Elon Musk Under Fire After GAO Audit Found Treasury Payment System User Was Granted Delete Access

The row over Elon Musk's brief leadership of the Department of Government Efficiency (DOGE) has burst back into the spotlight after a government audit revealed that a user was temporarily granted the ability to create, modify and delete data within a highly sensitive Treasury payment system.

The findings sparked a heated exchange in Congress, where Treasury Secretary Scott Bessent accepted responsibility for the incident but struggled to satisfy lawmakers demanding detailed answers about how millions of Americans' personal information was protected.

GAO Audit Raised Questions Over Treasury System Access

The controversy centres on a Government Accountability Office (GAO) audit examining access granted to a Treasury Department payment system managed by the Bureau of the Fiscal Service. The system processes trillions of dollars in federal payments and stores highly sensitive information, including Social Security numbers and bank account details belonging to millions of Americans.

During the hearing, Congresswoman Suzan DelBene questioned Treasury Secretary Scott Bessent over his decision to authorise DOGE access to the system in January 2025.

DelBene cited the GAO's findings, which concluded that one employee was inadvertently granted temporary permissions allowing them to create, modify and delete information within the payment system.

Those findings immediately raised concerns because such permissions go well beyond simple viewing rights. While the audit did not conclude that data had been altered or erased, it found that the elevated access should not have been granted in the first place.

The issue has added to criticism surrounding DOGE, the government reform initiative previously led by Musk, which opponents argue moved too quickly without putting adequate safeguards in place.

Bessent Accepted Responsibility but Faced Tough Follow-up Questions

The most striking moment of the hearing came when DelBene repeatedly asked Bessent whether he accepted responsibility for the security failures identified by the audit.

'I will take responsibility,' Bessent replied after several direct questions.

However, the exchange quickly became more contentious when he insisted the access had effectively been 'read only' and that users had no ability to edit the system.

DelBene challenged that explanation, pointing to the GAO report that stated temporary create, modify and delete permissions had in fact been granted.

She pressed the Treasury Secretary to explain what concrete steps had been taken to prevent a similar incident from happening again.

Bessent responded that the department had 'tightened protocols' and improved system access controls, but he did not provide specific details about the changes or explain whether the problematic permissions had been fully reviewed.

As the questioning continued, DelBene argued that vague assurances were insufficient given the sensitivity of the information involved.

Security Concerns

According to the report, the file was sent to external DOGE personnel without encryption, creating additional concerns about how sensitive government payment information was handled.

DelBene criticised the apparent lack of disciplinary action following the incident, arguing that failing to hold employees accountable risked weakening confidence in federal data security.

Bessent pushed back, stating that USAID was not under Treasury's direct oversight and questioned why the issue was being raised during his testimony.

DelBene responded that the payment information still involved Treasury systems overseen by the Bureau of the Fiscal Service.

The GAO ultimately issued six recommendations designed to strengthen security controls. Treasury agreed with three recommendations but did not clearly state whether it accepted or rejected the remaining three.