The Inner Monologue

There are few phrases less reassuring than “a former DOGE software engineer allegedly had Social Security databases on a thumb drive.”

According to a whistleblower complaint now under investigation by the Social Security Administration’s inspector general, a former Department of Government Efficiency employee reportedly told coworkers that he possessed two highly restricted databases and intended to share at least one with his next employer. The databases may contain information on hundreds of millions of living and deceased Americans. The former employee, the company, and the Social Security Administration dispute the allegation, so this remains an allegation—not an established breach.

Still, this is not the sort of disagreement that encourages a person to leave his credit file sitting out at room temperature.

I have therefore diagnosed myself with a reasonable fear of DOGE Bro Leakage, a modern information-age condition in which enormous collections of personal data appear to wander away from the institutions entrusted with protecting them.

The primary symptom is the sudden realization that your name, address, date of birth and Social Security number may have been handled by people whose résumés are considerably shorter than your grocery receipt.

Other symptoms include repeatedly checking your bank balance, becoming suspicious of unexpected authentication codes and muttering, “Why would anyone need that database on a thumb drive?”

Fortunately, there is a treatment.

Freeze everything.

I recently spent the better part of a day doing exactly that. Froze my credit files with Equifax, Experian and TransUnion. Those are the three everyone knows about—or at least the three everyone discovers after someone finances a bass boat in their name.

Then I kept going.

Froze my ChexSystems files, which banks may consult when someone tries to open a checking or savings account. Froze NCTUE, which helps telecommunications and utility companies decide whether someone claiming to be me should receive a new telephone line, cable account or electric service.

Froze Innovis. Froze LexisNexis. Froze SageStream.

At some point the process began to resemble preparing a supermarket for an approaching hurricane. If an organization maintained a file containing names, I wanted someone to place it in the walk-in freezer between the peas and the emergency pizzas.

As an American, I also obtained IRS Identity Protection PINs. These six-digit numbers help prevent someone from filing a fraudulent federal tax return using my Social Security numbers.

As an American, I also secured my online Social Security account, because discovering that someone else has created your government account before you do is an especially unpleasant way to begin a Tuesday.

I strengthened the security on my Gmail accounts, mobile-phone accounts, retirment savings accounts, other retirement accounts, my pay records, medical accounts and insurance accounts. I enrolled in our county’s property-record alert system in case someone files a suspicious document involving my home.

Next I opted out of prescreened credit offers, because nothing says “identity-theft starter kit” quite like an unattended mailbox containing a preapproved financial opportunity.

None of this makes me invisible. It does not remove my information from government databases, corporate databases, data-broker databases or the thumb drives of ambitious young men pursuing exciting private-sector opportunities.

It simply makes stolen information less useful.

That distinction matters. We are often told to “protect our data,” but ordinary citizens cannot protect information already held by Social Security, Medicare, the IRS, other governments, credit bureaus, banks, insurance companies, telephone carriers and dozens of data brokers most of us have never heard of.

We did not choose most of these databases. We cannot inspect their security. We cannot fire their contractors. We cannot verify that every person granted access possesses good judgment, mature supervision and an appropriately empty pocket where a thumb drive might otherwise fit.

The personal-responsibility lecture therefore has limits.

If someone breaks into a government system containing hundreds of millions of records, it is not because 300 million Americans simultaneously chose weak passwords. If insiders copy a database, no amount of individual vigilance can prevent the copying. Telling citizens to monitor their credit afterward is rather like telling passengers to carry buckets because the shipowner has stopped inspecting the hull.

Nevertheless, we still have to live on the ship.

A credit freeze is one of the strongest buckets available. It usually prevents a prospective lender from accessing the credit report needed to approve a new account. It is free, remains in place until lifted and can be temporarily thawed when the actual consumer wants a mortgage, automobile loan or credit card.

It is not complete protection. A freeze generally will not stop fraud involving an existing credit card, bank account or government-benefit account. It will not prevent phishing, account takeover or someone impersonating you with a telephone carrier. That is why the full treatment for DOGE Bro Leakage includes strong unique passwords, multifactor authentication, secured email and mobile-phone accounts, transaction alerts and immediate attention to unexpected authentication codes.

An unsolicited security code should be treated like smoke coming from underneath a closed door. Perhaps somebody burned toast. Perhaps the house is on fire. Either way, this is not the moment to roll over and go back to sleep.

The irony is that identity theft is often described as a consumer problem even though consumers did not assemble the giant reservoirs of information that make industrial-scale identity theft possible. Institutions collected the data, consolidated it, copied it, transferred it and sometimes handed access to people whose identities the public did not even know.

Then, when something goes wrong, the citizen receives a complimentary year of credit monitoring and an email beginning, “We take your privacy seriously.” Bullshit.

No organization has ever announced that it takes your privacy casually. It simply happens that some of them take it seriously only after losing it.

So I have adopted a new rule: Assume that the permanent information is already out there.

A password can be changed. A credit-card number can be replaced. But your date of birth remains stubbornly attached to the day you were born, and changing your Social Security number is considerably harder than resetting Netflix.

The sensible response is neither panic nor surrender. It is friction.

Create enough barriers that a thief holding your personal information cannot easily convert it into money. Freeze the credit reports. Freeze the banking report. Freeze the utility and telephone report. Secure the government accounts before an impostor does. Protect the email account that controls all the password resets. Lock the mobile account that receives the security codes. Obtain the IRS PIN that tells the tax system which “you” is actually you.

Then store the freeze confirmations, recovery codes and PINs somewhere safe. A freezer is useful only if you can find the handle when you legitimately need to open it.

DOGE Bro Leakage may eventually prove to be less disastrous than the allegations suggest. Perhaps the disputed data was never removed. Perhaps it was never shared. Perhaps every copy is fully accounted for.

I sincerely hope so.

But hope is not an identity-protection strategy.

Until government agencies can convincingly explain who accessed our information, what was copied, where it went and whether it was deleted, Americans should assume that their identifying information is no longer secret. We should behave accordingly—not fearfully, but deliberately.

DOGE Bro Leakage may be a national disease.

For now, the best home remedy is simple:

Stay calm.

Watch your accounts.

And keep your identity frozen solid.