The Trump administration began with a commitment to optimizing the efficiency of the government, introducing the so-called DOGE (Department of Government Efficiency) under Elon Musk. On the first day, I wrote that I would follow DOGE’s actions in optimizing the administration with interest. This is a task that we also face in my country, with electronic governance (of which I was the first minister a few years ago) being a tool for achieving it. On the very day of the executive order establishing DOGE, I wrote to colleagues that “the risky part is that every structure will have to provide them with all non-classified documents” and that they would likely be looking for “skeletons in the closet.”

This risk, stemming from the executive order, quickly materialized due to the actions of DOGE employees (or USDS, which is the U.S. government’s structure for IT services and administrative modernization, serving as DOGE’s main tool). The employees, who are 20-25-year-old IT specialists, gained access to the systems and databases of several key government agencies, even connecting external hard drives. This understandably sparked serious dissatisfaction.

I do not dispute the right of specialized units to access data and documents across the entire government structure. Nor do I deny the right to close down agencies or terminate funding — these are political decisions (subject to judicial oversight) that any administration has the authority to make (and anyone has the right to disagree and challenge them in court). Moreover, fraud and inefficiencies in spending certainly exist, and an external review of the data and systems can identify and eliminate them.

However, for the implementation of these political decisions to be legitimate, it must follow established rules. It appears that Musk and his team operate under the assumption that they are above the rules — that they can take over the information systems of key government agencies through “top-down orders.” These actions should be carried out properly, especially considering information security and data protection, which are at risk from such ad-hoc measures.

I will give a few examples from my time as a minister and earlier as an advisor, fully aware that the scale is different, but there are still direct parallels.

The first example is the SEBRA system (the Ministry of Finance’s budget payment system). Musk is essentially doing the same thing — extracting and potentially publishing all state payments. However, we did it properly — together with the Minister of Finance, we submitted a proposal to the Council of Ministers, designating payment data as a priority data set for publishing in compliance with the Access to Public Information Act. This decision mandated the Ministry of Finance to provide the data to the Ministry of e-Government in a specific format so that it could be processed, anonymized, and published. The Ministry of Finance assigned its contractor to extract the data and securely transfer it to the Ministry of e-Government, where the processing and anonymization code was published in an open-source repository. At the same time, a working group revised a regulation so that the system would automatically publish such data. If we had done it Musk’s way, I would have simply sent one of my advisors and told them, “Plug in your laptop and get access to the database.” And that would have been wrong.

In 2016, we opened up data from the Commercial Register and the Public Procurement Register. At the time, I was an advisor, but the data disclosure process involved official correspondence, and I never had direct access to the database — experts from the respective institutions wrote queries to the database, and I received a test database without real data to work on queries for extracting information. We also published the code for the anonymization tool used for the Commercial Register. This was all done based on formal communication and a valid legal basis under the Access to Public Information Act.

As a minister (after all, officially elected by parliament, not an unknown staffer), I requested to review systems, but someone else always had to show them to me while I only directed what should be extracted (even though I could have found it myself much faster). In these cases, the approach was always, “Sit here and show me,” or “Based on [legal grounds], please provide me with the following data,” rather than “Give me access to the database and leave.”

Yes, there is a risk of refusal or sabotage of these efforts, but there are other measures for that—those who sabotage can be reassigned or even dismissed if they do not comply with a lawful order. However, Musk is doing the opposite—his people (who have not been properly vetted) are acting unlawfully and are being stopped by the courts. In some places, internal teams correctly identified these actions as an “insider threat.” In principle, every access to databases should leave a trace, and access for usual personnel must be controlled because data misuse is not only a risk from external actors but also from internal ones.

The issue of access to institutional data is extremely serious and cannot be resolved with a blanket statement in a presidential executive order. It is serious because a modern state largely depends on its registers and databases. Their security and integrity are fundamental to many policies and their success or failure. “Seizing control” of registers and databases is a key instrument of power with significant negative potential.

Beyond this specific case, if DOGE had acted “properly,” it would have taken a few more months, but its actions would have had more legitimacy. However, in line with other actions and statements by the U.S. government, it seems that they are more interested in breaking things and disregarding the rules.

Government efficiency is important, and reducing unnecessary expenses is a valid political priority. But while it can be a legitimate goal, it can also serve as a cover for less honorable intentions. And although I come from the startup world, I do not agree with the approach that a government and administration can be run like a startup. In startups, the goal is to move fast, even at the risk of breaking things. In the public sector, it is more important not to break things, because lives and livelihoods depend on it, which is why processes take longer. And when you act by breaking the rules under the justification of political expediency, you do not build trust — you destroy it.

The post Assessment of DOGE and Musk’s Actions for Government Efficiency appeared first on Bozho's tech blog.