Myrtle Beach, SC
The most informative thing that happened in this story happened three days ago and almost nobody has covered it.
David Lebryk was the Fiscal Assistant Secretary at Treasury. Career civil servant, more than thirty years in the department, the senior official responsible for the systems that move federal money. He was placed on leave and announced his retirement on Friday, after resisting the new team’s request for access to the payment systems.
I work in marketing and I know what a resignation like that signals. Thirty-year career officials at that level do not leave over policy disagreements. They outlast administrations; that is the entire point of them. When one of them is pushed out inside two weeks over a specific request, the request was outside anything he had seen in thirty years.
That is not proof the request was improper. It is evidence about magnitude, and it came from the one person in the building best placed to judge it.
So my answer to the question as posed is that it is framed too generally. “Access to payment files” covers everything from a spreadsheet of last year’s disbursements to standing credentials on the system that executes payments, and the difference between those two is the entire argument.
An auditor needs the first. Nobody has ever needed the second.
The Bureau of the Fiscal Service moves something on the order of five trillion dollars a year — close to ninety percent of every federal payment. Social Security, tax refunds, veterans’ benefits, contractor invoices. It is not a filing cabinet. It is the pipe.
Give the review team the records. Every record. Contracts, headcount, payment history, going back as far as they want, and give it to them fast, because the case for the audit is strong and the case for delay is mostly institutional self-protection.
Do not give anybody credentials on the pipe.
Those are two different requests and the last two weeks have been conducted as though they were one.
Novi, MI
An auditor with plant access is normal. An auditor who can start a line is not an auditor. That distinction is the whole of this question and I want to be precise about it, because in my trade it is the difference between a quality function and a hazard.
There are three levels of access and everybody arguing this week is collapsing them.
Read access to records. The auditor can see what was paid, to whom, under what authority, when. This is ordinary, it is what every inspector general has, and there is no serious argument against granting it to a review team. It is also, for what it is worth, mostly available already — federal spending data is published.
Read access to live systems. The auditor can see the running system rather than a report about it. More sensitive, more useful, and defensible with logging.
Write access. The user can modify records, alter payees, change amounts, or halt disbursements.
The public argument this week has been about whether the team should have “access.” Treasury has said the access is read-only. Others have questioned that. Whichever is true, notice that the answer determines everything and it took a week of reporting to even get the question asked.
In a plant, we do not debate whether the quality auditor may enter. We debate what his badge opens. He gets the door to every record and he does not get the key that starts a press, and nobody finds that insulting because nobody confuses inspection with operation. The auditor who insists on the key has stopped being an auditor.
That is the framework and it produces a clean answer here.
Grant the records without limit. All of them, immediately. The case for the audit is strong and the resistance to it has been partly legitimate and partly the ordinary institutional reflex of a department that does not want to be examined.
Grant live read with logging, on request, with a named official signing.
Grant write access to nobody, under any circumstance, for any reason, ever — and say so in writing so the question stops being asked.
And the reason is not about anybody’s honesty. It is that write access on a system disbursing five trillion dollars a year is the highest-consequence privilege in the United States government, and the number of people who need it is small, trained, and audited. Adding anybody to that list for any reason other than operating the system is an unnecessary increase in the largest single-point risk the government has.
That is not an argument against the audit. It is the argument for the audit being done properly, and the people making it should be treated as allies of the review rather than as obstacles to it.
Orange County, CA
Orange County has done a lot of diligence and the standard is straightforward: read access, logged, scoped. What I want to add is that this question already has a governing statute, it is being litigated as I write, and nobody in this Forum has named it.
The Privacy Act of 1974.
It governs federal records about individuals held in systems of records, and it restricts disclosure of those records without the individual’s consent. It contains an exception for agency employees who need the record in the performance of their duties. That exception is the entire legal fight — whether personnel detailed to a new organisation, some of them very recently hired, qualify.
A suit was filed today in the District of Columbia by federal employee unions and a retirees’ group, on exactly that theory, seeking to stop the transfer of Treasury payment records.
So the question is not open. It is pending, and it will be answered by a judge within days rather than by a Forum within weeks.
I raise it because in finance we do not begin a diligence argument by debating whether access is a good idea. We begin by reading the confidentiality provisions in the underlying agreements, because those determine what is permissible regardless of how sensible the request is.
Here the provisions are statutory and they were written in 1974 for precisely this scenario: a new group inside the executive branch wanting to see records the government holds about private individuals.
The people making this request are not wrong that the government’s payment records should be examinable. They are wrong, or at least premature, if they think examinability is a matter of will rather than of law.
Now my substantive view, which the statute does not resolve.
Contract data and headcount records raise almost no Privacy Act problem and should be handed over immediately and completely. Contractor data is corporate, procurement records are public in large part, and position and grade data is not sensitive. Any delay on those is obstruction and should be called that.
Payment records about individuals are different in kind, because the system holds bank account numbers, addresses, and benefit amounts for essentially every American. That is not a difference of degree.
So the diligence answer: unrestricted access to the corporate and organisational side today, and Privacy Act-compliant access to the individual side — which is achievable, with aggregation, de-identification, and named-official approval, and which takes weeks rather than an afternoon.
The team wanted an afternoon. That is the actual dispute and it is a dispute about speed rather than about principle.
Bismarck, ND
Run it the other way, which is the only way to test whether the objection is principled.
A Democratic administration stands up a new outfit staffed by outside volunteers, some of them very young, none Senate-confirmed, and within two weeks they are asking for access to the Treasury system that disburses five trillion dollars a year — including the bank details of every Social Security recipient in the country. The career official who has run those systems for thirty years objects and is placed on leave and retires.
Would I accept “they need to see the books”? I would not. I would ask what kind of access, logged how, approved by whom, and I would ask why a thirty-year civil servant thought it was worth his career to say no.
Same answer here.
In compliance work we do not treat access as a single permission. We treat it as a matrix — who, what system, what privilege, logged how, approved by whom, for how long. Every regulated institution in America runs that matrix, and any examiner who demanded blanket credentials would be refused by a bank and the refusal would be correct.
The government has the same matrix. It is called least privilege and it has been federal policy for decades.
So what should the answer be?
Records: yes, fully, now. The audit is legitimate and the resistance to being audited is not.
Live system read: yes, with logging and a named approving official.
Write privilege: no, and the reason is not distrust of anybody in particular. It is that the number of humans who can alter federal disbursements should be as small as it can possibly be, forever, regardless of who is president.
And one more entry. The career official who objected should be interviewed rather than removed. Whatever he saw, he is the only person outside the request who understood both the system and the ask. Pushing him out was the single worst decision anybody has made in this file so far, because it destroyed the one source that could have settled whether the request was reasonable.
Clermont, FL
The books, yes. The keys to the register, no. That was my instinct and I want to say what an auditor actually needs, because I have hired a few.
An auditor needs the record of every transaction, the authority under which it was made, and the ability to trace a payment from authorisation to disbursement. That is it. Give him those three things and he can find anything that is findable.
He does not need the ability to make a payment, stop one, or change a payee. Not because he might do something wrong — because it is not part of the work, and every hour spent arguing about it is an hour not spent on the audit.
I consult with small businesses and the version of this argument I see most often runs like this. The owner brings in somebody to look at the books, the bookkeeper resists, and the owner concludes the bookkeeper is hiding something. Sometimes she is. Far more often she is protecting a control she was hired to maintain, and the owner has confused an objection to the method with an objection to the audit.
Both things happen and you cannot tell them apart from outside. What you can do is separate the requests. Ask for the records with no conditions — if she resists that, she is hiding something. Ask for the register key separately — if she resists that, she is doing her job.
Applied here: the team asked for both at once and the objection was to the second. Everything since has been argued as though the objection were to the first.
So my answer is that the audit should proceed at full speed and the access question should be split into its parts, today, in public. Records now. System credentials scoped and logged. Write privilege to nobody.
And I would say one more thing about pace. The instinct to move fast is not wrong. Reviews that take eighteen months produce reports nobody reads. But the fastest version of this is one where the records arrive in a week and nobody spends four months in court, and the way to get that is to ask for the thing nobody can reasonably refuse.
Jacksonville, FL
Ports give inspectors the manifest, not the crane controls. I want to describe what is actually being asked for, because the scale of it is not general knowledge and it changes how a reasonable person should feel about the request.
The Bureau of the Fiscal Service is the government’s disbursement arm. It issues close to ninety percent of all federal payments — on the order of a billion and a half transactions a year, moving something above five trillion dollars. Social Security. Veterans’ benefits. Tax refunds. Medicare reimbursements. Every contractor invoice.
It holds the bank routing and account numbers for essentially every household in the country that receives money from the federal government.
That is not a database. It is the single largest payment operation on earth, and it has run without a public failure for decades, which is the reason nobody has ever heard of it.
Now the request. A new organisation, stood up two weeks ago, staffed in part by people brought in from outside the government, sought access to it. The career official responsible — thirty years in the department, the senior civil servant over those systems — objected, was placed on leave, and retired on Friday.
Whatever one thinks of the audit, that sequence is the story.
Here is how a port would handle the identical situation, and I offer it because it is not a hypothetical framework — it is what every regulated critical system in the country actually does.
Inspectors get the manifest, the bills of lading, the customs entries, the labor records, and the maintenance logs. All of it, on request, without argument, because a port that resists an inspector is a port with a problem.
Inspectors do not get to operate the crane. Ever. Not because they are dishonest but because operating the crane requires training, certification, and accountability that an inspector by definition does not have, and because the crane is the thing that kills people when it goes wrong.
That is not an insult to the inspector. It is what the word inspector means.
So my answer: hand over every record, immediately, and treat any delay in doing so as obstruction. And treat any request for operating privileges on the payment system as outside the scope of an audit, because it is, and say so in writing so the question dies.
One further point about the man who left. He was the closest thing this country had to an expert witness on whether the request was reasonable, and he is now gone and will presumably say nothing. That was avoidable and it cost the audit more than it cost him. Somebody should ask him under oath what he was asked for. He is the only one who knows.
Las Vegas, NV
Auditors get the tapes. They do not get the drop key. That is a rule and I want to explain why it exists, because the reasoning transfers exactly.
In a casino, the count room has cameras on it, two-person rules, and access logs, and the auditor watches all of it. He can review every transaction back years. He cannot be alone with the money and nobody has ever thought that was an insult to auditors.
The principle is segregation of duties and it is not a courtesy. It is the reason the tapes mean anything. An auditor who could also move money produces an audit nobody can rely on, including an honest one, because the record no longer proves anything about anybody.
So the objection to write access is not that this particular team would steal. It is that granting it destroys the evidentiary value of the audit they came to perform.
That is the argument nobody has made this week and it is the one that ought to persuade the people making the request, because it is on their side.
Every finding this review produces will be attacked. The single strongest defence against those attacks is that the reviewers never had the ability to touch the underlying data. Give that up and the first contractor who loses a contract has a permanent talking point.
Now on the other side of it, because the house has an obligation too.
The records should have been handed over in twenty-four hours and they were not. Treasury spent a week on this and a thirty-year official was pushed out over it, and some part of that week was ordinary institutional foot-dragging by a department that has never been examined like this. I would not pretend otherwise. Resisting an audit is how you end up with an auditor who demands the drop key.
So: fast, complete, unconditional on the records. Nothing at all on the controls. And somebody should have said that out loud on day one instead of letting it become a fight about whether the audit was legitimate.
Knoxville, TN
The design answer here is an access matrix, and it is not a novel invention. It is standard federal practice that nobody applied.
Federal systems already operate on least privilege. Every user gets the minimum access required for the task, access is role-based, privileged access is separately approved and logged, and the log is itself protected. That is written policy across the government and it has been for years.
What appears to have happened is that a new organisation was stood up and nobody wrote its access role before people arrived. So the question became binary — in or out — when the existing framework would have answered it in an afternoon.
Here is the matrix anybody could have drafted on January twenty-first.
Tier one, procurement and organisational records. Contracts, obligations, lease data, position and grade rosters. No individual privacy interest of consequence. Full read, no approval required, available day one. Most of it is already public.
Tier two, aggregate payment data. Disbursements by program, agency, and payee category. Full read, logged, no individual identifiers.
Tier three, individual payment records. Names, addresses, account numbers, benefit amounts. Privacy Act system of records. Read only, individually approved by a named official, logged, with the purpose recorded and the log subject to inspector general review.
Tier four, transaction authority. Modify, halt, redirect. Restricted to trained and certified operations personnel. Not available to reviewers of any kind, permanently.
Four tiers. Any competent security officer produces that in a morning and it resolves the entire public argument, because it grants nearly everything the reviewers actually need and refuses only the thing no audit requires.
In public works terms this is a badging problem, and badging problems are only crises when nobody wrote the badge levels before the contractor showed up.
The reason it became a crisis is speed. Somebody decided that going through the access process would take too long and that the process was itself the obstruction. Sometimes it is. Here it produced a thirty-year civil servant leaving the department on Friday and a lawsuit filed this morning, which between them will cost more time than the process would have.
Write the matrix. It is late and it is still the cheapest thing available.
