The State Is Moving Into Private Hands

For six months, the keys to a piece of the federal government's cloud sat in a public GitHub repository. A contractor at Nightwing, a private firm doing cybersecurity work for the Cybersecurity and Infrastructure Security Agency, had uploaded 844 megabytes of production material — credentials for AWS GovCloud, SSH keys, plaintext passwords. The employee had switched off the tooling meant to catch secrets before they left the building. ^[1]

A national agency having 844 MB of production infrastructure material in a public GitHub repository for six months is as serious as a secrets leak gets. — Guillaume Valadon

It is the kind of incident that usually ends up as a footnote in a security blog. But it is the visible crack in something larger. Over the past year, the federal government has been moving its work into private hands at the same moment it has been emptying its own offices — and the two movements, running side by side, are producing a state that acts through proxies it cannot fully inspect. Start with the work itself. In March, the administration's cybersecurity strategy made the direction explicit.

We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities. — Donald Trump

This month the president signed a memorandum authorizing vetted private companies to conduct offensive cyber operations — surveillance and destructive effects — against foreign criminal organizations, with Justice Department and Homeland Security approval and a $1 million bond. ^[2] Offensive cyber was, until now, the exclusive province of government intelligence and military agencies. ^[3] Critics have a name for the new arrangement.

The American private sector is the most innovative and technologically advanced in the world, and its scale, speed, and capacity secure a critical offensive cyber advantage for the United States. — Donald Trump

The same movement runs through domestic surveillance. ICE has hired private contractors — Amivero and Guidehouse — to build dossiers on social media critics and unmask anonymous users, while the department issued hundreds of subpoenas to platforms like Reddit. ^[4] A separate, clandestine operation used Clearview AI's facial recognition and Cellebrite's phone-extraction tools to seize the financial records of labor unions and progressive groups. ^[5] Then there is the law itself. This month the Justice Department's Office of Legal Counsel issued an opinion that executive privilege — the shield that keeps presidential communications confidential — can extend to private advisers who are not federal employees. ^[6] It was applied within days to block a subpoena against Boris Epshteyn, a private attorney advising the president. And beneath all of it, the data. ICE has relied on Palantir for at least eight years to run the operational backbone of immigration enforcement. ^[7] Privacy groups are suing over the conversion of the SAVE immigration system into a citizenship lookup linked to Social Security records. ^[8] Now the other side of the ledger. The federal workforce has been cut to its smallest size since 1966 — more than 352,000 people removed. ^[9] Roughly a third of CISA's own staff is gone. ^[10] DOGE, run by the private citizen Elon Musk, was the most visible early instance of a private individual wielding state authority to restructure the government itself. ^[11] It would be a mistake to read all of this as one plan. The executive-privilege opinion covers advisers giving counsel, not companies running operations; the cyber authorization covers the latter. ICE's Palantir dependence predates this administration by years. And the courts have not simply stood aside — a federal judge in Rhode Island permanently blocked the dismantling of four agencies without congressional approval. ^[12]

By now, the question presented in this case is a familiar one: may the Executive Branch undertake such actions in circumvention of the will of the Legislative Branch? — T. J. McConnell

These are separate policies, made by different people at different times. What they share is a direction. The government is delegating its sovereign functions outward while hollowing the institutions that used to perform them — and the proxies doing the work sit outside the civil-service rules, the oversight, and the discipline built for federal employees. The question is whether that trade produces something better. The evidence so far points the other way. The bipartisan Cyberspace Solarium Commission warned that the administration is shifting coordination to the private sector without providing the resources or enforcement mechanisms to make it work. ^[13] And the GitHub leak is what that looks like in practice. The administration is not building a more capable shadow state. What it is producing is something harder to hold accountable and easier to break — a government whose cloud keys can sit in the open for six months because the person holding them was never inside the system built to catch that.