#nationaldesignstudio — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #nationaldesignstudio, aggregated by home.social.
-
The #NationalDesignStudio Became a #DOGE Landing Pad. Now ‘Big Balls’ Is #Recruiting
WIRED spoke with an engineer who was interviewed by Edward “Big Balls” Coristine for a government engineering role at the NDS, the #WhiteHouse agency staffed by other DOGE veterans.
#Musk #bigballs #security #privacy #ndshttps://www.wired.com/story/national-design-studio-doge-recruiting/
-
Here's the link to The Guardians' reporting on Trump's #DOGE / #NationalDesignStudio secretly injecting 3rd party tracking software into Federal websites such as those ostensibly used by "Americans with prescription drugs, children’s savings accounts, passports and voter registration", eg. "ndstudio.gov, trumprx.gov, realfood.gov and trumpaccounts.gov."
https://www.theguardian.com/us-news/2026/jun/28/government-website-visitor-tracking-surveillance-fears -
Not just #DOGE , because Trump's #NationalDesignStudio open sourced #Rampart *EVERYONE* on the planet now has access to the source code & knows exactly where #Trump's MiniLM #AI stores *ALL* the PII it ever detected. A "Mallory" only needs access to your browser cache, physically or remotely, to copy the entire Session Table of every detected PII label, value, & token pair. FYI basically every website under our Sun uses your browser cache, including Hugging Face.
https://www.techradar.com/pro/security/hugging-face-platform-hijacked-to-send-out-android-malware-heres-what-we-know-so-far -
For members of the #TrumpAdministration using #Rampart (likely unknowingly) for chats, specifically with #AI like #DOGE installed *EVERYWHERE* in the Federal government before courts dissolved it & it's members transferred to #Trump's #DOGE2.0 The #NationalDesignStudio to continue that work, this means somewhere in your browser cache there's a table of every labeled PII you ever entered. Trump's DOGE goons can probably retrieve it anytime they imagine you leaked. #Whistleblowers beware!!!
-
Looking at the actual MiniLM #AI PII classifier source code #Trump's #NationalDesignStudio #Rampart runs you can find it's downloaded from Hugging Face, a popular AI dev distribution system. Hugging Face was in the news earlier this year for a serious Cybersecurity breach. I don't see anything obvious preventing *any* "Mallory" from side loading their own hacked worker "AI-in-the-middle" to exfiltrate the entire plain text label & PII value pair session table.
https://github.com/nationaldesignstudio/rampart/blob/95798af5b0e71759e06f912d0a8b719f31744b20/src/ner/classifier.ts#L76 -
Timing of this #Trump White House #DOGE / #NationalDesignStudio vibe coded AI-in-the-middle PII redaction "filter" is also super sus. As thedreydossier OG reported the #TrumpAdministration was busted for illegally inserting secret 3rd party tracking scripts into federal government websites they've redesigned badly, likely also with AI, which was just confirmed by The Guardian & quietly removed. Looking at the code I doubt "privacy" was the primary objective...
https://substack.com/@thedreydossier/note/c-285724018?utm_source=notes-share-action -
This is "interesting", former #DOGE goons now working at #Trump's #NationalDesignStudio publicly released an in browser MiniLM #AI redaction privacy filter ostensibly to invisibly prevent unintentional leaking PII to AI chat bot sessions the government uses. It stores a chat sessions' filtered PII as a value key pair in the browser cache so it can replace sent PII text with generic labels like [GOVERNMENTID-1] then restores it in the AI response. I've got concerns.
https://ndstudio.gov/posts/say-hello-to-rampart -
"The National Design Studio, staffed by Doge veterans, installed visitor-tracking software on vital federal websites"
#TrumpAdministration #Trump #NationalDesignStudio #NDS #Doge #FederalWebsites #GovernmentWebsites #USA #JoeGebbia #PostHog #VoterRegistration #ElectionAssistanceCommission #EAC #NASED #TheGuardian #Surveillance #WhiteHouse #fascism #Faschismus #Privacy #Tracking #TrackingTool
-
Apparently get a non-US passport any way you can.
-
While I was finishing this piece, I typed passports.gov directly into my browser,
just to see what was there.A sign-in page came up:
enter your email and we will send you a six-digit code.
No State Department seal.
No agency name.
No privacy notice.
Just a black button that says Send code.The owner of passports.gov is the Executive Office of the President, White House Office.
The State Department does not own this domain.
The security contact field is blank.
The first certificate was issued May 5, three weeks ago.
Based on what I can see in the staging environment,
the next step will ask Americans to upload their passport photo through a White House-controlled website,
on the same Cloudflare account,
by the same people,
with no privacy notice on file.A passport photo is biometric quality.
Linked to your identity through Login.gov.
Collected through infrastructure the White House owns,
sealed from public view.They are building it this week.
Here is what the structure looks like from the outside.
Section 3161 hides the staff so they do not appear on salary reports or file financial disclosures.
The Executive Office of the President has no inspector general.
There are zero required privacy disclosures filed across all twelve programs
and no published contracts with any outside vendor.Forty federal websites run behind one personal Cloudflare account.
And the Presidential Records Act seals everything for twelve years the day this administration ends,
-- meaning until 2040, no one outside the White House can see who works there,
what they collected,
or where any of the data went.What this office is doing is taking the parts of the federal government that touch you directly,
your prescription,
your voter registration,
your passport,
your federal login,
out of the agencies that legally own them
and rebuilding them on White House infrastructure.Vote.gov belongs to the Election Assistance Commission,
and the studio built a copy.Passports belong to the State Department, and the studio is building a replacement this week.
Login.gov belonged to GSA, and the studio’s guy runs it now.
Trump has said publicly that this infrastructure is for other presidents,
and he is right about that.It is the one thing in this story I take him at his word on.
The infrastructure outlasts him.
Whoever wins in 2028 inherits the websites,
the vendors,
the data,
and the hardware,
sealed and waiting.There is a gold three-dimensional eagle on the homepage of TrumpRx,
clutching a ribbon in its talons.You are looking at the eagle.
Something is being built underneath the government you think you have,
on infrastructure you cannot see,
by people who answer to no one,
collecting everything.I wish, still, that I were being metaphorical.
#votegov #ndstudio #NationalDesignStudio #surveillance
https://thedreydossier.substack.com/p/i-found-a-second-votegov-and-its -
In October 2025,
Bobba got on a recorded conference call with state election directors from across the country
and presented a federal voter registration system the studio was building.Voters would register through a federal portal,
their identities verified through Login.gov,
their citizenship verified through DHS’s SAVE database,
their registrations transmitted to the states.A state election director asked him what data the federal government would retain.
He said, on a recording, in an election year:
I don’t know what they retain and what they are logging.The person presenting a federal voter registration system to state election directors did not know what data his own system kept on American voters.
After Florida 2000, Congress passed a law creating the "Election Assistance Commission" specifically because both parties agreed that voter registration cannot live inside the White House of any sitting president.
The sitting president should not have visibility into who is checking their registration in the weeks before an election that decides whether they keep their job.
So Congress built a wall, and today vote.gov is registered to the Election Assistance Commission.
As of this writing, that wall is still standing.
But in the certificate logs,
underneath the studio’s unannounced sites,
was a working preview of vote.gov,
built inside the studio’s staging environment, behind the same Cloudflare login,
isolated deliberately.The certificate appeared on April 10, 2026.
Weeks before that certificate appeared,
this administration signed an executive order requiring DHS,
the Social Security Administration,
and the SAVE program to construct a federal citizenship-verified voter list,
with a deadline of ninety days from signing.That deadline is weeks away.
When the order was challenged in federal court, the Department of Justice told the judge the agencies named had not yet begun preparation and were still in the deliberation phase.
The certificate is dated April 10.
DOJ told a federal court the infrastructure does not exist.
Both of those cannot be true.
Either DOJ lied to a federal judge,
or the studio is building a replacement for the country’s voter registration site without telling the agencies whose work it would replace.There is no third option.
#votegov
#ndstudio #NationalDesignStudio #surveillance
https://thedreydossier.substack.com/p/i-found-a-second-votegov-and-its -
All of it ran through the same private Cloudflare account.
Using Cloudflare is not unusual for a federal agency.
Running forty federal websites through one personal account is another matter.
The login screen for the gated preview sites read:
loveisaskill.cloudflareaccess.com.
"Love is a skill" is a phrase Gebbia has used publicly to describe Airbnb’s design philosophy.
It is the kind of name you give an account when it belongs to you personally,
not when it belongs to the federal government,
and federal infrastructure is supposed to be owned by the agency,
not the person running it.The people running this office are worth knowing about.
In 2025, a federal judge ordered everyone at DOGE blocked from accessing personnel records at the Office of Personnel Management.
Three people were granted exceptions and allowed to keep their access anyway.
Greg Hogan was one of them.
The administration argued he was essential to ongoing system work,
the judge accepted it,
and Hogan kept his access to federal personnel records
while every other DOGE staffer was locked out.He has since moved from DOGE into the National Design Studio,
where he was recently promoted to run Login.gov,
the federal government’s sign-in system.If you have ever applied for a federal job, requested your Social Security records online,
or filed for federal benefits,
you have used it.It scans your biometrics.
More than 150 million Americans have accounts.
The man who survived the OPM injunction now runs the front door to your federal identity.
A second name from the original DOGE cohort,
Akash Bobba,
now serves as the official security contact for the US African Development Foundation,
a small independent agency the administration tried to dissolve by executive order earlier this year.The dissolution got tied up in court,
the agency technically survived,
but most of its staff was cleared out.Bobba now holds the credentials controlling the agency’s website,
its email, and its security configuration,
-- which means a White House staffer has full visibility into who applies for grants, who gets approved, and who inside that agency is talking to whom.#NationalDesignStudio #surveillance #JoeGebbia
#GregHogan
#AkashBobba -
When the federal government collects information about citizens,
the law requires specific things first.Privacy disclosures.
Notices in the Federal Register.
Published contracts with outside vendors.
I went looking for all of it across twelve National Design Studio programs and found none of it,
not a single required document filed across any of the twelve.Every missing document is, by itself, a violation of federal law,
and these are the laws Congress wrote after Watergate to make sure the federal government could not run secret surveillance programs on its own citizens.The only document they did publish is a privacy policy on TrumpRx,
and it contradicts itself two paragraphs apart.The first paragraph says PostHog records the pages users visit and the medications they view.
Two paragraphs later, it says they do not collect health or medical information.
A federal health website is lying to the people using it and cannot even keep the lie consistent.
I wanted to know whether there were more sites the studio had not announced.
Here is something almost nobody outside of security research knows.
Every website with a padlock in the address bar has a certificate,
and there is a rule that every certificate issued anywhere in the world must be logged in a public ledger the moment it is created,
no exceptions.The side effect of that rule is that every new website on the internet,
even ones nobody has announced and even ones hidden behind a login,
leaves a public fingerprint the moment it is built.There is a free search engine called 👉 crt.sh where anyone can look up those logs.
I typed in the studio’s domain, and underneath the public sites I already knew about were roughly forty more, unannounced,
with no links pointing to them from any public page.I started reading the names.
Sites that looked like they belonged to the State Department.
To NASA.
To the Department of Homeland Security.And then two that stopped me cold:
a working preview of vote.gov,
and something called fbi-kirk-tipline.
I checked the public ownership records for every subdomain,
and every single one traced back to the same place,
the Executive Office of the President.The National Design Studio had built pre-launch versions of websites belonging to other federal agencies
and registered all of it to the White House.
#NationalDesignStudio
#surveillance #gebbia
#PostHog #AutoMonitor -
AN OFFICIAL EMBARRASSMENT OF THE UNITED STATES GOVERNMENT
-
“Ultimately, the National Design Studio solves a problem no one actually has.”
It doesn’t even do that. From a design, coding and user experience point of view, it’s a steaming pile of shit.
https://www.archpaper.com/2025/12/national-design-studio-rebrand/
-
Raw Story: Alarm raised as experts suspect ‘sloppy code’ used to overhaul sensitive govt websites. “Attempting to meet Donald Trump’s July 2026 deadline to refashion government websites where private information is shared, the National Design Studio is creating websites that have all the appearances of leaving gaping security holes, experts warned Monday.”
-
#DOGE Operatives Are Joining Donald Trump’s New #NationalDesignStudio
Many proposed #NDS projects were already in the works from federal workers who were let go earlier this year. Now, DOGE is getting involved.
#Trump #muskhttps://www.wired.com/story/doge-operatives-joining-national-design-studio/
-
The National Design Studio Is a Scam
https://www.chrbutler.com/the-national-design-studio-is-a-scam
#HackerNews #NationalDesignStudio #Scam #DesignScam #OnlineScams #DesignCritique #HackerNews