Drey / NDS verification

Article correctly states vote.gov is currently EAC-owned. The 'second vote.gov' the article refers to is the preview subdomain vote-gov.previews.ndstudio.gov — verified separately via crt.sh.

An independent federal agency's cybersecurity point of contact is a personal-named mailbox at the White House design shop. Confirmed verbatim in the CISA registry.

NEW finding not mentioned in the Drey article: the singular form is held by the White House too. Worth flagging — likely same preparation pattern.

NEW finding: a shorter nds.gov vanity domain is held by EOP alongside the publicly-known ndstudio.gov.

Two-source connection: EO 14338 names 'America by Design initiative' as the program; CISA dotgov-data shows americabydesign.gov registered to EOP/WH Office.

The two results are EO 14338 (Aug 2025, NDS founding) and the Nov 2025 'Fostering the Future for American Children and Families' EO (Trump Accounts). No SORNs, no PIAs. Article's central procedural claim verified.

Article gives 'August 2025' as creation date. Exact: signed Aug 21, published Aug 26. EO number 14338 verified.

EO Sec 2(b) verbatim: 'there is established within the White House Office of the Executive Office of the President the National Design Studio (NDS) and, within the NDS, a new position entitled the Chief Design Officer. The NDS shall be led by an Administrator, who shall report to the Office of the White House Chief of Staff.' Structural reporting claim confirmed; the EO does not name Susie Wiles by name.

EO verbatim: 'in accordance with section 3161 of title 5, United States Code, a temporary organization headed by the NDS Administrator and dedicated to helping advance the America by Design initiative. The temporary organization shall terminate 3 years from the date of this order.' Confirmed verbatim.

Subtle but legally significant: the EO casts NDS as consulting/coordinating, not as the agency of record for federal websites. The article's framing that NDS is rebuilding federal infrastructure outside its proper agencies is therefore a factual claim about execution, not authority.

Article: 'Weeks before that certificate appeared [Apr 10], this administration signed an executive order requiring DHS, the Social Security Administration, and the SAVE program to construct a federal citizenship-verified voter list.' The article describes EO 14399 verbatim. EO signed 10 days before the April 10 cert (close to 'weeks').

Article: 'with a deadline of ninety days from signing. That deadline is weeks away.' Confirmed verbatim. EO signed 2026-03-31, 90-day deadline = 2026-06-29. Article published 2026-05-26 — about a month before the deadline. Article's 'weeks away' framing exact.

EO §2(a) verbatim: 'The State Citizenship List shall be derived from Federal citizenship and naturalization records, SSA records, SAVE data, and other relevant Federal databases.' All three sources the article names — DHS, SSA, SAVE — are explicitly invoked.

EO §2(a) creates the State Citizenship List with the requirement: 'The State Citizenship List shall be updated and transmitted to State election officials no fewer than 60 days before each regularly scheduled Federal election.' Article's framing — that voter registration is being rebuilt on White House infrastructure — is structurally supported here: the EO assigns the list-building to DHS, which is an executive-branch entity reporting to the White House, NOT the independent Election Assistance Commission that currently owns vote.gov.

Signed 2025-03-25, published 2025-03-28. Likely the order the article refers to as the one previously challenged in federal court before EO 14399 expanded its citizenship-list provisions.

Document number 2025-20406. The second NDS-mentioning Federal Register doc (along with EO 14338 founding).

Verbatim from /privacy-policy: 'PostHog Provides anonymous usage analytics to help us improve our service.' Then under 'Information We Do Not Collect': 'Health or medical information / Prescription details or medication history'. PostHog session replays by default include page URLs and click targets, which on a medication-pricing site IS medication information.

From AutoMonitor.getClickData() lines 222-249. Every <button>, <a>, [role=button], [onclick], or [data-track] click on a page running this script is reported with enough detail to reconstruct what the user did and where they clicked on the page.

Lines 274-334. Stack-traced error data + UA + console messages give the receiver detailed insight into the application's internals and the user's environment.

sendBeacon was designed exactly for telemetry-on-unload. It's the correct API for the use case AND the API that gives the user the least opportunity to interrupt data leaving the browser.

Review of all 540 lines. No reference to consent, DNT, opt-out, or any privacy disclosure. Combined with the Federal Register zero-SORN finding, this is a federal tracker shipped without any of the legally-prescribed disclosure mechanisms.

Direct fetch of nasaforce.gov homepage; HTML source contains 'posthog' references. The article's PostHog finding (about TrumpRx) generalizes to at least one additional NDS site we could verify by direct fetch.

Direct fetch of genesis.energy.gov; HTML contains both the AutoMonitor script tag (cdn.infra.ndstudio.gov/internal-analytics/script.js) and Google's gtag/googletagmanager markers. So the federal AI initiative reports user behavior simultaneously to a White House endpoint and to Google.

Homepage snapshots: 2026-06-01 (29,378 b, references cdn.infra...script.js x2) vs 2026-06-22 (29,987 b, 0 references). Nav links Work/History/Dev Index/Apply Now also removed. Remaining byte delta is Next.js rebuild churn. Note: script still served at the CDN, just no longer embedded.

Before 2026-06-01 (55,304 b, dated Feb 2 2026) vs after 2026-06-22 (50,525 b, dated June 11 2026). Removed: Usage Analytics block (pages/medications viewed, device/browser, referrer, error reports); PostHog vendor naming + 'hosted in the United States' + PostHog policy link; analytics-cookies disclosure; 'Block analytics' opt-out guidance. Caveat: removing the disclosure does not prove tracking stopped.

Every subdomain the article specifically calls out is present in the certificate transparency log. See notes/01-ndstudio-subdomains.md.

vote-gov.previews.ndstudio.gov: 20+ cert events Sep 2025 – May 2026. vote-gov-ndstudio.previews.ndstudio.gov: added Nov 17, 2025; renewed through 2026-05-13. This is production-grade upkeep, not an abandoned experiment.

51 non-wildcard subdomains end in ndstudio.gov. About 10 are publicly announced/visible (ndstudio.gov itself, hiring., projects., trumprx.ndstudio.gov etc.). That leaves ~41 unannounced — consistent with the article's 'roughly forty' framing.

Studio shipped new staging infrastructure the day after the article ran. Chat embeds suggest some kind of conversational or assistive UI is being added to one of the existing properties.

Singular and plural were registered as dotgov domains AND set up as staging hostnames on the same day. Strong signal these are paired production endpoints, not redundant placeholders.

Total: 26 (article said 26 as of 2026-05-26). First apex+wildcard certs issued at exactly the same minute on May 5.

Article said 'nine new certs for photo.passports.gov and photos.passports.gov issued in a single hour on May 26.' Counted nine such certs in our snapshot, all within 03:29 to 04:21 UTC (52 minutes). Confirmed exactly.

Production-quality rollout: apex → staging → auth/api → photo staging → production photo. New context not in article: staging photo was up by May 22, days before the production sprint on May 26.

Direct quote from line 8: this.endpoint = "https://analytics.infra.ndstudio.gov/metrics". Exact endpoint URL. Article's specific code-level claims confirmed to the line.

Found verbatim in ndstudio.gov HTML source. The script ships AutoMonitor and runs on every page load on the studio's own homepage.

Federal government website with a designer byline, confirmed verbatim in source HTML.

Direct HTTPS probe of each subdomain returns the loveisaskill SSO portal. Confirms article's claim that one personal-named Cloudflare account fronts 40+ federal preview sites.

trumpaccounts.gov 403 is notable — article mentions it as an active program but it's not publicly browsable. passport.gov (singular) being registered-but-dark while passports.gov (plural) is actively staged suggests one is the production target and the other a hold.

This is the technique used by application performance monitoring tools, but normally opt-in with a published privacy policy. Here it ships unconditionally to every visitor with no documentation.

Endpoint is configured to drop connections that don't match its expected session/origin pattern, returning nothing instead of the normal 401/403/405. Consistent with a collector designed to accept data only from its own embedded JS, and to be opaque to outside researchers.

Sister hostname cdn.infra.ndstudio.gov resolves normally (Cloudflare IPs 104.26.12.39, 104.26.13.39, 172.67.70.9). The cert for analytics.infra has existed in transparency logs since 2025-09-10 and was actively renewed for months. Three possibilities: (1) DNS was pulled in response to public scrutiny; (2) split-horizon DNS — endpoint only resolves on internal/VPN networks; (3) endpoint was never live publicly and the cert is preparatory. If (1), it's a meaningful behavioral signal — the operator responded to attention by pulling the data-receiver hostname from public DNS while leaving the script that posts to it.

DNS A record probe of ndstudio.gov, cdn.infra.ndstudio.gov, trumprx.gov, realfood.gov, genesis.energy.gov — every one resolves to Cloudflare addresses.

The site loads PostHog via /_astro/posthog.astro_astro_type_script_index_0_lang.HSTy8Lgu.js, an Astro-framework script bundling pattern. TrumpRx uses Next.js (_next/static/chunks/...). The studio runs at least two different SPA frameworks on its sites.

The nasaforce PostHog SDK explicitly sets api_host='https://us.i.posthog.com' when app.posthog.com is detected. So whatever telemetry PostHog collects is transmitted off the .gov perimeter to PostHog's US infrastructure.

First certs for *.api2.passports.gov issued 2026-05-28 20:55 UTC. By 2026-06-01 direct probes show api2.passports.gov returns HTTP 302 (still serving) while api.passports.gov returns 403. Looks like a deliberate version-bump migration with the prior endpoint locked off. Plausibly a response to scrutiny: someone probably probed api.passports.gov after the article, prompting them to move and lock.

crt.sh has had availability issues since the article (article itself noted it). Certspotter is incomplete relative to crt.sh because some CAs aren't in its watch set. For monitoring, the recommended fallback is crt.sh HTML form when JSON 503s; do NOT rely on Certspotter alone.

Diff run 2026-06-01 14:17 UTC. Five of seven watched URLs are byte-identical to the prior snapshot. The studio shipped api2.passports.gov but did not modify the AutoMonitor script or publish any privacy disclosure.

Direct probes 2026-06-03: live.gov → 301 → whitehouse.gov/live; crypto.gov → 302 → whitehouse.gov/crypto; saveamerica.gov → 301 → whitehouse.gov/saveamerica; ai.gov → 200, content served from cdn.prod.website-files.com (Webflow); launch.gov → TLS cert error (invalid certificate, not serving content). This is useful for the dossier because it answers the question 'how do you tell an NDS site from a non-NDS EOP site' with three clear distinguishing features: (a) Next.js / posthog.com fingerprint; (b) Cloudflare account ownership under loveisaskill.cloudflareaccess.com for staging; (c) registered to 'White House Office' suborg with blank security contact in the CISA dotgov CSV. Anything else is conventional whitehouse.gov plumbing or commercial-hosted content.

crt.sh %.ndstudio.gov: 65 names (2026-05-29) -> 66 names (2026-06-22); the sole addition is inference.ndstudio.gov. The name suggests model-inference/serving infrastructure, but the CT log only confirms a TLS certificate was issued for it. passports.gov crt re-fetch still 503'd.

Last successful fetch of the script itself: 2026-06-01, HTTP 200, byte-identical to the 2026-05-29 snapshot (sha cb4da9fc...) — no content change before it went dark. Sister hostname analytics.infra.ndstudio.gov (the AutoMonitor metrics endpoint, claim referencing its NXDOMAIN-style status) remains similarly unresolvable, unchanged. Narrows the outage window vs. the prior 2026-07-01 note (which only flagged the failure, no window or cert data); still consistent with either a deliberate DNS-record pull or split-horizon/internal-only DNS — the still-valid cert argues against full decommissioning but is not conclusive on its own.

Verified directly in the CISA dotgov-data CSV snapshot (sha 12d89fd59bcb…, fetched 2026-06-01). Line 1163: 'usadf.gov,Federal - Executive,United States African Development Foundation,African Development Foundation,Washington,DC,akash@ndstudio.gov'. By contrast, the older 'adf.gov' domain (line 1162) still lists 'schi@usadf.gov' as security contact. This means the USADF security contact was transferred from a usadf.gov mailbox to an ndstudio.gov mailbox — i.e., a White House staffer now has full visibility into USADF security configuration. Confirms a Will Hold claim directly from the federal authority.

Verified via Nextgov/FCW article 2026-04 ('GSA Taps Greg Hogan As Head of Government's Identity Proofing Service, Login.gov') and Government Executive coverage of his September 2025 OPM departure. The court order (from American Federation of Teachers v Bessent, 8:25-cv-00430 D. Md.) named Hogan as a permitted exception. Login.gov has 150M+ accounts. UPDATED 2026-06-04: The underlying preliminary injunction in AFT v. Bessent (8:25-cv-00430 D. Md.) was VACATED on 2025-08-12 by the Fourth Circuit (No. 25-1282). The Hogan-as-court-ordered-exception framing no longer applies. See claim 97. He remains head of Login.gov inside NDS; that part is unchanged.

Verified via Daily Beast ('Trump Gives Big Balls Edward Coristine Huge New Job to Undermine US Allies'), Newsweek (reports on his KGB-defector great-grandfather), and Wikipedia. His Tesla.Sexy LLC owns domains for an AI Discord bot operating in the Russian market. The 'Big Balls' nickname was self-given on Fox News (Watters 'Primetime').

Koller verified via WIRED reporting cited by NOTUS. Terrell verified via NOTUS, Techdirt, and executive-search news coverage. NOTUS reported that NDS would be 'populated by DOGE operatives affiliated with the General Services Administration' but did not publish a complete staff list. Coverage of Terrell's specific NDS position is less definitive than for Koller.

Verified in Borges disclosure footnote 3 (citing DevX, Wired, NYT). Coristine and Moghaddassi were previously granted access to vast sensitive immigration data at USCIS including the cloud-based 'data lake' (FedScoop, April 2025). In April 2025, Moghaddassi sent acting SSA Commissioner Leland Dudek a list of 6,300 immigrants whose parole status was revoked the same day; he claimed the list was only people on 'terrorist watch list' but it included eight minors, including a 13-year-old (NYT).

Verified in Borges disclosure (p.15 and footnote 3). Russo was replaced as CIO by Scott Coulter in late March 2025 and transitioned to special advisor role focused on 'modernizing archaic technology.' Per Borges and Wired/NYT reporting, Russo disregarded an investigation by SSA public servants into Musk/Trump fraud claims and instead directed Akash Bobba (then a 21-year-old former Palantir intern) to conduct his own analysis using SSA's personal data on Americans.

Verified in Borges disclosure footnote 3 (citing Wired 'This Is DOGE 2.0' 2025-07-10) and Borges' specific narrative of the June 10-25 escalation. Solly is one of three DOGE-affiliated names Borges directly emailed on 2025-08-11 for information about the cloud security concerns and received no response.

Verified in Borges disclosure footnote 3, cross-referencing Krebs on Security 2025-02-28, Bloomberg 2025-02-07, Wired 2025-02-06 / 2025-06-04 / 2025-06-24 / 2025-07-30. He became a full-time federal employee in May 2025 at GS-15 (one of the highest GS rates possible). The fact that Coristine has a documented history of cybercrime adjacency materially affects the gravity of his access to NUMIDENT-class data.

Per Borges footnote 3 citing NYT 2025-06-16. Bobba is described as 'a 21-year-old former Palantir intern.' The Borges→USADF→NDS dossier on Bobba is now multi-source: Wired profiled him as one of the original DOGE engineers, NYT documented his role in SSA fraud claims analysis, and the CISA CSV documents his current security-contact role over a federal agency website.

Named in Borges disclosure p.10 as one of the two specific DOGE members requesting the EDW access that bypassed SAM. Less public reporting on Rehling than on the other named DOGE-SSA personnel.

Davis is the senior on-record voice articulating the DOGE 'join all data across government' strategy. Distinct from the young-engineer cohort (Coristine, Bobba, Rehling, Solly) — Davis is the strategic operator. WaPo 2025-05-07 'Why Elon Musk's DOGE is amassing sensitive government data.' Borges disclosure also cites him at footnote 22 (Natanson, Menn, Rein, Siegel).

Flick's declaration is a sworn primary source — much stronger than journalist-reported allegations. Her direct quote in court filings: 'A disregard for our careful privacy systems and processes now threatens the security the data SSA houses about millions of Americans.' Her testimony is also referenced in Borges disclosure footnote 20 (citing The Guardian 2025-03-10). She is the inside-baseball witness with the most institutional knowledge of the very-early-DOGE-at-SSA fact pattern (late January through mid-February 2025).

Verified via PBS News and Mashable Feb 18, 2025. Resignation-in-protest by a federal-agency-head is a fact pattern that strongly corroborates Flick's and Borges's accounts. King and Flick worked alongside each other; both refused DOGE's demands; both left the agency in the same time window. Mashable reported the data potentially at risk: addresses, banking, medical records, income, employment history.

Per Wired (Greenberg 2025-02-06), Krebs on Security 2025-02-28, and Mediaite. The faster.pw 'multiple encrypted cross-border networks' finding extends Coristine's foreign-internet-infrastructure footprint beyond Russia to include China-market cross-border circumvention services. Per security-clearance experts cited in the same reporting, foreign-internet-business ownership of this kind would normally raise red flags on a background check. Coristine was full-time federal employee at GS-15 by May 2025, with access to Treasury data and (per Borges) SSA NUMIDENT data. Recorded in extension of claims 66, 80.

Verified by grep of the GovInfo cached snapshot of FR 2025-16396 (sha 77c63cfddf3e…). Quoted passage: 'Heads of agencies shall consult with the Chief Design Officer to implement the America by Design initiative at their respective agencies and shall produce initial results by July 4, 2026.' This reframes Will Hold's reading: the July 4 date is structural, not a hidden flip switch — but it does mean the cert-creation timeline we documented (passports.gov 2026-05-05, vote.gov 2026-04-10) is the runway to that deadline.

Verified via Federal Register API (we already have a cached metadata fetch at FR 2026-06601.json) and the GovInfo full-text fetch (sha aa45807ac575). EO directs DHS through USCIS, SSA, USPS, the Attorney General; references the SAVE program as a data source. EO does NOT explicitly name the National Design Studio, Login.gov, or the Election Assistance Commission — those are Will Hold's inferences based on infrastructure ownership.

Verified via Democracy Forward press release (April 2026) and Democracy Docket coverage. Democracy Forward has filed FOIA requests and a lawsuit seeking the agreement, the identity of the signer, two Hatch Act referrals, and SSA DOGE-team communications with election-denying organizations. SSA admits the bypass occurred but says it has not yet found proof the data was actually shared. This corroborates Will Hold's quote.

Verified via Immigration Policy Tracking Project and Civil Rights Litigation Clearinghouse. The Common Cause complaint refers to DOJ's 'Voter Registration Nationalization Policy' and alleges DOJ has demanded statewide voter registration lists from nearly every state.

RESOLVED 2026-06-03 afternoon. The DOJ filing Will Hold referenced is the 2026-05-01 Defendants' Combined Memorandum of Law in DSCC v. Trump (1:26-cv-01114 D.D.C., Doc 106-1). The filing's language is nearly verbatim to Will Hold's paraphrase. See claims 85-87 for the verbatim quotes and the sharper finding that the DOJ representation about SSA is in tension with the Borges-documented June 2025 unsecured NUMIDENT cloud copy that pre-dates EO 14399.

Will Hold explicitly credits Drey Dossier and links to her May 26 piece. Many factual claims overlap (40 unannounced subdomains, AutoMonitor 540 lines, PostHog routing, EOP ownership of passports.gov, loveisaskill.cloudflareaccess.com gate). Will Hold adds: specific DOGE→NDS personnel named, the EO 14399 timeline contradiction, the March 24 2025 SSA Voter Data Agreement, and the framing that the July 4 2026 EO 14338 deadline is the 'switch-over' date.

Borges is a career civil servant with 22 years U.S. Navy service (Air Medal with Combat Distinguishing Device, Operation Iraqi Freedom) and prior CDO roles at NAVAIR, GSA, OMB, and CDC. He named the disclosure as covering 'Violation of Laws, Rules & Regulations, Abuse of Authority, Gross Mismanagement, and Substantial and Specific Threat to Public Health and Safety.' Cited statutes: 5 U.S.C. § 2302, 5 U.S.C. § 1213, and 5 U.S.C § 7211.

Documented on Borges disclosure p.10-11. Specific databases accessed: PSNAP and SNAP MI. Requested by DOGE members Payton Rehling and Aram Moghaddassi. The EDW team discovered the unauthorized access on 2025-03-17 — three days after it was granted. Cited statutory violations: 26 U.S.C. § 6103 (Federal Tax Information), 18 U.S.C. § 1030(a)(2) (Computer Fraud and Abuse Act, exceeding authorized access).

Documented on Borges disclosure p.11-12. The Borges disclosure characterizes the restoration as 'circumvented the judicial mandate.' Statutory violations alleged: 18 U.S.C. § 1030 (CFAA), 5 U.S.C. § 552a (Privacy Act), 44 U.S.C. § 3551 et seq. (FISMA), 5 U.S.C. Appendix (Inspector General Act), and 18 U.S.C. § 371 (Conspiracy to circumvent a federal court order). Borges notes that the simultaneous timing of the unauthorized restoration AND the under-oath certification of compliance is the core of the allegation.

Sequence (Borges p.13-15): 2025-06-10 Solly requests cloud env for NUMIDENT; 2025-06-11 morphs to 'test environment' then to 'full administrative access'; 2025-06-12 OCIO career official issues high-risk Risk Acceptance Request Form; 2025-06-23 CIO approves DOGE admin access but NOT NUMIDENT transfer (pending technical discussions of security controls); 2025-06-24 admin access confirmed; 2025-06-25 Solly requests NUMIDENT transfer; Michael Russo (no longer SSA CIO — by then 'special advisor') approves with single word 'Approved….' on Borges p.15; 2025-07-15 Aram Moghaddassi self-authorizes Provisional ATO with language 'I have determined the business need is higher than the security risk associated with this implementation and I accept all risks associated with this implementation and operation.' NUMIDENT contains the SS-5 application data for every US Social Security card ever issued: name, place/date of birth, citizenship, race/ethnicity, parents' names and SSNs, phone, address. Late June 2025: no verified audit or oversight existed over the cloud, no one outside the former DOGE group had insight into code being executed against the live data. Statutory violations: 44 U.S.C. § 3553(b) FISMA, 5 U.S.C. § 552a(e)(1) Privacy Act, 18 U.S.C. § 1030 CFAA, 44 U.S.C. § 3554(b) FISMA continuous monitoring.

Borges p.17. This is a separate retaliation-pattern claim from the underlying data-access claim. Borges has since filed a Prohibited Personnel Practices complaint over alleged retaliation, per Katz Banks Kumin LLP reporting cited via web search. Worth tracking for any OSC or Merit Systems Protection Board findings.

The five cases, in filing order: (1) DSCC v. Trump, 1:26-cv-01114 (D.D.C., filed 2026-04-01) — DSCC, DCCC, DNC, Democratic Governors Association, Senator Schumer, House Minority Leader Jeffries; (2) League of Women Voters of Massachusetts v. Trump, 1:26-cv-11549 (D. Mass., filed 2026-04-02); (3) League of United Latin American Citizens v. Exec. Off. of the President, 1:26-cv-01132 (D.D.C., filed 2026-04-02); (4) NAACP v. Trump, 1:26-cv-01151 (D.D.C., filed 2026-04-03) — joined by Common Cause, Common Cause Education Fund, Black Voters Matter Fund; (5) State of California v. Trump, 1:26-cv-11581 (D. Mass., filed 2026-04-03) — 21 states + Mass + Va + DC + Gov Shapiro of PA. The three D.D.C. cases are consolidated. Note: Common Cause v. DOJ, 1:26-cv-01352 (D.D.C., filed 2026-04-21) — which we previously documented — is a separate case about DOJ's 'Voter Registration Nationalization Policy' demanding state voter rolls; it is not directly challenging EO 14399 itself.

Will Hold's specific paraphrase ("had not yet begun preparations and were still in the deliberative phase") is faithful to the filing's actual language. The DOJ filing cites three supporting agency declarations: Decl. of M. Mayhew (DHS), Decl. of J.B. MacBride (SSA), and Decl. of S. Monteith (USPS). Authoring DOJ attorneys: Brett A. Shumate (AAG, Civil Division), Eric J. Hamilton (Deputy AAG), Joseph E. Borson (Asst. Branch Director), Stephen M. Pezzi (Senior Trial Counsel, D.C. Bar 995500), Esam K. Al-Shareffi (Trial Attorney, D.C. Bar 90010174).

The Borges disclosure establishes that the live NUMIDENT cloud copy was approved 2025-06-25 by Michael Russo and the Provisional ATO was self-signed 2025-07-15 by Aram Moghaddassi — both pre-dating EO 14399 (signed 2026-03-31). The DOJ's representation in the May 1 filing that 'DHS has not yet made any determination' about Privacy-Act feasibility of SSA data sharing for the State Citizenship List is technically accurate at the SORN level (DHS publishes the SORN, not SSA), but elides that an unauthorized live mirror of the underlying SSA data is already in place under DOGE control with no independent security oversight. The contradiction is structural rather than verbal: DOJ tells the court the infrastructure does not exist; the relevant infrastructure does exist, just on the wrong side of FISMA. The vote.gov staging certificate (2026-04-10, issued by Let's Encrypt to an NDS-controlled hostname under loveisaskill.cloudflareaccess.com) is similarly not 'the infrastructure contemplated by Section 4(c)' — that is DHS-built; vote.gov is NDS-built — but it is evidence that the broader White-House-owned alternative voter-verification infrastructure is being stood up in parallel.

From the DOJ memo p.33-34: 'The agencies charged with creation of the State Citizenship List have until at least June 29, 2026, to comply with the Order—or, alternatively, to conclude that creating or transmitting such a list is not feasible or consistent with applicable law.' That deadline tracks exactly to the runway implied by our earlier-documented cert log (passports.gov 2026-05-05, vote.gov 2026-04-10) and the EO 14338 July-4 deadline. The two EOs' deadlines are five days apart (2026-06-29 for EO 14399 §4(c); 2026-07-04 for EO 14338 §3). The DOJ's ripeness argument depends on those deadlines not being met — but if they are met, the cert log timestamps will already have proven the implementation began before DOJ's May 1 representations. This is the structural setup Will Hold and Drey both pointed at; it is now on the public docket.

The whistleblower behind the Connolly letter is SEPARATE from Chuck Borges (Borges's disclosure came four months later, August 2025). This is the earlier whistleblower Will Hold's article alludes to. The 'master database' allegation is the strategic frame for what Borges later observed concretely at SSA. Connolly's successor as ranking member, Rep. Robert Garcia, sent a follow-up letter on 2026-03-09 expanding the investigation following Borges's explosive new allegations.

This is the synthesizing claim. Three independent primary sources (Connolly's whistleblower, Borges, and Davis-via-WaPo) describe the same strategy from different angles. The Will Hold / Drey infrastructure findings (NDS-controlled vote.gov/passports.gov preview, Login.gov under Hogan, etc.) are the receiving infrastructure for that consolidated data once it is moved out of the originating agencies and into White House control under Section 3161 staffing (no IG, no FOIA after 12 years).

Verified by negative-finding searches across the three primary federal procurement databases. Will Hold's specific framing was: 'his position requires no Senate confirmation, meaning no financial disclosures, and the office does not appear in any federal procurement database. As far as the official record is concerned, Joe Gebbia and the National Design Studio are basically nonexistent.' The procurement-database part is supported. The Senate-confirmation part is supported by EO 14338's text. The salary-disclosure part is supported by Section 3161 authority.

Per CalMatters 2026-04, Democracy Docket, ABC7 LA, and Cyberscoop. The Riverside seizure is real, the 600k figure is approximately accurate, and the ballot-seizure pattern in the broader 2024-2026 period is real — but the specific actor in Riverside is a sheriff (state-level law enforcement), not the federal DOJ. The conflation of state and federal seizures in Will Hold's piece is the only specific factual misframing we have found in cross-checking the article. The DOJ Maricopa and Wayne County seizures are separately attested (per WIRED reporting cited by Will Hold) and remain unverified by this dossier.

Important correction to claim 65. The original framing — drawn from Nextgov and Government Executive reporting on the original district-court order — overstated Hogan's current legal status. The district court (Judge Boardman) had carved out Hogan because his statutory responsibilities as OPM CIO under 40 U.S.C. § 11315 include managing OPM IT; he was the eOPF system owner; his access was 'in connection with the performance of duties assigned to him.' That reasoning is now moot. Hogan remains the head of Login.gov inside NDS; that part is unchanged and continues to be the dossier-relevant fact about him.