Open threads

Verification answers the question "is what the article said true?" Investigation asks "what else is going on?" These are the open investigative threads — the ones we couldn't close in this verification session, plus the new ones the technical analysis surfaced.

Update: Will Hold cross-check — 2026-06-03

On 2026-05-31, the substack This Will Hold published "Trump Is Replicating Vote.gov to Recreate Musk's 2024 Election-Rigging Platform," which explicitly credits Drey and reaches the same conclusion about NDS through independent investigation. We cross-checked every novel claim against primary sources. Most stood up. A few sharpened our reading of what we already had.

What got confirmed

• The July 4, 2026 "switchover" date is not a hidden feature flag — it is the statutory deadline written into EO 14338 §3. Grep of our existing GovInfo snapshot of the EO text (sha 77c63cfddf3e…) turns up the literal sentence: "Heads of agencies shall consult with the Chief Design Officer to implement the America by Design initiative at their respective agencies and shall produce initial results by July 4, 2026." Sharpens Drey's timeline: the certificate-creation dates we already documented (passports.gov 2026-05-05, vote.gov 2026-04-10) are the runway to that statutory milestone. claim 62
• EO 14399 is real and the 90-day timeline is accurate. Federal Register doc 2026-06601, signed 2026-03-31, published 2026-04-03. §4(c) requires DHS to "establish the infrastructure necessary to compile, maintain, and transmit the State Citizenship List" within 90 days. The EO does NOT explicitly name NDS, Login.gov, or the Election Assistance Commission — those are Will Hold's structural inferences about who would actually build that infrastructure. claim 63
• Akash Bobba is the security contact for usadf.gov via an @ndstudio.gov mailbox. Direct hit in the CISA dotgov-data CSV we already pull on every diff run. Line 1163: usadf.gov,…,akash@ndstudio.gov. Means a White House staffer now has visibility into USADF's security configuration and (by implication) who applies for grants, who gets approved, and who at the agency is communicating with whom. By contrast, adf.gov (the older domain at line 1162) still lists a usadf.gov mailbox as security contact — there has been a real transfer. claim 64 · people roster
• Greg Hogan now runs Login.gov from inside NDS, after being one of three DOGE exceptions to the OPM court order. Verified via Nextgov/FCW and GovExec. The OPM exception comes out of American Federation of Teachers v. Bessent, 8:25-cv-00430 (D. Md.). 150M+ Login.gov accounts. claim 65
• Edward "Big Balls" Coristine joined NDS after DOGE. Self-given nickname (Watters Primetime). His Tesla.Sexy LLC owns Russian-registered domains running an AI Discord bot in the Russian market. Per Newsweek, great-grandson of a former KGB agent who defected to the United States. claim 66
• Kaitlyn Koller and Zachary Terrell joined NDS from DOGE. Koller (former Senate Foreign Relations Committee aide) confirmed via WIRED reporting cited by NOTUS. Terrell (DOGE roles at HHS and NSF) confirmed via NOTUS and Techdirt; less definitive about his formal NDS slot than Koller. claim 67
• The March 24, 2025 SSA "Voter Data Agreement" is real. A DOGE team member at SSA signed it with an advocacy group (widely suspected to be True the Vote), bypassing SSA's internal data-exchange safeguards. SSA discovered the agreement in November 2025 during an unrelated review. Democracy Forward has filed FOIA-driven litigation seeking the agreement, the identity of the signer, and the SSA DOGE team's communications with election-denying organizations. claim 68
• Two federal lawsuits challenge EO 14399. League of Women Voters of Massachusetts v. Trump (1:26-cv-11549, D. Mass., filed 2026-04-02) and Common Cause v. DOJ (1:26-cv-01352, D.D.C., filed 2026-04-21). The Common Cause complaint refers to a "Voter Registration Nationalization Policy." claim 69

What's still blocked

• DOJ's "deliberative phase" filing. Closed 2026-06-03 afternoon — Will Hold's paraphrase is faithful to the DOJ's actual language in the 2026-05-01 Combined Memorandum in DSCC v. Trump, 1:26-cv-01114 (D.D.C.), Document 106-1. Verbatim DOJ quotes: "none of the possible future agency actions … have been finalized—and some have not even started" (p.1); "no such lists have been created, nor has any of the 'infrastructure' contemplated by Section 4(c) of the Order" (p.2); "the relevant agencies themselves are still deliberating" (p.9); "DHS has not yet made any determination that preparing these lists is either 'feasible' or 'consistent with applicable law'" (p.18). Filing supported by sworn declarations from DHS, SSA, and USPS. The sharper finding: the SSA half of that representation is in tension with the Borges-documented June-July 2025 unsecured NUMIDENT cloud copy that pre-dates EO 14399 entirely. See claims 85–87. claim 70 · claim 85 · claim 86 · claim 87
• The October 2025 recorded call with state election directors. Will Hold attributes a specific quote to Bobba — "I don't know what they retain and what they are logging" — said on a recorded call about a federal voter registration portal NDS was building. Web search did not surface the recording, transcript, or contemporaneous press. Most direct path: contact Will Hold directly via Substack — they have the quote and may have the recording. Alternative: open-records request to any state SOS office that participated, or to NASS / NASED.
• The NYT-sourced Musk "Lasers from space" texts. Tangential to the NDS-infrastructure story; relevant only as motive context. If chased, the NYT May 2025 source identifies the text content and timestamps; we'd want the underlying litigation exhibit.

Unblocked 2026-06-03

• The 300-million-Americans whistleblower claim resolved. The disclosure exists, is public, and is far richer than the Will Hold piece's one-sentence summary suggested. Filed 2025-08-26 by SSA Chief Data Officer Charles 'Chuck' Borges through the Government Accountability Project, to the U.S. Office of Special Counsel and four Congressional committees. Public, 18 pages. It names DOGE personnel (Coristine, Moghaddassi, Solly, Russo, Bobba, Rehling), provides exact dates of court-order circumvention, identifies the AWS-ACI Virtual Private Cloud holding a live copy of NUMIDENT, and quotes SSA's own internal Risk Acceptance Request Form labeling the project "very high risk" with explicit warning of "catastrophic impact." Now reflected in the People Roster and Claims 72–82. The "Cloudflare" specifically referenced in Will Hold is a separate March 7–17, 2025 episode of DOGE-SSA personnel using Cloudflare-routed links outside SSA policy; both episodes are real but they are not the same incident. people roster
• Five EO 14399 lawsuits, not two. Per Judge Talwani's 2026-04-28 order denying DOJ's motion to transfer: DSCC v. Trump (1:26-cv-01114 D.D.C., filed 2026-04-01); LWV-MA v. Trump (1:26-cv-11549 D. Mass., filed 2026-04-02); LULAC v. EOP (1:26-cv-01132 D.D.C., filed 2026-04-02); NAACP v. Trump (1:26-cv-01151 D.D.C., filed 2026-04-03; joined by Common Cause and Black Voters Matter); State of California v. Trump (1:26-cv-11581 D. Mass., filed 2026-04-03; 21 states + Mass + Va + DC + Gov Shapiro of PA). The three D.D.C. cases are consolidated under DSCC v. Trump. The transfer motion was denied; Mass. cases stay in D. Mass. claim 83
• Coristine's cybercrime adjacency is documented in primary sources. Per Borges disclosure footnote 3 (citing Krebs on Security, Bloomberg, Wired): Coristine was part of the cybercrime group 'The Com,' a Telegram handle associated with him hired a hacker in 2022 for a DDoS attack, he was fired from cybersecurity firm Path Networks for leaking secrets to a competitor, and his Tesla.Sexy LLC owns Russian-registered domains running an AI Discord bot in the Russian market. He is now full-time federal employee at GS-15. This goes beyond Will Hold's "Russia-adjacent hacker" gloss to actual prior incidents. claim 80

What we're now watching

Added to diff.py's WATCH list so they fetch every diff run:

• EO 14399 metadata at federalregister.gov/api/v1/documents/2026-06601.json
• EO 14399 full text at govinfo.gov/.../2026-06601.htm (for implementing-agency diffs)
• FR search for "State Citizenship List" (follow-on rulemakings)
• FR search for "America by Design" (status updates against the July 4 deadline)

Highest-leverage threads first

• The DNS for analytics.infra.ndstudio.gov has been pulled. The endpoint is in the AutoMonitor source code as the destination for telemetry. We confirmed it returns NXDOMAIN from three independent resolvers, while sister hostname cdn.infra.ndstudio.gov still resolves. Either it was pulled in response to scrutiny, or it never publicly resolved. Either reading is significant. claim 54
• PostHog session-replay configuration. The SDK ships with replay enabled by default. We've confirmed the SDK is loaded on TrumpRx and nasaforce.gov, but we have not yet captured the actual posthog.init() call to see whether they override the defaults. A 5-minute headless-browser capture would settle this. claim 57
• The Reuters confirmation of Gebbia's appointment. Closed 2026-06-03 — confirmed through Newsweek and Federal News Network as well as the Reuters wire pickup at Investing.com. Gebbia is the first Chief Design Officer; NDS targets 26,000-27,000 federal web portals.
• The Greg Hogan OPM injunction exception. Closed 2026-06-03 — confirmed via Nextgov/FCW and GovExec coverage. Hogan was one of three DOGE-affiliated exceptions to the OPM access block (AFT v. Bessent, 8:25-cv-00430, D. Md.) and now runs Login.gov from inside NDS. people roster

People

Companies / vendors

What we're now watching automatically

This project now ships a change-detection script. Every URL below is re-fetched on demand; the new snapshot is diffed against the previous one for that URL; any added subdomain, new federal .gov registration, or changed AutoMonitor source is surfaced.

python3 diff.py                       # text report
python3 diff.py --json out.json       # JSON
python3 diff.py --html out.html       # browser-readable
python3 diff.py --add-as-claims       # auto-track changes

Watched URLs:

• crt.sh certificate transparency log for %.ndstudio.gov — new subdomains
• crt.sh for passports.gov — staging rollouts and new photo endpoints
• cisagov/dotgov-data/main/current-federal.csv — new federal .gov registrations or security-contact changes
• cdn.infra.ndstudio.gov/internal-analytics/script.js — AutoMonitor source for scope creep
• ndstudio.gov/ homepage — whether the studio adds or removes analytics scripts
• trumprx.gov/privacy-policy — privacy policy edits
• Federal Register search for "National Design Studio" — new SORN or PIA filings

The diff script categorizes each URL specifically — for the crt.sh ones it parses the JSON and lists added/dropped subdomain names. For the CISA CSV it lists added/dropped EOP-registered domains and any security-contact change on existing rows. For everything else it shows a hash change.

Recommended cadence: every 2–3 days, or on demand when the Drey author flags a new finding worth re-checking.

How to close a thread

When something on this page is verified by primary source:

1. python3 fetch.py 'https://your-source.url/' --description '...'
2. python3 claim.py add --category personnel --status confirmed --statement "..." --primary 'https://your-source.url/'
3. python3 site_gen.py — regenerates everything, including this page if we extend it to pull from the DB.

The verified findings live in claims.html. This page stays the open-questions worksheet.