The Trojan Horse Wore Dockers: Spies At The NLRB

This is one of those articles that can get really deep in tech lingo that puts one to sleep before you get to the point of the whole thing. So we’re taking it a slightly different direction. All the facts are still there, we didn’t make up anything. It’s just a different way of telling a story. Let’s dim the lights and cue the ominous music. Forget the dry prose; this smells like state secrets and danger.

The hum was constant. Not the frantic buzz of a trading floor or the purposeful thrum of heavy industry, but the low, monotonous drone of servers diligently processing the mundane dramas of American labor. Southeast Washington D.C., early March. Inside the unassuming headquarters of the National Labor Relations Board, Daniel Berulis liked the hum. It was the sound of order, of data flowing where it should, secured by the meticulous digital fortresses he’d spent the last six months reinforcing. Zero Trust Architecture – the principle was simple: trust no one, grant access only where essential. It was less a philosophy, more a necessity in a world crawling with digital predators. Berulis, a man who’d rather dissect a motherboard than attend a cocktail party, found a quiet satisfaction in protecting the NLRB’s trove – sensitive employee complaints, unionization efforts, and confidential corporate strategies laid bare in disputes. Data that, in the wrong hands, could ruin lives or swing markets. Data that had absolutely nothing to do with government efficiency.

He’d taken the job seeking public service, a way to contribute after a knee injury had sidelined military ambitions. Protecting workers’ rights felt right, tangible. It was, for a brief moment before the chill set in after the inauguration, a dream assignment. Then came the whispers, the tightening atmosphere, the ambient dread that permeated the DC air thicker than the swampy summer humidity. And then, came DOGE.

The arrival wasn’t subtle. A black SUV, the kind that absorbs light rather than reflecting it, glided into the garage, flanked by a police escort whose presence felt less protective, more coercive. Building security, suddenly deferential, ushered them in. They didn’t introduce themselves to the rank-and-file IT team, these emissaries from the President’s newly minted Department of Government Efficiency – DOGE, an acronym whose snarling implications felt increasingly apt. An initiative ostensibly about cutting waste, but effectively steered by the notorious tech billionaire known only as Muskrat – a man whose influence seemed limitless, whose allegiances felt disturbingly opaque, and whose name was often whispered in the same breath as deals struck in the cold corridors of the Kremlin.

Their demand, when it came, was delivered with quiet arrogance to Berulis’s superiors: absolute control. “Tenant owner level” access to the NLRB’s cloud systems. The digital keys to the kingdom. Unrestricted permission to read, copy, alt, delete. When Berulis’s colleagues, professionals steeped in security protocols, suggested activating the accounts through standard procedures that logged user activity – a basic tenet of cybersecurity – they were curtly told to stay out of DOGE’s way.  

Berulis felt a cold prickle run down his spine. No logging. It wasn’t just irregular; it was insane. It violated every core principle, every best practice hammered out by NIST, DHS, CISA, the FBI, the NSA. It was the digital equivalent of demanding the security cameras be turned off before entering the vault. Only hackers – criminals or state-sponsored actors – operated that way. Evasive. Untraceable. Malicious. This wasn’t efficiency; this was infiltration.

He started watching. Quietly. Carefully. The DOGE team, phantom-like, installed a ‘container’ – a virtual black box designed to run programs invisibly, leaving no trace once removed. Standard practice for some development, perhaps, but here? Combined with the demand for no logs? It felt like assembling a burglar’s toolkit.

Then, browsing online over a weekend, trying to distract himself, Berulis stumbled onto something that turned the cold prickle into icy dread. Jordan Wick, one of the DOGE engineers, had momentarily left a coding project public on his GitHub account. The title screamed louder than any alarm bell Berulis had ever configured: “NxGenBdoorExtract.”

Bdoor. Backdoor. A secret passage into the NLRB’s bespoke case management system, NxGen – the very heart, containing the agency’s most sensitive secrets. And “Extract.” It wasn’t subtle. It was brazen. Wick quickly privatized the repository after a journalist flagged his account online, but Berulis had seen enough. He alerted his team. Panic, barely suppressed, rippled through the IT department.

Then came the data spike. Berulis, monitoring network traffic, saw it clear as day on his console – a massive, anomalous surge of outbound data leaving the NxGen system’s core, then exiting the NLRB network entirely. Roughly ten gigabytes, mostly text files. An encyclopedia stack’s worth of information, potentially compressed, potentially cherry-picked. Data almost never left the system directly like this. Backups and migrations followed different protocols. This was exfiltration, pure and simple. He checked – no authorized data migrations were scheduled. No one else knew anything. The logs that should have tracked the outbound traffic? Missing. Actions attributed only to a “deleted account.”  

“We are under assault,” Berulis thought, the hum of the servers suddenly sounding like a countdown timer.

He wasn’t the only one noticing strange things. Colleagues found security controls inexplicably disabled – insecure mobile devices allowed access, multi-factor authentication turned off. An interface dangerously exposed to the public internet. Internal monitoring systems manually shut down. Someone had even exported the roster of outside lawyers who worked with the NLRB. And then, PowerShell downloads – five of them. Tools perfect for automating commands, masking activity. Wick’s GitHub account also showed interest in tools like “requests-ip-rotator” to generate endless IP addresses and “browserless” for web automation tools, Berulis realized with growing horror, seemingly designed to automate and mask large-scale data theft.  

But where was the data going? The exfiltration path was obscured using DNS tunneling – a technique favored by sophisticated hackers, breaking data into tiny packets hidden within innocent-looking DNS queries. A technique, intelligence analysts confirmed, frequently used by Russian threat actors targeting US systems.

And then came the pings. Almost immediately after DOGE gained access, login attempts began hitting the system from an IP address resolving to Russia. They were using one of the newly created, high-privilege DOGE accounts. They had the correct password. The attempts were blocked, but the implications were terrifying. Had DOGE’s sloppy, reckless intrusion already created an opening for foreign intelligence? Or was it something more direct?  

Berulis and his team initiated a formal breach investigation, preparing a request for assistance from CISA, the government’s cybersecurity agency. They needed more resources, more expertise. But the effort was abruptly shut down from above. No explanation given. Just… stop.

The isolation closed in. Then the fear became sickeningly personal. Days after the CISA request was quashed, Berulis found an envelope taped to his apartment door. Inside, a printed letter. Threatening language. Sensitive personal information – things no casual observer should know. And overhead photos of him walking his dog, grainy but unmistakable, clearly taken by a drone. The message was crude but effective: We see you. We know where you live. Shut up. The note specifically referenced his decision to report the breach internally. Law enforcement was investigating, but the chill was absolute. This wasn’t just about data anymore.

Who was behind DOGE? Ostensibly, the White House. But steered by Muskrat, a man with global business interests and opaque connections, including to Putin’s Russia. A man whose other companies, like SpaceX, had active, contentious cases before the NLRB. Was this efficiency, or corporate espionage sanctioned at the highest levels? Was it political sabotage aimed at crippling labor protections? Or was it something even worse – sensitive American data flowing, intentionally or accidentally, into the hands of foreign adversaries via a backdoor installed by government decree?  

Berulis looked at the puzzle pieces he’d painstakingly assembled: the demands for secrecy, the disabled logs, the backdoor tools, the massive data exfiltration, the sophisticated masking techniques, the Russian login attempts, the stonewalled investigation, the personal threats. The picture wasn’t just bad; it was horrifying.

He knew the risks of coming forward. He’d seen the “culture of fear” descend. But the alternative – silence, while the digital veins of the agency bled sensitive data to God-knows-where, potentially benefiting oligarchs in Moscow or silencing American workers – was unthinkable. He had to talk. He had to hope someone was listening. The hum of the servers now sounded like a warning klaxon, and time, he suspected, was running out. Maybe, just maybe, there was still time.