Letter to The Honorable Kelly Loeffler, Administrator, U.S. Small Business Administration (August 5, 2025)
Summary
A letter dated August 5, 2025 from Nydia M. Velázquez, Ranking Member, House Small Business Committee, to Administrator Kelly Loeffler of the U.S. Small Business Administration (SBA). The letter expresses concerns and requests information about the SBA's facilitation of expedited access to agency data for individuals associated with the Department of Government Efficiency (DOGE), citing reporting by Wired. It cites what it calls discrepancies between testimony before the Senate and House Small Business Committee and that reporting. The letter requests a detailed response no later than August 22, 2025, including to questions from correspondence dated February 3, 2025 and February 12, 2025.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Congressional materials
- Document type
- 2025 08 11 Housesbc Minority Letter Doge Access To Sba Systems Prattach
- Date
- 2025-08-11
- Case
- 2025 08 11 Housesbc Minority Letter Doge Access To Sba Systems Prattach
Cite this document
“Letter to The Honorable Kelly Loeffler, Administrator, U.S. Small Business Administration (August 5, 2025).”
Original at democrats-smallbusiness.house.gov, dated 2025-08-11. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2025-08-11-2025-08-11-housesbc-minority-letter-doge-access-to-sba-systems-prattach/
, SHA-256 e718b33331d2e9c688014831ae06b42721825ba1a247129bdf3eaff2435330a7.Full text
August 5, 2025
The Honorable Kelly Loeffler
Administrator
U.S. Small Business Administration
409 3rd Street, SW
Washington, DC 20416
Dear Administrator Loeffler,
I write again to express serious concerns and request information regarding the Small Business
Administration’s (SBA) facilitation of expedited access to agency data for individuals associated
with the Department of Government Efficiency (DOGE), particularly in light of recent reports
about the agency’s vetting process.
In testimony before the Senate Committee on Small Business and Entrepreneurship in May, you
stated that DOGE operatives “have not had access” to personal or sensitive small business
information. However, email communications reviewed by Wired show that on February 3, 2025,
senior SBA staff urgently requested broad access for DOGE operatives to both SBA and National
Finance Center (NFC) information systems.1 “Admin access” was reportedly granted within hours
to systems containing highly sensitive information—such as Social Security and Employer
Identification numbers—of SBA staff and of the millions of small business owners, homeowners,
and renters who have used SBA lending programs, including disaster assistance loans.2
These reports present a troubling account of SBA’s disregard for basic controls on sensitive data
as it expedited access for DOGE operatives. The speed with which SBA granted access makes
clear that it failed to protect personal information by bypassing the standard screening and security
clearance processes required of government employees who handle sensitive information.3
Even more troubling are reports that one DOGE operative had been fired from an internship at a
network monitoring firm after being suspected of leaking internal information, raising serious
doubts about his fitness to manage sensitive data.4 However, in testimony before the Small
1
Victoria Elliott, How Edward ‘Big Balls’ Coristine and DOGE Got Access to a Federal Payroll System That
Serves the FBI, Wired (July 30, 2025), https://www.wired.com/story/edward-coristine-big-balls-doge-federal-pay-
roll-system/.
2
Id.
3
Id.
4
Id.
1
Business Committee in June, you said the operative “is an SBA employee who has been vetted, as
has the entire team.” Given these discrepancies between your testimony before the Senate and
House Small Business Committee, and the reporting by Wired, I have serious concerns about the
omission of critical information to Congress.
As you know, government protocols regarding requests for access to information and systems
typically only allow the lowest level of access required to meet the specific objective in order to
protect sensitive data.5 The emails cited in reports did not explain the intended objective, limit
access to the lowest level required, or comply with federal laws, including the Federal Privacy Act
and the Federal Information Security Management Act (FISMA).6
Given the egregious lack of transparency and reports of SBA’s flagrant disregard for security
protocols, I, along with my colleagues on the Committee, sent two separate letters sent on February
3, 2025, and February 12, 2025 requesting detailed information on DOGE’s accessing of SBA’s
systems. The SBA’s lack of a satisfactory response is obstructing the Committee’s investigation
and raises serious concerns regarding the SBA’s efforts to comply with legitimate oversight
requests. Pursuant to Rule X of the House of Representatives, the Committee on Small Business
has broad authority to investigate “problems of all types of small business.” The Committee
possesses jurisdiction over “assistance to and protection of small businesses.”
I therefore request a detailed and thorough response to the following inquiries as soon as possible,
but no later than August 22, 2025:
1. Responses to our inquiries included in correspondence dated February 3, 2025. For your
convenience the questions that are awaiting a response are below.
1) Are the reports accurate that Department of Government Efficiency (DOGE) operatives
have access to SBA’s systems? If so:
a. What are the names of the specific systems?
b. Who has asked to gain access to the systems and for what purpose?
c. Who granted access?
d. Have any of these requests been approved? Are any still under consideration?
e. What information was obtained and what is it being used for?
f. Was there any breach of personal information?
2) The Executive Order directs each agency head to establish a DOGE team of at least four
employees within each agency. Please provide a comprehensive list of all DOGE
employees at SBA, as well as a specific list of every individual who has been granted access
to the system since President Trump’s inauguration.
a. Did they have appropriate clearances to protect sensitive information?
5
National Institute of Standards and Technology (2020) Security and Privacy Controls for Information Systems and
Organizations. (Department of Commerce, Washington, D.C.), Special Publications (SP) 800-53 Rev. 5, September
23, 2020. https://doi.org/10.6028/NIST.SP.800-53r5
6
Elliott, supra note 1.
2
b. Please provide detailed information on how DOGE individuals complied with
Ethics in Government Act, which include specific financial disclosure and conflict
of interest safeguards.
c. What specific access has been granted, and what was the rationale for doing so?
Can you confirm that no individual outside the SBA has been granted access to the
systems since President Trump’s inauguration?
3) What safeguards are in place to ensure access to these systems are not abused?
a. What safeguards are in place to protect Americans’ personal and private data?
b. What safeguards are in place to protect the integrity of the programs and ensure that
no authorized service or payment is delayed or canceled?
c. Please detail the extent to which you complied with the Privacy Act of 1974, which
prescribes how federal agency records are stored, accessed, used, and disclosed?
4) The EO Establishing and Implementing the President’s Department of Government
Efficiency reorganizes the U.S. Digital Service, to be led by an Administrator within
DOGE who reports to the White House Chief of Staff. Please provide specific information
as to who is the administrator at DOGE, and please list all of the vetting of the appointment
that has taken place.
5) What procedures are in place for controlling and providing access to the system, and were
these procedures followed in this case?
6) Were any SBA employees threatened with administrative leave or otherwise in order for
access to be granted?
7) Did President Trump, Elon Musk, or anyone at the White House suggest making any
threats to fire or place anyone on leave that objected to grant the access? If yes, who
suggested it and when did they suggest it?
8) Has the SBA threatened to remove or put any other career civil servants at the Small
Business Administration on administrative leave following President Trump’s
inauguration? Has anyone else in those offices left the Department since then?
9) Were additional unsecured servers set up after access was granted to the SBA’s systems?
If so:
a. What purpose do they serve and why were they necessary?
b. Please provide a list of anyone with access to these servers?
c. Have these servers undergone a Privacy Impact Assessment? If so, please provide
detailed information.
10) Please provide the legal authority under which the SBA granted access to systems to
anyone associated with Elon Musk or DOGE.
3
11) Copies of all communications between associates of Elon Musk or DOGE and the SBA
related to accessing SBA’s systems.
2. Responses to our inquiries included in correspondence dated February 12, 2025. For your
convenience the questions that are awaiting a response are below.
1) Does the SBA have possession of a memorandum of understanding between SBA and
DOGE or any document detailing its planned actions under the Executive Order
Establishing and Implementing the President’s “Department of Government Efficiency,”
as required by the E.O.14158. Please transmit such documents to the Committee.
2) How are conflicts of interest being vetted and reported regarding any individual being
given access to SBA’s data?
3) Going forward, what steps will the SBA take to ensure the protection of small business
data?
4) Will you pledge to work with and immediately notify the Committee of further interactions
and work with DOGE efforts?
3. Responses to inquiries related to the recent reporting:
1) Who authorized the expedited access to internal SBA systems? Were the White House,
Office of Personnel and Management, and Office of Management and Budget aware of this
expedited request?
2) Has DOGE centralized the information obtained from SBA and other federal agencies? If
so, where is this data stored? What is the intent behind centralizing Americans’ data?
3) What steps did SBA take to authenticate, vet, or supervise DOGE staffers, and on what
date did the SBA complete these steps? Were background checks or government
credentials verified? If so, what level of clearance did Edward Coristine, Donald Park, and
other DOGE staff hold?
4) Did SBA conduct a risk assessment or internal security review before or after granting
access?
5) Has SBA conducted a forensic audit to determine what information was viewed,
downloaded, or altered?
4
6) Were any Members of Congress, Committees, or Office of Inspector General informed
about this access prior to being granted?
7) What data privacy and protection trainings are SBA employees required to undergo? Did
DOGE staffers at SBA undergo the same training?
8) Has SBA notified individuals or loan recipients whose information may have been
accessed?
9) With comprehensive access to sensitive SBA data on loans and contracts for over five
months, have these DOGE staff identified any instances of loans or contracts that did not
adhere to program standards that were current at the time the loan or contract was
approved? If so, please provide documentation of any findings to the Committee.
Thank you for your attention to this matter. If you have any questions, please contact the
Committee’s minority staff at 202-225-4038.
Sincerely,
Nydia M. Velázquez
Ranking Member
House Small Business Committee
5
File and source
- File
- 2025-08-11_HouseSBC-Minority_letter-doge-access-to-sba-systems_prattach.pdf
- Size
- 228,481 bytes
- SHA-256
- e718b33331d2e9c688014831ae06b42721825ba1a247129bdf3eaff2435330a7