A major US federal agency has repeatedly left sensitive information in its Google Drive accessible to employees and contractors who had no legitimate business need to see it, and auditors aren’t happy. The General Services Administration (GSA), which handles contracting, procurement, property management, and other elements of basic operations for federal agencies, has faced repeated findings of inadequate protection for controlled unclassified information (CUI) since at least 2014, according to a report from the agency’s Office of Inspector General. Again. Controlled unclassified information, in the US federal government’s parlance, is information that isn’t classified but requires protection or restrictions on its distribution under applicable laws, regulations, or government-wide policies. Access is generally limited to individuals with a legitimate government need to know. According to the OIG report, that can include things like physical security info for government buildings, personally identifiable information (PII) of government employees, and proprietary business information, all of which the GSA has left exposed. According to the report published this week, employees and contractors have approximately 2. 5 million documents stored in GSA’s Google Drive. “During a limited search of GSA’s Google Drive, we found 116 files containing CUI that were improperly shared with all GSA users,” the report notes. That’s a limited search, mind you, and the OIG has plenty of reason to believe there’s more than just that sitting open for anyone with access to the GSA’s Google Drive instance to sneak a look at. The OIG said that GSA is failing to properly manage the third-party tool it has in place to prevent data loss and detect CUI exposures, with annual reviews of search terms incomplete or undocumented, many relevant search terms not implemented, and a failure to enable an available optical character recognition feature that could help detect CUI in scanned documents. Additionally, the GSA was apparently “unaware of the tool’s file size limitation of 15 megabytes,” meaning that even if the GSA was properly using that tool, some large files would still be skipped…