US cybersecurity chief uploads confidential documents to ChatGPT

The Acting Director of the Cybersecurity and Infrastructure Security Agency (CISA), the top US cybersecurity agency, was responsible for a security incident last year. Madhu Gottumukkala uploaded sensitive government documents to a public version of ChatGPT. According to information obtained by Politico from four DHS officials, this action triggered several automated security alerts. These sensors are designed to prevent the theft or unintentional disclosure of government material from federal networks. The systems reportedly raised alarms multiple times during the first week of August alone.

Gottumukkala used a special exemption to access the AI ​​chatbot, which he had requested from CISA's Chief Information Officer shortly after taking office in May. At that time, the app was restricted to regular Department of Homeland Security employees. While the uploaded files were not classified documents, they were contract documents marked "For Official Use Only". This designation indicates sensitive information not intended for public release.

The incident is particularly controversial due to the technical nature of the tool used. Inputs into the public version of ChatGPT are transmitted to developer OpenAI and can theoretically be used to further train the model or respond to queries from other users. In contrast, officially approved AI tools used by the Department of Security, such as the internal "DHSChat", are configured so that no data or search queries leave the protected federal networks. OpenAI states that the service now has over 700 million active users, highlighting the risk of potential exposure.

Meanwhile, CISA is trying to smooth things over. Spokeswoman Marci McCarthy said the use was approved, short-term, limited, and took place under security precautions. She also contradicted the timeline and said the director last used the tool in mid-July. This contradicts statements by officials that security sensors still registered uploads in early August. An internal investigation is now attempting to determine whether the incident caused any actual damage. The incident is one of a series of controversies surrounding Gottumukkala, who, according to reports, had previously failed a polygraph test for counterintelligence.