Investigation · Surveillance State(s) · see: Hub 5

The National Design Studio

Silicon Valley’s shadow IT layer for the federal government. A billionaire Airbnb co-founder, four federal websites, a whistleblower’s live copy of the Social Security file, and an executive-office reporting line that routes around every oversight law written since 1974.

§1 · Summary Brief

What this page is about

On August 21, 2025, President Donald Trump signed Executive Order 14338, “Improving Our Nation Through Better Design,” creating a new Chief Design Officer of the United States and a new office called the National Design Studio inside the Executive Office of the President. Joe Gebbia, the billionaire Airbnb co-founder, was named to the role. The White House framed the studio as a modernization project: better forms, better websites, less friction for the citizen. That framing is one piece of what the studio does.

The other piece is documented in a June 28, 2026 Guardian investigation by Jason Wilson, in an August 26, 2025 whistleblower disclosure filed by former Social Security Administration Chief Data Officer Charles Borges through the Government Accountability Project, and in a January 16, 2026 Department of Justice Notice of Corrections filed in ongoing litigation over the Department of Government Efficiency’s access to federal databases. What those three sources document, together, is a parallel technology apparatus that operates outside the Privacy Act of 1974, outside the E-Government Act of 2002, outside Senate confirmation, outside Inspector General jurisdiction, and outside the federal contracting database.

The apparatus is staffed by veterans of the Department of Government Efficiency, sits inside the Executive Office of the President as a “temporary organization,” and builds and operates federal websites that collect visitor data using commercial tracking tools that no Privacy Impact Assessment names. It runs a White House-controlled copy of the federal voter registration site. It runs a White House passport-application portal that bypasses the State Department. Its founder was appointed with the public support, on the record and on camera, of Founders Fund, Andreessen Horowitz, 8VC, and Thrive Capital.

This investigation documents what is on the record, grades each claim, and separates the documented from the inferred. The Guardian did the primary reporting on the tracking layer. Borges’s disclosure and the DOJ’s subsequent Notice of Corrections did the primary reporting on the data layer. We assemble them into a single frame and add the evergreen framing that The Black Book Audit uses: whose capital, whose personnel, and what the pattern is designed to do.

What we are NOT saying

We are not saying Joe Gebbia has personally accessed the Social Security master file. There is no primary-source evidence for that. The Borges disclosure names Aram Moghaddassi, Michael Russo, and John Solly at the SSA, and names DOGE personnel; it does not name Gebbia.

We are not saying the National Design Studio has already recorded voter data, medical data, or passport applicant biometrics for improper use. What we document is that the technical capability was installed, that required privacy filings were not made, and that the office structure places the capability outside the usual review process.

We are not saying every venture capitalist who publicly backed Gebbia’s appointment is directly involved in the studio’s operations. What we document is who stood up publicly, on camera, to endorse the project, and what the pattern of Silicon Valley capital positioning itself around the federal government looks like when read alongside the DOGE personnel roster.

We are not saying the “Golden Record” capability framing in cluster five is happening. It is framed as capability analysis, graded PURE SPECULATION, and offered as a set of open questions about what the assembled infrastructure could do if operated at scale. The point of running it is to ask the right questions of the record, not to assert conclusions the record cannot yet support.

We are not saying, in cluster six, that Toka’s product is installed on any National Design Studio system, or that there is any operational link between Toka and the studio. What is on the record is a network fact: one of the venture-capital firms publicly named by Gebbia as backing the studio (a16z) is also the lead investor in Toka, a firm whose disclosed product line is the ability to alter networked camera footage and whose disclosed customer list includes the United States. Cluster 06 places the network of capital and the coincidence of capability on the record, and frames the evidence-regime questions the record already invites, so oversight and further reporting can answer them from primary evidence rather than from silence.

Grading rubric

FACTOn the primary-source record: executive orders, court filings, whistleblower disclosures under sworn signature, or reporting confirmed by two or more independent named sources.
PROBABLY TRUEDocumented by named sources and consistent with the primary record, but the primary record itself is partial or held by parties who have not yet released it.
SOME SMOKEAttested by credible sources, disputed by other credible sources, or resting on a whistleblower characterization whose specific mechanism is being litigated. Both sides shown.
PURE SPECULATIONCapability analysis. Not a claim of action. Framed as a set of open questions about what installed infrastructure could do, and labeled openly so the reader can weigh it as such.

Cluster 01

The order and the office, August 21, 2025

An executive order created a Chief Design Officer of the United States and placed a new office called the National Design Studio inside the Executive Office of the President. Everything downstream in this investigation is downstream of the specific way that office was structured.

Executive Order 14338

FACT

On August 21, 2025, Donald Trump signed Executive Order 14338, “Improving Our Nation Through Better Design,” establishing the position of Chief Design Officer of the United States within the Executive Office of the President and creating the National Design Studio as a “temporary organization” under 5 U.S.C. 3161. On the same day, Joe Gebbia was announced as the first Chief Design Officer. The order’s stated purpose is to improve the design of federal digital services. It does not name the tracking software the studio would go on to install; it does not name the databases the studio’s staff would go on to access.

The “temporary organization” structure

FACT

The National Design Studio is chartered under the same statutory hiring authority as the Department of Government Efficiency: 5 U.S.C. 3161, which authorizes short-lived organizations within the Executive Office of the President. That designation carries three structural consequences documented in the Guardian’s June 28, 2026 investigation. The studio’s staff are not subject to Senate confirmation. The studio’s staff are not subject to the financial disclosure requirements that apply to most senior federal appointees. The studio’s operations are not within the jurisdiction of any Inspector General. CISA ownership records reviewed by the Guardian list the Executive Office of the President as the registrant of the studio’s public websites, including passports.gov and the studio’s copy of vote.gov. USAspending, the federal contracting database, contains no record of the National Design Studio as either a paying agency or a recipient of funds.

Oversight and chief of staff

FACT

White House Chief of Staff Susie Wiles has oversight of the National Design Studio, according to the Guardian’s investigation. That oversight sits inside the Executive Office of the President, one reporting line removed from the President himself. It is not routed through the General Services Administration, which runs Login.gov and the federal digital-service infrastructure that predates the studio; it is not routed through the Office of Management and Budget, which enforces the Privacy Act and the E-Government Act; and it is not routed through the National Archives, which enforces federal records retention. Where the pre-existing digital-service infrastructure was built with multiple independent oversight layers, the National Design Studio’s oversight is entirely internal to the White House.

Cluster 02

Joe Gebbia and the venture-capital backing

Gebbia was not a random appointment. He came to the Trump administration through DOGE, arrived with an announced roster of venture-capital endorsers, and stated on camera that the National Design Studio operates with the support of a specific set of Silicon Valley firms. This cluster documents the record on that support.

From Airbnb to DOGE to NDS

FACT

Joe Gebbia co-founded Airbnb with Brian Chesky and Nathan Blecharczyk in 2007 and served as chair of Airbnb.org, the company’s nonprofit affiliate, through April 2025. On April 4, 2025, Skift reported that Gebbia had stepped down from that role. In late February 2025, the New York Times reported that Gebbia was joining Elon Musk’s Department of Government Efficiency; Gebbia confirmed the appointment on X. At DOGE he led, according to his own public accounting on Joe Lonsdale’s podcast and on the Yahoo Finance profile of the studio, an initiative to digitize the federal retirement records held on paper at Iron Mountain for the Office of Personnel Management. On August 21, 2025, he was named Chief Design Officer of the United States.

Gebbia’s public thanks to his investors

FACT

In a First of Kind podcast interview published February 11, 2026, Joe Gebbia named the venture-capital firms and individuals publicly supporting the National Design Studio. His words, in sequence: “the support of Founders Fund and Peter Thiel, a16z and Marc Andreessen, HBC and Joe Lonsdale, Thrive and Josh Kushner … in fact, Scott Belsky is chairing the National Design Studio Advisory Council for me and putting together an amazing group of these people.” The reference to ‘HBC and Joe Lonsdale’ is to 8VC, Lonsdale’s firm and the successor to the Formation 8 vehicle he co-founded; the Palantir co-founder’s central role in Silicon Valley’s government-technology positioning is documented across a decade of on-record interviews. Scott Belsky is a former Adobe executive and Behance founder now positioned as chair of the NDS Advisory Council, per Gebbia’s own statement in the same interview.

“the support of Founders Fund and Peter Thiel, a16z and Marc Andreessen, HBC and Joe Lonsdale, Thrive and Josh Kushner … Scott Belsky is chairing the National Design Studio Advisory Council for me.”

Marc Andreessen’s parallel DOGE role

FACT

Marc Andreessen has described himself, in his own words on the Hoover Institution podcast in the first quarter of 2025, as an ‘unpaid intern’ at DOGE. Financial Times and TechCrunch reporting confirms that Andreessen helped recruit DOGE’s early technical hires. His parallel role in Gebbia’s National Design Studio, endorsed on camera in the First of Kind interview, places him at two intersecting nodes: on the DOGE recruiting side, and on the NDS venture-capital-backing side. The two roles overlap in personnel: DOGE veterans staff the National Design Studio, and the same venture-capital firms are named as public backers of both entities. This is not a claim about specific transactions or specific technical operations. It is a claim about the observable structure of the network as documented by named participants speaking on the record.

Cluster 03

The Borges disclosure and the DOJ correction

Before the National Design Studio was named on August 21, 2025, DOGE had already been at the Social Security Administration for eight months. The record of what DOGE did there is the anchor evidence for what the successor organization would be positioned to do.

The August 26, 2025 whistleblower disclosure

FACT

On August 26, 2025, Charles Borges, then Chief Data Officer of the Social Security Administration, filed a protected whistleblower disclosure through the Government Accountability Project. The disclosure alleged that DOGE personnel, working with then-SSA CIO Aram Moghaddassi and senior DOGE operative Michael Russo (also a former SSA CIO), had created a live copy of the NUMIDENT file (the Social Security Administration’s Numerical Identification System, which contains name, birth date, birthplace, citizenship, family relationships, and Social Security numbers on approximately 450 million living and deceased Americans) in a cloud environment outside the SSA’s ordinary oversight structure. The disclosure named John Solly as the DOGE-side individual who requested the NUMIDENT transfer. Borges characterized the affected population at approximately 300 million Americans. He filed the disclosure on the sworn record. He submitted an involuntary resignation letter three days later, on August 29, 2025.

The January 16, 2026 DOJ Notice of Corrections

FACT

On January 16, 2026, in ongoing litigation over DOGE’s access to federal databases, the Department of Justice filed a Notice of Corrections. The filing acknowledged, under the DOJ’s signature, that DOGE personnel had in fact used a third-party Cloudflare-hosted server in the course of their SSA work, contradicting earlier government statements to the court. The filing separately revealed that a DOGE Team Member had signed a ‘Voter Data Agreement’ with an outside political advocacy group in March 2025, without the knowledge of non-DOGE SSA staff. The specific Cloudflare acknowledgment, in the DOJ’s own words, is the strongest single piece of external corroboration for Borges’s disclosure now on the public record. The Government Accountability Project’s February 17, 2026 analysis of the filing walks through the correction in detail. PBS NewsHour covered Borges’s response to the DOJ’s admission.

Michelle King, the February 2025 resignation, and the second whistleblower

FACT

Acting Social Security Commissioner Michelle King resigned in February 2025 after refusing to hand over SSA data access to DOGE personnel. That resignation preceded the transfer of the live copy of NUMIDENT to the DOGE cloud environment, which Borges’s disclosure places in June 2025, following the Supreme Court’s lifting on June 6, 2025 of a temporary restraining order that had limited DOGE’s access. A second SSA whistleblower disclosure, referenced in a congressional letter from Representative John Larson’s office, alleged that a DOGE worker improperly accessed SSA systems using thumb drives, prompting an Office of Inspector General probe. That second disclosure is on the record as of March 2026. Between Borges, King, and the second whistleblower, three separate SSA insiders have now placed the same set of concerns on the public record about the same set of DOGE personnel operating during the same window.

Cluster 04

The tracking layer, June 28, 2026 (the Guardian’s work)

On June 28, 2026, the Guardian’s Jason Wilson published a technical investigation of the four public federal websites the National Design Studio has built and operates. What the code on those sites is doing, and what it is not accompanied by in the federal privacy record, is the anchor evidence for the surveillance concern.

The four public NDS sites and one internal site

FACT

The Guardian identified four public federal websites built and operated by the National Design Studio: ndstudio.gov (the studio’s own site), trumprx.gov (a prescription-drug pricing site), realfood.gov (a food-policy site), and trumpaccounts.gov (a children’s investment programme site). Beyond the public four, the studio built and runs a White House-controlled passport application portal at passports.gov that bypasses the State Department’s existing infrastructure and, as of September 17, 2025, a White House-controlled copy of the federal voter registration site vote.gov. Three additional NDS-tied addresses appeared in public records in late May 2026: chat.staging.ndstudio.gov, onboarding.ndstudio.gov, and upload.ndstudio.gov. The State Department, in a written response to the Guardian, said it ‘is working closely with the White House to deliver the best possible service for our passport customers while safeguarding US national security.’ The Election Assistance Commission’s Chair Thomas Hicks told the Guardian: ‘The EAC is not familiar with any domains or hosting utilized by NDS for their internal work.’

PostHog session recording on trumprx.gov and trumpaccounts.gov

FACT

The Guardian identified PostHog, a commercial product-analytics tool, installed in the code of all four public NDS sites. PostHog’s session-recording feature can replay every click, scroll, and keystroke of a visitor’s time on a webpage. On trumprx.gov and trumpaccounts.gov, session recording was actively enabled at the time of the Guardian’s reporting. On the other two sites, the recording feature was built into the page code but held inactive by a single setting inside PostHog’s dashboard, which can be toggled by whoever controls the website at any time without any change to the underlying site code. Serge Egelman, research director of the Usable Security and Privacy Group at ICSI, told the Guardian: ‘It’s not like someone going to the DMV website expects a private company to receive their personal data and then be allowed to use that however they want.’ Princeton researchers cited in the piece characterized watching a session recording as ‘as if someone is looking over your shoulder.’

First-party proxy routing designed to evade adblockers

FACT

PostHog was configured on the NDS-run sites to route analytics requests through an address on the federal website itself, rather than through PostHog’s own servers. The technical purpose of that configuration, in PostHog’s own documentation, is to prevent adblockers and privacy tools from flagging the tracking. PostHog’s public documentation explains: ‘because ad blockers haven’t visited your domain to catalog your setup. They don’t know what to block.’ That is not disputed. The configuration decision, made by the National Design Studio, means that a citizen visiting a federal website with a standard privacy-protection browser extension would receive no warning that their session was being recorded. This is the specific technical mechanism that turns commercial product analytics into what the Guardian’s sources called ‘shady tracking technologies’ when installed on a government site without notice.

AutoMonitor: the 539-line custom code on ndstudio.gov itself

FACT

On the National Design Studio’s own website, the Guardian identified a 539-line piece of bespoke JavaScript that recorded visitors’ clicks, form entries, and navigation; assigned each visitor a session identifier; and forwarded the captured data to an address that does not appear anywhere on the public internet. The script referred to itself as ‘AutoMonitor.’ Unlike PostHog, this is not a commercial product with public documentation and a privacy policy. It is a custom piece of code, written by or for the National Design Studio, that ships user telemetry to a destination the public cannot see, running on the studio’s public-facing website. This is the most direct evidence in the record that the studio is not simply using off-the-shelf analytics for user experience research.

No Privacy Impact Assessment. No System of Records Notice.

FACT

Section 208 of the E-Government Act of 2002 requires a Privacy Impact Assessment (PIA) for any federal information system that collects personally identifiable information. The Privacy Act of 1974 requires a System of Records Notice (SORN) for any federal information system that maintains records retrievable by personal identifier. The Guardian searched the federal privacy record and could find no PIA and no SORN for the National Design Studio’s web-tracking layer. None of the four public NDS sites carries a PIA that names PostHog. None is covered by a SORN that addresses what is collected or where it goes. The single published privacy instrument on any of the four programmes is a Treasury notice for the Trump Accounts programme; that notice describes how the children’s investment programme is administered but does not name PostHog and does not describe the tracking on trumpaccounts.gov at all. EPIC’s John Davisson called the missing filings ‘a pretty clearcut violation of Section 208’ and told the Guardian: ‘There’s just no suggestion that they’re trying to comply in good faith with any of their obligations when it comes to the collection of personal information.’

The vote.gov copy on White House infrastructure since September 17, 2025

FACT

Public records of secure web addresses reviewed by the Guardian show that a National Design Studio copy of vote.gov has been live on White House-controlled systems since September 17, 2025. The sign-in page carries the title ‘Log in to vote.gov preview’ and, above the password field, the notice: ‘For official use only. Actions will be recorded in accordance with applicable law.’ NDS engineer Akash Bobba briefed the system to state secretaries of state on a National Association of Secretaries of State conference call organized on October 23, and to the National Association of State Election Directors on October 17. Call notes from the NASED session recorded serious concerns about the project not complying with state election law. Bobba conceded on the call, on the specific question of data retention: ‘I don’t know what they retain and what they are logging.’ The Election Assistance Commission’s Chair Thomas Hicks separately told the Guardian: ‘The current, live vote.gov website is hosted on separate EAC-controlled infrastructure that does not have any integrations with NDS or Executive Office of the President systems.’ EPIC’s Davisson called the arrangement ‘dangerous’ and warned: ‘If you’re centralizing that in the White House, the White House is going to have sort of access to that backbone of data.’

Cluster 05

Six components on the ground at the same time under one reporting line to the White House

Six pieces of surveillance infrastructure are running right now under one reporting line to the White House Chief of Staff. No public filing accounts for them as a system. This cluster names each piece and asks what they could do together. The graded questions are speculation. The infrastructure is not.

Six components, running now, staffed by the same people

FACT

Holding only to Clusters 01 through 04, all six are on the ground at the same time:

1. A live copy of the NUMIDENT file. ~450 million records from the Social Security Administration, held in a cloud environment outside SSA’s ordinary oversight. Per the Borges disclosure and the DOJ’s January 2026 Notice of Corrections.

2. A White House-controlled passport portal. Collects identity data from applicants. Per CISA ownership records and the Guardian.

3. A White House-controlled copy of vote.gov. Positioned to collect voter registration data. Per public records and the Guardian.

4. Session recording on federal websites. Replays every click, scroll, and keystroke. Configured to evade adblockers.

5. AutoMonitor on ndstudio.gov itself. A custom telemetry pipeline that ships user data to a destination invisible on the public internet.

6. The same personnel network. Russo, Moghaddassi, Bobba, Hogan, and Coristine moved from DOGE to NDS. Same senior operators. Same reporting line.

No Privacy Impact Assessment currently accounts for these six components as a single system.

Three capability questions the record already asks

Open Questions

None of these questions asserts that anything is happening. Each one asks what the installed infrastructure could produce if operated at scale. They exist to force the office that installed the capability to account for it from primary evidence.

Question 1. Composite records. Could a session record from trumpaccounts.gov be joined to an identity from the passports.gov flow, then joined to the family links in NUMIDENT, and produce a single composite record aggregating financial, biometric, and family data on one civilian?

Question 2. Voter intent. Could session recordings from a vote.gov preview environment, joined to state voter rolls returned through any ‘election integrity’ workflow, produce an operational profile of individual voter intent?

Question 3. Silent expansion. Could the first-party proxy routing be extended to any other federal site the studio takes over, producing an invisible expansion of the tracking layer that no external Privacy Impact Assessment search would surface?

The Sunlight Foundation formulation applies: if the capability is on the ground, the office that installed it has to account for it.

Cluster 06

One venture fund invested in both a US federal design office and an Israeli evidence-alteration firm

a16z is a public backer of the National Design Studio. a16z is also the lead investor in Toka, an Israeli firm whose product alters camera footage. Nothing on the record shows Toka is inside the National Design Studio. But the same fund invested in both. This cluster names that network fact and asks the oversight questions it raises.

a16z led Toka’s 2018 seed round and remains its lead investor

FACT

Andreessen Horowitz led Toka’s $12.5M seed round in July 2018. Toka was founded that year in Tel Aviv by former Israeli Prime Minister Ehud Barak and former IDF Cyber Staff chief Brig. Gen. (ret.) Yaron Rosen, along with Alon Kantor and Kfir Waldman. Eclipse Ventures led a $25M Series B in July 2021. Total disclosed capital is $37.5M. The full lineage is documented on our dedicated Toka page.

Gebbia named a16z as a National Design Studio backer, on a podcast, on the record

FACT

Joe Gebbia said the words on the First of Kind podcast on February 11, 2026. He named the studio’s public backers in sequence: “the support of Founders Fund and Peter Thiel, a16z and Marc Andreessen, HBC and Joe Lonsdale, Thrive and Josh Kushner … in fact, Scott Belsky is chairing the National Design Studio Advisory Council for me.” This is not a claim that a16z holds a contract or an equity stake. The National Design Studio is a federal temporary organization, not a corporate entity. It is the studio director’s own statement about who is publicly supporting the work.

Toka’s product line, per its own pitch documents: “Discover, Hack, Alter”

FACT

Haaretz obtained Toka’s internal pitch documents in December 2022. The slides use the header “Discover, Hack, Alter.” The product finds networked cameras and other connected devices, breaks into them, and lets the operator alter the footage those devices produce. The disclosed customer list includes the United States. Toka has not disputed the documents. TechCrunch confirmed in December 2024 that Toka is actively pursuing US federal agency contracts. Whether the alteration leaves ‘no forensic trace’ is a claim from hackers who reviewed the Haaretz materials, and is graded separately on our Toka page. This block does not assert it.

Three facts, in one place, on the record

FACT

Holding only to what has been documented above and in Clusters 01 through 05:

One. The National Design Studio sits inside the Executive Office of the President. Its charter routes around Senate confirmation, Inspector General jurisdiction, and the federal contracting database. It has installed a collection surface that includes a live copy of the Social Security NUMIDENT file, a White House-controlled passport portal, a White House-controlled copy of vote.gov, session recording on federal websites, and custom telemetry on its own site.

Two. a16z, one of the venture-capital firms publicly named by the studio’s director as backing the studio, is also the lead investor in Toka. Toka’s product alters camera footage. Its disclosed customer list includes the United States.

Three. Marc Andreessen, a16z’s co-founder and the individual Gebbia named on the podcast, sits on the board of Meta. Meta’s subsidiary WhatsApp is separately litigating against NSO Group over spyware. That conflict is documented on our Toka page and is not this cluster’s subject.

Three oversight questions the record already asks

Open Questions

Nothing on the public record puts a Toka product inside the National Design Studio. Nothing documents any operational link between them. The network fact is the capital: the same fund invested in both. That fact raises three questions the record already asks. None of the questions asserts that anything is happening. They are the questions oversight has to answer from primary evidence.

Question 1. Conflict of interest. The same lead investor is publicly backing (a) an Israeli firm that sells evidence-alteration to governments and (b) a federal office running unaccountable data infrastructure. Does that meet the disclosable-conflict standard in federal procurement? If it does, where is the disclosure?

Question 2. Detection. If a US citizen is charged with a crime based on video or biometric evidence, and the vendor of the tool that collected it markets undetectable alteration as its product, what mechanism does that citizen have to detect whether the evidence has been altered?

Question 3. Jurisdiction. Who has authority to answer Question 2 from primary evidence? The National Design Studio’s temporary-organization charter removes it from ordinary Inspector General jurisdiction and from USAspending. That leaves GAO, OMB, the Federal Election Commission, the Federal Trade Commission, or Congress itself. Which of those has actual jurisdiction here?

§3 · Standing Invitation

If you are named on this page

If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.

This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.

§4 · See Also