The U.S. Secret Service failed to effectively manage and secure the mobile devices its agents use on the job, including during protective operations, leaving sensitive government communications vulnerable to foreign adversaries, a Department of Homeland Security inspector general report found. The DHS Office of Inspector General report, published Monday, adds another chapter to a long and growing record of institutional failures at the agency tasked with protecting the president and other senior officials.
The OIG concluded that agents routinely used personal cell phones for official government business because their agency-issued devices lacked the capabilities they needed. The agency had no policy requiring the testing of mobile application code before installation. And its procedures for securing devices used overseas were, in the inspector general's words, insufficient.
The result, the report warned, was that adversaries "could have intercepted and exploited Secret Service information, placing at risk our Nation's leaders, other protectees, and employees, especially when unsecured devices were used overseas."
The inspector general issued five recommendations aimed at tightening mobile device security and reducing agents' reliance on unmanaged personal phones. The Secret Service concurred with all five. The report did not enumerate the specific recommendations in detail, and it remains unclear whether any adversary actually intercepted agency communications, only that the door was left open for them to do so.
That distinction matters. But the pattern does not inspire confidence. The Secret Service's mobile device problems are not new, and they are not isolated.
In 2022, the New York Post reported that Secret Service agents deleted text messages from January 5, 6, 2021, during a device-replacement program, after the DHS inspector general had already requested those records as part of the January 6 investigation. As many as a third of the agency's personnel had received replacement phones by the time of the records request, potentially destroying unbackedup text data permanently. The agency denied any malicious intent, calling the suggestion "false."
The Associated Press confirmed the same timeline: messages erased "as part of a device-replacement program" even after the OIG had asked for them. Homeland Security personnel were told they could not provide records directly to the inspector general, records had to be reviewed first by DHS attorneys, causing weeks-long delays.
The Secret Service's track record with sensitive data goes back further still. Fox News reported that in 2008, two backup computer tapes containing the personal information of every Secret Service employee, including Social Security numbers, home addresses, medical records, bank accounts, passport numbers, and biometric data, were lost on a Washington, D.C., Metro train. A source with knowledge of the incident said the encryption on the tapes was minimal. Agency leadership was accused of covering up the breach and failing to comply with mandatory reporting requirements.
The OIG's latest findings land in a context the agency would prefer to forget. On July 13, 2024, a gunman identified by the FBI as Thomas Matthew Crooks opened fire at a rally for President Donald Trump in Butler, Pennsylvania. A bullet grazed Trump's right ear. Secret Service agents rushed him offstage and shot Crooks dead at the scene. One rally attendee was killed and another was badly injured.
It was the most serious attempt on a president or presidential candidate since Ronald Reagan was shot in Washington in 1981.
Trump issued a statement afterward focused on the victims. "Most importantly, I want to extend my condolences to the family of the person at the Rally who was killed, and also to the family of another person that was badly injured," he said.
A congressional task force examining the assassination attempt released its final report in December 2024, finding "failures in the planning, execution, and leadership" of the Secret Service. The mobile device review now under discussion does not appear to have been directly tied to the Butler shooting, but the OIG opened the review in part because agents were frequently using personal phones for official business, a security concern that extends to every protective operation the agency runs.
The agency has faced a string of high-profile security challenges in recent months, including multiple shooting incidents near the White House that have tested its perimeter defenses and response protocols.
What makes the OIG's findings so damaging is not any single lapse. It is the picture that emerges when you line up the incidents side by side: deleted text messages, lost data tapes, unencrypted backups, personal phones used for classified work, no app-testing policy, and overseas operations conducted on devices the agency itself could not vouch for.
Each failure on its own might be explained away as a bureaucratic hiccup. Together, they describe an agency that has struggled for years to meet basic information-security standards, even as its mission has grown more complex and the threat environment more dangerous.
Congress has shown some willingness to act. A Senate reconciliation bill steered $1 billion to the Secret Service for White House security upgrades, a sign that lawmakers recognize the agency's resource gaps. But money alone does not fix a culture that loses backup tapes on the subway, deletes records after they have been requested by investigators, and lets agents default to personal phones because their government devices cannot do the job.
The OIG report also noted that the agency's process for identifying employees' operational needs "did not always fully identify" what those employees actually required, leaving them "without essential capabilities." In plain language: the Secret Service did not give its own people the tools they needed, and then acted surprised when agents improvised with unsecured alternatives.
The agency has also found itself in inter-agency disputes over operational security, underscoring the broader tensions around how sensitive information is handled across the federal law enforcement apparatus.
The Secret Service concurred with all five OIG recommendations. That is the bureaucratic equivalent of nodding politely. Concurrence costs nothing. Implementation is what matters, and the report does not describe any enforcement mechanism or timeline for compliance.
The open questions are significant. Did any adversary actually exploit the unsecured devices? Which overseas operations were affected? What specific apps were installed without code review? The OIG report, at least as described, does not answer these questions. And the Secret Service's history of cooperation with oversight, from delayed records production to deleted texts to covered-up data breaches, does not inspire confidence that the full story will come out voluntarily.
The Washington Examiner has documented the fraught relationship between DHS oversight bodies and the agencies they supervise, including allegations that a lead investigator was directed to delay a Secret Service investigation report until after a presidential election and to withhold information that might embarrass the administration. That investigator, David Nieland, said his superiors told him "to withhold and alter certain information in the report of investigation because it was potentially embarrassing to the administration."
That kind of institutional self-protection is precisely what makes inspector general reports like this one necessary, and precisely why concurrence alone is not enough.
Recent incidents, including a shooting at the White House Correspondents' Dinner in which a Secret Service agent was hit, have kept public attention on the agency's readiness. Each new headline raises the same question: Is this agency up to the job?
The Secret Service exists for one purpose above all others: to keep the president and other protectees alive. Every other function, investigations, financial crimes, cyber fraud, is secondary to that mission. When the inspector general finds that the agency's own devices were so poorly managed that agents had to use personal phones, and that adversaries could have exploited the gap, that is not a footnote. It is a fundamental failure of the agency's core responsibility.
Five recommendations and five concurrences look tidy on paper. But the American public has seen this cycle before, the report, the agreement, the promise to do better, and then the next breach, the next deletion, the next lost tape. At some point, concurrence without consequence is just another form of evasion.
An agency that cannot secure its own phones has no business asking the public to trust it with anything more.
