Whoops: 18F’s Slack use could have created a data leak

18F’s enthusiasm for Slack is well documented. The “business inside the federal government” uses the online communication tool to connect a disparate team, encourage an inclusive office culture and even onboard new employees.
But a new report from the General Services Administration’s Office of Inspector General says 18F’s Slack account may have accidentally exposed a bunch of government information to outsiders.
Apparently, 18F shares Google Drive files on Slack, and uses a program called OAuth 2.0 to authorize access. Unfortunately, that’s not so secure. Per the report, the “use of OAuth 2.0 to authorize access between 18F’s Slack account and GSA Google Drive permitted full access to over 100 GSA Google Drives.”
In the report the Office of Inspector General states that “18F’s use of both OAuth 2.0 and Slack is not in compliance with GSA’s Information Technology Standards Profile,” and urges GSA to stop using Slack.
The report was published on Thursday, and 18F responded on Friday afternoon with a thorough blog post explaining the issue. Critically, they claim that “to our knowledge no sensitive information was shared inappropriately.”
18F admits that integrating Google Drive with Slack was a mistake, and one that was rectified as soon as it was noticed which, yes, was five months after an administrator first enabled the configuration.
Despite the OIG’s concern, however, 18F maintains that there was no data breach:

Upon discovering that this integration had been accidentally enabled, we immediately removed the Google Drive integration from our Slack, and then we reviewed all Google Drive files shared between Slack and Drive, just to be sure nothing was shared that shouldn’t have been. Our review indicated no personal health information (PHI), personally identifiable information (PII), trade secrets, or intellectual property was shared.

18F’s blog post does not address the OIG’s assertion that Slack is not in compliance with GSA’s Information Technology Standards.
Read the OIG’s full report here, and 18F’s response here.