Day Five of the Trump-Musk Treasury Payments Crisis of 2025: Not “Read Only” access anymore

If you are a current or former career Bureau of the Fiscal Service Employee, especially if you’re a legacy IT programmer with years of experience and especially if you are a COBOL programmer currently working on the PAM, SPS or any other adjacent team, contact me over email or over signal — linked here. My Signal username is “NathanTankus.01”. Legal counsel sources and payments level sources at the Federal Reserve are also helpful.

This is a free piece of Notes on the Crises. I will not be paywalling any coverage of this crisis for as long as it persists, so please take out a paid subscription to facilitate performing that public service. If you’re rich, take out the Trump-Musk Treasury Payments Crisis of 2025 Platinum Tier subscription. The additional thing you get is me trying to stop the Treasury’s internal payment system from melting down or Musk taking your confidential information, along with everyone else's.

Normally I carefully edit and review what I write in this newsletter for structure, coherence and other writing factors. I have time for, maybe, coherence. My highest priority is factual accuracy. So let's get into it. As readers are certainly aware by now, yesterday I released a bombshell article laying out the crisis that emerged on Friday with Musk and his “DOGE” trying to get operational access and control. The abbreviated version was in Rolling Stone an hour later. I also have done some interviews which have appeared, and one that has not in Marketwatch. I will obviously be doing a ton more interviews as well. My phone and email have been ringing off the proverbial hook for obvious reasons. Here’s what has appeared so far.

American Prospect: ‘Filled With Unmitigated Terror’ A Q&A with Nathan Tankus on what it means for Elon Musk’s forces to have commandeered some level of control of the U.S. payment system.

Majority Report: Elon’s Coup Lights Five-Alarm Plus Fire w/ Nathan Tankus 

I am going to state the obvious: Until this crisis is resolved or it fundamentally destroys the ability for economic and social life to continue in the United States, this newsletter is now devoted to this crisis full time. Since reporting and sources which have emerged subsequently to yesterday’s piece which I discuss below, it has become clear that at least some of my worst fears are proving true. Thus I’m officially labeling this crisis the “Trump-Musk Treasury Payments Crisis of 2025”. Originally I was going to number this crisis by business days, but as Musk is proudly tweeting about, DOGE is working the weekends. So today is Day 5 of the crisis.

Since I published my article at 6 am yesterday morning, a number of current and former Bureau of the Fiscal Service officials have reached out and unfortunately confirmed the accuracy of my reporting. Both in my understanding of the technical situation and the extreme dangers that the access which had been reported up to that point. All thought read only access was extraordinarily dangerous to the country. Unfortunately, my sources also tell me that the subsequent anonymous sources mainstream journalists reported who worked to downplay the situation are not accurate.

Wired beat me to the punch of reporting that a top DOGE employee, 25 year old former SpaceX employee Marko Elez, has not only read but write access to BFS servers. What can I say, I had to sleep and my sources messaged me after I was asleep. Their article is entitled “A 25-Year-Old With Elon Musk Ties Has Direct Access to the Federal Payment System”, my sources have also independently (and before publication of the Wire article at 1 AM today) confirmed their reporting that:

Two of those sources say that Elez’s privileges include the ability not just to read but to write code on two of the most sensitive systems in the US government: The Payment Automation Manager (PAM) and Secure Payment System (SPS) at the Bureau of the Fiscal Service (BFS). Housed on a top-secret mainframe, these systems control, on a granular level, government payments that in their totality amount to more than a fifth of the US economy. [...]

Typically, those admin privileges could give someone the power to log into servers through secure shell access, navigate the entire file system, change user permissions, and delete or modify critical files. That could allow someone to bypass the security measures of, and potentially cause irreversible changes to, the very systems they have access to. [...]

"Technically I don't see why this couldn't happen," a federal IT worker tells WIRED in a phone call late on Monday night, referring to the possibility of a DOGE employee being granted elevated access to a government server. "If you would have asked me a week ago, I'd have told you that this kind of thing would never in a million years happen. But now, who the fuck knows."

All of this is absolutely true according to my sources.

Additionally, I can exclusively report that while there was initial hesitation from “IT Leadership” to give them access, they relented. However, they still believed this was extremely risky with one member of leadership saying “I’ve never done anything like this before”, according to a source familiar with the situation. A current IT employee of the Bureau of the Fiscal Service told me “This level of unchecked access is critically dangerous to the economy and the government”. When I replied “this is terrifying” to being informed that they have “write access” this source replied “Yeah it's not good. Read privileges on its own still would have left room for catastrophe, but read and write is apocalyptic.”

It is as of yet unclear whether anyone on the Payment Application Modernization (PAM) system or the “Secured Payment System” (SPS) have been put on “paid administrative leave”, coerced into resigning or quit in protest. All that is known is that Marko can “access and query” SPS and that there was someone who gave Marko a “tour” of the facilities. We do not know where they are in operationalizing any control. One senior IT source can see Mark retrieving “close to a thousand rows of data” but they can’t see the content because the system is “top secret” even to them. No source I have has knowledge of what DOGE is doing with the data they are retrieving. 

One source states that IT is “mostly intact” but expects that to change as the return to work mandate comes into effect and/or DOGE starts doing even worse things. To be clear, IT is separate from the COBOL programmers who work specifically on these legacy systems. There have certainly been some number of “less than voluntary” resignations similar to Fiscal Assistant Secretary Lebryk. The only outright firings were of the Economic Equality and Opportunity team which one source found “insanely concerning” since that desegregation and anti-discrimination office has been in every federal agency since 1965. The war on “DEI” in the Federal Government is really a war to rollback desegregation and anti-discrimination protections created by the Civil Rights Acts and is not simply some attack on 2010s non-profit trends as it is often portrayed as. But that’s a whole other story.

One source explicitly said that they were only reporting to me because there was no one left in the Federal Government to report security breaches to:

I do not wish to harm my agency in any way. I loved working here. We did some of the most important work in the country and barely anyone knew who we were. In normal times, I would report insider threats to the appropriate security channels inside the government- but there is no one left for me to report it to.

Thus, my sources have unfortunately confirmed many of my worst fears about this situation.

I would also like to clarify some confusion on social media. The issue with understanding and grasping a COBOL system is not knowing COBOL, as a programming language, in the abstract. Nor is it, god help me, something that AI can “do” because you fired one of these chatbots up and got some code that could compile when you asked “write me some COBOL code”. The issue is understanding the specific physical limitations of the system, the way that it interacts with the “Business Logic” of the code and a million other contextual factors. 

There is specific code which tells you where to direct specific payments in specific ways and the structures, and why they are structured the way they are, requires deep contextual knowledge. This is “business logic”. The entire issue with COBOL and why it has been such a struggle to maintain it is that COBOL systems (both private and public) developed for decades with very little documentation, have a million different path dependent coding choices. Mar Hicks 2020 article in Logic Magazine “Built to Last” is worth a read on this topic.

This is what I meant yesterday when I referenced that 30 different COBOL systems at Treasury had developed their own “dialects” and they launched Payment Application Modernization (PAM), which among other things, unified them. What they unified was the business logic of those systems (as well as likely other factors, most notably the physical architecture of the systems they ran on). Part of me wishes they didn’t modernize with PAM because those 30 different and distinct systems would have been more secure from their infiltration. PAM processed 4.7 trillion dollars of payments in 2024.

It's also true that some similar issues can emerge with other more recent programming languages and the way “business logic” emerges if a mission critical IT system developed using a more recent programming language. But COBOL is unique; after all it's literally “common business-oriented language”. So while knowing the COBOL programming language is better than not knowing it, it does not make that much of a difference with these young Musk programmers mucking about. 

Large established businesses and governments do not have a “COBOL programmer” shortage. They have a “COBOL programmer with experience in legacy business or government IT systems” shortage. There’s a reason that the vast majority of legacy IT COBOL programmers had no objection to me using “knowing COBOL” as a shorthand for all this. They do not think of “COBOL” as just the programming language in the abstract, but all these contexts. This miscommunication and difference in mindset is why there is so much mutual misunderstanding between legacy IT programmers and the modern tech industry. The misunderstanding is primarily on the modern tech industry’s part. 

We are in such a catastrophic situation I do not have the words to describe. It is getting worse and very little is being done. Lawsuits have been launched to stop this on privacy grounds, but we need so much more. Strongly worded letters from congress are not enough. There is a protest at the Treasury today. This is not a newsletter to tell you how to organize or engage in political action. But wherever you are, whatever your context, get involved in resisting the Trump’s administration’s catastrophic lawlessness and destruction. And get the word out about the Trump-Musk Treasury Payments Crisis of 2025, which is the crisis above all the crises happening concurrently. I wish my newsletter’s name were a little less literally true right now.