Transcription
The analogy I give is an Apple store-like experience. What if the government had great design, amazing usability running on modern software? At its biggest mandate, it's in the next 3 years, how do we touch every digital service of the United States government? And the private sector's reached out as well. So the support of Founders Fund and Peter Teal, 816Z and Mark Andre, HBC and Joe Wndale, Thrive and Josh Kushner. This is branded civilization scale.
That, my friends, is Joe Gabia. He runs one of the most dangerous offices in the White House right now. And it's called the National Design Studio. Yeah. This is what I like to call Defcon 1 territory. Okay. Because what I believe they are doing is building a parallel federal government inside the executive branch on private infrastructure. And it is all being built by the same people who got sued the last time they touched any federal data.
Now, I've been investigating the National Design Studio for the better half of two weeks now. And what I have found, especially over the last few days, has shaken me to my core. Honestly, it has made me very scared. Okay? And this investigation is going to go pretty deep. Okay? So, I need you to stay with me here. Please stay focused because the deeper this goes, the worse it gets.
Now, if you've been watching my channel for any amount of time, then you'll know that over the past few months, I've been covering two main stories. The first being this ballroom that's going up in place of the east wing and the military apparatus that they are building underneath it which Donald Trump has admitted on camera goes six stories underground and includes a military hospital and research facilities etc etc.
What you don't see are the floors that I believe in here and they have very very uh important rooms very the most important. We went down six stories.
And the second is the Genesis mission, which is the federal AI program, which I believe is being built around Oracle and the largest supercomputer in American history called Solstice. And I've been saying for a while now that these two stories are connected, but there has to be some layer in between. You know, some piece of digital infrastructure that is linking the underground hardware to the data that's being assembled by the AI program. And it is through my investigation of the National Design Studio that I think I found that layer. and I found it almost by accident, which doesn't make it any more pleasant, but here we are.
So, earlier this week, I was perusing Trump RX, right, as one does, the new federal prescription drug pricing website. I was curious. I just wanted to see what they had going on. So, I was scrolling around and at the bottom of the page, I noticed something that I have not noticed on any other federal website. In the footer of the page, it said right above the privacy policy, designed and engineered in DC by National Design Studio. The whole website, by the way, looks like it was created on Wix with widgets and it's bizarre. But that line in particular is pretty weird because federal websites don't have design by lines. I mean, the IRS does not credit the design studio for that website. Neither does Social Security or the FBI. Like, nobody does that with federal government websites. Moreover, the design studio is hyperlinked. So, when you click on it, it takes you to the National Design Studio's website, which I don't love. And in a minute, you're going to see why.
Now, National Design Studio, which I'll be referring to as NDS throughout this video, reads more like a tech startup than anything else. And the site itself doesn't really tell you much beyond the mission statement language and recruiting copy. Like, it's very boilerplate and very in-your-face with how hip and cool it is. You know, very Silicon Valley. And there was no page telling you about who was on the team or who was running it. So, I had to do a little digging and the first name that came back to me was somebody named Joe Gbia. He is known as the chief design officer of the United States working with NDS.
Now, you probably have never heard of Joe Gibbia. Lord knows I hadn't before this, but fear not. He's the co-founder of Airbnb. So, you know, if anybody knows how to improve public spaces, it's the company that took residential spaces and made sure the public could never actually afford them again. He stepped back from Airbnb in 2022. But it's the years since then and now that really interest me because in September of 2022, Tesla appointed him to their board of directors. Yes, in fact, the seat he took had just been vacated by Larry Ellison. Yes, that Larry Ellison, the founder and chairman of Oracle. And hold on to old Larry Barry and Oracle in the back of your head, okay? Because this is going to come back up in a moment.
Then in August of 2025, Donald Trump signed an executive order creating a brand new federal office called the National Design Studio. This is also when he created the brand new federal title to go with it, the chief design officer of the United States. And Joe Gibbia was named that title on day one. and he reports directly to the White House chief of staff, Susie Wilds, which is bizarre, right? I mean, a National Design Studio reporting to the White House chief of staff. Like, that's not how this works. Why is it working like that? Well, it's because the National Design Studio is staffed under a federal hiring authority called section 3161, which was originally written for temporary advising bodies. And since they're working under that authority, that means almost everyone working at the National Design Studio is either a part-time adviser or a volunteer. You know how billionaires like to volunteer their time for federal design agencies. And so they don't show up on the White House salary report, nor do they file any financial disclosures that the public who has a financial stake in what they're doing can see. They were also not confirmed by the Senate. And they answer to no inspector general because the executive office of the president does not have one.
Well, where have I heard this before? Let's see. A brand new office inside the White House, staffed by people who are invisible to the federal disclosure process, answering to no independent oversight. Where have I heard that before? Oh, that's right. Because that's exactly how Doge was run. And Doge, lest we forget, in its very short, very horrific run, gutted federal agencies, fired tens of thousands of career civil servants and is currently the defendant in multiple federal lawsuits. And more specifically, those lawsuits are for letting engineers access social security data and the Department of Homeland Security data and share that sensitive federal data with outside parties trying to overturn elections. That Doge. And what do you know? I found in my investigation that Joe Gabia was also a member of Doge. Yep. He spent a whole 6 months there before his current position. And one of the initiatives that he personally led at Doge was the digitization of the federal retirement paperwork.
And this is actually where it gets really interesting and connects a little bit to some of this Eastwing ballroom underground bunker stuff. See, the records he was trying to digitize live in a place called Iron Mountain. About an hour north of Pittsburgh in a town called Boyers, Pennsylvania, there's a limestone mine 220 ft underground. And the federal government has been using this limestone mine as a retirement office since 1960. What do I mean by that? Well, the Office of Personnel Management, OPM, keeps 450 employees working down there full-time alongside 26,000 filing cabinets holding over 400 million paper records, processing about 10,000 federal retirements every month by hand. And I know the first thought that comes into a lot of people's minds is why the hell do we have that? Like why do we still have physical paperwork for processing people's retirements? And the reason is not because we technologically have not been able to digitize it. I mean, every administration since Reagan has tried to digitize these records. And every single one of them has failed for a multitude of reasons. It's because in order to do it correctly, meaning lawfully, you know, with the legal protections that the federal office of personnel requires is genuinely a very expensive thing to do. And it's politically very contentious. Because the reality is is that physical paperwork in a mine has a different level of protection than digitized paperwork. And so Joe Gia and his team over at Doge said, "We can do it." And they started to move these records onto the digital infrastructure that the White House now controls. Yeah. Instead, they just worked around the legal guard rails and called it a day.
Now, I wanted to learn more about what he was doing with National Design Studio. So, I started this investigation like I do all of them by following the money, except I hit immediate roadblocks because I remember that this is all being done off the books, right? Just like Doge did. I mean, there are no contracts on USA spending. the office is not registered on SAM.gov. As a federal procurement entity, the National Design Studio doesn't technically exist, which is probably the point, you know, because it was certainly the point with Doge, so I don't see why it would be any different here. And so, I did what I always do when I can't follow the money. I followed the data instead. I promise you, following the data is just as good as following the money. And you can't cover it up as easily because data always leaves behind residual data. It leaves behind a little trail like dust on furniture that you think you just cleaned.
And so when I was thinking through how I was going to follow the data for this investigation, that pattern recognition part of my brain started tingling, you know, because I remembered what Larry Ellison's company had been doing for the last decade. I remember reading about the time that Oracle ran this network of tracking tools that were embedded across the internet to build what they were internally calling digital dossas. And basically, they were these files of very sensitive information on people containing like where you lived, where you bank, what you buy, your political views, your race, like everything. And Oracle CEO Larry Ellison at one point in 2015 was even publicly bragging on stage claiming that the company had dossas on roughly 5 billion people. And I go into these digital dossas in more depth in another video which I recommend watching after this. But the TLDDR is this. In 2022, Oracle got sued in federal court for building those files without consent. And in July of 2024, they had settled for $115 million and shut the entire operation down. But that operation was obviously valuable enough to Ellison that he ran it for over a decade and only quit when he was forced to. And so I just think it's I don't know funny timing that five months after Oracle exits the dossier business, Joe Gbia joins Doge in the White House, you know, and now 6 months later he's running the National Design Studio with a lot of the same framework that Doge had. And so my question was simple. What if that same playbook is running here on federal websites with federal data? And the only place that question gets answered is in the code.
So I went and looked at the code behind these government websites. So I started with Trump RX, you know, since that was the site that got me here. Now code can be very overwhelming to look at, right? But the way that I think about it is that every web page whenever you load it is making phone calls, not to people exactly, but to other servers around the internet. You know, dozens per second. All of that invisible to you unless you click inspect. And so I rightclicked on Trump RX, opened the browser's built-in inspector, jumped over to the applications, and started reading the list. And that's when I saw that mixed in with the normal calls were calls that were going out to a company called Post Hog.
Upon further investigation, I found that Post Hog is a Silicon Valley analytics company whose whole business model is recording what visitors do on a website and selling it back to whoever owns the website. And this page was calling out to Post Hog over and over and over again. I mean, I had just opened the page and was more or less just sitting there. And to the best I can read it, the page was already on the phone with Postto telling them everything about me. And so I looked a bit closer at what instructions Trump RX was actually giving to Post Hog. And what it was doing was recording my session with the IP address not stripped, meaning that it was not anonymized. Here's what's really interesting. Because these session recordings were being disguised to make it look like they were going back to Trump RX to your browser, but in actuality, there is a script in the JavaScript that is actually forwarding it to Post Hog. And the thing is is that this is a technique that companies have been using to get past ad blockers for ages, right? But this is not the kind of thing that you expect to see on a federal drug pricing website. And so I'm alarmed, right? And I decided to go look at the other websites that this office had built to see if it was doing the same thing. And what do you know? Yeah, it it is. I mean, this includes the real food.gov, the federal food policy site, Trump accounts, you know, the Trump children's savings program or whatever it is, and even the studio's own homepage. anddystudios.gov. And so all of them have the same vendor, right? The same setup. The IP address is not stripped, the same trick to hide where all the data is going.
But I noticed something particular with ndstudio.gov. And it was only on ndstudio.gov. There was this second system that was running alongside Post Hog that someone had built entirely by hand from scratch. It was this long string of code, about 540 lines of JavaScript with a name embedded right into the code. It was called Auto Monitor. Now, look, I'm no professional web developer. So, I sent it over to a friend of mine who is a web developer and is much more into the computer smarts than I am. And from what he can tell, he said that he thinks that what it does is rewire the part of the browser that handles how a page talks to the outside world. So, basically, every conversation that the page has with any other server gets copied and forwarded to somewhere else. And we tried to follow that somewhere to see where it ended up. And it turns out it goes to a private backend with no public page. So, nobody answers when you knock.
Now, I want to be honest about what I can and cannot prove here. From what I can see, Auto Monitor is only loaded on the studio's own homepage, which is kind of weird, right? I mean, if the goal is to surveil Americans, why wouldn't you put it on something like Trump RX? You know, why put it on a website that almost nobody knows exists? But every Post Hog recording on every one of the federal sites that's linked with the NDS website at the bottom, to the best I can read, passes through the studio controlled infrastructure on its way to Post Hog. And so that would mean that the studio has the structural ability to keep a copy of every recording as it passes through. And so this was pretty concerning to me, right?
And so the next thing I wanted to know was whether or not there were other sites that the studio just hadn't announced yet. And here's a fun fact that not a lot of people outside of security research knows about. Every website that has that little padlock in the address bar has something called a certificate attached to it. And there's this rule in the industry that anytime a certificate is issued anywhere in the entire world, it has to be logged in a public ledger the second that it's created. That's right. There are no exceptions and no opt outs. And the lovely side effect of that rule is that now every new website on the internet, even the ones that nobody's announced yet, or even if it's hidden behind some kind of login, leaves a public fingerprint the moment that it's built. And even more lovely than that is that there's this free search engine called crt.sh SH where anybody can look up any of these logs. And so I typed in the studio's domain with a wild card, which is just a little asterisk at the beginning of it as a way of telling it to show me every certificate ever issued for any subdomain under ndstudio.gov. And the search took about 30 seconds. And what it came back with was yeah, it returned with no less than 40 more entries attached to ndstudio.gov. None of them announced anywhere with no links pointing them from any public page. And I just need to read some of these names off to you guys, okay? Because these were sites that looked like they belonged to different like departments, right, of the federal government, like state departments and to NASA and the Department of Homeland Security, but they don't. They in fact don't. And I logged all of these in an Excel sheet with the domain, subdomain, when it was first seen, last seen, the certificate, issuer, all of that, which will be available on my Substack. And so if you want to go look any deeper, by all means have at it. But a few of the ones that were most concerning to me were the ones like NASA Force.staging.ndsstudio.gov, passports.staging.ndsstudio.gov. By the way, staging is typically what developers will put when they're building a website. And they've created the certificate, but it's not quite ready. It's the staging website. And the two that really uh concern me, votegv.previews.ndstudio.gov and FBI kirk tipline.reviews.ndstudio.go.
Now, let the record show that these are federal agencies, which means that they do not belong to the National Design Studio, right? These don't belong to the National Design Studio, right? Yeah. Well, about that. I um I checked the public ownership records for each of these subdomains, you know, just to be sure. And every single one of them, all 40some that I could find, traced back to the same place, the Executive Office of the President. Yes. So, the National Design Agency has built pre-launch versions of websites that look like they belong to federal agencies and registered them all to the White House. Because remember, the White House is the executive office. And when things are under the executive office's control, it means that they don't always have to have congressional oversight, i.e. the ballroom. And look, there's a lot we need to unpack about the passport thing and the FBI tip line for Charlie Kirk. And we're going to get into all of that in a second, okay?
So, at first I needed to know who was running the infrastructure underneath everything. Well, every NDS site had the same label attached, Cloudflare, which is a private company that hosts and protects a huge chunk of the internet. Now, using Cloudflare is not necessarily abnormal for a federal agency. But running 40 federal websites through one single private Cloudflare account is another matter entirely, and all gated preview sites funneled into one single login screen that read loveiskll.cloudflareac.com. Let's read that again. Love is a skill.cloudflare access.com. That is something. That's something. And that name is just cringey enough where I think I know exactly who is behind that account. All right. And it's Joe Gbia. And not because he is the chief design studio guy. No, no, no. It is because when I was doing research for this, there was a phrase that he had been using publicly time and time again whenever he was describing Airbnb's design philosophy, which is that Airbnb taught him that love is a skill. Sound off in the comments. Do you think love is a skill? And what's really upsetting about this, I think, to me is that this is the kind of thing you would name an account when it belongs to you personally. Right? If Joe wanted to name his own personal cloud flare account, love is a skill, but not what you're naming something that belongs to the federal government. Why? Why? Why?
Moreover, the federal infrastructure is supposed to be owned by the agency, not the one person running it. I mean, it's not even legal for you to do it that way. When the federal government collects information on its citizens, the law requires a few specific things to happen first. It requires privacy disclosures, which none of these websites have. The privacy policies all contradict each other. It requires notices to the Federal Register, published contracts with any outside vendors so that there's a clear chain of accountability. And I went looking across all 12 national design studio programs that were publicly available to see, and I found none of that. I mean, those were the entire point of the laws that Congress wrote after Watergate and after 9/11 to make sure that the federal government could not run secret surveillance programs on Americans. You know, like Larry Ellison pitched two weeks after 9/11. Like I said, the only document that they do publish on their websites are these privacy policies. And for example, like on Trump RX, it contradicts itself two paragraphs apart. The first paragraph says that Post Hog may record its page users visits and medications that they view. Meanwhile, two paragraphs later, it says that they do not collect any health or medical information. I'm sorry, if I'm buying medications, those two things cannot be true. Straight to jail right now.
And because this was all pissing me off, I wanted to be very clear at who I was pissed off at. So, I started looking for the people who were working at National Design Studio besides Joe. And it wasn't easy to find this information because there's no list anywhere that states who they are, right? But I read the bylines of the studios blog posts and checked each name against different court filings from 2025. And what do you know? Every senior name came back from the same place, Doge. And there was one name in particular that stopped me. Greg Hogan. Because in 2025, a judge ordered everybody at Doge be blocked from accessing personnel records at the Office of Personnel Management, OPM. However, that order had exceptions. Three people were allowed to keep their access anyway. And one of those three people was Greg Hogan. Yeah. Because the administration argued that he specifically was essential to ongoing system work. And the judge just accepted it. And so while every other Doge staffer was locked out, Hogan kept his access to the federal personnel records the entire time. And a year later, he moved from Doge into the National Design Studio. And just last month, he was promoted to run login.gov. Now login.gov, if you're not aware, is the federal government sign-in system. So, if you've ever applied for a federal job or requested your social security records online or filed your taxes, wanted to check on how they were doing or I don't know, filed any federal benefits, you've used it or you will use it. I've used it. Okay, it even scans for biometrics. I've scanned my biometrics on it. You have to turn your head all the different way. I remember having to do it so many times. Oh my god. It's basically the front door to your federal identity and more than 150 million Americans have accounts. All right. And now the man who survived the OPM injunction is now in charge of that front door. Ring ring ring. Do you see where the five alarm fire is here?
Another name that I found was a cash Boba who was one of the original six engineers that Musk brought into Doge on day one who now also works for the National Design Studio. Which brings me to what happened in October of 2025 because a cash boba got on a recorded conference call with the state election directors from across the country and presented the federal voter registration system that the national design studio was building. And what he presented was that voters would register through their federal portal which their identities would be verified through login.gov of course you know which his former colleague Greg Hogan now runs and their citizenship would be verified through DHS's save database and their registrations transmitted to the states. And it was on that call that a state election director asked Boba what the data the federal government would retain. And Boba said, and I quote, "I don't know what they retain and what they are logging." End quote. Okay, so let me get this straight. The person presenting the federal voter registration system to the state election directors does not know what data his own system keeps on American voters. Okay? And this is important because after the disputed 2000 election in Florida, Congress had passed the 2002 Help America Vote Act with overwhelming bipartisan support and it created the Election Assistance Commission. Four commissioners split evenly by party, an inspector general, and FOYA obligations all written into the law. And the lesson from that was very clear. Voter registration must never sit inside the president's white house. Period. Why? Oh, I don't know. Because giving an incumbent visibility into who is checking registration before an election creates a structural conflict of interest that no functioning democracy can survive. That's why so Congress built a wall and that is why today vote.gov is registered to the election assistance commission as its own separate federal government agency. And at the time of recording this video that wall is still standing I think. But here's what I found in the certificate logs. A working preview of vote.gov of had been built inside NDS's studio staging environment and it's behind the same Cloudflare login but locked down tighter than any of the other previews. The certificate appeared for that website on April 10th, 2026 and it was isolated deliberately which means that somebody went out of their way to make sure that nobody could stumble onto it. Well, almost nobody. Now, I think it's worth noting that a few weeks before that certificate appeared, the administration signed an executive order requiring DHS, the Social Security Administration, and the SAVE program to construct a federal citizenship verified voter list. What does that look like? I don't know. But what I do know is that there's a deadline of 90 days from signing. And that deadline is a mere few weeks away. And as of the time of this recording, the Elections Assistance Commission has not publicly said one word about the fact that the White House has built a preview for the website that EAC owns. So either they don't know or they don't care. And I'm really hoping it's the former, in which case, hi, that's what they're doing.
Now, before we wrap all of this up, I do want to circle back to that one certificate log entry called FBI Kirk tip line, because that one has been bugging me a lot. Mostly because I saw that the certificate for that website was issued in March of 2026 for FBI kirk tipline.gov. Now, a couple of things don't really add up with that. First of all, it's because in September of 2025, as we all know, the conservative activist Charlie Kirk was shot and killed. And it was Tyler Robinson who was taken into custody 2 days later and formally charged on September 16th. So, the suspect was in custody and the charges were filed within the same week. And I know some of you are saying, "Well, they did have a tip line though, remember?" To which I say, "Yeah, I do remember." But I believe they said specifically any videos or photos that you might have uh the public should be submitted to our digital media tip line, which is uh www.fbi.gov/utah valley shooting all lowercase. Again, that is fi.gov/utah valley shooting all lowercase. You can also provide general tips about the shooting by calling 1 800 call FBI. That's 1800 C l FBI or at tips.fbi.gov.
And so the question I'm left with is what this tip line was actually going to be used for 6 months after the investigation was closed and what does that mean for everybody who called the other tip line? Did that get investigated at all? And the second thing I found tonight, actually, while I was finishing writing the outline for this video, might be the most significant of all. So, remember one of the hidden domains that I mentioned earlier included passports.staging.ndsstudio.gov. Tonight, I just for funsies wanted to type in passports.gov to see what kind of website it was shadowing. And instead of taking me to a federal government website, it took me to this page with a popup that said, "Enter your email and we'll send you a six-digit code." Yeah. No State Department seal, no agency name, no privacy notice, just a big old button that said send code, which obviously I did not put my email in there because what the [ __ ] is that? And so I decided to do another sweep of this website, right? Pull as much information as I could from it. And as it turns out, the first certificate for passports.gov was issued on May 5th, 3 weeks ago. And the sign-in domain that you're looking at right now, the o.pasports.gov, got its first certificate 4 days ago on May 22nd, which would be the craziest thing I ever heard of, except for the fact that while I was finishing writing this, like 45 minutes ago, they issued more certificates for a subdomain called photo.pasports.gov. Not once, not twice, but nine separate certificates between 2:00 a.m. Pacific Standard Time and 3:00 a.m. Pacific Standard Time. Yeah, they are standing this up right now in real time.
Okay. So, what do I think is happening here? What do I think the purpose of all of this is? I think to me, clearly the purpose is to pull all of the parts of the federal government that actually touch you away from the agencies that legally own them and rebuild them on an infrastructure that the White House and the Executive Office fully controls. And once you control the front doors, well, you need somewhere to put all of the data that's going to come through them, right? Somewhere that only the executive office can reach, which is I think the entire point of what is being built six stories underground in DC under the executive office of the president. And then with that, the Presidential Records Act closes the door right behind it because the day that the administration ends, you know, in 2028, God willing, everything seals for the next 12 years. So until 2040, nobody outside the White House gets to see who worked there, what they collected, or what data went where.
And look, and I know that sounds all very overwhelming and scary. So, here's what I think we can do about it in the meantime. I mean, honestly, the most important thing is to send this information to your representatives. Having them know what's going on is the first step to anything else because none of this gets fixed without Congress paying attention. And I don't think Congress is paying attention to the backend code of these websites. So, please send them this video or my Substack article. You know, I've sent everything that I have to the only two lawyers I know on Capitol Hill. And so I'm hoping something comes of that. And something else we definitely need to keep an eye on is the day that vote.gov's registration flips over to the executive office of the president because that's the day that the wall that Congress built after Florida 2000 essentially comes down. And the citizen verification executive order deadline is still a few weeks out. And I think what happens on that day will tell us how far along they actually are. And we also need to, I guess, keep an eye on passports.gov because oh my god, it seems like they are planning for something right now this week. So please, I beg of you, if you are a more data savvy, tech savvy person than I am, please dig into this with me. And don't worry, every domain, every certificate, every staging environment, every GitHub repository that I found will be linked at the bottom of my Substack article that goes with this video. It's free to subscribe. I It's just the most organized place that I can keep it. And help me out because I am but one person and I know that I'm only just scratching the surface with this. You know, Trump told us himself that the ballroom and whatever is being built underneath it is something that he's donating for the future presidents of the United States of America. And that is the one thing I think in this whole story that I can take him at his word on because this infrastructure is going to outlast him. And whoever wins in 2028 inherits all of it. You know, the National Design Studio says its job is to redesign how Americans experience their government, but I think the job that they're actually redesigning is how the government experiences its citizens. Meanwhile, the only thing that they really rebranded were Oracles dossas.