The Last Days of Big Balls, but DOGE’s Gutting Is Still Happening... Quietly

Security breaches, agencies guts, service disruptions. I know! Let's double the budget! For efficiency.

Edward “Big Balls” Coristine has resigned.

At just 19, he was one of the highest-paid civil servants in the country, with full access to sensitive government systems, top-tier security privileges, and a nickname straight out of frat house folklore. Now he’s gone, quietly. No press release. No thank-you tour. Not even a self-congratulatory thread.

And while America’s late-night hosts mourn the loss of a punch line, the rest of us are left wondering: Why now? What did he see? And more importantly, what did he do?

Because Big Balls wasn’t just a meme. He was a symptom, a signal, a walking indictment of what DOGE has become: reckless, unsupervised, and more dangerous than we were told.

His exit may be clean on paper, but it doesn’t clean up what’s still unfolding across federal systems. Because while Big Balls may have left the building, DOGE is still in deep.

---

So… What’s Been Going On With DOGE Anyway?

When the headlines moved on, most people assumed DOGE — the Department of Government Efficiency — had fizzled. It hadn’t posted splashy new firings. The lawsuits went quiet. The media, overwhelmed with other disasters, stopped checking in.

But here’s the thing: DOGE didn’t stop. It just stopped making noise.

While attention drifted, DOGE operatives stayed embedded across dozens of agencies. They continued to cut staff, disable oversight tools, and — as we now know — install unauthorized satellite internet systems that bypassed federal firewalls entirely.

The core DOGE strategy didn’t slow down. It simply moved off the grid — literally.

---

A Timeline of Breach, Denial, and Quiet Resignation

February 2025

• A Starlink terminal appeared on the roof of the Eisenhower Executive Office Building, steps from the West Wing.

• Installed by DOGE, but not authorized by White House IT.

• Devices began connecting to “Starlink Guest”, bypassing federal VPNs and firewalls.

Mid-March 2025

• Whistleblowers reported unmonitored data transfers from White House-connected devices.

• Traffic was routed through the DOGE-installed Starlink system.

• The quantity and destinations of the data remain unknown because no logs were kept.

March 3, 2025

• At the NLRB, DOGE activated a new user account.

• Within minutes, a Russian IP address attempted to log in using valid credentials.

• Federal logs were disabled shortly beforehand.

April 2025

• A second Starlink terminal was discovered at the NLRB.

• An internal whistleblower reported the presence of malware on systems and 10 GB of outbound data associated with DOGE accounts.

• Still no audit or containment reported.

May 2025

• Elon Musk and Steve Davis exited DOGE leadership.

• Starlink terminals remained active. Oversight remained nonexistent.

June 21, 2025

• Edward “Big Balls” Coristine resigned quietly.

• DOGE’s FY2026 budget request climbs from $20M to $45M.

• DOGE's presence in sensitive agencies continues, untouched.

See our previous reporting on the cybersecurity lapses and breaches here:

Starlink, the White House, and the Data Breach Few Are Talking About

---

It’s Still Happening

Big Balls is emblematic of the issues at DOGE. Young, a history of being fired from a cybersecurity firm for releasing proprietary information, connections to a network of Russian hackers, and unaccountable, he exemplifies everything dangerous about DOGE. Was he connected to the White House and NLRB breaches? Maybe. However, if he was cleared to work at the highest civilian federal wage with access to sensitive government information, there is no reason to think that others with similar problematic histories were not as well.

What is clear is that the two events are united by two factors: DOGE and StarLink. As the leadership and original workers quietly exit, it is hard not to wonder if the incidents and the resignations are related.

Edward Coristine may have walked away, but the system that empowered him hasn’t gone anywhere. In fact, it’s growing.

• The Starlink network at the White House is still active.

• The DOGE accounts with high-level credentials are still embedded in agencies.

• The security logs that were turned off remain off in places, with no federal directive to restore them.

And while internal watchdogs slowly investigate the breaches at the NLRB and the White House, the administration isn’t waiting around. It’s moving full speed ahead, doubling DOGE’s funding for 2026 and expanding its footprint across the federal landscape.

This was supposed to end.

When DOGE was launched, the plan was for a five-month rapid review, a self-expiring task force led by volunteers, which was to wrap up by July 4, 2025. Instead, it’s been institutionalized, budgeted, codified, and scaled.

$45 million. 150 full-time staff. More embedded operatives. More systems access. No reforms. No safeguards. No accountability.

This isn’t the pause after the breach. It’s the reward.

We’ve reported extensively on DOGE. See some of that reporting here:

Note: These articles are more than 45 days old and now live in the archive. Please consider becoming a paid subscriber for full access to the 700+ article archive and exclusive perks.

DOGE: Project 2025’s Trojan Horse

DOGE: The $40 Million Government Improv Show

---

If This Wasn’t Enough… What Will Be?

A Starlink terminal inside the White House.
Ten gigabytes of unlogged data vanishing from the NLRB.
A Russian IP login attempt using valid federal credentials.
Disabled security logs. No oversight. No consequences.

That’s not a theory. That’s the documented record.

And yet, no shutdown orders. No rollbacks. No accountability.

Instead, the response has been chilling in its clarity: a bigger budget, a larger staff, and the promise of permanence. The very office that brought unvetted operatives and foreign-accessible networks into the federal government is now being scaled into 2026 with expanded reach and zero correction.

And despite the shaky savings claims, the upheaval of services, the rehirings and lawsuits, the cybersecurity breaches, and the ballooning costs in just five months, nothing is being done to stop the DOGE machine. In fact, the House has begun legislation to make those cuts permanent, and the Senate is considering a budget bill that de-funds or cripples the agencies targeted by DOGE.

So if this wasn’t enough, what will be?

If a breach at the heart of executive power isn’t sufficient to provoke oversight, what line still exists? If the exposure of vulnerable personal, financial, and national data isn’t a red flag, what exactly is?

The silence isn’t just deafening. It’s defining.

---

What Has to Happen Now

1. Immediate disconnection of all DOGE-installed Starlink networks on federal property.

2. Full audit of DOGE’s access history, credential use, and data movement across agencies.

3. Freeze DOGE’s expansion until congressional oversight hearings can be conducted.

4. Public release of internal reviews, including any OIG findings related to NLRB and White House systems.

5. Enact hard limits on third-party ISP use in federal facilities, starting with executive branch properties.

Call Your Members of Congress

Make your voice heard. Call the congressional switchboard and ask to be connected to your representative and both senators:

U.S. Capitol Switchboard: (202) 224-3121

Sample Call Script

Hi, my name is [Your Name], and I’m a constituent from [Your City, State]. I’m calling to express serious concern about the Department of Government Efficiency and the confirmed cybersecurity breaches tied to unauthorized Starlink use inside federal agencies, including the White House and the NLRB.

I’m urging [Representative/Senator Name] to demand a public audit of DOGE, an immediate freeze on its expansion, and the removal of all non-federal ISP infrastructure like Starlink from government buildings.

This is a national security issue, and I’m asking you to take urgent action before more damage is done. Thank you.

Because if this isn’t where the line gets drawn, then we’ve already crossed it.

Bibliography:

• “Big Balls Leaves Government Hanging After Dumping New Job.” The Daily Beast, June 25, 2025.

• “Musk’s DOGE Goons Surreptitiously Transmitted Reams of White House Data.” The Daily Beast, June 8, 2025.

• “White House Security Staff Warned Musk’s Starlink Is a Security Risk.” Ellen Nakashima, Carol Leonnig, The Washington Post, June 7, 2025.

• “Whistleblower Org Says DOGE May Have Caused ‘Significant Cyber Breach’ at US Labor Watchdog.” Reuters, April 15, 2025.

• “Whistleblower: DOGE Siphoned NLRB Case Data.” Krebs on Security, April 2025. https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/

• “User with Russian IP Address Tried to Log into NLRB Systems Following DOGE Access, Whistleblower Says.” NextGov, April 2025.

• “Whistleblower Alleges Russian IP Address Attempted Access to US Agency’s Systems via DOGE-Created Accounts.” John E. Dunn, CSO Online, April 16, 2025.

• “Musk’s DOGE Goons … Could Expose Data of Millions of Americans to Hackers.” The Daily Beast, June 2025.