NDS Digital Infrastructure & Privacy Monitoring

1. Summary of Findings

Between June 16 and June 29, 2026, daily privacy audits were conducted on five federal websites operated by the White House National Design Studio (NDS). The investigation followed independent journalist Drey's May 27 exposé revealing that these sites were deployed with third-party analytics services without required privacy compliance filings, and was subsequently covered by The Guardian, This Will Hold, and Aaron Parnas.

Three sites named in Drey's article (ndstudio.gov, trumprx.gov, realfood.gov) had their PostHog trackers removed within approximately 20 days. Two sites not named in the article (trumpaccounts.gov and genesis.energy.gov) continued transmitting data to NDS-controlled analytics infrastructure throughout the entire monitoring period, including on the date the 90-day deadline of Executive Order 14399 elapsed.

The monitoring window was chosen to span the 90-day deadline of Executive Order 14399, signed March 31, 2026. A certificate for vote-gov.previews.ndstudio.gov appeared in Certificate Transparency logs nine days after the EO was signed, contradicting the Department of Justice's representation to a federal court (AFT v. SSA, Case 25-1411) that the voter infrastructure “does not exist.”

2. Background

The National Design Studio

The National Design Studio is a White House office established by EO 14338 in August 2025. It is led by Airbnb co-founder Joe Gebbia as Chief Design Officer and staffed largely by former operatives of Elon Musk’s Department of Government Efficiency, including engineers Akash Bobba and Greg Hogan. The studio is a “temporary organization” within the Executive Office of the President, exempt from Senate confirmation and Inspector General jurisdiction. All NDS records are sealed under the Presidential Records Act until 2040.

The NDS has been identified as the operator of approximately 100 unannounced federal domains discovered in Certificate Transparency logs, including replicated versions of vote.gov, passports.gov, and login.gov—all built on White House-controlled infrastructure rather than their traditional agency homes. A recurring date of July 4, 2026, across this infrastructure suggests a potential “switch date” when original agency sites may be redirected to their NDS-built replacements.

The Tracking Discovery

On May 27, 2026, Drey published a Substack investigation revealing that NDS-operated federal websites were running PostHog, a product analytics platform capable of session recording (capturing every click, scroll, and keystroke). The Guardian’s June 28 investigation added that PostHog was deliberately routed through federal domains to evade adblockers, and identified a second custom analytics system called AutoMonitor—539 lines of bespoke JavaScript on ndstudio.gov that recorded clicks, form entries, and session identifiers and forwarded data to an address not visible on the public internet.

Executive Order 14399

EO 14399, “Ensuring Citizenship Verification and Integrity in Federal Elections,” signed March 31, 2026, set a 90-day deadline for DHS, SSA, and the SAVE program to construct a State Citizenship List. Nine days after the EO was signed, a certificate for vote-gov.previews.ndstudio.gov appeared in Certificate Transparency logs—evidence that NDS was building voter infrastructure on White House-controlled servers while the Department of Justice was telling a federal court (AFT v. SSA, Case 25-1411) that no such infrastructure existed.

3. External Reporting

This investigation was not conducted in isolation. The following external reporting provides essential context for the monitoring data, and in several cases the daily audits independently verify or qualify specific claims made in those reports.

The Guardian (June 28, 2026)

“Redesign of US government websites stokes surveillance fears”

• Revealed PostHog was configured to evade adblockers by routing through federal domains
• Identified AutoMonitor, a 539-line custom script on ndstudio.gov
• Reported the White House was contacted June 4; tracking “reportedly removed or deactivated” afterward
• Named Joe Gebbia, Akash Bobba, and Greg Hogan as key NDS personnel

Our audits confirm: Three sites were cleaned, but trumpaccounts.gov transmitted PostHog data continuously through June 29, and genesis.energy.gov’s AutoMonitor remained active. The cleanup was partial.

This Will Hold (May 31, 2026)

“Trump Is Replicating Vote.gov to Recreate Musk’s 2024 Election-Rigging Platform”

• Identified ~100 unannounced NDS domains from Certificate Transparency logs
• Flagged July 4, 2026 as a recurring date across NDS infrastructure
• Noted Greg Hogan now runs Login.gov (150M+ accounts); Edward Coristine (age 20) on staff
• Documented NDS records sealed under Presidential Records Act until 2040

The Drey Dossier (May 27, 2026)

“I found a second vote.gov — and it’s registered to the White House”

The original exposé that started this investigation. Drey identified the five NDS sites, confirmed PostHog tracking on trumprx.gov and trumpaccounts.gov, and documented the absence of required privacy compliance filings. A Pull Request was submitted to Drey’s NDS_servers_map repository on June 16 adding the captured PostHog project key, the EO 14399 deadline, and documentation of the cleanup pattern.

Aaron Parnas (Ongoing)

Multiple posts covering NDS federal website tracking, including a deadline-day follow-up on June 29, 2026. Coverage focuses on legal implications, White House response to the Guardian report, and the broader pattern of federal infrastructure consolidation.

4. Timeline of Events

5. Site Analysis

trumpaccounts.gov

This site was not specifically named in Drey’s May 27 article. It continued transmitting PostHog data on every audit from June 16 through June 29, including after the Guardian contacted the White House on June 4 and after the Guardian story published on June 28. The same project key was originally deployed on trumprx.gov before that site was scrubbed.

genesis.energy.gov

This site was also not named in Drey’s article. The AutoMonitor script tag persisted in the HTML on every audit. The NDS private CDN (genesis.assets.ndstudio.gov) served production partner assets from studio-controlled infrastructure. The Guardian’s June 28 investigation identified AutoMonitor as 539 lines of custom code capable of recording clicks, form entries, and session identifiers.

ndstudio.gov — Cleaned

The studio’s home page. PostHog was removed between May 27 and June 16, consistent with the Guardian’s report that the White House was contacted on June 4. The Guardian identified AutoMonitor on this site specifically, but no active AutoMonitor payloads were detected from June 16 onward. The site continues to serve first-party NDS content via media.ndstudio.gov and embed Cloudflare Stream video.

trumprx.gov — Cleaned

A prescription drug pricing platform. PostHog was removed between May 27 and June 16. All 14 audits from June 16 showed zero PostHog or AutoMonitor traffic. Privacy policy language remained unchanged from when PostHog was present.

realfood.gov — Cleaned

A food policy portal. PostHog removed. Google Maps API remains for location features. No third-party analytics detected. Privacy policy not linked from footer.

6. The Remediation Pattern

The three sites specifically named in Drey’s May 27 article had their PostHog trackers removed within approximately 20 days. The two sites not specifically named continued transmitting data throughout the monitoring period, including after the Guardian contacted the White House and after the Guardian story was published. This pattern is consistent with targeted remediation in response to specific media attention rather than a systemic privacy review.

These findings indicate damage control, not a privacy program. The sites under public scrutiny were cleaned. The sites nobody checked were left running.

7. Executive Order 14399

8. Data Appendix

PostHog requests per day

AutoMonitor + nds-tracker requests per day

Total requests — 14-day trend

9. Methodology

• Tooling: Custom audit script using Camoufox + Playwright, deployed as a daily cron job
• Engagement simulation: Each audit performed human-like interaction (scroll, click navigation, type) followed by a 10-second dwell to capture asynchronous requests
• Scope: Five NDS-controlled federal domains: ndstudio.gov, trumprx.gov, realfood.gov, trumpaccounts.gov, genesis.energy.gov
• Cadence: Daily, June 16 through June 29, 2026 — 14 audit days, 70 total site visits
• Data captured per audit: Full HTTP request log (URL, method, status, content type), browser console output (errors, warnings, log messages), page screenshot, DOM snapshot, page title and metadata
• Tracker classification: Each outbound request categorized by destination host: posthog (PostHog SDK), automonitor (cdn.infra.ndstudio.gov), nds-tracker (other NDS infrastructure), other-tracker (third-party analytics), functional (CSS, images, JS, API calls essential to page function)
• No site alteration: All audits were read-only. No form submissions, no account creation, no file uploads.
• OPSEC: Research artifacts stored outside the primary Obsidian vault. No identifying metadata embedded in outputs.

10. Sources & Project Assets

Cited Sources

1. Drey, “I found a second vote.gov — and it’s registered to the White House,” The Drey Dossier, May 27, 2026. link
2. “Redesign of US government websites stokes surveillance fears,” The Guardian, June 28, 2026. link
3. “Trump Is Replicating Vote.gov to Recreate Musk’s 2024 Election-Rigging Platform,” This Will Hold, May 31, 2026. link
4. Aaron Parnas, “Important Sunday Update: Trump Takes Over Federal Websites,” June 29, 2026. link
5. “New Trump design chief aims to improve thousands of US government websites,” Reuters, August 23, 2025. link
6. Executive Order 14399, Federal Register 91 FR 17125, April 3, 2026. link
7. Executive Order 14338, “Improving Our Nation Through Better Design,” Federal Register, August 26, 2025. link
8. “National Design Studio,” Wikipedia. link
9. Certificate Transparency logs, crt.sh. link

Project Assets