Edward Coristine — DOGE Engineer (“Big Balls”)
Economic & Regulatory

Edward Coristine — DOGE Engineer (“Big Balls”)

Skip to main content
Table of Contents
< All Topics
Print

Edward Coristine — DOGE Engineer (“Big Balls”)

Posted
Updated
ByPU Publish
0 out of 5 stars
5 Stars 0%
4 Stars 0%
3 Stars 0%
2 Stars 0%
1 Stars 0%

Role: DOGE engineer with access to multiple federal systems beginning January 2025; 19 years old at the time of appointment; previously a Neuralink intern; online handles “Big Balls,” “Rivage,” and “JoeyCrafter.”

Basis for Inclusion

Subject classification: Voluntary Public Figure (private citizen granted federal authority).

Anchor met: Anchor B / D — operational coordinator role at DOGE with administrative access to federal systems holding personally identifiable information on hundreds of millions of Americans.

Background

Coristine was born in December 2005. He graduated from Rye Country Day School in 2024 and enrolled at Northeastern University as a mechanical engineering and physics major; he left to join the federal government within months of starting college. He is a registered Republican who friends describe as having idolized Elon Musk (Wikipedia; Newsweek, Feb 7, 2025).

Before joining DOGE, Coristine:

  • Founded Tesla.Sexy LLC at age 16 — a Connecticut-registered entity that managed dozens of web domains, including at least two registered in Russia. One Russia-facing domain hosted Helfie, an AI Discord bot targeting the Russian market (Wired, Feb 2025; ABC News, Mar 27, 2025).
  • Was hired and then fired in 2022 by Path Network, a network monitoring firm known for employing former black-hat hackers, after an internal probe found he had leaked proprietary information to a competitor (Bloomberg, Feb 7, 2025; CNN).
  • Operated DiamondCDN, a content-delivery and DDoS-protection service. Between October 2022 and June 2023, DiamondCDN’s IP infrastructure provided DDoS protection and caching to EGodly, a cybercrime group that publicly thanked DiamondCDN on Telegram on Feb 15, 2023 (Reuters; Fortune, Mar 27, 2025; ABC News).
  • Was linked by investigative journalist Brian Krebs to “The Com,” a network of Discord and Telegram channels associated with cybercrime activity, where he allegedly used the handles “Rivage” and “JoeyCrafter” (Krebs on Security; Revolving Door Project, Mar 14, 2025).
  • A Telegram handle tied to Coristine reportedly solicited a distributed denial-of-service (DDoS) attack-for-hire service in 2022 (Wired, Feb 2025).
  • Interned briefly at Neuralink, Musk’s brain-computer-interface company, prior to his DOGE appointment.

Coristine’s maternal grandfather was Valery Martynov, a former KGB officer executed by the Soviet Union after being unmasked as a double agent working for U.S. intelligence — a biographical detail that drew additional scrutiny given his subsequent unvetted access to sensitive U.S. government systems (India Today, Jun 25, 2025; Wikipedia).

DOGE Role and Federal Deployments

Coristine joined DOGE in January 2025 as part of the founding cohort of teen and early-20s engineers without prior government experience. He reported to Amanda Scales, a former xAI employee installed as OPM chief of staff (Wikipedia citing Wired). His formal designation at OPM was “expert”; he was later titled “Senior Advisor” at DOGE proper.

Reported placements include:

  • Office of Personnel Management (OPM) — sat on calls reviewing federal employees’ code and demanding they “justify their jobs”; used a non-government email address (Wired).
  • Cybersecurity and Infrastructure Security Agency (CISA) / Department of Homeland Security (DHS) — issued a DHS email and granted physical access to CISA facilities, the U.S. agency holding much of the country’s worldwide cyber-threat intelligence (Nextgov/FCW, Feb 19, 2025).
  • General Services Administration (GSA) — detailed to HHS and USDS through GSA (AFL-CIO v. DOL filings; Supreme Court amicus, May 23, 2025).
  • State Department, Bureau of Diplomatic Technology (DT) — listed as a “senior adviser” in internal directories (Biometric Update; Nextgov/FCW).
  • Social Security Administration (SSA) — granted administrative access to a cloud environment containing live NUMIDENT data (see Real-World Impacts).
  • U.S. Citizenship and Immigration Services (USCIS), Department of Education, HHS, USAID, Small Business Administration (SBA), FEMA — additional reported access points (ABC News; Politico; Revolving Door Project).

In May 2025, Coristine converted from a special government employee to a full-time federal employee at GS-15, one of the highest pay grades on the federal civilian schedule (Wired, “Big Balls’ Is Officially a Full-Time Government Employee,” Jun 4, 2025).

He resigned from DOGE in June 2025, was reported by the White House as having “left the Trump administration,” and within days reappeared at the Social Security Administration as a special government employee tasked with “improving the functionality of the Social Security website” (NBC News, Jun 26, 2025; The Hill, Jun 26, 2025; New York Times, Jun 24, 2025).

By late 2025, Coristine had moved to the White House National Design Studio (NDS), a new executive-office unit created by executive order on Aug 21, 2025 and led by Airbnb co-founder and Chief Design Officer Joe Gebbia. WIRED describes Coristine as head of engineering at NDS — a body the administration itself has described as “a stripped-down successor” to DOGE (Wired, “The National Design Studio Became a DOGE Landing Pad. Now ‘Big Balls’ Is Recruiting”; Federal News Network; Wikipedia). The July 19, 2026 Washington Post survey of DOGE’s afterlife identifies Coristine as NDS’s “chief engineer” and describes the studio as one of several channels through which DOGE alumni continue to operate inside the executive branch after the formal winddown (Washington Post, “DOGE was supposed to be dead. Its remnants are everywhere,” Jul 19, 2026).

NDS was created by executive order without going through Senate confirmation and, as a “temporary organization” inside the Executive Office of the President, sits outside the standard financial-disclosure regime and the jurisdiction of cabinet-department inspectors general. Its funding and contracts do not appear in USAspending (The Guardian, “‘It’s dangerous and it’s going to erode trust’: redesign of US government websites raises privacy fears,” Jun 28, 2026).

NDS deliverables involving Coristine

  • Rampart (Jun 2026): Coristine and NDS engineer Tai Groot shipped Rampart, a 14.7 MB open-source browser-side model intended to redact personally identifiable information before it leaves a user’s browser (e.g., before it is sent to a third-party chatbot). Coristine and Groot promoted the release on the TBPN podcast, with Coristine calling it a “side quest” and telling WIRED’s interview source that the NDS team of ~30 did not include a machine-learning engineer (Wired, “The National Design Studio Became a DOGE Landing Pad. Now ‘Big Balls’ Is Recruiting”; TBPN interview on X).
  • freedom.gov (Feb 2026): Reuters reported that the State Department, under Secretary Marco Rubio and Undersecretary for Public Diplomacy Sarah Rogers, is developing an online portal at freedom.gov intended to let users in Europe and elsewhere reach content restricted under local hate-speech, terrorism-content, and disinformation rules — a project explicitly framed by the administration as a counter to EU digital-services regulation. Reuters and The Daily Beast reported Coristine’s involvement via NDS; the domain was registered on Jan 12, 2026, and initially displayed only the NDS logo and a login form (Reuters, “US plans online portal to bypass content bans in Europe and elsewhere,” Feb 18, 2026; The Daily Beast, “Trump Gives ‘Big Balls’ Edward Coristine Huge New Job to Undermine U.S. Allies”).
  • Visitor tracking on federal websites: The Guardian’s June 28, 2026 investigation reported that NDS installed visitor-tracking software on sensitive federal sites — including passport applications, voter-registration pages, prescription-drug pricing, and children’s savings — in ways critics say may violate federal law, with Coristine appearing in photos and video on the NDS site (The Guardian, Jun 28, 2026).

Documented Actions

  • Participated in DOGE personnel actions affecting federal workforce reductions and program audits at multiple agencies.
  • On a Small Business Administration call, asserted DOGE wanted access to human-resources data (Wired).
  • Listed by Senate HSGAC investigators as having had “unrestricted access to SSA data, including the personal information of all Americans” while the agency had no visibility into his work (HSGAC DOGE Report, 2025).
  • Reportedly retained government access following Musk’s departure from DOGE in spring 2025.
  • After resigning from DOGE, appeared in a viral YouTube video with right-wing “fraud influencer” Nick Shirley in which Coristine claimed to have personally pulled Medicaid-spending data on California businesses for use as investigative targets (Wired, “Edward ‘Big Balls’ Coristine Is Helping Out on Viral Fraud Videos Now”).

Real-World Impacts

Federal Employees

  • Participated in DOGE personnel actions, audits, and code-justification reviews tied to reductions in force across multiple agencies.
  • Named or referenced in federal-employee class actions challenging DOGE access to personnel, payroll, and benefits systems, including:
  • Alliance for Retired Americans v. Bessent, No. 1:25-cv-00313 (D.D.C., filed Feb 3, 2025; Judge Colleen Kollar-Kotelly; case terminated on summary judgment Mar 5, 2026) — CourtListener docket.
  • American Federation of Labor and Congress of Industrial Organizations (AFL-CIO) v. Department of Labor, No. 1:25-cv-00339 (D.D.C., filed Feb 5, 2025) — CourtListener docket.
  • American Federation of Government Employees, AFL-CIO v. U.S. Office of Personnel Management, No. 1:25-cv-01237 (S.D.N.Y., filed Feb 11, 2025; Judge Denise L. Cote) — CourtListener docket. Charles Borges’s Aug 26, 2025 whistleblower disclosure was later filed as Exhibit A to ECF No. 172-1 in this case (EFF-hosted copy).
  • American Federation of State, County and Municipal Employees, AFL-CIO v. Social Security Administration, No. 1:25-cv-00596 (D. Md., filed Feb 21, 2025; Judge Ellen Lipton Hollander), which produced the temporary restraining order limiting DOGE access to SSA information — CourtListener docket.
  • State of New York v. Trump, No. 1:25-cv-01144 (S.D.N.Y., filed Feb 7, 2025) — CourtListener docket.

American Citizens (Public Services)

Vulnerable Populations

  • Recipients of Social Security retirement, disability (SSDI), and SSI benefits had their NUMIDENT records — including SSNs, date and place of birth, parents’ names, citizenship status, and disability-related information — copied into a cloud environment to which Coristine and a handful of other DOGE personnel reportedly had administrative control (Borges whistleblower complaint, Aug 26, 2025).

Privacy and Data Security

  • NUMIDENT cloud transfer (June–July 2025): Per the formal whistleblower disclosure filed by former SSA Chief Data Officer Charles Borges on Aug 26, 2025, DOGE personnel — including Coristine and SSA-detailed engineer John Solly, with authorization from DOGE-affiliated Michael Russo and SSA CIO Aram Moghaddassi — caused a live copy of the entire NUMIDENT database (core identity records for more than 300 million Americans, drawn from a file that has issued more than 548 million Social Security numbers) to be uploaded to an Amazon Web Services environment that “apparently lacks any security oversight from SSA or tracking to determine who is accessing or has accessed the copy of this data.” Borges alleged this violated the Privacy Act of 1974, FISMA, the Computer Fraud and Abuse Act, the Inspector General Act, and may have circumvented a federal court order limiting DOGE access to SSA systems. The full disclosure was later filed as Exhibit A to ECF No. 172-1 in AFGE v. OPM (S.D.N.Y., No. 1:25-cv-01237-DLC) on Dec 15, 2025 (Borges Disclosure to Congress (EFF-hosted PDF); New York Times, “DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says,” Aug 26, 2025; Government Accountability Project summary; FedScoop, “Sen. Peters pushes for new probe of DOGE’s Social Security Administration data dives”). Senator Gary Peters (D-Mich.), ranking member of Senate HSGAC, followed up on Feb 25, 2026 with formal requests to SSA Commissioner Frank Bisignano and the SSA Assistant IG for Audit for records, risk assessments, and communications from Solly, Coristine, Moghaddassi, and Russo, and for a full accounting of DOGE’s NUMIDENT activities.
  • Pre-existing security concerns: Former CISA Deputy Director Nitin Natarajan told Reuters of Coristine’s EGodly ties: “This stuff was not in the distant past. The recency of the activity and the types of groups he was associated would definitely be concerning.” A former FBI agent told Newsweek he would not have recommended Coristine for government work given his background.
  • Class actions and amicus filings: State of New York et al. v. Trump, AFL-CIO v. DOL, and an amicus brief filed at the Supreme Court (May 23, 2025) all name Coristine specifically as illustrative of DOGE’s vetting failures.
  • Senate findings: The HSGAC minority report on DOGE cited Coristine as a central case study, noting that the cybersecurity firm where he previously interned “was not willing to risk giving him access to sensitive company information after he leaked information to a competitor” — yet SSA had given him access to the personal data of all Americans.

Other Documented Harms

  • Coristine’s case became the canonical example in congressional oversight letters citing DOGE’s failure to apply standard suitability and clearance vetting (Feb 4, 2025 letter from Ranking Member James A. Himes and others to the White House).
  • The Aug 3, 2025 assault on Coristine — in which he was attacked near Logan Circle in Washington, D.C. during what police described as an attempted unarmed carjacking by a group of roughly ten juveniles — was used by President Trump as the immediate justification for ordering a federal surge of agents and National Guard troops into Washington, D.C., despite MPD statistics showing carjackings down 38% and overall violent crime down 26% year-over-year (CBS News, Aug 6, 2025; Politico, Aug 5, 2025; ABC News; NBC Washington). Two 15-year-olds were arrested at the scene and later sentenced to probation in family court after pleading guilty to simple assault. On Oct 16 and 17, 2025, Laurence Cotton-Powell, 19, and Anthony Taylor, 18, were arrested and charged in D.C. Superior Court with attempted unarmed carjacking, two counts of robbery, and two counts of assault with intent to commit robbery, arising both from the attack on Coristine and from a separate assault at a nearby gas station minutes earlier (U.S. Attorney’s Office, District of Columbia press release, Oct 20, 2025; Reuters/WTVB coverage of DOJ press conference; Politico, Oct 20, 2025). U.S. Attorney Jeanine Pirro used the arrests to publicly criticize prior probation-and-release decisions by D.C. Superior Court Judge Carmen McLean in Cotton-Powell’s earlier felony attempted-robbery case. Trump posted a shirtless, bloodied image of Coristine to Truth Social and publicly criticized the family-court judge.

Conflicts of Interest

  • Musk-network employment: Direct prior employment at Neuralink — a Musk company with FDA regulatory exposure — immediately preceding DOGE appointment.
  • Cybercrime-ring service relationship: DiamondCDN’s documented infrastructure relationship with EGodly (whose boasts included hijacking law-enforcement email accounts in Latin America and Eastern Europe, cryptocurrency theft, and doxxing/harassing an FBI agent in Wilmington, DE) creates an unresolved conflict between his federal-government access and prior commercial service to actors hostile to U.S. law enforcement (Reuters; Fortune).
  • Foreign-domain holdings: Tesla.Sexy LLC’s portfolio of Russia-registered domains and active Russian-market AI product (Helfie) would conventionally be a counterintelligence flag in a standard SF-86 background investigation; there is no public record that one was completed before his access was granted.
  • Family counterintelligence history: His grandfather’s KGB / double-agent background is the kind of foreign-influence factor that ordinarily prompts heightened SCI vetting.

Investigative trail pointers (public records)

Education only — verify independently. Absence of hits is not proof.

Channel Starting points
Federal courts CourtListener / PACER party and attorney searches (spelling variants)
Campaign finance FEC + OpenSecrets for committees and donors tied to documented roles
Corporate / LLC State secretary of state; OpenCorporates for cross-border shells from reporting
Sanctions / PEP OpenSanctions when international business context is already sourced
Contracts / grants USAspending.gov for named entities from investigations

Use public-records-research-specialist, corporate-intelligence-investigator, and public-corruption-ombudsman evidence tiers.

Sources

Factual correction requests: Contact factcheck@patriot.university.

Cross-References

Was this article helpful?
0 out of 5 stars
5 Stars 0%
4 Stars 0%
3 Stars 0%
2 Stars 0%
1 Stars 0%
5
Please Share Your Feedback
How Can We Improve This Article?

Related Articles