Role: DOGE engineer with access to multiple federal systems beginning January 2025; 19 years old at the time of appointment; previously a Neuralink intern; online handles “Big Balls,” “Rivage,” and “JoeyCrafter.”

Basis for Inclusion

Subject classification: Voluntary Public Figure (private citizen granted federal authority).

Anchor met: Anchor B / D — operational coordinator role at DOGE with administrative access to federal systems holding personally identifiable information on hundreds of millions of Americans.

Background

Coristine was born in December 2005. He graduated from Rye Country Day School in 2024 and enrolled at Northeastern University as a mechanical engineering and physics major; he left to join the federal government within months of starting college. He is a registered Republican who friends describe as having idolized Elon Musk (Wikipedia; Newsweek, Feb 7, 2025).

Before joining DOGE, Coristine:

• Founded Tesla.Sexy LLC at age 16 — a Connecticut-registered entity that managed dozens of web domains, including at least two registered in Russia. One Russia-facing domain hosted Helfie, an AI Discord bot targeting the Russian market (Wired, Feb 2025; ABC News, Mar 27, 2025).
• Was hired and then fired in 2022 by Path Network, a network monitoring firm known for employing former black-hat hackers, after an internal probe found he had leaked proprietary information to a competitor (Bloomberg, Feb 7, 2025; CNN).
• Operated DiamondCDN, a content-delivery and DDoS-protection service. Between October 2022 and June 2023, DiamondCDN’s IP infrastructure provided DDoS protection and caching to EGodly, a cybercrime group that publicly thanked DiamondCDN on Telegram on Feb 15, 2023 (Reuters; Fortune, Mar 27, 2025; ABC News).
• Was linked by investigative journalist Brian Krebs to “The Com,” a network of Discord and Telegram channels associated with cybercrime activity, where he allegedly used the handles “Rivage” and “JoeyCrafter” (Krebs on Security; Revolving Door Project, Mar 14, 2025).
• A Telegram handle tied to Coristine reportedly solicited a distributed denial-of-service (DDoS) attack-for-hire service in 2022 (Wired, Feb 2025).
• Interned briefly at Neuralink, Musk’s brain-computer-interface company, prior to his DOGE appointment.

Coristine’s maternal grandfather was Valery Martynov, a former KGB officer executed by the Soviet Union after being unmasked as a double agent working for U.S. intelligence — a biographical detail that drew additional scrutiny given his subsequent unvetted access to sensitive U.S. government systems (India Today, Jun 25, 2025; Wikipedia).

DOGE Role and Federal Deployments

Coristine joined DOGE in January 2025 as part of the founding cohort of teen and early-20s engineers without prior government experience. He reported to Amanda Scales, a former xAI employee installed as OPM chief of staff (Wikipedia citing Wired). His formal designation at OPM was “expert”; he was later titled “Senior Advisor” at DOGE proper.

Reported placements include:

• Office of Personnel Management (OPM) — sat on calls reviewing federal employees’ code and demanding they “justify their jobs”; used a non-government email address (Wired).
• Cybersecurity and Infrastructure Security Agency (CISA) / Department of Homeland Security (DHS) — issued a DHS email and granted physical access to CISA facilities, the U.S. agency holding much of the country’s worldwide cyber-threat intelligence (Nextgov/FCW, Feb 19, 2025).
• General Services Administration (GSA) — detailed to HHS and USDS through GSA (AFL-CIO v. DOL filings; Supreme Court amicus, May 23, 2025).
• State Department, Bureau of Diplomatic Technology (DT) — listed as a “senior adviser” in internal directories (Biometric Update; Nextgov/FCW).
• Social Security Administration (SSA) — granted administrative access to a cloud environment containing live NUMIDENT data (see Real-World Impacts).
• U.S. Citizenship and Immigration Services (USCIS), Department of Education, HHS, USAID, Small Business Administration (SBA), FEMA — additional reported access points (ABC News; Politico; Revolving Door Project).

In May 2025, Coristine converted from a special government employee to a full-time federal employee at GS-15, one of the highest pay grades on the federal civilian schedule (Wired, “Big Balls’ Is Officially a Full-Time Government Employee,” Jun 4, 2025).

He resigned from DOGE in June 2025, was reported by the White House as having “left the Trump administration,” and within days reappeared at the Social Security Administration as a special government employee tasked with “improving the functionality of the Social Security website” (NBC News, Jun 26, 2025; New York Times, Jun 24, 2025).

By late 2025, Coristine had moved to the White House National Design Studio (NDS), a new executive-office unit created by executive order on Aug 21, 2025 and led by Airbnb co-founder and Chief Design Officer Joe Gebbia. WIRED describes Coristine as head of engineering at NDS — a body the administration itself has described as “a stripped-down successor” to DOGE (Wired; Federal News Network; Wikipedia).

Documented Actions

• Participated in DOGE personnel actions affecting federal workforce reductions and program audits at multiple agencies.
• On a Small Business Administration call, asserted DOGE wanted access to human-resources data (Wired).
• Listed by Senate HSGAC investigators as having had “unrestricted access to SSA data, including the personal information of all Americans” while the agency had no visibility into his work (HSGAC DOGE Report, 2025).
• Reportedly retained government access following Musk’s departure from DOGE in spring 2025.
• After resigning from DOGE, appeared in a viral YouTube video with right-wing “fraud influencer” Nick Shirley in which Coristine claimed to have personally pulled Medicaid-spending data on California businesses for use as investigative targets (Wired, “Edward ‘Big Balls’ Coristine Is Helping Out on Viral Fraud Videos Now”).

Real-World Impacts

Federal Employees

• Participated in DOGE personnel actions, audits, and code-justification reviews tied to reductions in force across multiple agencies.
• Named in federal employee class actions (e.g., Alliance for Retired Americans v. Bessent, AFL-CIO v. Department of Labor, American Federation of Government Employees v. OPM) challenging DOGE access to personnel and payroll systems.

American Citizens (Public Services)

• Helped operate DOGE’s “audit” of SSA, the public-facing output of which included widely debunked claims that “150-year-olds” were receiving Social Security benefits — errors that originated from DOGE’s misreading of NUMIDENT date conventions (Wired, Feb 17, 2025).
• Tied to a federal payroll system serving the FBI and other agencies (Wired, “How Edward ‘Big Balls’ Coristine and DOGE Got Access to a Federal Payroll System That Serves the FBI,” Jul 30, 2025).

Vulnerable Populations

• Recipients of Social Security retirement, disability (SSDI), and SSI benefits had their NUMIDENT records — including SSNs, date and place of birth, parents’ names, citizenship status, and disability-related information — copied into a cloud environment to which Coristine and a handful of other DOGE personnel reportedly had administrative control (Borges whistleblower complaint, Aug 26, 2025).

Privacy and Data Security

• NUMIDENT cloud transfer (June–July 2025): Per the formal whistleblower disclosure filed by former SSA Chief Data Officer Charles Borges on Aug 26, 2025, DOGE personnel — including Coristine and SSA-detailed engineer John Solly, with authorization from DOGE-affiliated Michael Russo and SSA CIO Aram Moghaddassi — caused a live copy of the entire NUMIDENT database (core identity records for more than 300 million Americans) to be uploaded to an Amazon Web Services environment that “apparently lacks any security oversight from SSA or tracking to determine who is accessing or has accessed the copy of this data.” Borges alleged this violated the Privacy Act of 1974, FISMA, the Computer Fraud and Abuse Act, the Inspector General Act, and may have circumvented a federal court order limiting DOGE access to SSA systems (Borges Disclosure, Aug 26, 2025; FedScoop; Empire Justice).
• Pre-existing security concerns: Former CISA Deputy Director Nitin Natarajan told Reuters of Coristine’s EGodly ties: “This stuff was not in the distant past. The recency of the activity and the types of groups he was associated would definitely be concerning.” A former FBI agent told Newsweek he would not have recommended Coristine for government work given his background.
• Class actions and amicus filings: State of New York et al. v. Trump, AFL-CIO v. DOL, and an amicus brief filed at the Supreme Court (May 23, 2025) all name Coristine specifically as illustrative of DOGE’s vetting failures.
• Senate findings: The HSGAC minority report on DOGE cited Coristine as a central case study, noting that the cybersecurity firm where he previously interned “was not willing to risk giving him access to sensitive company information after he leaked information to a competitor” — yet SSA had given him access to the personal data of all Americans.

Other Documented Harms

• Coristine’s case became the canonical example in congressional oversight letters citing DOGE’s failure to apply standard suitability and clearance vetting (Feb 4, 2025 letter from Ranking Member James A. Himes and others to the White House).
• The Aug 3, 2025 assault on Coristine — in which he was attacked near Logan Circle in Washington, D.C. during what police described as an attempted unarmed carjacking by a group of roughly ten juveniles — was used by President Trump as the immediate justification for ordering a federal surge of agents and National Guard troops into Washington, D.C., despite MPD statistics showing carjackings down 38% and overall violent crime down 26% year-over-year (CBS News, Aug 6, 2025; Politico; ABC News; NBC Washington). Two 15-year-olds were arrested at the scene and later sentenced to probation in family court; Laurence Cotton-Powell, 19, and Anthony Taylor, 18, were arrested separately and charged with attempted unarmed carjacking, robbery, and assault with intent to commit a robbery. Trump posted a shirtless, bloodied image of Coristine to Truth Social and publicly criticized the family-court judge.

Conflicts of Interest

• Musk-network employment: Direct prior employment at Neuralink — a Musk company with FDA regulatory exposure — immediately preceding DOGE appointment.
• Cybercrime-ring service relationship: DiamondCDN’s documented infrastructure relationship with EGodly (whose boasts included hijacking law-enforcement email accounts in Latin America and Eastern Europe, cryptocurrency theft, and doxxing/harassing an FBI agent in Wilmington, DE) creates an unresolved conflict between his federal-government access and prior commercial service to actors hostile to U.S. law enforcement (Reuters; Fortune).
• Foreign-domain holdings: Tesla.Sexy LLC’s portfolio of Russia-registered domains and active Russian-market AI product (Helfie) would conventionally be a counterintelligence flag in a standard SF-86 background investigation; there is no public record that one was completed before his access was granted.
• Family counterintelligence history: His grandfather’s KGB / double-agent background is the kind of foreign-influence factor that ordinarily prompts heightened SCI vetting.

Sources

• Reuters, “Exclusive: DOGE staffer ‘Big Balls’ provided tech support to cybercrime ring, records show,” Mar 26, 2025
• Wired, multiple reports Feb–Jul 2025 (DOGE personnel; NUMIDENT; payroll-system access; National Design Studio)
• Bloomberg News, “Musk’s DOGE teen was fired by cybersecurity firm for leaking company secrets,” Feb 7, 2025
• Brian Krebs, “DOGE Staffer ‘Big Balls’ provided tech support to cybercrime ring” (Krebs on Security)
• Nextgov/FCW, “DOGE employee Edward Coristine lands at CISA with DHS email,” Feb 19, 2025
• Fortune, “A DOGE staffer working as a ‘senior advisor’ in the government provided tech support to a cybercrime group,” Mar 27, 2025
• Newsweek, “Who is ‘Big Balls’? Teen DOGE Engineer Edward Coristine,” Feb 7, 2025 (updated Aug 1, 2025)
• NBC News, “Teen DOGE staffer ‘Big Balls’ has gone to work for the Social Security Administration,” Jun 26, 2025
• New York Times, “Edward Coristine, Key Player on Elon Musk’s DOGE Team, Resigns,” Jun 24, 2025
• Charles Borges, “Whistleblower Disclosure to the Office of Special Counsel and Congress,” Aug 26, 2025 (full text via whistleblower.org and Government Accountability Project)
• FedScoop, “DOGE employees uploaded Social Security database to ‘vulnerable’ cloud, agency whistleblower says”
• Senate HSGAC Minority, DOGE Oversight Report (2025)
• Supreme Court Amicus Brief, In re DOGE FOIA Application, No. 24A1122, May 23, 2025
• Alliance for Retired Americans v. Bessent, AFL-CIO v. DOL, AFGE v. OPM, complaints and supporting filings 2025
• Revolving Door Project, “DOGE Agent: Edward Coristine,” Mar 14, 2025
• CBS News, “Ex-DOGE staffer allegedly injured in attempted carjacking — leading Trump to float federal takeover of D.C.,” Aug 6, 2025
• Politico, “Trump administration staffer known as ‘Big Balls’ assaulted in DC,” Aug 5, 2025
• ABC News and NBC Washington, coverage of subsequent arrests (Aug 2025)
• MeriTalk and Federal News Network, coverage of National Design Studio launch (Aug 2025)
• Wikipedia, “Edward Coristine” and “National Design Studio”