Chuck DarwinThe White House's National Design Studio has also built or taken control of websites that belong,
by law or by convention,
to other federal agencies.
The sites handle some of the most sensitive personal information Americans give to the government.
Passports.gov is now run from inside the White House,
not from the state department.
The state department operates US passport services through its existing site at travel.state.gov.
The studio’s version collects identity information from people applying for passports.
It carries no privacy notice.
Developer test code was left running on the live page.
In response to a request for comment,
a state department spokesperson wrote:
“The Department of State is working closely with the White House to deliver the best possible service for our passport customers
while safeguarding US national security.”
They added:
“US passport books and passport cards
– and the programs and websites that support them
– represent the gold standard in secure international travel documents,
underpinned by state-of-the-art security and technology.”
They referred additional questions to the White House.
Trumpaccounts.gov is the federal website for the children’s investment programme created in last summer’s tax legislation.
The treasury department, which administers the programme,
is the registrant of record for the site.
But the site itself runs through the same White House-controlled commercial account as the studio’s own sites:
ndstudio.gov,
the prescription-drug site trumprx.gov,
the food-policy site realfood.gov
and others.
The treasury department did not respond to a request for comment.
Login.gov is the federal sign-in gateway that more than 150 million Americans use to access services from social security to tax filing.
The studio’s preview of vote.gov,
described in the previous post,
uses Login.gov to verify the identities of visitors.
The Guardian contacted the General Services Administration (GSA), which operates Login.gov, for comment.
A spokesperson replied in an email:
“Login.gov is committed to the highest standards of privacy, transparency, and security.
Our Privacy Impact Assessment was most recently reviewed in March 2026.
All personnel supporting Login.gov,
including detailees,
are required to comply with applicable GSA policies, security requirements, privacy controls, and governance processes.”
The NDS, meanwhile, seems to be expanding its footprint across more government websites.
In late May, three new addresses tied to the NDS appeared in the public records:
chat.staging.ndstudio.gov,
onboarding.ndstudio.gov
and upload.ndstudio.gov.
All GNU social JP content and data are available under the