U.S. President Donald Trump looks at Chief Design Officer of the United States Joe Gebbia on the White House campus in Washington, D.C., U.S., May 18, 2026. REUTERS/Jonathan Ernst
A small disclaimer on a website just exposed a secret project with no reporting, oversight, transparency or accountability under the thumb of President Donald Trump's office.
Audrey Henson, who researches and writes about the intersection of technology and power, found the disclaimer in the footer of a page on the TrumpRx website, which claims to offer access to drugs the government is trying to renegotiate prices for.
"In the footer of the page, beneath all of it, I found something I have never seen on a federal government website in my life. A byline. The government does not do this," explained Henson. "The IRS does not sign its work. The FBI does not. Social Security does not. No federal agency that has ever built a website has felt the need to take credit for it. In plain bold text, sitting directly above the privacy policy, it said: Designed and Engineered in D.C. by National Design Studio. So I clicked through."
What she said she found was "The National Design Studio," an "office" created by one of Trump's executive orders in Aug. 2025.
According to Joe Gebbia, co-founder of Airbnb, the goal was to redesign how Americans experience their government online. He reports directly to Trump's chief of staff, Susie Wiles.
"His position requires no Senate confirmation, which means he files no financial disclosures, which means the office he runs does not appear in any federal procurement database, which means, as far as the official record is concerned, it barely exists," wrote Henson. That, she said, is the point.
Staff is hired under Section 3161, which allows for temporary advisory bodies meant to be part-time advisors and volunteers. Their salary isn't public, and there is no inspector general to keep an eye on ethics. Henson called it essentially what DOGE was meant to be, the "department" that was promised would save $2 trillion by cutting "waste, fraud and abuse" in government. Gebbia was previously working for DOGE.
So, Henson compared the names from DOGE with those of the National Design Studio and found them remarkably similar. " The National Design Studio is not a successor to DOGE. It is DOGE with a better logo and a design philosophy," she said.
What she found in the code of the pages on TrumpRx is that each page is "making phone calls to servers all over the internet with dozens per second." One of those is "PostHog," a Silicon Valley analytics company that records what users do on a website and reports it back to those who own it. It's everything from following mouse movements to scrolls and clicks.
"I had not clicked anything. I had just opened the page, and it was already on the phone with PostHog telling them about me," Henson said. It includes your IP address and any other identifying information it can obtain. Henson said it's not something she expected to see on a government website.
So, she checked other government sites. Real Food, Trump Accounts and others are all part of the PostHog tracking and data collection.
"And on ndstudio.gov alone, running alongside PostHog, was something someone had built entirely by hand. Five hundred and forty lines of custom JavaScript with a name embedded directly in the code: AutoMonitor. What it appears to do is rewire the part of the browser that handles how a page talks to the outside world, so that every conversation the page has with any server gets copied and forwarded to a private backend with no public presence. The studio has the structural ability to keep a copy of every recording as it passes through their infrastructure. I cannot prove they are keeping one. The pipe is built that way on purpose, and that is the part that matters," Hensen explained.
The problem is that the government requires a number of things for websites, which include privacy disclosures, notices in the Federal Register and published contracts with outside vendors, she said. None of those exist on the 12 National Design Studio programs. Those laws were enacted after Watergate to protect Americans from secret government surveillance programs. Each missing piece at those 12 sites is a crime, resulting in 36 breaches of federal law. There is a privacy disclosure on the Trump Rx page, but Hensen said that some paragraphs contradict each other.
"A federal health website is lying to the people using it and cannot even keep the lie consistent," Hensen warned.
Then she went searching for more, finding at least 40 on top of the first 12. Some of the sites haven't been announced.
"I started reading the names. Sites that looked like they belonged to the State Department. To NASA. To the Department of Homeland Security. And then two that stopped me cold: a working preview of vote.gov, and something called fbi-kirk-tipline. I checked the public ownership records for every subdomain, and every single one traced back to the same place, the Executive Office of the President," she said.
The sites were built by the National Design Studio. Everything was built by the White House using the same Cloudflare account, which isn't normal for a federal agency either.
"The login screen for the gated preview sites read: loveisaskill.cloudflareaccess.com. Love is a skill is a phrase Gebbia has used publicly to describe Airbnb’s design philosophy," said Henson. To her, this indicates Gebbia owns these personally, not the government.
Akash Bobba, one of the people on DOGE, now controls one of the sites for an agency as well as emails and security configurations. It "means a White House staffer has full visibility into who applies for grants, who gets approved and who inside that agency is talking to whom," said Henson.
Henson also remembered an Oct. 2025 conference call in which Bobba was recorded saying that the group was building a federal voter registration system on vote.gov.
"Voters would register through a federal portal, their identities verified through Login.gov, their citizenship verified through DHS’s SAVE database, their registrations transmitted to the states," Henson continued. "A state election director asked him what data the federal government would retain. He said, on a recording, in an election year: I don’t know what they retain and what they are logging. The person presenting a federal voter registration system to state election directors did not know what data his own system kept on American voters."
She noted that there is a previous law that blocks the White House from overseeing voter registration, so it violates that law too.
A few weeks before Trump signed the executive order, essentially forcing small parts of the SAVE Act on the public, the security certificate appeared. The order mandates that within 90 days of the signing, they must have a federally created "list" of citizen-verified voters. That 90 days is up in a few weeks. The Justice Department told the judge overseeing lawsuits against the order that it was in the deliberation phase. The websites show that the claim doesn't match up with reality.
"The certificate is dated April 10. DOJ told a federal court the infrastructure does not exist. Both of those cannot be true," Henson said. "Either DOJ lied to a federal judge, or the studio is building a replacement for the country’s voter registration site without telling the agencies whose work it would replace. There is no third option."
She then went to the State Department website for passports. The White House owns that website now, too. On May 5, the first security certificate was issued. The new website has no official seal on it or a privacy notice. She said that, based on the staging environment, it looks to her like the government wants to require Americans "to upload their passport photo through a White House-controlled website, on the same Cloudflare account, by the same people, with no privacy notice on file. A passport photo is biometric quality. Linked to your identity through Login.gov. Collected through infrastructure the White House owns, sealed from public view."
She cautioned that it appears the site is being built this week.
I found a second vote.gov — and it's registered to the White House by The Drey Dossier
Read on Substack