Big Balls Now Exposed to Serious Criminal Charges in at Least Six States

News

Government

Christopher Armitage

Campaign

Big Balls Now Exposed to Serious Criminal Charges in at Least Six States

Fired at 17 for leaking secrets. Served a cybercrime ring. Named by the Social Security whistleblower. Now the government’s model employee.

Chris Armitage

12 min read·

Sep 22, 2026

--

On Monday, September 14, Scott Kupor, the director of the Office of Personnel Management, went on Benny Johnson’s show to talk about hiring. Kupor sets personnel policy for the entire federal workforce.

Asked what kind of people he wants, he said: “I wanna see people like ‘Big Balls,’ or Ed, as we call him colloquially. We need people like that.”

He went on: “Ed is a great example. He dropped out of college. He never had substantive work experience before coming to DOGE.”

So the head of federal hiring named, as his model employee, a 20 year old who was fired from his only real job at 17 for leaking company secrets, ran a web service for a cybercrime group, and is named in a whistleblower disclosure over a live copy of every Social Security record in the country.

Edward Coristine was born in December 2005 and grew up in New Canaan, Connecticut. He graduated from high school in Rye, New York, in 2024 and was enrolled at Northeastern University as a mechanical engineering and physics major when he dropped out to join Elon Musk’s Department of Government Efficiency.

His father is Charles Coristine, who bought the snack company LesserEvil in 2011 and runs it as chief executive. His maternal grandfather was Valery Martynov, a KGB lieutenant colonel who spied for the FBI and CIA in the 1980s and was executed in Moscow in 1987 after Aldrich Ames and Robert Hanssen betrayed him. Coristine has said on Fox News that his grandfather “died so that I could come here and live in this free country that I love so much.”

Before government, Coristine built a trail of ventures and controversies that Bloomberg, Wired, Reuters, CNN, and Brian Krebs each documented.

He owns Tesla.Sexy LLC, launched in 2021 when he was about 16, which has managed image-hosting domains, at least two of them registered in Russia.

In 2022, as a 17 year old intern at the cybersecurity firm Path Network, he was fired. A Path executive wrote in an internal message reviewed by Bloomberg: “Edward has been terminated for leaking internal information to the competitors. This is unacceptable and there is zero tolerance for this.” He later boasted on Discord that he’d kept access to Path’s systems for months after termination.

His content delivery network, DiamondCDN, provided services to a cybercrime group called EGodly, which claimed on Telegram to have stolen cryptocurrency, hijacked phone numbers, broken into law enforcement email accounts, and harassed an FBI agent. On February 15, 2023, EGodly posted its thanks: “We extend our gratitude to our valued partners DiamondCDN for generously providing us with their amazing DDoS protection and caching systems, which allow us to securely host and safeguard our website.” Reuters traced the EGodly site to internet addresses registered to DiamondCDN and other Coristine companies from October 2022 to June 2023.

Krebs reported that Coristine was active in “The Com,” a network of Discord and Telegram channels where cybercriminals recruit and collaborate, under the handles “Rivage” and “JoeyCrafter.” Caleb Ecarma at Muskwatch reported, from web traffic records, that an image-sharing site Coristine ran was reachable through redirect addresses referencing child sexual abuse material and the Ku Klux Klan.

Coristine has not answered any outlet’s request for comment on any of it.

In 2025 he became one of the most recognizable people in DOGE. He worked out of the Office of Personnel Management and sat in on calls where federal technology workers were made to justify their jobs. Fox 5 DC reported he was one of two DOGE operatives given wide-ranging access to Small Business Administration systems in February 2025, which reached the National Finance Center, the system that processes payroll for agencies including the Department of Justice and the Department of Homeland Security.

Reuters found him listed as a senior adviser at the State Department and at the Cybersecurity and Infrastructure Security Agency, where Nextgov confirmed he had a Homeland Security email address and physical access to the building. On May 31, 2025, the General Services Administration hired him full time at GS-15, the highest grade in the civil service.

He resigned from the General Services Administration in June 2025, and within days the Social Security Administration confirmed it had hired him as a special government employee to work on the functionality of the Social Security website.

The Social Security Administration keeps a master file called NUMIDENT, the record of everyone who has ever held a Social Security number, living or dead, with the name, birth date, parents’ names, and citizenship of each holder.

On August 26, 2025, the agency’s chief data officer, Charles Borges, filed a whistleblower disclosure with the Office of Special Counsel and Congress through the Government Accountability Project. Borges alleged that DOGE personnel had copied NUMIDENT into a cloud environment they controlled, outside the agency’s security monitoring, covering more than 300 million Americans.

The disclosure names four DOGE personnel. Coristine is listed first, and a footnote describes his “lengthy history of facilitating, soliciting, or possibly participating in cybercrime.” Borges also names Coristine among the officials he asked for information and who did not respond.

The copy itself went like this. John Solly, another of the four, called a career agency employee on June 10, 2025 to open discussions about copying NUMIDENT, four days after the Supreme Court restored DOGE’s access to Social Security data, and Michael Russo approved it. The agency’s own security review rated the project high risk with potential catastrophic impact. Aram Moghaddassi signed the provisional authorization to operate on July 15, 2025, writing: “I have determined the business need is higher than the security risk associated with this implementation and I accept all risks.”

Coristine, according to the records in the disclosure, was involved in the project and was to be given access to the server.

On January 16, 2026, the Department of Justice filed a Notice of Corrections in the Social Security case in federal court in Maryland. The filing admitted that sworn statements the government had given the court about DOGE’s access to Social Security systems were materially inaccurate, that DOGE staff had routed data through an unapproved third-party server, and that a DOGE member had signed a data agreement with a political group.

NPR reported from the filing that on the morning of March 24, 2025, while Judge Ellen Hollander’s restraining order was in effect, a DOGE staffer was searching the master database at the same time agency officials were telling the court that all access had ended. The filing does not name the DOGE members.

On March 9, 2026, House Oversight Democrats sent Coristine a letter demanding a transcribed interview. The March 2026 thumb drive story, in which a former DOGE engineer allegedly claimed “God-level access” and walked out with Social Security records, is about Solly; Wired identified him, and the Social Security inspector general confirmed an open review.

Bloomberg reported the Path firing on February 7, 2025, and Musk posted that week: “Personally, I voted for Big Balls.”

On August 3, 2025, Coristine and a companion were attacked in an attempted carjacking near Logan Circle in Washington, D.C. He suffered a broken nose and a concussion, and two 15 year olds were arrested. Marjorie Taylor Greene posted that he “is also a HERO for sacrificing his own safety to defend a helpless woman!”

Eight days later the President signed the memorandum mobilizing the District’s National Guard, and it cites “the Administration staffer who was mercilessly beaten by a violent mob days ago.” A separate executive order the same day placed the District’s police under federal control. The two teenagers were sentenced in October 2025 to 12 months and 9 months of probation.

As of this month, Coristine works for an administration initiative to improve the functionality of agency websites, through the White House National Design Studio, the office Airbnb co-founder Joe Gebbia leads.

Intentionally getting into a government computer beyond your authorization and taking information out of it is a federal crime under 18 U.S.C. § 1030. Oklahoma’s Computer Crimes Act says the same thing in state law: it is a felony to willfully and without authorization gain access to data and copy, disclose, make use of, or take possession of it, and a separate felony to exceed the limits of your authorization and do the same. Every state that allows citizen grand jury petitions has a statute like it, and each county kit cites its own.

The Privacy Act has its own criminal provision. An officer or employee who willfully discloses protected records to anyone not entitled to receive them commits a crime under 5 U.S.C. § 552a, and the master file is a Privacy Act system of records.

The March 24 search is contempt of court. A database a federal judge has ordered you out of is a database you don’t search, and 18 U.S.C. § 401 lets the court punish disobedience of its orders by fine or imprisonment. The order was in effect that morning, and Borges’s disclosure separately reports that DOGE violated the March 20, 2025 court order barring continued access to the data.

Then there are the false sworn statements. Whoever supplied false facts about DOGE’s access to the officials who swore to them in front of the judge committed obstruction of justice under 18 U.S.C. § 1503, which reaches anyone who corruptly endeavors to obstruct the due administration of justice. The government has admitted the statements were false in material respects and hasn’t said who supplied the information.

Conspiracy covers everyone who took part in planning the copy, in federal law and in every state’s, once one of them acted on the plan. Solly’s call on June 10 is that act, and the disclosure’s own records place Coristine in the project.

Conspiracy is the charge the record attaches to his name.

If it was carelessness rather than intent, the Privacy Act’s civil damages standard, “intentional or willful,” has been read by the D.C. Circuit since Albright v. United States in 1984 to cover conduct done without grounds for believing it to be lawful, or in flagrant disregard of others’ rights under the Act, and since Laningham v. United States Navy in 1987 to cover conduct so patently egregious that anyone undertaking it should have known it was unlawful. Carelessness at that level is enough.

And the record makes the argument unnecessary: the copy was requested on June 10, 2025 and approved, then given a provisional authorization to operate on July 15, 2025, after the agency’s own security review called the harm catastrophic.

That review rated the project “catastrophic impact.” Borges called it “a substantial and specific threat to public health and safety.” The master file is the identity record of every American who has ever held a Social Security number.

That is a national security harm, done by choice, in a series of dated steps, by named people.

The crime’s result, the copying of the record of every person in Tulsa County who has a Social Security number, occurred in Tulsa County, and state criminal law reaches a crime committed partly inside the state, which includes a crime whose result occurs there. Kansas, Nebraska, and New Mexico expressly place identity theft in the county where the victim lives, regardless of where the perpetrator sat. The Supreme Court held in Gamble v. United States in 2019 that a state and the federal government are separate sovereigns, so a stat