Big Balls Now Exposed to Serious Criminal Charges in at Least Six States

Fired at 17 for leaking secrets. Served a cybercrime ring. Named by the Social Security whistleblower. Now the government's model employee.

Sep 22, 2026

Note from the author: below you’ll find an article, then a call to action, then the Existentialist Republic library. Thanks for reading.

On Monday, September 14, Scott Kupor, the director of the Office of Personnel Management, went on Benny Johnson’s show to talk about hiring. Kupor sets personnel policy for the entire federal workforce.

Asked what kind of people he wants, he said: “I wanna see people like ‘Big Balls,’ or Ed, as we call him colloquially. We need people like that.”

He went on: “Ed is a great example. He dropped out of college. He never had substantive work experience before coming to DOGE.”

So the head of federal hiring named, as his model employee, a 20 year old who was fired from his only real job at 17 for leaking company secrets, ran a web service for a cybercrime group, and is named in a whistleblower disclosure over a live copy of every Social Security record in the country.

Edward Coristine was born in December 2005 and grew up in New Canaan, Connecticut. He graduated from high school in Rye, New York, in 2024 and was enrolled at Northeastern University as a mechanical engineering and physics major when he dropped out to join Elon Musk’s Department of Government Efficiency.

His father is Charles Coristine, who bought the snack company LesserEvil in 2011 and runs it as chief executive. His maternal grandfather was Valery Martynov, a KGB lieutenant colonel who spied for the FBI and CIA in the 1980s and was executed in Moscow in 1987 after Aldrich Ames and Robert Hanssen betrayed him. Coristine has said on Fox News that his grandfather “died so that I could come here and live in this free country that I love so much.”

Before government, Coristine built a trail of ventures and controversies that Bloomberg, Wired, Reuters, CNN, and Brian Krebs each documented.

He owns Tesla.Sexy LLC, launched in 2021 when he was about 16, which has managed image-hosting domains, at least two of them registered in Russia.

In 2022, as a 17 year old intern at the cybersecurity firm Path Network, he was fired. A Path executive wrote in an internal message reviewed by Bloomberg: “Edward has been terminated for leaking internal information to the competitors. This is unacceptable and there is zero tolerance for this.” He later boasted on Discord that he’d kept access to Path’s systems for months after termination.

His content delivery network, DiamondCDN, provided services to a cybercrime group called EGodly, which claimed on Telegram to have stolen cryptocurrency, hijacked phone numbers, broken into law enforcement email accounts, and harassed an FBI agent. On February 15, 2023, EGodly posted its thanks: “We extend our gratitude to our valued partners DiamondCDN for generously providing us with their amazing DDoS protection and caching systems, which allow us to securely host and safeguard our website.” Reuters traced the EGodly site to internet addresses registered to DiamondCDN and other Coristine companies from October 2022 to June 2023.

Krebs reported that Coristine was active in “The Com,” a network of Discord and Telegram channels where cybercriminals recruit and collaborate, under the handles “Rivage” and “JoeyCrafter.” Caleb Ecarma at Muskwatch reported, from web traffic records, that an image-sharing site Coristine ran was reachable through redirect addresses referencing child sexual abuse material and the Ku Klux Klan.

Coristine has not answered any outlet’s request for comment on any of it.

In 2025 he became one of the most recognizable people in DOGE. He worked out of the Office of Personnel Management and sat in on calls where federal technology workers were made to justify their jobs. Fox 5 DC reported he was one of two DOGE operatives given wide-ranging access to Small Business Administration systems in February 2025, which reached the National Finance Center, the system that processes payroll for agencies including the Department of Justice and the Department of Homeland Security.

Reuters found him listed as a senior adviser at the State Department and at the Cybersecurity and Infrastructure Security Agency, where Nextgov confirmed he had a Homeland Security email address and physical access to the building. On May 31, 2025, the General Services Administration hired him full time at GS-15, the highest grade in the civil service.

He was 19.

He resigned from the General Services Administration in June 2025, and within days the Social Security Administration confirmed it had hired him as a special government employee to work on the functionality of the Social Security website.

The Social Security Administration keeps a master file called NUMIDENT, the record of everyone who has ever held a Social Security number, living or dead, with the name, birth date, parents’ names, and citizenship of each holder.

On August 26, 2025, the agency’s chief data officer, Charles Borges, filed a whistleblower disclosure with the Office of Special Counsel and Congress through the Government Accountability Project. Borges alleged that DOGE personnel had copied NUMIDENT into a cloud environment they controlled, outside the agency’s security monitoring, covering more than 300 million Americans.

The disclosure names four DOGE personnel. Coristine is listed first, and a footnote describes his “lengthy history of facilitating, soliciting, or possibly participating in cybercrime.” Borges also names Coristine among the officials he asked for information and who did not respond.

The copy itself went like this. John Solly, another of the four, called a career agency employee on June 10, 2025 to open discussions about copying NUMIDENT, four days after the Supreme Court restored DOGE’s access to Social Security data, and Michael Russo approved it. The agency’s own security review rated the project high risk with potential catastrophic impact. Aram Moghaddassi signed the provisional authorization to operate on July 15, 2025, writing: “I have determined the business need is higher than the security risk associated with this implementation and I accept all risks.”

Coristine, according to the records in the disclosure, was involved in the project and was to be given access to the server.

On January 16, 2026, the Department of Justice filed a Notice of Corrections in the Social Security case in federal court in Maryland. The filing admitted that sworn statements the government had given the court about DOGE’s access to Social Security systems were materially inaccurate, that DOGE staff had routed data through an unapproved third-party server, and that a DOGE member had signed a data agreement with a political group.

NPR reported from the filing that on the morning of March 24, 2025, while Judge Ellen Hollander’s restraining order was in effect, a DOGE staffer was searching the master database at the same time agency officials were telling the court that all access had ended. The filing does not name the DOGE members.

On March 9, 2026, House Oversight Democrats sent Coristine a letter demanding a transcribed interview. The March 2026 thumb drive story, in which a former DOGE engineer allegedly claimed “God-level access” and walked out with Social Security records, is about Solly; Wired identified him, and the Social Security inspector general confirmed an open review.

Bloomberg reported the Path firing on February 7, 2025, and Musk posted that week: “Personally, I voted for Big Balls.”

On August 3, 2025, Coristine and a companion were attacked in an attempted carjacking near Logan Circle in Washington, D.C. He suffered a broken nose and a concussion, and two 15 year olds were arrested. Marjorie Taylor Greene posted that he “is also a HERO for sacrificing his own safety to defend a helpless woman!”

Eight days later the President signed the memorandum mobilizing the District’s National Guard, and it cites “the Administration staffer who was mercilessly beaten by a violent mob days ago.” A separate executive order the same day placed the District’s police under federal control. The two teenagers were sentenced in October 2025 to 12 months and 9 months of probation.

As of this month, Coristine works for an administration initiative to improve the functionality of agency websites, through the White House National Design Studio, the office Airbnb co-founder Joe Gebbia leads.

Five crimes fit the facts above.

Intentionally getting into a government computer beyond your authorization and taking information out of it is a federal crime under 18 U.S.C. § 1030. Oklahoma’s Computer Crimes Act says the same thing in state law: it is a felony to willfully and without authorization gain access to data and copy, disclose, make use of, or take possession of it, and a separate felony to exceed the limits of your authorization and do the same. Every state that allows citizen grand jury petitions has a statute like it, and each county kit cites its own.

The Privacy Act has its own criminal provision. An officer or employee who willfully discloses protected records to anyone not entitled to receive them commits a crime under 5 U.S.C. § 552a, and the master file is a Privacy Act system of records.

The March 24 search is contempt of court. A database a federal judge has ordered you out of is a database you don’t search, and 18 U.S.C. § 401 lets the court punish disobedience of its orders by fine or imprisonment. The order was in effect that morning, and Borges’s disclosure separately reports that DOGE violated the March 20, 2025 court order barring continued access to the data.

Then there are the false sworn statements. Whoever supplied false facts about DOGE’s access to the officials who swore to them in front of the judge committed obstruction of justice under 18 U.S.C. § 1503, which reaches anyone who corruptly endeavors to obstruct the due administration of justice. The government has admitted the statements were false in material respects and hasn’t said who supplied the information.

Conspiracy covers everyone who took part in planning the copy, in federal law and in every state’s, once one of them acted on the plan. Solly’s call on June 10 is that act, and the disclosure’s own records place Coristine in the project.

Conspiracy is the charge the record attaches to his name.

If it was carelessness rather than intent, the Privacy Act’s civil damages standard, “intentional or willful,” has been read by the D.C. Circuit since Albright v. United States in 1984 to cover conduct done without grounds for believing it to be lawful, or in flagrant disregard of others’ rights under the Act, and since Laningham v. United States Navy in 1987 to cover conduct so patently egregious that anyone undertaking it should have known it was unlawful. Carelessness at that level is enough.

And the record makes the argument unnecessary: the copy was requested on June 10, 2025 and approved, then given a provisional authorization to operate on July 15, 2025, after the agency’s own security review called the harm catastrophic.

That review rated the project “catastrophic impact.” Borges called it “a substantial and specific threat to public health and safety.” The master file is the identity record of every American who has ever held a Social Security number.

That is a national security harm, done by choice, in a series of dated steps, by named people.

A state can prosecute this.

The crime’s result, the copying of the record of every person in Tulsa County who has a Social Security number, occurred in Tulsa County, and state criminal law reaches a crime committed partly inside the state, which includes a crime whose result occurs there. Kansas, Nebraska, and New Mexico expressly place identity theft in the county where the victim lives, regardless of where the perpetrator sat. The Supreme Court held in Gamble v. United States in 2019 that a state and the federal government are separate sovereigns, so a state may prosecute the same conduct under its own law whether or not the federal government ever charges anyone.

Federal employees prosecuted in state court claim immunity under the Supremacy Clause. The Supreme Court set the rule in In re Neagle in 1890: a federal officer is immune from state prosecution for an act that federal law authorized him to perform, and only if he did no more than was necessary and proper to perform it. The defendant removes the state case to federal court under 28 U.S.C. § 1442, the federal officer removal statute, and a federal judge decides whether the act was authorized and necessary, with the Justice Department defending him. If the answer is no, the state prosecution continues in federal court.

The government’s best fact is the Supreme Court’s stay of June 6, 2025, which restored DOGE’s access to Social Security data four days before the copy request. Access to the data was never authorization to copy the master file into an environment the agency itself had rated catastrophic, and no court order authorized a search of that file on the morning of March 24, the morning the government told the judge the searching had stopped.

Six states allow citizens to petition a district court directly for a criminal grand jury: Kansas, Nebraska, Nevada, New Mexico, North Dakota, and Oklahoma. The petition goes to the district court. The judge’s only two questions are whether there are enough valid signatures and whether the conduct, if true, is a crime under state law. No district attorney or attorney general has any part in it.

Petitioners in Tulsa County, Oklahoma, Nelson County, North Dakota, Douglas and Lancaster Counties, Nebraska, and Shawnee County, Kansas, are now set up with template petitioner kits made by The Existentialist Republic to facilitate activists pursuing justice for their fellow Social Security having neighbors. This particular campaign is for signatures on petitions built on the government’s own January 2026 admissions about the Social Security data.

The templates, signature sheets, and reference files for each county are free to download here, and anyone in the six states who wants to petition in their own county can sign up for a chat with our petition campaign experts and Existentialist Republic activist guides to share the publicly available information on the subject in digestible and helpful ways through the project’s sign-up form.

I wrote this because the government’s head of hiring described the person above as the model, on the record, this month, and the model is the subject of a whistleblower disclosure, a congressional demand letter, and grand jury petitions in five counties and counting.

We see you, Big Balls. And we want justice.

A note from Chris: only one of our last 30 articles got more than five new paid subscribers.

We have more readers than ever, tens of thousands per article, millions monthly, but subscriptions are largely drying up.

I get it, the economy is in a rough place and it’s being felt everywhere.

Just consider for a moment that it’s 50 cents per day for an activist organization, not just a news publication.

Subscriptions are the foundation of everything you see here.

I’ll keep doing this either way. But we need you, too.

Please don’t let this be the reason you miss a meal or are late on rent.

If you can spare 50 cents a day, you’re keeping the foundation beneath our feet as we work to destroy fascism.

Buy The ER Some Coffee

CALL TO ACTION

Who you are contacting and how: your state representative, found at Open States, by email, phone, FaxZero, or mail.

What you are asking for: introduce a bill in your state that does what Hawaii’s Act 11 does, or co-sponsor it if one exists.

What that is: on May 14, 2026, Hawaii enacted a law providing that corporations have only the powers the state grants them, and those powers do not include spending on elections. It passed the House 50 to 1 and the Senate unanimously.

Whether you write or call, use your own words and cover four things: who you are and where you live, that Hawaii passed Act 11 in May with near-unanimous bipartisan support, that you want the same law introduced in your state, and a request for the representative’s position. Identical messages get counted once. Your own words are what works.