Bureaucracy Times

All the news fit to be declassified.

Category: Congressional & Legislative

  • A Watchdog’s Budget Meets One Objection, and the Senate Leaves for Five Weeks

    On the last legislative day before a recess that runs through Election Day, Sen. Catherine Cortez Masto (D-NV) asked the Senate to pass S. 5681, a bill that would let the Federal Housing Finance Agency’s inspector general determine how much funding the office needs. Sen. Bernie Moreno (R-OH) objected. The bill had been introduced that same day. It went nowhere.

    Cortez Masto told the floor that FHFA Director Bill Pulte has pushed out ethics and civil rights staff and that the President fired the office’s acting inspector general last month. Those are her claims; the Record does not adjudicate them. Moreno said he supports independent oversight but that the bill sets no ceiling and no reasonableness test, and that assessments on Fannie Mae, Freddie Mac and the Home Loan Banks end up in mortgage costs. He said the office already has more than 100 employees and a budget above $50 million. A change in funding, he said, should come with a cap, a reporting requirement and a recorded vote.

    The rest of the day

    Confirmed: Keith Sonderling as Secretary of Labor, 47 to 41, after cloture passed 53 to 47. Twelve senators, six from each party, did not vote on confirmation. The Senate also confirmed ten ambassadors and one Air Force general.

    Passed: Twenty-two bills, none of them by recorded vote. The Digest lists only four roll calls for the day. The pile includes the Taxpayer Assistance and Service Act (H.R. 5349) on IRS services, the Health Care Cybersecurity and Resiliency Act (S. 3315), which orders HHS and CISA to coordinate, and the Skills-Based Federal Contracting Act (H.R. 5235), which bars minimum education requirements for contractor personnel in certain solicitations.

    Committees: A Homeland Security subcommittee heard from AI researchers on rogue AI agents and a bill to create a Department of Energy evaluation program (S. 2938). The HELP Committee advanced Nicole Saphier’s nomination for Surgeon General, along with two other HHS nominees. Energy and Natural Resources reported out 22 items. Intelligence met behind closed doors.

    Next: The Senate adjourned at 11:25 p.m. and will hold pro forma sessions only, with no business, through November 5. It returns November 9, when a cloture vote on the Survivor Justice Tax Prevention Act (H.R. 2347) is set for 5:30 p.m. The House was not in session and meets Thursday in a pro forma session.

    An inspector general may set the price of watching a housing agency, one senator argued, as soon as Washington holds a vote on it. The Senate is back November 9. The inspector general, presumably, will wait.

  • The Word That Decides Every Drug Sentence in America Was Never Actually Defined

    Every criminal penalty attached to a controlled substance in the United States, whether it is a marijuana possession charge or a fentanyl trafficking case, traces back to a single phrase in the Controlled Substances Act of 1970. “Potential for abuse.” It is the first of eight factors the Food and Drug Administration is required to weigh when deciding whether a drug belongs in Schedule I with heroin or Schedule V with cough syrup. According to a new GAO report released this week, FDA has never written down what the phrase means.

    Not “hasn’t gotten around to it lately.” Never. Fifty six years into the statute, the agency responsible for the single most consequential judgment in American drug law, the one that decides whether you face a misdemeanor or a mandatory minimum, is operating on what its own officials describe to GAO as “professional judgment.” There is no criteria document. There is no process memo. There is a phrase in a 1970 statute and a room full of scientists doing their best.

    The Machine That Has No Manual

    To be fair to FDA, the underlying machine is genuinely intricate, and GAO’s report lays it out in more detail than anyone outside the agencies has probably ever gotten. When DEA wants to schedule, reschedule, or deschedule a substance, it is required to request a scientific and medical evaluation from HHS, which farms the actual work out to FDA’s Controlled Substance Staff. FDA runs what the statute calls an eight factor analysis, weighs the evidence, and sends a recommendation back. Under a 2024 Department of Justice Office of Legal Counsel opinion, that recommendation is legally binding on DEA right up until DEA opens formal rulemaking, at which point DEA still owes it “significant deference.” In practice this produces a strange kind of choreography. GAO reviewed 208 substances DEA acted on between 2020 and 2025, found that DEA was required to request and consider an HHS evaluation for 95 of them, and confirmed DEA did so every single time, aligning with HHS’s recommendation on all 84 substances where a final decision had been published by the study’s cutoff.

    So the system, mechanically, works. Two agencies coordinate, mostly agree, and rarely fight. What GAO actually found alarming was not the disagreement rate. It was that neither agency has bothered to write down how any of this is supposed to happen. DEA has no policy assigning roles or responsibilities within its Diversion Control Division for any of the four scheduling pathways it runs. When GAO asked why, DEA’s answer amounted to a shrug dressed up as confidence, that the statute is already clear and the staff are qualified scientists with advanced degrees who do not need a manual. FDA’s defense was gentler but structurally identical, that each evaluation is so individualized a written policy might not fit, so staff learn the eight factor analysis through what the agency calls “person to person training.” Meaning if the two or three people who currently know how it is done retire in the same fiscal year, so does the institutional memory.

    A Definition Nobody Bothered to Write

    FDA officials told GAO directly that the absence of a written definition of “potential for abuse,” including what counts as a “high” potential for abuse, creates real problems when a substance does not cleanly resemble anything already scheduled. They cited xylazine, the veterinary sedative now showing up as a street drug additive, as a case where the lack of a legal or policy definition left staff improvising. This is not a hypothetical gap. It is the actual criterion federal law uses to sort substances into schedules that carry radically different criminal exposure, and the agency charged with applying it admits, on the record, that it is filling the void with judgment calls rather than standards.

    GAO’s other finding compounds this. FDA also maintains a memorandum of understanding with the National Institute on Drug Abuse describing how the two consult on scheduling science. That MOU is over forty years old and refers to FDA offices that no longer exist. Nobody had gotten around to updating it either, until GAO asked. Both agencies confirmed to GAO that the document is out of date and needs revising, which is its own small monument to how long a stale piece of paper can sit in a federal filing system before anyone with the authority to fix it notices.

    None of this is abstract. The report notes that DEA’s own request for an HHS evaluation of xylazine sat with FDA for three years before a recommendation came back, and DEA still had not finished its own review as of this spring. In the meantime the substance keeps showing up mixed into street fentanyl, and DEA has told GAO it now wants Congress to just legislate a schedule for xylazine directly, because the existing statute cannot cleanly cover the ranch hands and slaughterhouse workers who have a legitimate reason to be near the stuff. When the agency responsible for classifying a substance decides the classifying process itself does not fit the substance, the honest response is not to route around it quietly. It is to ask why the process is built the way it is in the first place, which is precisely the question GAO’s report keeps circling without ever quite being allowed to ask it directly, because GAO’s job is to audit process, not to interrogate the statute Congress wrote.

    Two Recommendations and a Very Small Concession

    GAO’s fix is almost aggressively modest. It asked DEA to write down its roles, responsibilities, and procedures for the four ways it schedules substances. It asked FDA to write down how staff should conduct the eight factor analysis and, specifically, how to define potential for abuse, including relative to other substances. It asked FDA and NIH to update their four decade old MOU and add a clause requiring someone to look at it again periodically. That is the entire ask. Not new authority, not a change to the statute, not even a change to who decides what. Just a request that the agencies write down what they are already doing, so the next generation of staff does not have to reinvent the standard from scratch every time someone retires.

    Justice and HHS both agreed to all three recommendations, which is the part of this story that should trouble anyone paying attention rather than reassure them. HHS’s written response promises FDA will draft a new policy describing how to conduct the evaluations that determine, among other things, whether someone’s fentanyl analog carries a Schedule I sentence or no sentence at all. That policy does not exist yet. It has never existed. The system that puts people in federal prison for decades has been running, by the agencies’ own account, on trained judgment and institutional memory rather than a rule anyone could read, challenge, or hold an official accountable to. GAO did not find that DEA and FDA were reaching wrong answers. It found something quieter and, in its way, more damning: nobody can say, on paper, why the right answers were right, or whether the next official asked the same question will reach the same one.

    Source: U.S. Government Accountability Office, Drug Scheduling: DEA and FDA Should Strengthen Policies and Procedures for Scheduling Controlled Substances (GAO-26-108623, September 2026).

    Fediverse Reactions

  • The Directive Was Binding. The Compliance Was Optional.

    In December 2024, the Cybersecurity and Infrastructure Security Agency issued a directive with a name that sounds like a threat, Binding Operational Directive 25-01. It ordered the entire Federal Civilian Executive Branch, all 102 agencies under CISA’s cybersecurity umbrella, to lock down their cloud tenants against the kind of misconfiguration that let hackers walk through SolarWinds in 2020 wearing the digital equivalent of a stolen badge. CISA director Jen Easterly said at the time that the directive would help “reduce risk to the federal civilian enterprise.” The word “binding” was doing a lot of work in that sentence, because a new DHS Inspector General report (OIG-26-30, released September 21, 2026) has confirmed what the word never actually meant, which is that CISA can write the rules and cannot make anyone follow them.

    The Toolbox Nobody Was Required to Open

    To its credit, CISA built the thing it said it would build. Through the Secure Cloud Business Applications project, launched in 2022 in direct response to SolarWinds, the agency produced ScubaGear and ScubaGoggles, free automated tools that scan an agency’s Microsoft 365 or Google Workspace tenant and flag every deviation from a defined security baseline; blocking outdated authentication, enforcing multifactor login, protecting personally identifiable information, the greatest hits of “things a competent IT department should already be doing.” CISA ran more than 80 outreach engagements with over 1,000 participants, put the tools in front of more than 130,000 requesters, and personally walked 17 agencies through implementation. By the OIG’s own account, none of this was phoned in (BOD 25-01, Implementation Guidance).

    BOD 25-01 laid out three deadlines. By February 21, 2025, agencies had to hand over a complete inventory of their cloud tenants. By April 25, they had to deploy the assessment tools and start reporting continuously. By June 20, they had to actually implement the mandatory security policies and begin continuous monitoring. Three deadlines, each one a smaller and more specific ask than the last, each one accompanied by a CISA outreach campaign, each one missed by a majority of the government it was written for.

    Sixty One, Then Fifty Two, Then Eighty Six

    The numbers get worse as the asks get more concrete, which is the part that should bother you. Forty of 102 agencies (39 percent) failed to even name their own cloud tenants by the first deadline, meaning nobody, not CISA, not the agency itself, could verify what needed protecting in the first place. Fifty three agencies (52 percent) had not deployed the assessment tools by the second deadline. By the third and most consequential deadline, the one requiring agencies to actually implement the security policies, 88 of 102 agencies, 86 percent of the entire FCEB, were noncompliant.

    Then it stopped improving. As of February 12, 2026, eight months past the original deadline, 78 of 102 agencies, 76 percent, were still not implementing all mandatory SCuBA policies. That is not a rollout lagging behind schedule; that is a rollout that reached its ceiling and stayed there. CISA’s own report acknowledges the specific failures, agencies leaving outdated authentication procedures in place, skipping multifactor authentication, declining to implement protections for sensitive personal data, the exact configurations the SolarWinds postmortem told everyone to fix five years earlier.

    A Compulsory Directive With No Compulsion Attached

    Here is the part the OIG buried in a single paragraph that should have been the headline. The Federal Information Security Modernization Act of 2014 gives the Secretary of Homeland Security authority to issue these directives; it does not give the Secretary, or CISA, any mechanism to force an agency to obey one. CISA can notify OMB. CISA can log the noncompliance in the annual FISMA metrics cycle. CISA can send its Directives and Policy team to sit down with an agency’s Chief Information Security Officer and ask nicely, again. What CISA cannot do is anything that resembles enforcement in the ordinary English sense of the word, and DHS OIG has now said so in writing three separate times across sixteen years, first in 2009, again in 2010, and now in 2026, joined by a fourth outside voice in GAO-20-133, February 2020, which found that DHS did not consistently validate agencies’ self-reported compliance in the first place.

    That last detail matters more than it looks like it should. An enforcement mechanism built on agencies grading their own homework was never going to survive contact with an agency that had a reason not to want a passing grade recorded. The OIG’s own data reliability check in this report found duplicate tenant submissions and mismatched agency counts between systems, discrepancies the OIG says it “reconciled,” which is a generous word for finding out the compliance numbers were built on the same self-certification honor system that produced the compliance failures in the first place.

    CISA, for its part, declined to submit management comments on this report. Not a rebuttal, not a clarification, not even the standard bureaucratic paragraph about “ongoing efforts to strengthen” whatever it is agencies say when they have nothing to add. Silence, on the record, in response to a finding that the flagship tool of your flagship post-SolarWinds initiative is being ignored by seven out of ten agencies eighteen months after the deadline.

    The Recommendation That Doesn’t Exist

    The single strangest sentence in the entire report comes at the end of the highlights page: “This report contains no recommendations.” Not because there is nothing to fix, but because the OIG has apparently concluded there is nothing left to recommend to an agency that already knows it lacks the authority to fix the problem itself. You cannot recommend that CISA enforce compliance, because Congress never gave CISA anything to enforce with. The recommendation, if there is one, has to go to the people who wrote the Federal Information Security Modernization Act of 2014 and left the enforcement clause out, and they are not the ones reading OIG reports.

    So the government spent two years building a genuinely useful set of free cybersecurity tools, distributed them to more than 130,000 people, walked federal agencies through installation by hand, and produced a compliance rate that, eight months after the deadline, sits at 24 percent. The tools work. The directive was binding in the sense that a strongly worded letter is binding. Everyone involved did their job except the one entity whose job was to make sure everyone else did theirs, and that entity does not exist, because Congress never built it. The next SolarWinds will not be stopped by a better baseline. It will be stopped, or it will not be, by whichever 24 percent happened to read the memo.

    Sources: DHS Office of Inspector General, CISA’s Implementation of Binding Operational Directive 25-01 (OIG-26-30, September 21, 2026); CISA, Binding Operational Directive 25-01: Implementing Secure Practices for Cloud Services; GAO-20-133, Federal Information Security: Agencies Need to Develop and Implement Adequate Policies for Complying with New Requirements (February 2020).

    Fediverse Reactions

  • Two Minutes on the House Floor, Five Days on the Clock

    The most consequential item in Monday’s Congressional Record is a piece of mail. The White House’s letter proposing 11 rescissions of budget authority, dated Friday, was logged and referred to committee. The House then convened at noon, adjourned two minutes later, and set its next session for Thursday, October 1. The money in question expires on September 30.

    The Arithmetic of Rounding Up

    The package totals $809.5 million, which Democrats on the Senate floor kept rounding up to nearly a billion. The largest slice is $567.4 million from HHS refugee and entrant assistance, followed by $69.6 million of a $70.3 million international education line and $56.1 million from HUD housing counseling. It also claws back $15 million from the Justice Department’s Community Relations Service, an office the administration eliminated in late 2025, which makes this the rare rescission that arrives after the funeral.

    A Calendar Doing the Work of a Statute

    The device is a pocket rescission. The Impoundment Control Act gives Congress 45 days to act on a request, and the administration reads that as permission to sit on the funds until they lapse. The Government Accountability Office concluded in 2018 and again in 2025 that the law does not allow this. The Supreme Court last September let the administration keep withholding roughly $4 billion while litigation continued, but said its order was not a ruling on the merits. Susan Collins, the Republican who chairs Senate Appropriations, called this one unlawful too. Nothing is settled, and the calendar does the rest.

    The Senate Stayed Until Nearly Eleven at Night

    The Senate spent its evening passing the Protect College Sports Act, 77 to 22, with 50 Republicans and 27 Democrats in favor. A Booker amendment on catastrophic injury insurance for athletes failed 49 to 50. By unanimous consent, senators also passed the House’s penny bill (H.R. 10167), which ends circulating minting and rounds cash sales to the nearest five cents, plus a terrorism risk insurance reauthorization (S. 4395) and a bill (H.R. 997) letting the National Taxpayer Advocate hire its own counsel.

    Two inspector general nominations arrived, Mark Priebe for Education and Robert Steinau for NASA, along with Jeffrey Zisk for the Postal Regulatory Commission. Majority Leader Thune filed cloture on the Stop Insider Trading Act, which would restrict stock holdings for members of Congress and their families, then withdrew the underlying motion; the Daily Digest schedules the cloture vote for Wednesday.

    Congress spent Monday retiring the penny and studying the price of college football, while eleven appropriations slipped quietly into a folder. It is a fine way to cancel money. Simply schedule the vote for after it is gone.

    Fediverse Reactions

  • The Design Standard NNSA Lowered to Keep Its Plutonium Factory on Schedule

    Of the five construction projects that the National Nuclear Security Administration has ever bothered to isolate into their own contract line items, the Savannah River Plutonium Processing Facility is the newest and the biggest. According to a new GAO report on how NNSA uses these line items, the facility got its own cost-plus-award-fee line in 2023, its own tailored performance evaluation, and, according to officials, a fee plan that took a group of thirty to forty staff and contractors to put together. The theory, as always, was that isolating the deliverable would isolate the accountability.

    What GAO’s own separate assessment of NNSA’s major projects found, published the same month, is that the agency has spent the last two years quietly lowering the bar the project has to clear rather than raising the pressure on the contractor to clear it.

    The Standard NNSA Lowered for Itself

    In October 2024, NNSA adopted what it calls a second revised tailoring strategy for the plutonium facility’s Main Process Building, according to GAO’s February 2026 assessment of NNSA’s major projects. The strategy folded the scope of three other projects into the Main Process Building, and it did something considerably more interesting to the government’s own rulebook. It let NNSA establish a formal cost and schedule baseline once the design was only sixty percent finished, instead of the ninety percent DOE’s own project management order otherwise requires. It also let construction begin before that baseline existed at all.

    NNSA approved ten early procurement and site preparation packages under this looser standard, intended to get lower risk work started while the design was still being finalized. According to GAO, the agency could not fully execute even that plan, because the contractor kept falling behind on delivering the design packages that were supposed to accompany the work. Officials told GAO they are still struggling to hire qualified design engineers and that the contractor continues to miss performance targets. The project’s final design review, originally set for March 2026, has slipped to September 2026. When the contractor submitted its package for an independent cost estimate in May 2025, GAO found it was insufficient to actually conduct the estimate; NNSA is waiting on a resubmission in early 2026, at which point officials hope the design will finally be close to the ninety percent maturity the agency waived in the first place.

    The cost, meanwhile, has done what cost usually does at Savannah River. NNSA’s own fiscal year 2026 budget justification puts the Main Process Building at over twenty two billion dollars, against a preliminary range of $6.9 billion to $11.1 billion that NNSA itself published at the project’s first major milestone. Officials told GAO the September 2035 completion date, already the later end of that earlier range, may slip further. A revised cost and schedule estimate is not due for internal NNSA approval until September 2026.

    A Building With a Prior Conviction

    None of this is Savannah River’s first attempt at doing something complicated with plutonium in that same footprint. The plutonium facility is being built inside and around the shell of the site’s Mixed Oxide Fuel Fabrication Facility, a program NNSA spent roughly fifteen years and more than eight billion dollars on before mothballing it in 2014. That project, too, started with a modest number. DOE estimated MOX construction at $1.6 billion in 2004. By 2013, GAO was confirming that NNSA had quietly added another two billion dollars to the estimate even as the facility was supposedly nearing completion, after years of the agency declining to disclose a rebaselined figure publicly. The facility never processed a gram of commercial fuel. NNSA converted the shell into the plutonium pit factory it operates today.

    There is a version of this story where the agency learned something from the MOX years and applied it to the pit factory. The tailoring strategy GAO documented in the new report suggests the lesson NNSA actually absorbed was narrower: that a hard design-maturity threshold is an obstacle to be waived when the schedule is inconvenient, not a floor to be held.

    Now Firing the Contractor, Unrelatedly

    Whatever the line item and its fee plan were supposed to buy NNSA, it apparently was not enough confidence in the incumbent. Savannah River Nuclear Solutions, the Fluor led joint venture that has run the site since 2008 and is building the plutonium facility, received a project management rating of less than adequate in its fiscal year 2024 performance evaluation, according to a review DOE released in February 2025, which cited the absence of a credible overall project schedule. In February 2026, NNSA released a request for proposals for a standalone follow-on management and operating contract for the entire Savannah River Site, worth an estimated sixty one and a half billion dollars over a potential twenty years and four months, a competition NNSA’s own announcement frames as separate from the plutonium project specifically but that plainly reflects an agency no longer content with how its current contractor performs. NNSA extended the incumbent’s contract through September 2027, worth an additional $2.3 billion, explicitly to preserve workforce continuity while the recompete plays out, which is its own small admission that the agency does not trust the transition to go smoothly either.

    The new M&O contract, whoever wins it, will not just run the plutonium factory. It also covers the storing, processing, and long term management of the nuclear materials and waste that Savannah River exists to handle, all under the same undocumented, case by case logic GAO’s line item report says NNSA still uses to decide which pieces of that work get isolated into their own accountability structure and which pieces stay folded into the general M&O scope where waived standards and quiet rebaselines are harder to see. A cost-plus-award-fee line item and a thirty person fee plan gave GAO something to point to when NNSA needed to demonstrate it was taking the plutonium facility seriously. It did not stop the agency from lowering its own design standard to keep pouring concrete, and it did not stop the government from concluding, two years after handing the project its own line, that the company running it needs to be replaced.

    Sources: GAO, NNSA Contract Line Items: Agency Should Document Criteria for Use and Capture Lessons Learned (GAO-26-108409, September 2026); GAO, NNSA Construction Projects: Cost and Schedule Performance (GAO-26-107777, February 2026); GAO, Mixed Oxide Fuel Fabrication Facility: DOE Needs to Provide More Consistent and Timely Cost Information (GAO-13-283, 2013). Related: $308 Million to Keep the Lights On in a Building From 1945.

  • Federal Programs Help People With Disabilities Find Work. The Handoff Can Take Months.

    The federal government has programs designed to help people with intellectual and developmental disabilities find and maintain jobs.

    It also has procedures for deciding which program is supposed to pay for that help.

    Sometimes the second part gets in the way of the first.

    A new Government Accountability Office report examining disability employment services in Georgia, Pennsylvania and Washington found that providers encountered administrative confusion, reimbursement delays and gaps in services as individuals moved between state Vocational Rehabilitation programs and employment supports financed through Medicaid.

    In one particularly striking example, a Washington provider association told GAO that funding authorizations for job-placement contracts that should take a week or less could instead take six to nine months because of staffing shortages.

    For someone who is ready to work, that is a rather long administrative definition of “ready.”

    Two Programs, One Worker

    Vocational Rehabilitation, or VR, is a joint federal-state program overseen nationally by the Department of Education’s Rehabilitation Services Administration. Medicaid Home- and Community-Based Services, or HCBS, is overseen federally by the Centers for Medicare & Medicaid Services.

    Together, they represent the primary federal programs funding employment services for people with intellectual or developmental disabilities, according to officials interviewed by GAO.

    The scale is substantial.

    Federal VR grants to states totaled approximately $3.7 billion in fiscal year 2023, and people with intellectual or developmental disabilities represented about 22 percent of VR cases nationally that year. Separately, a federally funded study estimated roughly $1.5 billion was spent on employment services for people with I/DD in FY2023, with Medicaid HCBS supplying most of that money. That estimate did not include the VR grants.

    The programs perform different roles, and on paper the transition between them is fairly orderly.

    VR typically finances shorter-term services such as job discovery and placement. Once an individual reaches job stabilization, generally after 90 days of employment, the VR case closes and Medicaid HCBS can finance longer-term assistance such as job coaching.

    If the worker loses or changes jobs, however, the process can begin again.

    That handoff is where things can become complicated.

    Mind the Gap

    GAO interviewed 12 employment service providers across the three states. Six reported service gaps caused by administrative burden or confusion between VR and state I/DD agencies.

    In Pennsylvania, one provider told investigators that support coordinators sometimes waited for a formal VR closure letter before beginning Medicaid-funded job coaching, even though individuals became automatically eligible after reaching 90 days of job stability.

    GAO said the practice caused “unnecessary gaps in services.”

    Providers can also find themselves financing the gap.

    Four of the 12 providers told GAO they experienced reimbursement delays as individuals transitioned from VR to I/DD services. One Georgia provider reported continuing to serve individuals without reimbursement during a three-month transition period while the agencies completed closure letters and prior authorizations.

    According to GAO, providers are not reimbursed for services delivered while an individual is caught between agencies after the VR case has closed.

    The consequences do not necessarily remain confined to accounting departments.

    One Washington provider told GAO that some families simply give up on obtaining employment services because of the administrative workload and back-and-forth between agencies. A Georgia provider described a woman who lost her job and then experienced months of delays reopening her VR case because of agency miscommunication.

    Pick Your Payment Problem

    Behind the coordination problem is another peculiarity: the two systems generally pay providers differently.

    VR agencies in the three states generally used a milestone model, paying providers when an individual achieved specified employment outcomes. Medicaid HCBS programs primarily used fee-for-service, paying according to units of service or time.

    Each approach comes with its own incentive problem.

    Under milestone payments, providers can perform substantial work without receiving full reimbursement if the worker fails to reach the prescribed outcome, even when circumstances are outside the provider’s control.

    GAO gives a particularly revealing example. One provider supported an individual whose workplace went out of business before the worker could demonstrate job stability. Because the required milestone wasn’t reached, the provider faced the reimbursement risk.

    Pennsylvania officials told GAO that providers considered milestone payments too risky compared with fee-for-service arrangements.

    Fee-for-service solves that problem and introduces another.

    The more services a provider delivers, the more it gets paid.

    Yet the objective of supported employment is generally for workers to become increasingly independent, with on-the-job assistance fading over time. GAO notes that fee-for-service therefore does not financially incentivize providers to reduce or eliminate services.

    In other words, one model can penalize providers when a desired outcome isn’t achieved. The other can reward them for continuing to provide the very services the program hopes workers will eventually need less of.

    Federal program design has apparently discovered diversification.

    Washington Has Been Told Before

    None of the coordination problem is entirely new to the federal government.

    In 2022, the Labor Department’s Office of Disability Employment Policy, Education’s Rehabilitation Services Administration, CMS and other federal agencies jointly encouraged state and local governments to coordinate funding through techniques known as blending, braiding and sequencing.

    The guidance also encouraged interagency agreements specifically to prevent confusion over responsibilities and delays in services.

    Georgia and Pennsylvania officials told GAO they found the guidance useful.

    Washington officials told GAO they had not yet implemented it.

    States have made other changes. Pennsylvania, for example, established guidance allowing an individual to proceed to Medicaid HCBS-funded employment services if VR has not made an eligibility determination within 120 days. Georgia officials said their VR and I/DD agencies now meet weekly to track transitioning cases and monthly to troubleshoot stalled ones.

    Those efforts matter, because GAO’s report is not a nationwide census of disability employment programs.

    The auditors examined only three states and interviewed 12 providers. GAO explicitly cautions that the results cannot be generalized to all states or all service providers.

    But within that limited sample, the pattern is difficult to miss.

    The government has programs to help people with intellectual and developmental disabilities enter and remain in the workforce. It has federal money supporting those programs. It has guidance explaining how different funding streams can be coordinated. And states have procedures intended to move people from one system to another.

    Yet GAO still found workers encountering service gaps, providers waiting months for reimbursement and families navigating enough administrative machinery that some reportedly abandoned the process altogether.

    For a system designed to remove barriers to employment, the paperwork occasionally appears to have erected a few of its own.

    Source: U.S. Government Accountability Office, Disability Employment Services: Factors Affecting Coordination Between Vocational Rehabilitation and Medicaid Programs (GAO-26-106499, September 2026).

    Fediverse Reactions

  • $308 Million to Keep the Lights On in a Building From 1945

    The National Nuclear Security Administration would like you to know that it has learned something about contract oversight. In 2014, when it awarded the contract to build a new uranium processing facility at the Y-12 National Security Complex in Oak Ridge, Tennessee, it did something it almost never does. It gave the project its own line item, separate from the sprawling, undifferentiated blob of “management and operating” work that otherwise governs how NNSA pays its contractors. A separate fee plan. A separate performance evaluation. Isolated accountability, in theory, for a single, isolable piece of work.

    According to a new GAO report on how NNSA uses contract line items, this was the pilot. The one meant to prove that separating deliverables out of the M&O morass would sharpen contractor performance and protect the government from the kind of cost bleed that has made NNSA’s acquisitions program a fixture on GAO’s High Risk List for over a decade.

    Here is how the pilot is going. The Uranium Processing Facility is nearly four billion dollars over its cost baseline and eight years behind schedule. NNSA re-baselined the project in December 2024, at a new estimate of $10.35 billion, more than fifty percent above where the project stood before. And because the replacement facility still is not ready, NNSA is now paying to keep the building it was supposed to replace alive, Building 9212, poured in 1945, older than the Atomic Energy Commission that once ran it, and not built to a code that anticipated an earthquake or a derecho hitting Oak Ridge. The Y-12 contractor’s own estimate for keeping 9212 in service is over $308 million, plus another $100 million in deferred maintenance nobody wants to put off any longer.

    The Fee Structure That Was Supposed to Fix This

    The theory behind giving a project its own line item is straightforward enough that GAO states it almost apologetically in the new report; separate the deliverable, separate the fee, and the contractor has a reason to hit the target instead of coasting on whatever else is going well across the site. NNSA officials told GAO they used exactly this logic for the Uranium Processing Facility, and for a while, on paper, it worked as designed. The line item let NNSA withhold fee when performance lagged. Officials told GAO that over the years since 2014, NNSA paid the contractor less than $40 million out of roughly $220 million in available fee, precisely because the fee was isolated and precisely because performance was bad.

    Withholding fee is not the same as finishing a building. The project kept slipping anyway, right up until the 2024 re-baseline, at which point, GAO notes, the contractor’s cost and schedule performance apparently improved. Which raises the obvious question nobody in the report quite asks out loud: did the line item fix the contractor, or did NNSA just eventually agree to pay for the delay it had spent a decade complaining about, at which point the delay, unsurprisingly, stopped generating friction?

    Separately, GAO’s February 2026 assessment of NNSA’s twenty eight major construction projects found that the UPF’s Main Process Building and Salvage and Accountability Building, the two subprojects riding under that pioneering line item, are responsible for roughly eighty percent of the $4.8 billion in cumulative cost overrun across the entire NNSA major projects portfolio, and forty percent of its thirty years of cumulative schedule delay. The flagship example of contract-oversight reform is also the single largest driver of the exact problem the reform was supposed to solve.

    A Building That Predates the Concept of a Safety Code

    None of this is abstract for the people who still have to run Building 9212 while its replacement crawls toward completion. The building processes enriched uranium for nuclear weapons components and Navy reactor fuel. It was constructed during the Manhattan Project‘s industrial buildout, before the National Environmental Policy Act, before OSHA, before DOE’s own seismic design standards existed in anything resembling their current form. GAO’s September 2025 review found that NNSA does not have a comprehensive, agreed-upon plan for how to keep operating it safely through the additional years the delay has bought it.

    The $308 million is not a hypothetical either. It is the contractor’s own figure, submitted as part of planning for continued operations through 2035, one year past NNSA’s current target date for the new facility to be fully operational, itself a date GAO’s reporting suggests deserves some skepticism given the project’s history of missing every prior one. Consolidated Nuclear Security, the M&O contractor at Y-12, is simultaneously the entity being paid an isolated, performance-linked fee to finish the new facility and the entity submitting cost estimates to keep the old, code-noncompliant facility running because the new one is not finished. It is worth sitting with how neatly those two roles cancel each other out as accountability mechanisms.

    What the Line Item Actually Bought

    To be fair to GAO’s broader report, and to NNSA, nobody involved is claiming the line item made things worse. NNSA officials told GAO the tailored fee structure gave them leverage they would not otherwise have had, and withholding $180 million in fee over a decade is not nothing. The report’s two recommendations, that NNSA document its criteria for when to use line items and formally capture lessons learned from the ones it has used, are modest and NNSA has already agreed to both, with target dates in the spring of 2027.

    But modest is the operative word, and it is worth being precise about what a documented criteria policy will and will not fix. It will not shrink Building 9212’s price tag. It will not un-spend the $4 billion the UPF re-baseline added to the government’s bill. What it will do, at best, is make NNSA’s next attempt to isolate a construction project’s fee and performance evaluation slightly more consistent across sites than the current, undocumented, case-by-case process that has left Los Alamos with zero project line items despite a $1.86 billion pit production subproject sitting well past the threshold the agency’s own officials cite for other sites.

    The uranium processing facility was supposed to be the proof that separating the fee from the noise made contractors perform. Instead it produced a decade of withheld fee, a $4 billion rebaseline, and a Manhattan Project era building that will now run a year past NNSA’s own optimistic new deadline, on a budget nobody is calling a placeholder because the money has already been spent. If this is what accountability looks like when NNSA does it on purpose, on its single best-documented example, it is fair to ask what the agency’s much larger, entirely undocumented middle ground of construction spending is actually buying the country.

    Sources: GAO, NNSA Contract Line Items: Agency Should Document Criteria for Use and Capture Lessons Learned (GAO-26-108409, September 2026); GAO, NNSA Construction Projects: Cost and Schedule Performance (GAO-26-107777, February 2026); GAO, Uranium Processing Facility: DOE Needs to Address Cost, Schedule, and Risk Challenges (GAO-25-107330). Related: The Design Standard NNSA Lowered to Keep Its Plutonium Factory on Schedule.

  • SEC Flagged OTC Link’s Access-Control Problem in 2016. It Was Still There in 2023.

    Three SEC examination cycles identified compliance problems at a major over-the-counter trading operator. The public record does not explain why years passed before enforcement followed.

    The Securities and Exchange Commission censured OTC Link LLC on Tuesday and ordered the broker-dealer to pay a $575,000 civil penalty for repeated failures involving technology and security requirements under Regulation Systems Compliance and Integrity, better known as Regulation SCI.

    The penalty is straightforward.

    The timeline is considerably less so.

    According to the SEC’s September 22 administrative order, the agency identified a deficiency involving OTC Link ATS’s access-control policy during a fiscal year 2016 examination.

    SEC examiners returned in 2019.

    The problem was cited again.

    They returned again in 2022.

    It was cited again.

    And according to the SEC, as of fiscal year 2023, the access-control policy “had still not been formally established.”

    That leaves an obvious question: What happened during those seven years?

    The SEC isn’t saying.

    A Rule Requiring “Prompt Action”

    OTC Link is a registered broker-dealer and a subsidiary of OTC Markets Group. It operates alternative trading systems used by broker-dealers to execute or facilitate transactions in securities that trade outside national securities exchanges.

    Because of its role in the market, OTC Link ATS is subject to Regulation SCI, a regulatory framework covering the technological infrastructure of important securities-market entities.

    Among other requirements, Regulation SCI requires covered entities to maintain policies and procedures governing their technological systems, conduct periodic reviews and take “prompt action” to remedy identified deficiencies.

    According to Tuesday’s SEC order, OTC Link’s problems went well beyond one unfinished document.

    The Commission identified deficiencies involving account management and access controls, network-device security configuration, data-loss prevention, application vulnerability management, and vulnerability testing and remediation.

    But the access-control policy provides perhaps the clearest illustration of the timeline.

    The SEC says the policy was deficient during its FY2016 examination because it remained in draft form.

    A subsequent examination resulted in another deficiency letter in 2019.

    Another examination produced another deficiency letter in 2022.

    By FY2023, according to the Commission, the policy still had not been formally established.

    If federal regulatory examinations came with punch cards, OTC Link was getting close to a free one.

    Then Came the Consultants

    The chronology finally begins moving faster in 2024.

    According to the SEC, OTC Link retained third-party compliance consultants that year to evaluate its Regulation SCI program and recommend improvements.

    Beginning in March 2025, the company established additional policies covering areas including application vulnerability management, account management and access control, and network-device configuration management.

    The SEC ultimately found that OTC Link willfully violated several provisions of Regulation SCI. The company agreed to a censure, a cease-and-desist order and the $575,000 penalty without admitting the Commission’s findings, except as to jurisdiction.

    But this was not OTC Link’s first recent encounter with SEC enforcement.

    In August 2024, the SEC charged OTC Link with separate anti-money-laundering compliance failures.

    In that case, the SEC found that from March 2020 through May 2023, OTC Link failed to implement reasonably designed policies and procedures for monitoring transactions on its trading platforms for suspicious activity.

    The result was remarkable: OTC Link did not file a single Suspicious Activity Report during that period, despite its three platforms facilitating tens of thousands of OTC transactions daily.

    OTC Link paid $1.19 million to settle that matter. The SEC said that investigation also grew out of an examination conducted by its Division of Examinations.

    The two cases involve different regulations and different compliance failures. There is no evidence in the public record establishing that one caused or contributed to the other.

    Their timelines nevertheless overlap.

    Three Examinations, One Unanswered Question

    The SEC’s latest order establishes that its examiners repeatedly found problems at OTC Link.

    What it does not explain is what happened after they found them.

    Bureaucracy Times contacted the SEC’s Office of Public Affairs on September 22 seeking the dates of the deficiency letters associated with the 2016, 2019 and 2022 examinations.

    We also asked whether OTC Link submitted remediation plans after those examinations, whether the SEC ever considered the deficiencies resolved, whether remediation deadlines were established, when examiners determined previously identified deficiencies remained unaddressed, and when the matter was referred or otherwise escalated to the Division of Enforcement.

    We specifically asked how the seven-year history of the access-control policy squared with Regulation SCI’s requirement for “prompt action” to remedy deficiencies.

    The SEC declined to answer.

    “Attributable to an SEC spokesperson, we decline comment beyond our public filings including our press release which we issued today,” SEC Public Affairs Specialist David Ausiello told Bureaucracy Times.

    That leaves the Commission’s own enforcement order to tell the story.

    FY2016: deficiency identified.

    2019: cited again.

    2022: cited again.

    FY2023: still not formally established.

    2024: outside consultants brought in.

    March 2025: additional policies established.

    September 2026: enforcement action announced.

    None of that absolves OTC Link of the violations described by the SEC. The Commission’s order places responsibility on the company for maintaining the required policies and promptly correcting deficiencies.

    But regulatory oversight is also supposed to do something after regulators repeatedly discover that a regulated entity has not fixed a previously identified problem.

    The SEC has now documented three examination cycles and years of unresolved deficiencies at an operator of important securities-market infrastructure.

    What remains missing from the public record is what the regulator did about those findings along the way.

    For now, the SEC has declined to fill in that part of the timeline.

    Sources: SEC Administrative Order, In the Matter of OTC Link LLC, Release No. 34-106458 (September 22, 2026); SEC press release, OTC Link AML enforcement action (August 2024).

    Fediverse Reactions

  • One Email Can Still Turn the National Labor Relations Board Off

    Late on January 27, 2025, a National Labor Relations Board member named Gwynne Wilcox got an email from a White House staffer telling her she was fired, effective immediately. No hearing. No stated cause. Her term ran to August 2028. The National Labor Relations Act says a Board member “may be removed by the President, upon notice and hearing, for neglect of duty or malfeasance in office, but for no other cause.” None of that happened. What happened instead is that a labor enforcement apparatus covering the entire private sector stopped working, by design, because of how few people it takes to make it stop.

    The Quorum Is the Whole Point

    The NLRB has five seats, but the Act requires three members present to do anything at all, per Section 3(b), and the Supreme Court made that requirement absolute in New Process Steel v. NLRB (2010), tossing out roughly 600 decisions a two-member Board had issued over 27 months on the theory that two was close enough. It was not. So when Wilcox’s seat emptied, the Board had two members left. Below quorum, the agency cannot certify a union election, cannot rule on an unfair labor practice charge, cannot seek a 10(j) injunction against an employer firing organizers mid-campaign. It can receive filings. It cannot decide them.

    This is worth sitting with, because it means removing one person, out of five, on a board that oversees private-sector labor relations for the entire country, is functionally the same as abolishing the agency for as long as the seat stays empty. Congress built in that fragility assuming no president would exploit it. That assumption did not survive contact with 2025.

    The Ninety Year Old Fence Comes Down

    Wilcox sued. In March 2025, Judge Beryl Howell reinstated her, writing that the removal was “blatantly illegal,” leaning on Humphrey’s Executor v. United States (1935), the case letting Congress insulate agency heads like FTC and NLRB members from at will removal for nine decades. The government appealed. In April 2025, the Supreme Court granted an emergency stay letting the firing stand, without yet deciding the underlying question, but noting the NLRB wields “considerable executive power,” a phrase that told you exactly where this was going more than a year before the Court said so on the merits.

    By December 2025, the D.C. Circuit obliged, ruling that NLRB removal protections violate Article II, consolidated with a companion case over the Merit Systems Protection Board. Then in June 2026, the Court delivered Trump v. Slaughter, tossing Humphrey’s Executor out entirely and holding that anyone who exercises executive power (adjudicating cases, writing binding rules, suing on the government’s behalf) has to be removable at the President’s will. The FTC lost its removal protections that day. The MSPB’s cert petition was denied the next. And this September, the Solicitor General filed a brief telling the Court that Wilcox’s case is moot for the same reason, since the NLRB does the identical three things (adjudicates, rules, sues) that got the FTC stripped of its tenure protections. DOJ wants cert denied outright, or granted and summarily affirmed, because there is nothing left to argue.

    The Federal Reserve Gets to Keep Its Fence

    Here is the detail that belongs in the lede of somebody’s dissertation someday. On the same day the Court decided Slaughter, a different lineup of justices decided Trump v. Cook, holding that the Federal Reserve’s Board of Governors is not subject to the same logic, and its removal protections survive. Same Court, same day, same constitutional text, opposite outcome, because the majority drew a line around the one institution whose independence bond markets actually price. The NLRB, which decides whether a shop steward gets reinstated, did not make the cut. The body that sets interest rates did. If “executive power” were a neutral legal category rather than a permission slip issued selectively, you would expect it to catch both agencies or neither. It caught the one nobody holding a bond portfolio would tolerate touching.

    Every Future President Now Owns a Switch

    Strip away the doctrinal packaging and what Slaughter hands the next several administrations, of either party, is a standing option. Dislike how an independent board is ruling, and you no longer need Congress to restructure it. Fire one member below quorum and the agency goes dark until you nominate a replacement, on your own schedule. The NLRB is uniquely exposed here because its quorum floor is so low relative to its seat count, three of five, that a single vacancy (whether from resignation, expiration, or a late-night email) can freeze it entirely. The FTC carries the same removal exposure now but a sturdier quorum structure, so it does not fail as cleanly. The NLRB does.

    Wilcox’s case will likely end quietly, denied or summarily affirmed, exactly as DOJ has asked, because the fight over the underlying constitutional question is already over. What is not over is the operational fact this litigation exposed almost as an aside. An agency built to arbitrate between employers and organized labor can be switched off by any president willing to fire one person and wait. Nobody had to rewrite the National Labor Relations Act to accomplish that. They just had to win a case about somebody else’s agency.

    Sources: National Labor Relations Act, 29 U.S.C. § 153; New Process Steel v. NLRB, 560 U.S. 674 (2010); Supreme Court emergency stay order, April 9, 2025; Solicitor General brief, Wilcox v. Trump (September 2026).

    Fediverse Reactions

  • Congressional Record Watch: The House Took Wednesday Off While the Senate Debated Whether License Plate Readers Are a Civil Liberties Problem

    The House of Representatives was not in session on Wednesday, September 23. It did not meet, it did not vote, it did not do anything a citizen could point to as work, and it will return Thursday only for a pro forma session lasting long enough for someone to gavel it open and closed again. The Senate, left to run the government’s daily errands alone, spent part of its day on a subject that actually deserves a headline; the rest went to student athlete compensation and eight National Whatever Day resolutions.

    The lede belongs to the Judiciary Committee’s Subcommittee on Crime and Counterterrorism, which held a hearing on Flock Safety’s nationwide automated license plate reader network. The witness list did the arguing for itself. The Institute for Justice and the American Civil Liberties Union warned that a private company’s cameras, feeding a searchable database used by thousands of police departments with no warrant requirement, is exactly the kind of infrastructure a country builds when nobody in particular decided to build a surveillance state; it just accumulated one contract at a time. A sheriff from Pinal County, Arizona showed up to say the cameras solve crimes. Both things can be true, which is the entire problem with oversight hearings that end in “concluded” rather than “acted on.”

    Elsewhere the Senate did pass things. The Romance Scam Prevention Act (H.R. 2481) requires online dating services to warn users about fraud, which is Congress discovering in 2026 that people lie on the internet. The Secure Space Act (S. 1962) bars the FCC from licensing satellite systems tied to entities on its own Covered List, a belated acknowledgment that the same national security concerns applied to telecom equipment for years apply just as well to something orbiting the planet. The Satellite Cybersecurity Act (S. 3404) orders a federal report on commercial satellite cybersecurity, which is to say a report about a report, since the underlying vulnerability isn’t news to anyone who has read a GAO study on the subject.

    The Senate confirmed Angela Veronica Colmenero to a federal judgeship in the Southern District of Texas on a 50 to 47 party line vote, and reported out 6,859 military nominations in a single Armed Services Committee motion, the kind of bulk personnel action that never gets a floor debate because nobody’s staff wants to read 6,859 names. The Environment and Public Works Committee held a hearing on nuclear waste management policy, a subject that has generated testimony since before some of the witnesses were born and will generate testimony long after this Congress is gone. The Special Committee on Aging examined the collapse of domestic generic drug manufacturing, which is the kind of hearing that produces excellent testimony and no legislation, because reshoring a pharmaceutical supply chain requires money, and money requires a vote nobody wants to cast.

    Homeland Security and Governmental Affairs declined to authorize its own legal counsel to seek immunity for a witness, a small item buried in the Digest that is more interesting than everything that got its own press release, and got none of the coverage.

    The House Chamber, notably, produced nothing today except a scheduling notice. Democracy’s most photographed branch is apparently also its most occasionally optional one.

    Sources: Congressional Record, Daily Digest, September 23, 2026 (Vol. 172, No. 151).

    Fediverse Reactions