Bureaucracy Times

All the news fit to be declassified.

Category: Federal Agencies & Oversight

  • The Pantry That Held a Federal Problem

    When federal investigators cracked open a humble kitchen cabinet in Kellyville, Oklahoma, they found exactly what the OIG’s proprietary data analytics had promised: a smorgasbord of narcotics meticulously arranged in false-bottom containers, each one designed to look like everyday household staples to the untrained eye.

    The powdered lemonade wasn’t lemonade. The sports drinks were a lie. Underneath, concealed in ingenious compartments, sat cocaine, MDMA, psilocybin mushrooms, and a colorful collection of counterfeit pharmaceuticals, including fraudulent Xanax, oxycodone, hydrocodone, and Percocet. It was, in its own way, a masterclass in domestic deception, right down to the organizational principle: everything in its place, everything legible to law enforcement, nothing what it appeared to be.

    This July, the suspect who organized this pharmaceutical pantry received a sentence of more than 17 years in federal prison. By then, the investigation that led to his conviction had already demonstrated something the Postal Inspection Service, the DEA, and the USPS Office of Inspector General would prefer remained institutional knowledge: the American postal system, for all its constitutional blessing and century-long tradition, remains a surprisingly efficient conduit for moving drugs across state lines, provided you know how to use it and how to hide what you’re moving.

    When Algorithms Light Up Like Christmas Trees

    The investigation began not with heroic detective work, but with the DEA Tulsa Office tracking a man suspected of participating in a nationwide fentanyl trafficking operation. The OIG special agents received the call in May 2025. They had an address. They had suspicion. They needed confirmation.

    What they got instead was overwhelming algorithmic vindication. The USPS Office of Inspector General maintains what it calls a proprietary analytical tool, developed by its Data Analytics team, designed to flag addresses receiving suspicious parcels. When OIG personnel ran this particular address through the system, according to the agency’s own account, “that address lit up like a Christmas tree.”

    The metaphor is instructive. Christmas trees are festive, innocent, beloved; the address, apparently, was not. What the analytics actually revealed was this: in just two months, the location had received numerous packages from Oklahoma, California, and Mississippi. The common thread was chemical, not emotional.

    The DEA and OIG coordinated. A search warrant was obtained. On the day agents intercepted one outbound package headed for the suspect, a K9 deputy with the Tulsa County Sheriff’s Office performed the olfactory confirmation. Inside was a vacuum-sealed bag containing nearly a pound of pills that tested positive for methamphetamine.

    That was merely the opening act.

    Compartmentalization as a Lifestyle

    When Postal Inspection Service agents arrived at the property to execute a search warrant, they found a residential space that appeared, on initial inspection, entirely unremarkable. The kitchen was organized. The pantry was stocked. Everything suggested the domestic routine of someone who believed in order, in structure, in the virtues of proper food storage.

    But the Postal Inspection Service and OIG special agents were not looking for actual provisions. They were hunting for what the OIG later characterized, without apparent irony, as “a smorgasbord of illicit drugs.” What they discovered was a methodological approach to compartmentalization that would have pleased any organizational consultant. A place where false-bottom containers that maintained the appearance of legitimacy on top while concealing controlled substances beneath. It was, in effect, an entire kitchen devoted to the principle of misdirection.

    The haul was substantial. Cocaine. MDMA, more commonly known as ecstasy or Molly. Psilocybin mushrooms, still classified as a Schedule I controlled substance, despite a growing scientific literature suggesting therapeutic applications. Counterfeit pharmaceuticals, each one a secondary fraud layered atop the primary narcotic crime. It’s not merely the distribution of oxycodone, but the distribution of counterfeit oxycodone, meaning consumers never even knew what they were ingesting. Counterfeit Xanax. Counterfeit Percocet.

    In the suspect’s vehicle, investigators found two semi-automatic handguns, $3,600 in concealed cash, three cellular telephones, and the supporting infrastructure of the retail drug trade. Things like digital scales, clear plastic baggies, and the mundane equipment of supply-chain management applied to substances that will destroy lives.

    Evidence suggested the suspect had ordered his inventory through unregulated online marketplaces, converted his residential property into a distribution hub, and conducted business across northeast Oklahoma. He was neither a major trafficker nor a minor street dealer. He was precisely the middle layer of the American drug supply chain, the network that makes narcotics available in communities where addiction has become, for all practical purposes, a chronic public health emergency with no visible ceiling.

    The Cooperative Takedown

    This case succeeded because it was built on institutional cooperation. The DEA pursued a nationwide investigation into fentanyl trafficking. The USPS OIG, equipped with its data analytics apparatus, cross-referenced suspicious addresses against the DEA’s intelligence. The Postal Inspection Service executed the warrants. The Tulsa County Sheriff’s Office provided K9 support. The U.S. Marshals Service accepted custody of the prisoner. Local prosecutors did the paperwork. Federal judges imposed the sentence.

    None of this was accidental. The USPS Inspector General, Tammy L. Hull, identified this partnership in remarks accompanying the case highlight.

    “We’re proud of the partnerships USPS OIG special agents have forged with the DEA, USPIS, and local and state law enforcement in Oklahoma and across the country. Joint investigations like these protect the American public by disrupting the criminal misuse of the U.S. Postal Service for drug trafficking.”

    The statement is, in every technical sense, accurate. The investigation succeeded. The suspect was convicted. The sentence was substantial. The American public was protected from one distributed, modestly-scaled narcotic operation across northeast Oklahoma.

    But the statement contains, perhaps necessarily, an institutional optimism worth examining. Every case that succeeds does so because someone chose to pursue it. Every criminal investigation requires the alignment of several independent bureaucracies, the availability of sufficient investigative resources, the cooperation of multiple jurisdictions, and a prosecutorial environment willing to proceed.

    The USPS OIG operates through voluntary cooperation with other agencies. These partnerships are real, demonstrable, documented. But they are also not comprehensive. They represent success, not saturation. For every address that lights up on the OIG’s proprietary analytics, how many others remain dark?

    The Postal System as Delivery Infrastructure

    The OIG’s public characterization of this case frames it as a vindication of joint investigative capacity. And in a technical sense, it is. But it also illustrates something more systemically concerning…the U.S. Postal Service remains, structurally, a convenient mechanism for the distribution of contraband.

    The postal system was designed for reliability, ubiquity, and trust. These same qualities make it attractive to anyone seeking to move substances across state lines while maintaining operational security.

    The suspect in this case was sentenced to 17 years in federal prison. The OIG has highlighted the case as evidence of joint investigative success. But the postal system still operates. Drugs still move through it. Other cases are still pending, and prior cases have already been tried, while future cases are being investigated right now by the very agencies that coordinated this takedown.

    The real question is whether identifying one pantry full of contraband represents progress in disrupting the systemic use of the postal system for drug trafficking, or merely the visible surface of a much larger problem.

    The OIG’s response, implied in its case highlight, is that institutional cooperation makes a difference. Perhaps it does. But the problem persists, and so do the pantries, and the compartments, and the false bottoms, and the small-scale distributors who convert residential spaces into supply hubs.

    For now, one address has been disrupted. One suspect has been incarcerated. One kitchen’s worth of contraband has been seized. The postal system, a government corporation, continues its deliveries.

    For more on USPS OIG oversight, see Nashville’s Postal Honor System Just Failed an Audit — on four OIG reports documenting self-reported compliance data that stopped matching reality at every layer of Nashville’s mail operation — and The Postal Service Passed Its Pay Audit. The Bill Just Got Postponed. — on how USPS executives legally defer salary cap overages into interest-bearing accounts while the agency posts a $9 billion annual loss.

    Fediverse Reactions

  • The Notary, the Vacation, and the Barred Planner: Inside the Gilchrist Tax Lien Fraud Case

    In the driveway, an unexpected visitor

    On a quiet weekday morning in a Bexar County subdivision, a 70-year-old North Texas attorney allegedly appeared without warning at a woman’s home. According to a federal criminal complaint, David Thomas Gilchrist told the woman’s husband that the FBI was looking for him and suggested the couple should consider taking a “vacation” for a couple of years, perhaps to Mexico. The visit came just days before Gilchrist was scheduled to testify under oath before the Securities and Exchange Commission.

    Federal prosecutors now allege that this driveway encounter was not an awkward misunderstanding but an act of witness tampering, aimed at pushing a potential witness out of reach of investigators probing what they describe as a $1.45 million Ponzi scheme built on the promise of safe, niche returns from Texas property tax liens.

    Gilchrist, a Grand Prairie, Texas attorney, was arrested on August 31, 2026, on a federal criminal complaint. He is charged with wire fraud, aggravated identity theft, and witness tampering, and is expected to make his initial appearance before a U.S. magistrate judge on September 2, 2026.

    The charges stem from an investment program that, on paper, looked like a sophisticated way to profit from delinquent property taxes and, in practice, allegedly became a vehicle for forgery, fabricated intermediaries, and a campaign of delay and evasion when investors started asking for their money back.

    A tax lien business that never was

    The criminal complaint affidavit alleges that between April 2023 and January 2026, Gilchrist solicited roughly twenty investors, often through partnership agreements or promissory notes, for the stated purpose of purchasing property tax liens in several Texas counties. He allegedly told investors he would use their pooled funds to buy tax liens, manage the portfolio, and repay them with attractive interest once delinquent property owners paid up.

    Property tax lien investing is, in fact, a real and heavily procedural niche. When a property owner fails to pay local taxes, a county or other taxing authority can sell the lien to private investors, who then earn statutory interest or penalties when the taxes are ultimately paid.

    Texas law contains detailed provisions for so-called transferred tax liens, specifying how liens may be assigned, recorded, and enforced. Done properly, the business can be steady, if unspectacular, for specialists who understand the statutes and local practices.

    According to investigators, that veneer of legitimacy was central to the pitch. The complaint alleges that bank records do not support Gilchrist’s representations about buying liens. Instead, he allegedly commingled investor funds with other accounts, used money for personal expenditures, and diverted new deposits to repay earlier participants. Prosecutors characterize the pattern as a classic Ponzi structure: newer funds shoring up older promises, with no real underlying investment engine.

    In total, the affidavit alleges, Gilchrist collected approximately $1.45 million from investors over the nearly three-year period and returned only about $789,000. The remainder is alleged to have been absorbed into a mix of personal spending and circular payments that kept the program running just long enough to secure additional deposits.

    What kept this program out of view for so long is not hard to discern. Private partnerships centered on a niche state-law instrument like Texas tax liens tend to operate far from the retail securities markets that draw the SEC’s routine attention.

    Only when the alleged conduct implicated the federal wire fraud and securities fraud statutes did the full weight of federal oversight come into play. A similar operation, structured to avoid securities status and interstate transfers, might have remained a strictly local problem.

    Forged deeds and borrowed identities

    The alleged misconduct, as described in court filings, did not stop at misrepresentations to investors. Once the SEC opened a formal investigation and requested documentation of the supposed tax lien purchases, Gilchrist allegedly escalated.

    According to the complaint, he provided the SEC with a series of quitclaim deeds purporting to show transfers of lien-related interests. On closer review, investigators concluded the deeds were forgeries.

    The documents, prosecutors allege, contained notary stamps and signatures belonging to real Texas notaries who had never met Gilchrist and had not notarized the transactions in question. By attaching genuine credentials to fabricated instruments, the filings suggest, Gilchrist allegedly attempted to backfill a paper trail of tax lien activity that did not exist.

    Those acts underpin the aggravated identity theft charge, which requires that a defendant knowingly use another person’s identification without lawful authority in connection with certain predicate crimes.

    The invented intermediary

    The woman whose home Gilchrist allegedly visited in Bexar County plays a different role in the narrative. According to the criminal complaint, she became a central figure not because she helped run a tax lien business, but because Gilchrist allegedly tried to cast her as the face of a fictitious one.

    During sworn SEC testimony in April and May 2026, Gilchrist allegedly told investigators he used an undocumented woman in Bexar County as an intermediary to identify delinquent homeowners and deliver cash to them as part of a lien acquisition strategy.

    He allegedly claimed he had redacted homeowner names from documents because, in his telling, the homeowners were in the country without legal status. The implication was that the SEC could not safely contact them, and that their identities were too sensitive to share.

    The complaint paints a different picture. According to prosecutors, the woman exists but was barely acquainted with Gilchrist and had no role in any tax lien transactions. She was, the filings allege, placed at the center of an invented operation that did not occur as described.

    The driveway visit, framed around warnings about the FBI and a suggested multi-year “vacation,” is alleged to have come just days before Gilchrist was due back before the SEC, turning a peripheral acquaintance into an unwitting character in a story he had already told under oath.

    Delay, distraction, and the Mansfield gym

    While regulators were working through bank records and deeds, investors were asking for their money. The complaint alleges that Gilchrist responded with an evolving series of explanations for why redemptions were delayed or payments had to be rolled over.

    Among the reasons prosecutors say he offered: the federal government was shut down, stalling necessary approvals; local authorities were tied up in an arson investigation affecting properties connected to the liens; he had been deployed to assist with hurricane relief. Each explanation, if taken at face value, suggested that external forces, like Washington politics, criminal probes, and natural disasters, were temporarily blocking distribution of otherwise sound investment proceeds.

    In one episode highlighted by investigators, Gilchrist allegedly told an investor he was hospitalized in Tennessee recovering from a colectomy. Hospitalization, especially out of state, is a powerful signal that repayment delays are unavoidable and, at least temporarily, excusable.

    Yet according to the complaint, during the period he claimed to be recovering in Tennessee, access records showed him checking into a gym in Mansfield, Texas, close to his home base in the Dallas-Fort Worth area. The alleged disconnect between his claimed incapacitation and his actual whereabouts became one more data point in a pattern of shifting stories and eroding credibility.

    The Novinger link and a repeat appearance

    Gilchrist is not the only name in the government’s paperwork. In a parallel civil action, the SEC’s Chicago Regional Office has filed a complaint charging Gilchrist with securities fraud. That civil case also references Christopher Novinger, a figure already familiar to regulators.

    In 2015, the SEC filed a civil complaint, summarized in Litigation Release No. 23256, alleging that Novinger and related parties sold approximately $4.3 million in interests in life-settlement contracts to 26 investors while making material misrepresentations.

    The program was promoted on what was billed as a financial radio show, the “Retirement Experts Radio Show,” which the SEC alleged functioned less as neutral advice and more as a marketing platform for the offerings. In 2016, through Release No. 34-78213, the Commission imposed a bar order prohibiting Novinger from associating with broker-dealers or investment advisers.

    That bar remained in place when the SEC filed its new civil complaint involving Gilchrist. According to coverage by InvestmentNews on September 1, 2026, the SEC now alleges that Novinger, despite the prior sanction, was steering clients into Gilchrist’s tax lien program. The details of that alleged pipeline are still emerging, but the mere fact that a previously barred financial promoter appears again in a fresh enforcement action underscores longstanding concerns about how effectively sanctions are monitored and enforced in fragmented markets.

    The SEC Office of Inspector General is investigating the criminal matter alongside federal prosecutors, with substantial assistance from the U.S. Marshals Service, according to government statements. Assistant U.S. Attorneys Alexander Schwab and Douglas Brasher of the Fraud Section are leading the prosecution, signaling that the case is being treated as more than a routine regional fraud referral.

    The gap around the edges

    The Gilchrist case, as laid out in the criminal and civil complaints, is not the largest alleged Ponzi operation in recent memory, nor the most complex. What makes it notable is where it sat: at the intersection of a lightly supervised state-law investment niche, informal referral networks, and federal enforcement regimes that tend to activate only after enough red flags accumulate in one place.

    The alleged scheme ran from at least April 2023 to January 2026, a span of nearly three years in which paperwork, bank wires, and individual complaints were all, in theory, available to someone with the authority to scrutinize them.

    Federal involvement here required wire fraud charges and the invocation of securities laws that treat certain pooled investments as securities even when they are nominally tied to local tax instruments. The question, for regulators and lawmakers, is less why the SEC and Department of Justice eventually acted, and more what kinds of signals could have triggered earlier, narrower interventions.

    When barred promoters allegedly reappear as referral sources, when private tax lien partnerships scale into the millions, or when a solo practitioner suddenly claims to be running a multi-county lien portfolio, those data points can be captured long before a driveway conversation turns into an obstruction allegation.

    For now, the case moves through the courts. A criminal complaint is only an allegation; it is not evidence, and it is not a conviction. All defendants, including Gilchrist and any individuals named in related filings, are presumed innocent unless and until the government proves its accusations beyond a reasonable doubt in a court of law.

    The filings in United States v. Gilchrist and the related SEC actions nonetheless outline a familiar pattern around the edges of the regulatory state, where niche products, personal trust, and delayed scrutiny can combine to give alleged schemes a long runway before anyone in authority is prepared, or positioned, to pull them back to earth.

    Fediverse Reactions

  • Thirty-Eight Fakes: How Fraudsters Turned the SEC’s Own Filing System Into a Trust Machine

    When a Disclosure Looks Like a License

    On the Securities and Exchange Commission’s own public database, the profile page looks reassuringly official. There is an SEC file number. A Form ADV reference. An austere masthead that reads “Exempt Reporting Adviser.” To a retail investor searching the Investment Adviser Public Disclosure system, that badge can look like a license to trust.

    According to a sweeping set of civil complaints the SEC filed in late August, it has also become something else: a cheap, reusable prop for fraud.

    The mechanism is deceptively simple. The Exempt Reporting Adviser, or ERA, category was created so that certain private fund advisers could file limited disclosures without undergoing the intensive scrutiny of full SEC registration. Yet on the Investment Adviser Public Disclosure (IAPD) database, those filings sit in the same public directory as fully registered advisers.

    The SEC itself alleges that dozens of purported firms exploited that proximity, pointing potential victims to their ERA pages as if they were evidence of government approval that the system was never designed to provide.

    The Exemption That Wasn’t Designed for This

    In regulatory terms, an ERA is a light-touch registrant. Under rules implementing the Dodd-Frank Act of 2010, advisers that manage only private funds and qualify for certain exemptions may file as Exempt Reporting Advisers instead of registering fully.

    The filing is mainly a disclosure exercise: basic ownership information, certain disciplinary histories, high-level data about the funds advised. It is transmitted through the same electronic system as full Form ADV filings, but it does not trigger the same examination regime or substantive vetting by the SEC.

    What it does not confer is any seal of approval. An ERA is not a registered investment adviser. The SEC does not review or endorse individual ERA business models before they appear on the IAPD database. According to the SEC’s own investor education materials, the category exists to reduce compliance burdens for advisers that serve sophisticated investors, not to create another credential for mass-market consumption.

    Thirty-Eight Complaints, One Playbook

    Yet the line between “disclosure” and “endorsement” can blur on a government-branded web portal. On August 27, 2026, the SEC announced that it had filed 38 simultaneous civil complaints in the U.S. District Court for the District of Colorado alleging that purported advisers and trading platforms around the world used ERA filings and related SEC references as marketing tools for unregistered, and in many instances fictitious, investment schemes.

    The actions, summarized in SEC Release No. 2026-78 and Litigation Release No. 26622, represent one of the most concentrated attempts yet to police the boundary between disclosure regime and perceived imprimatur.

    According to the complaints, the pattern recurs with minor variations. Entities would obtain or reference an ERA filing, claim a Colorado business address, and publish contact information that led nowhere. Phone numbers allegedly rang to disconnected lines. Suite numbers mapped to virtual offices or co-working spaces that had never heard of the firms using their addresses. From there, the SEC alleges, the purported advisers pointed investors to SEC file numbers, ERA pages, or fabricated “approval” documents to vouch for their legitimacy.

    Across the 38 cases, the SEC describes a common playbook. Allegedly false Colorado mailing addresses. Websites restyled from one template to another, but reusing the same fund descriptions and performance statistics across entities that were not otherwise connected. Nearly identical language, according to the complaints, touting high-yield crypto, foreign exchange, or “AI-driven” strategies.

    Phantom Auditors and Forged Seals

    Several of the complaints note that internal SEC analytics flagged statistically implausible overlaps in fund data entered into the IARD filing system, prompting closer review by enforcement staff.

    In place of real oversight, the firms allegedly invented it. The complaints cite, among other examples, references to outside auditors with no verifiable existence. One oft-repeated name in the filings, “Indicator Global,” appears in the SEC’s narrative as a kind of phantom gatekeeper, invoked to reassure investors that an independent third party had vetted returns and custody practices. According to the SEC, no such audit firm could be located.

    In other instances, the defendants allegedly displayed ornate “certificates of approval” featuring the SEC’s name or seal, despite the fact that the Commission issues no such certificates for ERAs or for investment advisers more generally.

    The SEC’s complaints also point to the digital exhaust left by the filings themselves. Although the purported firms claimed Colorado addresses, many of the IARD submissions and related account logins allegedly originated from foreign IP addresses scattered across multiple jurisdictions.

    The Commission does not allege that foreign origin is itself improper, but argues that the mismatch between claimed domestic locations and observed access patterns reinforced the picture of a coordinated effort to manufacture a U.S. regulatory footprint from afar.

    The Defendants

    The set of charged entities is sprawling by design. In its Colorado filings, the SEC names Abrdn Canada Limited, Absolutaris Base Limited, Apexium Securities Ltd, Axivon Exchange Ltd, Calystron Capital Ltd, CryptoOrbit Ltd, Equal Chance Capital Ltd, Ftaexchange Ltd, Future Finance Academy Ltd, Gainstra Capital Inc., Glorious Dawn Capital Management Co. Ltd, Harbor Financial Institute Ltd, Helios Wealth Management Ltd, Ideal Finance Ltd, Ironclad Trading Institute LLC, Korzen Asset Management Ltd, LinkedIn Research Institute Ltd, LuxePoint Capital Ltd, Nautical Echo Capital Ltd, NewstarAsset Capital Inc., Nexera Technologies Ltd, Nova Academy of Finance Ltd and Nova Financial Academy Ltd.

    The list continues: Perkea Capital Securities Inc., Pinnacle Crypto Exchange Inc., Pinno Capital Inc., Quantum Financial Institute Ltd, RBH Infinity Exchange Inc., Robin Markets Inc., Rockford Partners, Sapphire Tide Capital Ltd, Stellar Path Institute Ltd, Summit Breeze Haven Exchange Ltd, THEVGPRO Ltd, ThreeM Holding Ltd, Veriton Investment Inc., Web3 University, Wingspan Advisors LLC, and Ichcoin Tech Corp., the company behind the “WealthTutor” platform previously scrutinized in this publication’s separate investigation.

    Each complaint lays out its own factual narrative and alleged misrepresentations, but all are built on the shared theme of regulatory sheen without regulatory substance.

    The Trust Signal as a Weapon

    Those names may or may not be familiar to investors who encountered them on social media, search ads, or cold outreach. What almost all of them shared, according to the SEC, was a reference back to Washington. Marketing materials allegedly steered targets toward ERA listings, Form ADV identifiers, or generic SEC web pages, encouraging them to infer that appearance in the federal database meant their money was entering a supervised environment, part of a broader pattern of frauds moving through referral networks and recycled personas.

    The SEC is now, in effect, arguing that its own public records became part of the fraud script.

    The agency has tried to separate signal from noise. Concurrent with the Colorado filings, the Office of Investor Education and Advocacy released an alert on investor.gov warning that Exempt Reporting Advisers are not subject to the same level of regulatory oversight as registered advisers and that the SEC does not issue “certificates of approval” for any advisory firm. The alert urges investors to read the details of any IAPD entry carefully and to treat ERA status as a disclosure starting point, not an endorsement. That distinction has always been present in the rule text.

    A Design Flaw the Rule Didn’t Account For

    Dodd-Frank directed the SEC to tailor reporting obligations for advisers to certain private funds, based on the premise that sophisticated investors need less regulatory hand-holding. The Commission responded by designing ERA filings as a way to capture systemic risk information without forcing every small or specialized fund adviser into the full registration regime. But while the filing requirements calibrated burden and benefit for industry participants, the effect on unsophisticated investors confronting the IAPD interface received less attention.

    On the front end, the IAPD does exactly what Congress asked: it makes advisory information public. Yet the way it presents that information matters. ERAs appear in the same search results as fully registered advisers, framed by the same SEC branding. The database does contain textual explanations of status differences, but they do not leap off the page. For a hurried user looking for a yes-or-no answer to whether a firm is “in the system,” the difference between “registered investment adviser” and “exempt reporting adviser” is easily lost.

    Regulators are quick to stress that this is a design vulnerability, not a confession that the architecture is broken. The ERA framework has enabled thousands of legitimate advisers to comply with federal law in a proportionate way. Most ERAs do not show up in enforcement releases.

    The 38 cases in Colorado, if the allegations are borne out in court, would instead illustrate how a small subset of actors can weaponize a disclosure mechanism when user-interface design assumes sophistication that the audience does not actually possess.

    This publication previously reported in depth on Ichcoin Tech Corp. and its “WealthTutor” platform, one of the entities now named among the 38. In that case, as in the broader set of complaints, the alleged pattern is familiar: a thin factual connection to U.S. jurisdiction, a heavy rhetorical reliance on SEC file numbers and logos, and a target audience for whom those references substituted for more traditional due diligence. The new filings extend that pattern from one platform to a network of ostensibly separate brands.

    What Comes Next

    For now, the Colorado cases are at an early stage. The SEC is seeking permanent injunctions to bar future violations of the securities laws, conduct-based restrictions that would limit how the defendants could participate in the securities markets if they remain in them at all, and civil penalties intended to deter similar conduct by others. The complaints do not themselves determine liability, and all defendants are presumed innocent unless and until a court finds otherwise.

    The institutional question is what happens next to the machinery these firms allegedly misused. The SEC has now put in writing that Exempt Reporting Adviser filings and the IAPD interface can be co-opted as confidence devices.

    Having made that acknowledgement in court papers and investor alerts, the Commission owns the next move. It can redesign the architecture so that ERAs and registered advisers are visually and functionally distinct to unsophisticated users, or it can leave the interface largely as is and rely on case-by-case enforcement to police its perimeter.

    The 38 Colorado complaints draw a line in the sand. Whether that number stays exceptional, or becomes an early chapter in a larger series of exploitations, will depend in no small part on how the SEC treats the trust signals it has created.

    Fediverse Reactions

  • Paying for Nothing: How the VA Spent $11.2 Million on Services Never Delivered

    Paying for Nothing: How the VA Spent $11.2 Million on Services Never Delivered

    A Bureaucracy Times Analysis

    The Department of Veterans Affairs paid roughly $11.2 million for a Veterans Crisis Line backup center that never meaningfully answered a call. For nearly a year, taxpayer money went to a ghost operation that was supposed to catch overflow and emergencies for the nation’s 24/7 lifeline for veterans in suicidal crisis—but it never legally came online, never handled real traffic, and never delivered the backup protection the contract promised.

    The payments continued despite officials knowing—as early as November 2022—that the contractor couldn’t legally deliver the service. The backup call center sat understaffed, unable to meet security requirements, incapable of handling calls. Yet invoices kept coming. Checks kept clearing. Nobody stopped it until June 2023.

    This is not a case of good intentions gone wrong, or an unavoidable technical failure. It’s a story of institutional dysfunction, blurred accountability, and a bureaucratic apparatus so fractured that nobody felt personally responsible for stopping money from flowing to a ghost operation.

    The Setup: Why Backup Systems Matter

    The Veterans Crisis Line has answered over 5 million contacts since its 2007 launch. With a suicide rate among veterans nearly double the general population—35 deaths per 100,000 veterans according to VA’s own data—the service exists because it works. Trained responders recognize the specific trauma signatures of military experience. They know how to talk someone down from immediate harm.

    In 2022, the VCL added a new routing mechanism: the 988 hotline (national suicide prevention line) followed by the “press 1” option for veterans. This integration meant calls flowed through a contractor’s routing system before reaching VA responders. That contractor was also supposed to provide backup capacity—10 percent of call volume normally, but 100 percent in emergencies.

    Ten percent of normal traffic meant handling calls when the VCL’s main system went down for maintenance, during a cyberattack, or in the event of disaster. For a line that fielded 600 responders on average per month, this meant the contractor needed to maintain roughly 60 dedicated backup staff.

    On paper, the VA had it covered. A $32.5 million contract, awarded in April 2019, was supposed to last five years. The backup responder portion—$20.5 million of that total—went to a subcontractor brought in by the prime contractor. The service was supposed to be seamless, invisible unless needed, but absolutely reliable if crisis struck.

    It was none of those things.

    The Misaligned Checklist

    Start with the fundamental error: a security compliance failure buried in bureaucratic procedure.

    When the VA’s acquisition team put together the 2019 contract, they filled out a security checklist. This document, required by VA Handbook 6500.6, is supposed to identify what sensitive information the contractor will handle and what security protections are required. The 2019 checklist concluded: no Authority to Operate (ATO) needed. The contractor wouldn’t be storing sensitive veteran data, the team reasoned, so standard commercial security would suffice.

    This was wrong.

    The performance work statement—the contract’s actual requirements—mandated that the contractor transmit call documentation within 30 minutes of each call and provide call recordings to VA within 24 hours upon request. The contract explicitly stated: “call recordings will be kept according to VA policy; 100% recording and 100% retention.”

    Call recordings of veterans in crisis contain deeply sensitive information: suicidal ideation, trauma histories, medical conditions, personal identifying information. This is exactly the kind of data requiring Authority to Operate certification.

    The VA even had a reference point. When checking the previous 2017 contract—for nearly identical services—the 2019 acquisition team could have seen that ATO was required for the same work. But that discrepancy wasn’t caught. Nobody at VA compared the two. Nobody asked the information security officer why the exact same service changed from “requires ATO” to “doesn’t require ATO.”

    The information security officer would later tell OIG investigators that the understanding was the contractor wouldn’t store VA data. But the contract explicitly required it. When asked about the disconnect, neither the security officer nor the contracting officer could adequately explain the discrepancy.

    As the OIG report notes: “The information security officer and the COR who signed the 2019 checklist could not fully explain the discrepancy for the same service requiring an authority to operate for the 2017 contract but not requiring one for the 2019 contract.”

    This is how $11.2 million starts getting wasted: through a failure in the most basic institutional check—comparing your contract to the last contract for the same work.

    The Subcontractor Switch

    For three years, the system limped forward under the original subcontractor. Then, in April 2022, that subcontractor announced it was getting out of the business. Termination was set for July 15, 2022—the day before the VA was implementing “988 press 1” hotline routing through this same contractor.

    Within a week, VA leadership scrambled to create an internal backup system. But it would take months to get operational, and even longer to fully functional. So they needed the contractor—with his new subcontractor—to maintain backup capacity in the interim.

    The new subcontractor came on July 15, 2022, with an aggressive staffing plan provided to VA’s Contracting Officer’s Representative (COR):

    • 50 staff by October 2022 (2.5 months in)
    • 92 fully staffed responders by November 2022 (3.5 months in)

    The COR rated this plan “acceptable” and signed off on it.

    By August 2022, just weeks into the new subcontract, the new subcontractor revealed its technology plan: it wanted to use a cloud-based system for document sharing.

    This triggered an information security review. And that’s when VA’s sloppiness caught up with them.

    By the end of August 2022, the information security officer told the COR and VCL officials: if the contractor was processing, storing, or transmitting VA data using cloud services, it would need FedRAMP certification and an Authority to Operate. The proposed system didn’t have it.

    September 2022: The COR confirmed the contractor couldn’t use the proposed system because it lacked FedRAMP compliance.

    October 2022: The VCL’s deputy director of technology circulated an issue brief. It would take 12 to 18 months for the contractor to achieve compliance.

    Twelve to eighteen months. Let that sink in. VA officials had just learned they’d contracted for a year-and-a-half of security remediation—during which the contractor couldn’t legally handle veteran calls—and didn’t immediately stop the bleeding.

    The Meeting Where Everyone Knew

    November 2, 2022. This is the date that matters most.

    VCL officials, the COR, the contracting officer, and the acquisition services division chief all sat down to discuss the unfolding disaster. The meeting notes are blunt:

    “Contractor could not provide backup responder services without an Authority to Operate.”

    “It would be at least one to two years before services would be provided.”

    The acquisition services division chief—essentially the boss of the contracting operation—suggested options. The contract could be modified (which would require renegotiating price). A 60-day stop-work order could be issued to buy time to figure this out. Or the whole service could be terminated.

    The contracting officer’s response: “The contractor must be given a chance to become compliant and had to be paid.”

    This is the pivot point where negligence becomes something more deliberate. Everyone in that room understood:

    1. The service wasn’t being provided
    2. The contractor wasn’t compliant with federal security law
    3. The contractor couldn’t become compliant for at least a year
    4. Yet the contractor had to keep getting paid

    The meeting notes even included a section explicitly labeled “paying for services not received”—the COR later told OIG investigators that VCL leaders had expressed concerns about this issue to the contracting officer.

    Eight days later, on November 10, the parties met again. Same conclusion: the contractor would need 9 to 18 months for compliance. Still, the contracting officer didn’t issue a stop-work order. Didn’t renegotiate. Didn’t terminate.

    Why? The contracting officer told OIG investigators he was waiting for VCL officials’ direction.

    The VCL deputy executive director told OIG investigators VCL needed the backup system while building their internal option.

    So who made the decision? Nobody. That’s the answer. It fell into a bureaucratic void.

    The Invoice Trap

    Meanwhile, invoices were flowing in. Every month, the contractor—or its subcontractor—submitted payment requests for call responder backup services. The COR, whose job was to verify that services were actually delivered before authorizing payment, kept approving them.

    The data tells the real story.

    Call routing logs show: zero calls transferred to the backup center from mid-July 2022 through June 2023. Two calls in August 2022 that probably weren’t even answered based on call duration. Then nothing. Complete silence. A year of radio silence, during which VA paid $11.2 million for staffing that didn’t exist and calls that were never handled.

    Yet in March 2023—nine months into this black hole—the VCL management analyst emailed the VCL executive director asking to exercise the next contract option year for the backup center. Same day, the executive director approved it. The COR issued an evaluation saying the contractor’s performance was “satisfactory.” The contracting officer issued the modification to continue the contract.

    This is the trap: federal contracting law doesn’t punish you for overpaying for nothing. A firm-fixed-price contract means the contractor bears financial risk—but it also means the contractor gets paid regardless, as long as they keep billing. And unless someone explicitly stops payment, the machine keeps grinding.

    The COR later explained to OIG investigators that he approved invoices based on the contracting officer’s advice that payments were justified because the contractor was “making progress during the implementation phase and working toward an approval.” Translation: he approved payment for work not done because someone else told him it was okay.

    But VA’s acquisition manual explicitly states: “the COR should not recommend invoice payment solely on the recommendation of another government employee.”

    It happened anyway. Month after month, January through May 2023, invoices were approved based on one official deferring to another official’s judgment, with nobody actually verifying the work was done.

    The irony is caustic: the COR’s job was to protect the government’s interests. Instead, he abdicated that responsibility to someone else.

    Why Nobody Stopped It

    Three factors created this mess:

    First: Unclear authority and responsibility. The contracting officer believed VCL leadership needed to decide about the backup services. VCL leadership believed they needed contracting guidance. Nobody wanted to own the decision, so nobody made it. For seven months, the system defaulted to “keep paying.”

    Second: Weak documentation and communication. When a VCL official apparently told the contractor not to take calls (without official authorization), the contracting officer found out later and was confused about who said it and when. At a critical moment, nobody had written proof of the problem, so the contracting officer could demand written direction before acting. But this created a catch-22: VCL couldn’t be expected to formalize a problem the contracting officer wasn’t formally acknowledging.

    Third: The acquisition manual’s weak enforcement. The regulation says CORs shouldn’t rely on other officials’ advice. But there’s no secondary review, no checkpoint, no audit until months later. A COR can violate the manual by just deferring to the contracting officer, and nobody catches it until an OIG audit.

    The acquisition services division chief told OIG investigators that “there was no evidence in the contract file that indicated the contractor did not provide call answering services” and that “VCL officials did not provide a formal written notification stating that services were not being provided.”

    This is the heart of bureaucratic dysfunction. Nobody takes action without formal documentation. But the system that’s supposed to generate that documentation is the same system that’s failing. It’s circular: you can’t stop payment without formal notice, but nobody issues formal notice because nobody owns the decision.

    The Termination and Settlement

    Finally, in May 2023—a year after the disaster began—the VCL deputy executive director notified the COR: terminate the backup responder services. The COR relayed this to the contracting officer. The contracting officer issued the termination in June.

    Total damage: $11.2 million in payments for undelivered services. Plus $677,575 in settlement costs to unwind the contract.

    The OIG excluded the settlement costs from its “questioned costs” calculation—the official figure for waste. So the number that gets reported to Congress, the number that matters for oversight, is $11.2 million.

    But the real number is $11.9 million.

    Systemic Red Flags

    The OIG’s recommendations are measured but pointed:

    1. Have the Office of General Counsel determine whether to recoup the $11.2 million under the Contract Disputes Act.
    2. Implement policies to ensure information security requirements are accurately determined before contract award.

    VA’s response was equally measured. They concurred with #1 and said they’d check with General Counsel by year-end 2026. On #2, they concurred “in principle” and said they’d already addressed the issue with the acquisition team. No systemic breakdown, they implied. Just an isolated error.

    But the OIG identified two structural failures:

    Control environment failure: “VA officials did not take timely action to prevent paying for services not received.”

    Monitoring failure: “VA officials did not take timely action to modify the contract or terminate the call responder backup services.”

    These aren’t compliance errors. These are institutional willingness to let money flow to a failed program.

    The Missing Annual Assessment

    Buried in the report is another missed opportunity. VA Handbook 6500.6 requires contractors handling sensitive information to conduct annual security self-assessments. The 2019 contract included this requirement.

    The OIG found no evidence this assessment was ever conducted. The information security officer hadn’t seen it and thought it was no longer required.

    This should have been the circuit-breaker. The first annual assessment after the July 2022 subcontractor change would have immediately identified that an Authority to Operate was needed. The assessment would have forced the acquisition team to confront the noncompliance in real time, in formal documentation.

    Instead, the assessment was skipped. Another checkpoint failed. Another opportunity to catch the problem before $11.2 million was committed.

    The Veterans Crisis Line Context

    What makes this particularly damaging is that this happened to the Veterans Crisis Line—the service literally designed to prevent veteran suicide. The OIG estimated veteran suicide rate at 35 deaths per 100,000 veterans, nearly double the general population rate.

    The VCL answered over 5 million contacts since inception. It works. It saves lives. That’s why backup capacity matters. It’s not a theoretical nice-to-have; it’s insurance against the system that saves lives failing at a moment when someone’s in acute crisis.

    And $11.2 million—the amount wasted on a non-functional backup—represents federal resources that should have been flowing to actual crisis services, training, prevention, follow-up care.

    Waste at this scale, in a program this critical, isn’t just a budgeting problem. It’s a failure of stewardship toward the people the VA is supposed to serve.

    The Reorganization Unknown

    As of June 2026, the VA was still in the middle of a reorganization that consolidated contracting specialists under the Office of Acquisition, Logistics, and Construction. The OIG report notes: “The effects of these changes on the issues identified in this report are not yet known.”

    This is the unsaid part of the story. If restructuring doesn’t actually fix these problems, if acquisition staff just get moved around without changing procedures or accountability, then the next $11.2 million waste is probably already in the pipeline.

    The question isn’t whether the VA has policies that should work. They do. VA Handbook 6500.6, VA Directive 6500, the Federal Acquisition Regulation—these documents contain the requirements to prevent exactly this scenario.

    The question is whether the VA has the institutional discipline to enforce them.

    Open Questions for Further Investigation

    • Will General Counsel actually pursue recoupment? The OIG’s recommendation was for Office of General Counsel to determine if VA should recover the funds. VA said they’d report by December 31, 2026. Has that happened? What did they conclude?
    • Is this common? How many other VA contracts have similar compliance gaps? The OIG report treats this as an isolated incident, but the conditions that created it—weak security checklist review, missing annual assessments, unclear authority—are systemic.

    Conclusion: The Cost of Deferred Decisions

    This wasn’t a case of fraud or deliberate theft. Nobody was running a scam. The contractor presumably believed it could eventually become compliant. VA officials presumably believed paying during the compliance period was reasonable, especially if they thought the money might ultimately be clawed back under the Contract Disputes Act.

    But that reasoning collapses once you have a conference room full of people explicitly discussing “paying for services not received” and still choosing to let invoices through. The VA had tools to stop it. The contracting officer could have issued a stop-work order. The COR could have refused to approve invoices. VCL leadership could have formally declared the contractor noncompliant. Any of these actions would have prevented most of the $11.2 million in waste.

    None happened. Instead, each official deferred the decision to someone else. The contracting officer waited for VCL guidance. The COR approved invoices based on the contracting officer’s advice. VCL waited for the contracting officer to act. This is how $11.2 million disappears in a federal bureaucracy: not through malice, but through diffused responsibility. When everyone’s supposed to be in charge, nobody is.

    The open question now is whether that responsibility will ever be reassembled. VA has told the OIG it will decide by December 31, 2026 whether to seek recoupment of the $11.2 million. That decision point is more than an accounting exercise. It is a live test of whether the department is willing to say, in writing and with consequences, that paying for nothing is unacceptable even when the system has already moved on.

    Meanwhile, the underlying tradeoff doesn’t change. Veterans’ resources remain finite. Every million dollars wasted on a defunct contractor backup is a million dollars not available for crisis responder training, community outreach, or the mental health services that support long-term veteran wellbeing. It also reflects a broader pattern of VA institutional dysfunction documented in our coverage: a staffing crisis the VA counts with an unverified web form, construction projects that tripled in cost while no one operated the oversight machinery, and a psychiatric ward where safety hazards went unresolved for six years. The Veterans Crisis Line will keep taking calls, and the VA’s internal backup will keep running, but the opportunity cost of this failure is already baked into future budgets.

    The VA’s response to the OIG—concurring in principle while framing this as an isolated error—leans heavily on the hope that this is a one-off. The facts of the case suggest something else: a system that chose inaction when action was required, and that only fully acknowledged the problem once the money was gone and the audit was underway.

    That leaves a larger, unresolved question hanging over the Veterans Crisis Line case: is this common? If the same weak controls, missing assessments, and blurred lines of authority exist elsewhere in VA contracting, then this episode is not an anomaly but a preview. Whether General Counsel pursues recoupment will tell us something. Whether the institution prevents the next version of this from happening at all will tell us everything.

    Sources and Documentation

    Fediverse Reactions

  • Forty Reports, Zero Referrals: The LSC Inspector General’s Quiet Six Months

    Forty Reports, Zero Cases

    In the six months that ended March 31, 2026, the Legal Services Corporation Office of Inspector General opened 20 investigative cases, closed 29, and issued 40 investigative reports. That is a brisk clip for a small oversight office.

    The subject matter was not arcane. According to the semiannual report, investigators worked allegations of theft and misuse of funds, impermissible attorneys fees, time and attendance fraud, and travel fraud. These are not abstract compliance categories. They are the sort of allegations that, in other programs, often migrate from administrative files into criminal case management systems.

    The same document then presents the required statistical table of criminal enforcement activity. Persons referred to the Department of Justice for criminal prosecution: zero. Persons referred to state or local prosecuting authorities: zero. Arrests: zero. Indictments: zero. Convictions: zero. Forty reports. Zero referrals.

    The report does not attempt to reconcile those two sets of numbers. It simply prints them on adjacent pages and moves on.

    Small Watchdog, Large Checkbook

    The Inspector General Act of 1978, codified at 5 U.S.C. App., requires every federal Inspector General to send Congress a semiannual report that lists what the office did and what came of it. That includes a line for cases sent to prosecutors and the resulting prosecutions and convictions.

    The Legal Services Corporation Inspector General oversees a nationwide network of legal aid grantees that distribute hundreds of millions of federal dollars each year. Complaints arrive through the hotline. Investigators open cases. Auditors review financial statements and internal controls.

    The outcomes, from recoveries to referrals, are supposed to appear in the semiannual report in a way that lets Congress trace the line from misconduct identified to action taken. In this reporting period, that line stops abruptly at the threshold of criminal enforcement.

    A Busy Season on Paper

    The October 1, 2025 through March 31, 2026 semiannual report, posted on Oversight.gov, describes a reasonably active investigative period by the standards of a small grant oversight shop. The office opened 20 new investigations and closed 29, which signals that it arrived in October with a backlog and worked it down. Investigators issued 40 final reports.

    The report describes investigations into misappropriation of Legal Services Corporation funds, attorneys claiming fees they were not entitled to claim, employees falsifying time records, and staff submitting fraudulent travel expenses. These are the standard vices of a far flung grantee network, but they are also the same broad categories that have generated criminal charges in other grant programs when the facts supported it.

    On the audit side, the office reviewed 21 grantee financial statement audits and conducted 10 quality control reviews of the independent public accounting firms that audit Legal Services Corporation grantees. One marquee product dominates the dollar figures.

    A performance audit of Legal Aid of Nebraska, identified as Report AU 26 01, found $642,782 in questioned costs and produced 28 recommendations. The findings covered weaknesses in timekeeping controls, gaps in procurement documentation, and problems in travel expense management.

    During the period, the Inspector General reported two recovery actions that totaled $164,237. An additional $137,341 in previously unsupported Legal Services Corporation funded expenditures was brought into compliance after the office intervened.

    Two matters were referred back to Legal Services Corporation management, not to prosecutors, involving a combined $39,384 in questioned costs. The office also reported closure of one lingering recommendation from its earlier audit of Legal Services Corporation disaster grants.

    The report also notes that grantees are required under Program Letter 25 3 to report cyber incidents that affect Legal Services Corporation data to the Inspector General hotline. The tables for this period do not identify any cyber related referrals to prosecutors, a detail that becomes conspicuous only after one reads what follows.

    All That Fraud, None of the Handcuffs

    The referral table is where the narrative stumbles. Under the Inspector General Act, semiannual reports must list matters referred to prosecutorial authorities and their outcomes. For this six month window, the Legal Services Corporation Inspector General reports zero persons referred to the Department of Justice, zero persons referred to state or local prosecutors, zero arrests, zero indictments, and zero convictions. No separate line lists cyber related referrals. On its face, none occurred.

    By itself, a zero referral count in a half year is not an indictment of an oversight office. Administrative investigations are not criminal case files. Inspectors General routinely substantiate conduct that supports civil recovery, administrative discipline, or corrective action without ever presenting it to a grand jury. Not every false time sheet earns a criminal charge, and not every misused travel card is worth a prosecutor’s attention. United States Attorneys and state prosecutors have wide latitude to decline marginal or low dollar fraud cases.

    Context cuts in the other direction. The prior reporting period, April 1 through September 30, 2025, shows a more familiar pattern. The semiannual report for that span, also posted on Oversight.gov, lists two referrals to the Department of Justice, one referral to a state authority, and one conviction. The period before that, October 1, 2024 through March 31, 2025, recorded one Justice Department referral, one state referral, one arrest, one indictment, and one conviction, as reflected in the semiannual report for March 2025. The six months from April through September 2024 also posted a zero line in the referral column. The result is a pattern that alternates between modest criminal activity and none at all.

    There are several possible explanations for a zero that coincides with 40 investigative reports about theft, fraud, and fee abuse. The conduct may not have met the intent requirement or dollar thresholds that prosecutors look for. The office may have sent cases for consultation that never ripened into formal referrals. Investigators may have focused their energy on getting money back quickly instead of building criminal packages. Or the facts may be messier in ways the four line summary table does not capture.

    The report itself offers no theory. It simply confirms that, during a period of documented misuse of federal grant funds, no one found themselves the subject of a charging decision.

    Independence Without Impact

    Buried in the statistical tables is another figure that merits attention. Inspectors General are required to report any attempts by the entities they oversee to interfere with their independence. For the October 1, 2025 through March 31, 2026 period, the Legal Services Corporation Inspector General reports the expected entry. Attempts by the establishment to interfere with OIG independence: none. In an ordinary budget year, that would register as harmless boilerplate.

    This was not an ordinary year. The White House budget proposal for fiscal year 2026, set out in the budget appendix, again proposed eliminating the Legal Services Corporation and providing only enough money for what it called an orderly closeout. Congressional appropriators were openly debating whether to cut the agency roughly in half or to shut it down outright. Our coverage of the LSC’s FY2025 audit — conducted while the administration was trying to eliminate the agency — is here: The Auditors Said Fine. The Administration Said Gone. Congress Said Neither.

    Inside that context, the Inspector General opened cases, closed cases, issued reports, recovered $164,237, brought another $137,341 into compliance, and sent zero subjects to prosecutors, all without documented interference from an agency leadership fighting for institutional survival. That is what formal independence looks like on paper.

    Whether it produced the level of deterrence Congress thought it was buying is a harder question.

    An Awkward Number to Explain

    The Legal Services Corporation Inspector General spent six months doing what inspectors general say they do. The office investigated complaints. It audited grantees. It pressed for better controls. It recovered money. It issued 40 written products that describe theft, fraud, fee abuse, and other familiar forms of grant misbehavior.

    Then it reported zero criminal referrals, which could mean the facts did not justify criminal charges, or that prosecutors declined to invest scarce resources, or that something else happened in the space between the field work and the charging decision. The public record does not clarify that gap.

    What the semiannual report does say is simple. Forty investigative reports were issued. Twenty nine cases were closed. Two recoveries were made. No subjects were referred to the Justice Department. No subjects were referred to state or local prosecutors. No arrests, indictments, or convictions resulted from the period’s work.

    That zero sits at the end of a table that otherwise conveys a portrait of an office in motion. In oversight circles, an unexplained zero rarely feels like the most reassuring number in the room.

    For more on the limits of federal oversight, see The Inspectors General Say They Returned $17 for Every $1 Spent — our examination of what the federal IG community’s headline $65.6 billion return figure actually contains — and Five Billion Dollars for the Bureau of Prisons, and a Watchdog on a Diet, on Congress assigning a new $5 billion oversight mandate to a watchdog whose budget didn’t move.

    Fediverse Reactions

  • The Auditors Said Fine. The Administration Said Gone. Congress Said Neither.

    The line item the White House tried to erase

    The Trump administrations fiscal year 2026 budget request did not nibble at the Legal Services Corporation. It tried to erase it.

    In the budget appendix, the White House proposed to eliminate the Legal Services Corporation (LSC) outright and set aside 21 million dollars for what it called an “orderly closeout.” A fifty year old grant maker that underwrites civil legal aid for low income Americans would receive enough money to shut itself down. LSC had requested 2.132 billion dollars. The administration answered with 21 million and a farewell.

    That fight moved quickly from tables to press releases. The LSC warned, in a blunt statement, that the plan would end federal funding for civil legal aid for millions of low income Americans. Advocates mobilized. Appropriators counted votes. And into this argument walked CliftonLarsonAllen LLP, the outside firm hired by LSCs Office of Inspector General to audit the corporations fiscal year 2025 financial statements.

    On June 9, 2026, CLA issued its Independent Auditors Report. The opinion was unmodified. On paper, the books were fine, with one exception that critics of the elimination plan did not rush to cite and supporters did not need to.

    An agency built to move money, not wield power

    The Legal Services Corporation Act of 1974 created LSC as a federally funded nonprofit, not a regulatory agency. It does not prosecute cases, issue rules, or send investigators into courtrooms. It does not litigate on its own behalf. LSC receives federal appropriations and distributes them to a nationwide network of independent legal aid organizations that represent low income clients in civil matters, including housing evictions, domestic violence proceedings, veterans benefits disputes, consumer fraud cases, and immigration problems.

    It has no enforcement stick. Its entire institutional purpose is to move federal dollars from the Treasury to lawyers who handle cases that the private market will not take at a price low income clients can pay. In fiscal year 2025, LSC operated under an appropriation of roughly 560 million dollars. That sum did not buy a new bureaucracy. It bought time from lawyers who otherwise could not afford to keep their doors open for tenants, survivors, and veterans who show up without counsel.

    Elimination on paper, survival in markup

    The administration’s fiscal year 2026 proposal was not a haircut, which the LSC said plainly in its own response. The 21 million dollar line item was described as funding for closeout activities only. No new grants, no ongoing operations, just the administrative costs of winding down a national legal aid infrastructure. On the other side of the ledger sat LSCs 2.132 billion dollar request, which reflected rising demand and inflation, and which assumed continued existence.

    Congress declined to accept the premise that LSC should close its doors. The House Appropriations Committee initially marked the corporation at 300 million dollars, a cut of roughly 46 percent from the prior year enacted level. That figure drew bipartisan pushback from members who know exactly which clinics in their districts would go dark. After negotiations, the House passed 540 million dollars for LSC in a bipartisan vote that explicitly rejected elimination. The Senate Appropriations Committee recommended 566 million dollars. The Senate ultimately approved a 540 million dollar level that matched the House.

    The enacted fiscal year 2026 appropriation overrode the administration’s proposal but did not approach LSCs request. The corporation received 540 million dollars, which is 519 million dollars more than the White House wanted to spend and 1.592 billion dollars less than the agency said it needed.

    The LSC is not dead, but it is not fully funded. It operates in the gap between an administration that has tried to write it out of the budget and a Congress that keeps deciding, in bipartisan votes, that civil legal aid remains a line item worth defending. The audit landed in the middle of that gap.

    A clean opinion with a catch

    The fiscal year 2025 audit, recorded in the OIG release and listed on Oversight.gov, followed the standard script. The LSC Office of Inspector General contracted with CliftonLarsonAllen LLP, a national accounting and advisory firm that markets itself as CLA, to perform the work in accordance with Government Auditing Standards. On June 23, 2026, the OIG transmitted the completed package to LSC leadership, complete with the boilerplate assurance that the auditors were independent in fact and appearance.

    CLA issued three reports. The Independent Auditors Report on the financial statements gave LSC the prize every agency wants to wave at appropriators, an unmodified opinion that the statements present fairly, in all material respects, the corporation’s financial position and results of operations in conformity with U.S. Generally Accepted Accounting Principles (GAAP).

    The Independent Auditors Report on Internal Control over Financial Reporting identified a material weakness.

    The Independent Auditors Report on Compliance and Other Matters reported no instances of noncompliance that had to be disclosed.

    The weakness sits in Note 9 to the financial statements, titled Correction of Prior Period Error. During fiscal year 2025, LSC management identified an error in how the corporation had been classifying investment income earned on funds derived from federal appropriations.

    Historically, that income had been reported as net assets with donor restrictions. After reviewing applicable case law and accounting guidance, management concluded that it should have been reported as net assets without donor restrictions and restated the fiscal year 2024 statements.

    The restatement moved $7,806,766 in beginning net assets and $9,170,582 in investment income between the two columns. Total net assets did not change. Total investment income did not change. This was a classification error, not a missing dollar.

    The material weakness arises because the internal controls that were supposed to prevent or detect that kind of misclassification did not work well enough to catch it in the normal course of business. Management found it, corrected it, and disclosed it. CLA agreed that the correction was appropriate and kept the main opinion unmodified.

    Under Government Auditing Standards, however, a material weakness means there is a reasonable possibility that a material misstatement of the financial statements could occur and not be prevented or detected on a timely basis. For an agency that spends each spring justifying its existence to appropriators, that is not a flattering footnote.

    Weak controls in an agency on the bubble

    The chronology is not subtle. LSC management identified and corrected the classification error in fiscal year 2025. That is the same fiscal year in which the administration proposed to eliminate the corporation and Congress debated whether to cut it by nearly half or by one hundred percent. The audit does not suggest that political pressure caused the error in the prior year. It cannot. This was a financial statement audit, not a culture study.

    What the audit establishes is narrower and more uncomfortable. During a period of sustained institutional threat, LSCs internal controls were not strong enough to catch a prior year classification error without targeted management review. That is what a material weakness means in this context. The auditors found the books corrected. They also found that they should not have needed correcting in the first place. The Office of Inspector General put both facts in the same public document instead of letting the clean opinion swallow the control finding.

    The report does not wade into the reasons. Government Auditing Standards do not ask auditors to diagnose whether vacancies, frozen systems projects, or repeated elimination threats erode financial oversight. The letters stick to what is provable. The controls did not prevent or detect the error in a timely way. Management remediated the numbers. The underlying control environment will improve or it will not. That choice will show up in next years report.

    Neat books, messy politics

    The Legal Services Corporation passed its fiscal year 2025 audit. After a correction, CliftonLarsonAllen said the financial statements fairly present reality. The administration still wants the agency off the federal books. Congress funded it at 540 million dollars, which is 519 million dollars more than the White House proposed and 1.592 billion dollars less than LSC requested. The material weakness in internal control will be remediated or it will recur and trigger another finding next year.

    The fiscal year 2027 appropriations cycle will almost certainly open with another proposal to eliminate LSC, packaged in new budget language but familiar in substance. CLA or a peer firm will return. The OIG will issue another transmittal memo. Unmodified opinions and control findings will continue to travel together in thick PDFs that only specialists read.

    Elsewhere in the system, far from the footnotes and the markup tables, actual lawyers will or will not walk into housing court, family court, and veterans benefits hearings beside clients who have nowhere else to turn. If the zeros finally win, the missing lawyers will explain more than any audit ever could. For now, the audit is fine. The rest is politics. Those are not the same thing.

    For related coverage on the limits of federal oversight, see Forty Reports, Zero Referrals — on the LSC OIG’s six-month period that produced 40 investigative reports on theft and fraud and zero criminal referrals — and The Inspectors General Say They Returned $17 for Every $1 Spent, our examination of what the federal IG community’s headline return-on-investment figure actually measures.

    Fediverse Reactions

  • Hundreds of Separated CBP Contractors Still Have System Access, OIG Audit Finds

    A contractor leaves U.S. Customs and Border Protection with a password and access to a database full of biometric information, border patrol reports, and personally identifiable information. Because of a systemic process failure, that contractor can still log in months later. And CBP didn’t catch it — a federal audit did.

    Fifteen percent of contractors who separated from CBP retained active access to the agency’s computer systems after leaving, according to a Department of Homeland Security Office of Inspector General audit released September 4, 2026. Among federal employees who transferred to new positions within CBP, 17 percent kept access they no longer needed.

    The most alarming finding: 86 percent of the transferred employees with unneeded access came from CBP’s most sensitive offices — the Office of Intelligence, U.S. Border Patrol, Office of Field Operations, and Office of Air and Marine Operations — meaning they retained access to systems containing “highly sensitive systems containing national security and personally identifiable information.”

    The audit, titled “CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information” (OIG-26-28), reveals a cascading failure in CBP’s account management process where supervisors and contracting officers fail to properly document separations and transfers, leaving hundreds of people with passwords to systems they should no longer be able to access.

    This is one of three pieces covering the same OIG audit. The other two examine a seven-year-old privileged account vulnerability that gave all 76,000 CBP network users administrative access, and a 2023 security directive that went unenforced for three years because no compliance mechanism was ever built.

    How the System is Supposed to Work

    CBP’s established process for account disablement after an employee or contractor leaves is straightforward: A supervisor or contracting officer should create a separation notification record in the Employee Separation System or Contractor Tracking System once they’re aware of the separation. That system then automatically notifies CBP’s centralized Access Management System (AMS), which disables the account on the separation effective date.

    DHS policy requires accounts be disabled within 3 days of separation.

    For transferred employees, the process is similar. The departing supervisor creates a transfer record, and the AMS automatically removes the employee’s old system access on the transfer date, while preserving access needed for their new position.

    On paper, it works. In practice, it collapses under the weight of CBP’s size and bureaucratic friction.

    Where the Process Breaks Down

    The audit examined separations and transfers that occurred in fiscal years 2023 and 2024. The findings show systematic non-compliance at nearly every step.

    For separated employees: Supervisors didn’t create separation notifications in a timely manner. The OIG sampled 365 employees who separated in FY 2023-2024 and found 72 (20 percent) had accounts that were not disabled promptly after they left. Among contractors, the problem was worse: 1,208 of 8,013 identified contractors (15 percent) had accounts not disabled in a timely manner.

    For separated contractors specifically: The data reveals a stunning breakdown. Of 1,208 contractor separations, 623 (52 percent) had separation records created more than 30 days after the contractor had already left CBP.

    Think about that timeline: A contractor walks out the door on day one. The supervisor doesn’t create a separation record. Days pass. Weeks pass. Thirty days later — well after the contractor should have been disabled — the separation record finally gets created. In the intervening month, that person could have been accessing databases from anywhere in the world.

    For transferred employees: Of 3,697 identified employee transfers, 615 (17 percent) retained unneeded access after moving to new positions. When supervisors entered transfer records late — after the employee had already transferred — the AMS didn’t automatically remove the old system access. The employees retained unnecessary access, likely without supervisor awareness.

    The OIG report notes that CBP configured its systems to remove existing access on the transfer date but not after. Why? To avoid inadvertently removing any newly granted access needed for the transferred employee’s new position. The result: Employees who transfer keep their old access indefinitely.

    Why CBP’s Backup Plan Doesn’t Work

    When the primary process failed, CBP relied on “backup controls” to eventually catch the problem: account inactivity. If an account wasn’t used for a certain period, the system would eventually disable it.

    This is not adequate. The DHS requirement is 3 days. Account inactivity can take weeks or months.

    “Although these backup controls helped reduce the risk of separated personnel retaining unnecessary access, they did not allow CBP to disable the accounts within 3 days of an employee’s separation, as required,” the OIG found.

    CBP also relied on data from the National Finance Center to identify separated employees. This creates a lag — payroll data isn’t real-time — meaning accounts could remain active longer than policy allows.

    The National Security Angle

    Of the 615 transferred employees who retained unneeded access, 531 (86 percent) came from CBP’s most sensitive offices.

    The significance of this cannot be overstated. These are not administrative workers losing access to email or shared drives. These are personnel from the Office of Intelligence, Border Patrol, Office of Field Operations, and Office of Air and Marine Operations retaining access to systems with “national security and personally identifiable information.”

    Transferred employees with access to information without a need-to-know and legitimate business purpose weaken operational security and integrity of the programs and systems, the OIG noted. Such access “could result in using the access for improper purposes.”

    This raises personnel security questions: Is CBP conducting counterintelligence reviews to determine why someone transferred and whether they retained access? Are there cases where an employee transferred after disciplinary action or under suspicious circumstances and retained sensitive access?

    The OIG audit doesn’t address this question. It’s one worth investigating further.

    The June 2025 Breach Question

    In June 2025, multiple DHS components, including CBP, experienced a cybersecurity incident that allowed hackers to steal CBP employee data. The OIG report mentions this incident as context for why CBP needs strong access controls — attackers regularly target CBP systems.

    The audit does not state whether the June 2025 breach involved separated or transferred personnel accounts. But given that CBP had hundreds of accounts that should have been disabled but weren’t, it’s a logical question: Did hackers use a former contractor’s credentials to gain access?

    Bureaucracy Times submitted that question to CBP. The agency has not responded.

    CBP’s Response and Timeline

    CBP concurred with all 12 OIG recommendations related to this finding. The agency’s planned corrective actions include:

    • Updating supervisor training by August 31, 2026
    • Implementing a new “Submit” tab on separation forms that automatically emails supervisors with reminders and direct links to the Employee Separation System (also by August 31)
    • Issuing formal notification memorandums to contracting officer representatives (by August 31)
    • Developing a process to periodically review contractor separations for compliance (by August 31)
    • Evaluating and formalizing the process for managing access when CBP personnel transfer internally (by August 31)
    • Implementing controls to monitor and review transferred personnel’s access (by August 31)

    All of these were due by August 31, 2026. Whether CBP met those deadlines has not been confirmed. This article will be updated as new information becomes available. But the core problem — that CBP is attempting to manage account security through human process compliance rather than automated enforcement — remains unaddressed.

    The Real Issue: Process, Not Technology

    CBP’s explanation for the failure places blame on “human error and challenges associated with monitoring account access changes over time.” But this framing misses the point.

    The problem isn’t that supervisors are careless. The problem is that CBP built a system that depends on thousands of supervisors remembering to file paperwork within 3 days of separation, across an organization with 67,000 personnel, 4,500 facilities nationwide, and constantly shifting staffing.

    A modern access management system should detect separations from HR records automatically. A supervisor forgetting to file a form shouldn’t be able to delay account disablement. These are solvable technical problems, not inherent human failures.

    Instead, CBP has implemented “backup controls” and relies on account inactivity as a de facto enforcement mechanism. This is reactive security, not proactive security.

    The OIG recommendation to “update supervisor training” may help marginally, but it doesn’t address the structural problem: CBP’s access management process is fundamentally broken at the design level.

    What’s at Stake

    CBP protects America’s borders and manages biometric data on millions of people. The agency processes travel documents, law enforcement information, and intelligence. Contractors working for CBP — software developers, IT managers, security consultants — have access to some of the most sensitive information in the federal government.

    If CBP can’t reliably remove their access when they leave, the agency can’t reliably protect that information.

    The OIG audit found this problem in September 2026. CBP is promising fixes by August 2026. If the timeline holds and the fixes work, accounts should be disabled more reliably going forward.

    But accounts that should have been disabled in 2023 and 2024 — the subject of this audit — remain within CBP’s systems today. CBP has not said whether it has gone back and cleaned up those historical accounts, or what it found when it reviewed the access logs.

    Those are questions worth asking.

    References and Links

    Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — Released September 4, 2026 by the DHS Office of Inspector General

    DHS OIG Homepage: www.oig.dhs.gov

    Relevant DHS Policy (referenced in audit):

    • DHS 4300A: Information Technology System Security Program, Sensitive Systems (v. 13.4, December 2024)
    • NIST SP 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations

    CBP Policy Directives (referenced in audit):

    • CBP Directive 51715-006: Separation and Reassignment Directive for CBP Employees (August 2023)
    • CBP Directive 1210-007B: Tracking of Contractor Employees (August 2023)
    • CBP Identity Credential and Access Management Directive (IPL-2022-05-0253, May 2023)

    Editor’s Notes

    — CBP was contacted for additional details on the June 2025 cybersecurity incident and whether separated/transferred personnel accounts were involved. The agency has not responded as of September 9, 2026.

    — The report notes that “CBP provided timely responses to our requests for information and did not delay or deny access to information we requested” during the audit. This OIG notation is standard language confirming agency cooperation.

    — All 12 recommendations in the audit were concurred with by CBP, meaning the agency agreed with the findings and committed to corrective action.

    Fediverse Reactions

  • The VA Knows How to Help Pregnant Veterans. It Isn’t Doing It Consistently.

    VA Maternity Care Coordination Delivers The Easy Parts And Drops The Rest

    The premise sounds almost elegant. The Veterans Health Administration assigns a dedicated maternity care coordinator to each pregnant veteran. That coordinator is supposed to translate VA coverage into real care. Help schedule prenatal and postpartum visits. Connect veterans to community providers when VA facilities do not offer maternity services. Untangle billing in a system originally built for male patients and acute care, not pregnancy.

    The program exists because VA finally acknowledged what veterans and frontline staff already knew. Pregnancy inside a large, fragmented federal health system is a moment when complexity can hurt people if no one is minding the gaps.

    So the Office of Inspector General pulled fiscal year 2025 data to see how that promise is playing out in practice. The findings follow a familiar VA pattern. The structured, front end tasks are mostly done. The work that happens after delivery, where coordination actually earns its name, is where the program starts to fray.

    Where the Prenatal Numbers Hold Up

    Credit belongs where it is due. The OIG review, Review of VHA Maternity Care Coordination and Women Veterans’ Experience (Report No. 24-00818-208, August 10, 2026), found that VA providers largely met prenatal referral requirements. Seventy seven percent of veterans in the sample made it to a first community prenatal appointment in the first trimester. For a program that routes most maternity care to community providers, that is not a trivial accomplishment. It means the intake forms are completed, the consults are placed, the Community Care Network plumbing is working often enough to get most pregnant veterans into care when it matters most for fetal development and maternal risk assessment. Maternity care coordinators are doing the early paperwork and phone calls that the design demands. Where the rules are clear and the timeline is short, the system behaves.

    That matters for another reason. It establishes that the maternity care coordination program is not a caricature of VA failure. It is a partial success in the early phase of pregnancy. The coordinators exist. The referrals are flowing. The first trimester access metric is something many large private systems would be happy to claim.

    The OIG did not find systemic refusal to engage with pregnant veterans or wholesale breakdown of the front end processes. Instead, it found something both more mundane and more telling. Once the baby is born and the simple checklist items run out, the system loses interest.

    The Postpartum Drop-Off

    The postpartum phase is where the compliance picture deteriorates. The OIG reports that facilities were not yet in compliance with postpartum care coordination requirements, and it does not soften the point. Unlike the prenatal side, the report does not put a tidy percentage on postpartum coordination performance. That in itself is a clue.

    Postpartum coordination is inherently less tidy. It involves multiple follow up contacts, depression and safety screenings, contraception counseling, primary care scheduling, and handoff back into the broader VA system that will manage chronic conditions long after the baby shower balloons have deflated. It is work that stretches over months and cuts across services that still treat maternity as an exception, not a core line of business.

    The billing finding is more concrete and far less flattering. In roughly one in four records reviewed, OIG staff found documentation of billing issues related to maternity care. That is not a stray coding error. It is a pattern. Community care billing has been a persistent weak point across VA programs, and maternity services are no exception.

    In a June 27, 2024 national review of perceived barriers in coordinating maternity care, about 80 percent of maternity care coordinators surveyed told the OIG that billing processes were the top area that needed improvement. Two years and a fresh FY 2025 data pull later, the 2026 maternity coordination review confirms that billing trouble remains baked into the experience for too many pregnant and postpartum veterans.

    The clinical follow through is not much better. The report found that veterans were not consistently completing postpartum primary care visits within three months of delivery. That is not a small administrative miss. Those visits are where postpartum depression screening should happen. Where contraception options are revisited and chronic conditions like hypertension, diabetes, and PTSD are reassessed after pregnancy.

    When those visits fall off the schedule, the whole pitch of maternity care coordination looks thinner. The prenatal phase gets documented and counted. The messy reality of postpartum health, which rarely fits into a neat six week follow up, slides back into the same gaps that prompted VA to create maternity coordinators in the first place.

    A Structural Problem, Not an Isolated One

    None of this occurs in a vacuum. Community care billing problems are endemic across VA programs, not unique to maternity. The VA OIG has spent years documenting slow or failed resolution of community care claims. The postpartum coordination gap fits a broader pattern as well.

    Across service lines, VA has trouble maintaining intensive coordination once the acute episode is over and the veteran is supposed to flow smoothly back into routine care. For women veterans in particular, that handoff occurs inside an institution that is still catching up to its own demographic reality. VA likes to point to its expansion of women veterans clinics and services, and there is real progress there, documented in VA materials and in external reporting. Yet the infrastructure that supports those services, particularly billing and care coordination, often looks like it was bolted on in a hurry.

    In September 2023, VA extended maternity care coordinator availability to one year after delivery, an acknowledgment covered in contemporaneous reporting that postpartum needs do not vanish after the traditional six week check. The FY 2025 coordination review suggests that the requirements attached to that extended availability have not yet caught up with the ambition.

    The policy recognizes a year long postpartum reality. The execution still reaches only some veterans, some of the time. The result is a familiar VA split screen. On one side, a well worded policy statement. On the other, incomplete documentation, missed primary care follow up, and unresolved community care billing that lands in veterans mailboxes.

    Closed Recommendations, Open Questions

    The OIG did not leave its findings in abstract terms. It issued four recommendations to the Under Secretary for Health. All four have been closed as implemented. The recommendations called on VA to review postpartum coordination compliance and fix deficiencies, evaluate how facilities identify and resolve community care billing problems, improve scheduling of postpartum primary care visits, and close documentation gaps in coordination records. On paper, that is a clean result. The department agreed with every recommendation and reported specific corrective actions, which convinced the OIG to close the items.

    Closure, however, is an administrative milestone, not a victory lap. OIG recommendations come off the list when VA shows it has put a policy, process, or training in place, not when veterans lives measurably improve.

    The real test will come in the next review cycle, when inspectors can ask a simpler question. Did postpartum coordination rates rise? Are fewer maternity care records littered with billing disputes? Are more veterans keeping postpartum primary care visits within three months of delivery? Until those numbers move, the existence of closed recommendations mostly proves that VA knows where the problems are.

    The Map Is Not the Territory

    Maternity care is not a side project for a modern veterans health system. The number of women veterans continues to grow, and VA itself has framed maternity care coordination as proof that it can adapt. The department touts its maternity benefits on its own womenshealth.va.gov site. It promotes the Community Care Network as a flexible way to connect veterans to non VA providers when VA cannot provide a service directly.

    The FY 2025 OIG review is a cold measure of how that rhetoric holds up against the record. Early referrals work reasonably well. The harder, quieter labor of postpartum coordination and billing cleanup still falters.

    One in four maternity care records with documented billing issues does not describe a theoretical risk. It describes veterans receiving inaccurate bills or facing potential collections for care that should have been covered. That is not a harmless paperwork glitch. It is a pregnant or postpartum veteran who should be tracking blood pressure or sleep, instead tracking appeal deadlines and resubmitted claims.

    VA created the maternity care coordination program because it understood that unmanaged complexity can do real harm at a vulnerable moment. The OIG has now provided a clear map of where that complexity still wins.

    For more on VA institutional performance, see Paying for Nothing — on how the VA spent $11.2 million on a Veterans Crisis Line backup contractor that never answered a call — and Drug Companies Told the VA What Their Best Customers Pay. Two-Thirds of Them Lied. — on how pharmaceutical pricing disclosures for VA federal supply contracts fare under OIG review.

  • Drug Companies Told the VA What Their Best Customers Pay. Two-Thirds of Them Lied.

    When Veterans Become Test Cases For Drug Pricing Honesty

    The Department of Veterans Affairs runs the largest integrated health care system in the country. It buys enormous volumes of drugs through the VA Federal Supply Schedule, a program that was supposed to solve a simple problem: if manufacturers tell the government what they charge their best commercial customers, the government will not get fleeced.

    The contract paperwork calls this a Commercial Sales Practices disclosure. The theory is that the VA should get a price at least as good as the most favored commercial customer identified in that disclosure, consistent with the pricing rules in 38 U.S.C. § 8126.

    In practice, the VA Office of Inspector General keeps finding problems. In its latest summary of pre-award reviews of pharmaceutical proposals for fiscal year 2025, the OIG reports that 11 of 16 manufacturers submitted proposals with deficiencies in those required disclosures, covering contracts with an estimated value of about $21 billion and 1,043 offered items.1 That is just under 69 percent. You do not need a graduate seminar in procurement policy to understand what that ratio means. You just have to be able to count.

    How The VA Drug Pricing Gate Is Supposed To Work

    The VA National Acquisition Center in Hines, Illinois, runs the pharmaceutical side of the Federal Supply Schedule program under a delegation from the General Services Administration.2 Drug companies that want in on that steady government demand submit proposals that include a Commercial Sales Practices disclosure.

    On paper, it is straightforward. The manufacturer identifies its most favored commercial customer, lists the prices and discounts that customer receives, and explains any deviations from standard commercial pricing that might matter when the VA negotiates its own rates.

    The OIG does not rubber stamp those claims. For selected high value proposals, it conducts what the agency calls a pre-award review. Investigators compare the disclosure against underlying sales data, rebates, and price concessions to see whether the manufacturer described its commercial pricing accurately and completely before the contract is awarded.1

    The point is simple: the VA should not pay more than commercial customers pay for the same drug, especially when Congress has already told manufacturers in statute that prices for the VA and certain other agencies are capped at no more than a fixed percentage of the nonfederal average manufacturer price.

    For fiscal year 2025, the OIG summary covers 16 pharmaceutical proposals with a combined estimated value of about $21 billion, offering 1,043 line items into the Federal Supply Schedule.1 These are not discount contracts for aspirin at the corner store. These are large volume, multi year deals that set the baseline for what the government pays and what manufacturers earn on veterans health care.

    What Fiscal Year 2025 Actually Found

    The headline number is astounding: 11 out of 16 proposals had disclosure deficiencies, as the OIG defines them. That category includes errors, omissions, or inaccuracies in the commercial sales practices data that manufacturers are required by contract to provide truthfully and completely.1

    In seven of those 16 proposals, the OIG went further and made explicit pricing recommendations that helped contracting officers obtain about $24.7 million in savings before the contracts were awarded. That figure is not a theoretical projection, but one that reflects savings that VA contracting staff actually realized after the reviews.

    The names of the manufacturers do not appear in the public record. Individual pre-award reports are sealed because they contain commercially sensitive pricing information that federal law protects from public release.1 So the taxpayers who funded the drugs, and the veterans who will take them, see only the aggregate scorecard. They get the failure rate and the total savings, but not which company left what out of its disclosure, or how hard the government had to push to fix it.

    What that aggregate view does show is a pattern over time. The 2025 summary does not appear in isolation. In fiscal year 2023, the OIG reviewed 17 proposals and recommended approximately $120.6 million in savings for VA contracting officers.3

    In fiscal year 2024, it reviewed 14 proposals and estimated about 54.9 million dollars in potential savings, of which the VA sustained $36.8 million after negotiations.4 The $24.7 million in 2025 is realized savings, not just a recommendation.

    Whether that lower figure reflects cleaner initial proposals, a shift in which proposals the OIG chose to review, or less aggressive follow through by contracting officers is a question the public summary raises by implication and then leaves on the table.

    Why Deficiencies Are The Point, Not A Glitch

    The federal pricing rules for covered drugs exist because of a basic information gap. Drug manufacturers know exactly what they charge their best customers and what quiet concessions they make to close big commercial deals. The government generally does not, unless manufacturers are required to disclose it as a condition of doing business. Under the Veterans Health Care Act and its implementing contracts, that disclosure is not optional etiquette. It is a binding promise.

    Getting it wrong can carry real penalties. If a manufacturer obscures or misstates its commercial pricing, the government can seek price adjustments, refunds, or more severe remedies. In some cases, that pattern of conduct turns into False Claims Act exposure. That is not a hypothetical risk. The Justice Department has used that statute against pharmaceutical companies that overcharged the VA by failing to live up to their pricing obligations.

    Sanofi Pasteur, for example, agreed to pay $19.8 million to resolve allegations that it overcharged the department for certain vaccines by misreporting its pricing under the relevant federal program.5

    The OIG pre-award review program exists to keep more of those problems from maturing into retroactive enforcement cases years later. Seen that way, 11 out of 16 proposals requiring correction is not proof that the process failed. It is proof that the process is catching something real every time it is used. It is also a reminder that without this gatekeeping, those same deficiencies could have gone straight into long term contracts with no one the wiser until a whistleblower or analyst stumbled over the gap.

    What The Screen Misses By Design

    The pre-award reviews have one unavoidable limitation, in that the OIG does not review every pharmaceutical proposal that comes through the Federal Supply Schedule door. For fiscal year 2025, it examined 16. The broader VA FSS pharmaceutical portfolio is bigger than that, and the OIG is candid that it selects high risk, high value targets rather than running a universal check.1

    The individual pre-award reports remain confidential. The public does not see which manufacturers needed corrections or which contracting officers accepted, modified, or ignored OIG pricing recommendations. The $24.7 million in savings for 2025 is a documented floor, the confirmed amount that VA obtained after the reviews. How much was recommended but not sustained, as in 2024 when $54.9 million in potential savings yielded $36.8 million in actual reductions, is not broken out for 2025 in the public record.4

    What the record does say is simple enough. The VA is the largest buyer of prescription drugs in the federal system. The OIG reviews only a fraction of the proposals, and roughly two thirds of those examined contain problems in mandatory pricing disclosures. The screen catches something. It does not catch everything.

    Why Veterans Should Care Who Gets The Best Price

    Veterans health care spending is not an abstraction on a chart. The VA pharmaceutical budget comes from public money and buys medicines for people who served in uniform. When a manufacturer submits an inaccurate Commercial Sales Practices disclosure on a contract worth hundreds of millions or billions of dollars, and the OIG flags it before award, that is oversight doing its job.

    When about 69 percent of the proposals the OIG reviews contain deficiencies, year after year, that is the oversight system sending a message. The pre-award review program itself is relatively small compared with the volume of contracts it could examine. The path to catching more overcharging before it happens is not complicated. It involves more reviews, more often, with the same unglamorous insistence on accurate data.

    The harder question is how to get accurate disclosures from the start. The summary reports, properly, stay out of that policy fight. They just present the numbers and leave the rest to the people who decide how much risk they are willing to run with other peoples medicine.

    For more on VA oversight and institutional accountability, see Paying for Nothing — on how the VA paid $11.2 million for Veterans Crisis Line backup services never delivered — and The VA Knows How to Help Pregnant Veterans. It Isn’t Doing It Consistently. — on where the maternity care coordination program holds up and where it frays.

  • A Court Struck Down the $100,000 H-1B Fee. DHS Came Back With $103,265.

    After the Proclamation Falls, the Rulemaking Rises

    In September 2025, the Trump administration tried a shortcut. By presidential proclamation, it slapped a $100,000 payment requirement on cap-subject H-1B petitions, skipped notice-and-comment, and skipped a traditional cost justification. DHS and USCIS treated the proclamation as enough authority and began collecting the money.

    In June 2026, a federal judge in the First Circuit said no, ruling the proclamation-based fee unlawful and cutting off the revenue stream, as reported by the Associated Press.

    Seven weeks later, on August 25, 2026, the same policy goal reappeared in a more conventional outfit. DHS published a notice of proposed rulemaking in the Federal Register proposing a $103,265 fee on the same cap-subject H-1B petitions, now with a cost study, a docket number (USCIS-2026-0298), and a 30-day comment period that closes September 24, 2026.

    DHS estimates roughly $8.8 billion in annual revenue from the fee. The administration has learned from the loss. Whether the proposal survives its own litigation cycle is another matter.

    The proposed fee sits in the Federal Register as the innocuously titled “Fee for Certain H-1B Petitions,” 91 FR 54817, RIN 1615-AD20. The USCIS bulletin announcing it uses calmer language than the political rollout that preceded the 2025 proclamation, but the basic architecture is the same: a six-figure price tag aimed squarely at the capped segment of the H-1B market.

    This time, however, it arrives with the procedural trappings that courts expect. There is a published methodology. There is a public docket. There is at least a gesture at economic analysis. It looks less like a campaign press release and more like a revenue regulation.

    What the Proposed Fee Covers and Who Pays It

    DHS is explicit about the scope. The proposed $103,265 fee applies to cap-subject H-1B petitions, meaning the filings an employer submits when it wants one of the 65,000 regular cap numbers or one of the 20,000 advanced degree set-asides. It does not touch cap-exempt petitions filed by institutions of higher education, nonprofit research organizations, or governmental research organizations, which keep their current fee structure. The new amount would be due at filing, in practice from the petitioner, and would stack on top of the existing menu of charges.

    Those existing costs are already familiar to anyone who files H-1Bs for a living. There is the I-129 base fee. There is the ACWIA training fee, which runs up to $1,500 depending on employer size. There is the $500 fraud prevention and detection fee. There is the asylum program fee that USCIS added in its broader fee rule. For employers who need predictability, there is premium processing.

    DHS treats the new $103,265 figure as just one more line item in this stack, but the arithmetic looks different in the real world. A company sponsoring a worker under the proposal would face a government filing cost that clears $105,000 before attorney fees. That is not a filing fee in any normal sense. It is an entry tariff.

    The Legal Backstory

    The reason this policy is coming back as a proposed rule instead of another proclamation is simple: the first attempt collided with separation of powers.

    On September 19, 2025, President Trump issued a proclamation titled “Restriction on Entry of Certain Nonimmigrant Workers,” which included a $100,000 payment requirement tied to specific H-1B petitions. That document did not run through the Administrative Procedure Act, and it did not pretend to be a fee rule. DHS treated it as binding anyway and began collections.

    Litigation followed almost immediately. As AP reported, a federal judge in June 2026 struck down the proclamation-based fee as an overreach of executive authority and blocked its enforcement. DHS did not concede.

    In coverage from Bloomberg Law, the agency defended the payment as something less than a tax and urged the First Circuit to let collections continue while the appeal played out. The court declined to restore the fee.

    At that point, the administration had two choices: ride out the appellate process or route the policy through the machinery that Congress actually assigned to fee setting. It chose the second.

    The proposed rule in 91 FR 54817 includes a calculated amount of $103,264.57, rounded to $103,265, a cost study, and a public docket. It rests on USCIS fee authority rather than on a generalized presidential power over entry. That makes it procedurally more durable than the 2025 experiment, though not insulated from challenge.

    The potential attack lines are not exotic. Commenters will have questions about the cost model, the choice of payers, and the alignment with the agency’s statutory mandate to recover costs rather than generate free-standing revenue streams. Any eventual lawsuit will frame those questions as Administrative Procedure Act problems and ask a court to decide whether the agency crossed the line from fee setting into policy making that lacks a firm statutory hook.

    For now, DHS is busy papering the record that the proclamation never had.

    What $8.8 Billion Buys

    DHS estimates that the proposed fee would generate about $8.8 billion per year, with roughly $74.9 billion projected over ten years, as reported by Fortune. In the proposed rule, the agency frames this as cost recovery across DHS and other parts of the immigration machinery.

    The math is straightforward on paper: take projected total recoverable costs, divide by the projected volume of cap-subject H-1B petitions that would owe the fee, and call the result a cost-based amount.

    What the documents do not do is spell out in granular detail which programs and operations would live off this revenue or how it interacts with the rest of the USCIS fee schedule. Historically, USCIS has operated on a budget in the $4 billion to $5 billion range, funded almost entirely by filing fees.

    Against that backdrop, $8.8 billion per year from one fee on one subset of one visa category looks less like a user charge and more like a policy tool in search of legal justification.

    The Exemption That Matters

    The most structural choice in the proposal is the cap exemption. Universities, nonprofit research institutions, and governmental research entities are carved out. The fee lands instead on for-profit petitioners that need cap numbers: technology companies, consulting shops, staffing firms, financial institutions, and the rest of the private sector that relies on capped H-1Bs. That design does not happen by accident.

    For years Congress and DHS have used H-1B surcharges on for-profit employers to subsidize training and other programs, while preserving easier pathways for academic and nonprofit employers. The proposed $103,265 fee keeps that asymmetry and pulls it to an extreme.

    Academic and nonprofit hiring channels stay under the old fee logic. Cap-subject corporate sponsorship moves into a different economic universe. Whether one sees that as a labor market correction or as a selective barrier depends on policy priors, but the functional outcome is the same: for-profit demand for capped H-1Bs is the chosen revenue base.

    What Happens Next

    The comment period on the proposed rule runs through September 24, 2026. DHS will then sift through submissions, prepare responses, and decide whether to adjust the proposal before issuing a final rule with an effective date.

    At that point, the fight would shift from the White House and DHS press shops to the Administrative Procedure Act framework that governs challenges to federal regulations.

    Unlike the 2025 proclamation, a final rule would arrive with a cost study, a paper trail, and a comment record. That makes it more defensible in court but not untouchable. The H-1B program has drawn lawsuits from employers, workers, and restrictionist groups for years.

    If DHS finalizes a six-figure fee on cap-subject petitions, it will add one more high-stakes test of how far agencies can push revenue strategies under the label of cost recovery.