Category: Federal Agencies & Oversight

  • A Building Cannot Be Disposed Of Until Someone Else Is Evicted First

    The James V. Forrestal Federal Building has been marked for disposal twice now. The first attempt began around 2010, ran for roughly six years as a joint effort with the District of Columbia government, and was quietly terminated in 2016 without a sale. The second attempt started in earnest in 2024. As of this writing, it has produced a construction project, a proposed swap with a different federal agency, and no actual disposal.

    This is what “getting rid of a building” looks like inside the federal government. It is never one transaction. It is a chain of contingent moves, each one waiting on the one before it, and Forrestal is the clearest illustration on offer.

    The Wrong Size Building at the Wrong Time

    Forrestal serves as headquarters for the Department of Energy, and it is enormous, about 1.8 million gross square feet, with roughly 967,000 square feet of usable space. The plan, according to a GAO report issued this month, is to move Energy into the Lyndon B. Johnson Federal Building, which currently houses the Department of Education and offers about 385,000 usable square feet. Do the arithmetic. Energy is being asked to fit an agency built for nearly a million square feet into a building less than half that size, and Energy officials have said they may need to find supplemental space elsewhere just to make the numbers work.

    There’s a reason this particular move was chosen anyway. Energy’s headquarters requires a substantial footprint of Sensitive Compartmented Information Facilities, the secure spaces where classified work happens, and those aren’t rooms you rent off the shelf. A construction project is already underway to add 20,000 square feet of classified space to accommodate the move, at an estimated cost of $22 million. That’s before anyone has resolved where the current occupant of the smaller building goes.

    Education’s Problem Is Now Energy’s Problem

    The Department of Education occupies the Lyndon B. Johnson building today, and moving Energy in requires moving Education’s staff out first, to space that, as of August 2026, GSA has not identified. This is the part of the disposal process that rarely makes it into a press release. Selling Forrestal isn’t just a real estate transaction between the government and a buyer. It’s a relocation puzzle with at least three agencies in it, one of which hasn’t been told where it’s going yet, and the timeline for the whole sequence is described by GSA’s own officials as uncertain, contingent on investment that hasn’t been finalized.

    Estimated disposal costs for Forrestal stood at roughly $300 million as of December 2025, and GAO reports that figure remains in flux nearly a year later. Costs going up over time is not a surprising feature of federal disposals. It is close to the default setting. What makes Forrestal notable is how transparently the cost estimate depends on decisions that haven’t been made yet, namely where Education goes and how much classified buildout Energy ultimately needs.

    A Decade and a Half, Twice

    The first Forrestal disposal effort ran from roughly 2010 to 2016 and accomplished nothing that shows up in any completed-sale column. The current effort has been underway since 2024, gained real momentum when the Public Buildings Reform Board recommended the property in May 2025, and produced its first concrete milestone, the announced relocation to the Johnson building, in March 2026. That’s fifteen years, across two separate administrations of the same idea, to get from “we should sell this building” to “here is a building we might move the tenant into, contingent on evicting somebody else.”

    None of the individual actors here are behaving irrationally. Energy has a legitimate classified space requirement. GSA has to solve for Education’s relocation before it can hand Forrestal’s keys to anyone. The Public Buildings Reform Board did its job and made a recommendation on schedule. The dysfunction isn’t in any single decision. It’s in the fact that disposing of one federal building routinely requires resolving the housing needs of at least one other federal agency first, a dependency chain that the disposal process was never designed to shorten.

    The Punchline Is the Timeline

    Forrestal is not a story about waste, exactly, or fraud, or a single villain who mismanaged the file. It is a story about how the federal government’s real estate is load bearing in a way that makes disposal structurally slow no matter who is in charge or how much political will exists behind it. You cannot sell a headquarters building until you’ve solved for where its occupant goes, and you cannot solve for where its occupant goes until you’ve solved for where that building’s occupant goes. Fifteen years into trying to get rid of one building, the government has a construction contract, a proposed swap, and a two-step relocation problem it still hasn’t finished solving. Call it progress if you’re feeling generous. Call it the process working exactly as slowly as designed if you’re not.

  • The Surface Transportation Board Keeps Forgetting How to Lock Its Doors

    The Surface Transportation Board regulates freight rail rates, oversees railroad mergers, and adjudicates disputes over who gets to run trains through whose backyard. It is a small, obscure independent agency that most Americans have never heard of and will never have reason to contact. It is also, according to its own contracted auditor, an agency that cannot hold onto basic cybersecurity discipline for more than twelve consecutive months.

    Every year since at least 2017, the Department of Transportation’s Office of Inspector General has hired Williams Adley & Company to run STB through the federal government’s standard information security checkup, the one required by the Federal Information Security Modernization Act. Every year, the verdict has been the same word, ineffective. What makes the fiscal year 2026 report interesting is not that STB failed again. It is that STB had, for one brief shining reporting period, actually started to look like it was getting its act together, and then visibly did not.

    A Small Agency’s One Good Year

    To understand FY2026’s regression you first have to see the year it regressed from. The FY2025 audit reads almost warmly by federal oversight standards. Williams Adley wrote that STB “made improvements, since the previous reporting period” and closed five of nine outstanding recommendations. Identity and access management jumped to a calculated 3.67, edging into “Managed and Measurable” territory, the top tier the government considers genuinely effective. STB’s business impact analyses, the documents that are supposed to tell an agency which systems it absolutely cannot afford to lose, went from Level 3 to Level 4. Contingency plan testing for its two core systems, the General Support System and the Dynamic Case Management System, actually happened, complete with after-action reports. Management’s own response practically glowed, welcoming an audit that showed the program “continues to improve, year over year.”

    None of that survived contact with FY2026.

    The Metrics That Fell Off a Cliff

    The new report documents four specific reporting metrics that regressed in maturity level from the prior year, not stagnated, regressed. Business impact analyses fell from Level 4 to Level 2. Contingency plan testing fell from Level 3 to Level 2, because STB simply did not run the required annual exercises for any of its three in-scope systems this time, not the General Support System, not the case management platform, not even its Amazon Web Services environment. Cybersecurity risk management strategy dropped from Level 3 to Level 2 because two of four sampled Risk Acceptance Forms, the paperwork documenting known vulnerabilities STB has formally decided to live with, expired without anyone bothering to renew, reassess, or justify them. And identity authentication for ordinary, non-privileged users cratered from Level 4 all the way to Level 2.

    That last one is worth sitting with, because it is not an abstract maturity-model score, it is a paperwork failure with a name, the Personal Identity Verification exception process. STB employees are supposed to log in using PIV cards, the standard federal smart-ID credential mandated since a 2004 Bush-era directive. Some employees get exceptions, for legitimate reasons like a malfunctioning card or a pending new-hire issuance. Auditors sampled seven such exceptions. Four had no documented justification for being on the list at all. Three belonged to users who had working PIV cards and valid certificates the whole time, meaning STB’s own systems knew these people didn’t need an exception and left them on it anyway. This is not a resourcing problem in the abstract sense STB’s management response keeps invoking. It is a report nobody ran.

    STB’s Own Explanation, and Its Limits

    To its credit, STB does not dispute any of this. Managing Director Rachel Campbell’s response concurs with all four new recommendations and does not contest a single finding, which is more candor than some agencies manage. The explanation offered, repeated almost verbatim across domain after domain in the report, is resource constraints, budget reductions, limited personnel, competing workload demands. Auditors accepted this at face value and built it directly into the recommendation language itself, asking STB to “evaluate the impact of resource constraints” rather than simply fix the underlying control.

    There is something almost structurally convenient about that framing. A recommendation to study your own resource constraints and develop an action plan is not the same as a recommendation to actually restore PIV enforcement or run a contingency test. It buys another reporting cycle. It is worth noting that STB’s Data Protection and Privacy, Configuration Management, and Incident Response domains all held roughly steady this year, meaning the agency did not lose ground everywhere, only in the specific places where somebody has to remember to do a recurring task on a calendar. Inventory maintenance stayed strong; supply chain risk management stayed flat and mediocre at Level 2 for two straight years, the one condition that has been open long enough it barely counts as news anymore.

    Nine Years Is a Long Time to Draft an Architecture Document

    The most damning artifact in either report is not a new finding at all. It is recommendation 2021-1, first issued in fiscal year 2021, calling on STB to develop an enterprise architecture that actually incorporates information security into its planning. It was still open in FY2025. It is still open in FY2026. STB’s own target completion date for finally addressing it is now June 30, 2029, eight years after the recommendation was written, for a document. Recommendation 2024-9, about implementing federal logging requirements, took a different and stranger path to closure: the underlying OMB memorandum it was based on got rescinded and replaced by newer guidance before STB ever complied, so Williams Adley simply marked it closed as moot. STB didn’t fix the problem. The problem changed definitions out from under it.

    Put the two years side by side and the shape of the story becomes obvious. This is not an agency in crisis, and it is not an agency that has never tried. It is a small regulator with a demonstrably competent core, evidenced by real jumps in maturity when it applies itself, that cannot sustain that application from one fiscal year to the next once attention moves elsewhere. The PIV exception list did not get worse because someone at STB made a bad decision. It got worse because nobody checked it. For an agency whose entire regulatory mission rests on making sure railroads keep their paperwork current and their safety obligations honored, there is a certain grim symmetry in watching it fail the same test on itself, twice in two years, in opposite directions.

  • The Directive Was Binding. The Compliance Was Optional.

    In December 2024, the Cybersecurity and Infrastructure Security Agency issued a directive with a name that sounds like a threat, Binding Operational Directive 25-01. It ordered the entire Federal Civilian Executive Branch, all 102 agencies under CISA’s cybersecurity umbrella, to lock down their cloud tenants against the kind of misconfiguration that let hackers walk through SolarWinds in 2020 wearing the digital equivalent of a stolen badge. CISA director Jen Easterly said at the time that the directive would help “reduce risk to the federal civilian enterprise.” The word “binding” was doing a lot of work in that sentence, because a new DHS Inspector General report (OIG-26-30, released September 21, 2026) has confirmed what the word never actually meant, which is that CISA can write the rules and cannot make anyone follow them.

    The Toolbox Nobody Was Required to Open

    To its credit, CISA built the thing it said it would build. Through the Secure Cloud Business Applications project, launched in 2022 in direct response to SolarWinds, the agency produced ScubaGear and ScubaGoggles, free automated tools that scan an agency’s Microsoft 365 or Google Workspace tenant and flag every deviation from a defined security baseline; blocking outdated authentication, enforcing multifactor login, protecting personally identifiable information, the greatest hits of “things a competent IT department should already be doing.” CISA ran more than 80 outreach engagements with over 1,000 participants, put the tools in front of more than 130,000 requesters, and personally walked 17 agencies through implementation. By the OIG’s own account, none of this was phoned in (BOD 25-01, Implementation Guidance).

    BOD 25-01 laid out three deadlines. By February 21, 2025, agencies had to hand over a complete inventory of their cloud tenants. By April 25, they had to deploy the assessment tools and start reporting continuously. By June 20, they had to actually implement the mandatory security policies and begin continuous monitoring. Three deadlines, each one a smaller and more specific ask than the last, each one accompanied by a CISA outreach campaign, each one missed by a majority of the government it was written for.

    Sixty One, Then Fifty Two, Then Eighty Six

    The numbers get worse as the asks get more concrete, which is the part that should bother you. Forty of 102 agencies (39 percent) failed to even name their own cloud tenants by the first deadline, meaning nobody, not CISA, not the agency itself, could verify what needed protecting in the first place. Fifty three agencies (52 percent) had not deployed the assessment tools by the second deadline. By the third and most consequential deadline, the one requiring agencies to actually implement the security policies, 88 of 102 agencies, 86 percent of the entire FCEB, were noncompliant.

    Then it stopped improving. As of February 12, 2026, eight months past the original deadline, 78 of 102 agencies, 76 percent, were still not implementing all mandatory SCuBA policies. That is not a rollout lagging behind schedule; that is a rollout that reached its ceiling and stayed there. CISA’s own report acknowledges the specific failures, agencies leaving outdated authentication procedures in place, skipping multifactor authentication, declining to implement protections for sensitive personal data, the exact configurations the SolarWinds postmortem told everyone to fix five years earlier.

    A Compulsory Directive With No Compulsion Attached

    Here is the part the OIG buried in a single paragraph that should have been the headline. The Federal Information Security Modernization Act of 2014 gives the Secretary of Homeland Security authority to issue these directives; it does not give the Secretary, or CISA, any mechanism to force an agency to obey one. CISA can notify OMB. CISA can log the noncompliance in the annual FISMA metrics cycle. CISA can send its Directives and Policy team to sit down with an agency’s Chief Information Security Officer and ask nicely, again. What CISA cannot do is anything that resembles enforcement in the ordinary English sense of the word, and DHS OIG has now said so in writing three separate times across sixteen years, first in 2009, again in 2010, and now in 2026, joined by a fourth outside voice in GAO-20-133, February 2020, which found that DHS did not consistently validate agencies’ self-reported compliance in the first place.

    That last detail matters more than it looks like it should. An enforcement mechanism built on agencies grading their own homework was never going to survive contact with an agency that had a reason not to want a passing grade recorded. The OIG’s own data reliability check in this report found duplicate tenant submissions and mismatched agency counts between systems, discrepancies the OIG says it “reconciled,” which is a generous word for finding out the compliance numbers were built on the same self-certification honor system that produced the compliance failures in the first place.

    CISA, for its part, declined to submit management comments on this report. Not a rebuttal, not a clarification, not even the standard bureaucratic paragraph about “ongoing efforts to strengthen” whatever it is agencies say when they have nothing to add. Silence, on the record, in response to a finding that the flagship tool of your flagship post-SolarWinds initiative is being ignored by seven out of ten agencies eighteen months after the deadline.

    The Recommendation That Doesn’t Exist

    The single strangest sentence in the entire report comes at the end of the highlights page: “This report contains no recommendations.” Not because there is nothing to fix, but because the OIG has apparently concluded there is nothing left to recommend to an agency that already knows it lacks the authority to fix the problem itself. You cannot recommend that CISA enforce compliance, because Congress never gave CISA anything to enforce with. The recommendation, if there is one, has to go to the people who wrote the Federal Information Security Modernization Act of 2014 and left the enforcement clause out, and they are not the ones reading OIG reports.

    So the government spent two years building a genuinely useful set of free cybersecurity tools, distributed them to more than 130,000 people, walked federal agencies through installation by hand, and produced a compliance rate that, eight months after the deadline, sits at 24 percent. The tools work. The directive was binding in the sense that a strongly worded letter is binding. Everyone involved did their job except the one entity whose job was to make sure everyone else did theirs, and that entity does not exist, because Congress never built it. The next SolarWinds will not be stopped by a better baseline. It will be stopped, or it will not be, by whichever 24 percent happened to read the memo.

    Sources: DHS Office of Inspector General, CISA’s Implementation of Binding Operational Directive 25-01 (OIG-26-30, September 21, 2026); CISA, Binding Operational Directive 25-01: Implementing Secure Practices for Cloud Services; GAO-20-133, Federal Information Security: Agencies Need to Develop and Implement Adequate Policies for Complying with New Requirements (February 2020).

    Fediverse Reactions
  • The VA Will See Your Teeth Now (If You Qualify, Which You Probably Don’t)

    The Government Accountability Office has just handed Congress a report on veterans’ dental care, and the headline number is the kind of thing an agency press office loves. Eligibility for VA dental benefits jumped 70 percent from fiscal year 2020 to fiscal year 2025, climbing from about 1.38 million veterans to about 2.34 million. Read one press release off that stat and you’d think the VA had finally discovered flossing.

    Read the actual report, GAO-26-108467, and the picture gets more interesting. The eligibility bump did not happen because the VA decided more veterans deserve dental care. It happened almost entirely because more veterans qualified for a 100 percent service-connected disability rating, largely a downstream effect of the 2022 PACT Act’s expanded presumptive conditions for burn pit and toxic exposure. The dental benefit didn’t get more generous. The population of catastrophically disabled veterans got bigger, and dental coverage rode along as a side effect.

    Which brings us to the number nobody is putting in a headline. Even after that 70 percent surge, only 25 percent of the roughly 9.2 million veterans enrolled in VHA care are eligible for VA dental benefits at all. Three out of four veterans who trust the VA with their medical care are, dentally speaking, on their own. This is not new information (VA’s own eligibility rules have looked like a Rube Goldberg machine since the 1970s), but it is worth restating plainly every time the agency announces a percentage increase off a denominator this small.

    Eligible Is Not the Same as Treated

    Even the veterans who clear the eligibility bar don’t necessarily get a cleaning. GAO found that the number of eligible veterans actually using their dental benefit did double from about 420,000 in 2020 to about 870,000 in 2025. Progress, technically. But the utilization rate, the share of eligible veterans who used the benefit in a given year, only moved from 30 percent to 36 percent. Two thirds of veterans who qualify for VA dental care are still not showing up in a VA dental chair in any given year.

    Why. Lead dentists in all 18 Veterans Integrated Service Networks told GAO they do not have the staffing to meet current demand, full stop, before anyone talks about expanding eligibility to a single additional veteran. Facilities in at least two VISNs reported wait times exceeding 28 days for a dental appointment. Veterans service organizations told GAO the same thing they’ve been saying for years; the wait is the barrier, not the paperwork.

    For veterans who don’t qualify for free care, the VA’s answer since 2014 has been the VA Dental Insurance Program, a discounted private insurance plan veterans pay for themselves through Delta Dental or MetLife. GAO’s numbers on VADIP are the quiet embarrassment buried in Appendix III. Enrollment ran from about 55,000 veterans in FY 2020 to about 67,000 in FY 2025, consistently under 1 percent of the veterans eligible to buy in. VA officials’ own explanation, delivered to GAO with a straight face, is that most veterans have never heard of the program. A benefit that requires a subscription almost nobody signs up for is not a benefit. It’s a line item.

    The Pilot Program That Nearly Died of Loneliness

    If you want the most honest data point in this entire report, skip the highlights page and go to Appendix IV, on the VETSmile pilot program. Launched in July 2021, VETSmile linked veterans who lacked dental eligibility to outside dental partners, mostly university dental schools, willing to provide free or reduced-cost care. Fourteen partners signed on at launch, seven dental schools and seven federally qualified health centers.

    Within about a year, 13 of those 14 partners quit. Every single partner offering care at a reduced cost walked away. What was left, from September 2022 through July 2024, nearly two full years, was one dental school, NYU, treating veterans essentially alone on behalf of the entire national program. A second partner, the University of Nebraska, finally joined in July 2024. By the time the pilot wound down in June 2026, it had delivered about 101,000 procedures to roughly 4,700 veterans, worth an estimated $14.4 million in donated care.

    That’s a genuinely good outcome for the 4,700 veterans who got treated. It is also proof that VHA ran a signature access program on the goodwill of one dental school for two years and called it a pilot rather than what it actually was, which was a single point of failure with a press-friendly name.

    Congress Wants to Add Heart Disease to the List

    The reason GAO wrote this report at all is the Elizabeth Dole 21st Century Veterans Healthcare and Benefits Improvement Act, which directed a 2026 pilot providing dental benefits to certain veterans with heart disease, on the theory (backed by the American Heart Association, among others) that oral health and cardiovascular health are linked. GAO modeled what full expansion would look like. Extending comprehensive dental eligibility to every veteran with a diagnosis of ischemic heart disease would add about 620,000 veterans to the eligible pool, a 25 percent increase from 2.45 million to roughly 3.07 million.

    VHA officials and dental providers were blunt about what that would require (more dentists and hygienists in a profession already facing a projected nationwide staffing shortage, more clinic space, longer initial treatment plans for veterans who may not have seen a dentist in years, and closer coordination between dentistry and cardiology for an older, more medically complex population). One VHA facility already sends veterans out to community providers for root canals despite having an in-house specialist, simply because the in-house clinic can’t keep up. Expansion, in other words, would not fix the capacity problem this report documents. It would stress-test it.

    Meanwhile, a separate and far more sweeping bill, the Dental Care for Veterans Act, has sat in the House Committee on Veterans’ Affairs since January 2025, proposing to scrap the entire eligibility classification system and treat dental care like every other VA medical benefit, where enrolled simply means covered. GAO’s report doesn’t mention that bill, because GAO was asked a narrower question about heart disease. But read against the backdrop of a VA system that can’t staff its current 25 percent eligible population, “everyone gets dental care” reads less like reform and more like a promise the agency has no plan to keep.

    None of this makes the topline number in the highlights page false. Eligibility is up 70 percent, and that’s real. It’s just not the whole mouth.

    Source: U.S. Government Accountability Office, GAO-26-108467, Veterans Health Care: Information on Eligibility for and Use of Dental Benefits (September 2026).

    Fediverse Reactions
  • FDA Is Rewriting the Rulebook on Animal Testing. Congress Changed It Four Years Ago

    The Food and Drug Administration announced Monday that it is updating federal regulations to make clear that drug developers can use alternatives to animal testing before medicines are tested in humans.

    There is just one wrinkle.

    Congress changed the underlying law nearly four years ago.

    The FDA’s new direct final rule replaces regulatory references to “animal tests” and “animal studies” with broader terms such as “nonclinical tests” and “nonclinical studies.” It also removes language that the agency says could suggest animal testing is the only acceptable method for producing safety information.

    The change opens the regulatory vocabulary to technologies that sound considerably more 2026 than the rules they are replacing. Those include human-cell systems, organs-on-chips, computer modeling and other New Approach Methodologies, commonly known as NAMs.

    But the FDA is not suddenly abandoning animal testing. And drug companies did not wake up Monday with an authority Congress had never given them.

    The statutory change dates to 2022.

    Congress Got There First

    The Food and Drug Omnibus Reform Act of 2022, enacted as part of the Consolidated Appropriations Act for fiscal year 2023, amended federal drug law to replace references to animal testing with the broader concept of “nonclinical tests.”

    Congress also defined what that meant.

    The law recognized testing conducted in vitro, in silico, in chemico and through nonhuman in vivo methods. In plain English, the statutory framework could encompass laboratory testing involving cells, computer-based modeling, chemical testing and traditional animal studies.

    Animal testing remained an option. It simply stopped being the only category written into the statute.

    FDA’s regulations, however, continued using older terminology.

    Now, in September 2026, the agency is cleaning that up.

    According to the FDA, the new rule brings its regulations into alignment with the 2022 law and removes wording that could leave developers with the impression that animal studies were the required path for generating certain safety evidence.

    That distinction matters.

    The FDA explicitly says the rule does not prohibit animal studies, reduce existing evidentiary standards or impose new requirements or costs on drug developers. Instead, it clarifies that validated non-animal methods can be used when appropriate for the particular drug and regulatory question.

    In other words, this is less an abolition of animal testing than a regulatory vocabulary lesson four years in the making.

    Why the Words Matter

    Changing terminology in the Code of Federal Regulations can sound like the sort of administrative housekeeping best enjoyed with a strong cup of coffee.

    But in this case, the words can have practical consequences.

    Drug developers deciding how to design expensive safety studies do so within an elaborate regulatory system. If the statute says one thing while the implementing regulations continue referring specifically to animal studies, uncertainty can influence how sponsors design those studies and what evidence they believe FDA expects to see.

    FDA itself acknowledges the problem.

    The agency says clearer terminology and regulatory expectations can reduce avoidable uncertainty for sponsors preparing the evidence needed to begin human clinical trials.

    That raises an obvious question.

    If Congress broadened the statutory framework in 2022, what happened during the years in which FDA regulations continued using terminology the agency now says could suggest animal testing was the only acceptable approach?

    The answer will require more than Monday’s press release.

    FDA Provides 25 Places to Start Looking

    Alongside the rule, FDA launched a database containing 25 examples of New Approach Methodologies already found in publicly available agency review materials.

    That may ultimately prove more interesting than the terminology change itself.

    The examples provide a starting point for examining how drug developers have actually used alternative testing methods and how FDA reviewers treated that evidence.

    It also provides a way to begin measuring the transition rather than simply announcing one.

    Which companies used NAMs? What methods did they use? Were animal studies reduced or replaced? How did FDA evaluate the alternative evidence? And how frequently were these approaches being used while the agency’s regulations still contained the older language?

    Those are questions worth following.

    The Rule Is Not Quite Final Yet

    There is another bit of regulatory machinery still running.

    FDA published the change as a direct final rule while simultaneously issuing a companion proposed rule and opening a public-comment period.

    If the agency receives significant adverse comments, it says it will withdraw the direct final rule and proceed through the traditional notice-and-comment rulemaking process using the companion proposal.

    If that does not happen, the updated terminology can move forward without another full round of rulemaking.

    Either way, the direction is clear.

    Congress changed federal law in 2022 to recognize that the evidence supporting human drug trials does not necessarily have to come from animal studies. Technology continued advancing. Drug developers began using newer methodologies. FDA has now assembled examples showing those methods in practice.

    And in 2026, the regulations are finally getting new vocabulary to match.

    For a regulatory system preparing to embrace organs-on-chips and sophisticated computer models, apparently one of the first modernization projects was updating the nouns.

    Fediverse Reactions
  • Federal Register Watch: September 30, 2026

    The Treasury Department and the IRS published temporary regulations today spelling out how Trump Accounts, the new tax-advantaged children’s savings accounts, will actually be established and funded, including a provision letting the Treasury Secretary open an account automatically for an eligible child even if no parent has done so first.

    • Treasury Department / IRS — Trump Accounts temporary regulations lay out how the new accounts are established, including automatic enrollment of eligible children by the Treasury Secretary when a parent hasn’t opened one. That automatic-enrollment default is worth noting because it’s a different starting point than most federal benefit programs use, which typically require someone to apply; here the account can exist before a family has taken any action, raising practical questions about how parents will be notified and how they take control of an account opened on a child’s behalf.
    • National Highway Traffic Safety Administration — NHTSA finalized the SAFE Vehicles Rule III, recalibrating Corporate Average Fuel Economy standards for model years 2022 through 2031 and revising how vehicles are classified for compliance purposes. The agency says the changes are needed “to ensure compliance with law,” language that signals this final rule is closing out a legal vulnerability in how the standards were set rather than simply updating them on schedule, and the classification changes matter because they can shift which fuel-economy target a given vehicle model is actually held to.
    • Treasury Department, Office of Foreign Assets Control — OFAC tightened the Cuban Assets Control Regulations, eliminating the “U-turn” exception that let U.S. banks process certain Cuba-linked payments passing through the American financial system and ending authorization for group people-to-people and professional-meeting travel, carrying out a June 2025 presidential directive. The same day, OFAC also issued a brand-new Cuba Sanctions Regulations part implementing a separate May 2026 executive order, while noting that fuller definitions and general licenses are still to come; publishing the enforcement mechanism before the interpretive guidance that explains exactly what it covers is the kind of sequencing worth watching for how banks and travelers are expected to comply in the meantime.
    • Office of Management and Budget — OMB published the formal notice of a presidential rescissions package sent to Congress on September 25, proposing to cancel $810 million in already-appropriated funds across the Commerce, Education, Health and Human Services, Homeland Security, Housing and Urban Development, and Justice departments, plus international assistance programs. Filing this notice starts a 45-day clock under the Impoundment Control Act during which Congress can approve the cuts or let the proposal lapse, but the administration can hold the money back while that clock runs, a mechanism that has drawn scrutiny in past rescissions fights over whether it lets the executive branch withhold spending Congress already approved.
    • Treasury Department — Treasury issued an interim final rule setting the forms and procedures the new Stablecoin Certification Review Committee will use to decide whether a state’s stablecoin regulatory regime counts as “substantially similar” to the federal framework under the GENIUS Act, a call that determines whether state-chartered stablecoin issuers can operate under state rather than federal oversight. Issuing the procedures as an interim final rule means they take effect immediately without the advance public comment period ordinarily used to shape a new agency process, though Treasury says it will accept comments and may revise the rule later, worth watching given how much rides on the Committee’s decisions.
    • U.S. Citizenship and Immigration Services — USCIS finalized new EB-5 immigrant investor fees and folded in provisions from the EB-5 Reform and Integrity Act of 2022 that Congress passed but USCIS is only now codifying into fee regulations. The rule follows a proposed version published back in October 2025, and that roughly year-long gap is a useful reminder of how long even routine fee rulemakings take to finalize, regardless of how long the underlying statute has already been law.

    Editorial note: We screened all 118 documents published in the Federal Register on September 30, 2026, before selecting the items above. Excluded as routine: roughly two dozen agency information-collection notices submitted to OMB under the Paperwork Reduction Act; seven antidumping and countervailing-duty proceedings, sunset reviews, and court-decision notices; seven self-regulatory-organization (stock exchange) rule filings, including a batch of near-identical liquid-cooled-cabinet fee changes across four Nasdaq exchanges; sixteen NAGPRA repatriation and inventory-completion notices; a cluster of OFAC general-license republications spanning the Venezuela, Iran, and Russia sanctions programs; advisory-committee and closed-meeting notices; and three Presidential disaster-declaration amendments.

  • We Asked America.gov 15 Questions the Government Already Answered. It Did Surprisingly Well.

    The federal government launched a new artificial intelligence system Tuesday with an ambitious proposition: instead of making Americans figure out which agency, office, subagency, program, website, form and acronym possesses the thing they need, perhaps the government could figure that out for them.

    It is called America.gov, and on its first night in operation, Bureaucracy Times decided to give it a test.

    Not a test involving the capital of Nebraska or how to renew a passport. We gave it questions from our own reporting, including obscure federal contracts, nuclear waste, contaminated nickel, pension reporting requirements, used cooking oil, veterans benefits fraud, classified Pentagon clocks, voter records and one of the strangest securities disputes to pass through FINRA in recent years.

    The result was not what we expected.

    America.gov did remarkably well.

    Across 15 questions for which Bureaucracy Times had independently established an answer, established that no public answer exists, or possessed information unavailable to the general public, America.gov produced nine answers we classified as correct and six that were substantially correct but incomplete.

    We identified no fabricated answers.

    Not one.

    For an artificial intelligence system introduced by the federal government, an institution that has occasionally demonstrated an almost artisanal commitment to making simple information difficult to obtain, that deserves some credit.

    America.gov did have problems. It sometimes failed to retrieve information buried inside federal reports. Some of its statistics were years behind newer government figures. It occasionally found one government source while overlooking another containing the missing answer.

    And, in one particularly delightful encounter with the machinery of modern government, America.gov prevented us from asking about a federal contract because it apparently mistook the government’s own contract number for our personal information.

    Still, after an evening spent deliberately trying to make the new system stumble, the most consistent behavior we encountered was something increasingly valuable in the age of generative artificial intelligence:

    When America.gov did not know something, it generally said so.

    A New Front Door With 29,000 Rooms

    The General Services Administration unveiled America.gov on September 29 as what it calls a new digital “front door” to federal information and services.

    According to GSA’s launch announcement, America.gov combines information from more than 29,000 government websites with AI-enhanced search technology. Instead of navigating the federal government’s sprawling collection of agency websites, GSA says Americans will eventually be able to use a single interface to find information and conduct transactions.

    The White House goes further.

    Its September 29 fact sheet says Americans can currently “ask any question” and receive an up-to-date answer. Eventually, the administration says, people will be able to complete transactions including passport renewals and Medicare enrollment without being dispatched back into what the White House rather accurately calls a “maze of websites.”

    President Donald Trump also signed an executive order directing GSA, the National Design Studio and the Office of Management and Budget to establish America.gov as the central entry point for covered federal services.

    The government, in other words, has created a website designed to spare Americans from having to understand how the government created its websites.

    There is a certain elegance to that.

    There is also an immediate accountability question.

    What, exactly, are those 29,000 websites?

    GSA’s announcement does not provide the inventory or explain what it counts as a website. A domain could be a website. So could a subdomain. An agency might operate multiple applications or collections beneath one domain. And saying that America.gov “combines information” from 29,000 websites does not tell us whether every document hosted on those sites is searchable by the system.

    As our experiment would demonstrate, that distinction matters.

    Bureaucracy Times sent GSA a media inquiry Tuesday night asking for the inventory, the definition used to arrive at the 29,000 figure, the inclusion criteria, update frequency, source-ranking methodology and information about the AI models and providers operating the system.

    We also asked about records retention, system instructions, configuration changes and whether America.gov was designed and tested for research uses such as locating FOIA offices and federal records.

    The inquiry was sent at 9:50 p.m. Eastern. We will update this article if GSA responds.

    America.gov Has Been Here Before

    The name is new to many Americans. The domain is not.

    America.gov previously belonged to a State Department public-diplomacy operation intended largely for international audiences.

    A 2011 Senate Foreign Relations Committee record states that the old America.gov was transitioned to the State Department’s IIP Digital operation and archived on April 1, 2011.

    It was not an obscure little government webpage when it disappeared.

    According to the Senate record, America.gov had averaged approximately 1.67 million monthly page views and 925,288 monthly visitors, with 63.52 percent of visits coming from outside the United States.

    The federal government has therefore resurrected the address of what was once an American public-diplomacy operation and turned it into an AI gateway for Americans trying to navigate their own government.

    Washington does recycle.

    Sometimes it even recycles websites.

    Our Test Was Not Random

    We wanted to know whether America.gov could do more than tell someone where to renew a passport.

    Could a journalist use it?

    Could a researcher?

    Could an ordinary citizen trying to understand an inspector general report, federal contract or regulatory requirement use the government’s new front door to find information scattered through the federal bureaucracy?

    Rather than invent trivia questions, we selected 15 questions from Bureaucracy Times reporting and research conducted during the past month.

    That gave us something unusually useful when testing an AI system: a control.

    For some questions, we already knew the answer from federal records.

    For others, our reporting had established that the answer was not publicly available.

    In several cases, we possessed agency correspondence America.gov should not have access to at all.

    We recorded the responses and compared them against our existing reporting. Answers were classified as correct, partially correct, incorrect, unsupported or no answer. A separate category was created when America.gov’s safeguards prevented a question from being submitted.

    The final score was nine correct and six partially correct.

    There were no answers we classified as incorrect or unsupported.

    There were no hallucinations we could identify.

    That last finding deserves more attention than the score.

    When America.gov Couldn’t Find the Answer

    The system’s weaknesses appeared quickly.

    We asked how many separated Customs and Border Protection contractors retained system access after separation and how many contractor separation records were delayed more than 30 days.

    America.gov located the correct 2026 Department of Homeland Security inspector general report.

    Then it stopped.

    It said the available material did not provide the requested counts and suggested opening the full OIG report.

    The numbers are 1,208 and 623.

    America.gov had found the building but apparently couldn’t get into the room where the numbers were kept.

    A similar problem emerged when we asked how much the federal government has paid from the Judgment Fund because the Department of Energy failed to begin accepting commercial spent nuclear fuel in 1998.

    America.gov reconstructed the history accurately. It found totals of approximately $3.7 billion through fiscal 2013, $7.4 billion through fiscal 2018 and $10.1 billion as of September 30, 2022.

    It correctly distinguished those payments from DOE’s projected future liability.

    But our reporting had already located a newer figure of approximately $12.2 billion.

    America.gov’s answer was accurate as far as it went. It simply did not go far enough.

    The same happened when we asked how much commercial spent nuclear fuel is currently stored around the country. America.gov found official figures ranging from roughly 86,000 to more than 90,000 metric tons and correctly explained that there is no operating permanent federal repository.

    Newer federal information puts the inventory above 95,000 metric tons.

    Again, the problem was not fabrication.

    It was freshness.

    Then It Found the Nickel

    We turned up the difficulty.

    DOE has spent decades dealing with thousands of tons of radioactively contaminated nickel at the Paducah Gaseous Diffusion Plant in Kentucky.

    Bureaucracy Times had previously identified a curious discrepancy. An older DOE environmental assessment described 8,500 contaminated nickel ingots weighing approximately 9,350 short tons. Later DOE documents described approximately 9,700 tons.

    We asked America.gov for both figures.

    It found them.

    More impressively, the system corrected a chronological assumption embedded in our question rather than obediently accepting it. It explained that the earlier environmental assessment was the contemporaneous source and then located the later 9,700-ton figure.

    America.gov went one better.

    It found that DOE was still citing approximately 9,700 tons of contaminated nickel in a November 2025 Expression of Interest.

    That was a genuine research result.

    For a system less than a day old, searching through decades of obscure nuclear cleanup documents, it was impressive.

    Then we gave it a federal contract number.

    And America.gov decided we had gone too far.

    Please Remove the Government’s Personal Information

    We asked:

    How much recyclable-material credit did DOE receive under Contract DE-AC05-97OR22576 at the East Tennessee Technology Park?

    America.gov would not allow the question to be submitted.

    The contract number, DE-AC05-97OR22576, was highlighted in red.

    The interface instructed us: “Remove personal information before sending.”

    We preserved a screenshot.

    To be precise, our test establishes only that this particular public federal contract identifier triggered America.gov’s personal-information safeguard. It does not establish that all federal contract numbers will do so.

    But federal research depends heavily on identifiers. Contract numbers, solicitation numbers, docket numbers, case numbers, grant numbers, award identifiers and FOIA tracking numbers are the connective tissue of the government’s public record.

    A research system that occasionally mistakes those identifiers for private information could have a meaningful limitation.

    So we removed the contract number and tried again.

    America.gov immediately found the correct BNFL contract.

    It identified the original $238 million fixed-price agreement, approximately 129,000 tons of potentially reusable metal, $12 million in approved upward price adjustments and a roughly $40 million claim associated with DOE’s moratorium on releasing recycled nickel.

    It could not find the figure we wanted.

    Our previous research identified a recyclable-material credit of $55,569,748 in contract documentation.

    America.gov had once again arrived remarkably close to the answer without retrieving the particular fact buried in the record.

    The Questions With No Answers

    Then something interesting happened.

    America.gov began performing better when we asked questions that did not have public answers.

    We asked how much DOE has spent storing the contaminated Paducah nickel since the proposed sale failed decades ago.

    We do not know.

    America.gov did not know either.

    “I cannot invent that number,” it responded.

    That sentence may be the most important thing America.gov told us all night.

    We asked how many Form 10 attrition events involving frozen pension plans the Pension Benefit Guaranty Corporation receives each year.

    PBGC recently waived certain reporting requirements after saying its review showed such events rarely warranted additional scrutiny, but the agency did not publish the annual count underlying that conclusion. Bureaucracy Times sent PBGC a media inquiry seeking precisely that data earlier this month.

    America.gov found the technical update, explained the reporting requirements and correctly concluded that the annual figure could not be established from the published information.

    It did not grab some other PBGC statistic and force it into the hole.

    Then we asked whether federal renewable-fuel regulations require producers to prove that used cooking oil was lawfully obtained from the restaurant or original owner before generating Renewable Identification Numbers.

    America.gov correctly distinguished EPA’s feedstock documentation requirements from proof of lawful ownership.

    We followed with an even nastier question: Can stolen used cooking oil qualify for the Section 45Z Clean Fuel Production Credit if a fuel producer unknowingly purchases it?

    Bureaucracy Times has already asked Treasury and the IRS essentially that question.

    We have not found a definitive public answer.

    Neither did America.gov.

    It explained what Section 45Z requires, identified the relevant recordkeeping requirements and then stopped.

    It did not convert the absence of a prohibition into eligibility.

    It did not convert the absence of an eligibility provision into prohibition.

    That is exactly what an information system should do.

    It Also Knew What It Shouldn’t Know

    One of our tests involved Zachary Hess Dawson, who pleaded guilty in a federal prosecution involving more than $350,000 in fraudulently obtained VA benefits.

    Bureaucracy Times previously submitted a FOIA request to the VA Office of Inspector General seeking records concerning how the alleged fraud was detected and how the benefits continued.

    VA OIG denied our request under FOIA Exemption 7(A), citing the pending criminal proceeding.

    We asked America.gov why VA OIG denied access.

    It couldn’t answer.

    That was the correct response.

    The denial letter was sent directly to us. America.gov found the prosecution and the OIG investigation, but it could not find a public agency determination explaining our particular denial.

    Rather than infer that the pending prosecution was probably the reason, America.gov said it could not state why the request was denied.

    We then asked how VA continued paying Dawson from 2017 through 2025 and whether his arrest or incarceration triggered discovery of the alleged fraud.

    Again, America.gov found the known facts and refused to construct a causal story from them.

    The public record does not answer those questions.

    Neither did the machine.

    For journalists accustomed to watching generative AI confidently connect two dots with a third dot it just invented, restraint is worth noticing.

    The Classified Clocks Exposed Another Weakness

    Not every miss involved an obscure historical document.

    Earlier this month, the Department of War inspector general released an audit concerning security controls over Defense Regional Clocks.

    All 10 recommendations are classified.

    We asked America.gov why.

    It correctly determined that the government has not publicly disclosed the underlying classification rationale. It also found the original project announcement showing that the audit began after Hotline allegations.

    But America.gov said it could not verify publicly that there were 10 recommendations.

    That information is sitting on another government website.

    Oversight.gov publicly lists the report and identifies 10 recommendations, each classified.

    Here, America.gov successfully searched one portion of the federal information ecosystem while missing another federal source containing the information it lacked.

    That is an important limitation for a service advertised as combining information from more than 29,000 government websites.

    What does “combines” mean?

    Our test suggests it does not necessarily mean that every relevant piece of information across those sites will be retrieved and synthesized for every query.

    Public Records Still Matter

    We saw the same boundary when we asked whether Virginia election officials had provided voter-list products to organizations involved in an overseas-voter mail inquiry.

    America.gov correctly explained Virginia’s restrictions on distributing voter information and said it could not verify that such a transfer occurred.

    We knew something it didn’t.

    Virginia’s Department of Elections had already responded to our records request saying it found no responsive records for the requested voter-list products involving the specified organizations.

    That isn’t a failure by America.gov.

    It is a reminder of what the system cannot replace.

    Search can tell a journalist what the government has published.

    A records request can establish what the government has not.

    America.gov may make federal research considerably easier. It does not eliminate the need to ask agencies questions they haven’t already answered on the internet.

    The bureaucracy lives to see another FOIA.

    The MMTLP Test

    Our fourteenth question concerned MMTLP, the ticker symbol at the center of a years-long dispute involving FINRA’s December 2022 trading halt.

    America.gov accurately reconstructed FINRA’s stated reason for imposing a U3 extraordinary-event halt, including the settlement problem surrounding the distribution of Next Bridge Hydrocarbons shares.

    But it failed to locate a separate systems coding error involving MMTLP that FINRA subsequently acknowledged and that Bureaucracy Times had already identified during earlier reporting.

    Again, the prominent portion of the record was easy to find.

    The less prominent official disclosure was not.

    America.gov’s source discipline nevertheless held. It encountered investor allegations concerning other supposed errors and refused to characterize those allegations as official FINRA findings.

    Another partial answer.

    Another refusal to manufacture the missing piece.

    One Last Trap

    Our final question concerned the U.S. Arctic Research Commission.

    We asked for aggregate payroll and employer-paid personnel costs processed by the Interior Business Center for fiscal years 2024 and 2025.

    We don’t have those numbers yet. They are part of an ongoing records inquiry.

    America.gov found something that looked tantalizingly close: NSF budget tables showing USARC personnel compensation and benefits.

    For fiscal 2024, it found approximately $1.008 million.

    A less careful system could have handed us that number.

    America.gov didn’t.

    It explicitly distinguished budgeted personnel compensation and benefits from actual payroll and employer-paid costs processed through IBC.

    “I cannot confirm those IBC figures from these official sources,” it said.

    Correct.

    America.gov Wins Round One

    This was not a comprehensive technical evaluation.

    Fifteen questions cannot establish the overall accuracy of an AI system drawing information from a federal web environment that GSA says encompasses more than 29,000 websites. Our questions were also deliberately unusual. They came from the kinds of federal audits, contracts, regulatory disputes and records inquiries Bureaucracy Times spends its time digging through.

    But that was the point.

    We weren’t interested in whether America.gov could tell us how to apply for Social Security.

    We wanted to know what happened when a citizen walked through the government’s shiny new front door carrying a shovel.

    The answer, after one evening of testing, is encouraging.

    America.gov was not omniscient. It missed current figures. It sometimes failed to retrieve facts from reports it had correctly identified. It failed on some cross-government searches. And its privacy safeguard apparently looked at a Department of Energy contract number and decided we were trying to disclose someone’s personal information.

    There is work to do.

    But the failure we expected to find never arrived.

    We could not get America.gov to make something up.

    Several of our hardest questions were hard precisely because the answers remain unknown. America.gov consistently recognized that distinction. It found related evidence, explained what that evidence established and stopped before turning inference into fact.

    For researchers and journalists, that characteristic may ultimately matter more than whether every answer is immediately complete.

    Completeness can be investigated.

    A confident fabrication can send the investigation in the wrong direction entirely.

    There are also larger accountability questions still unanswered. GSA says America.gov draws from more than 29,000 government websites, but we have asked for the inventory behind that claim. We want to know how sources are selected and ranked, how quickly information is updated, which AI models are involved, how configuration changes are documented and what records are preserved when the system’s behavior changes.

    Those questions became particularly relevant on launch day. The Associated Press reported that America.gov initially answered several politically sensitive questions using government information, then began refusing some of those questions while President Trump was still speaking at the launch event. That does not tell us why the behavior changed or who changed it. It does demonstrate why configuration histories and change logs for a federal information system matter.

    GSA itself maintains an agency-wide AI directive requiring risk management, transparency and lifecycle accountability for covered AI systems. America.gov is now a very public test of what those principles mean when artificial intelligence becomes an intermediary between citizens and their government.

    And this is only the beginning.

    The White House says America.gov will eventually move beyond answering questions and begin conducting government transactions. Passport renewals and Medicare enrollment are among the services promised.

    At that point, accuracy will become something more than a search-quality metric.

    For now, though, America.gov has been online for one day.

    We spent its first evening feeding it questions about radioactive nickel, stolen cooking grease, pension reporting, classified clocks, securities regulation, federal payrolls, benefits fraud and a contract number it apparently wished we had kept to ourselves.

    It survived.

    More importantly, when it didn’t know the answer, it usually had the good sense to say so.

    For the federal government’s new AI front door, that is a surprisingly good place to start.

    Fediverse Reactions
  • The FAA Knows Someone Could Fake Its Air Traffic Instructions. It’s Still Working On That.

    Somewhere within range of a major airport, a person with a software-defined radio that costs less than a nice dinner could transmit a message that looks, to a pilot’s instruments, exactly like a legitimate clearance from air traffic control. There is currently no reliable way for that pilot to know the difference. This is not the premise of a thriller; it is the finding of a Government Accountability Office report released September 21, 2026, on the cybersecurity of the systems that keep more than 44,000 daily flights and 3 million passengers from colliding. The FAA has known about this class of problem for years. It has, by GAO’s account, mostly gotten around to writing memos about it.

    The ghosts in the frequency

    The National Airspace System runs on radio frequency signals, the same physical medium used for GPS, radar, and every other invisible thread holding modern aviation together. GAO catalogs three ways to attack it (interference, spoofing, and jamming), each capable of degrading, faking, or simply killing the signals aircraft and controllers depend on. None of this is theoretical. In 2012, an individual jamming GPS transmissions near Newark Airport degraded a landing-approach system during pre-deployment testing. In 2022, GPS interference with signs of spoofing near a Dallas airport caused controller confusion and more than 230 departure delays; the same year, an unauthorized transmitter near Denver International disrupted navigation accuracy for civil flights. GAO also notes, in the driest possible register, that a December 2024 Azerbaijan Airlines flight was shot down amid GPS disruptions linked to the Russia-Ukraine conflict, an approach GAO describes as having “become more complex than usual” due to pilot and controller miscommunications. International GNSS interference is now concentrated enough to have hotspots, mapped in the report like weather systems, radiating out of the Middle East, Eastern Europe, Southeast Asia, and the Baltic region.

    FAA is well aware of all this. Awareness, GAO’s report makes clear, is where the agency’s competence currently ends. This is also the third GAO aviation cybersecurity report in as many years; a September 2024 report found 51 of FAA’s 138 air traffic control systems outright unsustainable, and a July 2026 report found FAA had fully implemented only two of its own seven cybersecurity strategy goals.

    Assessed, in a general sort of way

    Federal information security law requires agencies to run risk assessments for individual systems, evaluating specific threats, vulnerabilities, and likely impact under NIST Special Publication 800-53 Rev. 5, and FAA’s own internal order requires the same. For seven of the eight spectrum-dependent NAS systems GAO reviewed, FAA had not done this. Instead it points to one general spectrum risk assessment covering everything at once, which GAO politely observes “does not satisfy the NIST recommendation” because it treats every system’s exposure as roughly identical rather than evaluating each one’s actual architecture and controls.

    The paperwork underneath these systems is not in better shape. Four of the eight still cite a NIST standard that was superseded in 2021. Five are missing required security controls for high-impact systems, including contingency planning and denial-of-service protection. One system’s documents cannot agree with each other on whether the system is high impact or merely moderate. One had not had its required annual security assessment done since 2023. A separate DOT Inspector General audit, cited in the report, found the same pattern of stale NIST standards and missing controls across FAA’s high-impact systems.

    Real-time monitoring, the thing that would actually let FAA notice an attack while it is happening rather than reconstructing it afterward, does not fully exist. FAA’s Spectrum Engineering office told GAO it has no 24/7 monitoring capability and lacks the specialized tools to detect interference or spoofing as it occurs; instead it investigates after someone reports a problem. The agency’s own Wide Area Augmentation System can flag degraded GPS performance but cannot detect spoofing or identify where it came from. FAA officials cited funding constraints as the reason certain monitoring tools have not been deployed to high-risk sites. It is worth sitting with that sentence; the nation’s air traffic infrastructure lacks live detection for signal spoofing because of a budget line item.

    A coalition of the partially willing

    FAA does talk to other agencies about all this, and GAO gives it credit for two of the eight leading interagency collaboration practices it measured against, defining common outcomes and leveraging shared resources, chiefly through the Aviation Cyber Initiative, the Purposeful Interference Response Team, and the Interdepartmental Radio Advisory Committee. The other six practices were only partially met, and the gap has a consistent shape. Inside the formal interagency groups, FAA has charters, bylaws, and defined roles. Outside them, it has almost nothing. FCC and DOD officials told GAO they routinely share information with FAA through informal channels with no documented policy governing how or when. Some aviation industry stakeholders told GAO they were unsure which FAA office to even contact about a spectrum issue, and some reported wanting more access to the incident coordination calls that already exist. FCC itself was apparently dropped from continued participation in the Aviation Cyber Initiative after an earlier interagency taskforce wound down in 2021, and nobody seems to have noticed enough to fix it.

    Clearance to land, or so says somebody

    The most concrete vulnerability in the report involves two applications that pilots and controllers actually use every day, ACARS, which handles operational messaging between aircraft and airlines, and CPDLC, which lets controllers send digital text clearances as an alternative to voice. Both predate modern cryptography as a design assumption. Neither is encrypted. Neither authenticates the sender. GAO walks through, with illustrated step-by-step diagrams, how a malicious actor could pull public flight-tracking data, transmit a spoofed clearance cancellation over VHF using nothing more exotic than a software-defined radio, and force a pilot into a verbal shouting match with real air traffic control to sort out which instruction is genuine. Do that to several aircraft at once and you have delayed departures, an overloaded controller workload, and, in a worse version of the same scenario, a pilot who follows a fabricated altitude or route change believing it came from ATC.

    FAA’s defense against all this is essentially procedural rather than technical: message-format standardization, mandatory acknowledgments, and the expectation that a suspicious pilot will simply pick up a voice radio and ask. These are reasonable stopgaps. They are also, as GAO notes, “not designed to provide the same level of protection as modern cryptographic controls,” which is a generous way of saying the agency is trusting human vigilance to compensate for a protocol built before anyone thought to secure it. A next-generation replacement, built on standard internet protocols, is in testing at select locations. FAA has not given GAO a timeline for when, or whether, it will actually replace the systems currently in use.

    GAO issued nine recommendations, covering system-specific risk assessments, consistent categorization, real-time monitoring, interagency accountability, sustained leadership, formal information-sharing agreements outside the existing clubs, broader stakeholder inclusion, and a plan to actually authenticate ACARS and CPDLC traffic. The Department of Transportation, replying on FAA’s behalf, concurred with all nine and promised a detailed response within 180 days, the standard federal-agency interval for “we will get back to you, eventually, with something.” Bureaucracy Times will be checking the calendar.

  • Who Decides When a Quantum Computer Actually Works?

    The Quantum Genesis Files, Part Four

    Washington has spent years funding quantum computers, testing them and listening to companies explain what their machines can do. Now DOE is building an apparatus to decide when one of them has actually delivered.

    Building a fault-tolerant quantum computer is difficult.

    Determining that someone has built one may prove surprisingly complicated too.

    That problem sits quietly underneath the Department of Energy’s new Quantum Genesis Q Competition.

    DOE wants private companies to demonstrate quantum computers with at least 100 logical qubits, hundreds of millions of fault-tolerant operations and scientific applications worthy of the Department’s research mission.

    Reach those milestones and substantial federal money becomes available.

    But first somebody has to verify the milestones.

    That means determining whether logical qubits are really behaving logically, whether error rates are low enough, whether operations can be repeated reliably and whether a supposedly useful scientific computation actually represents something conventional computers cannot reasonably accomplish.

    DOE has decided not to leave those judgments entirely to the companies building the machines.

    The Department is building referees.

    The $45 Million Referee

    When DOE announced the Quantum Genesis Q Competition on September 17, the $215 million competition naturally received most of the attention.

    Sitting beside it was another announcement.

    DOE plans to spend up to $45 million establishing a Quantum High-Performance Computing Validation and Verification Testbed through its National Laboratories.

    Fourteen million dollars is available from fiscal year 2026 funding. The remaining planned funding depends upon future congressional appropriations.

    Its assignment is remarkably broad.

    DOE says the testbed must be capable of characterizing and validating the entire quantum-computing stack.

    That includes physical hardware.

    Quantum gates.

    Logical architectures.

    Algorithms and applications.

    Classical control systems.

    The testbed will support the Q Competition, meaning companies seeking milestone payments will face something more substantial than a review of specifications supplied by their own engineers.

    DOE wants independent evidence.

    The Department is effectively spending money to answer a question that has followed quantum computing almost from its beginning.

    What exactly should count as success?

    Qubits Make Terrible Scoreboards

    Traditional computers are comparatively easy to describe.

    Processor speeds, memory, storage and standardized benchmark tests can provide imperfect but reasonably understandable comparisons.

    Quantum computers are another matter.

    Two machines can contain similar numbers of physical qubits while having dramatically different capabilities.

    One architecture may produce excellent individual gate fidelity while struggling with connectivity.

    Another may possess more qubits but suffer from errors that limit useful circuit depth.

    A machine may perform impressively on one specialized benchmark and considerably less impressively on another.

    Even the same quantum processor can produce different results depending upon calibration, software, circuit compilation and the expertise of the person operating it.

    That makes simple qubit counts a particularly poor substitute for useful performance.

    The federal government has known this for years.

    And some of its laboratories have been trying to solve the measurement problem long before Quantum Genesis existed.

    Sandia Has Been Building Yardsticks

    At Sandia National Laboratories, the Quantum Performance Laboratory has made quantum-computer assessment its business.

    The laboratory develops methods for measuring how quantum hardware actually performs.

    Its researchers study failure mechanisms, devise performance metrics, build predictive models and create protocols for testing experimental processors.

    They also develop and maintain pyGSTi, an open-source software package used to characterize quantum processors.

    Most importantly for Quantum Genesis, Sandia says the laboratory provides quantum-hardware assessment capabilities directly to DOE and the federal government.

    That makes Sandia’s work particularly relevant to the new competition.

    The Quantum Performance Laboratory has been publishing research on subjects such as randomized benchmarking, gate-set tomography, application-oriented benchmarks and fault-tolerance thresholds for years.

    Those terms may sound painfully specialized.

    Their purpose is relatively straightforward.

    A manufacturer can say a quantum processor performs at a certain level.

    Someone else needs a scientifically defensible way to check.

    Sandia has spent years developing the ruler.

    Oak Ridge Tried Measuring the Machines

    Oak Ridge National Laboratory approached the problem from another direction.

    Its Quantum Computing User Program has provided researchers access to commercial quantum computers from multiple companies.

    That arrangement allowed scientists to do something especially useful.

    They could compare machines.

    In 2023, Oak Ridge researchers reported what the laboratory described as the first independent comparison of leading quantum computers.

    The team examined 24 quantum processors.

    They then compared their results against performance figures promoted by vendors including IBM, Rigetti and Quantinuum.

    The exercise demonstrated precisely why verification matters.

    Most machines performed reasonably close to the vendors’ reported capabilities.

    But researchers had difficulty reproducing the highest advertised performance figures consistently.

    That did not mean the vendors were lying.

    Oak Ridge’s researchers explicitly cautioned against that conclusion.

    Manufacturers know their machines extraordinarily well and can optimize their hardware in ways ordinary users may not reproduce.

    That distinction may sound minor.

    For Quantum Genesis, it is enormous.

    DOE is not paying for the performance a manufacturer’s best engineers can coax from a carefully optimized demonstration.

    It is trying to determine whether a machine represents a scientifically useful computing capability.

    Those are not necessarily the same standard.

    DARPA Is Asking an Even Harder Question

    The Defense Advanced Research Projects Agency has developed its own verification system.

    DARPA’s Quantum Benchmarking Initiative is trying to determine whether any current quantum-computing approach can reach what the agency calls utility-scale operation by 2033.

    Its definition is intentionally economic as well as technical.

    The computational value of the machine must exceed its cost.

    Companies move through three stages.

    Stage A asks whether the company has a plausible concept.

    Stage B requires a detailed research and development plan, identification of technical risks and prototypes designed to reduce those risks.

    Then comes Stage C.

    At that point, a government verification-and-validation team determines whether the proposed utility-scale computer can actually be constructed as designed and operated as intended.

    DARPA describes the program as independent third-party verification.

    That distinction matters.

    The agency is not trying to crown the best quantum company.

    It says explicitly that the Quantum Benchmarking Initiative is not a competition intended to narrow the industry to a predetermined group of winners.

    Multiple approaches could succeed.

    One could succeed.

    None could succeed.

    The job of the government evaluators is to determine which claims survive examination.

    Two Federal Finish Lines

    DARPA and DOE are therefore examining related questions with different finish lines.

    DARPA is asking whether a company can build an industrially useful quantum computer by 2033.

    DOE wants scientifically relevant fault-tolerant quantum computing beginning around 2028.

    DOE’s target is tied to scientific utility.

    DARPA’s is tied to utility at industrial scale.

    The distinction creates an interesting federal experiment.

    A company could theoretically demonstrate a machine valuable for certain DOE scientific applications before proving that the same technological architecture can become economically useful at industrial scale.

    That makes Quantum Genesis something other than a miniature version of DARPA’s program.

    The agencies are measuring different stages in the evolution of the technology.

    They are also developing independent government expertise rather than accepting industry roadmaps at face value.

    The Government Is Learning How to Say No

    That may be the least glamorous but most important part of the entire Quantum Genesis story.

    Federal quantum policy has spent years asking how government can accelerate the technology.

    Fund research.

    Create national centers.

    Connect companies with laboratories.

    Purchase commercial hardware access.

    Support domestic manufacturing.

    Develop algorithms.

    Train scientists.

    Those activities help technology move forward.

    Verification serves a different purpose.

    It gives the government the ability to say no.

    No, that qubit count does not demonstrate useful performance.

    No, that benchmark does not prove fault tolerance.

    No, that scientific calculation does not yet represent meaningful advantage.

    No, that roadmap has not sufficiently addressed the engineering risks.

    Or eventually, perhaps, yes.

    Without an independent ability to make those judgments, a government quantum program risks becoming dependent upon the companies seeking its money to explain whether their own machines deserve it.

    DOE appears determined to avoid that arrangement.

    From Laboratory Instrument to Federal Infrastructure

    The Department’s ambitions extend beyond the current competition.

    Its 2026 roadmap envisions quantum processors eventually becoming part of DOE’s broader scientific-computing infrastructure.

    That means quantum machines would operate alongside conventional high-performance computers rather than replacing them.

    Researchers could move portions of scientific workloads onto quantum processors when those processors offer an advantage.

    DOE ultimately envisions a dedicated Quantum Computing User Facility built around that hybrid model.

    That changes the stakes of verification.

    The Department is not merely evaluating prototypes for a technology prize.

    It is potentially deciding what equipment eventually belongs inside the federal scientific-computing enterprise.

    DOE already operates some of the most powerful conventional supercomputers in the world.

    If quantum processors are going to become another instrument in that infrastructure, the Department needs to know not merely whether they work.

    It needs to know when they are useful.

    The Bureaucracy Behind the Breakthrough

    Quantum computing is often presented through images of exotic hardware, gold-colored cryogenic equipment and promises about calculations that would take conventional supercomputers longer than the age of the universe.

    The less photogenic part of the story involves measurement protocols, error models, validation plans, benchmark suites and federal scientists asking manufacturers to run the test again.

    That may ultimately matter just as much.

    The Quantum Genesis Q Competition is attempting to push private companies toward a fault-tolerant machine.

    The new DOE validation testbed will try to determine whether they get there.

    Sandia has spent years developing quantum-performance measurements.

    Oak Ridge has spent years putting commercial processors in front of independent scientific users.

    DARPA has built a staged process for dissecting company roadmaps and eventually verifying complete systems.

    Different agencies and laboratories are approaching the problem from different directions.

    But they are converging on the same principle.

    Extraordinary technological claims require considerably more than extraordinary press releases.

    They require somebody with a ruler.

    The Race Begins

    That brings the first four Quantum Genesis Files full circle.

    Part One followed the decade of DOE research that preceded the new $215 million competition.

    Part Two followed the federal money that helped construct the broader quantum ecosystem.

    Part Three mapped many of the companies and architectures already familiar to federal laboratories and evaluators.

    And Part Four arrives at the people responsible for deciding whether any of it actually works.

    The next major event is October 19, when applications for the Quantum Genesis Q Competition are due.

    Until then, we do not know who will enter.

    We do know considerably more about the track on which they will run.

    The federal government helped finance portions of the underlying science.

    Its laboratories helped test the machines.

    Its agencies are supporting manufacturing.

    Its researchers developed benchmarks.

    Its scientists are building verification tools.

    And now DOE has attached money to the finish line.

    For a technology famous for existing in multiple states at once, Quantum Genesis has reached at least one surprisingly definite condition.

    The government is no longer merely asking whether useful fault-tolerant quantum computing is possible.

    It is preparing to measure it.

  • Two Minutes on the House Floor, Five Days on the Clock

    The most consequential item in Monday’s Congressional Record is a piece of mail. The White House’s letter proposing 11 rescissions of budget authority, dated Friday, was logged and referred to committee. The House then convened at noon, adjourned two minutes later, and set its next session for Thursday, October 1. The money in question expires on September 30.

    The Arithmetic of Rounding Up

    The package totals $809.5 million, which Democrats on the Senate floor kept rounding up to nearly a billion. The largest slice is $567.4 million from HHS refugee and entrant assistance, followed by $69.6 million of a $70.3 million international education line and $56.1 million from HUD housing counseling. It also claws back $15 million from the Justice Department’s Community Relations Service, an office the administration eliminated in late 2025, which makes this the rare rescission that arrives after the funeral.

    A Calendar Doing the Work of a Statute

    The device is a pocket rescission. The Impoundment Control Act gives Congress 45 days to act on a request, and the administration reads that as permission to sit on the funds until they lapse. The Government Accountability Office concluded in 2018 and again in 2025 that the law does not allow this. The Supreme Court last September let the administration keep withholding roughly $4 billion while litigation continued, but said its order was not a ruling on the merits. Susan Collins, the Republican who chairs Senate Appropriations, called this one unlawful too. Nothing is settled, and the calendar does the rest.

    The Senate Stayed Until Nearly Eleven at Night

    The Senate spent its evening passing the Protect College Sports Act, 77 to 22, with 50 Republicans and 27 Democrats in favor. A Booker amendment on catastrophic injury insurance for athletes failed 49 to 50. By unanimous consent, senators also passed the House’s penny bill (H.R. 10167), which ends circulating minting and rounds cash sales to the nearest five cents, plus a terrorism risk insurance reauthorization (S. 4395) and a bill (H.R. 997) letting the National Taxpayer Advocate hire its own counsel.

    Two inspector general nominations arrived, Mark Priebe for Education and Robert Steinau for NASA, along with Jeffrey Zisk for the Postal Regulatory Commission. Majority Leader Thune filed cloture on the Stop Insider Trading Act, which would restrict stock holdings for members of Congress and their families, then withdrew the underlying motion; the Daily Digest schedules the cloture vote for Wednesday.

    Congress spent Monday retiring the penny and studying the price of college football, while eleven appropriations slipped quietly into a folder. It is a fine way to cancel money. Simply schedule the vote for after it is gone.

    Fediverse Reactions