Bureaucracy Times

All the news fit to be declassified.

Category: Federal Agencies & Oversight

  • Deja Vu on the Clinch River: TVA’s New Nuclear Bet Looks a Lot Like Its Last One

    The Success Story With an Asterisk

    Two articles into this series (introduced in Meet the Fourth Branch)—one on the RFC and one on Fannie Mae and Freddie Mac—both anchored on entities that blew up spectacularly, it seemed only fair to promise readers one that actually worked.

    The Tennessee Valley Authority was supposed to be that entity: a New Deal creation from May 18, 1933, still delivering power to more than nine million people across seven states, still self-financing off electricity sales rather than congressional appropriations, still standing while the Reconstruction Finance Corporation and the RFC’s mortgage-guaranteeing offspring both required federal intervention to survive their own ambitions.

    Here is the asterisk. TVA’s own regulator has spent the better part of four decades documenting a debt history that looks less like a success story and more like a rehearsal for one, and TVA is currently in the middle of placing the exact same kind of bet that got it into trouble the first time, on the exact same patch of land.

    Forty Times the Original Debt Ceiling

    TVA’s early financing was almost absurdly generous by modern standards. Congress appropriated roughly a billion dollars to the agency between 1933 and 1959, charged no interest on any of it, and ultimately treated more than a fifth of that money, 258.3 million dollars, as a straightforward taxpayer equity contribution that was never expected to be repaid at all, according to a Heritage Foundation institutional history of the agency. In 1959, Congress restructured TVA to finance itself through power revenues and its own bond issuance rather than direct appropriations, and set a statutory debt ceiling to keep the new arrangement disciplined.

    That ceiling did not hold the line for long. By 1979 Congress had raised it to 30 billion dollars, forty times the amount originally authorized twenty years earlier, driven almost entirely by TVA’s nuclear construction program. TVA started seventeen nuclear generating units during the 1960s and 1970s and completed only seven of them, according to GAO’s own account of the agency’s finances, a failure rate that turned billions of dollars of half built reactors into pure liability with no offsetting electricity to sell. By 1995, GAO reported that TVA carried 26 billion dollars in debt, with 14 billion dollars of that sunk into nonproducing nuclear assets that were not even included in the rates TVA charged customers, and warned in plain language that if TVA could not compete effectively as electricity markets opened up, the federal government might end up covering TVA’s debt itself.

    The debt problem eventually stabilized. The pension problem did not. By fiscal year 2016, GAO found TVA’s pension plan was only 54 percent funded, with unfunded liabilities that had grown steadily for a decade, and TVA had not even been reporting the shortfall in its own required performance plans. It got worse before it got better: TVA’s own numbers, reported by the Chattanooga Times Free Press, showed the plan falling to roughly 60 percent funded in 2019 and the underfunding widening to 5.6 billion dollars in 2020, driven largely by falling interest rate assumptions rather than any single management failure. Since then the pension picture has improved materially: according to the White House FY2026 Budget Appendix, as of September 30, 2024, the TVA Retirement System reported an estimated seventy-nine percent funding ratio and an unfunded liability of roughly 2.3 billion dollars—better than a decade ago, though still a meaningful gap on TVA’s balance sheet.

    Same River, New Reactor

    Here is where the story loops back on itself in a way that would be hard to invent. One of the reactors TVA never finished during its 1970s nuclear buildout was the Clinch River Breeder Reactor, a federally funded prototype fast breeder sited on TVA owned land near Oak Ridge, Tennessee, with TVA slated to buy its output. Congress killed the project in October 1983 after roughly 1.7 billion dollars had already been spent, amid years of cost estimates that kept sliding further out of reach no matter when anyone checked them.

    In May 2025, TVA became the first utility in the country to submit a construction permit application to the Nuclear Regulatory Commission for a new small modular reactor, specifically the BWRX-300, a boiling water small modular reactor design developed by GE Vernova and Hitachi.

    The site TVA chose is Clinch River, the same 1,200 acre property where the federal government’s last big nuclear swing already failed once. The Nuclear Regulatory Commission issued its Final Supplemental Environmental Impact Statement for the project on April 6, 2026, per the Federal Register notice, and its Final Safety Evaluation Report on June 25, 2026, finding no safety bars to issuing the construction permit, and has targeted a permit decision for the fall of 2026, meaning a yes or no could arrive shortly before or after this article appears.

    The Department of Energy has since selected TVA for up to 800 million dollars in cost shared federal funding to advance the project, on top of a separate 400 million dollar DOE grant announced in December 2025; TVA’s board has also approved up to 350 million dollars to explore small modular reactor development at Clinch River, according to the White House FY2027 Budget Appendix. TVA has additionally signed on for a 6 gigawatt small modular reactor deployment program with a private developer, framed by the current administration as central to an American nuclear renaissance and an energy dominance agenda.

    None of this is happening because nuclear has been quietly carrying TVA’s business. Local reporting in late 2025 found TVA’s nuclear generation had actually hit its lowest level since 2007 over the preceding year, even as the agency signed on for what would be the largest small modular reactor deployment commitment in the country.

    The bet is being placed on projected future demand, principally from data centers and population growth, using the identical playbook of federally backed capital investment that produced a 26 billion dollar debt pile and a decade of underfunded pensions the last time TVA tried it.

    For some background, the TVA’s total long-term debt stood at approximately twenty-three billion dollars as of June 30, 2026, according to its most recent quarterly filing with the Securities and Exchange Commission, down from the mid-1990s peak but still a substantial balance sheet obligation.

    Betting the Rate Base Again

    None of this means TVA is destined to repeat the Clinch River Breeder Reactor’s fate specifically. Small modular reactor technology is a genuinely different bet than a 1970s liquid metal fast breeder, and federal cost sharing this time is explicit up front rather than discovered after the fact.

    But the structural pattern this series keeps returning to is exactly present here, where a government corporation with an implicit federal backstop and a statutory debt ceiling that Congress has shown a consistent willingness to raise whenever the number gets inconvenient, making a decades long capital commitment to a nuclear technology that has never been built at commercial scale in the United States, funded partly by federal grants that do not show up as taxpayer risk until something goes wrong.

    TVA is not the RFC and it is not Fannie Mae. It has never needed a conservatorship or a liquidation act. But the entity billed in this series as the exception that proves government corporations can work has, on its own regulator’s paper trail, already run the exact experiment it is running again, on the same riverbank, with the same optimism about demand that never quite materialized the last time.

    Whether TVA gets to keep its status as this series’ good example may depend less on nuclear physics than on whether Congress and TVA’s own management have actually learned anything from the debt ceiling they raised forty times to pay for the last round of reactors that never got built.

    Sources: GAO, Shedding Light on Tennessee Valley Authority Debt (2017); GAO, Tennessee Valley Authority: Financial Problems Highlight Need for Long-Term Solutions (AIMD/RCED-95-134, 1995); NRC Final Supplemental Environmental Impact Statement, Clinch River SMR (Federal Register, April 6, 2026); DOE, TVA selected for up to $800 million SMR cost-sharing; TVA SEC quarterly filing (Q3 FY2026).

    Next in the series: the FDIC, the other entity in the running for the series’ success story, and what the 2023 collapse of Silicon Valley Bank revealed about how much daylight there really is between “well run” and “the last one standing.”

  • SEC Flagged OTC Link’s Access-Control Problem in 2016. It Was Still There in 2023.

    Three SEC examination cycles identified compliance problems at a major over-the-counter trading operator. The public record does not explain why years passed before enforcement followed.

    The Securities and Exchange Commission censured OTC Link LLC on Tuesday and ordered the broker-dealer to pay a $575,000 civil penalty for repeated failures involving technology and security requirements under Regulation Systems Compliance and Integrity, better known as Regulation SCI.

    The penalty is straightforward.

    The timeline is considerably less so.

    According to the SEC’s September 22 administrative order, the agency identified a deficiency involving OTC Link ATS’s access-control policy during a fiscal year 2016 examination.

    SEC examiners returned in 2019.

    The problem was cited again.

    They returned again in 2022.

    It was cited again.

    And according to the SEC, as of fiscal year 2023, the access-control policy “had still not been formally established.”

    That leaves an obvious question: What happened during those seven years?

    The SEC isn’t saying.

    A Rule Requiring “Prompt Action”

    OTC Link is a registered broker-dealer and a subsidiary of OTC Markets Group. It operates alternative trading systems used by broker-dealers to execute or facilitate transactions in securities that trade outside national securities exchanges.

    Because of its role in the market, OTC Link ATS is subject to Regulation SCI, a regulatory framework covering the technological infrastructure of important securities-market entities.

    Among other requirements, Regulation SCI requires covered entities to maintain policies and procedures governing their technological systems, conduct periodic reviews and take “prompt action” to remedy identified deficiencies.

    According to Tuesday’s SEC order, OTC Link’s problems went well beyond one unfinished document.

    The Commission identified deficiencies involving account management and access controls, network-device security configuration, data-loss prevention, application vulnerability management, and vulnerability testing and remediation.

    But the access-control policy provides perhaps the clearest illustration of the timeline.

    The SEC says the policy was deficient during its FY2016 examination because it remained in draft form.

    A subsequent examination resulted in another deficiency letter in 2019.

    Another examination produced another deficiency letter in 2022.

    By FY2023, according to the Commission, the policy still had not been formally established.

    If federal regulatory examinations came with punch cards, OTC Link was getting close to a free one.

    Then Came the Consultants

    The chronology finally begins moving faster in 2024.

    According to the SEC, OTC Link retained third-party compliance consultants that year to evaluate its Regulation SCI program and recommend improvements.

    Beginning in March 2025, the company established additional policies covering areas including application vulnerability management, account management and access control, and network-device configuration management.

    The SEC ultimately found that OTC Link willfully violated several provisions of Regulation SCI. The company agreed to a censure, a cease-and-desist order and the $575,000 penalty without admitting the Commission’s findings, except as to jurisdiction.

    But this was not OTC Link’s first recent encounter with SEC enforcement.

    In August 2024, the SEC charged OTC Link with separate anti-money-laundering compliance failures.

    In that case, the SEC found that from March 2020 through May 2023, OTC Link failed to implement reasonably designed policies and procedures for monitoring transactions on its trading platforms for suspicious activity.

    The result was remarkable: OTC Link did not file a single Suspicious Activity Report during that period, despite its three platforms facilitating tens of thousands of OTC transactions daily.

    OTC Link paid $1.19 million to settle that matter. The SEC said that investigation also grew out of an examination conducted by its Division of Examinations.

    The two cases involve different regulations and different compliance failures. There is no evidence in the public record establishing that one caused or contributed to the other.

    Their timelines nevertheless overlap.

    Three Examinations, One Unanswered Question

    The SEC’s latest order establishes that its examiners repeatedly found problems at OTC Link.

    What it does not explain is what happened after they found them.

    Bureaucracy Times contacted the SEC’s Office of Public Affairs on September 22 seeking the dates of the deficiency letters associated with the 2016, 2019 and 2022 examinations.

    We also asked whether OTC Link submitted remediation plans after those examinations, whether the SEC ever considered the deficiencies resolved, whether remediation deadlines were established, when examiners determined previously identified deficiencies remained unaddressed, and when the matter was referred or otherwise escalated to the Division of Enforcement.

    We specifically asked how the seven-year history of the access-control policy squared with Regulation SCI’s requirement for “prompt action” to remedy deficiencies.

    The SEC declined to answer.

    “Attributable to an SEC spokesperson, we decline comment beyond our public filings including our press release which we issued today,” SEC Public Affairs Specialist David Ausiello told Bureaucracy Times.

    That leaves the Commission’s own enforcement order to tell the story.

    FY2016: deficiency identified.

    2019: cited again.

    2022: cited again.

    FY2023: still not formally established.

    2024: outside consultants brought in.

    March 2025: additional policies established.

    September 2026: enforcement action announced.

    None of that absolves OTC Link of the violations described by the SEC. The Commission’s order places responsibility on the company for maintaining the required policies and promptly correcting deficiencies.

    But regulatory oversight is also supposed to do something after regulators repeatedly discover that a regulated entity has not fixed a previously identified problem.

    The SEC has now documented three examination cycles and years of unresolved deficiencies at an operator of important securities-market infrastructure.

    What remains missing from the public record is what the regulator did about those findings along the way.

    For now, the SEC has declined to fill in that part of the timeline.

    Sources: SEC Administrative Order, In the Matter of OTC Link LLC, Release No. 34-106458 (September 22, 2026); SEC press release, OTC Link AML enforcement action (August 2024).

    Fediverse Reactions

  • VA Pricing Problems Spread Beyond Drugs, With 11 of 12 Medical-Supply Proposals Flagged

    Earlier this month, Bureaucracy Times reported that nearly seven in ten pharmaceutical proposals examined by the Department of Veterans Affairs inspector general contained problems in the commercial pricing disclosures VA uses to negotiate federal drug prices.

    Apparently, the pharmaceuticals weren’t special.

    In a new report released Sept. 22, the VA Office of Inspector General examined 12 nonpharmaceutical Federal Supply Schedule proposals covering medical supplies and services. Eleven of the 12 proposals, or 91.7 percent, contained commercial-sales disclosures that auditors determined were not accurate, complete, or current.

    The proposals represented approximately $814 million in estimated contract value and included 12,246 offered items.

    Only one proposal passed through the review without OIG identifying disclosure deficiencies.

    That matters because VA uses commercial-sales information to determine whether prices offered to the federal government are fair and reasonable. Vendors are generally required to disclose information about their commercial pricing practices, including discounts and concessions offered to other customers.

    In other words, the government is negotiating with information supplied by the companies sitting across the negotiating table.

    And, once again, OIG found problems with that information.

    A Familiar Problem

    The findings closely resemble those in the pharmaceutical pricing review Bureaucracy Times covered on Sept. 8.

    In that report, OIG examined 16 pharmaceutical proposals and found that 11 contained deficient commercial-sales disclosures.

    Taken together, the two FY2025 reviews examined 28 pharmaceutical and nonpharmaceutical proposals.

    Twenty-two of them had disclosure problems.

    That works out to approximately 79 percent.

    The scale of the purchasing system involved is considerably larger than the sample. VA’s National Acquisition Center administers nine healthcare Federal Supply Schedules. Federal agencies purchased approximately $25.7 billion in products and services through those schedules during fiscal 2025, according to OIG.

    The pharmaceutical proposals reviewed by OIG represented roughly $21 billion in estimated contract value. The latest nonpharmaceutical review adds another $814 million.

    These are not negotiations over boxes of tongue depressors in the supply closet.

    $29 Million Identified, $11.7 Million Sustained

    OIG’s review also produced measurable results.

    Auditors recommended lower prices for eight of the 12 proposals and calculated approximately $29.1 million in potential savings.

    VA ultimately sustained approximately $11.7 million of those savings.

    That is about 40 percent of what OIG identified.

    But the aggregate figure conceals substantial differences among individual negotiations.

    For one proposal, identified in the report only as Report 4, OIG calculated $10.85 million in potential savings.

    VA sustained none of it.

    Another proposal, Report 10, carried approximately $4.59 million in potential savings. Again, none was sustained.

    Report 11 produced another $987,400 in potential savings and zero sustained savings.

    The opposite happened with Report 6. OIG identified approximately $11.75 million in potential savings, and VA ultimately sustained approximately $11.55 million, or more than 98 percent.

    Why one negotiation captured nearly everything OIG identified while others captured nothing is one of the more interesting questions left by the report.

    Unfortunately, figuring out who was sitting on the other side of those negotiations is not particularly easy.

    The Vendors Without Names

    The OIG summary does not identify the companies associated with the 12 proposals.

    There is a reason for that. According to OIG, the individual preaward reports are not publicly released because they contain proprietary commercial information.

    Bureaucracy Times attempted to reconstruct several of the unnamed vendors using information that is public.

    We compared the report dates, contract award dates and other information contained in OIG’s appendix against VA’s publicly accessible Federal Supply Schedule contracting records.

    The exercise produced several plausible matches, but not enough evidence to responsibly attach an OIG finding to a specific company.

    That distinction matters.

    For example, multiple VA medical-supply contracts were awarded on some of the dates appearing in the OIG report. A matching award date can identify candidates, but it cannot establish that a particular vendor was the subject of a particular OIG review.

    So we aren’t going to guess.

    The result is an odd transparency gap.

    VA publicly identifies its Federal Supply Schedule contractors. OIG publicly identifies millions of dollars in potential savings associated with individual proposal reviews. But the public information does not reliably connect the two.

    The government knows which companies submitted the problematic disclosures.

    The public gets Report 4.

    And Then There Is Report 11

    One entry in OIG’s appendix raises another question.

    Report 11 was issued Sept. 2, 2025.

    The table lists the corresponding contract award date as July 30, 2025.

    That would put the award 34 days before OIG issued its preaward report.

    There may be an entirely routine explanation. The date could reflect an existing contract, a modification, an effective date or some other element of the acquisition chronology.

    Our reconstruction uncovered another reason for caution. In at least one portion of the public contracting record, dates that appear to represent contract effectiveness do not necessarily correspond neatly with the literal date on which an award was made.

    That makes the chronology difficult to reconstruct from the summary alone.

    But it also illustrates the larger problem.

    OIG is performing these reviews precisely because commercial pricing disclosures affect the government’s ability to negotiate favorable prices. Across the pharmaceutical and nonpharmaceutical reviews examined by Bureaucracy Times this month, 22 of 28 proposals contained problems with those disclosures.

    The latest audit alone identified $29.1 million in potential savings.

    VA captured $11.7 million.

    And the public still cannot readily determine which companies were responsible for the disclosures behind the remaining millions.

    For a federal purchasing system that moved $25.7 billion in healthcare products and services last year, “Report 4” leaves quite a bit to the imagination.

    Sources: VA OIG, Federal Supply Schedule Nonpharmaceutical Preaward Reviews for Fiscal Year 2025 (VAOIG-26-00128-191, September 22, 2026).

    Fediverse Reactions

  • The Postal Service and Its Watchdog Cannot Agree on Whether They Spoke in 2024

    Somewhere in a federal email server sits the answer to a question that should not require an article to resolve. Did the United States Postal Service ask its own Inspector General for help in March 2024, and did the Inspector General say no? The Postal Service says yes, it asked, and yes, it was refused. The Inspector General says that characterization is false. Both cannot be right, and the fact that a $78 billion federal agency and its statutory watchdog cannot settle this in private, and instead settled it in the pages of a public audit report, tells you most of what you need to know about the state of oversight at USPS.

    The occasion for this standoff is Report 25-129-R26, “Customer Survey Integrity,” published by the USPS Office of Inspector General on September 15, 2026. The underlying subject, employees gaming a customer satisfaction survey system called Customer 360, is by federal standards almost quaint. What makes it worth your time is not the fraud. It is the fact that the agency’s official written response to its own watchdog reads less like a management letter and more like a rebuttal brief, and that the watchdog’s reply reads like a judge losing patience with counsel.

    A System Built to Be Gamed, Gamed As Designed

    C360 exists because the Postal Accountability and Enhancement Act requires USPS to report customer satisfaction data to the Postal Regulatory Commission every year. Resolve a service request, trigger a survey, roll the survey scores up through post office, district, and area, and eventually the national number lands on a page the PRC reads as a proxy for whether the mail is working. In fiscal 2025 that pipeline produced 5.5 million invitations and 1.2 million responses feeding a satisfaction score that has, for years, hovered somewhere in the high thirties to high forties, comfortably the worst of every customer metric USPS tracks.

    OIG’s audit found that this number has been inflated by two distinct schemes. The first, a nationwide exploit of the “Email Us” feature on usps.com, let employees invent customer issues tied to their own personal inboxes so they could receive and complete their own satisfaction surveys. OIG flagged roughly 119,000 of these as high risk. The second, a regional “booster campaign” concentrated in the WestPac Area, had employees logging routine, already resolved interactions, retrieving someone’s mail counts as a “walk-in service request” if you are creative enough, purely to generate more surveys to manipulate. Walk-in requests in the affected district rose by roughly 3,200 percent. One post office pushed its score up by more than 21 percent this way. At least 83 postmasters, managers, and supervisors either manipulated scores directly or told their people to.

    None of this is especially shocking as institutional behavior goes; performance metrics attached to bonuses tend to get gamed, and USPS is neither the first nor the hundredth federal entity to discover this. What distinguishes the case is what happened after OIG wrote it down.

    Two Federal Bodies, One Set of Facts, Zero Agreement

    USPS management’s written response, signed September 1, 2026, by Marc McCrery, Michael Elston, and Elvin Mercado, opens by stating that management “strongly disagrees with the single finding in the OIG’s report and all related recommendations as currently written.” It proceeds to reject all six recommendations, and along the way makes a claim that, if true, rewrites the entire premise of the audit. USPS says it notified OIG in March 2024 about employees manipulating email addresses, requested OIG’s assistance, and was turned down.

    OIG’s evaluation section, printed in the same report, calls this characterization something close to a fabrication. The Inspector General states it “strongly disagrees with the Postal Service’s characterization that we denied assistance,” explains that investigators reviewed the referred complaint, routed the administrative piece back to USPS for internal handling, and referred the systemic question to the Office of Audit, which is precisely how this audit came to exist. In OIG’s telling, this report is the assistance USPS says it never received.

    Layered on top of that is a second, more technical dispute over who is withholding data from whom. USPS says OIG refused to hand over the files identifying the 119,000 high risk Email Us surveys, making the finding unfalsifiable by USPS’s own analysts and, in management’s words, likely to have produced “a high volume of false positive results.” OIG’s rebuttal is pointed. It notes that USPS applied filters similar to OIG’s own methodology when it ran its internal WestPac analysis in early fiscal 2026, and that analysis flagged 126 employees, 116 of whom OIG had already identified independently in prior years. That is not the outcome you would expect from a methodology its target insists cannot be replicated.

    A federal inspector general and the agency it oversees are now on the record with mutually exclusive accounts of a documented request for help. This is not a dispute about interpretation, tone, or the fairness of a statistical filter. It is a dispute about whether an email exists. One side can produce it or cannot. Neither has, publicly, and a FOIA request would settle the matter in the time it takes USPS’s records office to process it, assuming USPS’s records office is inclined to move quickly on a request that would either vindicate or embarrass its own Vice President of Customer Experience.

    Management’s Numbers, Read Against Themselves

    Credit where due, USPS’s rebuttal is not empty bluster. It includes its own worst case modeling, assuming every single OIG flagged survey was in fact fraudulent and stripped from the count. Even under that maximal scenario, USPS calculates its satisfaction score still rose 4.15 percentage points from fiscal 2023 through 2025, with no resulting change to the National Performance Assessment corporate scorecard, since C360 survey data is diluted down to roughly one percent of that scorecard’s total weight (twenty percent of the Customer Satisfaction Composite, which is itself five percent of the corporate total).

    Notice what that concession actually concedes. USPS is not arguing the fraud did not happen or did not move the number. It is arguing the fraud did not move the number enough to matter for bonuses, which is a different and considerably weaker claim than the one management spends four pages building toward. The Postal Service’s own defense, taken at face value, confirms the direction OIG’s finding points in even while disputing its magnitude.

    The agency does offer USPS a narrow, grudging concession on Recommendation 6: it will strip 3,688 flagged fiscal 2025 surveys and the original 2,500 surveys tied to the 2024 scheme from its scoring. It refuses, flatly, to revisit fiscal 2023 and 2024 more broadly, on the grounds that doing so “would not provide timely feedback or materially change the C360 score reported to the Postal Regulatory Commission.” Translated, the Postal Service is declining to fully correct a mandatory federal report to a rate setting commission because doing so would be inconvenient and probably wouldn’t change the headline number much. That is a defense a compliance officer should recognize as the kind of sentence that gets quoted back at you later.

    The Watchdog That Cannot Get an Answer

    Strip away the survey fraud, which is genuinely the less interesting half of this story, and what remains is an inspector general that cannot get its own oversight target to agree on a shared set of facts about their own correspondence, cannot get access to data it needs to validate its own audit trail without a public fight breaking out over who denied whom, and cannot get the agency to commit to a single implementation date across six recommendations, all of which were answered with some version of “management disagrees with this recommendation as written.” Every recommendation lists its Target Implementation Date as N/A. Every one lists its Responsible Official as N/A.

    Congress wrote the Postal Accountability and Enhancement Act on the premise that an independent inspector general would be able to verify what USPS tells the Postal Regulatory Commission. What this report demonstrates is not that the premise failed, exactly, but that it now depends on whether a federal agency will voluntarily hand its own watchdog the emails proving or disproving a claim that agency itself put in writing. The Postal Service disagreed with all six recommendations. It might start by disagreeing with itself less and producing the correspondence more.

    Source: USPS Office of Inspector General, Customer Survey Integrity (Report 25-129-R26, September 15, 2026).

  • The Pentagon’s Own Gas Station Is Losing Money on Every Gallon

    Somewhere inside the Defense Logistics Agency’s ledgers this year sits a small, almost comic failure of arithmetic, the kind that would get a corner store shut down but barely rates a footnote in a war. CBO’s letter on the cost of Operation Epic Fury records that DLA, the office responsible for buying and reselling fuel to the entire Department of Defense, raised its surcharge on military fuel purchases by $42 a barrel this year to cover the war’s energy costs. The Government Accountability Office had already told Congress the increase would not be enough. By CBO’s account, GAO expected DLA to lose $1.82 billion on fuel sales in fiscal year 2026 anyway, meaning the agency set a price, watched its own watchdog tell it the price was wrong, and kept charging it. This is the kind of detail that never makes it into a floor speech about supporting the troops, because it is not about the troops at all. It is about a supply agency’s internal pricing model failing in real time, in public, while Congress is being asked to backfill the shortfall.

    The Gas Station That Loses Money on Every Gallon

    DLA is not a charity. It exists to buy fuel in bulk and resell it to the services at a price meant to cover its costs, full stop. When CBO adds up the $835 million in extra surcharge revenue DLA actually collected from April through June against the $1.82 billion GAO says it is on track to lose for the year, the agency comes out roughly $1 billion short of covering what it spent to run the exact same shop. DLA’s own remedy list, as CBO relays it, amounts to drawing down cash reserves, raising prices later to cover this year’s shortfall, or going back to Congress for a supplemental, some combination of an institution quietly eating its own losses and passing the bill forward. This is not exotic mismanagement. It is a government gas station that cannot price gas correctly even with its own accountants standing next to the pump.

    The Magazine Is Empty

    While DLA was losing money on diesel, the missile defense side of the ledger was spending down something that cannot simply be reordered at market price. CBO’s letter states that Operation Epic Fury and the Twelve Day War against Iran that preceded it in 2025 together consumed, by the agency’s estimate, somewhere between one half and two thirds of the entire US inventory of Patriot, THAAD, SM 3, and SM 6 interceptors. A CSIS assessment of the same stockpiles puts the replacement timeline at two to three years for the cheaper interceptors and considerably longer for the most sophisticated ones, because, as CBO notes, it typically takes three to five years just between placing an order for these systems and actually receiving one. CBO’s letter is explicit about why this matters beyond Iran; it points directly at a hypothetical conflict with the People’s Republic of China, whose missile arsenal dwarfs Iran’s and which would draw on precisely the interceptor types the United States just burned through defending Gulf allies and Israel. These are not cheap items to begin with. CBO puts Patriot and SM 6 interceptors at roughly $4 million apiece, THAAD interceptors at about $12 million, and the most advanced SM 3 variant at $28 million, all produced at rates too low to absorb a war’s worth of demand without years of lag. Congress authorized a war against Iran. Nobody voted on drawing down the country’s missile shield for a war with China that has not happened, and CBO is telling them, gently, that this is what occurred anyway.

    A War Bill With a Farm Subsidy and a Train Station Stapled to It

    Then there is the part of the ledger that has nothing to do with fighting at all. The administration’s June supplemental request, justified almost entirely by reference to the Iranian conflict, included $20.5 billion for agencies and purposes CBO could not connect to the war in any meaningful way. The single largest chunk, $11.1 billion, went to the Department of Agriculture, mostly to compensate crop farmers for higher fuel and fertilizer costs tied to the closure of the Strait of Hormuz, a connection CBO is willing to grant even if it is several steps removed from combat. A separate $1 billion of the same wartime request, however, was earmarked for the design and construction of a modernized Penn Station in New York, a project CBO states plainly has no connection to the decision to go to war at all. It rode into an Iran war supplemental request the same way a rider always does, quietly, attached to something urgent enough that nobody wants to be the member of Congress who voted against funding the troops in order to strip out a train station.

    The Invoice Nobody Reconciles

    None of these three items would sink a budget on its own. A rounding error at DLA, a stockpile drawdown with a five year lag, a train station riding along on a war appropriation, each is survivable in isolation. What they share is a pattern this publication keeps finding wherever it looks at federal spending under pressure, which is that the institutions responsible for pricing, replenishing, and appropriating money for a national emergency are not actually very good at doing any of those three things cleanly, and the emergency itself becomes the cover under which the sloppiness gets funded rather than fixed.

    DLA will eventually raise prices again to cover this year’s hole, quietly, in a future fuel bill nobody will connect back to Iran. The interceptors will eventually get rebuilt, five years and several billion dollars from now, for a war that may or may not arrive, against an adversary far better supplied than the one that just emptied the shelves. And Penn Station, whatever its architectural merits, will get built partly on the strength of a line item that borrowed its urgency from a war eight time zones away that had nothing whatsoever to do with commuter rail. Add it up and the pattern is not corruption in any prosecutable sense. It is simply what a bureaucracy does when nobody outside it is required to check the receipts before the money moves.

    Sources: Congressional Budget Office, Cost of Operation Epic Fury (September 2026); CSIS, Last Rounds: Status of Key Munitions After the Iran War Ceasefire; Office of Management and Budget, June 24, 2026 supplemental funding request letter to Speaker Johnson. See also: Congress Asked the Pentagon What the War Costs. The Pentagon Didn’t Pick Up.

    Fediverse Reactions

  • The $215 Million Quantum Race That Took Washington a Decade to Build

    The Quantum Genesis Files, Part One

    DOE wants a fault-tolerant quantum computer by 2028. The competition announced this week is only the newest piece of a federal research, benchmarking and industry partnership effort years in the making.

    The Department of Energy wants someone to build a quantum computer that actually works.

    Not merely one with an impressive number of qubits attached to its name. Not another experimental machine capable of demonstrating that quantum computing remains theoretically fascinating. DOE wants a fault-tolerant computer capable of performing useful scientific work, and it wants the first generation of that machine demonstrated by 2028.

    On September 17, DOE announced the Quantum Genesis Q Competition, offering up to $215 million in planned funding to private companies capable of reaching a series of increasingly difficult milestones.

    The headline number is substantial. The history behind it is considerably larger.

    The competition is the latest step in an effort DOE has been developing for more than a decade, moving gradually from asking whether quantum computers could be useful for federal science to preparing an independent government apparatus capable of determining whether industry has finally built one.

    From Physical Qubits to Useful Ones

    Quantum computing has suffered from an inconvenient problem for anyone trying to explain its progress. Qubit counts sound impressive without necessarily telling anyone how useful a machine is.

    Physical qubits are notoriously susceptible to errors. Environmental interference, imperfect controls and the delicate nature of quantum states can corrupt calculations long before a useful computation is completed.

    A logical qubit attempts to solve that problem by encoding quantum information across physical qubits using error correction. The objective is not simply to possess more qubits. It is to possess qubits reliable enough to keep calculating.

    DOE’s new competition therefore targets machines with at least 100 logical qubits capable of performing hundreds of millions of fault-tolerant operations.

    Companies reaching that threshold will be eligible to share a $100 million incentive pool. DOE has established another $50 million pool for competitors reaching 150 logical qubits and another $50 million for systems reaching 200.

    Before any of that happens, Phase I offers individual competitors up to $1.5 million for earlier milestones.

    There is, however, an important budgetary asterisk.

    The $215 million is planned funding, not $215 million already sitting in an account waiting to be distributed. DOE says only $2.5 million comes from fiscal year 2026 funding. The remainder is dependent upon future congressional appropriations.

    Applications are due October 19.

    DOE Did Not Arrive Here Overnight

    To understand why DOE thinks a machine like this might exist by 2028, it helps to travel back to Bethesda, Maryland, in February 2015.

    DOE’s Advanced Scientific Computing Research program convened a Workshop on Quantum Computing for Science.

    The question then was much more fundamental.

    Could quantum computing technologies eventually address computational problems relevant to DOE’s scientific and energy missions?

    The resulting report examined quantum simulation, physical sciences, applied mathematics, linear algebra, graph theory and machine learning. More importantly, it identified how much research still stood between quantum computing as an intriguing technology and quantum computing as a useful scientific instrument.

    That distinction has driven much of what followed.

    DOE convened a Quantum Testbeds Stakeholder Workshop in 2017. It subsequently funded quantum testbeds, application research and the Accelerated Research in Quantum Computing program. In 2023, another Basic Research Needs workshop in Quantum Computing and Networking examined problems including algorithms, benchmarking, verification and error resilience.

    The vocabulary evolved as the machines did.

    Eventually the question was no longer whether quantum computing might matter.

    It became how the government would know when it did.

    The Blueprint

    That evolution culminated this year in DOE’s Blueprint for DOE Quantum Supercomputing.

    The Blueprint was developed by DOE laboratories with what the Department describes as significant contributions from academia and industry. It establishes a strategy for developing fault-tolerant quantum computers capable of solving scientific problems beyond the reach of even the most powerful conventional supercomputers.

    DOE calls that threshold scientific utility.

    That phrase is important because it changes the measurement of success.

    A machine does not become scientifically important merely because a manufacturer announces another qubit record. DOE’s target is useful computation.

    The Blueprint calls for initial scientifically relevant quantum-computing capabilities by 2028, followed by larger production-scale systems in the 2030s.

    DOE then formally launched Quantum Genesis in June, organizing the initiative around three components.

    One is the Q Competition now underway.

    Another is a planned National Quantum Supercomputing User Facility intended to give American scientists access to advanced quantum systems and integrate those machines with DOE’s conventional high-performance computing infrastructure.

    The third is research into scientific applications that could actually make use of the machines.

    In other words, DOE is not envisioning quantum computers replacing its supercomputers.

    It wants them working together.

    Trust, but Verify the Qubits

    There is another part of this week’s announcement that received considerably less attention than the $215 million headline.

    DOE simultaneously announced a Quantum High-Performance Computing Validation and Verification Testbed Lab Call.

    The Department plans to provide another $45 million to its National Laboratories to establish tools for independently evaluating the machines entered in the competition.

    Of that amount, $14 million is FY2026 funding. The remainder, like most of the Q Competition funding, depends upon future appropriations.

    The validation program is supposed to examine virtually the entire quantum computing stack, including physical hardware, quantum gates, logical architectures, algorithms, scientific applications and classical control systems.

    That means DOE is doing something considerably more interesting than offering prizes for impressive specifications.

    It is building the referee at the same time it organizes the race.

    Competitors will have to demonstrate their machines to government evaluators rather than simply provide their own performance claims. DOE wants verification of logical error rates, gate performance, computational depth and scientific workflows.

    The arrangement represents the culmination of another thread running through DOE’s quantum research.

    Government researchers have spent years developing benchmarks, testbeds and performance-assessment techniques precisely because competing quantum architectures can be extraordinarily difficult to compare.

    DOE now intends to apply that expertise to machines competing for federal money.

    A Computer Looking for a Scientific Problem

    The Department has already identified the general territory where it expects quantum computing to matter.

    Chemistry is one obvious candidate. Molecules themselves obey quantum mechanics, making sufficiently complex molecular systems extraordinarily difficult to simulate using conventional computers.

    Materials science presents similar opportunities.

    DOE also identifies plasma physics, high-energy physics, nuclear physics and applied mathematics among the potential beneficiaries.

    But the Department is trying to avoid building an exotic machine and only afterward asking scientists what they might do with it.

    Quantum Genesis instead calls for scientific applications to develop alongside the hardware. National Laboratories, universities and industry partners are supposed to identify problems that can eventually become demonstrations of scientific utility.

    That is an important departure from treating quantum computing primarily as a hardware competition.

    The machine and the scientific mission are supposed to meet somewhere in the middle.

    The Starting Gun Is Not the Beginning

    Seen in isolation, the September 17 announcement looks like a new $215 million federal technology competition.

    Seen against the documentary history, it looks more like the moment DOE decided that more than a decade of research had advanced far enough to start demanding results.

    In 2015, DOE was assessing whether quantum computing could meaningfully serve its scientific mission.

    By 2017, it was studying testbeds and methods for comparing technologies.

    By 2023, benchmarking, verification and error resilience had become explicit research priorities.

    The 2026 Blueprint established scientifically useful fault-tolerant computing as the objective and 2028 as the initial deployment target.

    Now money is attached to the milestones.

    Even the money, however, requires some perspective.

    Quantum Genesis does not begin with this week’s $215 million announcement. DOE explicitly says the initiative builds upon longstanding federal investments in quantum information science, including the National Quantum Information Science Research Centers created under the National Quantum Initiative.

    Those investments, along with programs elsewhere in the federal government, have helped build the laboratories, researchers, partnerships, technologies and companies that now make a competition like Quantum Genesis possible.

    That raises a different accounting question.

    When companies line up to compete for DOE’s $215 million, how much federal support will already be standing behind them?

    That is where the quantum race gets considerably more interesting.

    Sources: DOE, Quantum Genesis Q Competition announcement (September 17, 2026); DOE, Quantum Genesis initiative launch (June 2026); DOE, Blueprint for DOE Quantum Supercomputing; DOE ASCR, Workshop on Quantum Computing for Science (February 2015).

    Fediverse Reactions

  • One Email Can Still Turn the National Labor Relations Board Off

    Late on January 27, 2025, a National Labor Relations Board member named Gwynne Wilcox got an email from a White House staffer telling her she was fired, effective immediately. No hearing. No stated cause. Her term ran to August 2028. The National Labor Relations Act says a Board member “may be removed by the President, upon notice and hearing, for neglect of duty or malfeasance in office, but for no other cause.” None of that happened. What happened instead is that a labor enforcement apparatus covering the entire private sector stopped working, by design, because of how few people it takes to make it stop.

    The Quorum Is the Whole Point

    The NLRB has five seats, but the Act requires three members present to do anything at all, per Section 3(b), and the Supreme Court made that requirement absolute in New Process Steel v. NLRB (2010), tossing out roughly 600 decisions a two-member Board had issued over 27 months on the theory that two was close enough. It was not. So when Wilcox’s seat emptied, the Board had two members left. Below quorum, the agency cannot certify a union election, cannot rule on an unfair labor practice charge, cannot seek a 10(j) injunction against an employer firing organizers mid-campaign. It can receive filings. It cannot decide them.

    This is worth sitting with, because it means removing one person, out of five, on a board that oversees private-sector labor relations for the entire country, is functionally the same as abolishing the agency for as long as the seat stays empty. Congress built in that fragility assuming no president would exploit it. That assumption did not survive contact with 2025.

    The Ninety Year Old Fence Comes Down

    Wilcox sued. In March 2025, Judge Beryl Howell reinstated her, writing that the removal was “blatantly illegal,” leaning on Humphrey’s Executor v. United States (1935), the case letting Congress insulate agency heads like FTC and NLRB members from at will removal for nine decades. The government appealed. In April 2025, the Supreme Court granted an emergency stay letting the firing stand, without yet deciding the underlying question, but noting the NLRB wields “considerable executive power,” a phrase that told you exactly where this was going more than a year before the Court said so on the merits.

    By December 2025, the D.C. Circuit obliged, ruling that NLRB removal protections violate Article II, consolidated with a companion case over the Merit Systems Protection Board. Then in June 2026, the Court delivered Trump v. Slaughter, tossing Humphrey’s Executor out entirely and holding that anyone who exercises executive power (adjudicating cases, writing binding rules, suing on the government’s behalf) has to be removable at the President’s will. The FTC lost its removal protections that day. The MSPB’s cert petition was denied the next. And this September, the Solicitor General filed a brief telling the Court that Wilcox’s case is moot for the same reason, since the NLRB does the identical three things (adjudicates, rules, sues) that got the FTC stripped of its tenure protections. DOJ wants cert denied outright, or granted and summarily affirmed, because there is nothing left to argue.

    The Federal Reserve Gets to Keep Its Fence

    Here is the detail that belongs in the lede of somebody’s dissertation someday. On the same day the Court decided Slaughter, a different lineup of justices decided Trump v. Cook, holding that the Federal Reserve’s Board of Governors is not subject to the same logic, and its removal protections survive. Same Court, same day, same constitutional text, opposite outcome, because the majority drew a line around the one institution whose independence bond markets actually price. The NLRB, which decides whether a shop steward gets reinstated, did not make the cut. The body that sets interest rates did. If “executive power” were a neutral legal category rather than a permission slip issued selectively, you would expect it to catch both agencies or neither. It caught the one nobody holding a bond portfolio would tolerate touching.

    Every Future President Now Owns a Switch

    Strip away the doctrinal packaging and what Slaughter hands the next several administrations, of either party, is a standing option. Dislike how an independent board is ruling, and you no longer need Congress to restructure it. Fire one member below quorum and the agency goes dark until you nominate a replacement, on your own schedule. The NLRB is uniquely exposed here because its quorum floor is so low relative to its seat count, three of five, that a single vacancy (whether from resignation, expiration, or a late-night email) can freeze it entirely. The FTC carries the same removal exposure now but a sturdier quorum structure, so it does not fail as cleanly. The NLRB does.

    Wilcox’s case will likely end quietly, denied or summarily affirmed, exactly as DOJ has asked, because the fight over the underlying constitutional question is already over. What is not over is the operational fact this litigation exposed almost as an aside. An agency built to arbitrate between employers and organized labor can be switched off by any president willing to fire one person and wait. Nobody had to rewrite the National Labor Relations Act to accomplish that. They just had to win a case about somebody else’s agency.

    Sources: National Labor Relations Act, 29 U.S.C. § 153; New Process Steel v. NLRB, 560 U.S. 674 (2010); Supreme Court emergency stay order, April 9, 2025; Solicitor General brief, Wilcox v. Trump (September 2026).

    Fediverse Reactions

  • Three Years Running, America’s Postal Watchdog Fails Its Own Report Card

    The Postal Regulatory Commission exists to keep an eye on the U.S. Postal Service. It reviews rate cases, audits service performance, and generally plays the part of the adult in a building full of trucks that don’t show up. So there is a certain poetry in the fact that, for the third consecutive year, the federal government’s own auditors have looked at the Commission’s cybersecurity and concluded, gently but repeatedly, that nobody is minding the store.

    The latest FISMA compliance audit, performed by KPMG under contract to the USPS Office of Inspector General, rates the PRC’s information security program as “Defined,” which is a polite way of saying Level 2 out of 5, which is a polite way of saying “Not Effective.” This is not a scandal in the sense of missing money or a whistleblower with a grudge. It is something more diagnostic of how the federal government actually runs, a quiet, well documented, thoroughly bureaucratic failure to do the basics, year after year, at an agency too small to notice and too obscure for anyone else to either.

    Groundhog Day in Arlington

    Start with the scorecard. In FY2024, the PRC scored Ad-hoc, the bottom rung, across all five cybersecurity functions then in use. In FY2025, it climbed to Defined, still “Not Effective,” but at least off the floor. This year, the agency improved further in three of six functions (Protect, Detect, and Recover all reached “Consistently Implemented”), while a newly added function called Govern, covering leadership and accountability for the whole program, opened at Ad-hoc, dead last, on its very first outing.

    That last detail is the one worth sitting with. The PRC has now had three straight audits, and the one category that measures whether the agency’s leadership has actually organized itself to manage cybersecurity risk is doing worse than areas the agency has had years longer to fix. Progress is real. It is also lopsided in a way that suggests the operational fixes are outrunning the institutional ones, which is what happens when an agency patches whatever the last audit complained about without building a structure to catch the next problem before an auditor finds it.

    There is also a quieter trick in the recommendation tracking. KPMG’s own appendix shows several findings “closed” in one year only to be “reissued” the next under a new recommendation number covering essentially the same gap. The FY2025 finding on cyber governance policy, for instance, gets closed in FY2026 and immediately reborn as a new recommendation about “cybersecurity current and target profiles,” a rename more than a resolution. Closure, in this accounting, means the paperwork changed forms, not that the underlying problem went away.

    The Chair Nobody Sat In

    If there is a single character in this story, it is the Chief Information Security Officer position, or rather its absence. The PRC’s first CISO departed in April 2024. The role sat vacant through the entirety of FY2025, run in the interim by the Chief Information Officer wearing a second hat, until a replacement finally started in August 2025, nearly a year and a half later. For a stretch in mid-2024, the Commission’s entire cybersecurity function, for an agency that hosts a public facing system processing regulatory filings, cost data, and PII, was staffed by one person.

    PRC management’s own explanation, offered without much embellishment across three consecutive audits, is that it is “a small agency with limited resources.” That is true as far as it goes. It also happens to be the same sentence, more or less, that management gave auditors in 2024 and again in 2025. A justification repeated for three years starts to function less like an explanation and more like a policy.

    Whose Money Is It, Anyway

    Here the story gets structurally interesting rather than merely sad, because the PRC does not control its own budget. By statute, the Commission submits its funding request to the USPS Board of Governors, which is to say, the leadership of the agency the PRC regulates, and the Governors may unilaterally cut the total by unanimous vote. The regulator’s paycheck is signed by the regulated.

    In September 2023, that is precisely what happened. The Commission requested roughly $22.6 million for FY2024; the Governors approved $21.1 million. Chairman Michael Kubayanda’s public statement on the cut warned it risked “eliminating positions in the understaffed agency” and “stopping long overdue technology upgrades,” and specified that the Commission was, at that moment, in the process of “establishing centralized databases, information management systems, and cybersecurity monitoring.” FY2024, recall, is the year the Commission’s cybersecurity program bottomed out at Ad-hoc across the board and the CISO walked out the door.

    The following year tells a more complicated story, and honesty requires including it. For FY2025, the Governors approved the Commission’s full $25.4 million request, no cut at all. Yet the CISO seat remained empty for the entire year regardless, filled only as FY2025 was closing out. So the money explains the disaster year reasonably well. It does not fully explain the second straight failing grade, which looks less like a budget problem and more like the ordinary friction of hiring a specialized federal position, a separate and more mundane kind of government dysfunction, but dysfunction all the same.

    Grading on a Curve

    None of this amounts to negligence or coverup. The PRC agreed with all nine of KPMG’s new recommendations this year, as it agreed with all of them the previous two years, and the underlying trend, Ad-hoc to Defined to a mix of Defined and Consistently Implemented, is genuine improvement by any honest reading. The agency went from a two person cybersecurity operation to six people in about two years. That is not nothing.

    What it is, instead, is a small case study in how “Not Effective” becomes a permanent institutional address rather than a temporary embarrassment. The fixes keep arriving with implementation dates a year or more out (several of this year’s nine recommendations are not due until September 2027), the governance layer keeps testing worse than the operational layers built under it, and the agency tasked with holding the Postal Service accountable spends its own compliance report explaining, once again, that it is small, understaffed, and doing its best. It probably is. The report just keeps saying so anyway.

    Sources: USPS OIG / KPMG, FY2026 Federal Information Security Modernization Act Audit of the Postal Regulatory Commission (Report 26-016-R26, September 2026); PRC Chairman Kubayanda statement on FY2024 budget cut.

    Fediverse Reactions

  • Four Audits, One Camera, and the Grade TSA Won’t Show You

    The Department of Homeland Security’s Inspector General wants you to know that TSA’s facial recognition program is basically fine. It also wants you to know that the part of the audit said to support that claim is classified, so you will have to take the agency’s word for it, which is the exact arrangement the entire program has run on since it started scanning faces at airport checkpoints.

    That is the honest summary of OIG-26-27, released September 15, 2026, and it is only the newest entry in a pile of oversight reports that keeps growing while the program itself keeps expanding unbothered.

    The Test You Are Not Allowed to Grade

    DHS OIG ran covert tests at airport checkpoints to see whether TSA’s facial recognition and identification technology actually catches fraudulent IDs and persons of interest, which is the entire stated justification for the program’s existence. The results produced three findings and six recommendations. TSA agreed with five and flatly refused the sixth. Two of the six recommendations remain open and unresolved months after the audit closed.

    And then, in the same paragraph, the report informs the reader that “additional details related to this part of our audit are classified or otherwise not available for public release.” No specifics on what the covert testers found, no breakdown of how often officers caught a fake ID versus missed one, nothing. The one part of this audit that speaks directly to whether the program works is the one part the public isn’t permitted to see.

    Security agencies classify testing methodology as a matter of course, and there’s a defensible argument for not publishing a how-to guide for beating a checkpoint. But an agency that non-concurs with one sixth of its own inspector general’s recommendations, on the classified section, is not asking for the benefit of the doubt so much as demanding it.

    The Vendor Who Let Itself In

    The unclassified half of the audit is more concrete, and worse. OIG examined how TSA’s Credential Authentication Technology 2 units, the kiosks that scan your driver’s license or passport at the podium, handle the biometric and biographic data they collect. Routine deletion practices checked out fine. The problem was the vendor.

    According to the audit, the CAT-2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and software enhancements, and TSA had no idea when this was happening. There was no policy governing it, no log tracking when data left the system, and no way to confirm the vendor actually deleted what it took. Passengers whose documents were pulled this way were never told.

    TSA concurred with all three recommendations attached to this finding, which sounds like accountability until you notice that one of the three is still listed as open and unresolved. The agency agreed a contractor had unsupervised access to your passport photo and still hasn’t finished fixing it.

    Three Watchdogs, One Stalled Bill

    This is not the first time someone has told TSA this. In May 2025, the Privacy and Civil Liberties Oversight Board released a staff report capping a six year review of the same program. Its headline finding was that DHS’s own Chief Privacy Officer never conducted the compliance review required under internal DHS policy, and that TSA has offered no schedule for when, or whether, that review will happen. PCLOB’s recommendations included independent public audits, a real privacy impact assessment, and mandatory demographic accuracy testing from vendors before deployment, not after.

    A year earlier, the Government Accountability Office reached a related conclusion from a different angle. GAO-24-106293 found that facial recognition accuracy has genuinely improved under laboratory conditions, but that almost nobody has rigorously studied how these systems perform in the field, across demographic groups, at the scale TSA is now deploying them. Improved in the lab and unverified in the wild is not the same claim as safe to use on the traveling public, though TSA’s messaging tends to obscure the difference.

    Meanwhile, TSA’s own public factsheet still describes the program in the language of pure customer service, as a security enhancement, a convenience, entirely voluntary, with no penalty for opting out and photos deleted after a match except in a limited testing environment.

    Every one of those assurances is now sitting next to an OIG finding about an outside vendor quietly copying passport images with nobody watching.

    The factsheet has not been updated to mention it.

    A Bill That Never Boards

    Congress has had an off ramp sitting on the table for three years and has yet to take it. Senator Jeff Merkley first introduced a bill to ban TSA facial recognition outright in 2023; it died without a vote. The current version, the Traveler Privacy Protection Act of 2025, S.1691, is considerably softer, restricting rather than banning the technology, requiring a non-biometric alternative at every checkpoint, and limiting how long TSA can retain the data it collects. It has bipartisan cosponsors and has gone precisely nowhere since being referred to committee, a fate Merkley’s own office has spent years narrating in press releases that read increasingly like dispatches from a stalemate.

    Put the four documents side by side and a pattern appears that no single report captures on its own. An inspector general audits the program and classifies the part that would tell the public whether it works. A privacy oversight board spends six years concluding that the agency responsible for auditing itself never actually did so. A government watchdog finds the underlying technology has been tested in laboratories but not in the world it is actually deployed in. And a bill written to address all three problems sits untouched in committee while the program it would constrain keeps expanding to more airports every year.

    None of this requires a conspiracy. It only requires an agency confident enough in its own mission that it treats oversight as a formality to be managed rather than a question to be answered, and a Congress content to keep writing reports about the problem instead of legislating one out of existence. TSA is not hiding a coverup. It is doing something more mundane and more durable: it is simply outlasting everyone who asks it to explain itself.

    Sources: DHS OIG, OIG-26-27: TSA’s Use of Facial Recognition Technology (September 2026); Privacy and Civil Liberties Oversight Board, Use of Facial Recognition Technology by TSA (May 2025); GAO-24-106293, Facial Recognition Technology: TSA Should Establish Goals and Measures for Evaluating the Impact on Screening (2024); TSA Facial Recognition Technology factsheet; S.1691, Traveler Privacy Protection Act of 2025.

    Fediverse Reactions

  • Congress Asked the Pentagon What the War Costs. The Pentagon Didn’t Pick Up.

    There is a particular kind of silence that only a cabinet department can produce. It is the silence of an institution that has decided the question does not deserve an answer. That is the silence the Congressional Budget Office ran into this year when it tried to price out Operation Epic Fury, the American military campaign against Iran that began on February 28, 2026. Ranking Budget Committee Member Brendan Boyle had asked CBO in March for a nonpartisan number. CBO went looking for one. The Department of Defense, according to CBO’s own letter, simply did not respond to the agency’s requests for information.

    The Silent Treatment

    This is worth sitting with. CBO is not a partisan attack shop; it is the body Congress built specifically so that both parties could agree on a baseline set of facts before arguing about what to do with them. When the agency needed to price out five categories of wartime cost, from expended Tomahawks to increased flying hours, it did not get so much as a courtesy briefing from the department actually fighting the war. Instead, CBO had to reconstruct DoD’s own costs using government databases, public reporting, and a private think tank’s homework, principally a CSIS analysis of munitions inventories that CBO cites as its best available source for how many missiles the Pentagon actually fired. An agency of Congress was reduced to citing a nonprofit’s guesswork about the executive branch’s own arsenal, because the executive branch would not tell it.

    CBO is admirably restrained about what this means. It notes, in the driest possible register, that its resulting estimate of $38.1 billion “is subject to considerable uncertainty.” That sentence is doing a great deal of work. It is bureaucratic for “we had to estimate a war.”

    Four Different Prices for the Same War

    Having built its own number from the wreckage of DoD’s silence, CBO then had the pleasure of comparing it against the three numbers the administration offered instead, none of which agree with each other. In June, the Office of Management and Budget sent House Speaker Mike Johnson a formal request for $87.6 billion in supplemental funding, of which the portion CBO judges directly attributable to the conflict comes to $42.3 billion, about 10 percent above CBO’s own figure. Then, on July 22, Secretary of Defense Pete Hegseth testified before the Senate that the war had cost $37.5 billion. Two weeks after that, without public explanation, DoD quietly revised its own munitions figure upward from $25 billion to $27.7 billion in a briefing to committee staff, nudging its total higher still.

    So Congress has, at various points this year, been handed four figures for the price of the same war: CBO’s $38.1 billion, the administration’s implied $42.3 billion, Hegseth’s sworn $37.5 billion, and DoD’s own quiet revision on top of that.

    Outside government, independent estimators landed in roughly the same neighborhood without any of them matching either. CBO’s letter notes that nongovernmental groups tend to publish still-higher totals, generally because they extrapolate from the war’s expensive early days or fold in costs CBO deliberately excluded, and separate think tank tallies circulating this year ranged anywhere from the low thirties to the high forties of billions, depending on which week’s fighting a given analyst used as a baseline. None of these numbers are wild outliers from one another, which is almost the most unsettling part; they are close enough to look authoritative and different enough to be unreconcilable, produced by an executive branch that cannot seem to settle on its own arithmetic even while testifying under oath about it.

    A Receipt With Twelve Billion Dollars Redacted

    The gap between CBO’s number and the administration’s supplemental request is not just noise, though. Of the $67.1 billion the administration requested for DoD, CBO could only trace $42.3 billion to activity plausibly connected to Operation Epic Fury. The remaining $24.8 billion sits in categories CBO’s letter describes as largely opaque to it, including $5.1 billion for “cybersecurity and autonomy,” $4 billion for something called the Airborne Moving Target Indicator and Space Data Network Backbone, and $12.1 billion filed simply as “other, classified.” CBO goes out of its way to note that prior wartime supplemental requests, for Iraq and Afghanistan, never buried this large a share of the ask behind a classification stamp. A Congressional Research Service review of the same request separately flagged that OMB’s letter and its enclosures did not provide enough detail even for Congress to determine whether some of this money duplicates the department’s ordinary FY2027 budget request, meaning lawmakers may be asked to fund the same missiles twice under two different labels.

    Classified line items are standard practice. A classified third of a wartime supplemental is not, and it lands at the exact moment Congress is least equipped to examine it, because the one agency built to do that could not get DoD on the phone.

    What the Ledger Won’t Say

    CBO’s letter is, in its understated way, a small monument to institutional failure operating at two levels simultaneously. At the surface level, a department at war would not answer basic cost questions from its own legislature’s scorekeeper. Underneath that, the numbers the administration did produce cannot be reconciled with each other, let alone independently verified, and a meaningful fraction of the request has been placed beyond scrutiny entirely. Congress is being asked to appropriate tens of billions of dollars on the strength of a request that its own budget office had to partially reverse-engineer from a think tank report, while a rotating set of official figures drift a few billion dollars apart from each other every few weeks.

    Nobody involved has lied, exactly. Nobody involved has really told the whole truth either, and the agency built to notice the difference had to work the case with the lights half off. That is not a small failure of paperwork. It is what happens when the one branch of government legally entitled to ask “what did this cost” gets treated like a nuisance caller, and the answer it eventually publishes has to carry a footnote admitting it is mostly an educated guess about a war still being fought.

    Sources: Congressional Budget Office, Cost of Operation Epic Fury (September 2026); Rep. Boyle’s March 2026 CBO request letter; CSIS, Last Rounds: Status of Key Munitions After the Iran War Ceasefire; OMB June 24, 2026 supplemental request to Speaker Johnson; Congressional Research Service, IN12700. See also: The Pentagon’s Own Gas Station Is Losing Money on Every Gallon

    Fediverse Reactions