Category: National Security & Defense

  • DOD Cut Its Civilian Workforce. GAO Says It Hasn’t Assessed What Happened at Remote Bases

    The Pentagon spent much of 2025 reducing its civilian workforce. At some of the military’s hardest places to staff, the consequences included closed youth programs, reduced services, depleted housing offices and positions that could already take more than a year to fill.

    There is just one problem.

    According to a new Government Accountability Office report, the Department of Defense has not specifically assessed what those workforce reductions did to critical services at remote and isolated military installations.

    GAO examined civilian staffing and services including health care, housing, child care, education, morale and recreation, and military-spouse employment at nine installations. The audit found that remote installations already faced substantial recruiting and retention problems before the latest workforce reductions.

    Then came 2025.

    GAO identified three major federal workforce actions affecting the installations it examined: the federal and DOD hiring freezes, the Deferred Resignation Program and DOD-directed staffing reductions. Installation officials told auditors those actions affected their ability to hire and retain workers needed to provide critical services.

    The numbers suggest DOD was hardly beginning with an abundance of spare personnel.

    Across the nine installations examined, GAO counted 624 vacant critical-support positions during fiscal years 2023 through 2025. Eielson Air Force Base in Alaska accounted for 428 of them. Naval Air Station Key West had 95 vacancies, while the Marine Corps Air Ground Combat Center at Twentynine Palms had 83.

    Filling those jobs could take considerably longer than ordering the furniture for their offices.

    DOD had established a baseline of 98 days for hiring civilian personnel. GAO found that Eielson averaged 407 days. White Sands Missile Range averaged 212 days, Cannon Air Force Base 199, Fort Wainwright 194 and Holloman Air Force Base 158.

    All but one of the installations for which GAO could calculate hiring times exceeded DOD’s 98-day baseline.

    The reasons are not particularly mysterious.

    Officials told GAO that remote installations compete against private employers offering better wages and must convince prospective employees to move somewhere with fewer services and amenities. Alaska installations reported losing prospective engineers and cooks to higher-paying oil and gold-mining jobs. At NAS Key West, officials said child-care job announcements remain continuously open because workers are constantly needed.

    DOD installations have tried bonuses and other incentives to compensate. That produces its own peculiar arithmetic.

    At some installations, recruitment and retention incentives come from the same account used for civilian salaries. Cannon officials told GAO that an installation with enough funding to hire 10 workers might be able to hire only six or seven after paying the incentives necessary to attract them.

    Then the workforce reductions arrived.

    GAO found tangible consequences across the installations it visited. Staffing shortages contributed to reduced morale, welfare and recreation programs, shortened operating hours and facility closures. At Fort Greely, officials planned to close the dining facility for certain meals because there weren’t enough employees to operate it full time. GAO noted that alternatives both on and off the installation were extremely limited.

    Child care took a hit as well.

    Officials at Holloman, Fort Wainwright, NAS Key West and Twentynine Palms told GAO that staffing shortages resulted in closures or reduced hours for child-care or youth programs. The DOD Inspector General had already identified the department’s difficulty providing quality child care as one of its top management and performance challenges for fiscal 2026.

    Housing and medical services present another problem because there may be no practical alternative outside the gate.

    At NAS Key West, anything beyond basic medical care can require a trip to Miami, more than 150 miles away and more than three hours by car. Officials told GAO that staffing at the installation clinic is thin enough that when personnel are sick or on leave, services can shut down.

    At Fort Greely, insufficient primary care means referrals to Bassett Army Hospital, requiring a one-way trip exceeding 100 miles, including during an Alaska winter that officials noted lasts more than six months.

    The consequences can reach beyond inconvenience.

    GAO found that inadequate medical services can cost military personnel duty time and therefore affect operational readiness. At Cannon Air Force Base, officials reported approximately 12,400 referrals outside the military health system in fiscal 2025 alone and about $587,000 in reimbursable patient travel expenses. The Defense Health Agency spent $28 million for medical care outside Cannon during fiscal years 2024 and 2025.

    Against that backdrop, GAO found DOD has not collected specific lessons learned about how its recent civilian workforce reductions affected remote and isolated installations.

    That matters because DOD doesn’t even have a settled enterprise-wide picture of which installations belong in that category. The Army and Navy completed new remote-and-isolated designation lists in May 2026. The Air Force did not, arguing that designation without additional resources or authorities would provide little benefit and that critical-service shortages were systemic throughout the service.

    GAO made two recommendations. One calls for DOD to establish a clear definition of a remote and isolated installation. The other calls for the department to specifically examine lessons learned from civilian workforce reductions at those locations.

    DOD concurred with both.

    The larger problem documented by GAO is therefore fairly simple.

    Remote installations were already difficult to staff. Some civilian positions already took months, or more than a year, to fill. Medical care could require hundreds of miles of travel. Child-care programs were vulnerable to shortages. And some bases had few alternatives when an on-base service disappeared.

    DOD then reduced the civilian workforce.

    Now GAO is asking the department to determine what happened next.

    Fediverse Reactions
  • Pentagon Spent Decades and Billions Hardening GPS. The Military Still Isn’t Ready to Lose It.

    A $6.27 billion replacement GPS control system was canceled this year, aircraft receivers remain years away, and GAO says fragmented Pentagon management is hampering efforts to protect U.S. forces from a threat already demonstrated in Ukraine.

    WASHINGTON — For more than two decades, the Pentagon has been trying to solve a problem that has since stopped being hypothetical.

    America’s military depends heavily on the Global Positioning System to navigate ships, aircraft and vehicles, coordinate communications and guide precision weapons. Adversaries have meanwhile demonstrated that GPS signals can be jammed, spoofed or otherwise disrupted.

    The Department of Defense has spent tens of billions of dollars trying to make that system harder to defeat and developing alternatives for when it is.

    According to a new Government Accountability Office report released Tuesday, considerable work remains.

    GAO describes GPS as the military’s principal source of positioning, navigation and timing information, but also warns that the Pentagon’s dependence on it creates a potential “single point of failure.” The department has spent more than 20 years developing a more secure and jam-resistant military GPS signal known as M-code, yet modernization has repeatedly encountered delays across satellites, ground-control systems and the equipment necessary for weapons and military platforms to actually use the signal.

    The stakes are no longer confined to acquisition schedules.

    Russia has used GPS jamming during the war in Ukraine to degrade some U.S.-provided precision-guided munitions, according to GAO, while both Russia and Ukraine have used spoofing to interfere with legitimate GPS signals.

    Research cited by GAO found intensified GPS jamming in eastern Ukraine reduced the effectiveness of one type of GPS-dependent precision-guided munition by as much as 80 percent. Another munition remained disrupted as much as 40 percent of the time even after countermeasures were employed.

    The Pentagon is therefore racing not merely to improve GPS, but to ensure American forces can continue operating when GPS is unavailable.

    It is doing so while still trying to finish a modernization effort that began around the turn of the century.

    Satellites Since 2005, Receivers Still Coming

    The military’s M-code capability depends upon three pieces working together: satellites capable of transmitting the signal, a ground system capable of controlling the constellation, and receivers installed in weapons and military equipment capable of using it.

    The first M-code-capable GPS satellites have been in orbit since 2005.

    Development of the Next Generation Operational Control System, known as OCX, began in 2010. Development of newer receiver equipment began in 2017.

    Previous GAO investigations have documented schedule delays reaching a decade or longer and cost increases reaching billions of dollars.

    The government watchdog was raising alarms about OCX by at least 2015, when it reported persistent cost and schedule growth, a high defect rate and concerns that unrealistic estimates were limiting Pentagon oversight. GAO’s 2015 report is available here.

    Eleven years later, the Pentagon pulled the plug.

    The Space Force formally accepted OCX from contractor Raytheon in July 2025 following years of development and testing. But acceptance came with waivers and deviations related to technical shortcomings.

    Among them was an unmet requirement involving “time-steering,” the mechanism used to maintain accurate time dissemination through the GPS constellation. Pentagon testing officials also considered the system’s cyber survivability a high-risk area requiring continued mitigation and investment.

    Integrated testing then uncovered still more problems.

    Space Force officials later said the difficulties spanned numerous capability areas and potentially put existing military and civilian GPS capabilities at risk.

    By January 2026, the government had spent approximately $6.27 billion on OCX, including Raytheon funding and government testing and program-support costs.

    Three months later, DOD canceled it.

    Space Force concluded that attempting to complete OCX posed greater risk than continuing to upgrade the GPS control system that OCX had been designed to replace. The Space Force’s account of the termination is available here.

    The Pentagon had effectively spent years and billions developing a replacement for its old GPS control system, accepted that replacement with unresolved deficiencies, and then concluded that modernizing the old system was the safer option.

    The Replacement for the Replacement

    DOD is now pursuing what it calls Architecture Evolution Plan Modernization, or AEP-M, a multiphase modernization of the existing GPS Operational Control Segment.

    But changing direction carries consequences of its own.

    The Space Force had planned to use OCX capabilities to launch, check out and operate the next generation of GPS IIIF satellites. Those satellites and their software were being prepared around OCX.

    Now the existing control system has to be modified to handle them instead.

    GAO says the decision creates schedule risk for incorporating the new satellites into the GPS constellation. The first ten GPS IIIF satellites were already averaging nine months of delay against a revised December 2024 delivery schedule as of September.

    The first satellite was projected for delivery in July 2027, while ground-control capability is needed in time to support planned launches beginning in 2028.

    It is another dependency in a modernization program full of them.

    And satellites that can broadcast M-code are only useful if American weapons can receive it.

    Aircraft Remain a Problem

    GAO found that development and fielding of M-code receiver equipment continue to face software, funding, technical and integration problems, particularly aboard aircraft.

    Integrating the new receivers into aircraft requires tying them into flight software and satisfying airworthiness requirements, making aviation among the most difficult pieces of the modernization puzzle.

    One Air Force program, the Embedded GPS Inertial Navigation System-Modernized, or EGI-M, lost one of its contractors after the company failed to provide what officials considered a realistic updated development schedule.

    The remaining contractor underestimated the complexity of software associated with security and airworthiness certification, according to GAO.

    Funding shortages created another problem: the contractor could not maintain the staff necessary to complete development on schedule.

    Production decisions for EGI-M variants used by the Navy’s E-2D and Air Force F-22 are now estimated for mid-2028. A decision on the F/A-18 variant is projected for 2030.

    Initial EGI-M fielding is expected in March 2032.

    The Navy, meanwhile, is developing an interim receiver to provide M-code capability to aircraft while it waits for the longer-term system.

    There has been progress elsewhere. The Army and Navy are fielding M-code-capable and multi-PNT receivers in some ground vehicles, ships and Army aircraft, and all the services are pursuing systems capable of combining GPS with alternative navigation information.

    Those alternatives are becoming increasingly important.

    When GPS Goes Dark

    DOD is building what amounts to a navigation toolbox for a battlefield where GPS can no longer be assumed.

    Some systems would obtain positioning signals from satellites in low-Earth orbit. Others could navigate without satellites at all.

    Inertial systems measure a vehicle’s direction, acceleration and orientation. Visual-navigation systems compare camera imagery against stored maps. Other technologies navigate by comparing measurements against maps of Earth’s magnetic or gravitational fields.

    Still others look upward.

    Modernized celestial-navigation systems can determine location using stars, planets and even artificial satellites whose orbits are known.

    The Pentagon is also deploying backup timing systems, including regional clocks and increasingly small atomic clocks, because disruption of GPS can affect far more than knowing where a vehicle is located. Loss of GPS timing can interfere with military communications and networking.

    Relatedly, a previous Bureaucracy Times investigation examined how the Pentagon audits the clocks that underpin GPS timing and what details remain classified.

    GAO’s illustration on page 22 depicts the intended result: GPS satellites operating alongside low-Earth-orbit constellations, celestial navigation, inertial sensors, visual navigation, magnetic and gravity navigation and alternative timing sources while adversaries attempt jamming, spoofing, cyberattacks and direct attacks against satellites.

    The technology exists in various stages of maturity.

    Getting all of it into the right weapons at the right time appears to be another matter.

    Everyone Is in Charge

    That may be the most consequential finding buried inside GAO’s highly technical report.

    Congress created a Positioning, Navigation and Timing Oversight Council to coordinate DOD’s sprawling PNT enterprise. But individual military services retain authority over the budgets funding their respective programs.

    The council can establish priorities and make recommendations.

    The services control the money.

    GAO found that this fragmented structure makes it difficult to synchronize programs that depend upon one another.

    A receiver card might be developed by one organization. Another program develops the receiver containing it. A military service then has to integrate that receiver into an aircraft, ship or vehicle. Munitions fired by those platforms may operate on yet another modernization schedule.

    The result can be technologically sophisticated pieces arriving at different times.

    Internal meeting records reviewed by GAO show that the problem has not gone unnoticed.

    Officials discussed inadequate Air Force funding for aviation receiver programs, and program officials attributed missed development goals partly to “chronic underfunding.”

    At a May 2025 PNT Oversight Council meeting, one official identified what may be the simplest description of the organizational problem: there was a need to “designate a single owner to the entire PNT value chain.”

    DOD has since consolidated several aviation receiver and M-code efforts into an Air Force-managed joint program office. GAO found that consolidation has produced closer reviews of costs, schedules, technical risks and performance and could serve as a model elsewhere.

    But the broader enterprise remains fragmented.

    GAO concluded that under the existing structure, DOD “lacks reasonable assurance” that its PNT investment decisions are addressing pressing warfighting needs.

    Two Decades of Warnings

    The new report does not arrive in isolation.

    GAO warned in 2021 that M-code remained years from widespread use and that receiver delays were producing ripple effects across weapons programs. Read GAO-21-145.

    In 2022, auditors found that Pentagon databases used to manage GPS modernization contained incomplete or inaccurate information. DOD was ultimately planning to integrate modernized GPS equipment into roughly 700 weapon systems, making reliable schedules and coordination particularly important. Read GAO-22-105086.

    In 2023, GAO again reported ground-system delays and questioned other portions of the modernization strategy. Read GAO-23-106018.

    And in September 2024, GAO reported that significant challenges remained across the space, ground and user-equipment segments of the modernization effort. Read GAO-24-106841.

    Two years later, the ground system examined in those reports no longer exists as a development program.

    GAO’s latest report puts the broader history in unusually stark terms: DOD has worked for more than two decades and spent tens of billions of dollars laying the foundation for fully modernized GPS and complementary navigation systems, yet “considerable work remains” before those capabilities are fielded.

    GAO issued three recommendations calling on the Army, Navy and Air Force to assess where GPS modernization and complementary PNT programs should be consolidated and to develop consolidation plans where doing so would improve strategic alignment.

    DOD agreed with all three recommendations.

    The Army maintains that its modernization efforts are already well coordinated and that it has found no duplication, but told GAO it will participate in a broader Pentagon assessment and develop a consolidation plan where appropriate.

    The Navy and Air Force likewise agreed to examine consolidation.

    The technology race, meanwhile, is unlikely to wait for the organizational chart.

    The Pentagon began developing a GPS signal resistant to jamming more than two decades ago. The first satellites capable of transmitting it reached orbit in 2005. Since then, wars have supplied real-world evidence of what happens when precision weapons encounter an enemy capable of interfering with satellite navigation.

    The United States now possesses satellites broadcasting the hardened signal, weapons waiting for modernized receivers, alternative navigation technologies under development and a new program to upgrade the old ground-control system after abandoning its $6.27 billion replacement.

    What it still does not have, according to GAO, is assurance that all those pieces will arrive where they are needed when the next battlefield starts interfering with GPS.

    Sources

    Fediverse Reactions
  • Washington Launches an Andes-Atlantic Corridor. The Bigger Story Is What Will Move Through It

    The State Department announced a new economic corridor with Argentina this week, complete with railways, pipelines, ports, power lines, digital infrastructure and potentially billions of dollars in U.S.-backed financing.

    But the most interesting thing about the Andes-Atlantic Corridor may not be the infrastructure.

    It is what Washington wants moving through it.

    The United States and Argentina formally launched the Andes-Atlantic Corridor on September 23, describing it as an effort to connect Argentina’s mineral-rich northwest and the Vaca Muerta energy basin with Atlantic ports and Western markets.

    According to the State Department, the corridor is intended to strengthen supply chains for lithium, copper, oil and natural gas while opening infrastructure projects to American companies.

    It is also the first corridor in the Western Hemisphere under the G7’s Partnership for Global Infrastructure and Investment.

    That makes the announcement considerably more than a transportation project.

    The corridor connects two things Washington increasingly considers strategic: infrastructure and critical minerals.

    Argentina sits inside the so-called Lithium Triangle and possesses major lithium and copper resources. Earlier this year, the United States and Argentina signed a bilateral Framework for Securing of Supply in the Mining and Processing of Critical Minerals. The new corridor is explicitly designed to support projects developed under that agreement.

    Then there is Vaca Muerta, Argentina’s enormous shale formation.

    The State Department says the corridor will support expanded development and export of those resources through pipelines, rail, ports and energy infrastructure.

    And Washington has brought its checkbook. Sort of.

    The State Department says the Export-Import Bank of the United States and Argentina have signed a “Build the Future” framework capable of providing up to $7 billion in financing by 2027 for infrastructure and productive-capacity projects.

    That should not be confused with $7 billion already spent, appropriated or even committed to individual corridor projects.

    The largest identified financing proposal illustrates the distinction.

    EXIM has issued a non-binding indicative term sheet for as much as $6 billion for Argentina LNG, a proposed $51 billion project involving Argentina’s YPF, Italy’s Eni and the United Arab Emirates’ XRG. The project would turn Vaca Muerta gas into liquefied natural gas for export.

    The financing would support purchases of American goods and services. State says American company Pumpco, a MasTec subsidiary, working with Bonatti and Contreras Hnos., has already received an engineering, procurement and construction contract worth more than $1 billion for the project’s export pipeline system, although that contract remains subject to a final investment decision.

    In other words, the corridor may have been formally launched this week, but the machinery underneath it was already moving.

    Argentina opened international tenders in August for 50-year concessions covering the Belgrano, San Martín and Urquiza freight rail systems. Together, the networks include roughly 7,594 kilometers of track across 16 provinces and connect major production regions with ports and international crossings.

    Argentina’s own government says decades of deterioration, inadequate maintenance and insufficient investment helped create the need for private capital.

    Those railways now appear on Washington’s corridor map.

    So does the Hidrovía waterway. So do proposed connections between Vaca Muerta and Atlantic ports. So do electricity projects and a planned modernization of Argentina’s ARSAT fiber-optic network.

    The corridor, therefore, looks less like a single new construction project and more like an umbrella placed over a collection of existing and proposed infrastructure projects, with U.S. financing agencies and American companies being encouraged to participate.

    And the strategy itself predates the launch.

    In February, Under Secretary of State for Economic Affairs Jacob Helberg told the House Foreign Affairs Committee that he had directed his office to conduct a strategic review of logistical corridors with previous State Department involvement. He specifically named the Andes-Atlantic Corridor alongside the Lobito Corridor in Africa and the Luzon Corridor in the Philippines.

    Seven months later, the corridor has officially arrived.

    The federal cast is substantial.

    State says the U.S. International Development Finance Corporation, EXIM and the U.S. Trade and Development Agency can provide financing, development assistance and technical support. The Departments of State, Commerce and Treasury are also expected to provide commercial expertise.

    A delegation from State, DFC and EXIM is scheduled to travel to Buenos Aires, Jujuy and Salta in October to identify and advance potential transactions. Deputy Secretary of State Christopher Landau is expected to follow later in the month to promote corridor investments.

    That makes the next phase worth watching carefully.

    The announcement contains some very large numbers, but much of the financing remains prospective. “Up to $7 billion” is not the same thing as $7 billion obligated, and a non-binding $6 billion EXIM term sheet is not a closed loan.

    What Washington has established is the framework through which those deals could happen.

    And the objective is unusually clear.

    The Andes-Atlantic Corridor is designed to connect Argentine lithium, copper, oil and natural gas with Western markets while giving American companies opportunities to build and finance the infrastructure required to get those resources there.

    The railroad tracks may be in Argentina.

    The supply-chain strategy runs straight through Washington.

    Sources: U.S. Department of State, Andes-Atlantic Corridor Fact Sheet (September 23, 2026); Export-Import Bank of the United States, Build the Future Framework Announcement.

  • A Missile Shield for All Americans, Subject to Classification

    The Scorekeeper Was the Last to Know

    The Congressional Budget Office put a price on a national missile defense system on May 12. A system matching the January 2025 Iron Dome for America executive order, CBO found, would cost about $1.2 trillion to develop, deploy and operate for twenty years, a figure laid out in its report and repeated in testimony to the Senate on September 29.

    Anyone who has met the federal government can guess what happened next. Nothing. David Mosher, who directs CBO’s National Security Division, told the Senate Armed Services strategic forces subcommittee at the hearing that the Golden Dome program office gave the agency its first briefing on September 25, four months after the estimate appeared, according to the Center Square.

    CBO told the same outlet it had received no information from the program office before publishing. Guetlein told the same hearing that the program remains on track to deliver an initial operational capability by the summer of 2028 — a statement confirmed in the hearing record — a timeline he has stated publicly since December 2025, according to Federal News Network and National Defense Magazine, and confirmed at the April 2026 subcommittee hearing.

    In the interval, Gen. Michael Guetlein, who runs the program, wrote a Washington Post opinion piece dated September 24 calling estimates approaching $1.2 trillion sensational and accusing their authors of imagining a hypothetical system built on legacy technology and outdated cost models. His office, he added, had briefed congressional committees dozens of times. CBO, as it happens, is not a congressional committee.

    There is a name for faulting a forecast’s assumptions while the real ones stay classified, and it is not peer review.

    Senator Deb Fischer‘s office, for its part, said she is glad the two sides can now work toward a more accurate estimate. One hopes to hear such sentiments in month one rather than month five.

    Two Numbers, Two Universes

    The Pentagon’s number is $185 billion, which a program office official described as covering the objective architecture through 2035. CBO’s is $1.2 trillion over twenty years. The same official told the Center Square the office would need more time to say what the $185 billion does and does not include, a remarkable thing to say about a figure one has been defending in public.

    CBO’s testimony offers two readings of the gap. Either the real architecture is far narrower than the executive order describes, or the money is parked in other accounts, such as the services’ missile procurement lines. Or both.

    The engine of the gap is the space layer. CBO prices the space-based interceptors at $743 billion, about 60 percent of the total, for 7,800 satellites sized to engage a raid of ten intercontinental ballistic missiles launched nearly at once. Atmospheric drag at those altitudes limits each satellite to roughly five years, so CBO says about 30,000 would be needed over twenty years to keep 7,800 aloft.

    Strip the layer out and the bill falls to $448 billion, though CBO notes the result would no longer match an executive order that asks for space-based interceptors by name.

    Here is an inference, and it should be labeled as one. It rests on CBO’s cost table and on the Pentagon’s own inability, so far, to define the scope of its figure.

    A $185 billion program through 2035 cannot contain a $743 billion constellation, so either the Pentagon’s space layer is far smaller than CBO’s or the cost is booked somewhere other than the Golden Dome fund. The reasoning is arithmetic, with one caveat: CBO spreads replacement purchases across twenty years, so the two numbers are not strictly comparable, and CBO itself says a direct comparison is difficult without more detail from the Department of Defense.

    Cleveland, Sioux Falls, and the Word Everyone

    The Pentagon’s position, relayed by an official who would not be named, is that the system protects all Americans, including those in Guam, Alaska and Hawaii. The official would not say which areas it defends, or whether it relies on U.S. Northern Command‘s defended asset list, citing operational security. Nor did the official address testimony at the hearing that not every American can be protected.

    That testimony came from David Trachtenberg, a former deputy under secretary of defense for policy, who told Senator Angus King he was not saying every citizen can be protected and expected the system to be deployed in phases. King had already observed that the name Golden Dome implies national coverage, and he asked the obvious follow-up.

    He put it to the panel this way, “Is it going to protect Cleveland but not Sioux Falls?” Choices were coming, King said, and they had to be made public.

    CBO’s notional design offers a hint of the geometry. Its 35 regional sectors each cover roughly 1/37 of the country, which CBO says would protect most of the U.S. population, and the agency says plainly that the system “would not be an impenetrable shield” and could be overwhelmed by a full-scale attack from Russia or China.

    CBO told the Center Square it did not estimate what share of the population or land area would be covered. Most is doing a great deal of work in that sentence, and the remainder presumably lives somewhere.

    The case for secrecy is not frivolous. Fischer’s office says the specifics are classified, and Tom Karako of the Center for Strategic and International Studies has argued that defended asset lists and similar operational details should remain closely held. But it is one thing to keep a radar’s performance secret and another to keep secret which American towns sit under the umbrella.

    The first protects the system. The second protects the program from the question.

    A Dome With No Budget Under It

    All of this assumes the thing gets paid for. Congress gave Golden Dome about $25 billion in the 2025 reconciliation law, and Guetlein said in August that roughly 90 percent had been obligated, according to Air and Space Forces Magazine.

    For fiscal 2027 the Pentagon asked for about $17 billion inside a proposed $350 billion reconciliation package and a mere $400 million in the ordinary base budget. The same report finds little political will for another reconciliation bill.

    The new fiscal year opened October 1 under a continuing resolution, and because Golden Dome has no fiscal 2026 appropriation, a stopgap has no baseline to hold it level against. Guetlein warned in August that without funding in fiscal 2027, “there is no Golden Dome because there is no funding.”

    Senators of both parties noticed. Mike Rounds said reconciliation should not have been necessary to get the program started. King called it very bothersome that the Pentagon and the White House went around the normal appropriations process for one of the most expensive initiatives of the government.

    Fischer pointed out that the layered architecture traces to her own committee’s language in the fiscal 2024 defense authorization, which means the program’s parentage is not in dispute even if its price is. Karako told the panel that Golden Dome and the broader munitions effort will stand or fall on 2027 funding.

    So the ledger reads as follows: A shield for everyone, with a list of protected places nobody will read aloud, priced at either $185 billion or $1.2 trillion depending on whom one asks and what one counts, funded by a reconciliation bill that has not passed and a continuing resolution that cannot carry it.

    CBO is careful to note that engaging a missile is not the same as defeating it. Someone at the Pentagon might extend the same care to distinguishing a program from a slogan.

  • Coast Guard Disabled Faulty Fire Systems on Cutters, Leaving Crews Facing Greater Risk

    DHS inspectors found a known fire-suppression defect, more than 9,000 delayed maintenance items and a fleet falling well below readiness requirements even as the Coast Guard continues buying new Fast Response Cutters.

    A fire in the engine room of a Coast Guard Fast Response Cutter is precisely the kind of emergency for which an automatic fire-suppression system exists.

    On some of those cutters, however, the automatic feature has been deliberately disabled.

    After repeated malfunctions caused firefighting agent to discharge unexpectedly and shut down cutter engines, the Coast Guard’s solution was to disconnect components of the system and secure a discharge pin with a zip tie. The workaround stopped the accidental activations, but it created another problem: in an engine-room fire, a Coast Guardsman may have to travel to the back of the vessel, descend through a hatch and manually activate the suppression system.

    The Department of Homeland Security Office of Inspector General says those additional steps would delay the release of firefighting agent and increase the danger to the crew. Its conclusion is unusually direct for a federal audit: failure to resolve the problem “could also lead to injury or death.”

    The finding is part of a broader September 28 audit of the Coast Guard’s Sentinel-class Fast Response Cutter fleet, a growing force of 154-foot patrol vessels used for missions ranging from search and rescue and drug interdiction to maritime security and defense readiness. The auditors found a fleet struggling with maintenance backlogs, escalating funding shortfalls and operational availability far below Coast Guard requirements.

    The fire-suppression problem, however, provides perhaps the clearest example of what those readiness problems mean for the people aboard the cutters.

    And the problem has been known for years.

    A Fire System That Could Shut Down the Ship

    According to DHS OIG, Fast Response Cutters experienced at least 22 random discharges of firefighting agent into their engine rooms between 2017 and 2023.

    The consequences were more substantial than an inconvenient false alarm.

    Activation of the suppression system shuts off engine-room ventilation, closes fuel valves and turns off the engines. Whether the system activates because of an actual fire or a malfunction, the cutter loses propulsion and cannot restart its engines until faults in the suppression system are cleared.

    The Coast Guard traced the failures to environmental degradation caused by moisture accumulating in a remote station box. The suppression system had complied with applicable requirements when the cutters were constructed, according to the audit, but responsibility for maintaining and replacing the equipment subsequently passed to the Coast Guard during the vessels’ sustainment phase.

    By April 2023, the Coast Guard had issued an engineering advisory addressing the recurring problem.

    Its interim solution was decidedly low-tech.

    Crews were directed to disconnect electrodes associated with the automatic suppression system and secure the discharge pin with a zip tie to prevent another accidental release. OIG inspectors photographed the arrangement aboard the Fast Response Cutter Paul Clark. The report includes images of both the zip-tied pin and disconnected electrodes.

    The modification worked in one important respect. OIG said it prevented additional random discharges.

    But disabling the electrodes also disabled the suppression controls in the pilothouse.

    That means a crew confronting an actual engine fire cannot simply activate the affected system from the vessel’s control station. Instead, according to OIG, a Coast Guardsman would have to move aft and climb down a hatch to manually discharge the firefighting agent.

    “These extra steps would delay immediate release of the firefighting agent,” the auditors concluded.

    The Coast Guard estimated that resolving the problem across the fleet would cost approximately $40 million. Yet as of fiscal 2025, according to OIG, replacement of the suppression system had not been included in the Coast Guard’s formal budget request. Officials told auditors that the project would, at best, receive a Tier II designation, which carried a low probability of funding.

    The Coast Guard has since begun moving toward a permanent solution, but that solution will not arrive quickly.

    Newer cutters are already being delivered with changes. According to the Coast Guard’s response to OIG, FRC #59, delivered in March 2025, and subsequent cutters receive different fire-alarm panels and upgrades to their fire-suppression systems. The service is also retrofitting a previously delivered cutter with the new system.

    For the older fleet, however, the Coast Guard estimates completing the retrofit will take at least three years, citing the number of vessels involved, the extent of the required work and availability of funding.

    There is still no estimated completion date.

    OIG consequently left the recommendation open and unresolved.

    A Safety Problem Inside a Maintenance Problem

    The fire system is only one part of a much larger readiness problem documented by the auditors.

    Fast Response Cutters are supposed to maintain at least 85 percent operational availability. OIG analyzed 52 domestic FRCs from October 2022 through June 2025 and found they collectively managed just 72 percent.

    Nearly one-third of the fleet, in other words, was not fully mission-capable at any given time.

    The results were particularly poor in fiscal 2024. Only 13 of the 52 cutters met the minimum availability requirement, and none of the eight Coast Guard districts operating FRCs met the service’s overall requirement.

    Those numbers have operational consequences.

    Auditors attempted to determine which missions the Coast Guard had been unable to perform because cutters were unavailable. They couldn’t.

    The Coast Guard does not maintain that data.

    OIG did identify at least one revealing example. A Fast Response Cutter conducting an interdiction in the Southeast District broke down during pursuit of a vessel suspected of carrying drugs and/or migrants.

    The suspected vessel escaped.

    The maintenance backlog behind those failures is substantial.

    Coast Guard cutter-fleet funding shortfalls grew from $219 million in fiscal 2022 to $486 million in fiscal 2025, according to internal memoranda reviewed by OIG. To manage those shortages, required maintenance was postponed.

    By June 17, 2025, crews had reported more than 9,000 FRC maintenance requests that were overdue or had received extensions from Coast Guard headquarters. One of them involved the cutter that subsequently broke down during the interdiction.

    Delaying the work did not necessarily save money.

    OIG found that postponing dockside maintenance until cutters entered scheduled dry dock could stretch a roughly 90-day maintenance period to 120 days. An additional 30 days in dry dock costs an average of approximately $160,000 per cutter. Across roughly 50 cutters over a four-year maintenance cycle, OIG estimated the practice could add about $8 million in costs while simultaneously keeping the vessels away from their homeports longer.

    There is an accounting problem buried beneath the maintenance problem as well.

    Despite evidence that operational and support expenses were rising, the FRC program reduced its projected life-cycle costs from $9.9 billion in 2021 to $9.2 billion in 2023. OIG concluded that the lower projection conflicted with actual cost increases and failed to account adequately for technical systems and deferred maintenance.

    In its response to the audit, the Coast Guard effectively acknowledged part of that problem. It told OIG that deferred maintenance had artificially lowered the actual costs used to develop its cost estimates and said those costs were being incorporated into a revised life-cycle estimate.

    That is an important distinction. Deferring maintenance can make today’s books look better by moving an expense into tomorrow’s inbox. Unfortunately, the cutter still knows the maintenance wasn’t performed.

    This Problem Predates the Latest Audit

    The new OIG findings also fit a longer pattern.

    The Government Accountability Office reported in earlier examinations of Coast Guard cutter maintenance that deferred work and equipment failures were already reducing cutter availability.

    More recently, GAO documented a Fast Response Cutter whose shaft-seal maintenance was postponed. The seal eventually failed, leaving the cutter unable to operate for four months. Coast Guard district officials told GAO that losing the vessel increased pressure on the remaining cutters, which then had to absorb its missions.

    That sequence is strikingly similar to the problem OIG now describes at fleet scale: defer maintenance because resources are constrained, suffer equipment failures later, lose operational availability, and place additional demands on the cutters that remain available.

    The latest audit puts numbers around the accumulated result.

    A 72 percent availability rate. More than 9,000 overdue or extended maintenance items. A $486 million cutter-fleet funding shortfall.

    And a fire-suppression problem serious enough that the Coast Guard disabled part of the system to prevent it from unexpectedly shutting down the vessel.

    Meanwhile, the Fleet Keeps Growing

    None of this has stopped expansion of the Fast Response Cutter program.

    In September 2025, the Coast Guard exercised a $507 million contract option with Bollinger Shipyards for 10 additional FRCs, increasing the number ordered under the contract from 67 to 77. Congress provided $1 billion for additional Fast Response Cutters as part of nearly $25 billion in Coast Guard funding contained in the One Big Beautiful Bill Act.

    The first cutter financed through that option is expected in fiscal 2028.

    Expansion has continued in the meantime. The Coast Guard accepted its 63rd Fast Response Cutter, the Jeffrey Palazzo, in June 2026.

    There is nothing inherently contradictory about replacing or upgrading equipment while expanding a fleet. New vessels can incorporate corrections that older hulls lack, and the Coast Guard says precisely that is happening with the fire-suppression system.

    But the juxtaposition is difficult to ignore.

    The Coast Guard is expanding a cutter fleet whose existing vessels have accumulated thousands of delayed maintenance requirements, while its own inspector general says nearly one-third of the domestic fleet was not fully mission-capable at any given time during the period examined.

    And the older cutters will not instantly inherit the improvements installed aboard their newer siblings.

    More Money, But OIG Wants a Plan

    The Coast Guard concurred with all three recommendations in the report.

    For maintenance, the service pointed to increased funding in its fiscal 2025 budget reconciliation, fiscal 2026 appropriation and fiscal 2027 budget proposal. According to its response, those increases include approximately $20 million in fiscal 2026 and another $30 million in fiscal 2027 for surface depot maintenance, with the Coast Guard addressing FRC work including five dry docks, five docksides and nine annual inspections.

    The Coast Guard asked OIG to consider the recommendation resolved and closed.

    OIG declined.

    Additional funding, the auditors said, did not constitute a plan explaining how the money would eliminate the FRC maintenance backlog. The recommendation will remain open until the Coast Guard produces documentation showing it has developed and implemented such a plan.

    The same unresolved designation applies to the fire-suppression system.

    The Coast Guard says the fleet-wide retrofit will take at least three years. Its completion date remains “to be determined.”

    That leaves the service in an uncomfortable position.

    It is simultaneously buying the next generation of Fast Response Cutters, attempting to catch up on maintenance for the existing generation, and trying to retrofit a known safety defect aboard older vessels while those vessels remain responsible for some of the Coast Guard’s most consequential missions.

    Those missions include drug interdiction, migrant interdiction, search and rescue, maritime security and national defense.

    The cutters are called Fast Response Cutters for a reason.

    The question raised by the inspector general’s report is increasingly whether enough of them can respond when they’re needed, and what risks their crews are being asked to accept when they do.

    Fediverse Reactions
  • The Directive Was Binding. The Compliance Was Optional.

    In December 2024, the Cybersecurity and Infrastructure Security Agency issued a directive with a name that sounds like a threat, Binding Operational Directive 25-01. It ordered the entire Federal Civilian Executive Branch, all 102 agencies under CISA’s cybersecurity umbrella, to lock down their cloud tenants against the kind of misconfiguration that let hackers walk through SolarWinds in 2020 wearing the digital equivalent of a stolen badge. CISA director Jen Easterly said at the time that the directive would help “reduce risk to the federal civilian enterprise.” The word “binding” was doing a lot of work in that sentence, because a new DHS Inspector General report (OIG-26-30, released September 21, 2026) has confirmed what the word never actually meant, which is that CISA can write the rules and cannot make anyone follow them.

    The Toolbox Nobody Was Required to Open

    To its credit, CISA built the thing it said it would build. Through the Secure Cloud Business Applications project, launched in 2022 in direct response to SolarWinds, the agency produced ScubaGear and ScubaGoggles, free automated tools that scan an agency’s Microsoft 365 or Google Workspace tenant and flag every deviation from a defined security baseline; blocking outdated authentication, enforcing multifactor login, protecting personally identifiable information, the greatest hits of “things a competent IT department should already be doing.” CISA ran more than 80 outreach engagements with over 1,000 participants, put the tools in front of more than 130,000 requesters, and personally walked 17 agencies through implementation. By the OIG’s own account, none of this was phoned in (BOD 25-01, Implementation Guidance).

    BOD 25-01 laid out three deadlines. By February 21, 2025, agencies had to hand over a complete inventory of their cloud tenants. By April 25, they had to deploy the assessment tools and start reporting continuously. By June 20, they had to actually implement the mandatory security policies and begin continuous monitoring. Three deadlines, each one a smaller and more specific ask than the last, each one accompanied by a CISA outreach campaign, each one missed by a majority of the government it was written for.

    Sixty One, Then Fifty Two, Then Eighty Six

    The numbers get worse as the asks get more concrete, which is the part that should bother you. Forty of 102 agencies (39 percent) failed to even name their own cloud tenants by the first deadline, meaning nobody, not CISA, not the agency itself, could verify what needed protecting in the first place. Fifty three agencies (52 percent) had not deployed the assessment tools by the second deadline. By the third and most consequential deadline, the one requiring agencies to actually implement the security policies, 88 of 102 agencies, 86 percent of the entire FCEB, were noncompliant.

    Then it stopped improving. As of February 12, 2026, eight months past the original deadline, 78 of 102 agencies, 76 percent, were still not implementing all mandatory SCuBA policies. That is not a rollout lagging behind schedule; that is a rollout that reached its ceiling and stayed there. CISA’s own report acknowledges the specific failures, agencies leaving outdated authentication procedures in place, skipping multifactor authentication, declining to implement protections for sensitive personal data, the exact configurations the SolarWinds postmortem told everyone to fix five years earlier.

    A Compulsory Directive With No Compulsion Attached

    Here is the part the OIG buried in a single paragraph that should have been the headline. The Federal Information Security Modernization Act of 2014 gives the Secretary of Homeland Security authority to issue these directives; it does not give the Secretary, or CISA, any mechanism to force an agency to obey one. CISA can notify OMB. CISA can log the noncompliance in the annual FISMA metrics cycle. CISA can send its Directives and Policy team to sit down with an agency’s Chief Information Security Officer and ask nicely, again. What CISA cannot do is anything that resembles enforcement in the ordinary English sense of the word, and DHS OIG has now said so in writing three separate times across sixteen years, first in 2009, again in 2010, and now in 2026, joined by a fourth outside voice in GAO-20-133, February 2020, which found that DHS did not consistently validate agencies’ self-reported compliance in the first place.

    That last detail matters more than it looks like it should. An enforcement mechanism built on agencies grading their own homework was never going to survive contact with an agency that had a reason not to want a passing grade recorded. The OIG’s own data reliability check in this report found duplicate tenant submissions and mismatched agency counts between systems, discrepancies the OIG says it “reconciled,” which is a generous word for finding out the compliance numbers were built on the same self-certification honor system that produced the compliance failures in the first place.

    CISA, for its part, declined to submit management comments on this report. Not a rebuttal, not a clarification, not even the standard bureaucratic paragraph about “ongoing efforts to strengthen” whatever it is agencies say when they have nothing to add. Silence, on the record, in response to a finding that the flagship tool of your flagship post-SolarWinds initiative is being ignored by seven out of ten agencies eighteen months after the deadline.

    The Recommendation That Doesn’t Exist

    The single strangest sentence in the entire report comes at the end of the highlights page: “This report contains no recommendations.” Not because there is nothing to fix, but because the OIG has apparently concluded there is nothing left to recommend to an agency that already knows it lacks the authority to fix the problem itself. You cannot recommend that CISA enforce compliance, because Congress never gave CISA anything to enforce with. The recommendation, if there is one, has to go to the people who wrote the Federal Information Security Modernization Act of 2014 and left the enforcement clause out, and they are not the ones reading OIG reports.

    So the government spent two years building a genuinely useful set of free cybersecurity tools, distributed them to more than 130,000 people, walked federal agencies through installation by hand, and produced a compliance rate that, eight months after the deadline, sits at 24 percent. The tools work. The directive was binding in the sense that a strongly worded letter is binding. Everyone involved did their job except the one entity whose job was to make sure everyone else did theirs, and that entity does not exist, because Congress never built it. The next SolarWinds will not be stopped by a better baseline. It will be stopped, or it will not be, by whichever 24 percent happened to read the memo.

    Sources: DHS Office of Inspector General, CISA’s Implementation of Binding Operational Directive 25-01 (OIG-26-30, September 21, 2026); CISA, Binding Operational Directive 25-01: Implementing Secure Practices for Cloud Services; GAO-20-133, Federal Information Security: Agencies Need to Develop and Implement Adequate Policies for Complying with New Requirements (February 2020).

    Fediverse Reactions
  • The FAA Knows Someone Could Fake Its Air Traffic Instructions. It’s Still Working On That.

    Somewhere within range of a major airport, a person with a software-defined radio that costs less than a nice dinner could transmit a message that looks, to a pilot’s instruments, exactly like a legitimate clearance from air traffic control. There is currently no reliable way for that pilot to know the difference. This is not the premise of a thriller; it is the finding of a Government Accountability Office report released September 21, 2026, on the cybersecurity of the systems that keep more than 44,000 daily flights and 3 million passengers from colliding. The FAA has known about this class of problem for years. It has, by GAO’s account, mostly gotten around to writing memos about it.

    The ghosts in the frequency

    The National Airspace System runs on radio frequency signals, the same physical medium used for GPS, radar, and every other invisible thread holding modern aviation together. GAO catalogs three ways to attack it (interference, spoofing, and jamming), each capable of degrading, faking, or simply killing the signals aircraft and controllers depend on. None of this is theoretical. In 2012, an individual jamming GPS transmissions near Newark Airport degraded a landing-approach system during pre-deployment testing. In 2022, GPS interference with signs of spoofing near a Dallas airport caused controller confusion and more than 230 departure delays; the same year, an unauthorized transmitter near Denver International disrupted navigation accuracy for civil flights. GAO also notes, in the driest possible register, that a December 2024 Azerbaijan Airlines flight was shot down amid GPS disruptions linked to the Russia-Ukraine conflict, an approach GAO describes as having “become more complex than usual” due to pilot and controller miscommunications. International GNSS interference is now concentrated enough to have hotspots, mapped in the report like weather systems, radiating out of the Middle East, Eastern Europe, Southeast Asia, and the Baltic region.

    FAA is well aware of all this. Awareness, GAO’s report makes clear, is where the agency’s competence currently ends. This is also the third GAO aviation cybersecurity report in as many years; a September 2024 report found 51 of FAA’s 138 air traffic control systems outright unsustainable, and a July 2026 report found FAA had fully implemented only two of its own seven cybersecurity strategy goals.

    Assessed, in a general sort of way

    Federal information security law requires agencies to run risk assessments for individual systems, evaluating specific threats, vulnerabilities, and likely impact under NIST Special Publication 800-53 Rev. 5, and FAA’s own internal order requires the same. For seven of the eight spectrum-dependent NAS systems GAO reviewed, FAA had not done this. Instead it points to one general spectrum risk assessment covering everything at once, which GAO politely observes “does not satisfy the NIST recommendation” because it treats every system’s exposure as roughly identical rather than evaluating each one’s actual architecture and controls.

    The paperwork underneath these systems is not in better shape. Four of the eight still cite a NIST standard that was superseded in 2021. Five are missing required security controls for high-impact systems, including contingency planning and denial-of-service protection. One system’s documents cannot agree with each other on whether the system is high impact or merely moderate. One had not had its required annual security assessment done since 2023. A separate DOT Inspector General audit, cited in the report, found the same pattern of stale NIST standards and missing controls across FAA’s high-impact systems.

    Real-time monitoring, the thing that would actually let FAA notice an attack while it is happening rather than reconstructing it afterward, does not fully exist. FAA’s Spectrum Engineering office told GAO it has no 24/7 monitoring capability and lacks the specialized tools to detect interference or spoofing as it occurs; instead it investigates after someone reports a problem. The agency’s own Wide Area Augmentation System can flag degraded GPS performance but cannot detect spoofing or identify where it came from. FAA officials cited funding constraints as the reason certain monitoring tools have not been deployed to high-risk sites. It is worth sitting with that sentence; the nation’s air traffic infrastructure lacks live detection for signal spoofing because of a budget line item.

    A coalition of the partially willing

    FAA does talk to other agencies about all this, and GAO gives it credit for two of the eight leading interagency collaboration practices it measured against, defining common outcomes and leveraging shared resources, chiefly through the Aviation Cyber Initiative, the Purposeful Interference Response Team, and the Interdepartmental Radio Advisory Committee. The other six practices were only partially met, and the gap has a consistent shape. Inside the formal interagency groups, FAA has charters, bylaws, and defined roles. Outside them, it has almost nothing. FCC and DOD officials told GAO they routinely share information with FAA through informal channels with no documented policy governing how or when. Some aviation industry stakeholders told GAO they were unsure which FAA office to even contact about a spectrum issue, and some reported wanting more access to the incident coordination calls that already exist. FCC itself was apparently dropped from continued participation in the Aviation Cyber Initiative after an earlier interagency taskforce wound down in 2021, and nobody seems to have noticed enough to fix it.

    Clearance to land, or so says somebody

    The most concrete vulnerability in the report involves two applications that pilots and controllers actually use every day, ACARS, which handles operational messaging between aircraft and airlines, and CPDLC, which lets controllers send digital text clearances as an alternative to voice. Both predate modern cryptography as a design assumption. Neither is encrypted. Neither authenticates the sender. GAO walks through, with illustrated step-by-step diagrams, how a malicious actor could pull public flight-tracking data, transmit a spoofed clearance cancellation over VHF using nothing more exotic than a software-defined radio, and force a pilot into a verbal shouting match with real air traffic control to sort out which instruction is genuine. Do that to several aircraft at once and you have delayed departures, an overloaded controller workload, and, in a worse version of the same scenario, a pilot who follows a fabricated altitude or route change believing it came from ATC.

    FAA’s defense against all this is essentially procedural rather than technical: message-format standardization, mandatory acknowledgments, and the expectation that a suspicious pilot will simply pick up a voice radio and ask. These are reasonable stopgaps. They are also, as GAO notes, “not designed to provide the same level of protection as modern cryptographic controls,” which is a generous way of saying the agency is trusting human vigilance to compensate for a protocol built before anyone thought to secure it. A next-generation replacement, built on standard internet protocols, is in testing at select locations. FAA has not given GAO a timeline for when, or whether, it will actually replace the systems currently in use.

    GAO issued nine recommendations, covering system-specific risk assessments, consistent categorization, real-time monitoring, interagency accountability, sustained leadership, formal information-sharing agreements outside the existing clubs, broader stakeholder inclusion, and a plan to actually authenticate ACARS and CPDLC traffic. The Department of Transportation, replying on FAA’s behalf, concurred with all nine and promised a detailed response within 180 days, the standard federal-agency interval for “we will get back to you, eventually, with something.” Bureaucracy Times will be checking the calendar.

  • The Design Standard NNSA Lowered to Keep Its Plutonium Factory on Schedule

    Of the five construction projects that the National Nuclear Security Administration has ever bothered to isolate into their own contract line items, the Savannah River Plutonium Processing Facility is the newest and the biggest. According to a new GAO report on how NNSA uses these line items, the facility got its own cost-plus-award-fee line in 2023, its own tailored performance evaluation, and, according to officials, a fee plan that took a group of thirty to forty staff and contractors to put together. The theory, as always, was that isolating the deliverable would isolate the accountability.

    What GAO’s own separate assessment of NNSA’s major projects found, published the same month, is that the agency has spent the last two years quietly lowering the bar the project has to clear rather than raising the pressure on the contractor to clear it.

    The Standard NNSA Lowered for Itself

    In October 2024, NNSA adopted what it calls a second revised tailoring strategy for the plutonium facility’s Main Process Building, according to GAO’s February 2026 assessment of NNSA’s major projects. The strategy folded the scope of three other projects into the Main Process Building, and it did something considerably more interesting to the government’s own rulebook. It let NNSA establish a formal cost and schedule baseline once the design was only sixty percent finished, instead of the ninety percent DOE’s own project management order otherwise requires. It also let construction begin before that baseline existed at all.

    NNSA approved ten early procurement and site preparation packages under this looser standard, intended to get lower risk work started while the design was still being finalized. According to GAO, the agency could not fully execute even that plan, because the contractor kept falling behind on delivering the design packages that were supposed to accompany the work. Officials told GAO they are still struggling to hire qualified design engineers and that the contractor continues to miss performance targets. The project’s final design review, originally set for March 2026, has slipped to September 2026. When the contractor submitted its package for an independent cost estimate in May 2025, GAO found it was insufficient to actually conduct the estimate; NNSA is waiting on a resubmission in early 2026, at which point officials hope the design will finally be close to the ninety percent maturity the agency waived in the first place.

    The cost, meanwhile, has done what cost usually does at Savannah River. NNSA’s own fiscal year 2026 budget justification puts the Main Process Building at over twenty two billion dollars, against a preliminary range of $6.9 billion to $11.1 billion that NNSA itself published at the project’s first major milestone. Officials told GAO the September 2035 completion date, already the later end of that earlier range, may slip further. A revised cost and schedule estimate is not due for internal NNSA approval until September 2026.

    A Building With a Prior Conviction

    None of this is Savannah River’s first attempt at doing something complicated with plutonium in that same footprint. The plutonium facility is being built inside and around the shell of the site’s Mixed Oxide Fuel Fabrication Facility, a program NNSA spent roughly fifteen years and more than eight billion dollars on before mothballing it in 2014. That project, too, started with a modest number. DOE estimated MOX construction at $1.6 billion in 2004. By 2013, GAO was confirming that NNSA had quietly added another two billion dollars to the estimate even as the facility was supposedly nearing completion, after years of the agency declining to disclose a rebaselined figure publicly. The facility never processed a gram of commercial fuel. NNSA converted the shell into the plutonium pit factory it operates today.

    There is a version of this story where the agency learned something from the MOX years and applied it to the pit factory. The tailoring strategy GAO documented in the new report suggests the lesson NNSA actually absorbed was narrower: that a hard design-maturity threshold is an obstacle to be waived when the schedule is inconvenient, not a floor to be held.

    Now Firing the Contractor, Unrelatedly

    Whatever the line item and its fee plan were supposed to buy NNSA, it apparently was not enough confidence in the incumbent. Savannah River Nuclear Solutions, the Fluor led joint venture that has run the site since 2008 and is building the plutonium facility, received a project management rating of less than adequate in its fiscal year 2024 performance evaluation, according to a review DOE released in February 2025, which cited the absence of a credible overall project schedule. In February 2026, NNSA released a request for proposals for a standalone follow-on management and operating contract for the entire Savannah River Site, worth an estimated sixty one and a half billion dollars over a potential twenty years and four months, a competition NNSA’s own announcement frames as separate from the plutonium project specifically but that plainly reflects an agency no longer content with how its current contractor performs. NNSA extended the incumbent’s contract through September 2027, worth an additional $2.3 billion, explicitly to preserve workforce continuity while the recompete plays out, which is its own small admission that the agency does not trust the transition to go smoothly either.

    The new M&O contract, whoever wins it, will not just run the plutonium factory. It also covers the storing, processing, and long term management of the nuclear materials and waste that Savannah River exists to handle, all under the same undocumented, case by case logic GAO’s line item report says NNSA still uses to decide which pieces of that work get isolated into their own accountability structure and which pieces stay folded into the general M&O scope where waived standards and quiet rebaselines are harder to see. A cost-plus-award-fee line item and a thirty person fee plan gave GAO something to point to when NNSA needed to demonstrate it was taking the plutonium facility seriously. It did not stop the agency from lowering its own design standard to keep pouring concrete, and it did not stop the government from concluding, two years after handing the project its own line, that the company running it needs to be replaced.

    Sources: GAO, NNSA Contract Line Items: Agency Should Document Criteria for Use and Capture Lessons Learned (GAO-26-108409, September 2026); GAO, NNSA Construction Projects: Cost and Schedule Performance (GAO-26-107777, February 2026); GAO, Mixed Oxide Fuel Fabrication Facility: DOE Needs to Provide More Consistent and Timely Cost Information (GAO-13-283, 2013). Related: $308 Million to Keep the Lights On in a Building From 1945.

  • $308 Million to Keep the Lights On in a Building From 1945

    The National Nuclear Security Administration would like you to know that it has learned something about contract oversight. In 2014, when it awarded the contract to build a new uranium processing facility at the Y-12 National Security Complex in Oak Ridge, Tennessee, it did something it almost never does. It gave the project its own line item, separate from the sprawling, undifferentiated blob of “management and operating” work that otherwise governs how NNSA pays its contractors. A separate fee plan. A separate performance evaluation. Isolated accountability, in theory, for a single, isolable piece of work.

    According to a new GAO report on how NNSA uses contract line items, this was the pilot. The one meant to prove that separating deliverables out of the M&O morass would sharpen contractor performance and protect the government from the kind of cost bleed that has made NNSA’s acquisitions program a fixture on GAO’s High Risk List for over a decade.

    Here is how the pilot is going. The Uranium Processing Facility is nearly four billion dollars over its cost baseline and eight years behind schedule. NNSA re-baselined the project in December 2024, at a new estimate of $10.35 billion, more than fifty percent above where the project stood before. And because the replacement facility still is not ready, NNSA is now paying to keep the building it was supposed to replace alive, Building 9212, poured in 1945, older than the Atomic Energy Commission that once ran it, and not built to a code that anticipated an earthquake or a derecho hitting Oak Ridge. The Y-12 contractor’s own estimate for keeping 9212 in service is over $308 million, plus another $100 million in deferred maintenance nobody wants to put off any longer.

    The Fee Structure That Was Supposed to Fix This

    The theory behind giving a project its own line item is straightforward enough that GAO states it almost apologetically in the new report; separate the deliverable, separate the fee, and the contractor has a reason to hit the target instead of coasting on whatever else is going well across the site. NNSA officials told GAO they used exactly this logic for the Uranium Processing Facility, and for a while, on paper, it worked as designed. The line item let NNSA withhold fee when performance lagged. Officials told GAO that over the years since 2014, NNSA paid the contractor less than $40 million out of roughly $220 million in available fee, precisely because the fee was isolated and precisely because performance was bad.

    Withholding fee is not the same as finishing a building. The project kept slipping anyway, right up until the 2024 re-baseline, at which point, GAO notes, the contractor’s cost and schedule performance apparently improved. Which raises the obvious question nobody in the report quite asks out loud: did the line item fix the contractor, or did NNSA just eventually agree to pay for the delay it had spent a decade complaining about, at which point the delay, unsurprisingly, stopped generating friction?

    Separately, GAO’s February 2026 assessment of NNSA’s twenty eight major construction projects found that the UPF’s Main Process Building and Salvage and Accountability Building, the two subprojects riding under that pioneering line item, are responsible for roughly eighty percent of the $4.8 billion in cumulative cost overrun across the entire NNSA major projects portfolio, and forty percent of its thirty years of cumulative schedule delay. The flagship example of contract-oversight reform is also the single largest driver of the exact problem the reform was supposed to solve.

    A Building That Predates the Concept of a Safety Code

    None of this is abstract for the people who still have to run Building 9212 while its replacement crawls toward completion. The building processes enriched uranium for nuclear weapons components and Navy reactor fuel. It was constructed during the Manhattan Project‘s industrial buildout, before the National Environmental Policy Act, before OSHA, before DOE’s own seismic design standards existed in anything resembling their current form. GAO’s September 2025 review found that NNSA does not have a comprehensive, agreed-upon plan for how to keep operating it safely through the additional years the delay has bought it.

    The $308 million is not a hypothetical either. It is the contractor’s own figure, submitted as part of planning for continued operations through 2035, one year past NNSA’s current target date for the new facility to be fully operational, itself a date GAO’s reporting suggests deserves some skepticism given the project’s history of missing every prior one. Consolidated Nuclear Security, the M&O contractor at Y-12, is simultaneously the entity being paid an isolated, performance-linked fee to finish the new facility and the entity submitting cost estimates to keep the old, code-noncompliant facility running because the new one is not finished. It is worth sitting with how neatly those two roles cancel each other out as accountability mechanisms.

    What the Line Item Actually Bought

    To be fair to GAO’s broader report, and to NNSA, nobody involved is claiming the line item made things worse. NNSA officials told GAO the tailored fee structure gave them leverage they would not otherwise have had, and withholding $180 million in fee over a decade is not nothing. The report’s two recommendations, that NNSA document its criteria for when to use line items and formally capture lessons learned from the ones it has used, are modest and NNSA has already agreed to both, with target dates in the spring of 2027.

    But modest is the operative word, and it is worth being precise about what a documented criteria policy will and will not fix. It will not shrink Building 9212’s price tag. It will not un-spend the $4 billion the UPF re-baseline added to the government’s bill. What it will do, at best, is make NNSA’s next attempt to isolate a construction project’s fee and performance evaluation slightly more consistent across sites than the current, undocumented, case-by-case process that has left Los Alamos with zero project line items despite a $1.86 billion pit production subproject sitting well past the threshold the agency’s own officials cite for other sites.

    The uranium processing facility was supposed to be the proof that separating the fee from the noise made contractors perform. Instead it produced a decade of withheld fee, a $4 billion rebaseline, and a Manhattan Project era building that will now run a year past NNSA’s own optimistic new deadline, on a budget nobody is calling a placeholder because the money has already been spent. If this is what accountability looks like when NNSA does it on purpose, on its single best-documented example, it is fair to ask what the agency’s much larger, entirely undocumented middle ground of construction spending is actually buying the country.

    Sources: GAO, NNSA Contract Line Items: Agency Should Document Criteria for Use and Capture Lessons Learned (GAO-26-108409, September 2026); GAO, NNSA Construction Projects: Cost and Schedule Performance (GAO-26-107777, February 2026); GAO, Uranium Processing Facility: DOE Needs to Address Cost, Schedule, and Risk Challenges (GAO-25-107330). Related: The Design Standard NNSA Lowered to Keep Its Plutonium Factory on Schedule.

  • Deja Vu on the Clinch River: TVA’s New Nuclear Bet Looks a Lot Like Its Last One

    The Success Story With an Asterisk

    Two articles into this series (introduced in Meet the Fourth Branch)—one on the RFC and one on Fannie Mae and Freddie Mac—both anchored on entities that blew up spectacularly, it seemed only fair to promise readers one that actually worked.

    The Tennessee Valley Authority was supposed to be that entity: a New Deal creation from May 18, 1933, still delivering power to more than nine million people across seven states, still self-financing off electricity sales rather than congressional appropriations, still standing while the Reconstruction Finance Corporation and the RFC’s mortgage-guaranteeing offspring both required federal intervention to survive their own ambitions.

    Here is the asterisk. TVA’s own regulator has spent the better part of four decades documenting a debt history that looks less like a success story and more like a rehearsal for one, and TVA is currently in the middle of placing the exact same kind of bet that got it into trouble the first time, on the exact same patch of land.

    Forty Times the Original Debt Ceiling

    TVA’s early financing was almost absurdly generous by modern standards. Congress appropriated roughly a billion dollars to the agency between 1933 and 1959, charged no interest on any of it, and ultimately treated more than a fifth of that money, 258.3 million dollars, as a straightforward taxpayer equity contribution that was never expected to be repaid at all, according to a Heritage Foundation institutional history of the agency. In 1959, Congress restructured TVA to finance itself through power revenues and its own bond issuance rather than direct appropriations, and set a statutory debt ceiling to keep the new arrangement disciplined.

    That ceiling did not hold the line for long. By 1979 Congress had raised it to 30 billion dollars, forty times the amount originally authorized twenty years earlier, driven almost entirely by TVA’s nuclear construction program. TVA started seventeen nuclear generating units during the 1960s and 1970s and completed only seven of them, according to GAO’s own account of the agency’s finances, a failure rate that turned billions of dollars of half built reactors into pure liability with no offsetting electricity to sell. By 1995, GAO reported that TVA carried 26 billion dollars in debt, with 14 billion dollars of that sunk into nonproducing nuclear assets that were not even included in the rates TVA charged customers, and warned in plain language that if TVA could not compete effectively as electricity markets opened up, the federal government might end up covering TVA’s debt itself.

    The debt problem eventually stabilized. The pension problem did not. By fiscal year 2016, GAO found TVA’s pension plan was only 54 percent funded, with unfunded liabilities that had grown steadily for a decade, and TVA had not even been reporting the shortfall in its own required performance plans. It got worse before it got better: TVA’s own numbers, reported by the Chattanooga Times Free Press, showed the plan falling to roughly 60 percent funded in 2019 and the underfunding widening to 5.6 billion dollars in 2020, driven largely by falling interest rate assumptions rather than any single management failure. Since then the pension picture has improved materially: according to the White House FY2026 Budget Appendix, as of September 30, 2024, the TVA Retirement System reported an estimated seventy-nine percent funding ratio and an unfunded liability of roughly 2.3 billion dollars—better than a decade ago, though still a meaningful gap on TVA’s balance sheet.

    Same River, New Reactor

    Here is where the story loops back on itself in a way that would be hard to invent. One of the reactors TVA never finished during its 1970s nuclear buildout was the Clinch River Breeder Reactor, a federally funded prototype fast breeder sited on TVA owned land near Oak Ridge, Tennessee, with TVA slated to buy its output. Congress killed the project in October 1983 after roughly 1.7 billion dollars had already been spent, amid years of cost estimates that kept sliding further out of reach no matter when anyone checked them.

    In May 2025, TVA became the first utility in the country to submit a construction permit application to the Nuclear Regulatory Commission for a new small modular reactor, specifically the BWRX-300, a boiling water small modular reactor design developed by GE Vernova and Hitachi.

    The site TVA chose is Clinch River, the same 1,200 acre property where the federal government’s last big nuclear swing already failed once. The Nuclear Regulatory Commission issued its Final Supplemental Environmental Impact Statement for the project on April 6, 2026, per the Federal Register notice, and its Final Safety Evaluation Report on June 25, 2026, finding no safety bars to issuing the construction permit, and has targeted a permit decision for the fall of 2026, meaning a yes or no could arrive shortly before or after this article appears.

    The Department of Energy has since selected TVA for up to 800 million dollars in cost shared federal funding to advance the project, on top of a separate 400 million dollar DOE grant announced in December 2025; TVA’s board has also approved up to 350 million dollars to explore small modular reactor development at Clinch River, according to the White House FY2027 Budget Appendix. TVA has additionally signed on for a 6 gigawatt small modular reactor deployment program with a private developer, framed by the current administration as central to an American nuclear renaissance and an energy dominance agenda.

    None of this is happening because nuclear has been quietly carrying TVA’s business. Local reporting in late 2025 found TVA’s nuclear generation had actually hit its lowest level since 2007 over the preceding year, even as the agency signed on for what would be the largest small modular reactor deployment commitment in the country.

    The bet is being placed on projected future demand, principally from data centers and population growth, using the identical playbook of federally backed capital investment that produced a 26 billion dollar debt pile and a decade of underfunded pensions the last time TVA tried it.

    For some background, the TVA’s total long-term debt stood at approximately twenty-three billion dollars as of June 30, 2026, according to its most recent quarterly filing with the Securities and Exchange Commission, down from the mid-1990s peak but still a substantial balance sheet obligation.

    Betting the Rate Base Again

    None of this means TVA is destined to repeat the Clinch River Breeder Reactor’s fate specifically. Small modular reactor technology is a genuinely different bet than a 1970s liquid metal fast breeder, and federal cost sharing this time is explicit up front rather than discovered after the fact.

    But the structural pattern this series keeps returning to is exactly present here, where a government corporation with an implicit federal backstop and a statutory debt ceiling that Congress has shown a consistent willingness to raise whenever the number gets inconvenient, making a decades long capital commitment to a nuclear technology that has never been built at commercial scale in the United States, funded partly by federal grants that do not show up as taxpayer risk until something goes wrong.

    TVA is not the RFC and it is not Fannie Mae. It has never needed a conservatorship or a liquidation act. But the entity billed in this series as the exception that proves government corporations can work has, on its own regulator’s paper trail, already run the exact experiment it is running again, on the same riverbank, with the same optimism about demand that never quite materialized the last time.

    Whether TVA gets to keep its status as this series’ good example may depend less on nuclear physics than on whether Congress and TVA’s own management have actually learned anything from the debt ceiling they raised forty times to pay for the last round of reactors that never got built.

    Sources: GAO, Shedding Light on Tennessee Valley Authority Debt (2017); GAO, Tennessee Valley Authority: Financial Problems Highlight Need for Long-Term Solutions (AIMD/RCED-95-134, 1995); NRC Final Supplemental Environmental Impact Statement, Clinch River SMR (Federal Register, April 6, 2026); DOE, TVA selected for up to $800 million SMR cost-sharing; TVA SEC quarterly filing (Q3 FY2026).

    Next in the series: the FDIC, the other entity in the running for the series’ success story, and what the 2023 collapse of Silicon Valley Bank revealed about how much daylight there really is between “well run” and “the last one standing.”