Bureaucracy Times

All the news fit to be declassified.

Category: National Security & Defense

  • The Pentagon’s Own Gas Station Is Losing Money on Every Gallon

    Somewhere inside the Defense Logistics Agency’s ledgers this year sits a small, almost comic failure of arithmetic, the kind that would get a corner store shut down but barely rates a footnote in a war. CBO’s letter on the cost of Operation Epic Fury records that DLA, the office responsible for buying and reselling fuel to the entire Department of Defense, raised its surcharge on military fuel purchases by $42 a barrel this year to cover the war’s energy costs. The Government Accountability Office had already told Congress the increase would not be enough. By CBO’s account, GAO expected DLA to lose $1.82 billion on fuel sales in fiscal year 2026 anyway, meaning the agency set a price, watched its own watchdog tell it the price was wrong, and kept charging it. This is the kind of detail that never makes it into a floor speech about supporting the troops, because it is not about the troops at all. It is about a supply agency’s internal pricing model failing in real time, in public, while Congress is being asked to backfill the shortfall.

    The Gas Station That Loses Money on Every Gallon

    DLA is not a charity. It exists to buy fuel in bulk and resell it to the services at a price meant to cover its costs, full stop. When CBO adds up the $835 million in extra surcharge revenue DLA actually collected from April through June against the $1.82 billion GAO says it is on track to lose for the year, the agency comes out roughly $1 billion short of covering what it spent to run the exact same shop. DLA’s own remedy list, as CBO relays it, amounts to drawing down cash reserves, raising prices later to cover this year’s shortfall, or going back to Congress for a supplemental, some combination of an institution quietly eating its own losses and passing the bill forward. This is not exotic mismanagement. It is a government gas station that cannot price gas correctly even with its own accountants standing next to the pump.

    The Magazine Is Empty

    While DLA was losing money on diesel, the missile defense side of the ledger was spending down something that cannot simply be reordered at market price. CBO’s letter states that Operation Epic Fury and the Twelve Day War against Iran that preceded it in 2025 together consumed, by the agency’s estimate, somewhere between one half and two thirds of the entire US inventory of Patriot, THAAD, SM 3, and SM 6 interceptors. A CSIS assessment of the same stockpiles puts the replacement timeline at two to three years for the cheaper interceptors and considerably longer for the most sophisticated ones, because, as CBO notes, it typically takes three to five years just between placing an order for these systems and actually receiving one. CBO’s letter is explicit about why this matters beyond Iran; it points directly at a hypothetical conflict with the People’s Republic of China, whose missile arsenal dwarfs Iran’s and which would draw on precisely the interceptor types the United States just burned through defending Gulf allies and Israel. These are not cheap items to begin with. CBO puts Patriot and SM 6 interceptors at roughly $4 million apiece, THAAD interceptors at about $12 million, and the most advanced SM 3 variant at $28 million, all produced at rates too low to absorb a war’s worth of demand without years of lag. Congress authorized a war against Iran. Nobody voted on drawing down the country’s missile shield for a war with China that has not happened, and CBO is telling them, gently, that this is what occurred anyway.

    A War Bill With a Farm Subsidy and a Train Station Stapled to It

    Then there is the part of the ledger that has nothing to do with fighting at all. The administration’s June supplemental request, justified almost entirely by reference to the Iranian conflict, included $20.5 billion for agencies and purposes CBO could not connect to the war in any meaningful way. The single largest chunk, $11.1 billion, went to the Department of Agriculture, mostly to compensate crop farmers for higher fuel and fertilizer costs tied to the closure of the Strait of Hormuz, a connection CBO is willing to grant even if it is several steps removed from combat. A separate $1 billion of the same wartime request, however, was earmarked for the design and construction of a modernized Penn Station in New York, a project CBO states plainly has no connection to the decision to go to war at all. It rode into an Iran war supplemental request the same way a rider always does, quietly, attached to something urgent enough that nobody wants to be the member of Congress who voted against funding the troops in order to strip out a train station.

    The Invoice Nobody Reconciles

    None of these three items would sink a budget on its own. A rounding error at DLA, a stockpile drawdown with a five year lag, a train station riding along on a war appropriation, each is survivable in isolation. What they share is a pattern this publication keeps finding wherever it looks at federal spending under pressure, which is that the institutions responsible for pricing, replenishing, and appropriating money for a national emergency are not actually very good at doing any of those three things cleanly, and the emergency itself becomes the cover under which the sloppiness gets funded rather than fixed.

    DLA will eventually raise prices again to cover this year’s hole, quietly, in a future fuel bill nobody will connect back to Iran. The interceptors will eventually get rebuilt, five years and several billion dollars from now, for a war that may or may not arrive, against an adversary far better supplied than the one that just emptied the shelves. And Penn Station, whatever its architectural merits, will get built partly on the strength of a line item that borrowed its urgency from a war eight time zones away that had nothing whatsoever to do with commuter rail. Add it up and the pattern is not corruption in any prosecutable sense. It is simply what a bureaucracy does when nobody outside it is required to check the receipts before the money moves.

    Sources: Congressional Budget Office, Cost of Operation Epic Fury (September 2026); CSIS, Last Rounds: Status of Key Munitions After the Iran War Ceasefire; Office of Management and Budget, June 24, 2026 supplemental funding request letter to Speaker Johnson. See also: Congress Asked the Pentagon What the War Costs. The Pentagon Didn’t Pick Up.

    Fediverse Reactions

  • Four Audits, One Camera, and the Grade TSA Won’t Show You

    The Department of Homeland Security’s Inspector General wants you to know that TSA’s facial recognition program is basically fine. It also wants you to know that the part of the audit said to support that claim is classified, so you will have to take the agency’s word for it, which is the exact arrangement the entire program has run on since it started scanning faces at airport checkpoints.

    That is the honest summary of OIG-26-27, released September 15, 2026, and it is only the newest entry in a pile of oversight reports that keeps growing while the program itself keeps expanding unbothered.

    The Test You Are Not Allowed to Grade

    DHS OIG ran covert tests at airport checkpoints to see whether TSA’s facial recognition and identification technology actually catches fraudulent IDs and persons of interest, which is the entire stated justification for the program’s existence. The results produced three findings and six recommendations. TSA agreed with five and flatly refused the sixth. Two of the six recommendations remain open and unresolved months after the audit closed.

    And then, in the same paragraph, the report informs the reader that “additional details related to this part of our audit are classified or otherwise not available for public release.” No specifics on what the covert testers found, no breakdown of how often officers caught a fake ID versus missed one, nothing. The one part of this audit that speaks directly to whether the program works is the one part the public isn’t permitted to see.

    Security agencies classify testing methodology as a matter of course, and there’s a defensible argument for not publishing a how-to guide for beating a checkpoint. But an agency that non-concurs with one sixth of its own inspector general’s recommendations, on the classified section, is not asking for the benefit of the doubt so much as demanding it.

    The Vendor Who Let Itself In

    The unclassified half of the audit is more concrete, and worse. OIG examined how TSA’s Credential Authentication Technology 2 units, the kiosks that scan your driver’s license or passport at the podium, handle the biometric and biographic data they collect. Routine deletion practices checked out fine. The problem was the vendor.

    According to the audit, the CAT-2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and software enhancements, and TSA had no idea when this was happening. There was no policy governing it, no log tracking when data left the system, and no way to confirm the vendor actually deleted what it took. Passengers whose documents were pulled this way were never told.

    TSA concurred with all three recommendations attached to this finding, which sounds like accountability until you notice that one of the three is still listed as open and unresolved. The agency agreed a contractor had unsupervised access to your passport photo and still hasn’t finished fixing it.

    Three Watchdogs, One Stalled Bill

    This is not the first time someone has told TSA this. In May 2025, the Privacy and Civil Liberties Oversight Board released a staff report capping a six year review of the same program. Its headline finding was that DHS’s own Chief Privacy Officer never conducted the compliance review required under internal DHS policy, and that TSA has offered no schedule for when, or whether, that review will happen. PCLOB’s recommendations included independent public audits, a real privacy impact assessment, and mandatory demographic accuracy testing from vendors before deployment, not after.

    A year earlier, the Government Accountability Office reached a related conclusion from a different angle. GAO-24-106293 found that facial recognition accuracy has genuinely improved under laboratory conditions, but that almost nobody has rigorously studied how these systems perform in the field, across demographic groups, at the scale TSA is now deploying them. Improved in the lab and unverified in the wild is not the same claim as safe to use on the traveling public, though TSA’s messaging tends to obscure the difference.

    Meanwhile, TSA’s own public factsheet still describes the program in the language of pure customer service, as a security enhancement, a convenience, entirely voluntary, with no penalty for opting out and photos deleted after a match except in a limited testing environment.

    Every one of those assurances is now sitting next to an OIG finding about an outside vendor quietly copying passport images with nobody watching.

    The factsheet has not been updated to mention it.

    A Bill That Never Boards

    Congress has had an off ramp sitting on the table for three years and has yet to take it. Senator Jeff Merkley first introduced a bill to ban TSA facial recognition outright in 2023; it died without a vote. The current version, the Traveler Privacy Protection Act of 2025, S.1691, is considerably softer, restricting rather than banning the technology, requiring a non-biometric alternative at every checkpoint, and limiting how long TSA can retain the data it collects. It has bipartisan cosponsors and has gone precisely nowhere since being referred to committee, a fate Merkley’s own office has spent years narrating in press releases that read increasingly like dispatches from a stalemate.

    Put the four documents side by side and a pattern appears that no single report captures on its own. An inspector general audits the program and classifies the part that would tell the public whether it works. A privacy oversight board spends six years concluding that the agency responsible for auditing itself never actually did so. A government watchdog finds the underlying technology has been tested in laboratories but not in the world it is actually deployed in. And a bill written to address all three problems sits untouched in committee while the program it would constrain keeps expanding to more airports every year.

    None of this requires a conspiracy. It only requires an agency confident enough in its own mission that it treats oversight as a formality to be managed rather than a question to be answered, and a Congress content to keep writing reports about the problem instead of legislating one out of existence. TSA is not hiding a coverup. It is doing something more mundane and more durable: it is simply outlasting everyone who asks it to explain itself.

    Sources: DHS OIG, OIG-26-27: TSA’s Use of Facial Recognition Technology (September 2026); Privacy and Civil Liberties Oversight Board, Use of Facial Recognition Technology by TSA (May 2025); GAO-24-106293, Facial Recognition Technology: TSA Should Establish Goals and Measures for Evaluating the Impact on Screening (2024); TSA Facial Recognition Technology factsheet; S.1691, Traveler Privacy Protection Act of 2025.

    Fediverse Reactions

  • Congress Asked the Pentagon What the War Costs. The Pentagon Didn’t Pick Up.

    There is a particular kind of silence that only a cabinet department can produce. It is the silence of an institution that has decided the question does not deserve an answer. That is the silence the Congressional Budget Office ran into this year when it tried to price out Operation Epic Fury, the American military campaign against Iran that began on February 28, 2026. Ranking Budget Committee Member Brendan Boyle had asked CBO in March for a nonpartisan number. CBO went looking for one. The Department of Defense, according to CBO’s own letter, simply did not respond to the agency’s requests for information.

    The Silent Treatment

    This is worth sitting with. CBO is not a partisan attack shop; it is the body Congress built specifically so that both parties could agree on a baseline set of facts before arguing about what to do with them. When the agency needed to price out five categories of wartime cost, from expended Tomahawks to increased flying hours, it did not get so much as a courtesy briefing from the department actually fighting the war. Instead, CBO had to reconstruct DoD’s own costs using government databases, public reporting, and a private think tank’s homework, principally a CSIS analysis of munitions inventories that CBO cites as its best available source for how many missiles the Pentagon actually fired. An agency of Congress was reduced to citing a nonprofit’s guesswork about the executive branch’s own arsenal, because the executive branch would not tell it.

    CBO is admirably restrained about what this means. It notes, in the driest possible register, that its resulting estimate of $38.1 billion “is subject to considerable uncertainty.” That sentence is doing a great deal of work. It is bureaucratic for “we had to estimate a war.”

    Four Different Prices for the Same War

    Having built its own number from the wreckage of DoD’s silence, CBO then had the pleasure of comparing it against the three numbers the administration offered instead, none of which agree with each other. In June, the Office of Management and Budget sent House Speaker Mike Johnson a formal request for $87.6 billion in supplemental funding, of which the portion CBO judges directly attributable to the conflict comes to $42.3 billion, about 10 percent above CBO’s own figure. Then, on July 22, Secretary of Defense Pete Hegseth testified before the Senate that the war had cost $37.5 billion. Two weeks after that, without public explanation, DoD quietly revised its own munitions figure upward from $25 billion to $27.7 billion in a briefing to committee staff, nudging its total higher still.

    So Congress has, at various points this year, been handed four figures for the price of the same war: CBO’s $38.1 billion, the administration’s implied $42.3 billion, Hegseth’s sworn $37.5 billion, and DoD’s own quiet revision on top of that.

    Outside government, independent estimators landed in roughly the same neighborhood without any of them matching either. CBO’s letter notes that nongovernmental groups tend to publish still-higher totals, generally because they extrapolate from the war’s expensive early days or fold in costs CBO deliberately excluded, and separate think tank tallies circulating this year ranged anywhere from the low thirties to the high forties of billions, depending on which week’s fighting a given analyst used as a baseline. None of these numbers are wild outliers from one another, which is almost the most unsettling part; they are close enough to look authoritative and different enough to be unreconcilable, produced by an executive branch that cannot seem to settle on its own arithmetic even while testifying under oath about it.

    A Receipt With Twelve Billion Dollars Redacted

    The gap between CBO’s number and the administration’s supplemental request is not just noise, though. Of the $67.1 billion the administration requested for DoD, CBO could only trace $42.3 billion to activity plausibly connected to Operation Epic Fury. The remaining $24.8 billion sits in categories CBO’s letter describes as largely opaque to it, including $5.1 billion for “cybersecurity and autonomy,” $4 billion for something called the Airborne Moving Target Indicator and Space Data Network Backbone, and $12.1 billion filed simply as “other, classified.” CBO goes out of its way to note that prior wartime supplemental requests, for Iraq and Afghanistan, never buried this large a share of the ask behind a classification stamp. A Congressional Research Service review of the same request separately flagged that OMB’s letter and its enclosures did not provide enough detail even for Congress to determine whether some of this money duplicates the department’s ordinary FY2027 budget request, meaning lawmakers may be asked to fund the same missiles twice under two different labels.

    Classified line items are standard practice. A classified third of a wartime supplemental is not, and it lands at the exact moment Congress is least equipped to examine it, because the one agency built to do that could not get DoD on the phone.

    What the Ledger Won’t Say

    CBO’s letter is, in its understated way, a small monument to institutional failure operating at two levels simultaneously. At the surface level, a department at war would not answer basic cost questions from its own legislature’s scorekeeper. Underneath that, the numbers the administration did produce cannot be reconciled with each other, let alone independently verified, and a meaningful fraction of the request has been placed beyond scrutiny entirely. Congress is being asked to appropriate tens of billions of dollars on the strength of a request that its own budget office had to partially reverse-engineer from a think tank report, while a rotating set of official figures drift a few billion dollars apart from each other every few weeks.

    Nobody involved has lied, exactly. Nobody involved has really told the whole truth either, and the agency built to notice the difference had to work the case with the lights half off. That is not a small failure of paperwork. It is what happens when the one branch of government legally entitled to ask “what did this cost” gets treated like a nuisance caller, and the answer it eventually publishes has to carry a footnote admitting it is mostly an educated guess about a war still being fought.

    Sources: Congressional Budget Office, Cost of Operation Epic Fury (September 2026); Rep. Boyle’s March 2026 CBO request letter; CSIS, Last Rounds: Status of Key Munitions After the Iran War Ceasefire; OMB June 24, 2026 supplemental request to Speaker Johnson; Congressional Research Service, IN12700. See also: The Pentagon’s Own Gas Station Is Losing Money on Every Gallon

    Fediverse Reactions

  • DOE Wants Industry to Mine Its Cold War Leftovers. First, It May Want to Check the Math.

    The Department of Energy is looking for companies interested in turning leftovers from America’s nuclear weapons complex into useful commodities.

    There is aluminum and copper from uranium enrichment plants. Lead shielding from a former nuclear rocket facility. Lithium hydride, radioactive cesium and contaminated platinum at Oak Ridge. And in Utah, there are millions of tons of uranium mill tailings that may still contain recoverable vanadium and other critical minerals.

    Before anyone starts digging, however, DOE may want to check the calculator.

    In an Expression of Interest released by DOE’s Office of Environmental Management, the department says approximately 8,000 tons of aluminum are available at its Paducah cleanup site in Kentucky.

    DOE helpfully converts that figure to 56 million pounds.

    It isn’t.

    Eight thousand tons is 16 million pounds, meaning DOE’s own critical-minerals inventory appears to overstate the aluminum weight by 40 million pounds.

    Fortunately, the underlying 8,000-ton estimate appears consistently enough elsewhere in the document to make the problem look considerably more like arithmetic than the sudden appearance of 20,000 additional tons of Cold War aluminum.

    And there is plenty of material without the extra zeroes.

    DOE announced the initiative Sept. 18, seeking information from private industry about recovering surplus materials at five Environmental Management cleanup sites: Paducah, Kentucky; Portsmouth, Ohio; Oak Ridge, Tennessee; the Nevada National Security Site; and the Moab Uranium Mill Tailings Remedial Action Project in Utah.

    At Paducah alone, DOE identifies about 8,000 tons of aluminum and 2,000 tons of copper, plus smaller quantities of tungsten, silver, platinum and selenium.

    That is roughly 20 million pounds of aluminum and copper before anyone reaches the more exotic items on the list.

    Much of it is a legacy of the enormous gaseous diffusion equipment once used to enrich uranium. DOE says the aluminum and copper are primarily contaminated with uranium on their surfaces, potentially allowing them to be decontaminated and recovered.

    Portsmouth presents a similar opportunity, including about 1,100 tons of copper from electrical equipment, 280 pounds of fluorine and a decidedly less industrial 3.1 grams of platinum.

    Oak Ridge gets stranger.

    DOE lists approximately 10,000 pounds of lithium hydride contained in shielding assemblies, about 1,000 grams of platinum and 1.39 pounds of cesium-137 chloride contained in sealed radioactive sources.

    Recovering the cesium, unsurprisingly, would require shielding, remote handling and specialized processing. The platinum comes with its own complication: contamination from cobalt, cesium and strontium.

    In other words, this is not a government garage sale.

    Sixteen Million Tons Already Buried

    The most intriguing possibility may be sitting in an engineered disposal cell about 30 miles north of Moab, Utah.

    DOE has spent years moving uranium mill tailings from the former Atlas mill beside the Colorado River to Crescent Junction. The material originated from uranium and vanadium ores processed between 1956 and 1984.

    Approximately 16.2 million tons of material covered by DOE’s analysis have already been placed in the disposal cell.

    Now the department wants to know whether some of what it buried might still be useful.

    Historical sampling found vanadium in the tailings, particularly in fine-grained material. DOE also identifies aluminum, antimony, beryllium, bismuth, cobalt, copper, lithium, manganese, nickel, tungsten, zinc and other potentially useful minerals.

    There is an important caveat.

    DOE says there has been no site-specific metallurgical testing establishing that those minerals can actually be recovered economically. The material is heterogeneous, radioactive and already inside a regulated disposal facility. DOE specifically warns against using historical samples to calculate a whole-cell mineral resource.

    The tailings averaged about 477 picocuries per gram of radium-226 in 2012-2025 loadout measurements.

    Mining yesterday’s radioactive waste, apparently, comes with paperwork.

    Recycle It or Bury It

    Nevada offers perhaps the simplest illustration of what DOE is trying to accomplish.

    At the Nevada National Security Site, DOE has surplus lead shielding from the former Engine Maintenance, Assembly and Disassembly facility, part of the Cold War-era nuclear rocket program.

    The inventory includes 402 standardized lead bricks already characterized as non-radiological, along with additional bricks and lead shot expected as dismantlement proceeds.

    DOE has a deadline.

    The lead must be dispositioned before May 1, 2027. If no user is found, DOE says it will be disposed of at the Nevada site.

    That turns the exercise into more than a hunt for valuable metals. Every pound successfully reused can potentially represent material DOE does not have to process, transport, store or dispose of as waste.

    There is historical precedent for that calculation. Federal reviews of DOE cleanup activities have long examined whether recovering metals from former nuclear facilities could offset disposal costs and produce commodity value.

    But DOE has not provided a current estimate of how much taxpayers could save through this particular initiative.

    That may be because DOE does not yet know.

    The current solicitation is only an Expression of Interest. DOE is not offering companies funding, and interested firms would be responsible for the equipment and expertise necessary to extract, process or relocate the material. DOE is essentially asking industry to tell the government what can realistically be recovered and what anyone might actually want.

    Companies have until Nov. 2 to respond, following a virtual Industry Day scheduled for Sept. 30.

    For an agency responsible for cleaning up the remnants of decades of nuclear weapons production, the experiment represents an unusual reversal.

    For years, the question has been how much it will cost to get rid of the material.

    DOE is now asking whether someone might want to buy, recover or reuse it instead.

    Just remember that the 8,000 tons of aluminum still weighs 16 million pounds.

    Fediverse Reactions

  • The Pentagon Spent Four Years Losing Track of $141 Million Meant to Arm Iraq Against ISIS

    There is a certain genius to a bureaucracy that can build an entire apparatus, complete with memoranda, standard operating procedures, and a coordination group that meets twice annually (on paper), and still lose track of $141 million. The Department of War’s Inspector General released a report on September 10 documenting exactly that: a program built to equip vetted Iraqi forces against ISIS that spent years shuffling paperwork between rotating officers who had, on average, ten days of handoff briefing before assuming responsibility for a multi-year, nine-figure equipment pipeline.

    The program is called the Counter-ISIS Train and Equip Fund for Iraq, or CTEF-I, and Congress has appropriated $414.7 million for its equipment component since fiscal year 2022. The findings, delivered with the OIG’s trademark flat affect, describe an institution that built the paperwork and then forgot to watch what happened to it.

    Endorsement at the Speed of Bureaucracy

    The USCENTCOM Syria-Iraq Train and Equip Cell’s own standard operating procedure, dated May 2020, allows 30 days to endorse an equipment request package once it clears initial submission; officials told auditors the real target, absent complications, is seven days. From October 2021 through May 2025, USCENTCOM missed that window on 53 of 80 packages, or 66 percent of everything submitted, worth $473 million. The average endorsement for those 53 took 131 days. One package, worth $8 million, took 592 days: nearly a year and a half spent bouncing a request back and forth over a missing mission statement and an unidentified vetted officer, a delay that survived two full personnel rotations before anyone resolved it.

    The report’s timeline reconstructions read like a workplace comedy with body armor at stake. A package submitted in April 2022 sat untouched for a year because nobody on either side followed up, during which the CJTF-OIR staff assigned to it rotated out twice. When someone finally looked again, the fix required months of back-and-forth over a single missing detail: an officer’s job title.

    None of this is because the underlying paperwork was bad. Auditors reviewed all 80 justification letters submitted over the audit period and found every one contained the required justification and capability gap analysis. The problem was never the writing; it was what happened to the writing after it was submitted.

    An Institutional Memory That Rotates Out Every Six Months

    The report’s central diagnosis is almost sympathetic, in the way autopsies are sympathetic: CJTF-OIR’s Directorate of Military Assistance, the unit actually responsible for tracking equipment through a process that can run more than four years, is staffed entirely by individually deployed service members on six to twelve month rotations. Do the math and a single equipment request can pass through the hands of eight different people before it reaches an Iraqi unit. The handoff between each of them, per the Directorate’s own Director, consisted of ten days of briefing from the outgoing officer.

    USCENTCOM’s civilian contractor staff, by contrast, do not rotate and could in theory provide the institutional continuity the military side lacks. Except the OIG found that USCENTCOM’s own SITEC office quietly stopped performing duties its 2020 SOP explicitly assigns it, including maintaining a tracker of procurement status and liaising with procurement commands, and let those responsibilities drift onto the rotating military personnel it was supposed to be backstopping. The one CTEF-I-specific training event that did exist, an annual conference, was not scheduled around rotation dates and was designed to build the next budget request rather than teach anyone how to track equipment already in the pipeline.

    The result is a program tracked across at least four separate, non-interoperable systems (a USCENTCOM tracker, the Security Cooperation Information Portal, a Defense Security Cooperation Agency tracker, and a CJTF-OIR demand tracker), each using its own case numbers, with no end-to-end view of where any given shipment actually stands. CJTF-OIR personnel told auditors they did not even have system access to see what equipment was scheduled to arrive in Kuwait; they found out when it showed up.

    Where the $141 Million Went

    The consequences arrived in three flavors. First, $64 million in equipment sat in Kuwaiti warehouses as of May 2025 awaiting reallocation because the original requirement had lapsed, including body armor and Soviet-style machine guns that have been in storage since 2017. CJTF-OIR trimmed that pile to $19 million by February 2026, an improvement the OIG credits while noting the remainder still needs a plan: reassign it, return it, or dispose of it.

    Second, $25 million in fiscal year 2024 equipment funds simply expired on September 30, 2025, unobligated, because the endorsement backlog ate the clock. CJTF-OIR had to raid fiscal year 2025 money to cover the requirements the expired funds were supposed to fund, a shell game the OIG classifies, without euphemism, as waste.

    Third, and worst, $52 million worth of equipment across 128 line items was still sitting somewhere in the procurement pipeline as of August 2025, never having shipped to Kuwait, with nobody able to say whether the original requirements were still valid. Eighteen of those line items were endorsed and funded at least five years ago and still have not reached a Partner Force unit. The tracker that surfaced this figure was compiled manually by a separate Army command and had not been updated in six months when investigators found it; it also only goes back to 2019, meaning the true backlog could be larger and simply invisible.

    Layered on top of the equipment mess is Finding B, which is almost a separate scandal wearing the same report’s clothes: the policy office responsible for aligning CTEF-I with strategic goals convened zero coordination-group meetings in all of 2025, despite a 2022 memo requiring two per year, and the operational command responsible for quarterly campaign assessments completed exactly two of them between fiscal year 2022 and the third quarter of fiscal year 2025. Both processes were, in the OIG’s careful phrasing, “initiated, but later suspended.” Nobody documented the decision to stop.

    Six Recommendations, Two of Which USCENTCOM Would Rather Not Discuss

    The OIG issued six recommendations. Four landed as “resolved”: the policy office agreed to restart its coordination group, and CJTF-OIR agreed to sort out the reallocation backlog and the stalled shipments, with an internal deadline of September 30, 2026. The other two, both aimed at USCENTCOM and asking for a comprehensive tracking mechanism and a real standard operating procedure, were met with responses the OIG describes as neither agreeing nor disagreeing, and which “did not address the specifics of the recommendation.” USCENTCOM’s counteroffer was a promise to stop accepting incomplete packages by October 1, 2026, which the OIG points out does nothing about the four years of packages already lost in the machinery. Both recommendations remain open and unresolved, and the OIG has given USCENTCOM 30 days from the report’s release to try again.

    At least $71 million of the money involved is, in the OIG’s own accounting language, funds that could still be put to better use. Whether it gets there depends on an institution that has already demonstrated it can build a tracking system, forget to use it, and still call the paperwork complete.

  • Federal Register Watch: September 17, 2026

    EPA moved to unwind its own legal basis for regulating power-plant greenhouse gases, finalizing a repeal of its 2024 carbon standards for electric generating units while, on the same day, proposing to rescind the underlying 2015 findings that justified regulating those emissions at all.

    • EPA proposes rescinding the 2015 findings behind power-plant climate rules. EPA proposed rescinding the 2015 findings that greenhouse gases from fossil-fuel power plants endanger public health, the legal foundation beneath a decade of federal climate regulation for the sector. The agency offers three separate arguments for reversing itself, including that Congress never clearly authorized EPA to regulate power plants over climate change under the “major questions doctrine,” and that eliminating the entire U.S. power sector’s emissions would have only a negligible effect on global temperatures. Because this is a proposed rule rather than a final one, it opens debate instead of closing it: comments are due November 2 and a virtual public hearing is set for October 1, giving utilities, states, and advocacy groups a real chance to contest the reasoning before it can take legal effect. Read the proposal.
    • EPA finalizes repeal of most of the 2024 Carbon Pollution Standards. In a companion action published the same day, EPA finalized the repeal of most of its 2024 Carbon Pollution Standards, including emission guidelines for existing coal- and gas-fired power plants and carbon-capture requirements the agency itself adopted only two years earlier. Unlike the proposal above, this one is already final, meaning it takes legal effect without any further public comment. Pairing a final repeal with a still-pending proposal to erase the legal findings underneath it is an unusual sequence, since it leaves EPA’s authority to write any future power-plant rule resting on a foundation the agency has separately proposed to tear down. Read the final rule.
    • FDIC calls a merger-policy board meeting on unusually short notice. The FDIC gave notice of a board meeting held with less than seven days’ advance warning, short of the one week of public notice its Sunshine Act procedures normally require, to take up two proposed rules on bank merger transactions and “state bank parity” plus a vote to rescind an existing supervisory guidance document. Federal open-meeting law expects an agency to state why a shortened notice period was necessary, and this notice offers no reason, which matters because that explanation is the only real check on how much warning the public and affected banks get before a board acts on merger policy. Read the notice.
    • FDA denies exemption for AI radiology software, despite a title that reads the other way. FDA denied a device maker’s petition to exempt certain AI-based radiology software, including cancer-detection and triage tools, from the premarket notification process that normally requires FDA clearance before a device can be sold. The agency found that relying on the company’s prior clearances and a proposed post-market monitoring plan wasn’t enough to show that skipping that clearance review would leave patients just as safe. It’s worth flagging because the document’s own title, “Exemption From Premarket Notification,” names the type of request under review rather than its outcome; read quickly, it can look like FDA loosened oversight of AI diagnostic tools when the agency in fact declined to. Read the notice.
    • Commerce renews export ban on Aeroflot, citing an active violation. The Commerce Department’s Bureau of Industry and Security renewed its temporary denial of export privileges against Russia’s PJSC Aeroflot, citing evidence the airline kept operating U.S.-regulated aircraft components in violation of the denial order Commerce had renewed just last September. A temporary denial order cuts a company off from anything subject to U.S. export rules, and a finding that Aeroflot defied the prior renewal, rather than the agency simply extending it as a precaution, signals that the restriction isn’t achieving compliance and that Commerce is now treating the airline as an active violator rather than a monitored risk. Read the order.

    This edition draws on the Federal Register’s full docket of 72 documents published on September 17, 2026. Set aside as routine: airworthiness directives, OMB/PRA information-collection notices, Coast Guard drawbridge and safety-zone notices, SEC self-regulatory-organization filings, FERC combined filings and blanket-authorization notices, cultural-property exhibition determinations, Postal Service product notices, and other standard administrative filings that didn’t trip an institutional-significance or anomaly signal.

    Fediverse Reactions

  • The Pentagon Audited Its Clocks. Everything Interesting Is Classified.

    The Pentagon’s inspector general recently released an audit concerning the security of the military’s clocks.

    Then it classified essentially everything interesting about it.

    All 10 recommendations in the September 9 audit are classified. No redacted public version of the report is available. What remains publicly visible is little more than the title, administrative metadata and one particularly intriguing fact…the investigation began because somebody made allegations to the Department of Defense Hotline.

    These, however, are not ordinary clocks.

    The Military Has Some Very Important Clocks

    Defense Regional Clocks are part of the Pentagon’s Critical Time Dissemination program, a geographically distributed precision-timing capability intended to keep mission-critical systems synchronized when normal external timing sources are degraded or unavailable.

    The Defense Department created the Critical Time Dissemination effort after recognizing the vulnerability created by dependence on the Global Positioning System. Modern military operations rely on precise positioning, navigation and timing for far more than telling soldiers what time it is. Communications networks, navigation systems, sensors and other systems can depend on extraordinarily precise synchronization.

    The clocks therefore provide part of the resilience needed when GPS or other timing sources are disrupted, jammed, spoofed or lost.

    That makes an audit of their security controls considerably less whimsical than its title initially suggests.

    A Program Years in the Making

    The Critical Time Dissemination program traces back to a fiscal 2012 Defense Department decision intended to address vulnerabilities associated with reliance on GPS.

    Its rollout was not particularly clocklike.

    Defense Department performance records show Defense Regional Clock installation at 63 percent in 2018 and 85 percent in 2019. The department expected to reach 100 percent installation in fiscal 2021.

    It did not.

    During fiscal 2020, installation remained at 87 percent through all four quarters. Subsequent Defense Department planning documents continued moving the finish line, eventually targeting completion of initial operational capability by the end of fiscal 2024.

    The publicly stated schedule therefore appears to have slipped roughly three years from the earlier fiscal 2021 target.

    GAO Finds an Incomplete Business Case

    The deployment history was not the only warning sign in the public record.

    In 2022, the Government Accountability Office examined several Defense Department programs intended to provide alternatives to GPS-based positioning, navigation and timing. Critical Time Dissemination was among them.

    GAO reported that the Office of the DoD Chief Information Officer planned to transition Critical Time Dissemination into the major capability acquisition pathway. But several pieces of its acquisition business case were still unfinished. Requirements were being drafted, and although a technology-risk assessment had been completed, an acquisition strategy, schedule-risk assessment and independent cost estimate had not.

    GAO’s formal business-case recommendation concerned Navy alternative-PNT programs rather than Critical Time Dissemination specifically. But the review nevertheless documented that, roughly a decade after the program began, CTD still lacked several elements of a complete acquisition business case.

    Then the Modernization Became Classified

    Classification surrounding the clock program did not begin with the inspector general’s latest audit.

    DISA’s fiscal 2023 budget justification included a $10 million increase for “Critical Time Dissemination Defense Regional Clocks Modernization.”

    The public explanation for the increase consisted of one word: “Classified.”

    That does not necessarily indicate anything improper. Military timing infrastructure has obvious national-security implications, and publishing technical vulnerabilities, architecture or precise capabilities could itself create risk.

    But then somebody called the Hotline.

    The Hotline Allegation

    On February 20, 2025, the DoD Office of Inspector General announced an audit of security controls protecting Defense Regional Clocks.

    The project announcement was unusually explicit about why the audit existed: “We are initiating the subject audit in response to allegations to the DoD Hotline.”

    The publicly stated objective was to determine whether security controls protecting the clocks were effective.

    The announcement directed work toward the Office of the DoD Chief Information Officer, the U.S. Naval Observatory, the Defense Information Systems Agency and selected Defense Regional Clock locations. It also instructed participating organizations to identify both a knowledgeable GS-15-equivalent point of contact and a Senior Executive Service or General/Flag Officer familiar with DRC security who could engage with senior OIG leadership if necessary.

    The allegation itself remains out of public view. The available records do not identify who made it, what specific weakness was alleged or when the underlying concern first arose.

    What Happened While OIG Was Looking?

    This is where the public chronology becomes particularly interesting.

    While the OIG audit was underway, Defense Department budget and procurement records began describing substantial additional work involving the timing infrastructure.

    DISA’s fiscal 2027 procurement justification requests more than $20 million for Critical Time Dissemination, including nearly $14 million for a Monitor and Control capability covering 46 Defense Regional Clocks and 30 Timing and Synchronization Support Center suites.

    The budget document contains a revealing description of the existing architecture: “The DRCs and TSSCs are currently independent and there is no existing connective network.”

    The proposed capability would connect the systems for centralized calibration and monitoring.

    Other fiscal 2027 budget material describes funding for a permanent test laboratory supporting system optimization and security compliance, anti-spoofing technology upgrades, GPS-independent time-holding capabilities and additional personnel.

    Those personnel would help inspect, operate and upgrade the globally deployed systems and maintain a watch-floor presence monitoring mission-critical timing assets.

    In June 2026, meanwhile, the Navy sought a firmware upgrade from FEI-Zyfer for 50 Time and Frequency Reference Measurement Systems supporting the Critical Time Dissemination project at the U.S. Naval Observatory. Procurement records describe capabilities involving additional external timing inputs, processing multiple streams, weighting and prioritizing timing sources and seamless failover.

    There is currently no public evidence establishing that these subsequent upgrades resulted from the Hotline allegations or from findings developed during the OIG audit.

    The timing is noteworthy, but chronology is not causation.

    What the documents do provide is a before-and-after silhouette worth examining further.

    Ten Recommendations, Ten Secrets

    On September 9, 2026, the DoD OIG finally released the audit.

    Sort of.

    Oversight.gov lists 10 recommendations associated with the audit. All 10 are classified. All 10 are listed as open. The OIG says the report contains classified information and that no redacted version is available.

    The public can therefore establish that allegations were made, that the inspector general considered them sufficient to initiate an audit of security controls, that the audit ran for roughly 19 months and that it resulted in 10 recommendations requiring corrective action.

    What the public cannot establish is what OIG found.

    The Record That Classification Can’t Erase

    There may be entirely legitimate national-security reasons why the vulnerabilities identified by the inspector general cannot be made public. Publishing locations, architectures or exploitable weaknesses in military timing infrastructure would hardly constitute responsible transparency.

    But classification does not make the surrounding public record disappear.

    That record shows a military timing program created to reduce dependence on GPS; a deployment that missed earlier completion targets; an acquisition effort that GAO found was still missing several business-case elements years after the program began; classified modernization spending; a subsequent Hotline allegation concerning security controls; and, while the resulting audit was underway, plans for centralized monitoring, security-compliance testing, anti-spoofing improvements, additional personnel and firmware upgrades.

    None of that tells us what the Hotline complainant alleged.

    It tells us why the question is worth asking.

    Someone saw enough of a problem with the Defense Regional Clock program to contact the Defense Department Hotline. The inspector general considered the allegations sufficient to launch an audit. That audit ultimately produced 10 recommendations.

    The public is permitted to know that much.

    What happened in between remains classified.

    Bureaucracy.news is continuing to examine the contracting, deployment and security history of the Defense Regional Clock program and the circumstances surrounding the Hotline allegations that prompted the audit.

  • The Security Order That Failed: Why CBP’s 2023 Modernization Directive Went Unenforced for Three Years

    In May 2023, U.S. Customs and Border Protection‘s leadership issued a formal directive requiring all information technology applications to consolidate their access controls under a centralized security system. It was a reasonable mandate: CBP recognized that its IT infrastructure had become fragmented and chaotic, with different applications using different security protocols. Centralization would improve security and make it easier to track who had access to what.

    Three years later, the order remains largely unenforced.

    The directive, issued as IPL-2022-05-0253 in May 2023, required all CBP application owners to “evaluate the feasibility of enrolling in” CBP’s Access Management System (AMS)—the centralized platform designed to manage user access across the agency’s 100 major IT applications.

    According to a Department of Homeland Security Office of Inspector General audit released September 4, 2026, CBP never followed up.

    This is one of three pieces covering the same OIG audit. The other two examine how hundreds of separated contractors and transferred employees kept active system access after leaving CBP, and a seven-year-old privileged account vulnerability that gave all 76,000 CBP network users administrative access.

    “The directive required all CBP application owners to evaluate the feasibility of enrolling in the AMS. Yet this policy was neither fully implemented nor enforced because CBP did not develop a process to track and monitor compliance with the directive, and some application teams disagreed with the directive’s requirements.”

    In other words: CBP issued an order, and then failed to build any mechanism to ensure the order was obeyed.

    Why This Matters: The Fragmentation Problem

    CBP operates approximately 100 major IT applications. Each one stores, processes, or accesses sensitive information: law enforcement data, biometric records, border security intelligence, personal information of travelers.

    For security to work at scale, CBP needs to know, at any given moment, who has access to what systems and why. This requires a centralized system of record—a single source of truth for user access across all applications.

    Before the May 2023 directive, CBP didn’t have that. Instead, the agency relied on individual application owners to manage access for their own systems. This approach created what the OIG audit describes as “oversight challenges for ensuring all accounts were monitored in accordance with requirements.”

    It’s a diplomatic way of saying: CBP had no idea whether its access controls were actually working.

    “CBP acknowledged that it could not identify all applications on its network,” the OIG audit states. Think about that: CBP couldn’t account for all of its own applications.

    This is not a minor technical issue. If CBP can’t identify all applications on its network, then CBP can’t secure them. Unidentified applications are unmonitored applications. Unmonitored applications are vulnerable applications.

    The Directive’s Core Requirement

    The May 2023 Identity Credential and Access Management Directive was CBP’s attempt to fix this problem at the structural level. The order required all application owners to evaluate whether their systems could be integrated into the centralized AMS.

    For applications that *could* be integrated, the directive implied they *should* be integrated. For applications that couldn’t be integrated (due to technical limitations), the directive required them to maintain their own rigorous access control standards while remaining outside the centralized system.

    In principle, this makes sense: Consolidate what you can, and tightly control what you can’t.

    In practice, CBP didn’t build any mechanism to enforce it.

    “CBP did not develop a process to track and monitor compliance with the directive,” the OIG found.

    This is a critical failure point. A directive without enforcement is merely a suggestion. And in a large bureaucracy, suggestions are easy to ignore.

    The OIG identified specific cases of non-compliance. “During our audit, we found not all application owners appropriately monitored their accounts. For example, one major application team we met with did not review their application service accounts in fiscal years 2023 and 2024, as required.”

    One major application team. Not reviewing accounts. For an entire two-year period. As required by policy.

    And no one noticed, because no one was checking.

    Organizational Resistance

    The OIG audit includes a phrase that deserves close attention: “some application teams disagreed with the directive’s requirements.”

    This is remarkable. A formal directive from CBP’s leadership on a critical security matter, and application teams simply disagreed with it.

    The audit does not elaborate on which teams disagreed, what their objections were, or what CBP leadership did in response to the disagreement. But the fact that disagreement existed and persisted suggests CBP’s leadership lacked either the authority or the will to enforce compliance.

    There are legitimate reasons why an application team might resist centralization:

    • Technical concerns: Their legacy system might not be compatible with the centralized platform
    • Operational concerns: Integration might cause service disruptions or performance degradation
    • Resource constraints: Integration requires staff time and potentially licensing costs
    • Autonomy concerns: Application teams might prefer maintaining control over their own access management

    Any of these reasons could be valid. But a security directive isn’t something that gets negotiated away because a team prefers autonomy or fears disruption. Security is not optional.

    The fact that CBP issued a directive and then allowed disagreement to derail it suggests that application teams had more power than the directive issuer. This is an organizational dysfunction issue.

    The Audit Timeline: How CBP Fell Behind

    The chronology is revealing:

    – May 2023: CBP’s Identity Credential and Access Management Directive is issued

    – October 2024 – December 2025: OIG audit is conducted

    – September 4, 2026: OIG audit is released, revealing non-compliance

    The audit took place approximately 18 months after the directive was issued. At that point, CBP had not yet developed a process to track compliance.

    This isn’t incompetence. This is a pattern: Issue a directive, don’t follow up, and when an auditor asks what happened, explain that enforcement mechanisms weren’t built.

    The OIG’s recommended corrective actions are telling:

    • “Identify all applications not in compliance with the Identity Credential and Access Management Directive” (Estimated completion: December 31, 2026)
    • “Develop and implement a process to monitor and enforce compliance with the Identity Credential and Access Management Directive” (Estimated completion: December 31, 2026)
    • “Develop and implement controls to monitor whether applications not integrated with CBP’s access management system comply with DHS and CBP privileged account security requirements” (Estimated completion: December 31, 2026)

    In other words: In September 2026, CBP is still in the process of doing things it should have done before issuing the May 2023 directive.

    CBP’s Response: Another Directive

    In response to the OIG audit, CBP agreed to the recommendations and provided corrective action plans.

    The agency’s response to the “monitor and enforce compliance” recommendation is instructive: “CBP’s Office of Information and Technology, Cybersecurity Directorate will develop and implement a standardized process to monitor and enforce compliance with the Identity Credential and Access Management Directive. This process will include regular reviews of application entitlements and coordination with application owners to ensure alignment with access management requirements. CBP will work to address legacy practices that allow certain applications to operate outside the centralized Identity Management platform.”

    This is bureaucratic language for: “We will now do what we should have done in May 2023.”

    CBP also acknowledges that building the inventory is itself a challenge: “CBP’s Office of Information and Technology, Cybersecurity Directorate will initiate an enterprise-wide effort to catalog all applications in use across the organization. This will include leveraging existing resources such as Mobius, Information Systems Security Manager/Information System Security Officer distribution lists, and other authoritative sources to develop a comprehensive inventory.”

    In 2023, CBP issued a directive to fix a security problem. In 2026, CBP is still trying to inventory what applications it owns. The direction of progress is clear, but the pace is glacial.

    A Symptom of Larger Dysfunction

    The May 2023 directive failure is not an isolated incident. It’s part of a pattern visible throughout the OIG audit.

    CBP issued account disablement policy directives in August 2023 (Directive 51715-006 and Directive 1210-007B). The audit found that supervisors and contracting officers still weren’t following them in 2023-2024.

    CBP’s access management system existed and was supposed to work, but many applications weren’t enrolled in it, so it didn’t actually manage access to those applications.

    CBP had defined processes and had built systems, but the systems weren’t integrated and the processes weren’t enforced.

    This is the hallmark of organizational dysfunction: scattered implementation, inconsistent enforcement, and reactive problem-solving instead of proactive governance.

    An alternative model would look like this:

    1. Issue a directive with specific compliance requirements
    2. Simultaneously build enforcement mechanisms
    3. Establish timelines and penalties for non-compliance
    4. Assign clear accountability for each component
    5. Monitor compliance proactively
    6. Address non-compliance immediately

    CBP’s actual model:

    1. Issue a directive
    2. Wait for voluntary compliance
    3. Eventually, notice that compliance isn’t happening
    4. When audited, admit that no enforcement mechanism was built
    5. Promise to build enforcement mechanisms in the future

    The Fundamental Question

    The May 2023 directive came after years of known, documented access control problems at CBP. The OIG had audited CBP’s access controls before. CBP knew its infrastructure was fragmented and inconsistently managed.

    So when CBP’s leadership decided to issue a directive requiring centralization, that decision presumably came with an understanding that centralization would require enforcement and monitoring.

    Yet no enforcement mechanism was built. No compliance monitoring was established. No timeline or accountability structure was created.

    Why?

    Possibilities:

    • Resource constraints: Monitoring compliance requires staff and budget that weren’t allocated
    • Technical limitations: The systems needed to monitor compliance weren’t ready
    • Leadership weakness: CBP’s CIO lacked authority to enforce directive compliance
    • Organizational fragmentation: Application owners reported to different chains of command and had different priorities
    • Competing demands: CBP’s leadership prioritized other initiatives over security modernization

    The OIG audit doesn’t answer this question. CBP’s response doesn’t address it. It remains unexplained.

    What Happens Now

    CBP’s corrective action plans commit to:

    • Completing application inventory by December 31, 2026
    • Implementing compliance monitoring and enforcement by December 31, 2026
    • Addressing legacy practices that bypass centralized controls by December 31, 2026

    If these timelines hold, CBP will finally, in late 2026, be implementing enforcement mechanisms for a directive issued in May 2023.

    That’s 3.5 years between issuing a security directive and building the enforcement mechanisms to actually make it work.

    The OIG will presumably audit CBP again in a year or two to determine whether the corrective actions actually solved the problem. If history is any guide, the answer will depend on whether CBP maintains the monitoring process over time or lets it atrophy.

    A directive that goes unenforced for three years suggests something deeper than a one-time oversight. It suggests that enforcing security directives isn’t actually prioritized in CBP’s organizational culture, even when the directive comes from leadership.

    That’s a pattern worth watching.

    References and Links

    – Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — OIG-26-28-Sep26.pdf — Released September 4, 2026 by the DHS Office of Inspector General

    – OIG Report Section: Key Finding 2: “CBP Did Not Ensure All Accounts Were Periodically Reviewed” (pages 4-5 of report)

    – CBP Policy Documents (referenced in audit):

    • CBP Identity Credential and Access Management Directive (IPL-2022-05-0253, May 2023)
    • CBP Directive 51715-006: Separation and Reassignment Directive for CBP Employees (August 2023)
    • CBP Directive 1210-007B: Tracking of Contractor Employees (August 2023)

    – DHS Policy (referenced in audit):

    – DHS OIG Homepage: www.oig.dhs.gov

    Editor’s Notes

    – CBP was asked for specifics about: (1) which application teams disagreed with the directive and on what grounds; (2) why no enforcement mechanism was built in May 2023; (3) what resources and timeline were originally planned for the directive’s implementation; and (4) what changed between May 2023 and September 2026 that prompted CBP to prioritize compliance monitoring. CBP declined to provide additional information beyond its written response to the OIG audit.

    – The CBP Identity Credential and Access Management Directive (IPL-2022-05-0253) is referenced in the OIG audit but the full text does not appear in the public report. Bureaucracy Times FOIA’d this document for fuller analysis; results pending.

    – The OIG audit notes that “CBP was aware of these challenges and took action to address them in May 2023” by issuing the directive. This confirms that CBP’s leadership recognized the fragmentation problem. The failure was in execution, not awareness.

    – All of CBP’s corrective action timeline commitments (December 31, 2026 and August 31, 2026) fall within the current fiscal year and represent commitments made to the OIG in response to the audit. These are not yet guaranteed to be achieved.

    Fediverse Reactions

  • CBP’s 7-Year Security Blind Spot: What the Agency Won’t Explain About Its Undetected Vulnerability

    A powerful administrative account was created inside U.S. Customs and Border Protection‘s computer network in 2019. For seven years, that account allowed any of CBP’s 76,000 network users—including contractors, visiting personnel from other agencies, and potentially anyone with network access—to perform privileged administrative tasks. They could reset passwords. They could modify user permissions. They could change security configurations.

    CBP didn’t catch it. A federal audit did.

    On September 4, 2026, the Department of Homeland Security Office of Inspector General released an audit of CBP’s information technology access controls. Buried in the report is a finding so significant that it demands an explanation CBP has not provided: How did a critical vulnerability created in 2019 remain undetected for seven years, until an outside auditor discovered it during routine testing?

    This is one of three pieces covering the same OIG audit. The other two examine how hundreds of separated contractors and transferred employees kept active system access after leaving CBP, and a 2023 security directive that went unenforced for three years because no compliance mechanism was ever built.

    The OIG report provides only a partial answer, using the bureaucratic language of “monitoring gaps” and “lacking tools to detect unexpected configurations.” But that explanation raises more questions than it answers—and CBP has declined to provide clarification.

    The Vulnerability: Widespread Privileged Access

    Service accounts are special non-human accounts used by IT systems to perform automated functions. Unlike regular user accounts, service accounts typically have elevated privileges—they need to perform powerful tasks that regular users shouldn’t be able to do.

    In principle, service accounts are carefully controlled. Only authorized applications should be able to use them. Regular users should never have access to them.

    But in CBP’s case, all 76,000 network users had access to one highly privileged service account. 

    “We identified a major vulnerability that attackers could have used to compromise CBP’s network,” the OIG stated flatly.

    With this access, an attacker could:

    • Change account passwords across CBP’s network
    • Add or remove user access permissions
    • Modify security configurations
    • Cover their tracks by manipulating audit logs (potentially)

    The implications are staggering. Every one of CBP’s 76,000 network users—including contractors, visiting personnel from other DHS components, and outside consultants—could perform administrative functions that should be restricted to a handful of vetted security professionals.

    “If CBP does not safeguard privileged accounts, attackers could use elevated permissions to access sensitive resources and perform powerful tasks, such as changing passwords and security settings,” the OIG warned.

    Seven Years of Exposure

    The vulnerability was created in 2019. The audit fieldwork took place from October 2024 through December 2025. CBP remained unaware of the problem for approximately seven years.

    “CBP immediately fixed the issue once notified,” the OIG report states. But this formulation obscures a critical question: Why did it take seven years for CBP to discover something an auditor found during standard testing?

    The answer, according to CBP, is monitoring gaps.

    “According to CBP, its privileged account vulnerabilities occurred due to human error and challenges associated with monitoring account access changes over time, such as lacking tools to detect unexpected configurations,” the OIG noted.

    CBP also provided a timeline. “In recent years, CBP implemented new monitoring capabilities,” the report states. “However, according to CBP, these new controls were not as effective for older accounts.”

    This raises immediate questions:

    • When exactly were these new monitoring capabilities implemented? If “recent years” means 2023 or 2024, then CBP had at least one or two years between deploying new monitoring and the audit discovering this vulnerability. Why didn’t those new tools catch it?
    • What about 2019 through 2022? What was CBP’s monitoring posture during those years?
    • If CBP lacked tools to detect unexpected configurations in 2019-2022, how did the auditors detect this vulnerability? What did they use that CBP didn’t have?

    CBP has not answered these questions. Bureaucracy Times submitted follow-up questions to CBP’s public affairs office asking for specifics on monitoring capabilities, timeline of deployment, and the auditor’s detection methodology. The agency declined to provide additional information.

    The Audit Process That Found It

    The OIG didn’t discover this vulnerability through passive monitoring or review of CBP’s security logs. They found it through active testing.

    “We performed technical assessments and penetration testing of CBP’s domain,” the audit states. “We completed penetration testing and configuration, vulnerability, and Active Directory assessments of the CBP Directory Services platform to determine how CBP manages vulnerabilities and security settings.”

    In other words: The OIG actually tried to break into CBP’s system, and in doing so, found this vulnerability. This is standard practice for security audits, but it underscores the key point—this wasn’t a passive discovery. This was an active security assessment, and it immediately surfaced the problem.

    The Larger Context: Other Privilege Escalation Paths

    The service account vulnerability was the most egregious finding, but it wasn’t the only one.

    The OIG also identified “more than 100 paths that would have allowed some users to elevate their permissions to an administrator level without proper authorization.”

    Over 100. Separate. Attack. Paths.

    An attacker could take over a regular user account, use one of these 100+ paths to escalate their privileges to administrator level, and then move through CBP’s network performing additional attacks “without CBP’s awareness.”

    CBP users could:

    • Take over accounts of CBP teams monitoring insider threats
    • Take over user accounts with access to sensitive law enforcement information
    • Obtain CBP officer-level access to shared drives at ports of entry
    • Become administrators of mobile device management software

    Again, all this was possible because CBP had “all users…incorrectly granted permission to perform privileged account or sensitive functions, although CBP is required to limit privileged access to the minimum level necessary for mission needs.”

    The underlying problem is the same: CBP’s access architecture allows far too many people to perform far too many privileged actions.

    Why This Matters

    CBP is a high-value target for attackers. The agency manages biometric databases, law enforcement information, border security intelligence, and travel documents. In June 2025, CBP experienced a cybersecurity incident where hackers stole CBP employee data.

    A network architecture where 76,000 users have access to privileged administrative functions is an invitation for attackers.

    If an external hacker compromised any single CBP employee’s credentials—through phishing, credential theft, or a supply chain attack—they would immediately have access to powerful administrative capabilities. They could create backdoors, modify security settings, and cover their tracks.

    Or, if an insider threat actor wanted to abuse CBP’s systems, they wouldn’t need to steal credentials from a system administrator. They would already have the capabilities they needed.

    The fact that CBP maintained this configuration for seven years—through two presidential administrations, through multiple cybersecurity incidents at other federal agencies, through evolving hacking techniques and increased threat awareness—suggests either:

    1. CBP’s security culture doesn’t prioritize preventive security architecture
    2. CBP lacked the technical expertise to recognize this problem
    3. CBP’s monitoring and testing processes were inadequate
    4. Some combination of the above

    The OIG audit documents the problem. It does not explain how CBP allowed it to persist for seven years.

    CBP’s Timeline for Fixing It

    In response to the OIG audit, CBP provided corrective action plans. For the service account vulnerability and the 100+ privilege escalation paths, CBP’s response includes:

    1. Comprehensive audit of the EVERYONE Active Directory group (completed, per CBP)
    2. Removal of all identified excessive privileges (completed, per CBP)
    3. Implementation of monitoring controls to detect future changes to these permissions (in progress, per OIG analysis)
    4. Evaluation of the 100+ identified attack paths (in progress, per OIG analysis)

    CBP claims it had already remediated the specific service account vulnerability and performed a validation scan to confirm no similar misconfigurations existed. It provided evidence to the OIG on April 4, 2025, and additional evidence on July 22, 2026.

    However, the OIG analysis of CBP’s responses includes this language: “To meet the intent of the recommendation, we need documentation that demonstrates how these new alerts are monitored and the actions taken to respond to any alerts.”

    Translation: CBP says it implemented monitoring, but it hasn’t demonstrated that anyone is actually watching the monitors or acting on alerts. This is a critical distinction—a monitor that no one watches is just a log file.

    Similarly, regarding the 100+ attack paths: “CBP has only provided evidence demonstrating its analysis and remediation of the EVERYONE group attack paths. We need documentation showing all 100-plus attack paths were analyzed and any unnecessary accesses were adjusted.”

    Translation: CBP fixed the one big problem but hasn’t demonstrated it fixed all 100+ of them.

    What Remains Unexplained

    CBP’s public response to the audit consists of a standard agency concurrence memo. In that memo, CBP acknowledges “CBP has defined controls and processes to secure privileged accounts” and notes that the agency “implemented an access management system to periodically review and approve privileged and service account access permissions.”

    But if CBP had defined controls, defined processes, and an access management system, how did the service account remain misconfigured for seven years?

    CBP does not answer this question.

    The agency also does not explain:

    • Account creation and authorization: Who created this service account in 2019? Was there a change control process? Was it documented? If the account was created for a specific business need and then that need changed, who was responsible for decommissioning it?
    • Access logs: Did CBP maintain audit logs of who accessed this account and when? If so, was there any suspicious activity during the seven years? If not, why not?
    • Monitoring capabilities before 2023: What monitoring did CBP have in place from 2019-2022? Why was it ineffective? Were there budget constraints, staffing limitations, or technical limitations that prevented better monitoring?
    • The penetration testing question: If the auditors could find this vulnerability with penetration testing, why didn’t CBP’s own security teams perform penetration testing? Is CBP not conducting regular penetration tests of its infrastructure? How often?
    • Risk acceptance: Did CBP know about this vulnerability and accept the risk? Or was it simply unknown? If unknown, does CBP conduct any pro-active security assessments, or only reactive ones?

    These are legitimate accountability questions that the public and Congress should have answered.

    A Broader Pattern

    This vulnerability exists within a larger context of CBP access control failures documented in the same audit.

    CBP failed to disable accounts for separated personnel in a timely manner (20 percent of sampled employee accounts, 15 percent of contractor accounts).

    CBP failed to remove unneeded access for transferred employees (17 percent retained unnecessary access).

    CBP did not enroll all applications in its centralized access management system and had no process to enforce a 2023 modernization directive that required such enrollment.

    CBP was unaware of all applications running on its network.

    These failures—the service account vulnerability, the 100+ attack paths, the account disablement failures, the transferred employee access retention—are not isolated incidents. They suggest a systemic weakness in CBP’s ability to maintain secure access controls across its infrastructure.

    The OIG has documented the problems. CBP has agreed to fix them. But the fundamental question remains: Why did it take a federal audit to identify vulnerabilities that CBP should have found through its own security processes?

    That’s the story CBP won’t explain.

    References and Links

    – Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — OIG-26-28-Sep26.pdf — Released September 4, 2026 by the DHS Office of Inspector General

    – **OIG Report Section:** Key Finding 1: “CBP Did Not Consistently Secure Privileged Accounts and Sensitive Information” (pages 2-4 of report)

    – DHS OIG Homepage: www.oig.dhs.gov

    – Relevant DHS Policy (referenced in audit):

    • DHS 4300A: Information Technology System Security Program, Sensitive Systems (v. 13.4, December 2024)
    • NIST SP 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations

    – Related Incident:

      – June 2025 CBP Cybersecurity Incident: Mentioned in OIG report as context for threat environment. Full details of incident not available in public reporting.

    Editor’s Notes

    – CBP was asked for specific details about: (1) the service account’s creation, purpose, and authorization process; (2) audit logs covering the 2019-2025 period; (3) the timeline of monitoring capability deployment; (4) whether penetration testing was routinely conducted; and (5) whether this vulnerability was previously known but accepted as a risk. CBP declined to provide additional information beyond the written response to the OIG audit.

    – The OIG report explicitly notes about CBP’s account remediation: “An audit log review was conducted which confirmed that the misconfigured account was not subjected to unauthorized use.” This suggests that while the vulnerability existed, there is no evidence it was exploited during the seven-year period. However, the OIG did not disclose whether access logs existed for the entire 2019-2025 period or only for a more recent timeframe.

    – The terminology “EVERYONE Active Directory group” is technical jargon for a Windows domain group that, by default, includes all users on a network. In this case, it should not have included permission to perform the privileged actions that CBP had granted it.

    Fediverse Reactions

  • AI-Assisted Scripts Are Probing U.S. Industrial Control Systems. Federal Agencies Issued an Advisory Three Weeks Ago.

    On August 19, 2026, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the FBI, the Department of Energy, and the Environmental Protection Agency jointly published Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs. The Federal Transit Administration flagged it to transportation stakeholders this week. The underlying threat predates the advisory by long enough that the advisory itself uses the phrase “active threat” in the title.

    Here is what the agencies found, and what it means.

    What a PLC Is and Why It Matters

    Programmable logic controllers are the hardware layer of critical infrastructure; that is, the physical devices that open valves, control motors, regulate pressure, and manage electrical loads in water treatment plants, power grids, transit systems, and manufacturing facilities. Siemens S7 series PLCs are among the most widely deployed in the world. They communicate over a protocol called S7comm on TCP port 102, and they are often directly internet-accessible, either by design or by administrative oversight.

    The S7 series has been a documented target before. Iranian-affiliated actors were documented exploiting internet-exposed PLCs across U.S. critical infrastructure as recently as April 2026, per a separate advisory (AA26-097A). The August advisory describes a distinct and ongoing campaign, but it lands in that context.

    The Threat: AI-Generated Scripts Disguised as Monitoring Tools

    The joint advisory describes threat actors conducting reconnaissance and capability development against internet-exposed Siemens S7 PLCs using AI-generated Python scripts, specifically tooling built on the python-snap7 and snap7 libraries, which are legitimate open-source tools for interfacing with S7 devices. The scripts are being disguised as standard OT monitoring software, making them harder to distinguish from normal network traffic without behavioral analysis.

    The attack workflow documented in the advisory has three stages. First, actors use internet scanning services (Censys and ZoomEye are specifically named) to identify internet-exposed S7 PLCs. Second, AI-assisted scripting tools enumerate the devices: reading PLC memory, accessing configuration data, and interacting with ladder logic. Third, actors conduct capability development, or building out exploitation capacity against identified targets, whether or not a destructive action has yet been taken.

    The advisory notes no confirmed destructive incidents tied to this specific campaign. It does not claim access logs exist for the full period of the observed activity. What the agencies are documenting is pre-operational: actors learning the terrain, building the tools, and positioning for an operation that may not yet have happened.

    The advisory explicitly warns that the risk is not confined to Siemens equipment. Any internet-exposed OT device running on S7comm or similar industrial protocols is part of the attack surface. Transit agencies, utilities, water systems, and manufacturing operators are all named as relevant sectors.

    The Gold Eagle Clearinghouse: A Platform Built for This Moment

    Two weeks before the PLC advisory, on July 14, 2026, the White House announced the launch of Gold Eagle, a joint CISA and Department of the Treasury initiative operating under Executive Order 14409, signed June 2, 2026, Promoting Advanced Artificial Intelligence Innovation and Security.

    Gold Eagle is a software capability layered on top of CISA’s existing Vulnerability Information and Coordinated Environment (VINCE) platform. The problem it addresses is structural: AI tools are dramatically accelerating the pace at which vulnerabilities are discovered and weaponized, and existing coordination infrastructure wasn’t built for that volume. Gold Eagle is designed to let organizations report, validate, and track AI-related vulnerabilities at scale — deduplicate submissions, route reports to the right vendors, and give CISA the throughput to actually process what comes in.

    The FTA’s advisory to transportation stakeholders notes that industry partners can reach CISA directly at clearinghouse@cisa.dhs.gov to participate.

    The timing is notable. Gold Eagle launches in mid-July. Three weeks later, a five-agency joint advisory goes out warning that AI-generated scripts are actively probing industrial control systems. The government is simultaneously acknowledging that AI has lowered the barrier to sophisticated OT attacks and standing up infrastructure to handle what that means for vulnerability coordination going forward.

    Three New ICS Advisories

    Alongside the FTA bulletin, CISA released three new Industrial Control Systems advisories covering current vulnerabilities:

    • ICSA-26-230-01: CISA Malcolm. Six vulnerabilities in CISA’s own Malcolm network traffic analysis platform, an open-source OT monitoring tool, including critical upload and remote code execution flaws and access-control bypasses. Malcolm is widely used by organizations securing OT environments, which makes its own vulnerability surface a pointed irony.
    • ICSA-26-230-02: Siemens Simcenter Nastran. Vulnerabilities in Siemens’ engineering simulation software.
    • ICSA-26-232-01: Johnson Controls Simplex Incident Manager. CVE-2026-27875, a cleartext credential storage flaw in Johnson Controls’ Simplex Incident Manager, a life-safety and incident management platform used in facilities management. Credentials stored in cleartext means that anyone with access to the file system or a memory dump can read them without any decryption step.

    What Transit and OT Operators Should Do

    The FTA’s guidance to transportation stakeholders, distilled:

    • Audit all internet-exposed PLCs and OT devices, not just Siemens equipment.
    • Review the joint advisory AA26-231A and apply recommended mitigations, including blocking TCP/102 from untrusted networks and restricting S7comm access to engineering workstations.
    • Patch or mitigate the three ICS advisories above if affected software is in your environment.
    • Review CISA Malcolm configurations if Malcolm is part of your OT monitoring stack.
    • Direct stakeholder questions to Dot-Sector-Cyber@dot.gov.

    The advisory is available on the CISA website. The Gold Eagle Clearinghouse is operational.

    Fediverse Reactions