Bureaucracy Times

All the news fit to be declassified.

  • SEC Flagged OTC Link’s Access-Control Problem in 2016. It Was Still There in 2023.

    Three SEC examination cycles identified compliance problems at a major over-the-counter trading operator. The public record does not explain why years passed before enforcement followed.

    The Securities and Exchange Commission censured OTC Link LLC on Tuesday and ordered the broker-dealer to pay a $575,000 civil penalty for repeated failures involving technology and security requirements under Regulation Systems Compliance and Integrity, better known as Regulation SCI.

    The penalty is straightforward.

    The timeline is considerably less so.

    According to the SEC’s September 22 administrative order, the agency identified a deficiency involving OTC Link ATS’s access-control policy during a fiscal year 2016 examination.

    SEC examiners returned in 2019.

    The problem was cited again.

    They returned again in 2022.

    It was cited again.

    And according to the SEC, as of fiscal year 2023, the access-control policy “had still not been formally established.”

    That leaves an obvious question: What happened during those seven years?

    The SEC isn’t saying.

    A Rule Requiring “Prompt Action”

    OTC Link is a registered broker-dealer and a subsidiary of OTC Markets Group. It operates alternative trading systems used by broker-dealers to execute or facilitate transactions in securities that trade outside national securities exchanges.

    Because of its role in the market, OTC Link ATS is subject to Regulation SCI, a regulatory framework covering the technological infrastructure of important securities-market entities.

    Among other requirements, Regulation SCI requires covered entities to maintain policies and procedures governing their technological systems, conduct periodic reviews and take “prompt action” to remedy identified deficiencies.

    According to Tuesday’s SEC order, OTC Link’s problems went well beyond one unfinished document.

    The Commission identified deficiencies involving account management and access controls, network-device security configuration, data-loss prevention, application vulnerability management, and vulnerability testing and remediation.

    But the access-control policy provides perhaps the clearest illustration of the timeline.

    The SEC says the policy was deficient during its FY2016 examination because it remained in draft form.

    A subsequent examination resulted in another deficiency letter in 2019.

    Another examination produced another deficiency letter in 2022.

    By FY2023, according to the Commission, the policy still had not been formally established.

    If federal regulatory examinations came with punch cards, OTC Link was getting close to a free one.

    Then Came the Consultants

    The chronology finally begins moving faster in 2024.

    According to the SEC, OTC Link retained third-party compliance consultants that year to evaluate its Regulation SCI program and recommend improvements.

    Beginning in March 2025, the company established additional policies covering areas including application vulnerability management, account management and access control, and network-device configuration management.

    The SEC ultimately found that OTC Link willfully violated several provisions of Regulation SCI. The company agreed to a censure, a cease-and-desist order and the $575,000 penalty without admitting the Commission’s findings, except as to jurisdiction.

    But this was not OTC Link’s first recent encounter with SEC enforcement.

    In August 2024, the SEC charged OTC Link with separate anti-money-laundering compliance failures.

    In that case, the SEC found that from March 2020 through May 2023, OTC Link failed to implement reasonably designed policies and procedures for monitoring transactions on its trading platforms for suspicious activity.

    The result was remarkable: OTC Link did not file a single Suspicious Activity Report during that period, despite its three platforms facilitating tens of thousands of OTC transactions daily.

    OTC Link paid $1.19 million to settle that matter. The SEC said that investigation also grew out of an examination conducted by its Division of Examinations.

    The two cases involve different regulations and different compliance failures. There is no evidence in the public record establishing that one caused or contributed to the other.

    Their timelines nevertheless overlap.

    Three Examinations, One Unanswered Question

    The SEC’s latest order establishes that its examiners repeatedly found problems at OTC Link.

    What it does not explain is what happened after they found them.

    Bureaucracy Times contacted the SEC’s Office of Public Affairs on September 22 seeking the dates of the deficiency letters associated with the 2016, 2019 and 2022 examinations.

    We also asked whether OTC Link submitted remediation plans after those examinations, whether the SEC ever considered the deficiencies resolved, whether remediation deadlines were established, when examiners determined previously identified deficiencies remained unaddressed, and when the matter was referred or otherwise escalated to the Division of Enforcement.

    We specifically asked how the seven-year history of the access-control policy squared with Regulation SCI’s requirement for “prompt action” to remedy deficiencies.

    The SEC declined to answer.

    “Attributable to an SEC spokesperson, we decline comment beyond our public filings including our press release which we issued today,” SEC Public Affairs Specialist David Ausiello told Bureaucracy Times.

    That leaves the Commission’s own enforcement order to tell the story.

    FY2016: deficiency identified.

    2019: cited again.

    2022: cited again.

    FY2023: still not formally established.

    2024: outside consultants brought in.

    March 2025: additional policies established.

    September 2026: enforcement action announced.

    None of that absolves OTC Link of the violations described by the SEC. The Commission’s order places responsibility on the company for maintaining the required policies and promptly correcting deficiencies.

    But regulatory oversight is also supposed to do something after regulators repeatedly discover that a regulated entity has not fixed a previously identified problem.

    The SEC has now documented three examination cycles and years of unresolved deficiencies at an operator of important securities-market infrastructure.

    What remains missing from the public record is what the regulator did about those findings along the way.

    For now, the SEC has declined to fill in that part of the timeline.

    Sources: SEC Administrative Order, In the Matter of OTC Link LLC, Release No. 34-106458 (September 22, 2026); SEC press release, OTC Link AML enforcement action (August 2024).

    Fediverse reactions

  • VA Pricing Problems Spread Beyond Drugs, With 11 of 12 Medical-Supply Proposals Flagged

    Earlier this month, Bureaucracy Times reported that nearly seven in ten pharmaceutical proposals examined by the Department of Veterans Affairs inspector general contained problems in the commercial pricing disclosures VA uses to negotiate federal drug prices.

    Apparently, the pharmaceuticals weren’t special.

    In a new report released Sept. 22, the VA Office of Inspector General examined 12 nonpharmaceutical Federal Supply Schedule proposals covering medical supplies and services. Eleven of the 12 proposals, or 91.7 percent, contained commercial-sales disclosures that auditors determined were not accurate, complete, or current.

    The proposals represented approximately $814 million in estimated contract value and included 12,246 offered items.

    Only one proposal passed through the review without OIG identifying disclosure deficiencies.

    That matters because VA uses commercial-sales information to determine whether prices offered to the federal government are fair and reasonable. Vendors are generally required to disclose information about their commercial pricing practices, including discounts and concessions offered to other customers.

    In other words, the government is negotiating with information supplied by the companies sitting across the negotiating table.

    And, once again, OIG found problems with that information.

    A Familiar Problem

    The findings closely resemble those in the pharmaceutical pricing review Bureaucracy Times covered on Sept. 8.

    In that report, OIG examined 16 pharmaceutical proposals and found that 11 contained deficient commercial-sales disclosures.

    Taken together, the two FY2025 reviews examined 28 pharmaceutical and nonpharmaceutical proposals.

    Twenty-two of them had disclosure problems.

    That works out to approximately 79 percent.

    The scale of the purchasing system involved is considerably larger than the sample. VA’s National Acquisition Center administers nine healthcare Federal Supply Schedules. Federal agencies purchased approximately $25.7 billion in products and services through those schedules during fiscal 2025, according to OIG.

    The pharmaceutical proposals reviewed by OIG represented roughly $21 billion in estimated contract value. The latest nonpharmaceutical review adds another $814 million.

    These are not negotiations over boxes of tongue depressors in the supply closet.

    $29 Million Identified, $11.7 Million Sustained

    OIG’s review also produced measurable results.

    Auditors recommended lower prices for eight of the 12 proposals and calculated approximately $29.1 million in potential savings.

    VA ultimately sustained approximately $11.7 million of those savings.

    That is about 40 percent of what OIG identified.

    But the aggregate figure conceals substantial differences among individual negotiations.

    For one proposal, identified in the report only as Report 4, OIG calculated $10.85 million in potential savings.

    VA sustained none of it.

    Another proposal, Report 10, carried approximately $4.59 million in potential savings. Again, none was sustained.

    Report 11 produced another $987,400 in potential savings and zero sustained savings.

    The opposite happened with Report 6. OIG identified approximately $11.75 million in potential savings, and VA ultimately sustained approximately $11.55 million, or more than 98 percent.

    Why one negotiation captured nearly everything OIG identified while others captured nothing is one of the more interesting questions left by the report.

    Unfortunately, figuring out who was sitting on the other side of those negotiations is not particularly easy.

    The Vendors Without Names

    The OIG summary does not identify the companies associated with the 12 proposals.

    There is a reason for that. According to OIG, the individual preaward reports are not publicly released because they contain proprietary commercial information.

    Bureaucracy Times attempted to reconstruct several of the unnamed vendors using information that is public.

    We compared the report dates, contract award dates and other information contained in OIG’s appendix against VA’s publicly accessible Federal Supply Schedule contracting records.

    The exercise produced several plausible matches, but not enough evidence to responsibly attach an OIG finding to a specific company.

    That distinction matters.

    For example, multiple VA medical-supply contracts were awarded on some of the dates appearing in the OIG report. A matching award date can identify candidates, but it cannot establish that a particular vendor was the subject of a particular OIG review.

    So we aren’t going to guess.

    The result is an odd transparency gap.

    VA publicly identifies its Federal Supply Schedule contractors. OIG publicly identifies millions of dollars in potential savings associated with individual proposal reviews. But the public information does not reliably connect the two.

    The government knows which companies submitted the problematic disclosures.

    The public gets Report 4.

    And Then There Is Report 11

    One entry in OIG’s appendix raises another question.

    Report 11 was issued Sept. 2, 2025.

    The table lists the corresponding contract award date as July 30, 2025.

    That would put the award 34 days before OIG issued its preaward report.

    There may be an entirely routine explanation. The date could reflect an existing contract, a modification, an effective date or some other element of the acquisition chronology.

    Our reconstruction uncovered another reason for caution. In at least one portion of the public contracting record, dates that appear to represent contract effectiveness do not necessarily correspond neatly with the literal date on which an award was made.

    That makes the chronology difficult to reconstruct from the summary alone.

    But it also illustrates the larger problem.

    OIG is performing these reviews precisely because commercial pricing disclosures affect the government’s ability to negotiate favorable prices. Across the pharmaceutical and nonpharmaceutical reviews examined by Bureaucracy Times this month, 22 of 28 proposals contained problems with those disclosures.

    The latest audit alone identified $29.1 million in potential savings.

    VA captured $11.7 million.

    And the public still cannot readily determine which companies were responsible for the disclosures behind the remaining millions.

    For a federal purchasing system that moved $25.7 billion in healthcare products and services last year, “Report 4” leaves quite a bit to the imagination.

    Sources: VA OIG, Federal Supply Schedule Nonpharmaceutical Preaward Reviews for Fiscal Year 2025 (VAOIG-26-00128-191, September 22, 2026).

    Fediverse reactions

  • The Postal Service and Its Watchdog Cannot Agree on Whether They Spoke in 2024

    Somewhere in a federal email server sits the answer to a question that should not require an article to resolve. Did the United States Postal Service ask its own Inspector General for help in March 2024, and did the Inspector General say no? The Postal Service says yes, it asked, and yes, it was refused. The Inspector General says that characterization is false. Both cannot be right, and the fact that a $78 billion federal agency and its statutory watchdog cannot settle this in private, and instead settled it in the pages of a public audit report, tells you most of what you need to know about the state of oversight at USPS.

    The occasion for this standoff is Report 25-129-R26, “Customer Survey Integrity,” published by the USPS Office of Inspector General on September 15, 2026. The underlying subject, employees gaming a customer satisfaction survey system called Customer 360, is by federal standards almost quaint. What makes it worth your time is not the fraud. It is the fact that the agency’s official written response to its own watchdog reads less like a management letter and more like a rebuttal brief, and that the watchdog’s reply reads like a judge losing patience with counsel.

    A System Built to Be Gamed, Gamed As Designed

    C360 exists because the Postal Accountability and Enhancement Act requires USPS to report customer satisfaction data to the Postal Regulatory Commission every year. Resolve a service request, trigger a survey, roll the survey scores up through post office, district, and area, and eventually the national number lands on a page the PRC reads as a proxy for whether the mail is working. In fiscal 2025 that pipeline produced 5.5 million invitations and 1.2 million responses feeding a satisfaction score that has, for years, hovered somewhere in the high thirties to high forties, comfortably the worst of every customer metric USPS tracks.

    OIG’s audit found that this number has been inflated by two distinct schemes. The first, a nationwide exploit of the “Email Us” feature on usps.com, let employees invent customer issues tied to their own personal inboxes so they could receive and complete their own satisfaction surveys. OIG flagged roughly 119,000 of these as high risk. The second, a regional “booster campaign” concentrated in the WestPac Area, had employees logging routine, already resolved interactions, retrieving someone’s mail counts as a “walk-in service request” if you are creative enough, purely to generate more surveys to manipulate. Walk-in requests in the affected district rose by roughly 3,200 percent. One post office pushed its score up by more than 21 percent this way. At least 83 postmasters, managers, and supervisors either manipulated scores directly or told their people to.

    None of this is especially shocking as institutional behavior goes; performance metrics attached to bonuses tend to get gamed, and USPS is neither the first nor the hundredth federal entity to discover this. What distinguishes the case is what happened after OIG wrote it down.

    Two Federal Bodies, One Set of Facts, Zero Agreement

    USPS management’s written response, signed September 1, 2026, by Marc McCrery, Michael Elston, and Elvin Mercado, opens by stating that management “strongly disagrees with the single finding in the OIG’s report and all related recommendations as currently written.” It proceeds to reject all six recommendations, and along the way makes a claim that, if true, rewrites the entire premise of the audit. USPS says it notified OIG in March 2024 about employees manipulating email addresses, requested OIG’s assistance, and was turned down.

    OIG’s evaluation section, printed in the same report, calls this characterization something close to a fabrication. The Inspector General states it “strongly disagrees with the Postal Service’s characterization that we denied assistance,” explains that investigators reviewed the referred complaint, routed the administrative piece back to USPS for internal handling, and referred the systemic question to the Office of Audit, which is precisely how this audit came to exist. In OIG’s telling, this report is the assistance USPS says it never received.

    Layered on top of that is a second, more technical dispute over who is withholding data from whom. USPS says OIG refused to hand over the files identifying the 119,000 high risk Email Us surveys, making the finding unfalsifiable by USPS’s own analysts and, in management’s words, likely to have produced “a high volume of false positive results.” OIG’s rebuttal is pointed. It notes that USPS applied filters similar to OIG’s own methodology when it ran its internal WestPac analysis in early fiscal 2026, and that analysis flagged 126 employees, 116 of whom OIG had already identified independently in prior years. That is not the outcome you would expect from a methodology its target insists cannot be replicated.

    A federal inspector general and the agency it oversees are now on the record with mutually exclusive accounts of a documented request for help. This is not a dispute about interpretation, tone, or the fairness of a statistical filter. It is a dispute about whether an email exists. One side can produce it or cannot. Neither has, publicly, and a FOIA request would settle the matter in the time it takes USPS’s records office to process it, assuming USPS’s records office is inclined to move quickly on a request that would either vindicate or embarrass its own Vice President of Customer Experience.

    Management’s Numbers, Read Against Themselves

    Credit where due, USPS’s rebuttal is not empty bluster. It includes its own worst case modeling, assuming every single OIG flagged survey was in fact fraudulent and stripped from the count. Even under that maximal scenario, USPS calculates its satisfaction score still rose 4.15 percentage points from fiscal 2023 through 2025, with no resulting change to the National Performance Assessment corporate scorecard, since C360 survey data is diluted down to roughly one percent of that scorecard’s total weight (twenty percent of the Customer Satisfaction Composite, which is itself five percent of the corporate total).

    Notice what that concession actually concedes. USPS is not arguing the fraud did not happen or did not move the number. It is arguing the fraud did not move the number enough to matter for bonuses, which is a different and considerably weaker claim than the one management spends four pages building toward. The Postal Service’s own defense, taken at face value, confirms the direction OIG’s finding points in even while disputing its magnitude.

    The agency does offer USPS a narrow, grudging concession on Recommendation 6: it will strip 3,688 flagged fiscal 2025 surveys and the original 2,500 surveys tied to the 2024 scheme from its scoring. It refuses, flatly, to revisit fiscal 2023 and 2024 more broadly, on the grounds that doing so “would not provide timely feedback or materially change the C360 score reported to the Postal Regulatory Commission.” Translated, the Postal Service is declining to fully correct a mandatory federal report to a rate setting commission because doing so would be inconvenient and probably wouldn’t change the headline number much. That is a defense a compliance officer should recognize as the kind of sentence that gets quoted back at you later.

    The Watchdog That Cannot Get an Answer

    Strip away the survey fraud, which is genuinely the less interesting half of this story, and what remains is an inspector general that cannot get its own oversight target to agree on a shared set of facts about their own correspondence, cannot get access to data it needs to validate its own audit trail without a public fight breaking out over who denied whom, and cannot get the agency to commit to a single implementation date across six recommendations, all of which were answered with some version of “management disagrees with this recommendation as written.” Every recommendation lists its Target Implementation Date as N/A. Every one lists its Responsible Official as N/A.

    Congress wrote the Postal Accountability and Enhancement Act on the premise that an independent inspector general would be able to verify what USPS tells the Postal Regulatory Commission. What this report demonstrates is not that the premise failed, exactly, but that it now depends on whether a federal agency will voluntarily hand its own watchdog the emails proving or disproving a claim that agency itself put in writing. The Postal Service disagreed with all six recommendations. It might start by disagreeing with itself less and producing the correspondence more.

    Source: USPS Office of Inspector General, Customer Survey Integrity (Report 25-129-R26, September 15, 2026).

  • The Pentagon’s Own Gas Station Is Losing Money on Every Gallon

    Somewhere inside the Defense Logistics Agency’s ledgers this year sits a small, almost comic failure of arithmetic, the kind that would get a corner store shut down but barely rates a footnote in a war. CBO’s letter on the cost of Operation Epic Fury records that DLA, the office responsible for buying and reselling fuel to the entire Department of Defense, raised its surcharge on military fuel purchases by $42 a barrel this year to cover the war’s energy costs. The Government Accountability Office had already told Congress the increase would not be enough. By CBO’s account, GAO expected DLA to lose $1.82 billion on fuel sales in fiscal year 2026 anyway, meaning the agency set a price, watched its own watchdog tell it the price was wrong, and kept charging it. This is the kind of detail that never makes it into a floor speech about supporting the troops, because it is not about the troops at all. It is about a supply agency’s internal pricing model failing in real time, in public, while Congress is being asked to backfill the shortfall.

    The Gas Station That Loses Money on Every Gallon

    DLA is not a charity. It exists to buy fuel in bulk and resell it to the services at a price meant to cover its costs, full stop. When CBO adds up the $835 million in extra surcharge revenue DLA actually collected from April through June against the $1.82 billion GAO says it is on track to lose for the year, the agency comes out roughly $1 billion short of covering what it spent to run the exact same shop. DLA’s own remedy list, as CBO relays it, amounts to drawing down cash reserves, raising prices later to cover this year’s shortfall, or going back to Congress for a supplemental, some combination of an institution quietly eating its own losses and passing the bill forward. This is not exotic mismanagement. It is a government gas station that cannot price gas correctly even with its own accountants standing next to the pump.

    The Magazine Is Empty

    While DLA was losing money on diesel, the missile defense side of the ledger was spending down something that cannot simply be reordered at market price. CBO’s letter states that Operation Epic Fury and the Twelve Day War against Iran that preceded it in 2025 together consumed, by the agency’s estimate, somewhere between one half and two thirds of the entire US inventory of Patriot, THAAD, SM 3, and SM 6 interceptors. A CSIS assessment of the same stockpiles puts the replacement timeline at two to three years for the cheaper interceptors and considerably longer for the most sophisticated ones, because, as CBO notes, it typically takes three to five years just between placing an order for these systems and actually receiving one. CBO’s letter is explicit about why this matters beyond Iran; it points directly at a hypothetical conflict with the People’s Republic of China, whose missile arsenal dwarfs Iran’s and which would draw on precisely the interceptor types the United States just burned through defending Gulf allies and Israel. These are not cheap items to begin with. CBO puts Patriot and SM 6 interceptors at roughly $4 million apiece, THAAD interceptors at about $12 million, and the most advanced SM 3 variant at $28 million, all produced at rates too low to absorb a war’s worth of demand without years of lag. Congress authorized a war against Iran. Nobody voted on drawing down the country’s missile shield for a war with China that has not happened, and CBO is telling them, gently, that this is what occurred anyway.

    A War Bill With a Farm Subsidy and a Train Station Stapled to It

    Then there is the part of the ledger that has nothing to do with fighting at all. The administration’s June supplemental request, justified almost entirely by reference to the Iranian conflict, included $20.5 billion for agencies and purposes CBO could not connect to the war in any meaningful way. The single largest chunk, $11.1 billion, went to the Department of Agriculture, mostly to compensate crop farmers for higher fuel and fertilizer costs tied to the closure of the Strait of Hormuz, a connection CBO is willing to grant even if it is several steps removed from combat. A separate $1 billion of the same wartime request, however, was earmarked for the design and construction of a modernized Penn Station in New York, a project CBO states plainly has no connection to the decision to go to war at all. It rode into an Iran war supplemental request the same way a rider always does, quietly, attached to something urgent enough that nobody wants to be the member of Congress who voted against funding the troops in order to strip out a train station.

    The Invoice Nobody Reconciles

    None of these three items would sink a budget on its own. A rounding error at DLA, a stockpile drawdown with a five year lag, a train station riding along on a war appropriation, each is survivable in isolation. What they share is a pattern this publication keeps finding wherever it looks at federal spending under pressure, which is that the institutions responsible for pricing, replenishing, and appropriating money for a national emergency are not actually very good at doing any of those three things cleanly, and the emergency itself becomes the cover under which the sloppiness gets funded rather than fixed.

    DLA will eventually raise prices again to cover this year’s hole, quietly, in a future fuel bill nobody will connect back to Iran. The interceptors will eventually get rebuilt, five years and several billion dollars from now, for a war that may or may not arrive, against an adversary far better supplied than the one that just emptied the shelves. And Penn Station, whatever its architectural merits, will get built partly on the strength of a line item that borrowed its urgency from a war eight time zones away that had nothing whatsoever to do with commuter rail. Add it up and the pattern is not corruption in any prosecutable sense. It is simply what a bureaucracy does when nobody outside it is required to check the receipts before the money moves.

    Sources: Congressional Budget Office, Cost of Operation Epic Fury (September 2026); CSIS, Last Rounds: Status of Key Munitions After the Iran War Ceasefire; Office of Management and Budget, June 24, 2026 supplemental funding request letter to Speaker Johnson. See also: Congress Asked the Pentagon What the War Costs. The Pentagon Didn’t Pick Up.

    Fediverse reactions

  • The $215 Million Quantum Race That Took Washington a Decade to Build

    The Quantum Genesis Files, Part One

    DOE wants a fault-tolerant quantum computer by 2028. The competition announced this week is only the newest piece of a federal research, benchmarking and industry partnership effort years in the making.

    The Department of Energy wants someone to build a quantum computer that actually works.

    Not merely one with an impressive number of qubits attached to its name. Not another experimental machine capable of demonstrating that quantum computing remains theoretically fascinating. DOE wants a fault-tolerant computer capable of performing useful scientific work, and it wants the first generation of that machine demonstrated by 2028.

    On September 17, DOE announced the Quantum Genesis Q Competition, offering up to $215 million in planned funding to private companies capable of reaching a series of increasingly difficult milestones.

    The headline number is substantial. The history behind it is considerably larger.

    The competition is the latest step in an effort DOE has been developing for more than a decade, moving gradually from asking whether quantum computers could be useful for federal science to preparing an independent government apparatus capable of determining whether industry has finally built one.

    From Physical Qubits to Useful Ones

    Quantum computing has suffered from an inconvenient problem for anyone trying to explain its progress. Qubit counts sound impressive without necessarily telling anyone how useful a machine is.

    Physical qubits are notoriously susceptible to errors. Environmental interference, imperfect controls and the delicate nature of quantum states can corrupt calculations long before a useful computation is completed.

    A logical qubit attempts to solve that problem by encoding quantum information across physical qubits using error correction. The objective is not simply to possess more qubits. It is to possess qubits reliable enough to keep calculating.

    DOE’s new competition therefore targets machines with at least 100 logical qubits capable of performing hundreds of millions of fault-tolerant operations.

    Companies reaching that threshold will be eligible to share a $100 million incentive pool. DOE has established another $50 million pool for competitors reaching 150 logical qubits and another $50 million for systems reaching 200.

    Before any of that happens, Phase I offers individual competitors up to $1.5 million for earlier milestones.

    There is, however, an important budgetary asterisk.

    The $215 million is planned funding, not $215 million already sitting in an account waiting to be distributed. DOE says only $2.5 million comes from fiscal year 2026 funding. The remainder is dependent upon future congressional appropriations.

    Applications are due October 19.

    DOE Did Not Arrive Here Overnight

    To understand why DOE thinks a machine like this might exist by 2028, it helps to travel back to Bethesda, Maryland, in February 2015.

    DOE’s Advanced Scientific Computing Research program convened a Workshop on Quantum Computing for Science.

    The question then was much more fundamental.

    Could quantum computing technologies eventually address computational problems relevant to DOE’s scientific and energy missions?

    The resulting report examined quantum simulation, physical sciences, applied mathematics, linear algebra, graph theory and machine learning. More importantly, it identified how much research still stood between quantum computing as an intriguing technology and quantum computing as a useful scientific instrument.

    That distinction has driven much of what followed.

    DOE convened a Quantum Testbeds Stakeholder Workshop in 2017. It subsequently funded quantum testbeds, application research and the Accelerated Research in Quantum Computing program. In 2023, another Basic Research Needs workshop in Quantum Computing and Networking examined problems including algorithms, benchmarking, verification and error resilience.

    The vocabulary evolved as the machines did.

    Eventually the question was no longer whether quantum computing might matter.

    It became how the government would know when it did.

    The Blueprint

    That evolution culminated this year in DOE’s Blueprint for DOE Quantum Supercomputing.

    The Blueprint was developed by DOE laboratories with what the Department describes as significant contributions from academia and industry. It establishes a strategy for developing fault-tolerant quantum computers capable of solving scientific problems beyond the reach of even the most powerful conventional supercomputers.

    DOE calls that threshold scientific utility.

    That phrase is important because it changes the measurement of success.

    A machine does not become scientifically important merely because a manufacturer announces another qubit record. DOE’s target is useful computation.

    The Blueprint calls for initial scientifically relevant quantum-computing capabilities by 2028, followed by larger production-scale systems in the 2030s.

    DOE then formally launched Quantum Genesis in June, organizing the initiative around three components.

    One is the Q Competition now underway.

    Another is a planned National Quantum Supercomputing User Facility intended to give American scientists access to advanced quantum systems and integrate those machines with DOE’s conventional high-performance computing infrastructure.

    The third is research into scientific applications that could actually make use of the machines.

    In other words, DOE is not envisioning quantum computers replacing its supercomputers.

    It wants them working together.

    Trust, but Verify the Qubits

    There is another part of this week’s announcement that received considerably less attention than the $215 million headline.

    DOE simultaneously announced a Quantum High-Performance Computing Validation and Verification Testbed Lab Call.

    The Department plans to provide another $45 million to its National Laboratories to establish tools for independently evaluating the machines entered in the competition.

    Of that amount, $14 million is FY2026 funding. The remainder, like most of the Q Competition funding, depends upon future appropriations.

    The validation program is supposed to examine virtually the entire quantum computing stack, including physical hardware, quantum gates, logical architectures, algorithms, scientific applications and classical control systems.

    That means DOE is doing something considerably more interesting than offering prizes for impressive specifications.

    It is building the referee at the same time it organizes the race.

    Competitors will have to demonstrate their machines to government evaluators rather than simply provide their own performance claims. DOE wants verification of logical error rates, gate performance, computational depth and scientific workflows.

    The arrangement represents the culmination of another thread running through DOE’s quantum research.

    Government researchers have spent years developing benchmarks, testbeds and performance-assessment techniques precisely because competing quantum architectures can be extraordinarily difficult to compare.

    DOE now intends to apply that expertise to machines competing for federal money.

    A Computer Looking for a Scientific Problem

    The Department has already identified the general territory where it expects quantum computing to matter.

    Chemistry is one obvious candidate. Molecules themselves obey quantum mechanics, making sufficiently complex molecular systems extraordinarily difficult to simulate using conventional computers.

    Materials science presents similar opportunities.

    DOE also identifies plasma physics, high-energy physics, nuclear physics and applied mathematics among the potential beneficiaries.

    But the Department is trying to avoid building an exotic machine and only afterward asking scientists what they might do with it.

    Quantum Genesis instead calls for scientific applications to develop alongside the hardware. National Laboratories, universities and industry partners are supposed to identify problems that can eventually become demonstrations of scientific utility.

    That is an important departure from treating quantum computing primarily as a hardware competition.

    The machine and the scientific mission are supposed to meet somewhere in the middle.

    The Starting Gun Is Not the Beginning

    Seen in isolation, the September 17 announcement looks like a new $215 million federal technology competition.

    Seen against the documentary history, it looks more like the moment DOE decided that more than a decade of research had advanced far enough to start demanding results.

    In 2015, DOE was assessing whether quantum computing could meaningfully serve its scientific mission.

    By 2017, it was studying testbeds and methods for comparing technologies.

    By 2023, benchmarking, verification and error resilience had become explicit research priorities.

    The 2026 Blueprint established scientifically useful fault-tolerant computing as the objective and 2028 as the initial deployment target.

    Now money is attached to the milestones.

    Even the money, however, requires some perspective.

    Quantum Genesis does not begin with this week’s $215 million announcement. DOE explicitly says the initiative builds upon longstanding federal investments in quantum information science, including the National Quantum Information Science Research Centers created under the National Quantum Initiative.

    Those investments, along with programs elsewhere in the federal government, have helped build the laboratories, researchers, partnerships, technologies and companies that now make a competition like Quantum Genesis possible.

    That raises a different accounting question.

    When companies line up to compete for DOE’s $215 million, how much federal support will already be standing behind them?

    That is where the quantum race gets considerably more interesting.

    Sources: DOE, Quantum Genesis Q Competition announcement (September 17, 2026); DOE, Quantum Genesis initiative launch (June 2026); DOE, Blueprint for DOE Quantum Supercomputing; DOE ASCR, Workshop on Quantum Computing for Science (February 2015).

    Fediverse reactions

  • One Email Can Still Turn the National Labor Relations Board Off

    Late on January 27, 2025, a National Labor Relations Board member named Gwynne Wilcox got an email from a White House staffer telling her she was fired, effective immediately. No hearing. No stated cause. Her term ran to August 2028. The National Labor Relations Act says a Board member “may be removed by the President, upon notice and hearing, for neglect of duty or malfeasance in office, but for no other cause.” None of that happened. What happened instead is that a labor enforcement apparatus covering the entire private sector stopped working, by design, because of how few people it takes to make it stop.

    The Quorum Is the Whole Point

    The NLRB has five seats, but the Act requires three members present to do anything at all, per Section 3(b), and the Supreme Court made that requirement absolute in New Process Steel v. NLRB (2010), tossing out roughly 600 decisions a two-member Board had issued over 27 months on the theory that two was close enough. It was not. So when Wilcox’s seat emptied, the Board had two members left. Below quorum, the agency cannot certify a union election, cannot rule on an unfair labor practice charge, cannot seek a 10(j) injunction against an employer firing organizers mid-campaign. It can receive filings. It cannot decide them.

    This is worth sitting with, because it means removing one person, out of five, on a board that oversees private-sector labor relations for the entire country, is functionally the same as abolishing the agency for as long as the seat stays empty. Congress built in that fragility assuming no president would exploit it. That assumption did not survive contact with 2025.

    The Ninety Year Old Fence Comes Down

    Wilcox sued. In March 2025, Judge Beryl Howell reinstated her, writing that the removal was “blatantly illegal,” leaning on Humphrey’s Executor v. United States (1935), the case letting Congress insulate agency heads like FTC and NLRB members from at will removal for nine decades. The government appealed. In April 2025, the Supreme Court granted an emergency stay letting the firing stand, without yet deciding the underlying question, but noting the NLRB wields “considerable executive power,” a phrase that told you exactly where this was going more than a year before the Court said so on the merits.

    By December 2025, the D.C. Circuit obliged, ruling that NLRB removal protections violate Article II, consolidated with a companion case over the Merit Systems Protection Board. Then in June 2026, the Court delivered Trump v. Slaughter, tossing Humphrey’s Executor out entirely and holding that anyone who exercises executive power (adjudicating cases, writing binding rules, suing on the government’s behalf) has to be removable at the President’s will. The FTC lost its removal protections that day. The MSPB’s cert petition was denied the next. And this September, the Solicitor General filed a brief telling the Court that Wilcox’s case is moot for the same reason, since the NLRB does the identical three things (adjudicates, rules, sues) that got the FTC stripped of its tenure protections. DOJ wants cert denied outright, or granted and summarily affirmed, because there is nothing left to argue.

    The Federal Reserve Gets to Keep Its Fence

    Here is the detail that belongs in the lede of somebody’s dissertation someday. On the same day the Court decided Slaughter, a different lineup of justices decided Trump v. Cook, holding that the Federal Reserve’s Board of Governors is not subject to the same logic, and its removal protections survive. Same Court, same day, same constitutional text, opposite outcome, because the majority drew a line around the one institution whose independence bond markets actually price. The NLRB, which decides whether a shop steward gets reinstated, did not make the cut. The body that sets interest rates did. If “executive power” were a neutral legal category rather than a permission slip issued selectively, you would expect it to catch both agencies or neither. It caught the one nobody holding a bond portfolio would tolerate touching.

    Every Future President Now Owns a Switch

    Strip away the doctrinal packaging and what Slaughter hands the next several administrations, of either party, is a standing option. Dislike how an independent board is ruling, and you no longer need Congress to restructure it. Fire one member below quorum and the agency goes dark until you nominate a replacement, on your own schedule. The NLRB is uniquely exposed here because its quorum floor is so low relative to its seat count, three of five, that a single vacancy (whether from resignation, expiration, or a late-night email) can freeze it entirely. The FTC carries the same removal exposure now but a sturdier quorum structure, so it does not fail as cleanly. The NLRB does.

    Wilcox’s case will likely end quietly, denied or summarily affirmed, exactly as DOJ has asked, because the fight over the underlying constitutional question is already over. What is not over is the operational fact this litigation exposed almost as an aside. An agency built to arbitrate between employers and organized labor can be switched off by any president willing to fire one person and wait. Nobody had to rewrite the National Labor Relations Act to accomplish that. They just had to win a case about somebody else’s agency.

    Sources: National Labor Relations Act, 29 U.S.C. § 153; New Process Steel v. NLRB, 560 U.S. 674 (2010); Supreme Court emergency stay order, April 9, 2025; Solicitor General brief, Wilcox v. Trump (September 2026).

    Fediverse reactions

  • Three Years Running, America’s Postal Watchdog Fails Its Own Report Card

    The Postal Regulatory Commission exists to keep an eye on the U.S. Postal Service. It reviews rate cases, audits service performance, and generally plays the part of the adult in a building full of trucks that don’t show up. So there is a certain poetry in the fact that, for the third consecutive year, the federal government’s own auditors have looked at the Commission’s cybersecurity and concluded, gently but repeatedly, that nobody is minding the store.

    The latest FISMA compliance audit, performed by KPMG under contract to the USPS Office of Inspector General, rates the PRC’s information security program as “Defined,” which is a polite way of saying Level 2 out of 5, which is a polite way of saying “Not Effective.” This is not a scandal in the sense of missing money or a whistleblower with a grudge. It is something more diagnostic of how the federal government actually runs, a quiet, well documented, thoroughly bureaucratic failure to do the basics, year after year, at an agency too small to notice and too obscure for anyone else to either.

    Groundhog Day in Arlington

    Start with the scorecard. In FY2024, the PRC scored Ad-hoc, the bottom rung, across all five cybersecurity functions then in use. In FY2025, it climbed to Defined, still “Not Effective,” but at least off the floor. This year, the agency improved further in three of six functions (Protect, Detect, and Recover all reached “Consistently Implemented”), while a newly added function called Govern, covering leadership and accountability for the whole program, opened at Ad-hoc, dead last, on its very first outing.

    That last detail is the one worth sitting with. The PRC has now had three straight audits, and the one category that measures whether the agency’s leadership has actually organized itself to manage cybersecurity risk is doing worse than areas the agency has had years longer to fix. Progress is real. It is also lopsided in a way that suggests the operational fixes are outrunning the institutional ones, which is what happens when an agency patches whatever the last audit complained about without building a structure to catch the next problem before an auditor finds it.

    There is also a quieter trick in the recommendation tracking. KPMG’s own appendix shows several findings “closed” in one year only to be “reissued” the next under a new recommendation number covering essentially the same gap. The FY2025 finding on cyber governance policy, for instance, gets closed in FY2026 and immediately reborn as a new recommendation about “cybersecurity current and target profiles,” a rename more than a resolution. Closure, in this accounting, means the paperwork changed forms, not that the underlying problem went away.

    The Chair Nobody Sat In

    If there is a single character in this story, it is the Chief Information Security Officer position, or rather its absence. The PRC’s first CISO departed in April 2024. The role sat vacant through the entirety of FY2025, run in the interim by the Chief Information Officer wearing a second hat, until a replacement finally started in August 2025, nearly a year and a half later. For a stretch in mid-2024, the Commission’s entire cybersecurity function, for an agency that hosts a public facing system processing regulatory filings, cost data, and PII, was staffed by one person.

    PRC management’s own explanation, offered without much embellishment across three consecutive audits, is that it is “a small agency with limited resources.” That is true as far as it goes. It also happens to be the same sentence, more or less, that management gave auditors in 2024 and again in 2025. A justification repeated for three years starts to function less like an explanation and more like a policy.

    Whose Money Is It, Anyway

    Here the story gets structurally interesting rather than merely sad, because the PRC does not control its own budget. By statute, the Commission submits its funding request to the USPS Board of Governors, which is to say, the leadership of the agency the PRC regulates, and the Governors may unilaterally cut the total by unanimous vote. The regulator’s paycheck is signed by the regulated.

    In September 2023, that is precisely what happened. The Commission requested roughly $22.6 million for FY2024; the Governors approved $21.1 million. Chairman Michael Kubayanda’s public statement on the cut warned it risked “eliminating positions in the understaffed agency” and “stopping long overdue technology upgrades,” and specified that the Commission was, at that moment, in the process of “establishing centralized databases, information management systems, and cybersecurity monitoring.” FY2024, recall, is the year the Commission’s cybersecurity program bottomed out at Ad-hoc across the board and the CISO walked out the door.

    The following year tells a more complicated story, and honesty requires including it. For FY2025, the Governors approved the Commission’s full $25.4 million request, no cut at all. Yet the CISO seat remained empty for the entire year regardless, filled only as FY2025 was closing out. So the money explains the disaster year reasonably well. It does not fully explain the second straight failing grade, which looks less like a budget problem and more like the ordinary friction of hiring a specialized federal position, a separate and more mundane kind of government dysfunction, but dysfunction all the same.

    Grading on a Curve

    None of this amounts to negligence or coverup. The PRC agreed with all nine of KPMG’s new recommendations this year, as it agreed with all of them the previous two years, and the underlying trend, Ad-hoc to Defined to a mix of Defined and Consistently Implemented, is genuine improvement by any honest reading. The agency went from a two person cybersecurity operation to six people in about two years. That is not nothing.

    What it is, instead, is a small case study in how “Not Effective” becomes a permanent institutional address rather than a temporary embarrassment. The fixes keep arriving with implementation dates a year or more out (several of this year’s nine recommendations are not due until September 2027), the governance layer keeps testing worse than the operational layers built under it, and the agency tasked with holding the Postal Service accountable spends its own compliance report explaining, once again, that it is small, understaffed, and doing its best. It probably is. The report just keeps saying so anyway.

    Sources: USPS OIG / KPMG, FY2026 Federal Information Security Modernization Act Audit of the Postal Regulatory Commission (Report 26-016-R26, September 2026); PRC Chairman Kubayanda statement on FY2024 budget cut.

    Fediverse reactions

  • Four Audits, One Camera, and the Grade TSA Won’t Show You

    The Department of Homeland Security’s Inspector General wants you to know that TSA’s facial recognition program is basically fine. It also wants you to know that the part of the audit said to support that claim is classified, so you will have to take the agency’s word for it, which is the exact arrangement the entire program has run on since it started scanning faces at airport checkpoints.

    That is the honest summary of OIG-26-27, released September 15, 2026, and it is only the newest entry in a pile of oversight reports that keeps growing while the program itself keeps expanding unbothered.

    The Test You Are Not Allowed to Grade

    DHS OIG ran covert tests at airport checkpoints to see whether TSA’s facial recognition and identification technology actually catches fraudulent IDs and persons of interest, which is the entire stated justification for the program’s existence. The results produced three findings and six recommendations. TSA agreed with five and flatly refused the sixth. Two of the six recommendations remain open and unresolved months after the audit closed.

    And then, in the same paragraph, the report informs the reader that “additional details related to this part of our audit are classified or otherwise not available for public release.” No specifics on what the covert testers found, no breakdown of how often officers caught a fake ID versus missed one, nothing. The one part of this audit that speaks directly to whether the program works is the one part the public isn’t permitted to see.

    Security agencies classify testing methodology as a matter of course, and there’s a defensible argument for not publishing a how-to guide for beating a checkpoint. But an agency that non-concurs with one sixth of its own inspector general’s recommendations, on the classified section, is not asking for the benefit of the doubt so much as demanding it.

    The Vendor Who Let Itself In

    The unclassified half of the audit is more concrete, and worse. OIG examined how TSA’s Credential Authentication Technology 2 units, the kiosks that scan your driver’s license or passport at the podium, handle the biometric and biographic data they collect. Routine deletion practices checked out fine. The problem was the vendor.

    According to the audit, the CAT-2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and software enhancements, and TSA had no idea when this was happening. There was no policy governing it, no log tracking when data left the system, and no way to confirm the vendor actually deleted what it took. Passengers whose documents were pulled this way were never told.

    TSA concurred with all three recommendations attached to this finding, which sounds like accountability until you notice that one of the three is still listed as open and unresolved. The agency agreed a contractor had unsupervised access to your passport photo and still hasn’t finished fixing it.

    Three Watchdogs, One Stalled Bill

    This is not the first time someone has told TSA this. In May 2025, the Privacy and Civil Liberties Oversight Board released a staff report capping a six year review of the same program. Its headline finding was that DHS’s own Chief Privacy Officer never conducted the compliance review required under internal DHS policy, and that TSA has offered no schedule for when, or whether, that review will happen. PCLOB’s recommendations included independent public audits, a real privacy impact assessment, and mandatory demographic accuracy testing from vendors before deployment, not after.

    A year earlier, the Government Accountability Office reached a related conclusion from a different angle. GAO-24-106293 found that facial recognition accuracy has genuinely improved under laboratory conditions, but that almost nobody has rigorously studied how these systems perform in the field, across demographic groups, at the scale TSA is now deploying them. Improved in the lab and unverified in the wild is not the same claim as safe to use on the traveling public, though TSA’s messaging tends to obscure the difference.

    Meanwhile, TSA’s own public factsheet still describes the program in the language of pure customer service, as a security enhancement, a convenience, entirely voluntary, with no penalty for opting out and photos deleted after a match except in a limited testing environment.

    Every one of those assurances is now sitting next to an OIG finding about an outside vendor quietly copying passport images with nobody watching.

    The factsheet has not been updated to mention it.

    A Bill That Never Boards

    Congress has had an off ramp sitting on the table for three years and has yet to take it. Senator Jeff Merkley first introduced a bill to ban TSA facial recognition outright in 2023; it died without a vote. The current version, the Traveler Privacy Protection Act of 2025, S.1691, is considerably softer, restricting rather than banning the technology, requiring a non-biometric alternative at every checkpoint, and limiting how long TSA can retain the data it collects. It has bipartisan cosponsors and has gone precisely nowhere since being referred to committee, a fate Merkley’s own office has spent years narrating in press releases that read increasingly like dispatches from a stalemate.

    Put the four documents side by side and a pattern appears that no single report captures on its own. An inspector general audits the program and classifies the part that would tell the public whether it works. A privacy oversight board spends six years concluding that the agency responsible for auditing itself never actually did so. A government watchdog finds the underlying technology has been tested in laboratories but not in the world it is actually deployed in. And a bill written to address all three problems sits untouched in committee while the program it would constrain keeps expanding to more airports every year.

    None of this requires a conspiracy. It only requires an agency confident enough in its own mission that it treats oversight as a formality to be managed rather than a question to be answered, and a Congress content to keep writing reports about the problem instead of legislating one out of existence. TSA is not hiding a coverup. It is doing something more mundane and more durable: it is simply outlasting everyone who asks it to explain itself.

    Sources: DHS OIG, OIG-26-27: TSA’s Use of Facial Recognition Technology (September 2026); Privacy and Civil Liberties Oversight Board, Use of Facial Recognition Technology by TSA (May 2025); GAO-24-106293, Facial Recognition Technology: TSA Should Establish Goals and Measures for Evaluating the Impact on Screening (2024); TSA Facial Recognition Technology factsheet; S.1691, Traveler Privacy Protection Act of 2025.

    Fediverse reactions

  • Congressional Record Watch: The House Took Wednesday Off While the Senate Debated Whether License Plate Readers Are a Civil Liberties Problem

    The House of Representatives was not in session on Wednesday, September 23. It did not meet, it did not vote, it did not do anything a citizen could point to as work, and it will return Thursday only for a pro forma session lasting long enough for someone to gavel it open and closed again. The Senate, left to run the government’s daily errands alone, spent part of its day on a subject that actually deserves a headline; the rest went to student athlete compensation and eight National Whatever Day resolutions.

    The lede belongs to the Judiciary Committee’s Subcommittee on Crime and Counterterrorism, which held a hearing on Flock Safety’s nationwide automated license plate reader network. The witness list did the arguing for itself. The Institute for Justice and the American Civil Liberties Union warned that a private company’s cameras, feeding a searchable database used by thousands of police departments with no warrant requirement, is exactly the kind of infrastructure a country builds when nobody in particular decided to build a surveillance state; it just accumulated one contract at a time. A sheriff from Pinal County, Arizona showed up to say the cameras solve crimes. Both things can be true, which is the entire problem with oversight hearings that end in “concluded” rather than “acted on.”

    Elsewhere the Senate did pass things. The Romance Scam Prevention Act (H.R. 2481) requires online dating services to warn users about fraud, which is Congress discovering in 2026 that people lie on the internet. The Secure Space Act (S. 1962) bars the FCC from licensing satellite systems tied to entities on its own Covered List, a belated acknowledgment that the same national security concerns applied to telecom equipment for years apply just as well to something orbiting the planet. The Satellite Cybersecurity Act (S. 3404) orders a federal report on commercial satellite cybersecurity, which is to say a report about a report, since the underlying vulnerability isn’t news to anyone who has read a GAO study on the subject.

    The Senate confirmed Angela Veronica Colmenero to a federal judgeship in the Southern District of Texas on a 50 to 47 party line vote, and reported out 6,859 military nominations in a single Armed Services Committee motion, the kind of bulk personnel action that never gets a floor debate because nobody’s staff wants to read 6,859 names. The Environment and Public Works Committee held a hearing on nuclear waste management policy, a subject that has generated testimony since before some of the witnesses were born and will generate testimony long after this Congress is gone. The Special Committee on Aging examined the collapse of domestic generic drug manufacturing, which is the kind of hearing that produces excellent testimony and no legislation, because reshoring a pharmaceutical supply chain requires money, and money requires a vote nobody wants to cast.

    Homeland Security and Governmental Affairs declined to authorize its own legal counsel to seek immunity for a witness, a small item buried in the Digest that is more interesting than everything that got its own press release, and got none of the coverage.

    The House Chamber, notably, produced nothing today except a scheduling notice. Democracy’s most photographed branch is apparently also its most occasionally optional one.

    Sources: Congressional Record, Daily Digest, September 23, 2026 (Vol. 172, No. 151).

    Fediverse reactions

  • Federal Register Watch: September 24, 2026

    The Nuclear Regulatory Commission opened a proposed “wholesale revision” of its reactor-licensing and oversight rules today, on a docket where the Commerce Department also imposed an immediate, backdated import restriction on stockpiled polysilicon and the Federal Trade Commission quietly rewrote a cluster of its own internal procedural rules.

    • Nuclear Regulatory Commission — a “wholesale revision” of reactor oversight, not a routine update. The NRC published a proposed rule, Regulatory Enhancements for Reactor Licensing, Decommissioning, and Operational Oversight, describing it as part of a broader regulatory rewrite ordered by Executive Order 14300. Comments are due by November 9, giving the public and the nuclear industry roughly six weeks to weigh in before the agency can finalize anything; the notice itself offers few specifics on what would actually change, which makes that comment window the main opportunity to find out before the rule takes firmer shape.
    • Commerce/Industry and Security Bureau — an import restriction effective two days before it was published. The bureau’s temporary final rule restricting imports of polysilicon and its derivatives, aimed at companies it says are stockpiling the material ahead of tariff adjustments set for December 4 under Presidential Proclamation 11052, is listed as effective September 22 even though it only appeared in today’s Federal Register. A “temporary final rule” skips the advance notice-and-comment process that normally precedes a regulation, and a retroactive effective date compounds that: importers were bound by new registration, monitoring, and waiver requirements before they had any public notice the rule was coming.
    • NRC — the Air Force gets a binding order after mishandling a radioactive source. The commission issued a confirmatory order to the Department of the Air Force, locking in commitments the service made during mediation over a “stuck source event” at the panoramic irradiator at Kirtland Air Force Base. A confirmatory order converts a settlement’s promises — here, fixing the Air Force’s Radioisotope Committee, updating operating procedures, and strengthening safety culture — into a legally enforceable requirement, so a future lapse becomes a violation rather than just a broken promise; it’s a rare instance of one federal agency formally disciplining another over its handling of radioactive material.
    • FTC — two final rules the same day, one dropping a conflict-of-interest check, the other rewriting how the commission votes. One rule eliminates the agency’s post-employment clearance rule, which had required departing staff to clear a review before representing outside parties before the commission; a companion rule, effective the same day, revises how the FTC calculates a quorum, restores page limits for opening briefs, and adds new requirements for commissioner disqualification motions, among other procedural changes. Both took effect immediately with no advance comment period, and dropping an ethics screen the same day the commission also touches its own quorum and disqualification rules is the kind of pairing worth a second look, even without any sign of what prompted it.
    • Civil Rights Cold Case Records Review Board — most of what agencies wanted kept secret, stayed secret. The board’s latest Notice of Formal Determination on Records Release reports that NARA proposed withholding 450 pages across three cold-case incidents, then withdrew 25 of those requests after consultation; the board approved 424 of the remainder, about 94 percent, while clearing 2,987 pages in full and 63 pages in part for release. The board must publish these decisions within 14 days under the Civil Rights Cold Case Records Collection Act of 2018, and a high approval rate for the agencies’ own withholding requests is worth tracking edition to edition to see whether it holds.
    • HHS/Administration for Children and Families — $20 million to one nonprofit, no competition. The Office of Refugee Resettlement’s Refugee Program Bureau announced its intent to award a single-source cooperative agreement worth up to $20 million to the International Rescue Committee for a “National Virtual Program for Professional Advancement,” serving up to 1,334 refugees who arrived in the United States specifically between September 1 and September 30, 2026. A single-source notice is the government’s required public disclosure that it plans to skip competitive bidding, giving other providers a brief window to object before the award is locked in; the unusually narrow one-month arrival window for eligible refugees is the detail worth watching for in future notices.

    This edition draws on the full Federal Register docket for September 24, 2026: 106 documents in all. Excluded as routine: dozens of foreign-trade-zone subzone and production-activity notices, a batch of SEC self-regulatory-organization rule filings, antidumping and countervailing-duty determinations, routine EPA air-plan approvals and NESHAP information-collection renewals, controlled-substance manufacturer and importer registration notices, standard OMB/Paperwork Reduction Act information-collection comment requests, and routine agency meeting notices.

    Fediverse reactions