Bureaucracy Times

All the news fit to be declassified.

  • Federal Register Watch: September 16, 2026

    The federal government’s most consequential move of the day came not from the President but from a sub-Cabinet arms-control official at the State Department, who quietly waived the last sanctions Washington still held over Syria’s chemical-weapons history.

    • State Department \u2014 Waiver of Sanctions on Syria Under the Chemical and Biological Weapons Control and Warfare Elimination Act (document 2026-18918) — published a notice memorializing an August 20 determination by the Under Secretary for Arms Control and Nonproliferation waiving the two remaining sanctions on Syria under the Chemical and Biological Weapons Control and Warfare Elimination Act, covering arms sales and arms-sales financing. The move completes a process the President started in June 2025 by finding that a change in Syria’s government justified lifting most of the sanctions imposed over the Assad regime’s chemical attacks on its own people, but this final step, unlike that one, did not require a fresh presidential determination or the public accountability that comes with it, because it was made under delegated authority by an official two levels below the Secretary. Read the notice.
    • Centers for Disease Control and Prevention — Order Under Sections 362 and 365 of the Public Health Service Act (document 2026-18948) — renewed, for at least the fourth month running, an order under Sections 362 and 365 of the Public Health Service Act suspending the right of people from countries with quarantinable communicable disease outbreaks to enter the United States, this time through October 11. That authority is normally reserved for acute public health emergencies and used briefly, so a standing suspension that has now been rolled over roughly every month since early summer is worth watching, particularly since the notice itself does not say which disease or which countries are driving the repeated renewal. Read the notice.
    • National Science Foundation — Advisory Committee for Integrative Activities; Reestablishment (document 2026-19008) — announced it is “reestablishing” its Advisory Committee for Integrative Activities, a panel that advises the NSF Director on priorities that cut across the agency’s science directorates. Federal advisory committees are ordinarily kept alive through charter renewals described in exactly those terms, so calling this one a reestablishment suggests the prior charter may have been allowed to lapse before being revived, a gap that would have left the committee without formal standing to meet or advise in the meantime. Read the notice.
    • Department of Homeland Security — Registration of Lawful Permanent Residence for Children Born to Foreign Government Employees in the United States; Correction (document 2026-18949) — corrected an interim final rule it had published just one week earlier, on September 9, restoring language on registering U.S.-born children of foreign government employees for permanent residence that the agency says was “unintentionally removed” from the original filing. Interim final rules take effect immediately and skip the advance public comment period that ordinary rulemaking requires, so when a substantive drafting error surfaces within days of one taking effect, it is a reminder that the speed those rules offer comes at the cost of the review that might otherwise have caught the mistake before it became binding. Read the notice.
    • State Department — International Traffic in Arms Regulations: Modification of Civil Aircraft to Incorporate Aircraft Survivability Equipment; Correction (document 2026-18914) — also corrected an interim final rule from August 28 that had removed certain aircraft survivability equipment from the U.S. Munitions List, fixing an error in one of the rule’s amendatory instructions so the regulatory text matches what the agency says it intended. Munitions List determinations decide what counts as a regulated arms export, so even a brief drafting error in the text that draws that line carries higher stakes than an ordinary typo, and its being the second rushed correction to a recent interim final rule in this same day’s docket is worth watching for a pattern rather than dismissing as one-off sloppiness. Read the notice.
    • State Department, Bureau of Consular Affairs — Delegation of Authority for Visa Bond Waivers (document 2026-18958) — delegated its authority to waive Visa Bond Program requirements down from the Assistant Secretary to the Principal Deputy Assistant Secretary and the Deputy Assistant Secretary for Visa Services, covering waivers for individual travelers, entire countries, or categories of applicants. The program requires certain visa applicants, generally from countries the department judges to have elevated overstay rates, to post a bond before traveling, so whoever holds the waiver pen effectively controls how easily that restriction gets lifted case by case, and pushing that discretion down a rung or two in the chain of command is a small but real shift in who sets immigration policy day to day. Read the notice.

    This edition draws on the full Federal Register issue for September 16, 2026, 104 documents in all. Excluded as routine: roughly a dozen antitrust consortium registration notices under the National Cooperative Research and Production Act, fifteen Native American Graves Protection and Repatriation Act repatriation and inventory-completion notices, a dozen antidumping and countervailing duty determinations, seven SEC self-regulatory organization fee filings, and several dozen routine information-collection, advisory-committee meeting, and safety-zone notices.

  • Cameras Rolling, Signs Missing: Inside a San Antonio VA Psychiatric Ward’s Six-Year Wait for Repairs

    A veteran checks into a psychiatric ward in San Antonio expecting one of two things: he is being watched because someone with a badge decided he might hurt himself, or he is being watched because the government simply films everything and asks permission later. According to a Veterans Affairs Office of Inspector General report released September 14, the second version is closer to the truth, and it took federal inspectors walking the halls of the Audie L. Murphy Memorial Veterans’ Hospital to discover that nobody had bothered to tell the patients either way.

    The inspection covered the acute inpatient mental health unit at the South Texas Veterans Health Care System, conducted on site over three days in January 2026. Investigators found a unit that met some of its most serious obligations, suicide risk screening and safety planning among them, while quietly failing at nearly everything adjacent to those obligations: the physical space patients recover in, the paperwork protecting their legal rights, and the cameras recording their worst days without their knowledge.

    Thirty Three Beds That Weren’t There

    Ask South Texas Veterans Health Care System how many psychiatric beds it operates and the paperwork says 33. Ask the OIG, who counted, and the answer is 25. One of the unit’s three wings has been closed for roughly five years for construction that has yet to finish. Two more beds sat empty because of water leaking into their bathrooms. The eight phantom beds existed only in a bed availability letter that facility leaders had simply not gotten around to updating, a lapse that runs directly counter to a national directive requiring “current, complete, and accurate” reporting so the Veterans Integrated Service Network knows what it is actually working with.

    This is not an abstract bookkeeping problem. When bed counts are wrong, veterans get diverted to community hospitals instead of admitted to the VA, and the facility acknowledged as much. Mental health leaders told inspectors they expect seven additional beds once construction wraps, with a completion estimate of December 2027, a date that recurs throughout this report with the reliability of a scheduled bus that never arrives.

    The physical unit itself fares no better on inspection. Bedrooms are dimly lit, painted an institutional off white, furnished with nothing but a bed, and fitted with blinds that cannot be adjusted, a safety feature that doubles as a permanent excuse to keep out natural light. The common area used for dining has a wall phone with no privacy and no artwork, no warm paint, nothing resembling the “hopeful and healing environment” that VA’s own design guide calls for. The facility’s own Associate Chief of Staff for Mental Health described the unit as “very old and institutionalized,” which is one way to characterize a taxpayer funded psychiatric ward that cannot manage ambient lighting.

    The Ligature Points That Have Waited Six Years

    If the paint colors are cosmetic, the next finding is not. The unit has sinks, toilets, and anchor points identified as hanging hazards, the exact kind of environmental risk the Mental Health Environment of Care Checklist exists to catch and correct within six months. Instead, the facility has been granted appeal after appeal, for six consecutive years, to keep these hazards in place while a “risk mitigation plan” consisting largely of nursing staff performing 15 minute observation checks stood in for an actual fix. There was no documentation that these checks were even happening consistently until the OIG asked for one, at which point staff produced a tracking sheet on the spot. The unit’s chief nurse told inspectors the workaround placed an ongoing burden on her staff, which is a polite way of saying the facility outsourced a construction failure to the nervous system of its nursing corps.

    A contract to fix the toilets, sinks, and dispensers existed at one point. It was terminated because the contractor lacked the materials to finish the job. As of the inspection, there was no completion date at all. By May 2026, facility leaders had landed on the now familiar December 2027, a full two years after the OIG walked the unit and found the hazards still standing. Two of the six standing appeals were not even resubmitted within the required window, a paperwork lapse on top of a construction lapse on top of a safety hazard that predates most of the current staff’s tenure.

    Cameras Rolling, Signs Missing

    Buried in the section on “recovery oriented principles,” not suicide prevention, sits the finding most likely to unsettle anyone who has spent time on a locked ward: VA police were monitoring and recording veterans on camera in common areas, in direct violation of the agency’s own privacy directive. That directive permits live monitoring for safety purposes but explicitly prohibits recording, restricts access to authorized healthcare staff, and requires posted signage telling patients they are being watched. The unit had no signage, no standard operating procedure governing camera use, and video access that extended beyond clinical staff to VA police, who were the ones doing the recording.

    It is worth being precise about what the report does and does not establish. The OIG places this finding under general unit operations, not under its Suicide Prevention or Safety sections, and the specific mechanism the facility relies on for monitoring veterans identified as suicide risks is the manual 15 minute check described above, tied to physical hazards rather than to camera footage. Whether the recording was ever intended, formally or informally, as a suicide watch tool is a question the report leaves open, and one bureaucracy.news would like South Texas Veterans Health Care System to answer directly. What the report does establish, clearly, is that the violation here is not that surveillance existed on a psychiatric unit, which any veteran who has been on one would tell you to expect, but that it existed without a sign, without a policy, and without confining access to the people actually providing care. A posted notice at the front door would have made the surveillance itself unremarkable. Its absence, combined with unauthorized recording, is what turned routine security into a documented civil liberties failure.

    The Paperwork Veterans Never Get to Read

    The unit’s clinical shortcuts round out the picture. Only 36 percent of reviewed medical records showed a prescriber had discussed the risks and benefits of a new psychiatric medication with the veteran before giving it to them, well short of the required standard. Discharge instructions, the document meant to get a veteran to his next appointment, listed follow up locations in plain, understandable language only 13 percent of the time; the rest buried the information in medical abbreviations a discharged patient in crisis has no reason to decode. Facility policy on involuntary commitment existed but never bothered to align itself with Texas state law, leaving staff to rely on informal huddles to track who was there voluntarily and who was not, a gap the OIG flagged as capable of contributing to unlawful hospitalization. That disconnect is not a technicality; it risks turning short-term evaluation holds into de facto detentions without the hearings, notices, and clinical certifications state law requires. For veterans on the unit, the difference between a compliant policy and the one in place can be the line between a lawful admission and a confinement that would not withstand legal scrutiny.

    The Health Service Area Director and the Medical Center Director concurred with all thirteen recommendations and produced action plans stretching into 2027, which is the bureaucratic equivalent of a pinky promise with a calendar invite attached. The signage recommendation is already closed. The construction, the treatment planning SOPs, and the involuntary commitment procedures are not, and December 2027 remains, for now, less a deadline than a mantra.

    For more on VA institutional failures, see The VA’s Staffing Crisis, As Reported by the VA, to Itself, on a Web Form — on how 4,712 severe shortages were tabulated from a single unverified questionnaire — and How the VA Turned a $34.5 Million Construction Plan Into a $100 Million Disaster in Arkansas, on a facility whose oversight machinery was present but left deliberately unoperated.

    Fediverse reactions

  • Buy America, Trust America

    When Congress folded the Build America, Buy America Act into the 2021 infrastructure law, it built in something federal industrial policy rarely bothers with: an actual hard number.

    Under Section 70914(a) of the statute, the head of every covered federal agency must ensure that none of the funds for an infrastructure award are obligated unless all the iron, steel, manufactured products, and construction materials used in the project are produced in the United States.

    Waivers exist, and 2 CFR Part 184 spells out exactly three grounds for one: public interest, nonavailability, or a cost increase north of 25 percent. That last figure is not a vibe. It is a line item.

    The theory behind the law is straightforward enough. BABA was sold as industrial policy with a national security gloss, which is keep federal infrastructure dollars circulating through American steel mills and manufacturers rather than leaking out to the cheapest global bidder, on the logic that a country which cannot make its own rebar in a crisis has a problem bigger than procurement.

    Four HUD program offices administer money that counts as infrastructure spending under the statute, which means four separate offices inherited the same legal obligation to check their grantees’ receipts.

    You would think an agency handed a bright line would build a fence along it. According to HUD’s own Office of Inspector General, the Department spent more than four years administering this law across those four offices without a single agency wide plan to verify anyone was actually complying with it.

    HUD did not designate an official to own BABA implementation until April 16, 2026, and it did so only in the middle of the OIG’s own fieldwork on the subject. Nothing focuses an agency’s mind quite like watching an inspector general take notes.

    The Grantee’s Word Is Good Enough

    Of the four offices bound by BABA, the Office of Community Planning and Development got there first, applying the law to Community Development Block Grant projects starting in November 2022 and racking up nine approved waivers since. CPD is, by HUD’s own account, the most mature implementation in the building.

    Its enforcement mechanism is a checkbox.

    Grantees drawing funds through CPD’s Integrated Disbursement and Information System simply indicate whether BABA applies to their activity and self certify compliance. There is no independent verification layer sitting underneath that certification.

    BABA only gets a second look if a risk assessment happens to flag it, which means the government’s flagship domestic sourcing law rides on the same honor system CPD uses for everything else, applied to a statute that exists because Congress specifically did not trust the market to sort this out on its own.

    2 CFR § 200.322 already required a general domestic preference for federal financial assistance procurements before BABA arrived. BABA was supposed to be the version with teeth.

    Everyone Else Just Waited

    If CPD is the office that built a system and then quietly hollowed it out, the other three did not build anything at all. The Office of Public and Indian Housing spent years telling the OIG it was waiting on OMB for guidance on how to structure compliance oversight, an answer that stops sounding like patience and starts sounding like a strategy somewhere around year three of a law that took effect in 2021.

    The Office of Multifamily Housing Programs reported zero waiver requests and zero compliance issues, a data point HUD’s own management framed as evidence of a healthy program rather than what it also could be: a program that has never looked closely enough to find a problem.

    The Office of Lead Hazard Control and Healthy Homes gets a pass by design rather than diligence, since its grants have simply never crossed the simplified acquisition threshold that triggers BABA in the first place. Three different offices, three different excuses for the same underlying fact: nobody was checking.

    Meanwhile OMB’s implementation guidance has been on the books since October 2023, and the Made in America Office exists specifically to standardize waiver review across agencies so that a law meant to apply uniformly does not turn into four unrelated fiefdoms. HUD’s fiefdoms did manage to coordinate on one thing: HUD’s Office of the Chief Financial Officer processes every waiver request that goes out the door, posting each proposed waiver for a public comment period before forwarding it to the Made in America Office for final review.

    That is a genuinely sound piece of process design. It also means HUD built a working pipeline for the rare case when a grantee admits it cannot comply, while leaving the far more common case, whether a grantee complied at all, to nobody in particular.

    The July 2027 Excuse

    The OIG’s fix is almost insultingly modest: designate one accountable official, and have each office write down an actual monitoring policy. HUD agreed to the first part immediately, once the person doing the agreeing had already been appointed mid audit. The second part is where the report gets its best line, buried in Appendix A.

    The Office of Multifamily Housing Programs, responding in writing, told the OIG it does not intend to call out BABA compliance separately from every other regulatory requirement grantees already certify to, arguing that a standalone BABA certification would be duplicative on top of the general certifications already required under 2 CFR § 200.322 and the noncompliance remedies already available under 2 CFR §§ 200.339 through 200.343.

    That is a coherent legal argument. It is also, functionally, an office explaining why it would prefer not to build the one thing the inspector general asked for, and it set a target completion date of July 2027 to write guidance it has apparently already decided will not say much.

    The Office of Lead Hazard Control and Healthy Homes made a nearly identical case in Appendix B, while simultaneously agreeing to join a memorandum of understanding making some other office responsible for the coordination.

    None of this means BABA is a bad law, or even that HUD’s grantees are quietly larding their construction sites with foreign steel. Nobody in the report claims that, because nobody checked closely enough to claim anything.

    That is the actual finding here, dressed up in the government’s preferred euphemism of “limited program office monitoring.” A domestic sourcing law with a hard 25 percent ceiling and a specific enforcement office in OMB got implemented across a cabinet agency for the better part of half a decade on the strength of a checkbox, a waiting list, and a threshold nobody has crossed yet.

    The law had teeth. HUD just never got around to installing the jaw.

  • Federal Register Watch: September 15, 2026

    Wednesday’s Federal Register carried a cluster of civil-service actions from the Office of Personnel Management, the most notable of which was a second correction in six weeks to the same reduction-in-force rule the agency finalized this summer.

    • Office of Personnel Management — Reduction in Force; Correction (document 2026-18800): OPM corrected its own reduction-in-force and Career Transition Assistance Plan regulations for the second time since the underlying rule took effect on September 2, after finding that an earlier amendatory instruction had accidentally deleted two paragraphs from the definition of a “displaced” employee. Two corrections to the same rule within six weeks is worth a second look, because “displaced” status is what determines which employees keep recall and reassignment rights when a reduction in force hits, so an error there is not merely typographical. Read the correction.
    • Office of Personnel Management — Promoting Employee Accountability (document 2026-18943): OPM reopened, for two weeks, the comment period on a proposed rule that would loosen the standards agencies must meet to discipline or remove employees for poor performance or misconduct, a window that had already closed in early August. The reopening is specifically to gather views on new OPM data and on a report from an outside advocacy group called We the Doers, which is an unusual reason to reopen a closed docket and raises the question of why that particular report, rather than the agency’s own review, prompted a fresh round of public input. Read the notice.
    • Office of Personnel Management — Shared Certificates and Pooled Hiring Actions (document 2026-18828): OPM issued an interim final rule, effective October 15, letting federal agencies share hiring certificates and applicant pools with each other for jobs common across government. The rule cites a specific 2015 statute that authorizes OPM to skip the normal notice-and-comment process, so the change takes legal effect before the public comment period even closes on November 16, which is the exception rather than the rule for how federal regulations are ordinarily made. Read the rule.
    • Office of Personnel Management — Federal Employees Health Benefits Program: Optimizing FEHB Plan Offerings (document 2026-18944): OPM asked for public input on whether to lift the regulatory cap limiting FEHB carriers to three plan options, or two options plus a high-deductible plan, a limit currently set out in agency regulation. It is only a request for information rather than a proposed change, but it signals OPM may be building a record to expand its authority over health-plan choices for the federal workforce, the kind of structural question worth flagging well before any formal rule follows. Read the request for information.
    • Federal Energy Regulatory Commission / North American Electric Reliability Corporation — Order Approving Reliability Standard CIP-014-4 (document 2026-18868): FERC approved an updated mandatory standard requiring electric transmission owners to reassess, more rigorously and more often, which substations are critical enough that physical damage to them could destabilize the broader grid. The order followed FERC’s standard approval process with no sign of an expedited timeline or dissent, but it is a real tightening of physical-security obligations for the utilities that operate the country’s most sensitive transmission infrastructure. Read the order.

    This edition reflects a full screen of all 121 documents published in today’s Federal Register. Excluded as routine: state-by-state SNAP demonstration project notices, antidumping and countervailing duty determinations, self-regulatory organization exchange-rule filings, OMB/PRA information-collection requests, airworthiness directives and airspace amendments, safety zones, advisory-committee and Sunshine Act meeting notices, and foreign-trade zone actions.

  • Federal Register Watch: September 14, 2026

    The White House issued five separate proclamations today rewriting, yet again, which Canadian products face a 50 percent tariff, the latest turn in a trade fight over motor vehicles, dairy, and alcoholic beverages that has shifted by presidential proclamation every few weeks since July.

    • Executive Office of the President: Five Presidential Proclamations published today adjust the scope of the 50 percent additional tariff on Canadian goods covering motor vehicles, dairy, and alcoholic beverages, some removing specific products from the duty and others keeping or reimposing it. The proclamations invoke Section 338 of the Tariff Act of 1930 and Section 604 of the Trade Act of 1974, and take effect at 12:01 a.m. Eastern the following morning, meaning importers of the affected goods had less than a day’s notice before the new duty status applied. This is at least the third adjustment to the same underlying tariff order since it was first imposed in July, following a brief suspension and what the proclamations describe as Canada’s failure to honor negotiating commitments in August. See the motor vehicles proclamation, the dairy proclamation, and the alcoholic beverages proclamation.
    • OCC, Federal Reserve, and FDIC: The three banking regulators issued a joint interim final rule doubling, from under $3 billion to under $6 billion in total assets, the size threshold under which small banks and U.S. branches of foreign banks qualify for a lighter-touch 18-month exam cycle instead of the standard 12-month one, implementing a provision of the 21st Century ROAD to Housing Act (Public Law 119-101). Because it is an interim final rule rather than a proposed one, the change is already in effect; the agencies are only taking public comment after the fact, through October 14, which limits outside input to whether the rule should be revised rather than whether it should have happened in the first place.
    • Federal Aviation Administration: The FAA proposed a new airworthiness directive requiring repeated borescope inspections, and in some cases parts replacement, on CFM56-5B, -5C, and -7B engines, which power a large share of the in-service Boeing 737NG and Airbus A320 fleets, after multiple reports of a turbine seal shedding material inside the engine. The entry’s own title in the Federal Register is simply its regulatory identifier, “RIN 2120-AA64,” rather than a description of the affected aircraft or the defect, the kind of gap that would make it easy to miss for anyone scanning the day’s docket by title rather than reading every entry in full.
    • Natural Resources Conservation Service (USDA): NRCS rescinded its own December 2022 notice of intent to prepare a full Environmental Impact Statement for a proposed dam and reservoir on the West Fork of Battle Creek in Carbon County, Wyoming, stating plainly that the original notice “was issued prior to confirming viable alternatives and need for an EIS.” An EIS notice launches a multi-year formal review process and commits an agency to studying a defined set of alternatives, so unwinding one nearly four years in means whatever groundwork occurred under it is now void and any future review would effectively start over.
    • Administration for Community Living (HHS): ACL announced its intent to award a single-source, non-competitive supplemental grant of $1,084,718 for fiscal year 2026 to the Lake Erie College of Osteopathic Medicine, bringing that cooperative agreement’s total funding since fiscal year 2024 to $4,345,417, for outreach and training aimed at engaging older adults with behavioral health conditions in evidence-based health programs. Sole-source awards skip the competitive process most federal grants go through, and the notice states only that ACL “intends” to make the award without explaining why this recipient was chosen over any competing applicant, leaving the public comment period as the only real check before the money goes out.
    • National Institutes of Health (HHS): NIH released a draft biosafety policy meant to eventually replace its longstanding Guidelines for recombinant or synthetic nucleic acid molecule research, the rulebook that governs safety practices at essentially every NIH-funded lab doing this kind of work. Comments are open through October 19, and because NIH is, by its own description, the world’s largest public funder of biomedical research, any change to how it defines biosafety compliance will eventually reach thousands of grantee institutions rather than staying confined to NIH’s own facilities.

    This edition draws on the full 156 documents published in the Federal Register on September 14, 2026. Categories screened and excluded absent an anomaly signal: routine antidumping and countervailing duty determinations and administrative reviews, SEC self-regulatory-organization fee-schedule filings, the large block of immigration and naturalization information-collection renewal notices, Sunshine Act meeting notices, routine state disaster declarations, FERC environmental-assessment scheduling notices, International Trade Commission complaint-receipt notices, and standard OMB and Paperwork Reduction Act information-collection requests.

  • The VA’s Staffing Crisis, As Reported by the VA, to Itself, on a Web Form

    The Department of Veterans Affairs Office of Inspector General has published its thirteenth annual accounting of occupational understaffing across the Veterans Health Administration, and the numbers are, on their face, alarming. 4,712 severe occupational staffing shortages, spread across 389 distinct occupations, at all 139 VA medical centers. Ninety seven percent of facilities reported a shortage of Medical Officers. Eighty six percent reported one for Nurses. Practical Nurse topped the clinical list, followed by Psychology, Psychiatry, Social Work, and Nursing Assistant. Police led the nonclinical list, trailed by Custodial Worker, Medical Support Assistance, Food Service Worker, and Healthcare Engineer.

    These are the kind of numbers that generate a congressional statement before lunch, and they did. What they will not generate, this year or any year, is an OIG recommendation. There were none. The Under Secretary for Health concurred with the entire document, which is not a difficult thing to do when the document asks nothing of you. “No further action is required,” the cover memo notes, four words carrying an improbable amount of institutional weight.

    Worth noting before anything else: this year’s title changed. Prior editions in this series were called “OIG Determination of Veterans Health Administration’s Severe Occupational Staffing Shortages.” This one is the “OIG Report of Veterans Health Administration’s Responses.” A determination implies somebody determined something. A report of responses implies somebody filled out a form. Both titles describe the identical annual survey. Only one of them is being straight with you.

    The Instrument: One Email, One Form, One Month

    Here, in full, is the OIG’s evidentiary process. On March 18, 2026, the OIG emailed a link to a web based questionnaire to one VHA designated official at each of the agency’s 139 medical facilities. Those officials had until April 1 to check boxes next to any of 596 listed occupation codes they personally believed met the criteria for a “severe shortage” under 5 C.F.R. § 337.204, weighing eight enumerated factors that include things like labor market conditions and “the desirability of the duties.” Having weighed them, the official simply decided. One hundred twenty six people responded on behalf of all 139 facilities by April 16.

    That is the entire study. The OIG says, twice, once in the introduction and once in the conclusion, that it “does not validate the accuracy of the information provided.” No supporting documentation was required. No vacancy data was requested, gathered, or cross referenced against a single one of the 4,712 claimed shortages. The report is unusually candid about what this means in practice: a facility can designate an occupation a severe shortage whether it has zero open positions or one hundred, and the methodology treats the two cases identically.

    That is not a staffing audit. It is a survey of managerial mood, conducted once a year, with a two week deadline.

    The looseness compounds. Officials could flag a shortage at the individual assignment code level (say, Cardiology Non Invasive) or at the parent occupational series level (Medical Officer) or both, and the OIG counted each separately in its national tally. Birmingham VA Health Care System in Alabama reported 148 severe shortages, the most of any facility in the country. VA Gulf Coast Healthcare System in Biloxi, Mississippi, reported four. The report offers no basis for distinguishing a genuinely more troubled hospital from a more enthusiastic form filler, because it never asked.

    What the Report Declines to Explain

    A document organized entirely around workforce shortages might reasonably be expected to eventually address why those shortages exist. This one does not. Buried inside the eight criteria officials could weigh is a requirement to consider “an explanation of why recruitment and training efforts have not been sufficient.” Whatever that explanation was, for any given facility, it lived inside the checkbox and stayed there. The OIG never collected it, never aggregated it, and never mentions pay, attrition, working conditions, or federal workforce policy anywhere in its findings. The causes of the shortage are, per the document’s own design, unknowable from the document.

    Even the year over year comparison that has been a fixture of this report series since at least 2018 has quietly disappeared. Last year’s edition devoted an entire section to comparing eight years of responses and reported a 50 percent jump in total shortages, from 2,959 to 4,434 (VA OIG, FY 2025 report). This year’s report does not mention that figure, does not compare itself to it, and contains no trend section at all. A reader curious whether 4,712 represents an emergency or a rounding error has to leave the document and do the arithmetic personally: it is a further 6 percent increase over an already record year, and a 59 percent increase over FY 2024.

    Also unmentioned is the VA’s own 2025 workforce reduction planning, first floated above 80,000 positions before settling under 30,000, and the deferred resignation program that thinned the federal workforce in the same window. The OIG itself acknowledged last year that its FY 2025 survey window did not fully capture those effects. This year’s survey ran March through April 2026, squarely inside the period when those departures would show up in a facility’s staffing picture, and the report does not revisit the question, or apparently think to.

    The Vacancy Count Nobody Counted

    None of this means the VA’s staffing problems are invented. It means this particular report cannot tell you whether they are unusual, because it never checks them against anything, including the rest of the American labor market in the same occupations.

    Start with nursing, the VA’s top reported shortage. HRSA’s national workforce projections put 2026 registered nurse supply at roughly 90 percent of demand nationally, an 8 to 10 percent shortfall, and the hospital industry’s own 2026 retention survey puts the national RN vacancy rate at 8.6 percent (Prolink, citing HRSA; Becker’s Hospital Review, 2026 NSI staffing data). VHA officials, using no comparable metric, designated a severe nurse shortage at 86 percent of facilities. Either VA hospitals are short nurses at roughly ten times the national hospital rate, or “severe shortage” inside this survey describes something considerably softer than an actual vacancy.

    Policing follows the same pattern. Nationally, law enforcement agencies are operating at roughly 91 percent of authorized sworn strength, a genuine and heavily documented crisis produced by a 1990s hiring boom now reaching retirement age and a battered applicant pipeline (PERF survey data, via LegalClarity). VA police were designated a severe shortage at 57 percent of facilities, again with no vacancy count attached to the claim.

    Behavioral health is the one category where the VA’s self reported alarm and the underlying civilian labor market actually agree. HRSA’s own shortage area designations put roughly 40 percent of the country inside a federally recognized Mental Health Professional Shortage Area, and its workforce model projects the nation will be short tens of thousands of psychologists and counselors within the next decade (HRSA Behavioral Health Workforce Brief). Psychology was VHA officials’ second most cited clinical shortage, at 58 percent of facilities. Here, for once, the VA’s internal alarm and the government’s own independent workforce data land in roughly the same neighborhood, which only makes the inflation everywhere else more conspicuous by comparison.

    The VA’s staffing report will make headlines again this year, as it does every year, because 4,712 is a large, quotable, frightening number, and because almost nobody reads past the executive summary to the methodology section where the OIG quietly tells you what the number actually is. It is real, in the sense that 126 people typed it into a web form under no obligation to prove it. Whether it describes an actual staffing emergency, a genuinely under resourced institution correctly flagging its own weak points, or a system where any manager annoyed enough to log in can manufacture a crisis with a checkbox, the report itself will not say. The consequences of these gaps show up elsewhere in our VA coverage: a San Antonio psychiatric unit operating with 15 vacant medical positions, a construction disaster at the Fayetteville VA that left veterans waiting years for facilities that still aren’t open, and $11.2 million paid to a backup crisis line contractor that never answered a call. It offered no recommendations. It required none. The Under Secretary for Health concurred without comment, because there was, by design, nothing left in the document to argue with.

    Fediverse reactions

  • The Security Order That Failed: Why CBP’s 2023 Modernization Directive Went Unenforced for Three Years

    In May 2023, U.S. Customs and Border Protection‘s leadership issued a formal directive requiring all information technology applications to consolidate their access controls under a centralized security system. It was a reasonable mandate: CBP recognized that its IT infrastructure had become fragmented and chaotic, with different applications using different security protocols. Centralization would improve security and make it easier to track who had access to what.

    Three years later, the order remains largely unenforced.

    The directive, issued as IPL-2022-05-0253 in May 2023, required all CBP application owners to “evaluate the feasibility of enrolling in” CBP’s Access Management System (AMS)—the centralized platform designed to manage user access across the agency’s 100 major IT applications.

    According to a Department of Homeland Security Office of Inspector General audit released September 4, 2026, CBP never followed up.

    This is one of three pieces covering the same OIG audit. The other two examine how hundreds of separated contractors and transferred employees kept active system access after leaving CBP, and a seven-year-old privileged account vulnerability that gave all 76,000 CBP network users administrative access.

    “The directive required all CBP application owners to evaluate the feasibility of enrolling in the AMS. Yet this policy was neither fully implemented nor enforced because CBP did not develop a process to track and monitor compliance with the directive, and some application teams disagreed with the directive’s requirements.”

    In other words: CBP issued an order, and then failed to build any mechanism to ensure the order was obeyed.

    Why This Matters: The Fragmentation Problem

    CBP operates approximately 100 major IT applications. Each one stores, processes, or accesses sensitive information: law enforcement data, biometric records, border security intelligence, personal information of travelers.

    For security to work at scale, CBP needs to know, at any given moment, who has access to what systems and why. This requires a centralized system of record—a single source of truth for user access across all applications.

    Before the May 2023 directive, CBP didn’t have that. Instead, the agency relied on individual application owners to manage access for their own systems. This approach created what the OIG audit describes as “oversight challenges for ensuring all accounts were monitored in accordance with requirements.”

    It’s a diplomatic way of saying: CBP had no idea whether its access controls were actually working.

    “CBP acknowledged that it could not identify all applications on its network,” the OIG audit states. Think about that: CBP couldn’t account for all of its own applications.

    This is not a minor technical issue. If CBP can’t identify all applications on its network, then CBP can’t secure them. Unidentified applications are unmonitored applications. Unmonitored applications are vulnerable applications.

    The Directive’s Core Requirement

    The May 2023 Identity Credential and Access Management Directive was CBP’s attempt to fix this problem at the structural level. The order required all application owners to evaluate whether their systems could be integrated into the centralized AMS.

    For applications that *could* be integrated, the directive implied they *should* be integrated. For applications that couldn’t be integrated (due to technical limitations), the directive required them to maintain their own rigorous access control standards while remaining outside the centralized system.

    In principle, this makes sense: Consolidate what you can, and tightly control what you can’t.

    In practice, CBP didn’t build any mechanism to enforce it.

    “CBP did not develop a process to track and monitor compliance with the directive,” the OIG found.

    This is a critical failure point. A directive without enforcement is merely a suggestion. And in a large bureaucracy, suggestions are easy to ignore.

    The OIG identified specific cases of non-compliance. “During our audit, we found not all application owners appropriately monitored their accounts. For example, one major application team we met with did not review their application service accounts in fiscal years 2023 and 2024, as required.”

    One major application team. Not reviewing accounts. For an entire two-year period. As required by policy.

    And no one noticed, because no one was checking.

    Organizational Resistance

    The OIG audit includes a phrase that deserves close attention: “some application teams disagreed with the directive’s requirements.”

    This is remarkable. A formal directive from CBP’s leadership on a critical security matter, and application teams simply disagreed with it.

    The audit does not elaborate on which teams disagreed, what their objections were, or what CBP leadership did in response to the disagreement. But the fact that disagreement existed and persisted suggests CBP’s leadership lacked either the authority or the will to enforce compliance.

    There are legitimate reasons why an application team might resist centralization:

    • Technical concerns: Their legacy system might not be compatible with the centralized platform
    • Operational concerns: Integration might cause service disruptions or performance degradation
    • Resource constraints: Integration requires staff time and potentially licensing costs
    • Autonomy concerns: Application teams might prefer maintaining control over their own access management

    Any of these reasons could be valid. But a security directive isn’t something that gets negotiated away because a team prefers autonomy or fears disruption. Security is not optional.

    The fact that CBP issued a directive and then allowed disagreement to derail it suggests that application teams had more power than the directive issuer. This is an organizational dysfunction issue.

    The Audit Timeline: How CBP Fell Behind

    The chronology is revealing:

    – May 2023: CBP’s Identity Credential and Access Management Directive is issued

    – October 2024 – December 2025: OIG audit is conducted

    – September 4, 2026: OIG audit is released, revealing non-compliance

    The audit took place approximately 18 months after the directive was issued. At that point, CBP had not yet developed a process to track compliance.

    This isn’t incompetence. This is a pattern: Issue a directive, don’t follow up, and when an auditor asks what happened, explain that enforcement mechanisms weren’t built.

    The OIG’s recommended corrective actions are telling:

    • “Identify all applications not in compliance with the Identity Credential and Access Management Directive” (Estimated completion: December 31, 2026)
    • “Develop and implement a process to monitor and enforce compliance with the Identity Credential and Access Management Directive” (Estimated completion: December 31, 2026)
    • “Develop and implement controls to monitor whether applications not integrated with CBP’s access management system comply with DHS and CBP privileged account security requirements” (Estimated completion: December 31, 2026)

    In other words: In September 2026, CBP is still in the process of doing things it should have done before issuing the May 2023 directive.

    CBP’s Response: Another Directive

    In response to the OIG audit, CBP agreed to the recommendations and provided corrective action plans.

    The agency’s response to the “monitor and enforce compliance” recommendation is instructive: “CBP’s Office of Information and Technology, Cybersecurity Directorate will develop and implement a standardized process to monitor and enforce compliance with the Identity Credential and Access Management Directive. This process will include regular reviews of application entitlements and coordination with application owners to ensure alignment with access management requirements. CBP will work to address legacy practices that allow certain applications to operate outside the centralized Identity Management platform.”

    This is bureaucratic language for: “We will now do what we should have done in May 2023.”

    CBP also acknowledges that building the inventory is itself a challenge: “CBP’s Office of Information and Technology, Cybersecurity Directorate will initiate an enterprise-wide effort to catalog all applications in use across the organization. This will include leveraging existing resources such as Mobius, Information Systems Security Manager/Information System Security Officer distribution lists, and other authoritative sources to develop a comprehensive inventory.”

    In 2023, CBP issued a directive to fix a security problem. In 2026, CBP is still trying to inventory what applications it owns. The direction of progress is clear, but the pace is glacial.

    A Symptom of Larger Dysfunction

    The May 2023 directive failure is not an isolated incident. It’s part of a pattern visible throughout the OIG audit.

    CBP issued account disablement policy directives in August 2023 (Directive 51715-006 and Directive 1210-007B). The audit found that supervisors and contracting officers still weren’t following them in 2023-2024.

    CBP’s access management system existed and was supposed to work, but many applications weren’t enrolled in it, so it didn’t actually manage access to those applications.

    CBP had defined processes and had built systems, but the systems weren’t integrated and the processes weren’t enforced.

    This is the hallmark of organizational dysfunction: scattered implementation, inconsistent enforcement, and reactive problem-solving instead of proactive governance.

    An alternative model would look like this:

    1. Issue a directive with specific compliance requirements
    2. Simultaneously build enforcement mechanisms
    3. Establish timelines and penalties for non-compliance
    4. Assign clear accountability for each component
    5. Monitor compliance proactively
    6. Address non-compliance immediately

    CBP’s actual model:

    1. Issue a directive
    2. Wait for voluntary compliance
    3. Eventually, notice that compliance isn’t happening
    4. When audited, admit that no enforcement mechanism was built
    5. Promise to build enforcement mechanisms in the future

    The Fundamental Question

    The May 2023 directive came after years of known, documented access control problems at CBP. The OIG had audited CBP’s access controls before. CBP knew its infrastructure was fragmented and inconsistently managed.

    So when CBP’s leadership decided to issue a directive requiring centralization, that decision presumably came with an understanding that centralization would require enforcement and monitoring.

    Yet no enforcement mechanism was built. No compliance monitoring was established. No timeline or accountability structure was created.

    Why?

    Possibilities:

    • Resource constraints: Monitoring compliance requires staff and budget that weren’t allocated
    • Technical limitations: The systems needed to monitor compliance weren’t ready
    • Leadership weakness: CBP’s CIO lacked authority to enforce directive compliance
    • Organizational fragmentation: Application owners reported to different chains of command and had different priorities
    • Competing demands: CBP’s leadership prioritized other initiatives over security modernization

    The OIG audit doesn’t answer this question. CBP’s response doesn’t address it. It remains unexplained.

    What Happens Now

    CBP’s corrective action plans commit to:

    • Completing application inventory by December 31, 2026
    • Implementing compliance monitoring and enforcement by December 31, 2026
    • Addressing legacy practices that bypass centralized controls by December 31, 2026

    If these timelines hold, CBP will finally, in late 2026, be implementing enforcement mechanisms for a directive issued in May 2023.

    That’s 3.5 years between issuing a security directive and building the enforcement mechanisms to actually make it work.

    The OIG will presumably audit CBP again in a year or two to determine whether the corrective actions actually solved the problem. If history is any guide, the answer will depend on whether CBP maintains the monitoring process over time or lets it atrophy.

    A directive that goes unenforced for three years suggests something deeper than a one-time oversight. It suggests that enforcing security directives isn’t actually prioritized in CBP’s organizational culture, even when the directive comes from leadership.

    That’s a pattern worth watching.

    References and Links

    – Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — OIG-26-28-Sep26.pdf — Released September 4, 2026 by the DHS Office of Inspector General

    – OIG Report Section: Key Finding 2: “CBP Did Not Ensure All Accounts Were Periodically Reviewed” (pages 4-5 of report)

    – CBP Policy Documents (referenced in audit):

    • CBP Identity Credential and Access Management Directive (IPL-2022-05-0253, May 2023)
    • CBP Directive 51715-006: Separation and Reassignment Directive for CBP Employees (August 2023)
    • CBP Directive 1210-007B: Tracking of Contractor Employees (August 2023)

    – DHS Policy (referenced in audit):

    – DHS OIG Homepage: www.oig.dhs.gov

    Editor’s Notes

    – CBP was asked for specifics about: (1) which application teams disagreed with the directive and on what grounds; (2) why no enforcement mechanism was built in May 2023; (3) what resources and timeline were originally planned for the directive’s implementation; and (4) what changed between May 2023 and September 2026 that prompted CBP to prioritize compliance monitoring. CBP declined to provide additional information beyond its written response to the OIG audit.

    – The CBP Identity Credential and Access Management Directive (IPL-2022-05-0253) is referenced in the OIG audit but the full text does not appear in the public report. Bureaucracy Times FOIA’d this document for fuller analysis; results pending.

    – The OIG audit notes that “CBP was aware of these challenges and took action to address them in May 2023” by issuing the directive. This confirms that CBP’s leadership recognized the fragmentation problem. The failure was in execution, not awareness.

    – All of CBP’s corrective action timeline commitments (December 31, 2026 and August 31, 2026) fall within the current fiscal year and represent commitments made to the OIG in response to the audit. These are not yet guaranteed to be achieved.

    Fediverse reactions

  • How the VA Turned a $34.5 Million Construction Plan Into a $100 Million Disaster in Arkansas

    The Veterans Health Administration’s capacity for self-inflicted institutional failure remains as reliably catastrophic as ever. A new Office of Inspector General report, released in September 2026, documents how five construction and maintenance projects at the Fayetteville VA Medical Center in Arkansas went from a collectively budgeted $34.5 million to approximately $100 million in actual or projected costs, with delays ranging from one year to more than seven years beyond their scheduled completion dates. As of January 2026, only one of the five projects had been finished. The others languished in various states of partial construction, abandonment, or perpetual redesign.

    The core allegation that prompted the OIG investigation, submitted via hotline complaint in March 2024, was straightforward: the facility was chronically unable to execute basic construction management tasks. Three of the four allegations were substantiated. The fourth, regarding contract terminations, wasn’t needed; the more damning finding was that the facility didn’t even fail to terminate contracts properly, because it managed not to terminate any construction-related contracts at all between 2019 and 2024, suggesting a different species of dysfunction entirely.

    The OIG report identifies the underlying cause with surgical precision: the engineers delegated as Contracting Officers’ Representatives (CORs) at Fayetteville didn’t do their jobs. They failed to provide architectural and engineering firms with complete VA design and physical security requirements. They handed construction contractors statements of work so vague that bidders peppered the facility with clarifying questions that went unanswered or received replies that prompted yet more questions. None of the three CORs interviewed for the investigation had taken formal training on developing statements of work, despite this being identified in VHA guidance as a primary responsibility. No formal design review process existed, despite the Federal Acquisition Regulation requiring CORs to maintain records of their design approvals. In lieu of institutional process, the facility’s engineering team conducted design reviews via email and spreadsheet, often without signatures, frequently without documentation of which engineer actually did the reviewing.

    This is not complexity masquerading as bureaucracy. This is bureaucracy pretending to be competence.

    The Geometry of Delay

    The mathematics of Fayetteville’s construction failures follows a peculiar pattern: small initial omissions compound into massive downstream costs and schedule disruptions. Consider the inpatient mental health building, the facility’s flagship project. Originally budgeted at $9.5 million with a planned October 2018 completion date, it remained under construction as of January 2026, more than seven years late, at an estimated final cost around $19 million. As the OIG investigation traced the project’s trajectory, the story of how a straightforward 21,056-square-foot psychiatric facility became a near-decade-long institutional migraine emerged from the contract record.

    The architectural and engineering design did not comply with VA physical security standards because the CORs writing the initial design contract omitted VA-specific requirements from the statement of work. This wasn’t a disagreement about standards or a calculated decision to incorporate standards later. The VA design requirements simply weren’t communicated. When construction bidders reviewed the design documents and began asking contractors’ reasonable questions about security specifications, lighting minimums, electrical connections, piping, stairwells, and elevator shafts, the facility’s response was essentially: we’ll figure it out. The COR’s responses were vague enough that contractors asked follow-up questions, some of which went unanswered. After the contract was awarded at $12.4 million, well above the $9.5 million budget, construction began. Then the contractors discovered the design didn’t meet VA standards. Automatic door operators required for patient accessibility throughout the building were absent. An over-the-door alarm system for suicide prevention in patient rooms was missing. The design lacked proper gaps between exterior masonry and walls, a deficiency that led to a legal dispute and cost the facility $1.8 million in contractor time spent resolving the noncompliance.

    In total, the mental health building accumulated 34 contract modifications, of which 16 related directly to design errors and omissions. Another project, the logistics area and sterile processing service renovation, began with a $2.7 million budget and 6,300 square feet of intended space. Architects eventually informed the facility that the selected location lacked sufficient square footage to meet the project’s design requirements. Rather than catching this during the planning phase, the discovery triggered a two-month work stoppage while the facility and its architectural firm argued about scope. When they agreed to expand the space, the project’s footprint ballooned to 13,500 square feet. By January 2024, the facility decided to split the project in two. The original $2.7 million project is now projected to cost $28.9 million total, with completion dates pushed five years into the future. The sterile processing component alone now carries a $24.8 million price tag.

    The laundry facility renovation followed a similar arc, though with more dramatic physical consequences. The original $1.9 million project eventually cost over $8 million. During construction, water damage was discovered in the building’s concrete floor; damaged concrete and rebar had to be removed and replaced before any other work could proceed. This discovery suggests contractors were bidding on a site assessment that had no apparent connection to what was actually in the ground. The statement of work didn’t adequately describe existing site conditions, so contractors bid on a phantom project, then discovered the real one halfway through construction.

    The Accounting of Incompetence

    The financial impact extends beyond the direct project costs. The facility spent over $1.1 million from its general operations funds on indirect expenses related to construction delays. When the inpatient mental health building delayed its opening, furniture purchased for the facility in 2020 needed warehousing. The facility paid a contractor $52,000 in December 2022 to store furniture for a building that still wasn’t ready for occupancy. Eventually, the facility moved the furniture to on-site storage to reduce costs further. Storage, surveillance, and laundry operations were temporarily outsourced or relocated due to construction delays, creating a cascading series of workarounds, each carrying its own budget impact.

    The three projects affected by cost-estimate variances all exceeded independent government cost estimates by more than 20 percent. The mental health building’s estimated construction cost was $8.2 million; the awarded contract was $12.4 million. The inpatient medical surgery unit’s estimated cost was $7.8 million; the awarded contract was $11.7 million. The logistics renovation estimate was $1.8 million; the awarded contract was $4.1 million. The OIG notes that while VA has no established criteria for acceptable variance between estimates and contract awards, significant deviations result in schedule delays while additional budget approvals are sought.

    There’s a damning detail embedded in the OIG’s analysis of independent government cost estimates. These estimates are supposed to be developed by CORs and based on prior project information, market research, anticipated direct and indirect costs, and design review. They’re meant to serve as a baseline against which to evaluate whether a contractor’s proposed price is reasonable. But the Fayetteville CORs were developing these estimates without having received training on how statements of work affect cost estimates, because training on developing statements of work simply wasn’t part of their onboarding. One might reasonably ask: if your staff doesn’t know how to write clear project specifications, how can they be expected to estimate what those (unclear) specifications should cost?

    The Institutional Abdication

    The most corrosive finding in the OIG report concerns what the VA system failed to catch before irreversible harm occurred. VISN 16, the regional oversight body, explicitly offered technical assistance through a construction management support contract designed to help facilities identify architectural and engineering design deficiencies. The Fayetteville medical center declined to use it. The facility’s chief of engineering service said the center couldn’t identify a “resource gap” that the contract would fill. Yet three of the projects reviewed by the OIG were either in the design phase or early construction phases at the time this assistance was available. The most charitable interpretation is that the facility’s leadership couldn’t recognize its own incompetence; less charitable interpretations are equally plausible.

    The OIG made four recommendations. The facility concurred with all of them. One recommendation has been closed based on documentation provided by the facility showing that design review procedures are now being tracked in the VA’s Support Service Center Capital Assets database. Recommendations 2, 3, and 4 remain open, pending evidence that the facility has actually implemented meaningful changes to how engineering staff are trained, how independent government cost estimates are developed, and how design reviews are documented and approved.

    Here’s what the OIG report demonstrates, in the accumulated weight of its findings: the VA possesses process frameworks, oversight structures, and technical guidance that should prevent exactly this kind of failure. The fact that none of these prevented failure isn’t an indictment of the systems themselves; it’s evidence of how thoroughly an institution can hollow out its own operational capacity. Training exists but isn’t taken. Technical assistance is offered but declined. Design standards are documented but not communicated. Contract requirements are supposed to be reviewed but are circulated via email and spreadsheet instead. The machinery of federal construction management is present. The people running it simply chose not to operate it.

    As of July 2025, the water storage facility project remained in limbo after three unsuccessful contract solicitations. The facility planned to resolicit the project in 2027, if funding was received in 2026. That’s the institutional pace at which the VA operates: catastrophic delay, followed by planning to attempt delay again, followed by a faint hope that future budget cycles might permit another try.

    The veterans served by this facility waited for facilities that should have been ready six years ago. They’re still waiting. The OIG report documents why, in exhausting bureaucratic detail. The question now is whether anyone at the Veterans Health Administration will actually read it. For broader context on VA institutional capacity, see The VA’s Staffing Crisis, As Reported by the VA, to Itself, on a Web Form — on how staffing shortage data is collected with no verification — and Cameras Rolling, Signs Missing, on a San Antonio psychiatric ward that waited six years for basic safety repairs.

    Fediverse reactions

  • The Slush Fund That Ate Washington: How the RFC Invented the Modern Government Bailout

    A Loan Bigger Than Every Small Business in America Combined

    In 1949, while roughly a third of the country was still climbing out of Depression era wreckage, a federal agency handed a single automaker forty four million dollars, more money than it lent to every small business in America combined that year and the year before it. The automaker was Kaiser Frazer. The agency was the Reconstruction Finance Corporation, an outfit created seventeen years earlier with the explicit mission of saving ordinary banks and ordinary people from ruin.

    By the time it was finally put down in 1957, the RFC had disbursed more than fifty one billion dollars, according to its own final report to Congress, an amount so large that at its peak the RFC was arguably the biggest financial institution on earth, bigger than any bank, answerable to almost no one, and staffed by an administrator who could move Treasury sized sums without asking Congress for permission first.

    This is the story of how a Depression rescue vehicle became Washington’s favorite way to spend money without admitting it was spending money, and why Congress eventually got scared enough of its own creation to shut it down.

    From Bank Rescue to New Deal Piggy Bank

    The RFC was born on January 22, 1932, the brainchild of Federal Reserve governor Eugene Meyer and pushed through Congress by a Hoover administration desperate to stop a wave of bank failures. It was explicitly modeled on the War Finance Corporation, the WWI era agency that had proven Washington could stand up a fast moving lender when normal appropriations were too slow.

    GAO’s own contemporaneous correspondence on the RFC treated it as an executive agency of the federal government, entitled to borrow equipment and support from other federal bodies under the Economy Act, which tells you how thoroughly it was woven into the ordinary machinery of government even while operating with corporate flexibility (GAO B-27842).

    Under Hoover, the RFC was cautious to the point of uselessness. Under Roosevelt, it became something else entirely. Jesse Jones, the Texas banker Roosevelt installed to run it, turned the RFC into what amounted to the financial engine of the New Deal, funding public works, agricultural relief, and eventually the entire wartime industrial buildup through eight specialized subsidiaries.

    Its unusual quasi independent status meant Roosevelt could route enormous sums into favored projects with a degree of insulation from ordinary congressional appropriation fights, a feature that made it indispensable to the White House and increasingly uncomfortable for everyone else.

    The uncomfortable part showed up on schedule. Analysis from the Heritage Foundation on the RFC’s later years found that more than three quarters of its funds went out as large business loans of a hundred thousand dollars or more, typically at four percent interest, a rate at which the borrowing firms could not have raised private capital on anything close to comparable terms, meaning the RFC was routinely making high risk loans without charging anything resembling a risk premium (Heritage Foundation).

    Starting in 1948, congressional investigations turned up something worse than bad underwriting. Investigators found the RFC had extended loans to speculative ventures backed by sitting senators and administration officials, apparently in exchange for promises of continued funding for the agency itself, a scandal serious enough that the Senate Banking Committee forced a full reorganization in 1952 (EBSCO Research Starters).

    The Act Written to Rein In Its Own Creation

    Here is where the RFC stops being a New Deal history footnote and starts being the missing chapter of the story we have already been telling in this series. The Government Corporation Control Act of 1945, the law that still governs every federal corporation operating today, was not written in a vacuum. It was written by a Congress that had watched an entity like the RFC balloon into a nearly unaccountable financial power center and decided every future government corporation needed mandatory budgets, GAO audits, and explicit borrowing limits before it, too, got away from them.

    The RFC did not go quietly, and it did not go for the reasons you might expect. It survived the 1945 reforms, survived its own corruption scandal, and kept operating until the Eisenhower administration, ideologically committed to shrinking the government’s footprint in private markets, pushed through the RFC Liquidation Act of 1953 and wound the whole thing down by 1957, according to Britannica’s institutional history of the agency (Britannica). The RFC was not killed by a market failure.

    It was killed by a political decision that a government-owned bank had simply gotten too big and too politically entangled to keep operating as one.

    But the RFC did not disappear so much as metastasize. Among its many subsidiaries was an entity created specifically to guarantee mortgages during the housing crisis of the 1930s: the Federal National Mortgage Association, now known to every homeowner in America as Fannie Mae.

    The RFC is not a cautionary tale from a bygone era. It is the direct ancestor of the government-sponsored enterprise model that required its own trillion dollar rescue in 2008–a model built on the same instinct that built the RFC…keep the government’s fingerprints on the credit while keeping the balance sheet off the government’s books, until the balance sheet stops cooperating.

    The Blueprint Outlived the Agency

    The pattern here is worth sitting with, because it is the pattern this entire series keeps circling back to. An agency gets built for speed during a crisis. It proves useful enough that nobody wants to give up the flexibility once the crisis passes. It grows past the size anyone originally intended, starts making decisions that look less like emergency triage and more like industrial policy dressed up as commercial lending, and eventually either implodes into scandal or gets quietly absorbed into something else. Its institutional DNA lives on in whatever replaces it.

    The RFC’s most lasting legacy is not the $51 billion it lent out. It is the template it left behind, wherein a government corporation, built to look market-oriented and self-funding, can become the single most effective way for Washington to intervene in the economy at scale while limiting the amount transparency.

    Congress tried to fix that with the 1945 Act. It is worth asking, three quarters of a century and one Fannie Mae bailout later, whether that fix ever really took.

    Next in the series: Born in Bailout, Raised in Denial: The Fannie and Freddie Story Washington Still Can’t Finish — Fannie Mae and Freddie Mac, the RFC’s most consequential children, and the government sponsored enterprise structure that let Washington keep pretending it wasn’t in the mortgage business until 2008 proved otherwise.

    Fediverse reactions

  • CBP’s 7-Year Security Blind Spot: What the Agency Won’t Explain About Its Undetected Vulnerability

    A powerful administrative account was created inside U.S. Customs and Border Protection‘s computer network in 2019. For seven years, that account allowed any of CBP’s 76,000 network users—including contractors, visiting personnel from other agencies, and potentially anyone with network access—to perform privileged administrative tasks. They could reset passwords. They could modify user permissions. They could change security configurations.

    CBP didn’t catch it. A federal audit did.

    On September 4, 2026, the Department of Homeland Security Office of Inspector General released an audit of CBP’s information technology access controls. Buried in the report is a finding so significant that it demands an explanation CBP has not provided: How did a critical vulnerability created in 2019 remain undetected for seven years, until an outside auditor discovered it during routine testing?

    This is one of three pieces covering the same OIG audit. The other two examine how hundreds of separated contractors and transferred employees kept active system access after leaving CBP, and a 2023 security directive that went unenforced for three years because no compliance mechanism was ever built.

    The OIG report provides only a partial answer, using the bureaucratic language of “monitoring gaps” and “lacking tools to detect unexpected configurations.” But that explanation raises more questions than it answers—and CBP has declined to provide clarification.

    The Vulnerability: Widespread Privileged Access

    Service accounts are special non-human accounts used by IT systems to perform automated functions. Unlike regular user accounts, service accounts typically have elevated privileges—they need to perform powerful tasks that regular users shouldn’t be able to do.

    In principle, service accounts are carefully controlled. Only authorized applications should be able to use them. Regular users should never have access to them.

    But in CBP’s case, all 76,000 network users had access to one highly privileged service account. 

    “We identified a major vulnerability that attackers could have used to compromise CBP’s network,” the OIG stated flatly.

    With this access, an attacker could:

    • Change account passwords across CBP’s network
    • Add or remove user access permissions
    • Modify security configurations
    • Cover their tracks by manipulating audit logs (potentially)

    The implications are staggering. Every one of CBP’s 76,000 network users—including contractors, visiting personnel from other DHS components, and outside consultants—could perform administrative functions that should be restricted to a handful of vetted security professionals.

    “If CBP does not safeguard privileged accounts, attackers could use elevated permissions to access sensitive resources and perform powerful tasks, such as changing passwords and security settings,” the OIG warned.

    Seven Years of Exposure

    The vulnerability was created in 2019. The audit fieldwork took place from October 2024 through December 2025. CBP remained unaware of the problem for approximately seven years.

    “CBP immediately fixed the issue once notified,” the OIG report states. But this formulation obscures a critical question: Why did it take seven years for CBP to discover something an auditor found during standard testing?

    The answer, according to CBP, is monitoring gaps.

    “According to CBP, its privileged account vulnerabilities occurred due to human error and challenges associated with monitoring account access changes over time, such as lacking tools to detect unexpected configurations,” the OIG noted.

    CBP also provided a timeline. “In recent years, CBP implemented new monitoring capabilities,” the report states. “However, according to CBP, these new controls were not as effective for older accounts.”

    This raises immediate questions:

    • When exactly were these new monitoring capabilities implemented? If “recent years” means 2023 or 2024, then CBP had at least one or two years between deploying new monitoring and the audit discovering this vulnerability. Why didn’t those new tools catch it?
    • What about 2019 through 2022? What was CBP’s monitoring posture during those years?
    • If CBP lacked tools to detect unexpected configurations in 2019-2022, how did the auditors detect this vulnerability? What did they use that CBP didn’t have?

    CBP has not answered these questions. Bureaucracy Times submitted follow-up questions to CBP’s public affairs office asking for specifics on monitoring capabilities, timeline of deployment, and the auditor’s detection methodology. The agency declined to provide additional information.

    The Audit Process That Found It

    The OIG didn’t discover this vulnerability through passive monitoring or review of CBP’s security logs. They found it through active testing.

    “We performed technical assessments and penetration testing of CBP’s domain,” the audit states. “We completed penetration testing and configuration, vulnerability, and Active Directory assessments of the CBP Directory Services platform to determine how CBP manages vulnerabilities and security settings.”

    In other words: The OIG actually tried to break into CBP’s system, and in doing so, found this vulnerability. This is standard practice for security audits, but it underscores the key point—this wasn’t a passive discovery. This was an active security assessment, and it immediately surfaced the problem.

    The Larger Context: Other Privilege Escalation Paths

    The service account vulnerability was the most egregious finding, but it wasn’t the only one.

    The OIG also identified “more than 100 paths that would have allowed some users to elevate their permissions to an administrator level without proper authorization.”

    Over 100. Separate. Attack. Paths.

    An attacker could take over a regular user account, use one of these 100+ paths to escalate their privileges to administrator level, and then move through CBP’s network performing additional attacks “without CBP’s awareness.”

    CBP users could:

    • Take over accounts of CBP teams monitoring insider threats
    • Take over user accounts with access to sensitive law enforcement information
    • Obtain CBP officer-level access to shared drives at ports of entry
    • Become administrators of mobile device management software

    Again, all this was possible because CBP had “all users…incorrectly granted permission to perform privileged account or sensitive functions, although CBP is required to limit privileged access to the minimum level necessary for mission needs.”

    The underlying problem is the same: CBP’s access architecture allows far too many people to perform far too many privileged actions.

    Why This Matters

    CBP is a high-value target for attackers. The agency manages biometric databases, law enforcement information, border security intelligence, and travel documents. In June 2025, CBP experienced a cybersecurity incident where hackers stole CBP employee data.

    A network architecture where 76,000 users have access to privileged administrative functions is an invitation for attackers.

    If an external hacker compromised any single CBP employee’s credentials—through phishing, credential theft, or a supply chain attack—they would immediately have access to powerful administrative capabilities. They could create backdoors, modify security settings, and cover their tracks.

    Or, if an insider threat actor wanted to abuse CBP’s systems, they wouldn’t need to steal credentials from a system administrator. They would already have the capabilities they needed.

    The fact that CBP maintained this configuration for seven years—through two presidential administrations, through multiple cybersecurity incidents at other federal agencies, through evolving hacking techniques and increased threat awareness—suggests either:

    1. CBP’s security culture doesn’t prioritize preventive security architecture
    2. CBP lacked the technical expertise to recognize this problem
    3. CBP’s monitoring and testing processes were inadequate
    4. Some combination of the above

    The OIG audit documents the problem. It does not explain how CBP allowed it to persist for seven years.

    CBP’s Timeline for Fixing It

    In response to the OIG audit, CBP provided corrective action plans. For the service account vulnerability and the 100+ privilege escalation paths, CBP’s response includes:

    1. Comprehensive audit of the EVERYONE Active Directory group (completed, per CBP)
    2. Removal of all identified excessive privileges (completed, per CBP)
    3. Implementation of monitoring controls to detect future changes to these permissions (in progress, per OIG analysis)
    4. Evaluation of the 100+ identified attack paths (in progress, per OIG analysis)

    CBP claims it had already remediated the specific service account vulnerability and performed a validation scan to confirm no similar misconfigurations existed. It provided evidence to the OIG on April 4, 2025, and additional evidence on July 22, 2026.

    However, the OIG analysis of CBP’s responses includes this language: “To meet the intent of the recommendation, we need documentation that demonstrates how these new alerts are monitored and the actions taken to respond to any alerts.”

    Translation: CBP says it implemented monitoring, but it hasn’t demonstrated that anyone is actually watching the monitors or acting on alerts. This is a critical distinction—a monitor that no one watches is just a log file.

    Similarly, regarding the 100+ attack paths: “CBP has only provided evidence demonstrating its analysis and remediation of the EVERYONE group attack paths. We need documentation showing all 100-plus attack paths were analyzed and any unnecessary accesses were adjusted.”

    Translation: CBP fixed the one big problem but hasn’t demonstrated it fixed all 100+ of them.

    What Remains Unexplained

    CBP’s public response to the audit consists of a standard agency concurrence memo. In that memo, CBP acknowledges “CBP has defined controls and processes to secure privileged accounts” and notes that the agency “implemented an access management system to periodically review and approve privileged and service account access permissions.”

    But if CBP had defined controls, defined processes, and an access management system, how did the service account remain misconfigured for seven years?

    CBP does not answer this question.

    The agency also does not explain:

    • Account creation and authorization: Who created this service account in 2019? Was there a change control process? Was it documented? If the account was created for a specific business need and then that need changed, who was responsible for decommissioning it?
    • Access logs: Did CBP maintain audit logs of who accessed this account and when? If so, was there any suspicious activity during the seven years? If not, why not?
    • Monitoring capabilities before 2023: What monitoring did CBP have in place from 2019-2022? Why was it ineffective? Were there budget constraints, staffing limitations, or technical limitations that prevented better monitoring?
    • The penetration testing question: If the auditors could find this vulnerability with penetration testing, why didn’t CBP’s own security teams perform penetration testing? Is CBP not conducting regular penetration tests of its infrastructure? How often?
    • Risk acceptance: Did CBP know about this vulnerability and accept the risk? Or was it simply unknown? If unknown, does CBP conduct any pro-active security assessments, or only reactive ones?

    These are legitimate accountability questions that the public and Congress should have answered.

    A Broader Pattern

    This vulnerability exists within a larger context of CBP access control failures documented in the same audit.

    CBP failed to disable accounts for separated personnel in a timely manner (20 percent of sampled employee accounts, 15 percent of contractor accounts).

    CBP failed to remove unneeded access for transferred employees (17 percent retained unnecessary access).

    CBP did not enroll all applications in its centralized access management system and had no process to enforce a 2023 modernization directive that required such enrollment.

    CBP was unaware of all applications running on its network.

    These failures—the service account vulnerability, the 100+ attack paths, the account disablement failures, the transferred employee access retention—are not isolated incidents. They suggest a systemic weakness in CBP’s ability to maintain secure access controls across its infrastructure.

    The OIG has documented the problems. CBP has agreed to fix them. But the fundamental question remains: Why did it take a federal audit to identify vulnerabilities that CBP should have found through its own security processes?

    That’s the story CBP won’t explain.

    References and Links

    – Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — OIG-26-28-Sep26.pdf — Released September 4, 2026 by the DHS Office of Inspector General

    – **OIG Report Section:** Key Finding 1: “CBP Did Not Consistently Secure Privileged Accounts and Sensitive Information” (pages 2-4 of report)

    – DHS OIG Homepage: www.oig.dhs.gov

    – Relevant DHS Policy (referenced in audit):

    • DHS 4300A: Information Technology System Security Program, Sensitive Systems (v. 13.4, December 2024)
    • NIST SP 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations

    – Related Incident:

      – June 2025 CBP Cybersecurity Incident: Mentioned in OIG report as context for threat environment. Full details of incident not available in public reporting.

    Editor’s Notes

    – CBP was asked for specific details about: (1) the service account’s creation, purpose, and authorization process; (2) audit logs covering the 2019-2025 period; (3) the timeline of monitoring capability deployment; (4) whether penetration testing was routinely conducted; and (5) whether this vulnerability was previously known but accepted as a risk. CBP declined to provide additional information beyond the written response to the OIG audit.

    – The OIG report explicitly notes about CBP’s account remediation: “An audit log review was conducted which confirmed that the misconfigured account was not subjected to unauthorized use.” This suggests that while the vulnerability existed, there is no evidence it was exploited during the seven-year period. However, the OIG did not disclose whether access logs existed for the entire 2019-2025 period or only for a more recent timeframe.

    – The terminology “EVERYONE Active Directory group” is technical jargon for a Windows domain group that, by default, includes all users on a network. In this case, it should not have included permission to perform the privileged actions that CBP had granted it.

    Fediverse reactions