Bureaucracy Times

All the news fit to be declassified.

  • CBP’s 7-Year Security Blind Spot: What the Agency Won’t Explain About Its Undetected Vulnerability

    A powerful administrative account was created inside U.S. Customs and Border Protection‘s computer network in 2019. For seven years, that account allowed any of CBP’s 76,000 network users—including contractors, visiting personnel from other agencies, and potentially anyone with network access—to perform privileged administrative tasks. They could reset passwords. They could modify user permissions. They could change security configurations.

    CBP didn’t catch it. A federal audit did.

    On September 4, 2026, the Department of Homeland Security Office of Inspector General released an audit of CBP’s information technology access controls. Buried in the report is a finding so significant that it demands an explanation CBP has not provided: How did a critical vulnerability created in 2019 remain undetected for seven years, until an outside auditor discovered it during routine testing?

    This is one of three pieces covering the same OIG audit. The other two examine how hundreds of separated contractors and transferred employees kept active system access after leaving CBP, and a 2023 security directive that went unenforced for three years because no compliance mechanism was ever built.

    The OIG report provides only a partial answer, using the bureaucratic language of “monitoring gaps” and “lacking tools to detect unexpected configurations.” But that explanation raises more questions than it answers—and CBP has declined to provide clarification.

    The Vulnerability: Widespread Privileged Access

    Service accounts are special non-human accounts used by IT systems to perform automated functions. Unlike regular user accounts, service accounts typically have elevated privileges—they need to perform powerful tasks that regular users shouldn’t be able to do.

    In principle, service accounts are carefully controlled. Only authorized applications should be able to use them. Regular users should never have access to them.

    But in CBP’s case, all 76,000 network users had access to one highly privileged service account. 

    “We identified a major vulnerability that attackers could have used to compromise CBP’s network,” the OIG stated flatly.

    With this access, an attacker could:

    • Change account passwords across CBP’s network
    • Add or remove user access permissions
    • Modify security configurations
    • Cover their tracks by manipulating audit logs (potentially)

    The implications are staggering. Every one of CBP’s 76,000 network users—including contractors, visiting personnel from other DHS components, and outside consultants—could perform administrative functions that should be restricted to a handful of vetted security professionals.

    “If CBP does not safeguard privileged accounts, attackers could use elevated permissions to access sensitive resources and perform powerful tasks, such as changing passwords and security settings,” the OIG warned.

    Seven Years of Exposure

    The vulnerability was created in 2019. The audit fieldwork took place from October 2024 through December 2025. CBP remained unaware of the problem for approximately seven years.

    “CBP immediately fixed the issue once notified,” the OIG report states. But this formulation obscures a critical question: Why did it take seven years for CBP to discover something an auditor found during standard testing?

    The answer, according to CBP, is monitoring gaps.

    “According to CBP, its privileged account vulnerabilities occurred due to human error and challenges associated with monitoring account access changes over time, such as lacking tools to detect unexpected configurations,” the OIG noted.

    CBP also provided a timeline. “In recent years, CBP implemented new monitoring capabilities,” the report states. “However, according to CBP, these new controls were not as effective for older accounts.”

    This raises immediate questions:

    • When exactly were these new monitoring capabilities implemented? If “recent years” means 2023 or 2024, then CBP had at least one or two years between deploying new monitoring and the audit discovering this vulnerability. Why didn’t those new tools catch it?
    • What about 2019 through 2022? What was CBP’s monitoring posture during those years?
    • If CBP lacked tools to detect unexpected configurations in 2019-2022, how did the auditors detect this vulnerability? What did they use that CBP didn’t have?

    CBP has not answered these questions. Bureaucracy Times submitted follow-up questions to CBP’s public affairs office asking for specifics on monitoring capabilities, timeline of deployment, and the auditor’s detection methodology. The agency declined to provide additional information.

    The Audit Process That Found It

    The OIG didn’t discover this vulnerability through passive monitoring or review of CBP’s security logs. They found it through active testing.

    “We performed technical assessments and penetration testing of CBP’s domain,” the audit states. “We completed penetration testing and configuration, vulnerability, and Active Directory assessments of the CBP Directory Services platform to determine how CBP manages vulnerabilities and security settings.”

    In other words: The OIG actually tried to break into CBP’s system, and in doing so, found this vulnerability. This is standard practice for security audits, but it underscores the key point—this wasn’t a passive discovery. This was an active security assessment, and it immediately surfaced the problem.

    The Larger Context: Other Privilege Escalation Paths

    The service account vulnerability was the most egregious finding, but it wasn’t the only one.

    The OIG also identified “more than 100 paths that would have allowed some users to elevate their permissions to an administrator level without proper authorization.”

    Over 100. Separate. Attack. Paths.

    An attacker could take over a regular user account, use one of these 100+ paths to escalate their privileges to administrator level, and then move through CBP’s network performing additional attacks “without CBP’s awareness.”

    CBP users could:

    • Take over accounts of CBP teams monitoring insider threats
    • Take over user accounts with access to sensitive law enforcement information
    • Obtain CBP officer-level access to shared drives at ports of entry
    • Become administrators of mobile device management software

    Again, all this was possible because CBP had “all users…incorrectly granted permission to perform privileged account or sensitive functions, although CBP is required to limit privileged access to the minimum level necessary for mission needs.”

    The underlying problem is the same: CBP’s access architecture allows far too many people to perform far too many privileged actions.

    Why This Matters

    CBP is a high-value target for attackers. The agency manages biometric databases, law enforcement information, border security intelligence, and travel documents. In June 2025, CBP experienced a cybersecurity incident where hackers stole CBP employee data.

    A network architecture where 76,000 users have access to privileged administrative functions is an invitation for attackers.

    If an external hacker compromised any single CBP employee’s credentials—through phishing, credential theft, or a supply chain attack—they would immediately have access to powerful administrative capabilities. They could create backdoors, modify security settings, and cover their tracks.

    Or, if an insider threat actor wanted to abuse CBP’s systems, they wouldn’t need to steal credentials from a system administrator. They would already have the capabilities they needed.

    The fact that CBP maintained this configuration for seven years—through two presidential administrations, through multiple cybersecurity incidents at other federal agencies, through evolving hacking techniques and increased threat awareness—suggests either:

    1. CBP’s security culture doesn’t prioritize preventive security architecture
    2. CBP lacked the technical expertise to recognize this problem
    3. CBP’s monitoring and testing processes were inadequate
    4. Some combination of the above

    The OIG audit documents the problem. It does not explain how CBP allowed it to persist for seven years.

    CBP’s Timeline for Fixing It

    In response to the OIG audit, CBP provided corrective action plans. For the service account vulnerability and the 100+ privilege escalation paths, CBP’s response includes:

    1. Comprehensive audit of the EVERYONE Active Directory group (completed, per CBP)
    2. Removal of all identified excessive privileges (completed, per CBP)
    3. Implementation of monitoring controls to detect future changes to these permissions (in progress, per OIG analysis)
    4. Evaluation of the 100+ identified attack paths (in progress, per OIG analysis)

    CBP claims it had already remediated the specific service account vulnerability and performed a validation scan to confirm no similar misconfigurations existed. It provided evidence to the OIG on April 4, 2025, and additional evidence on July 22, 2026.

    However, the OIG analysis of CBP’s responses includes this language: “To meet the intent of the recommendation, we need documentation that demonstrates how these new alerts are monitored and the actions taken to respond to any alerts.”

    Translation: CBP says it implemented monitoring, but it hasn’t demonstrated that anyone is actually watching the monitors or acting on alerts. This is a critical distinction—a monitor that no one watches is just a log file.

    Similarly, regarding the 100+ attack paths: “CBP has only provided evidence demonstrating its analysis and remediation of the EVERYONE group attack paths. We need documentation showing all 100-plus attack paths were analyzed and any unnecessary accesses were adjusted.”

    Translation: CBP fixed the one big problem but hasn’t demonstrated it fixed all 100+ of them.

    What Remains Unexplained

    CBP’s public response to the audit consists of a standard agency concurrence memo. In that memo, CBP acknowledges “CBP has defined controls and processes to secure privileged accounts” and notes that the agency “implemented an access management system to periodically review and approve privileged and service account access permissions.”

    But if CBP had defined controls, defined processes, and an access management system, how did the service account remain misconfigured for seven years?

    CBP does not answer this question.

    The agency also does not explain:

    • Account creation and authorization: Who created this service account in 2019? Was there a change control process? Was it documented? If the account was created for a specific business need and then that need changed, who was responsible for decommissioning it?
    • Access logs: Did CBP maintain audit logs of who accessed this account and when? If so, was there any suspicious activity during the seven years? If not, why not?
    • Monitoring capabilities before 2023: What monitoring did CBP have in place from 2019-2022? Why was it ineffective? Were there budget constraints, staffing limitations, or technical limitations that prevented better monitoring?
    • The penetration testing question: If the auditors could find this vulnerability with penetration testing, why didn’t CBP’s own security teams perform penetration testing? Is CBP not conducting regular penetration tests of its infrastructure? How often?
    • Risk acceptance: Did CBP know about this vulnerability and accept the risk? Or was it simply unknown? If unknown, does CBP conduct any pro-active security assessments, or only reactive ones?

    These are legitimate accountability questions that the public and Congress should have answered.

    A Broader Pattern

    This vulnerability exists within a larger context of CBP access control failures documented in the same audit.

    CBP failed to disable accounts for separated personnel in a timely manner (20 percent of sampled employee accounts, 15 percent of contractor accounts).

    CBP failed to remove unneeded access for transferred employees (17 percent retained unnecessary access).

    CBP did not enroll all applications in its centralized access management system and had no process to enforce a 2023 modernization directive that required such enrollment.

    CBP was unaware of all applications running on its network.

    These failures—the service account vulnerability, the 100+ attack paths, the account disablement failures, the transferred employee access retention—are not isolated incidents. They suggest a systemic weakness in CBP’s ability to maintain secure access controls across its infrastructure.

    The OIG has documented the problems. CBP has agreed to fix them. But the fundamental question remains: Why did it take a federal audit to identify vulnerabilities that CBP should have found through its own security processes?

    That’s the story CBP won’t explain.

    References and Links

    – Full OIG Report (OIG-26-28): CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information — OIG-26-28-Sep26.pdf — Released September 4, 2026 by the DHS Office of Inspector General

    – **OIG Report Section:** Key Finding 1: “CBP Did Not Consistently Secure Privileged Accounts and Sensitive Information” (pages 2-4 of report)

    – DHS OIG Homepage: www.oig.dhs.gov

    – Relevant DHS Policy (referenced in audit):

    • DHS 4300A: Information Technology System Security Program, Sensitive Systems (v. 13.4, December 2024)
    • NIST SP 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations

    – Related Incident:

      – June 2025 CBP Cybersecurity Incident: Mentioned in OIG report as context for threat environment. Full details of incident not available in public reporting.

    Editor’s Notes

    – CBP was asked for specific details about: (1) the service account’s creation, purpose, and authorization process; (2) audit logs covering the 2019-2025 period; (3) the timeline of monitoring capability deployment; (4) whether penetration testing was routinely conducted; and (5) whether this vulnerability was previously known but accepted as a risk. CBP declined to provide additional information beyond the written response to the OIG audit.

    – The OIG report explicitly notes about CBP’s account remediation: “An audit log review was conducted which confirmed that the misconfigured account was not subjected to unauthorized use.” This suggests that while the vulnerability existed, there is no evidence it was exploited during the seven-year period. However, the OIG did not disclose whether access logs existed for the entire 2019-2025 period or only for a more recent timeframe.

    – The terminology “EVERYONE Active Directory group” is technical jargon for a Windows domain group that, by default, includes all users on a network. In this case, it should not have included permission to perform the privileged actions that CBP had granted it.

    Fediverse reactions

  • So I Started Opening Websites: What the Federal Government Looked Like 25 Years After 9/11

    Most days, I approach the federal government with professional skepticism. It is, after all, more or less the business model around here.

    But September 11 occupies a different place. Personally.

    Twenty-five years after the attacks, I found myself wondering not whether Americans remember, and not whether federal employees care, but what our government looks like when it remembers.

    So I started opening websites.

    Not reports. Not press releases buried in archives. Not commemorative statements I could find by searching for the right words. I started with the front doors: the homepages the federal government was showing the world on the morning of September 11, 2026.

    This was not an attempt to grade agencies on patriotism, and it was never intended to become a list of bureaucratic winners and losers. A missing banner tells us almost nothing about the people working inside an agency. There are hard-working public servants, law-enforcement officers, veterans and others throughout these institutions for whom September 11 is considerably more personal than a communications decision on a website.

    Instead, I wanted to try something less conventional. I wanted to use the visible federal web as a kind of cultural instrument. Twenty-five years later, what place does September 11 occupy in the visible institutional consciousness of the federal government?

    Looking Through the Front Door

    Beginning early on September 11, I examined a broad cross-section of public-facing federal homepages. These website checks included agencies and institutions ranging from DHS and TSA to the State Department, Secret Service, CISA and Capitol Police.

    I looked at cabinet departments, military services, national-security and law-enforcement organizations, cultural institutions and other public-facing parts of the federal establishment. I recorded whether September 11 material was immediately prominent, present elsewhere on the homepage, incidental or not observed. I also paid attention to what the page emphasized instead.

    Then, at noon, I did it again.

    The second snapshot mattered because websites move. A communications shop may update a homepage after a morning ceremony. A carousel may rotate. A story can rise from the middle of a page to the top. So rather than pretend a 7 a.m. observation represented the entire day, I allowed one second look. At noon, the census closed.

    The methodology is admittedly imperfect. A homepage is not an agency. A communications office is not its workforce. A banner is not grief, and the absence of one is not indifference. This exercise measured visibility, not patriotism.

    But federal homepages are also finite public spaces. Institutions decide what occupies them. Taken individually, those decisions may mean very little. Viewed together, they offer a snapshot of institutional attention.

    What Was Visible

    The federal landscape on the morning of the 25th anniversary of 9/11 was not uniform.

    Some institutions placed September 11 unmistakably at the front door. The Department of Defense (now branded the Department of War) carried multiple remembrance features, including material marking 25 years since the attacks and content connected to the Pentagon Memorial.

    The National Guard led with a September 11 remembrance and featured Guard members recalling their experiences. The Air Force and Space Force displayed (almost identical) commemorative material in their homepage feature areas. The Department of Justice prominently presented a video from its 25th-anniversary memorial.

    Other acknowledgments required a little more looking. On the Army homepage during the morning check, September 11 material appeared farther down the page rather than dominating the opening view. By noon, that had changed, where a 25th-anniversary Army Museum story had moved into the first position under Top Stories, while a separate Patriot Day “Never Forget” feature was also present.

    Capitol Police offered another variation. Its September 11 item was there, but farther down in a social-media highlight rather than occupying the principal visual space.

    And then there were many homepages where no identifiable September 11 acknowledgment was visible during our observation. Among the pages we examined were the White House, FBI, ATF, Department of Veterans Affairs, National Archives, Library of Congress, U.S. Courts, Architect of the Capitol and several others.

    Manual inspection of some otherwise difficult-to-check sites likewise found no visible 9/11 material at the time of the snapshot, even after examining carousels or scrolling farther down the page.

    The noon pass did not produce a sweeping change. The Army’s elevation of its anniversary material was notable precisely because most of the landscape remained relatively stable. That gave us some confidence that the morning picture was not merely the consequence of arriving before federal web teams had finished their coffee.

    Silence on a Homepage Is Not Forgetting

    This is where the experiment became more interesting, and where a simple tally would have become misleading.

    The White House, for example, did not prominently display September 11 material on the homepage we observed, but it had published commemorative material earlier in the week.

    The Coast Guard’s principal homepage was overwhelmingly mission- and operations-oriented, yet Coast Guard editorial channels carried substantial 9/11 coverage and retrospectives.

    The Department of Veterans Affairs likewise had commemorative activity elsewhere even though its main homepage remained focused largely on benefits and services.

    Those examples matter.

    If the question were simply, “Did this agency remember September 11?” then searching the homepage would be a remarkably poor test. Federal institutions held ceremonies, published histories, posted on social media, remembered fallen colleagues and marked the anniversary in ways a homepage census cannot measure.

    But that was not quite the question.

    I was interested in prominence. That is, what did the federal government choose to put in front of a visitor arriving at its digital front doors on this particular morning?

    What Was in the Window Instead?

    Once I began looking at the project that way, absence became less interesting by itself. What occupied the space instead became equally important.

    Across the sites examined were current administration priorities, enforcement statistics, recruiting messages, agency services, operational news, leadership announcements and the ordinary business of government. America’s 250th celebration and related 250th-anniversary messaging also appeared repeatedly across the federal landscape.

    There is no scandal in any of that. Government still has to govern on September 11. Veterans still need benefits. Travelers still need information. Law-enforcement agencies still have cases. The country does not stop operating because the calendar reaches an anniversary.

    But homepages have finite attention. Every homepage is an exercise in selection.

    That made the recurring juxtaposition of America at 250 and September 11 at 25 particularly striking. One commemorates the continuity of the American experiment. The other remembers a morning when that experiment was attacked, and when, for a time, Americans responded with an extraordinary sense that whatever else divided us, we belonged to the same country.
    I remember a rapid and relatively moving rendition of “God Bless America” sung on the steps of Capitol Hill. Sure, it was presented by a large number of congressional leaders, for many of whom singing was not why they were elected. But is as tangible as the American flag being visible in every direction for months after the attack.

    It made me wonder, in today’s Washington, would we see the same thing? Or would politics trump our ability to unite in such a way?

    Twenty-Five Years Is a Long Time

    Perhaps that is the part of this exercise I found hardest to quantify.

    For those of us who remember September 11, twenty-five years can feel impossibly short. The images have not acquired the sepia tone of distant history. There are sounds, places and moments from that day that remain stubbornly contemporary.

    Institutionally, however, twenty-five years is enormous.

    Administrations have come and gone. Wars began and ended. Agencies were created and reorganized. People joined the federal workforce, served entire careers and retired. Young Americans born after the attacks are now old enough to serve inside institutions whose modern missions were shaped by an event they cannot personally remember.

    That may be the deeper question underneath this odd little experiment:

    What happens when lived memory becomes institutional memory?

    Every generation eventually confronts that transition. Pearl Harbor moved from living experience to inherited history. World wars passed from veterans’ memories into museums, textbooks and national ceremonies. September 11 is undergoing the same process in real time.

    Perhaps institutional memory does not simply disappear. Perhaps it changes location. It moves from the homepage to the archive, from the employee who was there to the employee who has heard the story, from an immediate national wound to an annual ceremony, from lived experience to history.

    A Litmus Test That Cannot Give a Laboratory Result

    I don’t want to pretend this exercise can tell us more than it can.

    There is no scientifically defensible percentage at which a nation has “remembered enough.” There is no proper number of homepage banners. And I would be suspicious of anyone claiming that a website carousel can measure the patriotism of the people behind it.

    Our census measured something narrower. It measured what a broad collection of federal institutions chose to show the public through their principal digital entrances during two snapshots on the morning of the 25th anniversary of September 11th.

    Some remembered loudly. Some remembered elsewhere. Some offered only a small acknowledgment. Some showed nothing we could identify on the homepage at all.

    Together, those choices produced something that no individual agency page could—a portrait.

    The Art of Noticing

    Bureaucracy Times spends most days examining what government gets wrong. Audits, procurement failures, unanswered FOIA requests, regulatory peculiarities and administrative absurdities provide no shortage of material. Rolling one’s eyes at the federal government is occasionally less an editorial position than an occupational requirement.

    But skepticism toward government and love of country are not contradictory ideas.

    I came to this exercise from two perspectives that do not always appear on these pages at the same time. I came as a citizen practicing the art of noticing, and as a retired soldier enduring the art of remembering.

    September 11 was not simply a day on which the United States was attacked. It was also one of those rare moments when the abstraction called “the United States” suddenly became tangible. For a brief period, the nation felt like a nation. The whole of government mobilized. Americans who disagreed about almost everything discovered something larger they still held in common.

    Twenty-five years later, the federal government still remembers.

    But it does not remember uniformly, and it does not always remember out loud.

    Maybe institutions aren’t so different from people in that respect.

    Memory changes before it disappears, but I will not forget.

  • AI-Assisted Scripts Are Probing U.S. Industrial Control Systems. Federal Agencies Issued an Advisory Three Weeks Ago.

    On August 19, 2026, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the FBI, the Department of Energy, and the Environmental Protection Agency jointly published Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs. The Federal Transit Administration flagged it to transportation stakeholders this week. The underlying threat predates the advisory by long enough that the advisory itself uses the phrase “active threat” in the title.

    Here is what the agencies found, and what it means.

    What a PLC Is and Why It Matters

    Programmable logic controllers are the hardware layer of critical infrastructure; that is, the physical devices that open valves, control motors, regulate pressure, and manage electrical loads in water treatment plants, power grids, transit systems, and manufacturing facilities. Siemens S7 series PLCs are among the most widely deployed in the world. They communicate over a protocol called S7comm on TCP port 102, and they are often directly internet-accessible, either by design or by administrative oversight.

    The S7 series has been a documented target before. Iranian-affiliated actors were documented exploiting internet-exposed PLCs across U.S. critical infrastructure as recently as April 2026, per a separate advisory (AA26-097A). The August advisory describes a distinct and ongoing campaign, but it lands in that context.

    The Threat: AI-Generated Scripts Disguised as Monitoring Tools

    The joint advisory describes threat actors conducting reconnaissance and capability development against internet-exposed Siemens S7 PLCs using AI-generated Python scripts, specifically tooling built on the python-snap7 and snap7 libraries, which are legitimate open-source tools for interfacing with S7 devices. The scripts are being disguised as standard OT monitoring software, making them harder to distinguish from normal network traffic without behavioral analysis.

    The attack workflow documented in the advisory has three stages. First, actors use internet scanning services (Censys and ZoomEye are specifically named) to identify internet-exposed S7 PLCs. Second, AI-assisted scripting tools enumerate the devices: reading PLC memory, accessing configuration data, and interacting with ladder logic. Third, actors conduct capability development, or building out exploitation capacity against identified targets, whether or not a destructive action has yet been taken.

    The advisory notes no confirmed destructive incidents tied to this specific campaign. It does not claim access logs exist for the full period of the observed activity. What the agencies are documenting is pre-operational: actors learning the terrain, building the tools, and positioning for an operation that may not yet have happened.

    The advisory explicitly warns that the risk is not confined to Siemens equipment. Any internet-exposed OT device running on S7comm or similar industrial protocols is part of the attack surface. Transit agencies, utilities, water systems, and manufacturing operators are all named as relevant sectors.

    The Gold Eagle Clearinghouse: A Platform Built for This Moment

    Two weeks before the PLC advisory, on July 14, 2026, the White House announced the launch of Gold Eagle, a joint CISA and Department of the Treasury initiative operating under Executive Order 14409, signed June 2, 2026, Promoting Advanced Artificial Intelligence Innovation and Security.

    Gold Eagle is a software capability layered on top of CISA’s existing Vulnerability Information and Coordinated Environment (VINCE) platform. The problem it addresses is structural: AI tools are dramatically accelerating the pace at which vulnerabilities are discovered and weaponized, and existing coordination infrastructure wasn’t built for that volume. Gold Eagle is designed to let organizations report, validate, and track AI-related vulnerabilities at scale — deduplicate submissions, route reports to the right vendors, and give CISA the throughput to actually process what comes in.

    The FTA’s advisory to transportation stakeholders notes that industry partners can reach CISA directly at clearinghouse@cisa.dhs.gov to participate.

    The timing is notable. Gold Eagle launches in mid-July. Three weeks later, a five-agency joint advisory goes out warning that AI-generated scripts are actively probing industrial control systems. The government is simultaneously acknowledging that AI has lowered the barrier to sophisticated OT attacks and standing up infrastructure to handle what that means for vulnerability coordination going forward.

    Three New ICS Advisories

    Alongside the FTA bulletin, CISA released three new Industrial Control Systems advisories covering current vulnerabilities:

    • ICSA-26-230-01: CISA Malcolm. Six vulnerabilities in CISA’s own Malcolm network traffic analysis platform, an open-source OT monitoring tool, including critical upload and remote code execution flaws and access-control bypasses. Malcolm is widely used by organizations securing OT environments, which makes its own vulnerability surface a pointed irony.
    • ICSA-26-230-02: Siemens Simcenter Nastran. Vulnerabilities in Siemens’ engineering simulation software.
    • ICSA-26-232-01: Johnson Controls Simplex Incident Manager. CVE-2026-27875, a cleartext credential storage flaw in Johnson Controls’ Simplex Incident Manager, a life-safety and incident management platform used in facilities management. Credentials stored in cleartext means that anyone with access to the file system or a memory dump can read them without any decryption step.

    What Transit and OT Operators Should Do

    The FTA’s guidance to transportation stakeholders, distilled:

    • Audit all internet-exposed PLCs and OT devices, not just Siemens equipment.
    • Review the joint advisory AA26-231A and apply recommended mitigations, including blocking TCP/102 from untrusted networks and restricting S7comm access to engineering workstations.
    • Patch or mitigate the three ICS advisories above if affected software is in your environment.
    • Review CISA Malcolm configurations if Malcolm is part of your OT monitoring stack.
    • Direct stakeholder questions to Dot-Sector-Cyber@dot.gov.

    The advisory is available on the CISA website. The Gold Eagle Clearinghouse is operational.

    Fediverse reactions

  • The Government Breached Its Nuclear Promise. A Federal Court Just Said It Can’t Bill Ratepayers for the Delay.

    For more than 40 years, the Department of Energy has failed to collect spent nuclear fuel it legally agreed to remove. The latest court ruling closes off its most creative escape route yet.

    In 1982, Congress struck a deal with the nuclear power industry: utilities would pay into a federal waste fund, and the Department of Energy would permanently dispose of their spent nuclear fuel. The deadline was January 31, 1998.

    That deadline passed 28 years ago. DOE has not removed a single rod of spent fuel from any power plant. There is still no approved permanent repository. Yucca Mountain, the designated site, remains mired in a political stalemate with no resolution in sight.

    On September 4, 2026, the U.S. Court of Appeals for the Federal Circuit handed down its fifth ruling in this long-running series of cases, affirming a $145 million judgment against the United States in favor of three decommissioned New England nuclear utilities: Connecticut Yankee Atomic Power Company, Maine Yankee Atomic Power Company, and Yankee Atomic Electric Company, collectively known as “the Yankees.”

    The government did not dispute that it had breached its contract. It argued instead that it shouldn’t have to pay.

    The Arithmetic of an Ongoing Breach

    The Yankees stopped generating electricity in 1996 and completed decommissioning their plants by 2007. They continue to exist for one reason: the federal government has not collected the spent nuclear fuel sitting at their sites, stored in steel casks on concrete pads known as Independent Spent Fuel Storage Installations, or ISFSIs.

    Maintaining those ISFSIs costs money. Security, radiation monitoring, regulatory compliance, licensing. During the 2017 to 2021 claim period at the center of this appeal, those costs totaled $145 million. Because DOE has insisted it still intends to eventually perform under the contract, courts have treated the breach as “partial” and ongoing. That status prevents the Yankees from seeking a final, comprehensive damages award; instead, the litigation proceeds in five-year installments. This appeal was the fifth round.

    Four prior rounds produced nearly $500 million in judgments. Approximately $396 million of that has been returned to ratepayers.

    The Government’s Argument: Your Investment Gains Are Our Defense

    Federal regulations require nuclear utilities to maintain Nuclear Decommissioning Trusts (NDTs), segregated funds built from ratepayer contributions, to cover decommissioning and ongoing SNF storage costs. The Yankees’ NDTs have received $405 million in ratepayer contributions since their establishment in the early 1980s and have generated $339 million in investment earnings since 2009 alone.

    During the 2017 to 2021 claim period, the NDTs earned nearly $185 million in investment gains, more than enough to cover the $145 million in ISFSI expenses.

    The government’s argument was straightforward, if audacious: the Yankees used NDT funds to pay their breach-related costs, and those funds earned $185 million in that same period. Award them $145 million in damages on top of that, the government said, and you’re giving them a windfall. The NDT investment gains should offset the damages to zero.

    The Court of Federal Claims rejected that argument in February 2024. The Federal Circuit, in an opinion authored by Judge Stark and joined by Judges Lourie and Prost, agreed.

    Why the Argument Failed

    The Federal Circuit identified two independent reasons the government’s offset theory doesn’t hold up.

    The gains didn’t mitigate anything. Mitigation, in contract law, means taking actions that actually reduce or avoid a loss. The Yankees’ ISFSI expenses did not go down because the NDTs had a good investment year. The costs mounted regardless. The government couldn’t identify a single expense that decreased as a result of the NDT gains. A funding source that pays for costs without reducing them is a checkbook, not mitigation.

    The court drew a sharp contrast with prior SNF cases where offsets were appropriate: utilities that upgraded to higher-enrichment fuel assemblies and saved money per cycle; utilities that reduced wet storage fees; utilities that pursued off-site storage arrangements. In each of those cases, the non-breaching party took action that actually reduced the damage caused by the breach. The Yankees’ NDT investment returns did neither.

    The gains aren’t connected to the breach. The mitigation offset rule requires a direct relationship, in time and subject matter, between the breach and the event the government wants to use as an offset. The NDTs were established in 1984, more than a decade before DOE’s breach began in 1998. They were created because federal law required them, not as a response to anything DOE did or failed to do. The court rejected the government’s argument that the relevant moment is the claim period rather than when the trusts were created, finding no legal authority supporting that reframing.

    The investment gains, the court wrote, are a “remote consequence” of the breach. A favorable one, but not one that reduces the government’s liability.

    The Windfall That Isn’t

    The government’s windfall argument had intuitive appeal: if the Yankees have $185 million sitting in their trust accounts and only owe $145 million in expenses, why should taxpayers also cut them a $145 million check?

    The court’s answer was precise: because the money in those trusts doesn’t belong to the Yankees. The NDTs are held in trust for ratepayers. Federal regulation requires that when DOE finally performs under the Standard Contract and the Yankees’ SNF storage obligations end, the NDT funds, including investment gains, must be returned to the ratepayers who contributed them. When the Yankees draw on NDTs to cover breach-related costs, they are borrowing against a fund that belongs to someone else. The damages award reimburses that fund.

    Reducing the damages award to zero, as the government asked, would leave ratepayers $145 million short. That is not preventing a windfall. That is engineering one, for the government.

    The Symmetry Problem

    The court added a final reason rooted in logical consistency.

    If NDT investment gains offset damages, NDT investment losses must increase them. That is not a novel legal principle; it is arithmetic. The same activity cannot be mitigation only when it is profitable. At oral argument, the government strongly implied it would never accept liability for NDT losses during partial breach periods. The court held that position disqualifies the government from claiming credit for the gains.

    “The NDTs and their investments are either mitigation activities or they are not,” the court wrote, citing prior Federal Circuit precedent. The government chose to disclaim responsibility for the downside. It cannot benefit from the upside.

    Where Things Stand

    The $145 million judgment stands. The Yankees, which exist solely to store nuclear waste the federal government contracted to remove a quarter-century ago, will receive that amount, which flows back to the ratepayers who funded the trust in the first place.

    DOE has no timeline for SNF removal. Yucca Mountain has no funding, no NRC license, and no political pathway. The courts have now awarded nearly $650 million in damages across five rounds of litigation, with more claim periods accumulating and more rounds ahead.

    The Standard Contract was supposed to solve the national problem of permanent nuclear waste disposal. Instead, it has become a perpetual litigation machine. The government loses, pays, and then tries to find new ways not to pay in the next round.

    This was the fifth round. It will not be the last.

    Connecticut Yankee Atomic Power Company, et al. v. United States, No. 25-1395 (Fed. Cir. Sept. 4, 2026). Panel: Lourie, Prost, and Stark, Circuit Judges. Opinion by Judge Stark.

    Fediverse reactions

  • The Pantry That Held a Federal Problem

    When federal investigators cracked open a humble kitchen cabinet in Kellyville, Oklahoma, they found exactly what the OIG’s proprietary data analytics had promised: a smorgasbord of narcotics meticulously arranged in false-bottom containers, each one designed to look like everyday household staples to the untrained eye.

    The powdered lemonade wasn’t lemonade. The sports drinks were a lie. Underneath, concealed in ingenious compartments, sat cocaine, MDMA, psilocybin mushrooms, and a colorful collection of counterfeit pharmaceuticals, including fraudulent Xanax, oxycodone, hydrocodone, and Percocet. It was, in its own way, a masterclass in domestic deception, right down to the organizational principle: everything in its place, everything legible to law enforcement, nothing what it appeared to be.

    This July, the suspect who organized this pharmaceutical pantry received a sentence of more than 17 years in federal prison. By then, the investigation that led to his conviction had already demonstrated something the Postal Inspection Service, the DEA, and the USPS Office of Inspector General would prefer remained institutional knowledge: the American postal system, for all its constitutional blessing and century-long tradition, remains a surprisingly efficient conduit for moving drugs across state lines, provided you know how to use it and how to hide what you’re moving.

    When Algorithms Light Up Like Christmas Trees

    The investigation began not with heroic detective work, but with the DEA Tulsa Office tracking a man suspected of participating in a nationwide fentanyl trafficking operation. The OIG special agents received the call in May 2025. They had an address. They had suspicion. They needed confirmation.

    What they got instead was overwhelming algorithmic vindication. The USPS Office of Inspector General maintains what it calls a proprietary analytical tool, developed by its Data Analytics team, designed to flag addresses receiving suspicious parcels. When OIG personnel ran this particular address through the system, according to the agency’s own account, “that address lit up like a Christmas tree.”

    The metaphor is instructive. Christmas trees are festive, innocent, beloved; the address, apparently, was not. What the analytics actually revealed was this: in just two months, the location had received numerous packages from Oklahoma, California, and Mississippi. The common thread was chemical, not emotional.

    The DEA and OIG coordinated. A search warrant was obtained. On the day agents intercepted one outbound package headed for the suspect, a K9 deputy with the Tulsa County Sheriff’s Office performed the olfactory confirmation. Inside was a vacuum-sealed bag containing nearly a pound of pills that tested positive for methamphetamine.

    That was merely the opening act.

    Compartmentalization as a Lifestyle

    When Postal Inspection Service agents arrived at the property to execute a search warrant, they found a residential space that appeared, on initial inspection, entirely unremarkable. The kitchen was organized. The pantry was stocked. Everything suggested the domestic routine of someone who believed in order, in structure, in the virtues of proper food storage.

    But the Postal Inspection Service and OIG special agents were not looking for actual provisions. They were hunting for what the OIG later characterized, without apparent irony, as “a smorgasbord of illicit drugs.” What they discovered was a methodological approach to compartmentalization that would have pleased any organizational consultant. A place where false-bottom containers that maintained the appearance of legitimacy on top while concealing controlled substances beneath. It was, in effect, an entire kitchen devoted to the principle of misdirection.

    The haul was substantial. Cocaine. MDMA, more commonly known as ecstasy or Molly. Psilocybin mushrooms, still classified as a Schedule I controlled substance, despite a growing scientific literature suggesting therapeutic applications. Counterfeit pharmaceuticals, each one a secondary fraud layered atop the primary narcotic crime. It’s not merely the distribution of oxycodone, but the distribution of counterfeit oxycodone, meaning consumers never even knew what they were ingesting. Counterfeit Xanax. Counterfeit Percocet.

    In the suspect’s vehicle, investigators found two semi-automatic handguns, $3,600 in concealed cash, three cellular telephones, and the supporting infrastructure of the retail drug trade. Things like digital scales, clear plastic baggies, and the mundane equipment of supply-chain management applied to substances that will destroy lives.

    Evidence suggested the suspect had ordered his inventory through unregulated online marketplaces, converted his residential property into a distribution hub, and conducted business across northeast Oklahoma. He was neither a major trafficker nor a minor street dealer. He was precisely the middle layer of the American drug supply chain, the network that makes narcotics available in communities where addiction has become, for all practical purposes, a chronic public health emergency with no visible ceiling.

    The Cooperative Takedown

    This case succeeded because it was built on institutional cooperation. The DEA pursued a nationwide investigation into fentanyl trafficking. The USPS OIG, equipped with its data analytics apparatus, cross-referenced suspicious addresses against the DEA’s intelligence. The Postal Inspection Service executed the warrants. The Tulsa County Sheriff’s Office provided K9 support. The U.S. Marshals Service accepted custody of the prisoner. Local prosecutors did the paperwork. Federal judges imposed the sentence.

    None of this was accidental. The USPS Inspector General, Tammy L. Hull, identified this partnership in remarks accompanying the case highlight.

    “We’re proud of the partnerships USPS OIG special agents have forged with the DEA, USPIS, and local and state law enforcement in Oklahoma and across the country. Joint investigations like these protect the American public by disrupting the criminal misuse of the U.S. Postal Service for drug trafficking.”

    The statement is, in every technical sense, accurate. The investigation succeeded. The suspect was convicted. The sentence was substantial. The American public was protected from one distributed, modestly-scaled narcotic operation across northeast Oklahoma.

    But the statement contains, perhaps necessarily, an institutional optimism worth examining. Every case that succeeds does so because someone chose to pursue it. Every criminal investigation requires the alignment of several independent bureaucracies, the availability of sufficient investigative resources, the cooperation of multiple jurisdictions, and a prosecutorial environment willing to proceed.

    The USPS OIG operates through voluntary cooperation with other agencies. These partnerships are real, demonstrable, documented. But they are also not comprehensive. They represent success, not saturation. For every address that lights up on the OIG’s proprietary analytics, how many others remain dark?

    The Postal System as Delivery Infrastructure

    The OIG’s public characterization of this case frames it as a vindication of joint investigative capacity. And in a technical sense, it is. But it also illustrates something more systemically concerning…the U.S. Postal Service remains, structurally, a convenient mechanism for the distribution of contraband.

    The postal system was designed for reliability, ubiquity, and trust. These same qualities make it attractive to anyone seeking to move substances across state lines while maintaining operational security.

    The suspect in this case was sentenced to 17 years in federal prison. The OIG has highlighted the case as evidence of joint investigative success. But the postal system still operates. Drugs still move through it. Other cases are still pending, and prior cases have already been tried, while future cases are being investigated right now by the very agencies that coordinated this takedown.

    The real question is whether identifying one pantry full of contraband represents progress in disrupting the systemic use of the postal system for drug trafficking, or merely the visible surface of a much larger problem.

    The OIG’s response, implied in its case highlight, is that institutional cooperation makes a difference. Perhaps it does. But the problem persists, and so do the pantries, and the compartments, and the false bottoms, and the small-scale distributors who convert residential spaces into supply hubs.

    For now, one address has been disrupted. One suspect has been incarcerated. One kitchen’s worth of contraband has been seized. The postal system, a government corporation, continues its deliveries.

    For more on USPS OIG oversight, see Nashville’s Postal Honor System Just Failed an Audit — on four OIG reports documenting self-reported compliance data that stopped matching reality at every layer of Nashville’s mail operation — and The Postal Service Passed Its Pay Audit. The Bill Just Got Postponed. — on how USPS executives legally defer salary cap overages into interest-bearing accounts while the agency posts a $9 billion annual loss.

    Fediverse reactions

  • Federal Register Watch: September 10, 2026

    Today’s Federal Register carried 119 documents, headlined by a Census Bureau proposal that would exclude people without legal status from congressional apportionment counts and strip race, ethnicity, and sexual-orientation questions from the census questionnaire entirely.

    • Census Bureau (Commerce Department): The Bureau proposed writing formal residence criteria into regulation for the first time, including a rule that would exclude people without legal status from the count used to divide up House seats and Electoral College votes, while still counting lawful permanent residents, prisoners at their facilities, and military and federal personnel at their duty stations. A companion proposal would limit the census questionnaire to biological sex, date of birth, and household relationship, dropping race, ethnicity, and sexual orientation questions altogether. Because apportionment decides how much political weight each state carries and federal agencies lean on census demographic data to enforce civil rights law and steer funding formulas, this is a rewrite of how power and money get divided among the states rather than a clerical update. Comments are due October 13, 2026. Read the proposal.
    • Homeland Security Department: DHS issued a correction to the data table underlying its August 25 proposal to charge $103,265 for most cap-subject H-1B petitions, fixing the historical petition-volume figures it used to estimate how many petitions the fee would apply to and how much revenue it would raise. The correction touches exactly the numbers that justify the fee’s size, yet the comment period and the proposed fee amount are untouched, so the public is left commenting on a rule whose supporting math changed midstream. Read the correction.
    • Office of Foreign Assets Control (Treasury Department): OFAC indefinitely suspended three general licenses and a licensing policy that had authorized narrow categories of transactions with Iran, covering overflight payments, aircraft-safety licensing, bunkering and emergency repairs, and the temporary return of certain civil aircraft, with the suspension effective September 8, two days before the rule was published. The agency invoked the Administrative Procedure Act’s foreign-affairs exception to skip notice-and-comment rulemaking entirely, which is a lawful shortcut for sanctions actions but one that means the public had no chance to weigh in before the change took effect. Read the rule.
    • Securities and Exchange Commission: The SEC proposed rescinding the 15-year-old rule that bars investment advisers from collecting fees from a government client for two years after the adviser or a covered employee makes a political contribution to an official who could influence that business. The Commission argues the rule produced blanket contribution bans and hiring restrictions beyond its original purpose and that existing fraud and fiduciary-duty rules can police pay-to-play conduct instead, trading a bright-line restriction for one that depends on case-by-case enforcement. Comments are due November 9, 2026. Read the proposal.
    • Fish and Wildlife Service (Interior Department): FWS reopened public comment on its proposal to remove the Gila chub, a small Southwestern fish, from the endangered species list, more than a year after the original comment period closed in August 2025. The agency cites a statutory obligation to give proper notice as the reason for reopening, but the notice does not explain what happened to the rule during the thirteen months in between, which is the kind of gap worth watching for what surfaces when a final rule eventually appears. Comments are now due September 25, 2026. Read the notice.
    • Executive Office of the President: The White House published two executive orders signed September 4. “Supporting America’s Ranchers” frames ranching as central to food security, while “Promoting Fair Competition in Livestock Markets and Expanding Market Access for American Meat Producers” takes up ranchers’ complaints that concentrated meat processors squeeze them on price and make it harder to sell across state lines. Because executive orders direct agencies rather than create enforceable rules on their own, the pair mainly signals where USDA and other agencies are expected to focus rulemaking and enforcement in the months ahead. Read EO 14425 | Read EO 14424.

    This edition reflects the full day’s docket of 119 documents published in the Federal Register for September 10, 2026. Excluded as routine: agency information-collection and OMB/PRA notices, self-regulatory-organization rule filings from national stock exchanges, antidumping and countervailing duty administrative review notices, FEMA flood hazard determinations, airworthiness directives, foreign-trade zone production-activity notices, procurement list additions and deletions, medical device classification notices, USPS product-change notices, and routine advisory-committee meeting and marine-event notices.

  • The Notary, the Vacation, and the Barred Planner: Inside the Gilchrist Tax Lien Fraud Case

    In the driveway, an unexpected visitor

    On a quiet weekday morning in a Bexar County subdivision, a 70-year-old North Texas attorney allegedly appeared without warning at a woman’s home. According to a federal criminal complaint, David Thomas Gilchrist told the woman’s husband that the FBI was looking for him and suggested the couple should consider taking a “vacation” for a couple of years, perhaps to Mexico. The visit came just days before Gilchrist was scheduled to testify under oath before the Securities and Exchange Commission.

    Federal prosecutors now allege that this driveway encounter was not an awkward misunderstanding but an act of witness tampering, aimed at pushing a potential witness out of reach of investigators probing what they describe as a $1.45 million Ponzi scheme built on the promise of safe, niche returns from Texas property tax liens.

    Gilchrist, a Grand Prairie, Texas attorney, was arrested on August 31, 2026, on a federal criminal complaint. He is charged with wire fraud, aggravated identity theft, and witness tampering, and is expected to make his initial appearance before a U.S. magistrate judge on September 2, 2026.

    The charges stem from an investment program that, on paper, looked like a sophisticated way to profit from delinquent property taxes and, in practice, allegedly became a vehicle for forgery, fabricated intermediaries, and a campaign of delay and evasion when investors started asking for their money back.

    A tax lien business that never was

    The criminal complaint affidavit alleges that between April 2023 and January 2026, Gilchrist solicited roughly twenty investors, often through partnership agreements or promissory notes, for the stated purpose of purchasing property tax liens in several Texas counties. He allegedly told investors he would use their pooled funds to buy tax liens, manage the portfolio, and repay them with attractive interest once delinquent property owners paid up.

    Property tax lien investing is, in fact, a real and heavily procedural niche. When a property owner fails to pay local taxes, a county or other taxing authority can sell the lien to private investors, who then earn statutory interest or penalties when the taxes are ultimately paid.

    Texas law contains detailed provisions for so-called transferred tax liens, specifying how liens may be assigned, recorded, and enforced. Done properly, the business can be steady, if unspectacular, for specialists who understand the statutes and local practices.

    According to investigators, that veneer of legitimacy was central to the pitch. The complaint alleges that bank records do not support Gilchrist’s representations about buying liens. Instead, he allegedly commingled investor funds with other accounts, used money for personal expenditures, and diverted new deposits to repay earlier participants. Prosecutors characterize the pattern as a classic Ponzi structure: newer funds shoring up older promises, with no real underlying investment engine.

    In total, the affidavit alleges, Gilchrist collected approximately $1.45 million from investors over the nearly three-year period and returned only about $789,000. The remainder is alleged to have been absorbed into a mix of personal spending and circular payments that kept the program running just long enough to secure additional deposits.

    What kept this program out of view for so long is not hard to discern. Private partnerships centered on a niche state-law instrument like Texas tax liens tend to operate far from the retail securities markets that draw the SEC’s routine attention.

    Only when the alleged conduct implicated the federal wire fraud and securities fraud statutes did the full weight of federal oversight come into play. A similar operation, structured to avoid securities status and interstate transfers, might have remained a strictly local problem.

    Forged deeds and borrowed identities

    The alleged misconduct, as described in court filings, did not stop at misrepresentations to investors. Once the SEC opened a formal investigation and requested documentation of the supposed tax lien purchases, Gilchrist allegedly escalated.

    According to the complaint, he provided the SEC with a series of quitclaim deeds purporting to show transfers of lien-related interests. On closer review, investigators concluded the deeds were forgeries.

    The documents, prosecutors allege, contained notary stamps and signatures belonging to real Texas notaries who had never met Gilchrist and had not notarized the transactions in question. By attaching genuine credentials to fabricated instruments, the filings suggest, Gilchrist allegedly attempted to backfill a paper trail of tax lien activity that did not exist.

    Those acts underpin the aggravated identity theft charge, which requires that a defendant knowingly use another person’s identification without lawful authority in connection with certain predicate crimes.

    The invented intermediary

    The woman whose home Gilchrist allegedly visited in Bexar County plays a different role in the narrative. According to the criminal complaint, she became a central figure not because she helped run a tax lien business, but because Gilchrist allegedly tried to cast her as the face of a fictitious one.

    During sworn SEC testimony in April and May 2026, Gilchrist allegedly told investigators he used an undocumented woman in Bexar County as an intermediary to identify delinquent homeowners and deliver cash to them as part of a lien acquisition strategy.

    He allegedly claimed he had redacted homeowner names from documents because, in his telling, the homeowners were in the country without legal status. The implication was that the SEC could not safely contact them, and that their identities were too sensitive to share.

    The complaint paints a different picture. According to prosecutors, the woman exists but was barely acquainted with Gilchrist and had no role in any tax lien transactions. She was, the filings allege, placed at the center of an invented operation that did not occur as described.

    The driveway visit, framed around warnings about the FBI and a suggested multi-year “vacation,” is alleged to have come just days before Gilchrist was due back before the SEC, turning a peripheral acquaintance into an unwitting character in a story he had already told under oath.

    Delay, distraction, and the Mansfield gym

    While regulators were working through bank records and deeds, investors were asking for their money. The complaint alleges that Gilchrist responded with an evolving series of explanations for why redemptions were delayed or payments had to be rolled over.

    Among the reasons prosecutors say he offered: the federal government was shut down, stalling necessary approvals; local authorities were tied up in an arson investigation affecting properties connected to the liens; he had been deployed to assist with hurricane relief. Each explanation, if taken at face value, suggested that external forces, like Washington politics, criminal probes, and natural disasters, were temporarily blocking distribution of otherwise sound investment proceeds.

    In one episode highlighted by investigators, Gilchrist allegedly told an investor he was hospitalized in Tennessee recovering from a colectomy. Hospitalization, especially out of state, is a powerful signal that repayment delays are unavoidable and, at least temporarily, excusable.

    Yet according to the complaint, during the period he claimed to be recovering in Tennessee, access records showed him checking into a gym in Mansfield, Texas, close to his home base in the Dallas-Fort Worth area. The alleged disconnect between his claimed incapacitation and his actual whereabouts became one more data point in a pattern of shifting stories and eroding credibility.

    The Novinger link and a repeat appearance

    Gilchrist is not the only name in the government’s paperwork. In a parallel civil action, the SEC’s Chicago Regional Office has filed a complaint charging Gilchrist with securities fraud. That civil case also references Christopher Novinger, a figure already familiar to regulators.

    In 2015, the SEC filed a civil complaint, summarized in Litigation Release No. 23256, alleging that Novinger and related parties sold approximately $4.3 million in interests in life-settlement contracts to 26 investors while making material misrepresentations.

    The program was promoted on what was billed as a financial radio show, the “Retirement Experts Radio Show,” which the SEC alleged functioned less as neutral advice and more as a marketing platform for the offerings. In 2016, through Release No. 34-78213, the Commission imposed a bar order prohibiting Novinger from associating with broker-dealers or investment advisers.

    That bar remained in place when the SEC filed its new civil complaint involving Gilchrist. According to coverage by InvestmentNews on September 1, 2026, the SEC now alleges that Novinger, despite the prior sanction, was steering clients into Gilchrist’s tax lien program. The details of that alleged pipeline are still emerging, but the mere fact that a previously barred financial promoter appears again in a fresh enforcement action underscores longstanding concerns about how effectively sanctions are monitored and enforced in fragmented markets.

    The SEC Office of Inspector General is investigating the criminal matter alongside federal prosecutors, with substantial assistance from the U.S. Marshals Service, according to government statements. Assistant U.S. Attorneys Alexander Schwab and Douglas Brasher of the Fraud Section are leading the prosecution, signaling that the case is being treated as more than a routine regional fraud referral.

    The gap around the edges

    The Gilchrist case, as laid out in the criminal and civil complaints, is not the largest alleged Ponzi operation in recent memory, nor the most complex. What makes it notable is where it sat: at the intersection of a lightly supervised state-law investment niche, informal referral networks, and federal enforcement regimes that tend to activate only after enough red flags accumulate in one place.

    The alleged scheme ran from at least April 2023 to January 2026, a span of nearly three years in which paperwork, bank wires, and individual complaints were all, in theory, available to someone with the authority to scrutinize them.

    Federal involvement here required wire fraud charges and the invocation of securities laws that treat certain pooled investments as securities even when they are nominally tied to local tax instruments. The question, for regulators and lawmakers, is less why the SEC and Department of Justice eventually acted, and more what kinds of signals could have triggered earlier, narrower interventions.

    When barred promoters allegedly reappear as referral sources, when private tax lien partnerships scale into the millions, or when a solo practitioner suddenly claims to be running a multi-county lien portfolio, those data points can be captured long before a driveway conversation turns into an obstruction allegation.

    For now, the case moves through the courts. A criminal complaint is only an allegation; it is not evidence, and it is not a conviction. All defendants, including Gilchrist and any individuals named in related filings, are presumed innocent unless and until the government proves its accusations beyond a reasonable doubt in a court of law.

    The filings in United States v. Gilchrist and the related SEC actions nonetheless outline a familiar pattern around the edges of the regulatory state, where niche products, personal trust, and delayed scrutiny can combine to give alleged schemes a long runway before anyone in authority is prepared, or positioned, to pull them back to earth.

    Fediverse reactions

  • Thirty-Eight Fakes: How Fraudsters Turned the SEC’s Own Filing System Into a Trust Machine

    When a Disclosure Looks Like a License

    On the Securities and Exchange Commission’s own public database, the profile page looks reassuringly official. There is an SEC file number. A Form ADV reference. An austere masthead that reads “Exempt Reporting Adviser.” To a retail investor searching the Investment Adviser Public Disclosure system, that badge can look like a license to trust.

    According to a sweeping set of civil complaints the SEC filed in late August, it has also become something else: a cheap, reusable prop for fraud.

    The mechanism is deceptively simple. The Exempt Reporting Adviser, or ERA, category was created so that certain private fund advisers could file limited disclosures without undergoing the intensive scrutiny of full SEC registration. Yet on the Investment Adviser Public Disclosure (IAPD) database, those filings sit in the same public directory as fully registered advisers.

    The SEC itself alleges that dozens of purported firms exploited that proximity, pointing potential victims to their ERA pages as if they were evidence of government approval that the system was never designed to provide.

    The Exemption That Wasn’t Designed for This

    In regulatory terms, an ERA is a light-touch registrant. Under rules implementing the Dodd-Frank Act of 2010, advisers that manage only private funds and qualify for certain exemptions may file as Exempt Reporting Advisers instead of registering fully.

    The filing is mainly a disclosure exercise: basic ownership information, certain disciplinary histories, high-level data about the funds advised. It is transmitted through the same electronic system as full Form ADV filings, but it does not trigger the same examination regime or substantive vetting by the SEC.

    What it does not confer is any seal of approval. An ERA is not a registered investment adviser. The SEC does not review or endorse individual ERA business models before they appear on the IAPD database. According to the SEC’s own investor education materials, the category exists to reduce compliance burdens for advisers that serve sophisticated investors, not to create another credential for mass-market consumption.

    Thirty-Eight Complaints, One Playbook

    Yet the line between “disclosure” and “endorsement” can blur on a government-branded web portal. On August 27, 2026, the SEC announced that it had filed 38 simultaneous civil complaints in the U.S. District Court for the District of Colorado alleging that purported advisers and trading platforms around the world used ERA filings and related SEC references as marketing tools for unregistered, and in many instances fictitious, investment schemes.

    The actions, summarized in SEC Release No. 2026-78 and Litigation Release No. 26622, represent one of the most concentrated attempts yet to police the boundary between disclosure regime and perceived imprimatur.

    According to the complaints, the pattern recurs with minor variations. Entities would obtain or reference an ERA filing, claim a Colorado business address, and publish contact information that led nowhere. Phone numbers allegedly rang to disconnected lines. Suite numbers mapped to virtual offices or co-working spaces that had never heard of the firms using their addresses. From there, the SEC alleges, the purported advisers pointed investors to SEC file numbers, ERA pages, or fabricated “approval” documents to vouch for their legitimacy.

    Across the 38 cases, the SEC describes a common playbook. Allegedly false Colorado mailing addresses. Websites restyled from one template to another, but reusing the same fund descriptions and performance statistics across entities that were not otherwise connected. Nearly identical language, according to the complaints, touting high-yield crypto, foreign exchange, or “AI-driven” strategies.

    Phantom Auditors and Forged Seals

    Several of the complaints note that internal SEC analytics flagged statistically implausible overlaps in fund data entered into the IARD filing system, prompting closer review by enforcement staff.

    In place of real oversight, the firms allegedly invented it. The complaints cite, among other examples, references to outside auditors with no verifiable existence. One oft-repeated name in the filings, “Indicator Global,” appears in the SEC’s narrative as a kind of phantom gatekeeper, invoked to reassure investors that an independent third party had vetted returns and custody practices. According to the SEC, no such audit firm could be located.

    In other instances, the defendants allegedly displayed ornate “certificates of approval” featuring the SEC’s name or seal, despite the fact that the Commission issues no such certificates for ERAs or for investment advisers more generally.

    The SEC’s complaints also point to the digital exhaust left by the filings themselves. Although the purported firms claimed Colorado addresses, many of the IARD submissions and related account logins allegedly originated from foreign IP addresses scattered across multiple jurisdictions.

    The Commission does not allege that foreign origin is itself improper, but argues that the mismatch between claimed domestic locations and observed access patterns reinforced the picture of a coordinated effort to manufacture a U.S. regulatory footprint from afar.

    The Defendants

    The set of charged entities is sprawling by design. In its Colorado filings, the SEC names Abrdn Canada Limited, Absolutaris Base Limited, Apexium Securities Ltd, Axivon Exchange Ltd, Calystron Capital Ltd, CryptoOrbit Ltd, Equal Chance Capital Ltd, Ftaexchange Ltd, Future Finance Academy Ltd, Gainstra Capital Inc., Glorious Dawn Capital Management Co. Ltd, Harbor Financial Institute Ltd, Helios Wealth Management Ltd, Ideal Finance Ltd, Ironclad Trading Institute LLC, Korzen Asset Management Ltd, LinkedIn Research Institute Ltd, LuxePoint Capital Ltd, Nautical Echo Capital Ltd, NewstarAsset Capital Inc., Nexera Technologies Ltd, Nova Academy of Finance Ltd and Nova Financial Academy Ltd.

    The list continues: Perkea Capital Securities Inc., Pinnacle Crypto Exchange Inc., Pinno Capital Inc., Quantum Financial Institute Ltd, RBH Infinity Exchange Inc., Robin Markets Inc., Rockford Partners, Sapphire Tide Capital Ltd, Stellar Path Institute Ltd, Summit Breeze Haven Exchange Ltd, THEVGPRO Ltd, ThreeM Holding Ltd, Veriton Investment Inc., Web3 University, Wingspan Advisors LLC, and Ichcoin Tech Corp., the company behind the “WealthTutor” platform previously scrutinized in this publication’s separate investigation.

    Each complaint lays out its own factual narrative and alleged misrepresentations, but all are built on the shared theme of regulatory sheen without regulatory substance.

    The Trust Signal as a Weapon

    Those names may or may not be familiar to investors who encountered them on social media, search ads, or cold outreach. What almost all of them shared, according to the SEC, was a reference back to Washington. Marketing materials allegedly steered targets toward ERA listings, Form ADV identifiers, or generic SEC web pages, encouraging them to infer that appearance in the federal database meant their money was entering a supervised environment, part of a broader pattern of frauds moving through referral networks and recycled personas.

    The SEC is now, in effect, arguing that its own public records became part of the fraud script.

    The agency has tried to separate signal from noise. Concurrent with the Colorado filings, the Office of Investor Education and Advocacy released an alert on investor.gov warning that Exempt Reporting Advisers are not subject to the same level of regulatory oversight as registered advisers and that the SEC does not issue “certificates of approval” for any advisory firm. The alert urges investors to read the details of any IAPD entry carefully and to treat ERA status as a disclosure starting point, not an endorsement. That distinction has always been present in the rule text.

    A Design Flaw the Rule Didn’t Account For

    Dodd-Frank directed the SEC to tailor reporting obligations for advisers to certain private funds, based on the premise that sophisticated investors need less regulatory hand-holding. The Commission responded by designing ERA filings as a way to capture systemic risk information without forcing every small or specialized fund adviser into the full registration regime. But while the filing requirements calibrated burden and benefit for industry participants, the effect on unsophisticated investors confronting the IAPD interface received less attention.

    On the front end, the IAPD does exactly what Congress asked: it makes advisory information public. Yet the way it presents that information matters. ERAs appear in the same search results as fully registered advisers, framed by the same SEC branding. The database does contain textual explanations of status differences, but they do not leap off the page. For a hurried user looking for a yes-or-no answer to whether a firm is “in the system,” the difference between “registered investment adviser” and “exempt reporting adviser” is easily lost.

    Regulators are quick to stress that this is a design vulnerability, not a confession that the architecture is broken. The ERA framework has enabled thousands of legitimate advisers to comply with federal law in a proportionate way. Most ERAs do not show up in enforcement releases.

    The 38 cases in Colorado, if the allegations are borne out in court, would instead illustrate how a small subset of actors can weaponize a disclosure mechanism when user-interface design assumes sophistication that the audience does not actually possess.

    This publication previously reported in depth on Ichcoin Tech Corp. and its “WealthTutor” platform, one of the entities now named among the 38. In that case, as in the broader set of complaints, the alleged pattern is familiar: a thin factual connection to U.S. jurisdiction, a heavy rhetorical reliance on SEC file numbers and logos, and a target audience for whom those references substituted for more traditional due diligence. The new filings extend that pattern from one platform to a network of ostensibly separate brands.

    What Comes Next

    For now, the Colorado cases are at an early stage. The SEC is seeking permanent injunctions to bar future violations of the securities laws, conduct-based restrictions that would limit how the defendants could participate in the securities markets if they remain in them at all, and civil penalties intended to deter similar conduct by others. The complaints do not themselves determine liability, and all defendants are presumed innocent unless and until a court finds otherwise.

    The institutional question is what happens next to the machinery these firms allegedly misused. The SEC has now put in writing that Exempt Reporting Adviser filings and the IAPD interface can be co-opted as confidence devices.

    Having made that acknowledgement in court papers and investor alerts, the Commission owns the next move. It can redesign the architecture so that ERAs and registered advisers are visually and functionally distinct to unsophisticated users, or it can leave the interface largely as is and rely on case-by-case enforcement to police its perimeter.

    The 38 Colorado complaints draw a line in the sand. Whether that number stays exceptional, or becomes an early chapter in a larger series of exploitations, will depend in no small part on how the SEC treats the trust signals it has created.

    Fediverse reactions

  • Paying for Nothing: How the VA Spent $11.2 Million on Services Never Delivered

    Paying for Nothing: How the VA Spent $11.2 Million on Services Never Delivered

    A Bureaucracy Times Analysis

    The Department of Veterans Affairs paid roughly $11.2 million for a Veterans Crisis Line backup center that never meaningfully answered a call. For nearly a year, taxpayer money went to a ghost operation that was supposed to catch overflow and emergencies for the nation’s 24/7 lifeline for veterans in suicidal crisis—but it never legally came online, never handled real traffic, and never delivered the backup protection the contract promised.

    The payments continued despite officials knowing—as early as November 2022—that the contractor couldn’t legally deliver the service. The backup call center sat understaffed, unable to meet security requirements, incapable of handling calls. Yet invoices kept coming. Checks kept clearing. Nobody stopped it until June 2023.

    This is not a case of good intentions gone wrong, or an unavoidable technical failure. It’s a story of institutional dysfunction, blurred accountability, and a bureaucratic apparatus so fractured that nobody felt personally responsible for stopping money from flowing to a ghost operation.

    The Setup: Why Backup Systems Matter

    The Veterans Crisis Line has answered over 5 million contacts since its 2007 launch. With a suicide rate among veterans nearly double the general population—35 deaths per 100,000 veterans according to VA’s own data—the service exists because it works. Trained responders recognize the specific trauma signatures of military experience. They know how to talk someone down from immediate harm.

    In 2022, the VCL added a new routing mechanism: the 988 hotline (national suicide prevention line) followed by the “press 1” option for veterans. This integration meant calls flowed through a contractor’s routing system before reaching VA responders. That contractor was also supposed to provide backup capacity—10 percent of call volume normally, but 100 percent in emergencies.

    Ten percent of normal traffic meant handling calls when the VCL’s main system went down for maintenance, during a cyberattack, or in the event of disaster. For a line that fielded 600 responders on average per month, this meant the contractor needed to maintain roughly 60 dedicated backup staff.

    On paper, the VA had it covered. A $32.5 million contract, awarded in April 2019, was supposed to last five years. The backup responder portion—$20.5 million of that total—went to a subcontractor brought in by the prime contractor. The service was supposed to be seamless, invisible unless needed, but absolutely reliable if crisis struck.

    It was none of those things.

    The Misaligned Checklist

    Start with the fundamental error: a security compliance failure buried in bureaucratic procedure.

    When the VA’s acquisition team put together the 2019 contract, they filled out a security checklist. This document, required by VA Handbook 6500.6, is supposed to identify what sensitive information the contractor will handle and what security protections are required. The 2019 checklist concluded: no Authority to Operate (ATO) needed. The contractor wouldn’t be storing sensitive veteran data, the team reasoned, so standard commercial security would suffice.

    This was wrong.

    The performance work statement—the contract’s actual requirements—mandated that the contractor transmit call documentation within 30 minutes of each call and provide call recordings to VA within 24 hours upon request. The contract explicitly stated: “call recordings will be kept according to VA policy; 100% recording and 100% retention.”

    Call recordings of veterans in crisis contain deeply sensitive information: suicidal ideation, trauma histories, medical conditions, personal identifying information. This is exactly the kind of data requiring Authority to Operate certification.

    The VA even had a reference point. When checking the previous 2017 contract—for nearly identical services—the 2019 acquisition team could have seen that ATO was required for the same work. But that discrepancy wasn’t caught. Nobody at VA compared the two. Nobody asked the information security officer why the exact same service changed from “requires ATO” to “doesn’t require ATO.”

    The information security officer would later tell OIG investigators that the understanding was the contractor wouldn’t store VA data. But the contract explicitly required it. When asked about the disconnect, neither the security officer nor the contracting officer could adequately explain the discrepancy.

    As the OIG report notes: “The information security officer and the COR who signed the 2019 checklist could not fully explain the discrepancy for the same service requiring an authority to operate for the 2017 contract but not requiring one for the 2019 contract.”

    This is how $11.2 million starts getting wasted: through a failure in the most basic institutional check—comparing your contract to the last contract for the same work.

    The Subcontractor Switch

    For three years, the system limped forward under the original subcontractor. Then, in April 2022, that subcontractor announced it was getting out of the business. Termination was set for July 15, 2022—the day before the VA was implementing “988 press 1” hotline routing through this same contractor.

    Within a week, VA leadership scrambled to create an internal backup system. But it would take months to get operational, and even longer to fully functional. So they needed the contractor—with his new subcontractor—to maintain backup capacity in the interim.

    The new subcontractor came on July 15, 2022, with an aggressive staffing plan provided to VA’s Contracting Officer’s Representative (COR):

    • 50 staff by October 2022 (2.5 months in)
    • 92 fully staffed responders by November 2022 (3.5 months in)

    The COR rated this plan “acceptable” and signed off on it.

    By August 2022, just weeks into the new subcontract, the new subcontractor revealed its technology plan: it wanted to use a cloud-based system for document sharing.

    This triggered an information security review. And that’s when VA’s sloppiness caught up with them.

    By the end of August 2022, the information security officer told the COR and VCL officials: if the contractor was processing, storing, or transmitting VA data using cloud services, it would need FedRAMP certification and an Authority to Operate. The proposed system didn’t have it.

    September 2022: The COR confirmed the contractor couldn’t use the proposed system because it lacked FedRAMP compliance.

    October 2022: The VCL’s deputy director of technology circulated an issue brief. It would take 12 to 18 months for the contractor to achieve compliance.

    Twelve to eighteen months. Let that sink in. VA officials had just learned they’d contracted for a year-and-a-half of security remediation—during which the contractor couldn’t legally handle veteran calls—and didn’t immediately stop the bleeding.

    The Meeting Where Everyone Knew

    November 2, 2022. This is the date that matters most.

    VCL officials, the COR, the contracting officer, and the acquisition services division chief all sat down to discuss the unfolding disaster. The meeting notes are blunt:

    “Contractor could not provide backup responder services without an Authority to Operate.”

    “It would be at least one to two years before services would be provided.”

    The acquisition services division chief—essentially the boss of the contracting operation—suggested options. The contract could be modified (which would require renegotiating price). A 60-day stop-work order could be issued to buy time to figure this out. Or the whole service could be terminated.

    The contracting officer’s response: “The contractor must be given a chance to become compliant and had to be paid.”

    This is the pivot point where negligence becomes something more deliberate. Everyone in that room understood:

    1. The service wasn’t being provided
    2. The contractor wasn’t compliant with federal security law
    3. The contractor couldn’t become compliant for at least a year
    4. Yet the contractor had to keep getting paid

    The meeting notes even included a section explicitly labeled “paying for services not received”—the COR later told OIG investigators that VCL leaders had expressed concerns about this issue to the contracting officer.

    Eight days later, on November 10, the parties met again. Same conclusion: the contractor would need 9 to 18 months for compliance. Still, the contracting officer didn’t issue a stop-work order. Didn’t renegotiate. Didn’t terminate.

    Why? The contracting officer told OIG investigators he was waiting for VCL officials’ direction.

    The VCL deputy executive director told OIG investigators VCL needed the backup system while building their internal option.

    So who made the decision? Nobody. That’s the answer. It fell into a bureaucratic void.

    The Invoice Trap

    Meanwhile, invoices were flowing in. Every month, the contractor—or its subcontractor—submitted payment requests for call responder backup services. The COR, whose job was to verify that services were actually delivered before authorizing payment, kept approving them.

    The data tells the real story.

    Call routing logs show: zero calls transferred to the backup center from mid-July 2022 through June 2023. Two calls in August 2022 that probably weren’t even answered based on call duration. Then nothing. Complete silence. A year of radio silence, during which VA paid $11.2 million for staffing that didn’t exist and calls that were never handled.

    Yet in March 2023—nine months into this black hole—the VCL management analyst emailed the VCL executive director asking to exercise the next contract option year for the backup center. Same day, the executive director approved it. The COR issued an evaluation saying the contractor’s performance was “satisfactory.” The contracting officer issued the modification to continue the contract.

    This is the trap: federal contracting law doesn’t punish you for overpaying for nothing. A firm-fixed-price contract means the contractor bears financial risk—but it also means the contractor gets paid regardless, as long as they keep billing. And unless someone explicitly stops payment, the machine keeps grinding.

    The COR later explained to OIG investigators that he approved invoices based on the contracting officer’s advice that payments were justified because the contractor was “making progress during the implementation phase and working toward an approval.” Translation: he approved payment for work not done because someone else told him it was okay.

    But VA’s acquisition manual explicitly states: “the COR should not recommend invoice payment solely on the recommendation of another government employee.”

    It happened anyway. Month after month, January through May 2023, invoices were approved based on one official deferring to another official’s judgment, with nobody actually verifying the work was done.

    The irony is caustic: the COR’s job was to protect the government’s interests. Instead, he abdicated that responsibility to someone else.

    Why Nobody Stopped It

    Three factors created this mess:

    First: Unclear authority and responsibility. The contracting officer believed VCL leadership needed to decide about the backup services. VCL leadership believed they needed contracting guidance. Nobody wanted to own the decision, so nobody made it. For seven months, the system defaulted to “keep paying.”

    Second: Weak documentation and communication. When a VCL official apparently told the contractor not to take calls (without official authorization), the contracting officer found out later and was confused about who said it and when. At a critical moment, nobody had written proof of the problem, so the contracting officer could demand written direction before acting. But this created a catch-22: VCL couldn’t be expected to formalize a problem the contracting officer wasn’t formally acknowledging.

    Third: The acquisition manual’s weak enforcement. The regulation says CORs shouldn’t rely on other officials’ advice. But there’s no secondary review, no checkpoint, no audit until months later. A COR can violate the manual by just deferring to the contracting officer, and nobody catches it until an OIG audit.

    The acquisition services division chief told OIG investigators that “there was no evidence in the contract file that indicated the contractor did not provide call answering services” and that “VCL officials did not provide a formal written notification stating that services were not being provided.”

    This is the heart of bureaucratic dysfunction. Nobody takes action without formal documentation. But the system that’s supposed to generate that documentation is the same system that’s failing. It’s circular: you can’t stop payment without formal notice, but nobody issues formal notice because nobody owns the decision.

    The Termination and Settlement

    Finally, in May 2023—a year after the disaster began—the VCL deputy executive director notified the COR: terminate the backup responder services. The COR relayed this to the contracting officer. The contracting officer issued the termination in June.

    Total damage: $11.2 million in payments for undelivered services. Plus $677,575 in settlement costs to unwind the contract.

    The OIG excluded the settlement costs from its “questioned costs” calculation—the official figure for waste. So the number that gets reported to Congress, the number that matters for oversight, is $11.2 million.

    But the real number is $11.9 million.

    Systemic Red Flags

    The OIG’s recommendations are measured but pointed:

    1. Have the Office of General Counsel determine whether to recoup the $11.2 million under the Contract Disputes Act.
    2. Implement policies to ensure information security requirements are accurately determined before contract award.

    VA’s response was equally measured. They concurred with #1 and said they’d check with General Counsel by year-end 2026. On #2, they concurred “in principle” and said they’d already addressed the issue with the acquisition team. No systemic breakdown, they implied. Just an isolated error.

    But the OIG identified two structural failures:

    Control environment failure: “VA officials did not take timely action to prevent paying for services not received.”

    Monitoring failure: “VA officials did not take timely action to modify the contract or terminate the call responder backup services.”

    These aren’t compliance errors. These are institutional willingness to let money flow to a failed program.

    The Missing Annual Assessment

    Buried in the report is another missed opportunity. VA Handbook 6500.6 requires contractors handling sensitive information to conduct annual security self-assessments. The 2019 contract included this requirement.

    The OIG found no evidence this assessment was ever conducted. The information security officer hadn’t seen it and thought it was no longer required.

    This should have been the circuit-breaker. The first annual assessment after the July 2022 subcontractor change would have immediately identified that an Authority to Operate was needed. The assessment would have forced the acquisition team to confront the noncompliance in real time, in formal documentation.

    Instead, the assessment was skipped. Another checkpoint failed. Another opportunity to catch the problem before $11.2 million was committed.

    The Veterans Crisis Line Context

    What makes this particularly damaging is that this happened to the Veterans Crisis Line—the service literally designed to prevent veteran suicide. The OIG estimated veteran suicide rate at 35 deaths per 100,000 veterans, nearly double the general population rate.

    The VCL answered over 5 million contacts since inception. It works. It saves lives. That’s why backup capacity matters. It’s not a theoretical nice-to-have; it’s insurance against the system that saves lives failing at a moment when someone’s in acute crisis.

    And $11.2 million—the amount wasted on a non-functional backup—represents federal resources that should have been flowing to actual crisis services, training, prevention, follow-up care.

    Waste at this scale, in a program this critical, isn’t just a budgeting problem. It’s a failure of stewardship toward the people the VA is supposed to serve.

    The Reorganization Unknown

    As of June 2026, the VA was still in the middle of a reorganization that consolidated contracting specialists under the Office of Acquisition, Logistics, and Construction. The OIG report notes: “The effects of these changes on the issues identified in this report are not yet known.”

    This is the unsaid part of the story. If restructuring doesn’t actually fix these problems, if acquisition staff just get moved around without changing procedures or accountability, then the next $11.2 million waste is probably already in the pipeline.

    The question isn’t whether the VA has policies that should work. They do. VA Handbook 6500.6, VA Directive 6500, the Federal Acquisition Regulation—these documents contain the requirements to prevent exactly this scenario.

    The question is whether the VA has the institutional discipline to enforce them.

    Open Questions for Further Investigation

    • Will General Counsel actually pursue recoupment? The OIG’s recommendation was for Office of General Counsel to determine if VA should recover the funds. VA said they’d report by December 31, 2026. Has that happened? What did they conclude?
    • Is this common? How many other VA contracts have similar compliance gaps? The OIG report treats this as an isolated incident, but the conditions that created it—weak security checklist review, missing annual assessments, unclear authority—are systemic.

    Conclusion: The Cost of Deferred Decisions

    This wasn’t a case of fraud or deliberate theft. Nobody was running a scam. The contractor presumably believed it could eventually become compliant. VA officials presumably believed paying during the compliance period was reasonable, especially if they thought the money might ultimately be clawed back under the Contract Disputes Act.

    But that reasoning collapses once you have a conference room full of people explicitly discussing “paying for services not received” and still choosing to let invoices through. The VA had tools to stop it. The contracting officer could have issued a stop-work order. The COR could have refused to approve invoices. VCL leadership could have formally declared the contractor noncompliant. Any of these actions would have prevented most of the $11.2 million in waste.

    None happened. Instead, each official deferred the decision to someone else. The contracting officer waited for VCL guidance. The COR approved invoices based on the contracting officer’s advice. VCL waited for the contracting officer to act. This is how $11.2 million disappears in a federal bureaucracy: not through malice, but through diffused responsibility. When everyone’s supposed to be in charge, nobody is.

    The open question now is whether that responsibility will ever be reassembled. VA has told the OIG it will decide by December 31, 2026 whether to seek recoupment of the $11.2 million. That decision point is more than an accounting exercise. It is a live test of whether the department is willing to say, in writing and with consequences, that paying for nothing is unacceptable even when the system has already moved on.

    Meanwhile, the underlying tradeoff doesn’t change. Veterans’ resources remain finite. Every million dollars wasted on a defunct contractor backup is a million dollars not available for crisis responder training, community outreach, or the mental health services that support long-term veteran wellbeing. It also reflects a broader pattern of VA institutional dysfunction documented in our coverage: a staffing crisis the VA counts with an unverified web form, construction projects that tripled in cost while no one operated the oversight machinery, and a psychiatric ward where safety hazards went unresolved for six years. The Veterans Crisis Line will keep taking calls, and the VA’s internal backup will keep running, but the opportunity cost of this failure is already baked into future budgets.

    The VA’s response to the OIG—concurring in principle while framing this as an isolated error—leans heavily on the hope that this is a one-off. The facts of the case suggest something else: a system that chose inaction when action was required, and that only fully acknowledged the problem once the money was gone and the audit was underway.

    That leaves a larger, unresolved question hanging over the Veterans Crisis Line case: is this common? If the same weak controls, missing assessments, and blurred lines of authority exist elsewhere in VA contracting, then this episode is not an anomaly but a preview. Whether General Counsel pursues recoupment will tell us something. Whether the institution prevents the next version of this from happening at all will tell us everything.

    Sources and Documentation

    Fediverse reactions

  • Federal Register Watch: September 9, 2026

    Today’s Federal Register carries a supplemental notice from the EPA and the Army Corps of Engineers reopening public comment on the definition of “waters of the United States,” the phrase that decides how much of the country’s wetlands and waterways fall under federal Clean Water Act permitting and one of the longest-running fights in environmental law.

    • Environmental Protection Agency / Army Corps of Engineers. The agencies issued a supplemental notice asking for renewed public comment on how to define “waters of the United States” under the Clean Water Act, responding to the Supreme Court’s 2023 decision in Sackett v. EPA, which narrowed federal jurisdiction over wetlands. The definition has been rewritten by nearly every administration since the 1970s because it determines whether a landowner needs a federal permit before touching a wetland or stream; reopening comment for another round means the public gets a fresh formal chance to weigh in, but it also means that three years after Sackett the agencies still haven’t settled on language built to survive the next legal challenge. Read the notice.
    • Centers for Disease Control and Prevention. CDC published a notice formally restructuring its National Center for Immunization and Respiratory Diseases, consolidating offices, retitling divisions and branches, and rewriting mission and function statements. A Federal Register notice is how a reorganization like this becomes official, and because NCIRD sets vaccine and respiratory-disease policy, which offices survive the consolidation and which get folded into broader units is worth tracking even though the notice itself offers little explanation for the changes. Read the notice.
    • Department of Energy. DOE requested public input on implementing an executive order that declared a national emergency over the security of the U.S. bulk-power system, asking specifically what equipment and transactions should count as “covered” when they involve foreign-made grid components or what the order calls “Covered Foreign Entities.” A request for comment at this stage is where the real boundaries of an emergency declaration get drawn, since how DOE answers will decide how much of the grid’s supply chain ends up restricted and how much stays untouched. Read the notice.
    • Pipeline and Hazardous Materials Safety Administration. PHMSA granted a request from Exxon Mobil for a determination that federal hazardous-materials law preempts state common-law tort claims over the safety of gasoline transportation, concluding that letting such claims proceed would obstruct compliance with the federal regulatory framework. Preemption determinations like this are unusual because they are issued at a single company’s request and can close off state-court lawsuits before they’re ever filed, which raises a fair why-now question about what prompted Exxon to seek this ruling and whether other carriers will lean on it in future litigation. Read the notice.
    • Environmental Protection Agency. EPA proposed repealing its own December 2024 rule that had partially approved North Dakota’s regional-haze air plan, after the state and Basin Electric Power Cooperative petitioned for reconsideration and a federal appeals court agreed to pause the related litigation while EPA reworked its position. An agency proposing to undo a rule it finalized less than two years earlier is worth flagging on its own, and more so because the reconsideration was granted specifically at industry’s request rather than the agency’s own initiative. Read the notice.
    • Agricultural Marketing Service. USDA withdrew a year-old proposed rule that would have cut the number of importer seats on the National Watermelon Promotion Board from nine to seven, stating outright that the calculation used to justify the change was “legally insufficient.” It’s a small commodity-board governance matter, but an agency publicly admitting its own math didn’t hold up is a useful reminder that not every proposal gets the scrutiny it needs before it lands in the Federal Register in the first place. Read the notice.

    This edition reviewed all 127 documents published in today’s Federal Register. Excluded as routine: National Park Service NAGPRA notices (inventory completions, intended repatriations, and dispositions), SEC self-regulatory-organization rule filings, antidumping and countervailing-duty determinations, OMB/PRA information-collection notices, Superfund taxable-substance-list filings, routine safety-zone and drawbridge notices, FDA patent-extension regulatory-review-period determinations, presidential major-disaster declarations (five states today), and standard advisory-committee meeting notices.