Bureaucracy Times

The Timesheet That Refused to Change, Four Audits Running

There is a particular flavor of institutional rot that does not announce itself with a stolen Ferrari or an embezzled yacht. It announces itself with paperwork so lazy it becomes its own confession. In a new Justice Department Inspector General audit of $105 million in federal victim assistance grants flowing through the Michigan Department of Health and Human Services, auditors found a subrecipient director whose activity reports were identical, pay period after pay period, for years. Not similar. Identical. The kind of identical that suggests a human being decided, once, what percentage of their time belonged to which grant, then stopped thinking about it entirely, apparently confident nobody downstream would ever check the math against reality.

Somebody did check. Michigan DHHS itself flagged the pattern, first in a monitoring review dating back to fiscal year 2021. And flagged it again. And again, through fiscal year 2025, by which point the department’s own report on the matter had degraded into a bureaucratic shrug; a note that “future repayment may be requested” should the identical timesheets continue to appear identical. Four years is a long time to keep discovering the same fire and responding by writing a memo about how, next time, there might be consequences.

A Culture of Encouragement

This is not an isolated lapse dressed up as a pattern; it is the pattern. The Office of Justice Programs grants at issue, three Victims of Crime Act formula awards covering fiscal years 2022 through 2024, fund a genuinely vital state apparatus. Michigan’s Division of Victim Services channels the money to more than 200 community organizations providing crisis intervention, forensic exam reimbursement, shelter, and legal advocacy to survivors of domestic violence, sexual assault, and child abuse. Nobody is disputing that the underlying work matters. What the audit disputes is whether anyone in Lansing was prepared to make subrecipients actually fix what monitoring reviews kept turning up.

Auditors pulled a sample of 14 subrecipients’ monitoring histories across the five year review cycle and found that 9 of them had repeat or substantially similar findings. In one case, financial audits conducted in fiscal years 2022 and 2024 turned up eleven repeat findings at the same organization, including unsupported expenses and improperly calculated indirect costs; the same deficiencies persisted across the two year gap despite the subrecipient having been formally required to update its processes. The audit’s own language captures the department’s operating philosophy with more precision than any editorial gloss could manage; Michigan DHHS “identified concerns but did not explicitly require subrecipients to take corrective action, rather encouraged subrecipients to resolve the issues before their next monitoring review.” Encouraged. As though four year old fraud indicators were a matter of gentle persuasion rather than federal compliance.

Michigan DHHS officials offered auditors a reasonable sounding excuse; some review periods overlapped, leaving subrecipients insufficient time to correct issues before the next check arrived. It is a plausible administrative headache. It does not explain why, when a director’s timesheets never once varied across years of reviews, “encouragement” remained the department’s entire enforcement toolkit. Nor does it explain the parallel finding that of 22 subrecipient contract reviews auditors examined, 19 turned up errors in the performance data those subrecipients reported to the federal Performance Measurement Tool system; wrong categories, service logs that did not match the numbers claimed. Michigan DHHS caught these errors and, per the audit, did not require subrecipients to correct them or revise how they tracked the data going forward. The department has since told auditors it now asks for amended reports when it spots discrepancies, an improvement whose arrival four audit cycles late says something on its own.

The Cash That Sat Around Too Long

While the timesheet saga is the report’s most vivid moment, it shares billing with a second failure that deserves its own brief entry in the ledger of institutional forgetfulness. Federal rules require grant recipients to keep drawdown requests to the minimum needed for reimbursements due within ten days; essentially, do not sit on federal cash. Michigan DHHS transferred roughly $3.2 million in expenditures between two overlapping VOCA grants and, in the shuffle, ended up drawing down funds it had effectively already drawn once, leaving $900,000 in excess federal cash sitting in state coffers for over a month, discovered only because the auditors went looking.

The department returned the money, eventually, and explained that it had not known about the ten day repayment requirement, this despite a nearly identical episode having already surfaced in a prior review by the OJP’s own Chief Financial Officer’s office. A department managing over a hundred million dollars in federal victim services money discovering, for a second time, that it does not know how quickly federal cash must move is not an anecdote so much as a diagnostic.

Money That Michigan Says Belongs to Michigan

The audit also questioned $238,982 in administrative expenditures, the bulk of it $169,659 in pension and retirement contributions charged to the VOCA grant for employees whose eligibility for those specific benefits could not be verified. Michigan disagreed, at length, citing state law that spreads certain unfunded pension liabilities across the entire state payroll regardless of individual eligibility, and declined to concede the point even in its formal response to the draft report. The Office of Justice Programs sided with its own auditors; federal cost allocation rules require charges to match the actual pattern of benefits received by the employees whose salaries hit the grant, not a statewide average. It is, in miniature, a preview of the same institutional posture visible everywhere else in this report; acknowledge the smaller, cheaper findings gracefully, agree to return the money nobody will fight for, and hold the line only where holding it costs the most.

What Comes Next

Justice Department auditors issued eight recommendations. The Office of Justice Programs agreed to all of them without qualification. Michigan DHHS agreed with four, contested the pension cost finding across three separate recommendations, and simply declined to state a position on a fifth, even while agreeing to write the check. Every recommendation in this report is now formally “resolved” in the federal accountability sense of the word, meaning paperwork exists committing someone to eventually do something; Michigan has given itself until September 2027, more than a year from now, to finalize procedures ensuring subrecipients actually correct their deficiencies in a timely way.

That deadline sits uncomfortably close to another number in this report; the four years auditors spent watching one subrecipient’s timesheets stay exactly the same while nothing happened. Bureaucracy has a rhythm all its own, and in Lansing it appears to run on a five year monitoring cycle that resets itself before consequences ever quite arrive.

Sources: DOJ Office of the Inspector General, Audit of the Office of Justice Programs Victim Assistance Grants Awarded to the Michigan Department of Health and Human Services, Report 26-099 (September 2026)
Fediverse reactions
A Watchdog’s Budget Meets One Objection, and the Senate Leaves for Five Weeks

On the last legislative day before a recess that runs through Election Day, Sen. Catherine Cortez Masto (D-NV) asked the Senate to pass S. 5681, a bill that would let the Federal Housing Finance Agency’s inspector general determine how much funding the office needs. Sen. Bernie Moreno (R-OH) objected. The bill had been introduced that same day. It went nowhere.

Cortez Masto told the floor that FHFA Director Bill Pulte has pushed out ethics and civil rights staff and that the President fired the office’s acting inspector general last month. Those are her claims; the Record does not adjudicate them. Moreno said he supports independent oversight but that the bill sets no ceiling and no reasonableness test, and that assessments on Fannie Mae, Freddie Mac and the Home Loan Banks end up in mortgage costs. He said the office already has more than 100 employees and a budget above $50 million. A change in funding, he said, should come with a cap, a reporting requirement and a recorded vote.

The rest of the day

Confirmed: Keith Sonderling as Secretary of Labor, 47 to 41, after cloture passed 53 to 47. Twelve senators, six from each party, did not vote on confirmation. The Senate also confirmed ten ambassadors and one Air Force general.

Passed: Twenty-two bills, none of them by recorded vote. The Digest lists only four roll calls for the day. The pile includes the Taxpayer Assistance and Service Act (H.R. 5349) on IRS services, the Health Care Cybersecurity and Resiliency Act (S. 3315), which orders HHS and CISA to coordinate, and the Skills-Based Federal Contracting Act (H.R. 5235), which bars minimum education requirements for contractor personnel in certain solicitations.

Committees: A Homeland Security subcommittee heard from AI researchers on rogue AI agents and a bill to create a Department of Energy evaluation program (S. 2938). The HELP Committee advanced Nicole Saphier’s nomination for Surgeon General, along with two other HHS nominees. Energy and Natural Resources reported out 22 items. Intelligence met behind closed doors.

Next: The Senate adjourned at 11:25 p.m. and will hold pro forma sessions only, with no business, through November 5. It returns November 9, when a cloture vote on the Survivor Justice Tax Prevention Act (H.R. 2347) is set for 5:30 p.m. The House was not in session and meets Thursday in a pro forma session.

An inspector general may set the price of watching a housing agency, one senator argued, as soon as Washington holds a vote on it. The Senate is back November 9. The inspector general, presumably, will wait.
The Word That Decides Every Drug Sentence in America Was Never Actually Defined

Every criminal penalty attached to a controlled substance in the United States, whether it is a marijuana possession charge or a fentanyl trafficking case, traces back to a single phrase in the Controlled Substances Act of 1970. “Potential for abuse.” It is the first of eight factors the Food and Drug Administration is required to weigh when deciding whether a drug belongs in Schedule I with heroin or Schedule V with cough syrup. According to a new GAO report released this week, FDA has never written down what the phrase means.

Not “hasn’t gotten around to it lately.” Never. Fifty six years into the statute, the agency responsible for the single most consequential judgment in American drug law, the one that decides whether you face a misdemeanor or a mandatory minimum, is operating on what its own officials describe to GAO as “professional judgment.” There is no criteria document. There is no process memo. There is a phrase in a 1970 statute and a room full of scientists doing their best.

The Machine That Has No Manual

To be fair to FDA, the underlying machine is genuinely intricate, and GAO’s report lays it out in more detail than anyone outside the agencies has probably ever gotten. When DEA wants to schedule, reschedule, or deschedule a substance, it is required to request a scientific and medical evaluation from HHS, which farms the actual work out to FDA’s Controlled Substance Staff. FDA runs what the statute calls an eight factor analysis, weighs the evidence, and sends a recommendation back. Under a 2024 Department of Justice Office of Legal Counsel opinion, that recommendation is legally binding on DEA right up until DEA opens formal rulemaking, at which point DEA still owes it “significant deference.” In practice this produces a strange kind of choreography. GAO reviewed 208 substances DEA acted on between 2020 and 2025, found that DEA was required to request and consider an HHS evaluation for 95 of them, and confirmed DEA did so every single time, aligning with HHS’s recommendation on all 84 substances where a final decision had been published by the study’s cutoff.

So the system, mechanically, works. Two agencies coordinate, mostly agree, and rarely fight. What GAO actually found alarming was not the disagreement rate. It was that neither agency has bothered to write down how any of this is supposed to happen. DEA has no policy assigning roles or responsibilities within its Diversion Control Division for any of the four scheduling pathways it runs. When GAO asked why, DEA’s answer amounted to a shrug dressed up as confidence, that the statute is already clear and the staff are qualified scientists with advanced degrees who do not need a manual. FDA’s defense was gentler but structurally identical, that each evaluation is so individualized a written policy might not fit, so staff learn the eight factor analysis through what the agency calls “person to person training.” Meaning if the two or three people who currently know how it is done retire in the same fiscal year, so does the institutional memory.

A Definition Nobody Bothered to Write

FDA officials told GAO directly that the absence of a written definition of “potential for abuse,” including what counts as a “high” potential for abuse, creates real problems when a substance does not cleanly resemble anything already scheduled. They cited xylazine, the veterinary sedative now showing up as a street drug additive, as a case where the lack of a legal or policy definition left staff improvising. This is not a hypothetical gap. It is the actual criterion federal law uses to sort substances into schedules that carry radically different criminal exposure, and the agency charged with applying it admits, on the record, that it is filling the void with judgment calls rather than standards.

GAO’s other finding compounds this. FDA also maintains a memorandum of understanding with the National Institute on Drug Abuse describing how the two consult on scheduling science. That MOU is over forty years old and refers to FDA offices that no longer exist. Nobody had gotten around to updating it either, until GAO asked. Both agencies confirmed to GAO that the document is out of date and needs revising, which is its own small monument to how long a stale piece of paper can sit in a federal filing system before anyone with the authority to fix it notices.

None of this is abstract. The report notes that DEA’s own request for an HHS evaluation of xylazine sat with FDA for three years before a recommendation came back, and DEA still had not finished its own review as of this spring. In the meantime the substance keeps showing up mixed into street fentanyl, and DEA has told GAO it now wants Congress to just legislate a schedule for xylazine directly, because the existing statute cannot cleanly cover the ranch hands and slaughterhouse workers who have a legitimate reason to be near the stuff. When the agency responsible for classifying a substance decides the classifying process itself does not fit the substance, the honest response is not to route around it quietly. It is to ask why the process is built the way it is in the first place, which is precisely the question GAO’s report keeps circling without ever quite being allowed to ask it directly, because GAO’s job is to audit process, not to interrogate the statute Congress wrote.

Two Recommendations and a Very Small Concession

GAO’s fix is almost aggressively modest. It asked DEA to write down its roles, responsibilities, and procedures for the four ways it schedules substances. It asked FDA to write down how staff should conduct the eight factor analysis and, specifically, how to define potential for abuse, including relative to other substances. It asked FDA and NIH to update their four decade old MOU and add a clause requiring someone to look at it again periodically. That is the entire ask. Not new authority, not a change to the statute, not even a change to who decides what. Just a request that the agencies write down what they are already doing, so the next generation of staff does not have to reinvent the standard from scratch every time someone retires.

Justice and HHS both agreed to all three recommendations, which is the part of this story that should trouble anyone paying attention rather than reassure them. HHS’s written response promises FDA will draft a new policy describing how to conduct the evaluations that determine, among other things, whether someone’s fentanyl analog carries a Schedule I sentence or no sentence at all. That policy does not exist yet. It has never existed. The system that puts people in federal prison for decades has been running, by the agencies’ own account, on trained judgment and institutional memory rather than a rule anyone could read, challenge, or hold an official accountable to. GAO did not find that DEA and FDA were reaching wrong answers. It found something quieter and, in its way, more damning: nobody can say, on paper, why the right answers were right, or whether the next official asked the same question will reach the same one.

Source: U.S. Government Accountability Office, Drug Scheduling: DEA and FDA Should Strengthen Policies and Procedures for Scheduling Controlled Substances (GAO-26-108623, September 2026).
Fediverse reactions
The Million Dollar Door FEMA Never Bothered to Guard

The Threshold Was the Point

In 1988 Congress decided that FEMA’s disaster recovery apparatus was too slow, so it built a shortcut. Section 422 of the Stafford Act let the agency skip the paperwork for any “small project,” accepting an applicant’s own cost estimate instead of demanding receipts, inspections, or anything resembling scrutiny. The threshold started at $35,000. It has been raised six times since, most recently in 2022, when FEMA lifted the small project ceiling to a full $1 million, a number that would have seemed unthinkable to whoever wrote the original rule.

The logic was always the same; move fast, trust the applicant, save the field inspections for the projects big enough to matter. What nobody seems to have asked is what happens when a project is engineered to sit precisely at the line that separates “trust me” from “prove it.”

The DHS Office of Inspector General just answered that question in OIG-26-25, and the answer is not flattering. Auditors sampled 20 small projects across every FEMA region and found problems in 12 of them, questioning $3.1 million of the $8.9 million obligated (a rate that would get a private contractor blacklisted). Two projects in the sample deserve special attention, not because they were caught doing anything as crude as inventing storm damage, but because they expose the threshold itself as the vulnerability.

Exhibit One, the Bridge Built to Spec

Project number 240045, “Repair Bridge on Roy Brown Lane,” sits in FEMA Region 4. Its total project cost, as recorded in the OIG’s own appendix, is exactly $1,000,000. Not $998,000. Not $1,004,000. One million dollars, on the nose, the precise figure that separates a small project (light documentation, applicant estimates accepted at face value) from a large project (the kind that gets an actual FEMA cost review before the check is cut).

Maybe that number is coincidence. Bridges are expensive and round figures happen. But an applicant that lands its total cost exactly on a regulatory cliff edge is the textbook profile auditors call “structuring,” the same behavior banks flag when someone deposits $9,900 in cash nine days running to stay under the $10,000 reporting requirement. It does not prove intent. It does prove that the threshold, not the damage, may be doing the engineering.

Exhibit Two, the School That Cost Almost Twice the Cap

Project 173233, the Southwest Louisiana Charter College Prep site, tells a stranger story. Its total project cost was $1,873,814, comfortably inside “large project” territory. Yet it received small project treatment, and its federal cost share came out to $733,109, a reimbursement rate of roughly 39 percent. Every other project in the OIG’s twenty-project sample lands on the Stafford Act’s standard 75 or 90 percent cost share; this one does not, and nothing in the public record explains why.

Put the two exhibits together and you get a threshold operating in both directions at once. One applicant appears to have shaped its numbers downward to stay inside the light-touch lane. Another sailed nearly double the small project cap and still got waved through the same lane, at a reimbursement rate nobody else in the sample received. A door built to keep large, complicated projects out let a $1.87 million project walk straight past the guard.

The same undocumented trust shows up elsewhere in the sample, just in smaller dollar amounts. In Alabama, an applicant got $40,000 approved to install a pitched metal roof, then installed a cheaper flat, silicone-coated roof instead, after FEMA had already paid separately to remove the original roof under a different project. In New Hampshire, a town claimed storm damage to two miles of road and nine culverts; satellite imagery and an on-site inspection found damage to about a third of a mile and three culverts, a gap FEMA’s own simplified procedures were never built to catch, because simplified procedures do not ask for satellite imagery, they ask for a signature. None of that required a project engineered to a dollar figure. It only required an agency that had already decided, by policy, not to look.

It is worth noting where that guard was standing. Five of the twenty sampled projects, a quarter of the entire sample, came out of FEMA Region 6 (Louisiana and Texas), more than any other region, and Region 6 also produced three of the sample’s four utility projects, plus the levee case the OIG highlighted separately, in which a town’s claimed disaster damage predated the actual disaster by six months. A regional oversight gap is a management problem. A regional oversight gap sitting directly under the sample’s two biggest financial anomalies is a pattern.

What Twenty Projects Are Supposed to Tell Washington

The OIG’s sample was not a full census; it was 20 projects out of what is presumably thousands processed under simplified procedures since 2022. Auditors found trouble in 60 percent of what they looked at and said plainly that the full scope of wasted funds almost certainly is higher. That is not a rounding error in an otherwise sound program; that is an agency admitting its own sample size was too small to know how bad the problem actually is.

FEMA’s defenders will say the small project threshold exists because disaster survivors cannot wait for a bureaucrat to drive out and inspect a culvert while their town is still underwater, and they are not wrong. Speed matters after a hurricane. But speed and zero verification are not the same policy choice, and Congress did not authorize FEMA to accept an applicant’s word up to $1 million so that a charter school renovation could be waved through at a discount reimbursement rate nobody can explain, or so that a bridge repair could land, suspiciously, on the exact dollar that keeps it out of real review.

The OIG’s recommendations, as usual, will ask FEMA to tighten documentation requirements and improve its tracking systems. Tightened documentation is a fine start. It does not answer the harder question buried in this appendix, which is whether the $1 million line itself, the one Congress kept raising in the name of efficiency, has become less a speed limit than a target to aim for.

There is also the matter of what happens after the money is found to be wrong. FEMA has three years after a project’s completion to claw back improper payments administratively, absent evidence of fraud. That clock does not stop for a system migration, yet the same OIG report notes that FEMA closed 20 of 30 already-flagged de-obligation cases during a data migration without recovering the funds, only correcting most of them after auditors came looking, with three still unresolved as of last June. A three-year recovery window managed by an agency that loses track of its own flagged cases during a software update is not an oversight regime; it is a countdown timer nobody is watching.

None of this requires a villain. It requires only an incentive structure where the safest place for a project to live is just inside a line nobody checks, and the OIG’s twenty-project sample suggests applicants, whether by design or by drift, have found that address. Congress built the door to move money fast to towns that needed it. It did not ask what happens when the door itself becomes the destination.

Bureaucracies rarely get caught lying. They get caught doing exactly what the rules permit, at exactly the moment the rules stop looking.
Federal Register Watch: October 1, 2026
The State Department published a rule today removing Syria from the list of countries subject to a blanket denial policy under the International Traffic in Arms Regulations, shifting defense-export licensing for Syria from automatic refusal to case-by-case review.
- State Department — Syria Country Policy Revision removes Syria from ITAR’s list of countries subject to a blanket denial policy, letting license requests for defense-related exports be adjudicated case by case instead of refused automatically. The shift follows an August 19 decision to adopt a new Syria defense-trade policy after the administration determined that statutory prerequisites, including rescinding Syria’s terrorism-support designation, had been met. Because foreign-affairs rules are exempt from the Administrative Procedure Act’s notice-and-comment requirement, the change took effect the same day it was published, with no public comment period before the licensing shift took hold.
- State Department — The same day, the agency proposed a broader review of the U.S. Munitions List, the register of defense articles and technologies subject to export controls, that would remove certain items from the list, rewrite definitions, and add a new licensing exemption. The agency frames the changes as cutting regulatory burden while sharpening ITAR’s focus on the most sensitive technologies, and it is taking comments through November 30, a 60-day window that gives industry and arms-control watchers a chance to flag any items they think are being deregulated too loosely before the rule is finalized.
- Department of Homeland Security — DHS published three coordinated notices adjusting immigration-related fees for Fiscal Year 2027 under the One Big Beautiful Bill Act (H.R. 1): one covering USCIS-administered fees, one raising the fee ICE charges aliens ordered removed in absentia or apprehended between ports of entry to $5,300, and one adjusting CBP’s parole, ESTA, and EVUS fees. H.R. 1 requires these fees to be adjusted for inflation every year, so the coordinated rollout across three components is the law’s routine annual mechanics rather than a new policy choice, but the increases are still a real cost that takes effect October 16 for people moving through the immigration system.
- Federal Trade Commission — The FTC proposed a new rulemaking on impersonation of government and businesses aimed at search engines, social media platforms, and other digital marketplaces that the agency says “further” impersonation scams, a notable expansion from targeting scammers directly to targeting the platforms that carry their ads and listings. The FTC already finalized a narrower impersonation rule in 2024 covering people who pose as government agencies or businesses directly, so reopening the subject under nearly the same name is worth watching for how far the agency intends to stretch its unfair-or-deceptive-practices authority to cover platforms that did not themselves commit the impersonation. Comments are due November 30.
- Agriculture Department, Rural Business-Cooperative Service — USDA finalized a rewrite of the Rural Energy for America Program that flips the grant model: instead of applying for funding before building a project, applicants must now complete construction first and apply afterward with twelve months of documented energy production or savings data, with awards based on actual results rather than projections. USDA says the rule is exempt from standard notice-and-comment because it concerns grants, but the agency accepted comments through November 2 anyway, a short 33-day window for a rule that is already effective October 16, meaning public input arrives after the policy is locked in rather than before it. The rewrite also drops state-level competitions for a single national scoring process, which could disadvantage smaller or first-time applicants who lack the capital to build speculatively before knowing whether they will be funded.
- Nuclear Regulatory Commission — The NRC opened a four-week public notice period on an application from SMR, LLC, a Holtec International subsidiary, for a phased construction permit and limited work authorization to build two small modular reactors, Pioneer Units 1 and 2, at the former Palisades Energy Center in Michigan. A limited work authorization lets a company begin site preparation and certain construction activities before the NRC finishes reviewing the full construction permit, meaning the site could start ground work on a new reactor build while the broader licensing case is still pending, a sequencing the NRC has leaned on more often as it works to speed the nuclear buildout the administration has pushed for.
Editorial note: We screened all 112 documents published in the Federal Register on October 1, 2026, before selecting the items above. Excluded as routine: nearly thirty agency information-collection notices submitted to OMB under the Paperwork Reduction Act; a dozen antidumping and countervailing-duty preliminary determinations, five-year sunset reviews, and administrative-review initiations spanning products from air compressors to graphite electrodes; four self-regulatory-organization (stock exchange) rule filings from CME, Investors Exchange, and the Texas Stock Exchange; routine Coast Guard safety zones and special local regulations; six airworthiness directives; five FERC notices of filings and related orders; advisory-committee renewal, meeting, and nomination notices; and two correction notices to Medicare payment rules.
Fediverse reactions
A Building Cannot Be Disposed Of Until Someone Else Is Evicted First

The James V. Forrestal Federal Building has been marked for disposal twice now. The first attempt began around 2010, ran for roughly six years as a joint effort with the District of Columbia government, and was quietly terminated in 2016 without a sale. The second attempt started in earnest in 2024. As of this writing, it has produced a construction project, a proposed swap with a different federal agency, and no actual disposal.

This is what “getting rid of a building” looks like inside the federal government. It is never one transaction. It is a chain of contingent moves, each one waiting on the one before it, and Forrestal is the clearest illustration on offer.

The Wrong Size Building at the Wrong Time

Forrestal serves as headquarters for the Department of Energy, and it is enormous, about 1.8 million gross square feet, with roughly 967,000 square feet of usable space. The plan, according to a GAO report issued this month, is to move Energy into the Lyndon B. Johnson Federal Building, which currently houses the Department of Education and offers about 385,000 usable square feet. Do the arithmetic. Energy is being asked to fit an agency built for nearly a million square feet into a building less than half that size, and Energy officials have said they may need to find supplemental space elsewhere just to make the numbers work.

There’s a reason this particular move was chosen anyway. Energy’s headquarters requires a substantial footprint of Sensitive Compartmented Information Facilities, the secure spaces where classified work happens, and those aren’t rooms you rent off the shelf. A construction project is already underway to add 20,000 square feet of classified space to accommodate the move, at an estimated cost of $22 million. That’s before anyone has resolved where the current occupant of the smaller building goes.

Education’s Problem Is Now Energy’s Problem

The Department of Education occupies the Lyndon B. Johnson building today, and moving Energy in requires moving Education’s staff out first, to space that, as of August 2026, GSA has not identified. This is the part of the disposal process that rarely makes it into a press release. Selling Forrestal isn’t just a real estate transaction between the government and a buyer. It’s a relocation puzzle with at least three agencies in it, one of which hasn’t been told where it’s going yet, and the timeline for the whole sequence is described by GSA’s own officials as uncertain, contingent on investment that hasn’t been finalized.

Estimated disposal costs for Forrestal stood at roughly $300 million as of December 2025, and GAO reports that figure remains in flux nearly a year later. Costs going up over time is not a surprising feature of federal disposals. It is close to the default setting. What makes Forrestal notable is how transparently the cost estimate depends on decisions that haven’t been made yet, namely where Education goes and how much classified buildout Energy ultimately needs.

A Decade and a Half, Twice

The first Forrestal disposal effort ran from roughly 2010 to 2016 and accomplished nothing that shows up in any completed-sale column. The current effort has been underway since 2024, gained real momentum when the Public Buildings Reform Board recommended the property in May 2025, and produced its first concrete milestone, the announced relocation to the Johnson building, in March 2026. That’s fifteen years, across two separate administrations of the same idea, to get from “we should sell this building” to “here is a building we might move the tenant into, contingent on evicting somebody else.”

None of the individual actors here are behaving irrationally. Energy has a legitimate classified space requirement. GSA has to solve for Education’s relocation before it can hand Forrestal’s keys to anyone. The Public Buildings Reform Board did its job and made a recommendation on schedule. The dysfunction isn’t in any single decision. It’s in the fact that disposing of one federal building routinely requires resolving the housing needs of at least one other federal agency first, a dependency chain that the disposal process was never designed to shorten.

The Punchline Is the Timeline

Forrestal is not a story about waste, exactly, or fraud, or a single villain who mismanaged the file. It is a story about how the federal government’s real estate is load bearing in a way that makes disposal structurally slow no matter who is in charge or how much political will exists behind it. You cannot sell a headquarters building until you’ve solved for where its occupant goes, and you cannot solve for where its occupant goes until you’ve solved for where that building’s occupant goes. Fifteen years into trying to get rid of one building, the government has a construction contract, a proposed swap, and a two-step relocation problem it still hasn’t finished solving. Call it progress if you’re feeling generous. Call it the process working exactly as slowly as designed if you’re not.
The Surface Transportation Board Keeps Forgetting How to Lock Its Doors

The Surface Transportation Board regulates freight rail rates, oversees railroad mergers, and adjudicates disputes over who gets to run trains through whose backyard. It is a small, obscure independent agency that most Americans have never heard of and will never have reason to contact. It is also, according to its own contracted auditor, an agency that cannot hold onto basic cybersecurity discipline for more than twelve consecutive months.

Every year since at least 2017, the Department of Transportation’s Office of Inspector General has hired Williams Adley & Company to run STB through the federal government’s standard information security checkup, the one required by the Federal Information Security Modernization Act. Every year, the verdict has been the same word, ineffective. What makes the fiscal year 2026 report interesting is not that STB failed again. It is that STB had, for one brief shining reporting period, actually started to look like it was getting its act together, and then visibly did not.

A Small Agency’s One Good Year

To understand FY2026’s regression you first have to see the year it regressed from. The FY2025 audit reads almost warmly by federal oversight standards. Williams Adley wrote that STB “made improvements, since the previous reporting period” and closed five of nine outstanding recommendations. Identity and access management jumped to a calculated 3.67, edging into “Managed and Measurable” territory, the top tier the government considers genuinely effective. STB’s business impact analyses, the documents that are supposed to tell an agency which systems it absolutely cannot afford to lose, went from Level 3 to Level 4. Contingency plan testing for its two core systems, the General Support System and the Dynamic Case Management System, actually happened, complete with after-action reports. Management’s own response practically glowed, welcoming an audit that showed the program “continues to improve, year over year.”

None of that survived contact with FY2026.

The Metrics That Fell Off a Cliff

The new report documents four specific reporting metrics that regressed in maturity level from the prior year, not stagnated, regressed. Business impact analyses fell from Level 4 to Level 2. Contingency plan testing fell from Level 3 to Level 2, because STB simply did not run the required annual exercises for any of its three in-scope systems this time, not the General Support System, not the case management platform, not even its Amazon Web Services environment. Cybersecurity risk management strategy dropped from Level 3 to Level 2 because two of four sampled Risk Acceptance Forms, the paperwork documenting known vulnerabilities STB has formally decided to live with, expired without anyone bothering to renew, reassess, or justify them. And identity authentication for ordinary, non-privileged users cratered from Level 4 all the way to Level 2.

That last one is worth sitting with, because it is not an abstract maturity-model score, it is a paperwork failure with a name, the Personal Identity Verification exception process. STB employees are supposed to log in using PIV cards, the standard federal smart-ID credential mandated since a 2004 Bush-era directive. Some employees get exceptions, for legitimate reasons like a malfunctioning card or a pending new-hire issuance. Auditors sampled seven such exceptions. Four had no documented justification for being on the list at all. Three belonged to users who had working PIV cards and valid certificates the whole time, meaning STB’s own systems knew these people didn’t need an exception and left them on it anyway. This is not a resourcing problem in the abstract sense STB’s management response keeps invoking. It is a report nobody ran.

STB’s Own Explanation, and Its Limits

To its credit, STB does not dispute any of this. Managing Director Rachel Campbell’s response concurs with all four new recommendations and does not contest a single finding, which is more candor than some agencies manage. The explanation offered, repeated almost verbatim across domain after domain in the report, is resource constraints, budget reductions, limited personnel, competing workload demands. Auditors accepted this at face value and built it directly into the recommendation language itself, asking STB to “evaluate the impact of resource constraints” rather than simply fix the underlying control.

There is something almost structurally convenient about that framing. A recommendation to study your own resource constraints and develop an action plan is not the same as a recommendation to actually restore PIV enforcement or run a contingency test. It buys another reporting cycle. It is worth noting that STB’s Data Protection and Privacy, Configuration Management, and Incident Response domains all held roughly steady this year, meaning the agency did not lose ground everywhere, only in the specific places where somebody has to remember to do a recurring task on a calendar. Inventory maintenance stayed strong; supply chain risk management stayed flat and mediocre at Level 2 for two straight years, the one condition that has been open long enough it barely counts as news anymore.

Nine Years Is a Long Time to Draft an Architecture Document

The most damning artifact in either report is not a new finding at all. It is recommendation 2021-1, first issued in fiscal year 2021, calling on STB to develop an enterprise architecture that actually incorporates information security into its planning. It was still open in FY2025. It is still open in FY2026. STB’s own target completion date for finally addressing it is now June 30, 2029, eight years after the recommendation was written, for a document. Recommendation 2024-9, about implementing federal logging requirements, took a different and stranger path to closure: the underlying OMB memorandum it was based on got rescinded and replaced by newer guidance before STB ever complied, so Williams Adley simply marked it closed as moot. STB didn’t fix the problem. The problem changed definitions out from under it.

Put the two years side by side and the shape of the story becomes obvious. This is not an agency in crisis, and it is not an agency that has never tried. It is a small regulator with a demonstrably competent core, evidenced by real jumps in maturity when it applies itself, that cannot sustain that application from one fiscal year to the next once attention moves elsewhere. The PIV exception list did not get worse because someone at STB made a bad decision. It got worse because nobody checked it. For an agency whose entire regulatory mission rests on making sure railroads keep their paperwork current and their safety obligations honored, there is a certain grim symmetry in watching it fail the same test on itself, twice in two years, in opposite directions.
The Directive Was Binding. The Compliance Was Optional.

In December 2024, the Cybersecurity and Infrastructure Security Agency issued a directive with a name that sounds like a threat, Binding Operational Directive 25-01. It ordered the entire Federal Civilian Executive Branch, all 102 agencies under CISA’s cybersecurity umbrella, to lock down their cloud tenants against the kind of misconfiguration that let hackers walk through SolarWinds in 2020 wearing the digital equivalent of a stolen badge. CISA director Jen Easterly said at the time that the directive would help “reduce risk to the federal civilian enterprise.” The word “binding” was doing a lot of work in that sentence, because a new DHS Inspector General report (OIG-26-30, released September 21, 2026) has confirmed what the word never actually meant, which is that CISA can write the rules and cannot make anyone follow them.

The Toolbox Nobody Was Required to Open

To its credit, CISA built the thing it said it would build. Through the Secure Cloud Business Applications project, launched in 2022 in direct response to SolarWinds, the agency produced ScubaGear and ScubaGoggles, free automated tools that scan an agency’s Microsoft 365 or Google Workspace tenant and flag every deviation from a defined security baseline; blocking outdated authentication, enforcing multifactor login, protecting personally identifiable information, the greatest hits of “things a competent IT department should already be doing.” CISA ran more than 80 outreach engagements with over 1,000 participants, put the tools in front of more than 130,000 requesters, and personally walked 17 agencies through implementation. By the OIG’s own account, none of this was phoned in (BOD 25-01, Implementation Guidance).

BOD 25-01 laid out three deadlines. By February 21, 2025, agencies had to hand over a complete inventory of their cloud tenants. By April 25, they had to deploy the assessment tools and start reporting continuously. By June 20, they had to actually implement the mandatory security policies and begin continuous monitoring. Three deadlines, each one a smaller and more specific ask than the last, each one accompanied by a CISA outreach campaign, each one missed by a majority of the government it was written for.

Sixty One, Then Fifty Two, Then Eighty Six

The numbers get worse as the asks get more concrete, which is the part that should bother you. Forty of 102 agencies (39 percent) failed to even name their own cloud tenants by the first deadline, meaning nobody, not CISA, not the agency itself, could verify what needed protecting in the first place. Fifty three agencies (52 percent) had not deployed the assessment tools by the second deadline. By the third and most consequential deadline, the one requiring agencies to actually implement the security policies, 88 of 102 agencies, 86 percent of the entire FCEB, were noncompliant.

Then it stopped improving. As of February 12, 2026, eight months past the original deadline, 78 of 102 agencies, 76 percent, were still not implementing all mandatory SCuBA policies. That is not a rollout lagging behind schedule; that is a rollout that reached its ceiling and stayed there. CISA’s own report acknowledges the specific failures, agencies leaving outdated authentication procedures in place, skipping multifactor authentication, declining to implement protections for sensitive personal data, the exact configurations the SolarWinds postmortem told everyone to fix five years earlier.

A Compulsory Directive With No Compulsion Attached

Here is the part the OIG buried in a single paragraph that should have been the headline. The Federal Information Security Modernization Act of 2014 gives the Secretary of Homeland Security authority to issue these directives; it does not give the Secretary, or CISA, any mechanism to force an agency to obey one. CISA can notify OMB. CISA can log the noncompliance in the annual FISMA metrics cycle. CISA can send its Directives and Policy team to sit down with an agency’s Chief Information Security Officer and ask nicely, again. What CISA cannot do is anything that resembles enforcement in the ordinary English sense of the word, and DHS OIG has now said so in writing three separate times across sixteen years, first in 2009, again in 2010, and now in 2026, joined by a fourth outside voice in GAO-20-133, February 2020, which found that DHS did not consistently validate agencies’ self-reported compliance in the first place.

That last detail matters more than it looks like it should. An enforcement mechanism built on agencies grading their own homework was never going to survive contact with an agency that had a reason not to want a passing grade recorded. The OIG’s own data reliability check in this report found duplicate tenant submissions and mismatched agency counts between systems, discrepancies the OIG says it “reconciled,” which is a generous word for finding out the compliance numbers were built on the same self-certification honor system that produced the compliance failures in the first place.

CISA, for its part, declined to submit management comments on this report. Not a rebuttal, not a clarification, not even the standard bureaucratic paragraph about “ongoing efforts to strengthen” whatever it is agencies say when they have nothing to add. Silence, on the record, in response to a finding that the flagship tool of your flagship post-SolarWinds initiative is being ignored by seven out of ten agencies eighteen months after the deadline.

The Recommendation That Doesn’t Exist

The single strangest sentence in the entire report comes at the end of the highlights page: “This report contains no recommendations.” Not because there is nothing to fix, but because the OIG has apparently concluded there is nothing left to recommend to an agency that already knows it lacks the authority to fix the problem itself. You cannot recommend that CISA enforce compliance, because Congress never gave CISA anything to enforce with. The recommendation, if there is one, has to go to the people who wrote the Federal Information Security Modernization Act of 2014 and left the enforcement clause out, and they are not the ones reading OIG reports.

So the government spent two years building a genuinely useful set of free cybersecurity tools, distributed them to more than 130,000 people, walked federal agencies through installation by hand, and produced a compliance rate that, eight months after the deadline, sits at 24 percent. The tools work. The directive was binding in the sense that a strongly worded letter is binding. Everyone involved did their job except the one entity whose job was to make sure everyone else did theirs, and that entity does not exist, because Congress never built it. The next SolarWinds will not be stopped by a better baseline. It will be stopped, or it will not be, by whichever 24 percent happened to read the memo.

Sources: DHS Office of Inspector General, CISA’s Implementation of Binding Operational Directive 25-01 (OIG-26-30, September 21, 2026); CISA, Binding Operational Directive 25-01: Implementing Secure Practices for Cloud Services; GAO-20-133, Federal Information Security: Agencies Need to Develop and Implement Adequate Policies for Complying with New Requirements (February 2020).
Fediverse reactions
The VA Will See Your Teeth Now (If You Qualify, Which You Probably Don’t)

The Government Accountability Office has just handed Congress a report on veterans’ dental care, and the headline number is the kind of thing an agency press office loves. Eligibility for VA dental benefits jumped 70 percent from fiscal year 2020 to fiscal year 2025, climbing from about 1.38 million veterans to about 2.34 million. Read one press release off that stat and you’d think the VA had finally discovered flossing.

Read the actual report, GAO-26-108467, and the picture gets more interesting. The eligibility bump did not happen because the VA decided more veterans deserve dental care. It happened almost entirely because more veterans qualified for a 100 percent service-connected disability rating, largely a downstream effect of the 2022 PACT Act’s expanded presumptive conditions for burn pit and toxic exposure. The dental benefit didn’t get more generous. The population of catastrophically disabled veterans got bigger, and dental coverage rode along as a side effect.

Which brings us to the number nobody is putting in a headline. Even after that 70 percent surge, only 25 percent of the roughly 9.2 million veterans enrolled in VHA care are eligible for VA dental benefits at all. Three out of four veterans who trust the VA with their medical care are, dentally speaking, on their own. This is not new information (VA’s own eligibility rules have looked like a Rube Goldberg machine since the 1970s), but it is worth restating plainly every time the agency announces a percentage increase off a denominator this small.

Eligible Is Not the Same as Treated

Even the veterans who clear the eligibility bar don’t necessarily get a cleaning. GAO found that the number of eligible veterans actually using their dental benefit did double from about 420,000 in 2020 to about 870,000 in 2025. Progress, technically. But the utilization rate, the share of eligible veterans who used the benefit in a given year, only moved from 30 percent to 36 percent. Two thirds of veterans who qualify for VA dental care are still not showing up in a VA dental chair in any given year.

Why. Lead dentists in all 18 Veterans Integrated Service Networks told GAO they do not have the staffing to meet current demand, full stop, before anyone talks about expanding eligibility to a single additional veteran. Facilities in at least two VISNs reported wait times exceeding 28 days for a dental appointment. Veterans service organizations told GAO the same thing they’ve been saying for years; the wait is the barrier, not the paperwork.

For veterans who don’t qualify for free care, the VA’s answer since 2014 has been the VA Dental Insurance Program, a discounted private insurance plan veterans pay for themselves through Delta Dental or MetLife. GAO’s numbers on VADIP are the quiet embarrassment buried in Appendix III. Enrollment ran from about 55,000 veterans in FY 2020 to about 67,000 in FY 2025, consistently under 1 percent of the veterans eligible to buy in. VA officials’ own explanation, delivered to GAO with a straight face, is that most veterans have never heard of the program. A benefit that requires a subscription almost nobody signs up for is not a benefit. It’s a line item.

The Pilot Program That Nearly Died of Loneliness

If you want the most honest data point in this entire report, skip the highlights page and go to Appendix IV, on the VETSmile pilot program. Launched in July 2021, VETSmile linked veterans who lacked dental eligibility to outside dental partners, mostly university dental schools, willing to provide free or reduced-cost care. Fourteen partners signed on at launch, seven dental schools and seven federally qualified health centers.

Within about a year, 13 of those 14 partners quit. Every single partner offering care at a reduced cost walked away. What was left, from September 2022 through July 2024, nearly two full years, was one dental school, NYU, treating veterans essentially alone on behalf of the entire national program. A second partner, the University of Nebraska, finally joined in July 2024. By the time the pilot wound down in June 2026, it had delivered about 101,000 procedures to roughly 4,700 veterans, worth an estimated $14.4 million in donated care.

That’s a genuinely good outcome for the 4,700 veterans who got treated. It is also proof that VHA ran a signature access program on the goodwill of one dental school for two years and called it a pilot rather than what it actually was, which was a single point of failure with a press-friendly name.

Congress Wants to Add Heart Disease to the List

The reason GAO wrote this report at all is the Elizabeth Dole 21st Century Veterans Healthcare and Benefits Improvement Act, which directed a 2026 pilot providing dental benefits to certain veterans with heart disease, on the theory (backed by the American Heart Association, among others) that oral health and cardiovascular health are linked. GAO modeled what full expansion would look like. Extending comprehensive dental eligibility to every veteran with a diagnosis of ischemic heart disease would add about 620,000 veterans to the eligible pool, a 25 percent increase from 2.45 million to roughly 3.07 million.

VHA officials and dental providers were blunt about what that would require (more dentists and hygienists in a profession already facing a projected nationwide staffing shortage, more clinic space, longer initial treatment plans for veterans who may not have seen a dentist in years, and closer coordination between dentistry and cardiology for an older, more medically complex population). One VHA facility already sends veterans out to community providers for root canals despite having an in-house specialist, simply because the in-house clinic can’t keep up. Expansion, in other words, would not fix the capacity problem this report documents. It would stress-test it.

Meanwhile, a separate and far more sweeping bill, the Dental Care for Veterans Act, has sat in the House Committee on Veterans’ Affairs since January 2025, proposing to scrap the entire eligibility classification system and treat dental care like every other VA medical benefit, where enrolled simply means covered. GAO’s report doesn’t mention that bill, because GAO was asked a narrower question about heart disease. But read against the backdrop of a VA system that can’t staff its current 25 percent eligible population, “everyone gets dental care” reads less like reform and more like a promise the agency has no plan to keep.

None of this makes the topline number in the highlights page false. Eligibility is up 70 percent, and that’s real. It’s just not the whole mouth.

Source: U.S. Government Accountability Office, GAO-26-108467, Veterans Health Care: Information on Eligibility for and Use of Dental Benefits (September 2026).
Fediverse reactions
FDA Is Rewriting the Rulebook on Animal Testing. Congress Changed It Four Years Ago

The Food and Drug Administration announced Monday that it is updating federal regulations to make clear that drug developers can use alternatives to animal testing before medicines are tested in humans.

There is just one wrinkle.

Congress changed the underlying law nearly four years ago.

The FDA’s new direct final rule replaces regulatory references to “animal tests” and “animal studies” with broader terms such as “nonclinical tests” and “nonclinical studies.” It also removes language that the agency says could suggest animal testing is the only acceptable method for producing safety information.

The change opens the regulatory vocabulary to technologies that sound considerably more 2026 than the rules they are replacing. Those include human-cell systems, organs-on-chips, computer modeling and other New Approach Methodologies, commonly known as NAMs.

But the FDA is not suddenly abandoning animal testing. And drug companies did not wake up Monday with an authority Congress had never given them.

The statutory change dates to 2022.

Congress Got There First

The Food and Drug Omnibus Reform Act of 2022, enacted as part of the Consolidated Appropriations Act for fiscal year 2023, amended federal drug law to replace references to animal testing with the broader concept of “nonclinical tests.”

Congress also defined what that meant.

The law recognized testing conducted in vitro, in silico, in chemico and through nonhuman in vivo methods. In plain English, the statutory framework could encompass laboratory testing involving cells, computer-based modeling, chemical testing and traditional animal studies.

Animal testing remained an option. It simply stopped being the only category written into the statute.

FDA’s regulations, however, continued using older terminology.

Now, in September 2026, the agency is cleaning that up.

According to the FDA, the new rule brings its regulations into alignment with the 2022 law and removes wording that could leave developers with the impression that animal studies were the required path for generating certain safety evidence.

That distinction matters.

The FDA explicitly says the rule does not prohibit animal studies, reduce existing evidentiary standards or impose new requirements or costs on drug developers. Instead, it clarifies that validated non-animal methods can be used when appropriate for the particular drug and regulatory question.

In other words, this is less an abolition of animal testing than a regulatory vocabulary lesson four years in the making.

Why the Words Matter

Changing terminology in the Code of Federal Regulations can sound like the sort of administrative housekeeping best enjoyed with a strong cup of coffee.

But in this case, the words can have practical consequences.

Drug developers deciding how to design expensive safety studies do so within an elaborate regulatory system. If the statute says one thing while the implementing regulations continue referring specifically to animal studies, uncertainty can influence how sponsors design those studies and what evidence they believe FDA expects to see.

FDA itself acknowledges the problem.

The agency says clearer terminology and regulatory expectations can reduce avoidable uncertainty for sponsors preparing the evidence needed to begin human clinical trials.

That raises an obvious question.

If Congress broadened the statutory framework in 2022, what happened during the years in which FDA regulations continued using terminology the agency now says could suggest animal testing was the only acceptable approach?

The answer will require more than Monday’s press release.

FDA Provides 25 Places to Start Looking

Alongside the rule, FDA launched a database containing 25 examples of New Approach Methodologies already found in publicly available agency review materials.

That may ultimately prove more interesting than the terminology change itself.

The examples provide a starting point for examining how drug developers have actually used alternative testing methods and how FDA reviewers treated that evidence.

It also provides a way to begin measuring the transition rather than simply announcing one.

Which companies used NAMs? What methods did they use? Were animal studies reduced or replaced? How did FDA evaluate the alternative evidence? And how frequently were these approaches being used while the agency’s regulations still contained the older language?

Those are questions worth following.

The Rule Is Not Quite Final Yet

There is another bit of regulatory machinery still running.

FDA published the change as a direct final rule while simultaneously issuing a companion proposed rule and opening a public-comment period.

If the agency receives significant adverse comments, it says it will withdraw the direct final rule and proceed through the traditional notice-and-comment rulemaking process using the companion proposal.

If that does not happen, the updated terminology can move forward without another full round of rulemaking.

Either way, the direction is clear.

Congress changed federal law in 2022 to recognize that the evidence supporting human drug trials does not necessarily have to come from animal studies. Technology continued advancing. Drug developers began using newer methodologies. FDA has now assembled examples showing those methods in practice.

And in 2026, the regulations are finally getting new vocabulary to match.

For a regulatory system preparing to embrace organs-on-chips and sophisticated computer models, apparently one of the first modernization projects was updating the nouns.
Fediverse reactions