2. The Perfect Storm: How technical complexity and classification secrecy enable fraud

The year 2025 marked a turning point in federal fiscal oversight. As the Department of Justice announced a record 6.8 billion dollars in False Claims Act recoveries, a disturbing trend emerged from the data. While healthcare fraud traditionally dominated these figures, a new contender has risen. Cybersecurity contracting is now the primary frontier for complex embezzlement. This shift is not accidental. It is the result of a structural flaw in how the government buys digital defense. Two distinct forces have converged to create an environment ripe for theft. The first is the sheer technical opacity of the deliverables. The second is the shroud of classification that prevents standard auditing.

Modern embezzlement rarely involves stealing cash from a vault. In the digital age, it looks like billing for services that never happened or selling software that does not work. The Hill ASC case from July 2025 illustrates this perfectly. The contractor agreed to pay over 14 million dollars to resolve allegations of billing fraud. They charged the General Services Administration for “highly adaptive” cybersecurity services. In reality, the firm lacked the technical qualifications to perform the work. The government paid for a digital phantom. This is the “black box” problem. Unlike a physical jet or a tank, cyber defenses are often invisible. A monitoring service or a software patch leaves no physical trace. Auditors cannot walk into a warehouse and count firewalls. Contractors exploit this intangibility. They bill for hours not worked and systems not installed.

The problem deepens when we examine the software itself. In July 2025, biotechnology giant Illumina Inc. agreed to a settlement approaching 10 million dollars. The allegations were damning. The company sold genomic sequencing systems to federal agencies while certifying they met strict safety standards. They did not. The systems contained known vulnerabilities that left sensitive data exposed. For years, the government paid a premium for security it did not receive. This is a form of procurement fraud where the complexity of the code hides the crime. Unless a dedicated team disassembles the software, the fraud remains undetected. The contractor collects the check while the agency inherits the risk.

While technical jargon blinds the auditor, classification laws blind the public. The second pillar of this fraud is secrecy. A vast portion of cyber spending occurs within the “black budget” or under classified distinct contract vehicles. Here, the phrase “national security” often functions as a shield against inquiry. The Booz Allen Hamilton settlement from July 2023 serves as the master class in this mechanic. The defense firm paid 377 million dollars to settle claims that it improperly billed commercial costs to government contracts. This method, known as cost shifting, is notoriously hard to catch in classified environments. When a budget line is Secret, few inspectors have the clearance to view it. Fewer still have the forensic accounting skills to untangle the billing codes.

The Civil Cyber Fraud Initiative, launched in 2021, has tried to pierce this veil. By 2026, it had recovered millions from contractors who failed to meet standards. The Georgia Tech Research Corporation case proved that even academic institutions are not immune. In late 2025, they paid nearly one million dollars to settle claims regarding the Astrolavos Lab. The lab handled sensitive defense data but failed to enforce basic security protocols. Worse, they submitted a false summary score to the Pentagon. They certified a level of safety that did not exist. This creates a terrifying reality. The government is not just losing money. It is relying on defenses that are nothing more than paper promises.

This convergence of technical obscurity and classified secrecy has built a sanctuary for fraud. Contractors know that their work is too complex for a general auditor to understand and too secret for the public to see. They operate in the shadows between code and clearance. As the budget for digital defense swells effectively without limit, the incentive to embezzle grows with it. The 2026 data suggests we are only seeing the surface of a deep and expensive ocean of theft.

3. Emergency Procurement: Abusing “Urgent Need” Clauses to Bypass Competitive Bidding

The Federal Acquisition Regulation, known as FAR, contains a specific provision that has become the preferred loophole for embezzlement in the cybersecurity sector. Under FAR 6.302 2, agencies may bypass the standard competitive bidding process if they can demonstrate an “unusual and compelling urgency” that would injure the government if delayed. Between 2020 and 2026, this clause shifted from a rare wartime exception to a standard operating procedure for awarding lucrative IT and defense contracts. By classifying routine network upgrades as critical national security emergencies, procurement officers and private contractors have created a protected channel for billions of dollars in federal spending to vanish with minimal oversight.

The precedent was set during the onset of the pandemic in 2020. Agencies scrambled to secure remote work environments, leading to a massive spike in sole source awards. However, while the public health crisis subsided, the procurement panic did not. In 2024 and 2025, agencies increasingly cited “AI driven threats” or “quantum decryption risks” to justify immediate, no bid contract awards. These nebulous threats provided the perfect cover. Unlike a hurricane or a physical invasion, a cyber risk is invisible and highly technical, making it difficult for auditors to challenge the validity of the “urgent need” classification.

The Mechanism of the Grift

The fraud typically operates in three stages. First, an agency identifies a critical vulnerability, often relying on vendor supplied intelligence reports that exaggerate the immediacy of the threat. Second, the agency invokes the urgency clause to award a massive contract to a “preselected” vendor, bypassing the months long competitive review that would normally scrutinize costs and capabilities. Third, the contractor delivers vague “consulting services” or “threat monitoring” with few deliverables, knowing that the contract was awarded too quickly to include strict performance benchmarks.

A striking example surfaced in late 2024 involving the Department of Justice and a major university research lab. The DOJ intervened in a False Claims Act lawsuit against the Georgia Institute of Technology. The allegations centered on the Astrolavos Lab, which held contracts worth over $31 million. The lab was accused of failing to implement basic cybersecurity protections while certifying to the DoD that they were fully compliant. This case exposed a systemic rot: contractors were billing the government for premium security compliance that did not exist, banking on the fact that the urgency of the research outweighed the rigors of an audit.

The Billion Dollar Battlefield

The scale of this abuse reached new heights in 2025. In May 2025, the Cybersecurity and Infrastructure Security Agency (CISA) was forced to cancel a procurement valued at up to $2.4 billion for its “Cyber Analytics and Data System.” The contract, intended to succeed the legacy Einstein program, became mired in controversy. Court documents revealed a bitter dispute between defense giant Leidos and a rival firm, Nightwing. The conflict stemmed from allegations that a former CISA employee had provided Leidos with unfair access to nonpublic information. While this specific case resulted in cancellation, it highlighted the chaotic environment of high stakes cyber contracting, where inside connections often trump technical merit.

By early 2026, the crackdown had begun. The newly proposed “Department of Government Efficiency” (DOGE) launched an audit initiative targeting “waste, fraud, and abuse” in 8(a) and sole source awards exceeding $20 million. This audit, announced in January 2026, specifically targeted contracts where the “urgent need” justification was used to mask poor planning or favoritism. Preliminary findings suggested that nearly 30 percent of cybersecurity “emergencies” declared in 2024 were for predictable software end of life updates that should have been managed through standard competitive channels.

The Cost of Permanent Emergency

The reliance on emergency procurement has created a paradox: the more money the federal government spends on urgent cyber defense, the less transparent the results become. When competition is removed, the market price for security services inflates artificially. Contractors charge premium rates for “rapid deployment” teams that often consist of junior staff using off the shelf tools. The retirement of ten separate CISA Emergency Directives in January 2026 signaled a desire to return to normalcy, but for many contractors, the “emergency” is too profitable to end.

7. The Pass Through Game: Prime contractors skimming margins while subcontractors do the work

The architecture of federal procurement has mutated into a tiered system of rent extraction. While the Department of Justice celebrates record recoveries, including the 6.8 billion dollar total from Fiscal Year 2025, a quieter crisis corrodes the foundation of national digital defense. This is the pass through game. In this scheme, large prime contractors win massive Indefinite Delivery Indefinite Quantity awards based on their glossy security credentials, only to farm out the actual labor to smaller entities while retaining forty to fifty percent of the revenue as a management fee. The prime contractor becomes a billing shell, effectively skimming margins while transferring the cybersecurity risk to subcontractors who often lack the budget to maintain the required controls.

This dynamic creates a perilous gap in the defense supply chain. The prime contractor certifies compliance with NIST 800 171 standards to win the bid. However, once the contract is operational, the sensitive data flows down to a subcontractor network that the prime fails to police. The Department of Justice Civil Cyber Fraud Initiative, launched in 2021, has begun to expose this specific fracture. By 2025, the initiative shifted focus from simple negligence to systemic flow down fraud, where primes knowingly misrepresent the security posture of their downstream partners.

A definitive example emerged in June 2024 involving the Emergency Rental Assistance Program. Two consulting firms settled for 11.3 million dollars after a prime contractor outsourced the development of a web portal to a subcontractor. Neither entity conducted the contractually required security testing. When the portal launched, it was immediately compromised, exposing the private data of thousands of applicants. The settlement highlighted a critical precedent: the prime contractor cannot wash its hands of liability simply by subcontracting the work. They are paid to ensure security, not just to process invoices.

The fiscal years spanning 2024 and 2026 saw an explosion of such cases. In May 2025, Raytheon and its subsidiary Nightwing agreed to pay 8.4 million dollars to resolve allegations they violated cybersecurity provisions in defense contracts. This case underscored that even defense giants are not immune when they fail to validate the integrity of their operational environments. Similarly, in September 2025, the Georgia Tech Research Corporation paid 875,000 dollars after a whistleblower revealed the organization had submitted a summary level security score of 98 to the Department of Defense. This score was allegedly based on a fictitious or virtual environment rather than the actual networks processing government data. The prime contractor in this instance provided a veneer of perfection while the underlying reality was noncompliant.

The financial mechanics drive this fraud. A prime contractor might bill the government 250 dollars per hour for a senior cybersecurity analyst. They then hire a subcontractor at 120 dollars per hour to perform the role. The remaining 130 dollars is absorbed by the prime for program management. In theory, this fee covers oversight and quality assurance. In practice, investigations reveal that primes often provide zero technical oversight. They function merely as a conduit for funds. This leaves the subcontractor, who is operating on thinner margins, to cut corners on data protection protocols like multifactor authentication or continuous monitoring.

Data from 2026 indicates that the Department of Justice is aggressively targeting this markup structure. The focus is no longer just on whether a breach occurred, but on whether the prime contractor defrauded the government by charging for security oversight they never provided. When a prime pockets half the contract value but accepts none of the operational work, the government receives half the security it paid for. As the Civil Cyber Fraud Initiative matures, the legal argument is shifting. Subcontracting is a valid business practice, but collecting a premium for security governance while allowing subcontractors to operate in the dark is now being prosecuted as a False Claims Act violation.

8. The Revolving Door: Tracking procurement officials moving to boards of winning vendors

The transition from public service to private wealth has become the defining feature of the modern federal cybersecurity complex. While traditional defense corruption involved kickbacks or padded invoices, the new frontier of federal embezzlement operates in the open. It functions through deferred compensation: the promise of a lucrative board seat or executive role awaiting officials who oversee massive contract awards. Between 2020 and 2026, this pathway evolved from a pattern into a systemic pipeline, funneling senior leaders from the Pentagon and CISA directly into the boardrooms of the very corporations they previously regulated or enriched.

The Cloud Architects

The saga of the Joint Warfighting Cloud Capability, known as JWCC, illustrates this mechanism with clarity. This nine billion dollar vehicle replaced the failed JEDI contract and dispersed funds among Amazon, Google, Microsoft, and Oracle. The officials who designed these architectures did not stay to manage them for long. Dana Deasy served as the Chief Information Officer for the Department of Defense during the critical formulation of these cloud strategies. By September 2023, Deasy had joined the board of directors for SAIC, a major defense integrator deeply embedded in federal cyber networks. His trajectory continued upward in December 2024 when Boeing appointed him as their Chief Information Digital Officer. The proprietary knowledge regarding Pentagon digital needs, acquired on the taxpayer dime, was effectively privatized and sold to vendors seeking those same contracts.

From Regulators to Advisors

The Cybersecurity and Infrastructure Security Agency, or CISA, was established to act as the nation’s risk advisor. However, its leadership roster reads like a future hiring queue for elite security firms. Chris Krebs, the first director of CISA, left government service and swiftly moved to the private sector. By 2021, he had joined the advisory board of SentinelOne, a vendor aggressively pursuing federal endpoint protection contracts. In April 2023, he began chairing the CISO Advisory Board for Rubrik, a data security firm. The message to the industry is stark: the individuals writing the rules on Monday are selling the compliance solutions on Tuesday.

Jen Easterly followed a similar path after her departure from CISA in early 2025. Despite a political controversy regarding a rescinded academic offer, the private sector wasted no time. By August 2025, Easterly had joined Huntress as an advisor. These moves create a dynamic where federal mandates for “secure by design” software conveniently align with the product roadmaps of companies employing the former mandates’ authors.

The AI Frontier

The most significant shift in this legalized embezzlement of influence occurred in 2024 with the retirement of General Paul Nakasone. As the dual commander of the NSA and US Cyber Command, Nakasone held arguably the most powerful intelligence role in the world. In June 2024, mere months after hanging up his uniform, he joined the Board of Directors at OpenAI. This move signaled the total integration of Silicon Valley artificial intelligence into the national security apparatus. OpenAI, eager to secure varied defense contracts and navigate complex safety regulations, purchased the ultimate insider guide. Nakasone does not merely bring expertise; he brings the unwritten map of the Pentagon’s future digital desires.

The Embezzlement of Trust

Chris Inglis, the former National Cyber Director who left office in 2023, provides another example. His subsequent board appointments at Semperis, Claroty, and later MITRE in 2024, demonstrate how extensive this network has become. MITRE manages federally funded research and development centers, acting as a trusted government partner. When former officials join its governance structure, the line between the government customer and the private partner dissolves completely.

This revolving door represents a form of soft embezzlement. Public officials extract value from their positions not through theft of funds, but through the theft of influence and strategic foresight. They carry the playbook of the federal government into private meetings, ensuring that specific vendors win contracts not solely on merit, but on inside alignment. As the United States spends billions on zero trust architectures and AI defense systems, the primary beneficiaries are often the architects themselves, now seated comfortably on the other side of the table.

10. Legacy Leeching: Indefinite maintenance contracts for obsolete systems that cannot be patched

The most lucrative contract in Washington is not for building something new. It is for keeping something old on life support. This practice is known as “Legacy Leeching,” a bureaucratic mechanism where contractors extract billions of dollars annually to maintain information technology systems that are functionally dead. These systems, often running on code written before the moon landing, cannot be patched against modern security threats. Yet, from 2020 to 2026, federal spending on Operations and Maintenance (O&M) for these zombies has consistently consumed roughly 80 percent of the total federal IT budget. In 2024 alone, this equated to nearly $80 billion spent not on innovation, but on stagnation.

The core of this legalized embezzlement lies in the structure of the contracts themselves. Agencies issue Indefinite Delivery, Indefinite Quantity (IDIQ) awards or sole source extensions to vendors who hold the proprietary keys to archaic infrastructure. Because the code is often obsolete (such as COBOL or Assembly), the agency becomes hostage to the vendor. The contractor has zero incentive to modernize; doing so would kill their golden goose. Instead, they bill for “extended support” or “custom security mitigation” that offers the illusion of safety for systems that are inherently insecure.

The Price of Obsolescence

A prime example of this financial drain occurred between 2020 and 2023 regarding the Windows 7 operating system. Microsoft ended standard support for Windows 7 in January 2020. However, unable to migrate their vast networks in time, federal agencies were forced to purchase Extended Security Updates (ESU). The pricing structure was designed to be punitive, doubling every year. In 2020, the cost was $25 per device. By 2022, it had surged to $100 per device. For an agency with 50,000 terminals, the cost to simply tread water jumped from $1.25 million to $5 million annually, all for an operating system that was essentially obsolete. This capital did not buy new capabilities; it merely bought a temporary stay of execution.

The Immortal Master File

The Internal Revenue Service provides the starkest case study of Legacy Leeching. Its core data repository, the Individual Master File (IMF), dates back to 1960. Written in Assembly code, a language largely unknown to modern programmers, the IMF handles the tax data of hundreds of millions of citizens. In 2024, despite decades of “modernization” initiatives, the IRS admitted it was still running the legacy IMF in parallel with newer systems. Contractors continue to bill millions annually to maintain this fragile beast. A July 2025 GAO report highlighted that of the ten most critical legacy systems identified in 2019, seven remained largely unmodernized. These seven systems ranged from 23 to 59 years in age. The vendors maintaining them face no penalty for the delay. In fact, every day the modernization stalls is another day of billable O&M revenue.

The Security Facade

The danger extends beyond wasted tax dollars. These contracts create a security theater. Contractors claim to “ring fence” these legacy systems, placing them behind firewalls to compensate for their inability to receive standard security patches. This approach failed spectacularly during the 2020 SolarWinds breach and subsequent incidents. Attackers pivoted through modern entry points to access legacy data stores that lacked internal encryption or granular access controls. The maintenance contracts rarely cover structural security upgrades because the underlying architecture cannot support them. Thus, the government pays premium rates for a service that guarantees continued vulnerability.

By 2026, the cumulative cost of maintaining just the ten most critical legacy systems identified by the GAO is projected to exceed the cost of replacing them entirely. Yet the replacement never happens. The friction of procurement, combined with the lobbying power of incumbent contractors who profit from the status quo, ensures that Legacy Leeching remains a dominant business model. Until the funding ratio flips—capping O&M spend to force modernization—billions will continue to vanish into the maintenance of digital ghosts.

11. The Fear Premium: How threat inflation is used to justify unverified budget increases

The most lucrative commodity in the federal procurement ecosystem is not software or hardware. It is panic. Between 2020 and 2026, a specific psychological mechanism took hold of the budgeting process for digital defense. This mechanism, which we term the “Fear Premium,” allows agencies and contractors to bypass standard oversight by framing every budget request as an existential necessity. When the specter of a “digital Pearl Harbor” is invoked, the normal friction of fiscal verification vanishes. The result is a sprawling landscape of unverified spending where the line between urgent security needs and opportunistic embezzlement blurs into irrelevance.

The Mechanics of Inflation

The Fear Premium operates on a simple cycle. First, an intelligence assessment or vendor report highlights a vague but catastrophic possibility, such as a complete grid shutdown or the corruption of nuclear command data. Second, this potentiality is treated as an inevitability. Finally, massive contracts are awarded to prevent this theoretical disaster, often with “indefinite delivery, indefinite quantity” structures that make auditing nearly impossible. The threat itself becomes the product.

Between 2020 and 2022, the panic surrounding the global pandemic and remote work served as the primary catalyst. Agencies rushed to secure decentralized networks, approving billions in emergency spending. While the initial need was genuine, the lack of guardrails allowed waste to fester. By 2024, the focus shifted to artificial intelligence and quantum decryption threats. The narrative remained constant: give us the funding immediately, or the infrastructure of the nation will collapse.

Case Study: The CISA Retention Incentive Failure

A stark example of this phenomenon appeared in the mismanagement of funds at the Cybersecurity and Infrastructure Security Agency (CISA). In September 2025, the Department of Homeland Security Office of Inspector General released a report detailing a severe failure in financial oversight. The audit revealed that between Fiscal Years 2020 and 2024, CISA spent over $138 million on a “Cybersecurity Retention Incentive Program” intended to keep top talent from fleeing to the private sector.

The investigation found that the agency failed to verify eligibility for these payments. Money flowed to employees who did not possess the unique qualifications required by law. The Office of Inspector General noted that CISA did not even maintain proper records of who received the payments or why. This $138 million expenditure was justified by the fear of a “talent gap” leaving the nation vulnerable, yet the funds were dispersed with the casual negligence of a slush fund. The fear of losing staff justified the spending, but no one checked if the money actually secured the necessary talent.

The Contractor Grift: Profiting from Panic

The Fear Premium also emboldens contractors to bill for services they never provide, banking on the assumption that agencies are too frightened to look closely at the details. In 2024 and 2025, the Department of Justice intervened in multiple cases under the False Claims Act that highlighted this trend.

One notable case involved the Georgia Institute of Technology. The DOJ accused the institution of failing to implement basic digital protections while fulfilling defense contracts valued at $31 million. The lawsuit alleged that the lab submitted false assessment scores to the government. They claimed to be compliant with rigorous security standards to win the contract, while in reality, they left sensitive information exposed. The government paid a premium for security that did not exist.

Similarly, in July 2025, Hill ASC Inc. agreed to pay nearly $15 million to resolve allegations that it billed federal agencies for unqualified personnel. The company had promised “highly adaptive” security services—a buzzword laden with urgency—but allegedly provided staff who lacked the required education or experience. They also billed for work that fell completely outside the scope of the contract. The urgency of the threat landscape allowed these invoices to pass through accounts payable without sufficient challenge.

The Audit Black Hole

This systemic lack of verification culminates in the colossal audit failures of the Department of Defense. In November 2024, the Pentagon failed its seventh consecutive annual audit. The agency could not fully account for its $824 billion budget. While this failure encompasses more than just digital defense, the opacity of cyber contracts plays a significant role. Tracking a missile shipment is difficult; tracking the efficacy of a “threat hunting” service or a “cloud security posture management” license is exponentially harder.

The Government Accountability Office (GAO) reported in early 2026 that the federal government continues to spend billions maintaining legacy systems that are inherently insecure, while simultaneously paying for modern “overlay” protections that fail to address the root vulnerabilities. This dual spending is the ultimate expression of the Fear Premium: paying to keep the old lights on while paying double to fearfully guard the switch.

Until the justification of “national security” is met with the same rigorous accounting standards as any other government expense, the Fear Premium will continue to serve as a convenient cover for waste, fraud, and the embezzlement of taxpayer wealth.

13. Shell Entities: The rise of fleeting cyber consultancies with opaque ownership structures

The federal procurement landscape transformed radically after 2020. As agencies rushed to modernize digital infrastructure and secure remote networks, a new predator emerged in the federal ecosystem: the hollow cyber consultancy. These entities, often incorporated only days before bidding, lack permanent staff or physical offices. They exist primarily as paperwork constructs designed to siphon contract dollars through regulatory loopholes. By 2026, investigations revealed that these opaque structures had become a primary vehicle for embezzlement, diverting billions intended for national defense into private offshore accounts.

The Anatomy of a Conduit

The mechanism is deceptively simple. A fraudster registers a limited liability company in a jurisdiction with high privacy standards, such as Delaware or Wyoming. This entity obtains federal registration codes by claiming status as a small business, often exploiting set aside programs like the 8(a) Business Development Program. On paper, the firm appears to be a legitimate minority owned or disadvantaged business. In reality, it is a shell.

Once the contract is awarded, the shell firm performs no actual work. Instead, it acts as a passive middleman. It subcontracts the entire project to a larger, nonqualified corporation or, in egregious cases, to cheap overseas labor pools, keeping a substantial cut of the funding as a “management fee.” This “pass through” fraud negates the security vetting process, as the actual workers accessing sensitive government networks are often unknown to the agency paying the bill.

The ATI Government Solutions Scandal

The scale of this deception became undeniable in late 2025 with the collapse of ATI Government Solutions. Investigators from the Small Business Administration (SBA) and the Department of Justice uncovered a sprawling network of shell companies connected to a single ownership group. ATI had secured lucrative cybersecurity contracts by leveraging its status as a tribally owned 8(a) entity, a designation that allows for sole source awards without competitive bidding.

Data released in October 2025 showed that ATI and its affiliates had absorbed more than $253 million in federal awards. Yet, federal auditors found that the firm lacked the technical staff to fulfill these obligations. Instead, ATI allegedly routed the work to unauthorized external vendors while its executives pocketed millions. The ownership structure was deliberately complex, involving layers of holding companies that obscured where the money ultimately flowed. This case was not an isolated incident but a symptom of a systemic breakdown in vendor verification.

Regulatory Blind Spots

The rise of these phantom firms was facilitated by the sheer velocity of federal spending. Between 2020 and 2024, the pressure to disperse funds for pandemic relief and subsequent infrastructure acts overwhelmed oversight bodies. Contracting officers, prioritized on speed rather than diligence, often relied on self attestation forms where vendors simply checked a box confirming their eligibility.

The consequences of this laxity came into sharp focus in January 2026. Following the ATI revelations, the SBA suspended over 1,000 contractors from the 8(a) program. The agency demanded financial records from 4,300 participants to identify other shell entities. This purge highlighted a staggering reality: a significant portion of the federal cybersecurity defense layer was being managed by companies that existed only on paper.

The Hidden Cost

Financial loss is merely the surface damage. The deeper threat lies in the compromise of federal networks. When a shell entity acts as a conduit, the government loses visibility into its supply chain. A contractor listed as a secure US based firm may unknowingly farm out code development to developers in hostile nations. The “opaque ownership” model creates an ideal entry point for espionage, allowing foreign actors to bid on and win contracts to build the very walls meant to keep them out.

By early 2026, the Department of Justice had launched a dedicated task force to dismantle these networks. However, the funds embezzled through these fleeting consultancies—estimated in the billions since 2020—remain largely unrecovered, washed through cryptocurrency and complex international banking layers that defy easy tracing.

14. The Auditor’s Gap: The lack of technical literacy within Offices of Inspectors General

The flow of federal funds into cybersecurity defense relies on a critical assumption: that the watchdogs tasked with oversight possess the vision to see where the money actually goes. For decades, the Offices of Inspectors General (OIGs) have served as the first line of defense against fraud, waste, and abuse. Their auditors are trained to track invoices, verify receipts, and follow paper trails. Yet, as the mechanism of embezzlement shifts from padded construction invoices to complex cloud computing billing and phantom software licenses, these traditional skills are proving dangerously obsolete. A forensic accountant can spot a double payment for office chairs; they are rarely equipped to determine if a million dollar contract for “advanced threat heuristics” is delivering functional code or merely vaporware.

This disparity creates what industry insiders call the “Auditor’s Gap.” It is a fundamental mismatch between the technical sophistication of the perpetrators and the digital literacy of the investigators. As federal agencies rush to modernize their networks, the oversight bodies struggle to hire staff who understand the technology they are meant to police. The private sector offers cybersecurity auditors and forensic data scientists salaries that government pay scales cannot match. Consequently, OIGs are often left attempting to audit quantum resistant encryption contracts with tools and mindsets from the dial up era.

The Unknown Workforce

The scale of this blindness was starkly illustrated in September 2025, when the Government Accountability Office (GAO) released a damning report on the federal cyber workforce. The findings revealed a systemic inability to even identify who is working on government networks. According to the data, 22 out of 23 major federal agencies reported partial or no data regarding their contractor cyber workforce. They did not know the size of the contracted staff, their specific roles, or the true cost associated with their labor.

For an embezzler, this environment is perfect. If an agency cannot confirm how many contractor employees exist, it cannot verify if they are showing up or if they are performing the work billed. A contractor can invoice the government for twenty senior security architects while employing only five junior analysts, pocketing the difference. Without the technical capacity to audit access logs or verify code commits, the OIG has no way to prove the fraud exists. The money simply vanishes into a black box of “support services.”

Case Study: The CISA Incentive Failure

The consequences of this management failure are not theoretical. In September 2025, the Department of Homeland Security OIG released an audit of the Cybersecurity and Infrastructure Security Agency (CISA). The report detailed the mismanagement of a retention incentive program designed to keep top tier talent in government. The audit found that the agency spent over $138 million between 2020 and 2024 but failed to properly manage the requirements. The result was that ineligible employees received payments totaling millions, including $1.41 million in unallowed back payments.

While this case involved direct payments to employees, it highlights a broader inability to correlate spending with technical outcomes. The OIG found that the agency did not maintain proper records of who received the incentives or why. If the primary cybersecurity agency of the United States struggles to track its own payroll incentives, the capacity of an external auditor to detect nuanced billing fraud in a third party contract is virtually nonexistent.

The Software License Shell Game

Another vector for embezzlement lies in software asset management, where lack of technical literacy allows for massive overspending on unused tools. A 2023 NASA OIG report found the space agency was spending approximately $15 million on unused software licenses. The audit described the approach to managing these assets as “decentralized and ad hoc.”

In a fraudulent context, this chaos is an opportunity. Corrupt actors can procure expensive enterprise licenses for software that is never deployed or is used by only a fraction of the claimed user base. The vendor gets paid, the insider gets a kickback, and the auditor sees a valid receipt for a software product that technically exists. Without the technical skill to query the network and verify active user sessions, the auditor sees a clean transaction where a technologist would see a crime.

The reality facing federal oversight in 2026 is that financial literacy is no longer sufficient for financial crimes. Until OIGs can deploy auditors who can read code as fluently as they read ledgers, the new frontier of cybersecurity contracting will remain a safe harbor for the sophisticated embezzler.

15. Intellectual Property Shields: Using IP clauses to prevent government code audits

The most effective tool for federal embezzlement in the modern era is not the shredded document or the offshore bank account. It is the proprietary software license. Between 2020 and 2026, a disturbing trend emerged within the defense industrial base: the use of intellectual property rights as a legal shield to block government inspectors from auditing defective code. By classifying critical cybersecurity infrastructure as “commercial off the shelf” (COTS) technology, vendors effectively legally forbade federal agencies from looking under the hood. The result was a massive transfer of taxpayer wealth to contractors for digital goods that were fundamentally broken, insecure, or nonexistent.

The Commercial Loophole

The mechanism of this fraud lies in a specific interpretation of federal acquisition regulations. Under standard commercial practices, software vendors rarely allow customers to inspect source code. When the Pentagon purchases software designated as “commercial,” it often accepts these standard restrictions. Vendors successfully argued that allowing government auditors to scan their proprietary code for vulnerabilities would constitute a violation of their trade secrets. This legal maneuver created a “black box” procurement model. The government paid billions for cybersecurity tools it was contractually prohibited from testing.

The consequences of this opacity were catastrophic. Without the ability to audit the code, federal agencies were forced to rely on “self attestation,” where the vendor simply promised they were compliant with security standards like NIST 800 171.

The False Claims Epidemic (2020 to 2026)

The reality of this embezzlement scheme came to light only through the brave actions of whistleblowers, as the government had signed away its own right to inspect the fraud. The Department of Justice Civil Cyber Fraud Initiative, launched in 2021, began to peel back the layers of this deception.

• Illumina (2025): In a landmark case revealing the danger of proprietary shields, this medical technology giant agreed to pay 9.8 million dollars to resolve allegations. The company sold genomic sequencing systems to the Pentagon and other agencies that were riddled with software vulnerabilities. Because the code was proprietary, the government could not detect these flaws during procurement. The vendor knowingly failed to patch these defects while collecting federal funds.
• Guidehouse and Nan McKay (2024): These vendors paid 11.3 million dollars after failing to perform required cybersecurity testing on software used to distribute pandemic relief funds. They delivered a product that had not been properly vetted, leading to the exposure of personal data. The “proprietary” nature of their development process allowed them to bypass scrutiny until the system failed publicly.
• Georgia Tech (2024 to 2025): This case highlighted that even academic institutions used opacity to hide negligence. The university paid settlements and faced intervention for failing to install basic antivirus tools and submitting false assessment scores for a lab conducting sensitive defense research. The lab claimed compliance in paperwork while running completely insecure systems.

The Audit Crisis

The refusal of vendors to grant “authorization and consent” for deep code audits contributed directly to the systemic failure of Department of Defense financial oversight. In November 2024, the Pentagon failed its seventh consecutive audit. A key factor in this failure was the inability to properly value or assess software assets. When auditors cannot inspect a software asset due to IP restrictions, they cannot verify its existence, its functionality, or its value.

This created a ghost inventory. The military possesses thousands of software licenses for tools that may be obsolete, nonfunctional, or compromised. Yet, because of strict IP clauses signed during the acquisition, the government pays annual maintenance fees for these “ghosts.” This is embezzlement by contract: the vendor continues to bill for a service that the customer is legally barred from verifying.

The AI Black Box

By 2026, this tactic migrated to Artificial Intelligence contracts. Vendors selling AI solutions to the intelligence community declared their model weights and training data to be supreme trade secrets. This prevented any government oversight into whether the models were biased, hallucinating, or poisoned by adversaries. The “IP Shield” thus evolved from a method of hiding bad code to a method of hiding nonfunctional intelligence tools.

The pattern is undeniable. By wrapping fraud in the protective flag of Intellectual Property rights, contractors successfully converted federal procurement into a trust based honor system. In an industry driven by profit, that honor was frequently sold to the highest bidder, leaving the American taxpayer with expensive, beautiful, and completely locked boxes full of nothing.

Section 16: Incident Response Gouging

Padding hours and rates during major breach remediations

The immediate aftermath of a federal data breach is chaos. In this confusion, a lucrative form of embezzlement has taken root. It is not the theft of funds by external hackers, but the systematic inflation of recovery costs by the very firms hired to fix the damage. This practice, known as incident response gouging, exploits the panic of government agencies to bill for unnecessary hours, unqualified staff, and phantom services. Between 2020 and 2026, as federal spending on cybersecurity surged, this mechanism became a primary vehicle for contract fraud.

The mechanism is simple. When an agency suffers a breach, standard procurement rules are often suspended to allow for an emergency response. Contractors deploy “tiger teams” to contain the threat. In this “fog of war,” billing controls vanish. Firms charge emergency rates for junior analysts who lack the required clearances or certifications. A 2025 settlement involving Hill ASC Inc offers a glimpse into this machinery. The company paid nearly fifteen million dollars to resolve allegations that it billed the government for IT personnel who lacked the mandatory experience and education. While the agency paid premium rates for expert remediation, they received novice support.

Data from the 2024 IBM Cost of a Data Breach Report illuminates the environment that enables this fraud. The average cost of a breach in the public sector rose significantly, with detection and escalation costs reaching record highs. This explosion in legitimate costs provides cover for illegitimate billing. If a remediation project is expected to cost five million dollars, a contractor can easily pad the invoice by another million without raising alarms. The urgency of the situation prevents auditors from verifying whether a specific forensic analysis took ten hours or one hundred hours.

The Department of Justice attempted to curb this behavior with the Civil Cyber Fraud Initiative, launched in 2021. This initiative utilizes the False Claims Act to penalize contractors who knowingly provide deficient cybersecurity services or misrepresent their compliance. By 2025, the DOJ had secured multiple settlements, including a massive eleven million dollar agreement with Guidehouse and Nan McKay. These firms were accused of failing to meet cybersecurity requirements for a federally funded rental assistance program. While the Guidehouse case focused on failure to secure data, it highlighted the broader culture of noncompliance where contractors prioritize speed and billing over actual contract adherence.

Another vector for gouging is the “retainer trap.” Agencies pay annual retainers to ensure rapid response. However, during the actual incident, contractors often claim the scope of work exceeds the retainer, triggering exorbitant hourly billing. In 2025, the case against MorseCorp, which settled for over four million dollars, showed how companies bill the government while failing to maintain the required security posture. The firm billed for compliant secure hosting while using noncompliant commercial vendors. This is the essence of gouging: charging for a Cadillac service while delivering a dangerous clunker.

Whistleblowers have become the only effective check against this abuse. In the Georgia Tech Research Corporation case, settled in late 2024, insiders revealed that the entity failed to install basic antivirus tools while conducting sensitive defense research. The university paid nearly one million dollars to resolve the claims. These cases prove that invoices for “cybersecurity expertise” often mask a complete lack of operational security.

As we move through 2026, the trend is shifting from simple overbilling to complex service substitution. Contractors now use automated tools to perform tasks that were previously manual, yet they continue to bill for manual labor hours. They deploy AI driven monitoring systems but charge for human eyes on glass. Without rigorous oversight and real time auditing of remediation logs, federal agencies will continue to bleed millions in taxpayer dollars to the very people hired to stop the bleeding.