Healthcare.gov, the new government website designed to help Americans find and apply for health insurance plans across 36 of the 50 states (14 states have their own health insurance exchanges) hasn’t had a smooth rollout. Troubles have dogged the site from Day 1, and a recent discovery isn’t going to help matters, even if it’s just an embarrassing faux pas. British developer SpryMedia has found its own code being used on Healthcare.gov. There’s nothing intrinsically wrong with that, since the code in question is licensed under the GPL, as shown below.
But on Healthcare.gov, the aforementioned section of sript states only:
Comparisons of comments within the DataTables script by SpryMedia and the Healthcare.gov have turned up multiple instances of exact comments, so the government’s work is clearly based on SpryMedia’s. But why remove the code attribution? It turns out, there’s reason to think this may have been a genuine accident. The company that developed the website front-end, Development Seed, is devoted to open source work and passionate about giving back to both the larger world community and the programming world in particular. Companies devoted to promoting open data and universal access do not, as a rule, run about ripping off other open source contributors.
Until this week, the entire front-end of the government website was available for download on GitHub, and while it’s not clear why that repository has vanished, a great many eyeballs have been pointed at it for several weeks. The general consensus is that Healthcare.gov’s various problems and glitches have been driven by issues with the backend of the website, which was developed by other contractors, like Oracle.
Sprymedia is less-than thrilled about the discovery and has yet to receive a response, but it’s not clear who has even been manning the phones during the shutdown. Hopefully with the government reactivating, this kind of issue gets fixed immediately. It might seem a small thing, given the range of other problems, but the fact that it is a small issue means it’s also quickly and easily fixed. Proper acknowledgment of the GPL2 has proven to have teeth in court before, but this should be addressed long before that point.
Source: Hot Hardware
Even foreign governments are no match for the NSA’s reach, with documents now showing that it could read the Mexican president’s email.
The US has been snooping on the inbox belonging to former Mexican President Felipe Calderon, according to documents leaked to Der Spiegel.
The documents were leaked by whistleblower Edward Snowden and, according to Der Spiegel, reveal that in May 2010, the National Security Agency’s (NSA) Tailored Access Operations division was successful in compromising an email server within the Mexican presidential network. This would provide the NSA with access to emails from the president’s own email account, as well as those of Cabinet members who also use the same server.
The NSA is alleged to boast about the achievement in the documents, noting that it now has access to “diplomatic, economic and leadership communications”.
The issue of spying on Mexico reaches further back than the presidential office. Further documents obtained by Der Spiegel show that the department responsible for regulating drug trade and human trafficking, the Public Security Secretariat, had been similarly compromised in August 2009.
Documents as recent as April 2013 show that Mexico’s leaders were a priority target for surveillance, as well as Brazil.
Brazil’s recent announcement over the security of its email may indicate that it is aware of the US surveillance campaign against its communications, however.
The country’s President Dilma Rousseff has tasked one of its departments with creating a system to ensure its email is free from espionage attempts. She previously lashed out at the US after earlier leaked documents showed that her country was being spied on.
NSA director Keith Alexander and his deputy John Inglis are soon expected to leave the US spy agency, but the NSA denies that their departures have anything to do with the recent media attention.
It was rumored back in March that Amazon had been awarded a $600 million contract by the CIA to develop a cloud computing infrastructure for the clandestine agency. It is believed that this new infrastructure will cut costs for the CIA as it looks to build a new way to handle enormous amounts of data efficiently.
When Amazon was named as the provider, IBM moved the court to reopen bidding for the contract. IBM had concerns on the process through which the contract had been awarded to Amazon, it believed that the prices were not properly evaluated and that a contract requirement had been waived for Amazon. The effort to reopen bidding has been squashed by Amazon in court.
The hammer was laid down by Judge Thomas Wheeler of the U.S. Court of Federal Claims in Washington. IBM is obviously not happy. The company says in a statement that it is “disappointed” with the ruling made by the court and that it plans to file an appeal against this decision.
IBM goes on to say that in light of current times this decision is “especially inappropriate,” adding that IBM’s bid was superior in a number of ways while also being “substantially more cost-effective.” Amazon is yet to comment on this ruling, but it seems to be far from a victory, given that IBM is showing no signs of backing off any time soon.
The security researcher Bruce Schneier, who is now helping the Guardian newspaper review Snowden documents, suggests that more revelations are on the way.
Bruce Schneier, a cryptographer and author on security topics, last month took on a side gig: helping the Guardian newspaper pore through documents purloined from the U.S. National Security Agency by contractor Edward Snowden, lately of Moscow.
In recent months that newspaper and other media have issued a steady stream of revelations, including the vast scale at which the NSA accesses major cloud platforms, taps calls and text messages of wireless carriers, and tries to subvert encryption.
This year Schneier is also a fellow at Harvard’s Berkman Center for Internet and Society. In a conversation there with David Talbot, chief correspondent of MIT Technology Review, Schneier provided perspective on the revelations to date—and hinted that more were coming.
Continue reading by clicking the source link below.
Source: MIT Technology Review
AT&T provides the US Drug Enforcement Administration (DEA) with records of Americans’ phone calls dating back to 1987 as part of a surveillance program that goes beyond the scope of the National Security Agency’s (NSA) call collection, the New York Times reported Sunday.
Besides covering a longer time span, the program is unlike the NSA’s data collection because it “includes information on the locations of callers,” the report said.
“For at least six years, law enforcement officials working on a counternarcotics program have had routine access, using subpoenas, to an enormous AT&T database that contains the records of decades of Americans’ phone calls—parallel to but covering a far longer time than the National Security Agency’s hotly disputed collection of phone call logs,” the Times wrote. “The government pays AT&T to place its employees in drug-fighting units around the country. Those employees sit alongside Drug Enforcement Administration agents and local detectives and supply them with the phone data from as far back as 1987.”
Read More by following the source link below.
Source: Ars Technica
BlackBerry has announced today that the US Defense Information System Agency (DISA) has given both the BlackBerry Z10 and Q10 the Authority to Operate (ATO) on the Department of Defense (DoD) networks, making BlackBerry the first Mobile Device Management (MDM) to obtain an ATO. With the ATO, the DISA is prepping to support 10,000 BB10 devices by the fall and over 30,000 but the end of 2013.
Press Release below:
BlackBerry Awarded “Authority to Operate” on U.S. Department of Defense Networks
DISA deploying BlackBerry Enterprise Service 10 to support BlackBerry 10 smartphones on DoD networks
WATERLOO, ONTARIO–(Marketwired – August 08, 2013) – BlackBerry® (NASDAQ: BBRY)(TSX: BB) today announced the U.S. Defense Information System Agency (DISA) has given BlackBerry® Z10 and BlackBerry® Q10 smartphones with BlackBerry® Enterprise Service 10, the Authority to Operate (ATO) on Department of Defense (DoD) networks. BlackBerry is the first Mobile Device Management (MDM) provider to obtain an ATO.
With the ATO, DISA is now developing the infrastructure to support BlackBerry 10 smartphones. DISA is architecting the capacity to support 10,000 BlackBerry 10 smartphones by this fall and 30,000 by the end of 2013 on DoD networks.
“Being the first smartphones to be supported on U.S. Department of Defense networks further establishes BlackBerry’s proven and validated security model,” said Scott Totzke, SVP, BlackBerry Security Group at BlackBerry. “With foreign entities – governmental and criminal – ramping up attacks on electronic communications and information systems, BlackBerry provides government agencies with a proven partner that follows top-to-bottom security protocols.”
Receiving the ATO is a critical step forward in the security certification process. The approval demonstrates that BlackBerry 10 smartphones meet DoD’s most stringent security requirements. BlackBerry 10 smartphones will enable DoD personnel to have the ability to securely connect to networks and access assets from work. The BlackBerry mobile infrastructure provides a highly responsive, intelligent and intuitive mobile computing experience while ensuring the personal and the corporate information on a user’s phone are kept separate and safe.
For more information about BlackBerry 10, please visit: http://www.blackberry.com/BB10.
A legal fight over the government’s use of a secret surveillance tool has provided new insight into how the controversial tool works and the extent to which Verizon Wireless aided federal agents in using it to track a suspect.
Court documents in a case involving accused identity thief Daniel David Rigmaiden describe how the wireless provider reached out remotely to reprogram an air card the suspect was using in order to make it communicate with the government’s surveillance tool so that he could be located.
Rigmaiden, who is accused of being the ringleader or a $4 million tax fraud operation, asserts in court documents that in July 2008 Verizon surreptitiously reprogrammed his air card to make it respond to incoming voice calls from the FBI and also reconfigured it so that it would connect to a fake cell site, or stingray, that the FBI was using to track his location.
Air cards are devices that plug into a computer and use the wireless cellular networks of phone providers to connect the computer to the internet. The devices are not phones and therefore don’t have the ability to receive incoming calls, but in this case Rigmaiden asserts that Verizon reconfigured his air card to respond to surreptitious voice calls from a landline controlled by the FBI.
The FBI calls, which contacted the air card silently in the background, operated as pings to force the air card into revealing its location.
In order to do this, Verizon reprogrammed the device so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI. This allowed the FBI to position its stingray in the neighborhood where Rigmaiden resided. The stingray then “broadcast a very strong signal” to force the air card into connecting to it, instead of reconnecting to a legitimate cell tower, so that agents could then triangulate signals coming from the air card and zoom-in on Rigmaiden’s location.
To make sure the air card connected to the FBI’s simulator, Rigmaiden says that Verizon altered his air card’s Preferred Roaming List so that it would accept the FBI’s stingray as a legitimate cell site and not a rogue site, and also changed a data table on the air card designating the priority of cell sites so that the FBI’s fake site was at the top of the list.
Rigmaiden makes the assertions in a 369-page document he filed in support of a motion to suppress evidence gathered through the stingray. Rigmaiden collected information about how the stingray worked from documents obtained from the government, as well as from records obtained through FOIA requests filed by civil liberties groups and from open-source literature.
During a hearing in a US District Court in Arizona on March 28 to discuss the motion, the government did not dispute Rigmaiden’s assertions about Verizon’s activities.
The actions described by Rigmaiden are much more intrusive than previously known information about how the government uses stingrays, which are generally employed for tracking cell phones and are widely used in drug and other criminal investigations.
The government has long asserted that it doesn’t need to obtain a probable-cause warrant to use the devices because they don’t collect the content of phone calls and text messages and operate like pen-registers and trap-and-traces, collecting the equivalent of header information.
The government has conceded, however, that it needed a warrant in his case alone — because the stingray reached into his apartment remotely to locate the air card — and that the activities performed by Verizon and the FBI to locate Rigmaiden were all authorized by a court order signed by a magistrate.
The Electronic Frontier Foundation and the American Civil Liberties Union of Northern California, who have filed an amicus brief in support of Rigmaiden’s motion, maintain that the order does not qualify as a warrant and that the government withheld crucial information from the magistrate — such as identifying that the tracking device they planned to use was a stingray and that its use involved intrusive measures — thus preventing the court from properly fulfilling its oversight function.
“It shows you just how crazy the technology is, and [supports] all the more the need to explain to the court what they are doing,” says EFF Staff Attorney Hanni Fakhoury. “This is more than just [saying to Verizon] give us some records that you have sitting on your server. This is reconfiguring and changing the characteristics of the [suspect's] property, without informing the judge what’s going on.”
The secretive technology, generically known as a stingray or IMSI catcher, allows law enforcement agents to spoof a legitimate cell tower in order to trick nearby mobile phones and other wireless communication devices like air cards into connecting to the stingray instead of a phone carrier’s legitimate tower.
When devices connect, stingrays can see and record their unique ID numbers and traffic data, as well as information that points to the device’s location.
By moving the stingray around and gathering the wireless device’s signal strength from various locations in a neighborhood, authorities can pinpoint where the device is being used with much more precision than they can get through data obtained from a mobile network provider’s fixed tower location.
Use of the spy technology goes back at least 20 years. In a 2009 Utah case, an FBI agent described using a cell site emulator more than 300 times over a decade and indicated that they were used on a daily basis by U.S, Marshals, the Secret Service and other federal agencies.
The FBI used a similar device to track former hacker Kevin Mitnick in 1994, though the version used in that case was much more primitive and passive.
A 1996 Wired story about the Mitnick case called the device a Triggerfish and described it as “a technician’s device normally used for testing cell phones.” According to the story, the Triggerfish was “a rectangular box of electronics about a half a meter high controlled by a PowerBook” that was essentially “a five-channel receiver, able to monitor both sides of a conversation simultaneously.” The crude technology was hauled around in a station wagon and van. A black coaxial cable was strung out of the vehicle’s window to connect the Triggerfish to a direction-finding antenna on the vehicle’s roof, which had four antenna prongs that reached 30 centimeters into the sky.
The technology has become much sleeker and less obtrusive since then, but still operates under the same principles.
In Rigmaiden’s case, agents apparently used two devices made by a Florida-based company called Harris. One was the company’s StingRay system, which is designed to work from a vehicle driven around a neighborhood to narrow a suspect’s location to a building. Once agents tracked the signals from Rigmaiden’s air card to the Domicilio Apartments complex in Santa Clara, California, they apparently used another device made by Harris called the — a handheld system that allowed them to walk through the complex and zero-in on Rigmaiden’s air card in apartment 1122.
Although a number of companies make stingrays, including Verint, View Systems, Altron, NeoSoft, MMI, Ability, and Meganet, the Harris line of cell site emulators are the only ones that are compatible with CDMA2000-based devices. Others can track GSM/UMTS-based communications, but the Harris emulators can track CDMA2000, GSM and iDEN devices, as well as UMTS. The Harris StingRay and KingFish devices can also support three different communication standards simultaneously, without having to be reconfigured.
Rigmaiden was arrested in 2008 on charges that he was the mastermind behind an operation that involved stealing more than $4 million in refunds from the IRS by filing fraudulent tax returns. He and others are accused of using numerous fake IDs to open internet and phone accounts and using more than 175 different IP addresses around the United States to file the fake returns, which were often filed in bulk as if through an automated process. Rigmaiden has been charged with 35 counts of wire fraud, 35 counts of identify theft, one count of unauthorized computer access and two counts of mail fraud.
The surveillance of Rigmaiden began in June 2008 when agents served Verizon with a grand jury subpoena asking for data on three IP addresses that were allegedly used to electronically file some of the fraudulent tax returns. Verizon reported back that the three IP addresses were linked to an air card account registered in the name of Travis Rupard — an identity that Rigmaiden allegedly stole. The air card was identified as a UTStarcom PC5740 device that was assigned a San Francisco Bay Area phone number.
A court order was then submitted to Verizon Wireless requiring the company to provide historical cell site data on the account for the previous 30 days to determine what cell towers the air card had contacted and determine its general location. Verizon responded by supplying the government with information that included the latitude and longitude coordinates for five cell sites in San Jose and Santa Clara cities, in the heart of Silicon Valley.
In July, the government served Verizon Wireless with another court order directing the company to assist the FBI in the use and monitoring of a mobile tracking device to locate an unidentified suspect. The order directed Verizon Wireless to provide the FBI with any “technical assistance needed to ascertain the physical location of the [air card]….”
The government has
fought hard to suppress information on how it uses stingrays, but in his motion to suppress, Rigmaiden lays out in great detail how the surveillance occurred and the nature of the technical assistance Verizon provided the FBI.
On the morning of July 14, 2008, FBI Agent Killigrew created a cell tower range chart/map consisting of a street map, plotted Verizon Wireless cell site sectors belonging to cell site Nos. 268, 139, and 279, and a triangulated aircard location signature estimate represented by a shaded area. On the chart/map, the total land area collectively covered by cell site Nos. 268, 139, and 279 is approximately 105,789,264 ft2. FBI Agent Killigrew used triangulation techniques and location signature techniques to eliminate 93.9% of that 105,789,264 ft2 area resulting in the location estimate being reduced to 6,412,224 ft2 represented by the shaded area. The shaded area on the cell tower range chart covers the location of apartment No. 1122 at the Domicilio apartment complex.
On July 15, agents with the FBI, IRS and US Postal Service flew to San Jose to triangulate Rigmaiden’s location using the stingray. They worked with technical agents from the San Francisco FBI’s Wireless Intercept and Tracking Team to conduct the real-time tracking.
According to Rigmaiden, the agents drove around the cell site areas gathering information about signal range and radio frequencies for each cell site sector. “The radio frequency information was needed so that the FBI technical agents could properly configure their StingRay and KingFish for use in cell site emulator mode,” Rigmaiden writes. “By referencing a list of all the radio frequencies already in use, the FBI was able to choose an unused frequency for use by its emulated cellular network that would not interfere with the various FCC licensed cellular networks already operating in the noted area.”
The next day, Verizon Wireless surreptitiously reprogrammed Rigmaiden’s air card so that it would recognize the FBI’s stingray as a legitimate cell site and connect to it “prior to attempting connections with actual Verizon Wireless cell sites.” The FBI needed Verizon to reprogram the device because it otherwise was configured to reject rogue, unauthorized cell sites, Rigmaiden notes.
On July 16, the FBI placed 32 voice calls to the air card between 11am and 5pm. Each time the air card was notified that a call was coming in, it dropped its data connection and went into idle mode. At the same time, it sent real-time cell site location information to Verizon, which forwarded the information to the FBI’s DCS-3000 servers, part of the elaborate digital collection system the FBI operates for wiretapping and pen-registers and trap-and-traces. From the FBI’s servers, the location data was transmitted wirelessly through a VPN to the FBI’s technical agents “lurking in the streets of Santa Clara” with the StingRay.
A stingray, made by Harris Corp. Image: U.S. Patent and Trademark Office
At this point, the StingRay took over and began to broadcast its signal to force the air card — and any other wireless devices in the area — to connect to it, so that agents could zoom-in on Rigmaiden’s location.
“Because the defendant attempted to keep his aircard continuously connected to the Internet, the FBI only had a very short window of time to force the aircard to handoff its signal to the StingRay after each surreptitious voice call [and] the FBI needed to repeatedly call the aircard in order to repeatedly boot it offline over the six hours of surreptitious phone calls,” Rigmaiden writes. “Each few minute window of time that followed each denial-of-service attack (i.e., surreptitious phone call) was used by the FBI to move its StingRay, while in cell site emulator mode, to various positions until it was close enough to the aircard to force an Idle State Route Update (i.e., handoff).”
Rigmaiden maintains that once the connection was made, the StingRay wrote data to the air card to extend the connection and also began to “interrogate” the air card to get it to broadcast its location. The FBI used the Harris AmberJack antenna to deliver highly-directional precision signals to the device, and moved the StingRay around to various locations in order to triangulate the precise location of the air card inside the Domicilio Apartments complex.
According to Rigmaiden, agents also transmitted Reverse Power Control bits to his air card to get it to transmit its signals at “a higher power than it would have normally transmitted if it were accessing cellular service through an actual Verizon Wireless cell site.”
Once agents had tracked the device to the Domicilio Apartments complex, they switched out the StingRay for the handheld KingFish device to locate Rigmaiden’s apartment within the complex.
Around 1am on July 17, an FBI agent sent a text message to another FBI agent stating, “[w]e are down to an apt complex….” By 2:42 am, one of the FBI technical agents sent a text message to someone stating that they had “[f]ound the card” and that agents were “working on a plan for arrest.”
Agents still didn’t know who was in the apartment — since Rigmaiden had used an assumed identity to lease the unit — but they were able to stake out the apartment complex and engage in more traditional investigative techniques to gather more intelligence about who lived in unit 1122. On August 3, while the apartment was still under surveillance, Rigmaiden left the unit. Agents followed him a short distance until Rigmaiden caught on that he was being followed. After a brief foot chase, he was arrested.
Rigmaiden and the American Civil Liberties Union and Electronic Frontier Foundation have argued that the government did not obtain a legitimate warrant to conduct the intrusive surveillance through the stingray. They say it’s indicative of how the government has used stingrays in other cases without proper disclosure to judges about how they work, and have asked the court to suppress evidence gathered through the use of the device.
U.S. District Court Judge David Campbell is expected to rule on the motion to suppress within a few weeks.
Four years ago, Agnieszka Gaczkowska, a 29-year-old doctor and entrepreneur from Poland, was travelling through Detroit’s airport on her way to Boston when her bag was selected for random inspection. The inspection officer asked her if she had any documents with her. Exhausted after a long journey, she replied that she did not, forgetting that she had put a few outstanding bills in one of her textbooks.
Suddenly, she found herself in serious trouble. The inspection officer found the bills and accused her of “lying to a federal officer.” They held her for two hours as she was interrogated about the details of her life. The officer ordered her to turn her phone on, and then proceeded to read her e-mails, texts, and Facebook messages without her permission. She was shocked. Eventually, Gaczkowska was released, but she wondered if this was a common practice.
As it turns out – it is; thousands of people every year face a similar situation. Our government agencies have allowed themselves the right to search and seize your electronic devices with stunning impunity.
Just two weeks ago, the Department of Homeland Security quietly released a strangely worded document reaffirming their own right to search and seize your electronics without suspicion or cause, anywhere along the United States border (which they define as 100 miles in from the border – an area twice as long as Rhode Island). In reality, this is nothing new, Homeland Security been doing this since at least 2009; That’s when Secretary Napolitano put her stamp on the Bush-era practice, and promised an impact assessment within 120 days. Over two years later, it’s finally here, and it is nothing more than a poorly written press release.
Having a government official force their way into your laptop is fundamentally different from having them inspect your suitcase. Our hard drives contain personal correspondence, intimate details, deep logs of our activities, and sensitive financial or medical information. Yet we still give this less legal privacy protection than a sealed envelope with a stamp on it.
For now, the business community has figured out a way around having the government search and confiscate devices with company secrets – give their employees blank laptops, and put the important information in the cloud. This subject is much bigger than how Homeland Security does its job. There is a deeper issue here that is not going away any time soon: our electronics, and the data they hold, have become extensions of who we are.
The Fourth Amendment of the Constitution already provides us with protection against unreasonable search and seizures for people in their “persons, houses, papers, and effects” – is it time that we add “data” to this list?
The way in which we go about answering this question will have enormous ramifications for our entire legal system. Courts around the country are struggling to decide how to balance security with privacy. From school to the workplace, this question is popping up in different ways almost every day.
In the meantime, the government has accelerated their pursuit of our digital breadcrumbs. In 2011, mobile companies received a staggering 1.3 million law enforcement requests for data, including text messages and location information. It has been over 25 years since Ronald Reagan signed sweeping digital privacy protections into law. In today’s world of cloud computing and ubiquitous screens, these protections are horribly inadequate. We should not have to continue to rely on protections passed in an age where the Internet was a military project and the personal computer was just becoming a common thing.
Eventually, the Supreme Court will have to step in to settle the issue, and they are not exactly known for their technological expertise. It might not be long before we are asked at the airport whether we packed our own devices, if we were asked to bring anyone else’s files, and if we know if anyone has placed any data on our devices without our knowledge. At least then, it might seem polite; for now, they don’t even have to bother with the questions.
Technologies being developed to aid in communications between cars may be affected by the Federal Communications Commission’s plan to increase Wi-Fi spectrum.
Bands reserved since 1999 for car-to-car communication may become collateral damage in the FCC’s search for more wireless spectrum, and potentially puts the future of self-driving vehicles at risk.
A letter from automotive trade associations has been sent to FCC Chairman Julius Genachowski in protest of the plans, reports Bloomberg. Parallels were drawn with the LightSquared wireless broadband network proposal, which was at first approved by the FCC, before it was discovered that the signals affected GPS equipment. By opening nearby spectrum to other devices, the possibility of crosstalk or interference with the allocated-to-automotive bands could effectively cause an accident to occur.
The systems currently being developed allows cars at short range to communicate automatically, with data such as speeds, changes in direction, and other important details being transferred between the cars, with the ultimate goal of reducing collisions and vehicular accidents. Currently undergoing testing in Ann Arbor Michigan inside 3,000 vehicles, the technology is said by automakers to cost as little as $100 per vehicle to install, both from new and as an after-market option.
The FCC will be voting on the Wi-Fi proposal on February 20th.
The Department of Energy mismanaged millions of dollars last year when quickly doling out recovery funds for new “smart grid” projects, according to a new inspector general’s report.
The agency failed to secure proper documentation for reimbursements and allowed some recipients to falter on their cost-share responsibilities when approving 11 projects worth about $12 million, DOE Inspector General Gregory Friedman said in a report released this week.
“We found the department had not always managed the program effectively and efficiently,” Friedman wrote.
DOE has been tasked with disbursing large sums of money for new grid projects under the American Recovery and Reinvestment Act, with the aim of injecting money into the faltering economy.
The agency has distributed about $700 million to support 42 projects demonstrating new energy storage systems and advanced metering, 10 of which were only partially funded, according to the report.
After reviewing 11 smart grid projects, Friedman said, he uncovered about $12.3 million in “questionable spending.”
Specifically, DOE officials failed to provide documentation to show reimbursements were necessary or cost-effective, he said. In one case, the agency reimbursed two recipients based on estimates and not actual costs, resulting in overpayments of almost $10 million, he said. A third recipient received almost $2.4 million without showing the proper documentation, according to the report.
The agency also allowed one recipient to use $28 million worth of proceeds from a federally backed project to meet its cost-share requirement, Friedman said. Recipients cannot under federal law use federal funds or previous contributions to meet cost-share requirements, he said.
In another case, DOE awarded a recipient $14 million for a project that had already received $2 million under the Advanced Research Projects Agency-Energy program for similar work.
“In fact, the recipient, unknown to the department until our audit, had reported the same accomplishments under both awards,” Friedman said.
DOE has already recovered most of the money in question, and the agency agreed with many of Friedman’s findings in the report. But the department also rejected some of his concerns, including the assertion that the department approved $1.7 million for an energy storage project that hadn’t been built yet.
Instead, DOE said it “maintained frequent contact with the recipient and had been continually aware of the project’s progress.”
Source: Governor’s Wind Energy Coalition