Federal Reports

U.S. Customs and Border Protection (CBP) did not effectively manage and secure its mobile devices, resulting in vulnerabilities and higher susceptibility to cyberattacks, potential unauthorized access to law enforcement and operational sensitive information, and waste and abuse from under- or over-usage.  Specifically, we found that CBP did not: • Consistently implement required security settings to protect its mobile devices or mitigate risks from applications installed on these devices; • Use its mobile device management system to fully manage and secure its mobile devices; • Address software vulnerabilities within the mobile device management system; • Increase monitoring and protection for devices used outside the United States, which are at a higher risk of cyberattacks; • Perform required steps to reduce risks associated with the disposal, loss, or theft of its mobile devices; and • Monitor its mobile devices for under- or over-usage. CBP allowed mobile devices to operate without completing a security authorization process to ensure required security controls; did not establish or implement sufficient security policies and processes; relied on unclear or contradictory guidance; and did not address its increased mobile device losses.  Moreover, the Department did not provide oversight to ensure that CBP fulfilled DHS requirements for monitoring mobile devices outside the United States and CBP did not enforce its policies.   

An Amtrak coach cleaner based in New Orleans, Louisiana, signed a civil settlement agreement on September 22, 2025, with the U.S. Attorney’s Office, Eastern District of Louisiana. The employee agreed to pay $19,132.75 in restitution and a penalty of $4,497.25 related to the fraudulent receipt of a Paycheck Protection Program (PPP) loan. We found that the employee submitted an application containing false statements and information to qualify for the loan. As a result, the employee received a PPP loan in the amount of $16,452 to which she was not entitled.

Why We Did This Report

The U.S. Environmental Protection Agency Office of Inspector General has identified concerns regarding the installation and use of unauthorized software, specifically jiggler software, on EPA computers and networks. Commonly referred to as “mouse jigglers,” jiggler software simulates activity on a laptop, preventing the laptop from entering sleep mode and locking out its user. After running network scans in two EPA regions in November and December 2024, the Agency discovered 120 employees and contractors using jiggler software.

Summary of Findings

Our investigation found that jiggler software could bypass the Agency’s Windows Installer settings, that some of the EPA’s information technology specialists believed they were exempt from the policy, and that other EPA employees and contractors installed the software without authorization. Furthermore, we discovered inconsistencies in how quickly the regional offices acted to remove the jiggler software after it was detected. The installation and use of unauthorized software on EPA computers and networks represent critical cybersecurity risks and ethics violations for the Agency.

We found that DOI may have misstated its total acres by 82 percent in its FY 2023 AFR.

We found that nearly $40 million in IT-related purchase requests were incorrectly classified and did not receive appropriate IT approval as required.

Access to retail services is an important part of the Postal Service’s universal service obligation. The Postal Service relies on a network of over 31,000 facilities (“units”) where customers can conduct various retail transactions, and this network hosted over 655 million visits in fiscal year 2024. It is imperative for retail units to be accessible to customers by being open during scheduled hours and not closed for prolonged periods of time (such as suspensions).