Investigative Reports

The OIG investigated suspicious internet traffic discovered during an IT security audit of the computer network at the U.S. Geological Survey (USGS), Earth Resources Observation and Science (EROS) Center satellite imaging facility in Sioux Falls, SD. The audit found indications that a USGS employee’s computer was compromised and infected with malware. We sought to confirm how a compromise occurred.We found that the employee knowingly used U.S. Government computer systems to access unauthorized internet web pages. We also found that those unauthorized pages hosted malware that downloaded to the employee’s Government laptop. The malware then exploited USGS’ system; it introduced additional malicious code, reduced the Department’s ability to monitor exploits, introduced a covert channel program, and automatically connected to malicious websites in Russia. We did not find evidence that the employee intentionally introduced the malware, nor was there evidence of data exfiltration. We issued a separate Management Advisory related to this investigation discussing vulnerabilities in USGS’ IT security posture.The employee retired a day before his employment was to be terminated. We provided this report to the Director of the USGS.

The OIG investigated an allegation that a U.S. Geological Survey (USGS) contract specialist misused his assigned Government charge card.We determined that Matthew Wathen embezzled over $26,000 through unauthorized personal use of his Government charge card, including weekly lodging, monthly rental cars, dining, gasoline, vacations, and other expenses.Wathen resigned from his USGS position and pleaded guilty to one count of theft of Government funds in U.S. District Court for the Southern District of Mississippi. He was sentenced to 5 years of probation and ordered to pay restitution of $26,350.

The OIG investigated an allegation that a Bureau of Safety and Environmental Enforcement (BSEE) investigator violated Government ethics regulations by applying for a position with an oil company while he was investigating an incident involving the same company.We found that the employee notified his supervisor of his intent to apply for the position, and a BSEE ethics official provided timely guidance regarding the potential conflict of interest. The BSEE investigator never applied for a position with the oil company.

The OIG investigated allegations that a U.S. Fish and Wildlife Service (FWS) law enforcement officer stole Government property from the wildlife refuge where he was assigned, to include lawn maintenance equipment, furniture, and ammunition. The complainant also alleged that the officer’s spouse offered to sell them the stolen Government ammunition.We found no evidence that the officer stole Government property, nor did we corroborate that his spouse offered to sell Government ammunition to anyone. We reviewed refuge records and property and confirmed that no property was missing.

The OIG investigated allegations that a tribe removed approximately $11 million from the bank account of a tribally controlled school funded by the Bureau of Indian Education (BIE). We investigated whether the funds had been removed as alleged and whether the removal violated any law or regulation.We found that the tribe did remove the funds, but did not violate any law or regulation by doing so. The tribe took the funds to reimburse itself for unpaid indirect costs that had accumulated since 2001.

The OIG investigated allegations that a former National Park Service (NPS) superintendent held visitor donations in a private investment account instead of a U.S. Treasury account as required by NPS policy and may have personally benefited from the funds.We found no evidence of misuse or personal gain. We analyzed the account and found no withdrawals or transfers; all the donations remained in the account. Although holding the funds in a private investment account violated NPS policy, we found the superintendent was following procedures established by his predecessors. The NPS is in the process of transferring the funds to a U.S. Treasury account and enhancing its oversight of the funds.

The OIG investigated the alleged theft of a U.S. Treasury check paid to Cheryle Jordan for land that Jordan sold through the U.S. Department of the Interior’s (DOI’s) Land Buy-Back Program for Tribal Nations. Jordan filed a claim with the Office of Special Trustee for American Indians (OST) stating she never received the check. After Jordan filed her claim, however, the OST determined the check had been cashed.We determined Jordan falsely reported the check as stolen. Jordan admitted she mailed a false claim to fraudulently obtain a second check. She subsequently pleaded guilty in U.S. District Court for the District of Montana to mail fraud and was sentenced to 2 years’ probation.

The OIG investigated allegations that an FWS contractor falsely certified payments to the U.S. Fish and Wildlife Service (FWS) under a construction contract it held in the Southeast Region and that the contractor failed to pay a subcontractor for work performed.We found no evidence that the contractor falsely certified payments to the FWS or that it withheld payment to its subcontractor. We found that the subcontractor did not provide the contractor with timely and accurate support for its invoices and that there were legitimate delays in the contractor’s payments to the subcontractor. In an eventual settlement, the subcontractor acknowledged they had been paid in full for the work performed.

The VA Office of Inspector General (OIG) investigated an allegation that the Executive Director of the Florida National Cemetery improperly stored his personal vehicle in a garage on Long Island National Cemetery property after he transferred to Florida and asked subordinates to drive him in government vehicles to and from his residence on the Long Island National Cemetery property to the airport. The Executive Director of the Calverton National Cemetery also allegedly asked subordinates to drive him in government vehicles to and from his residence and the airport. Additionally two employees allegedly misused VA resources by taking two government vehicles from New York to training in Virginia and one extended his travel to sightsee with his spouse. The OIG did not substantiate any of these allegations.

The OIG investigated allegations that a Bureau of Land Management (BLM) manager sent pornographic images and sexually suggestive instant messages from his Government computer and personal cellphone to a subordinate employee. The complainant further alleged that the BLM manager installed cameras in the district office to monitor employees and had misused Federal money to purchase a 72-inch flat-screen television and furniture for his office. We found that the BLM manager sent sexually explicit messages to a subordinate employee from his Government computer during work hours and to two other BLM subordinate employees from his personal cellphone. All involved said the exchange of content was consensual, but the manager acknowledged that the conduct was inappropriate.We did not find that the BLM manager installed cameras to monitor employees, but he did admit that he had inappropriately used the building’s surveillance system and his Government-issued iPad to capture images of BLM employees without their knowledge.We found no evidence that the BLM manager misused Federal money to buy a television or furniture for his office.

U.S. Department of Labor Office of Inspector General Investigations Report Volume XVII: June 1 - July 31, 2018.

An Amtrak Foreman in Chicago, Illinois, was issued a letter of counseling on September 9, 2018, for providing an unauthorized written endorsement of a company vendor. The written endorsement was posted on the vendor’s website.On August 23, 2018, the vendor was issued a notice to remove the unauthorized endorsement, along with all company images and logos that had been posted to their website without permission. The vendor subsequently removed the unauthorized endorsement and images containing the company logo from their website.

An Amtrak Reservation Sales Agent resigned from employment on September 4, 2018, after the employee was prosecuted for theft of customer credit card numbers. The employee used the stolen credit card numbers to purchase items for personal use valued at over $2,100. On August 22, 2018, in the Court of Common Pleas of Philadelphia County, Pennsylvania, the employee entered into an Accelerated Rehabilitative Disposition (intervention program) agreement for 12 months. The investigation was conducted jointly with the Amtrak Police Department.