oversight

Closing documents for National Geospatial-Intelligence Agency (NGA), Office of Inspector General (OIG) investigations closed during CY 2012 - CY 2013

Published by the Department of Defense, Office of Inspector General on 2018-12-10.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

Description of document:                 Closing documents for National Geospatial-Intelligence
                                         Agency (NGA), Office of Inspector General (OIG)
                                         investigations closed during CY 2012 - CY 2013

Requested date:                          2015

Release date:                            30-July-2015

Posted date:                             10-December-2018

Source of document:                      FOIA Request
                                         NGA FOIA Program Office
                                         National Geospatial-Intelligence Agency FOIA/PA
                                         Requester Service Center
                                         7500 GEOINT Drive, MS N22-SISM
                                         Springfield, Virginia 22150-7500
                                         Fax: 571-558-3165
                                         Email: FOIANGA@nga.mil
                                         FOIA Request Form (PDF)




The governmentattic.org web site (“the site”) is noncommercial and free to the public. The site and materials
made available on the site, such as this file, are for reference only. The governmentattic.org web site and its
principals have made every effort to make this information as complete and as accurate as possible, however,
there may be mistakes and omissions, both typographical and in content. The governmentattic.org web site and
its principals shall have neither liability nor responsibility to any person or entity with respect to any loss or
damage caused, or alleged to have been caused, directly or indirectly, by the information provided on the
governmentattic.org web site or in this file. The public records published on the site were obtained from
government agencies using proper legal channels. Each document is identified as to the source. Any concerns
about the contents of the site should be directed to the agency originating the document in question.
GovernmentAttic.org is not responsible for the contents of documents published on the website.
                      NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY
                                         7500 GEOINT Drive
                                      Springfield, Virginia 22 150




U-204- 15/OIG                                                                     July 30 , 2015




SUBJECT: Freedom of Information Act Request (FOIA Case No. 20140123F)



This is in response to your request for the closing memo, final report, referral memo and Report
of Investigation closed by the National Geospatial-lntelligence Agency (NGA) , Office of
Inspector General , during the 2012 and 2013 calendar years . Please note, this request was
later amended to just a copy of the closing report during the designated time period .

Attached are copies of the closing Reports of the Investigations which were closed during the
calendar years of 2012 and 2013 which can be released under your request. Note, the
identities of any individuals who may have been identified in the report along with any
information that might identify an organization within NGA, were redacted in accordance with
FOIA exemption (3) (material exempted from disclosure by statute); specifically 10 U.S.C. § 424
(limiting the release of NGA organizational and personnel information) .

You may appeal these redactions in writing to the NGA Inspector General, the appellate
authority, within 60 days from the date of this letter. The appeal , which should reference the
above FOIA request number, may be sent to the Inspector General , National Geospatial-
lntelligence Agency , Mail Stop N75-OIGC, 7500 GEOINT Drive, Springfield , VA 22150. Please
include a copy of this letter with your appeal.

Fees associated with processing your FOIA request have been waived.

                                          Sincerely,



                                  ~
                                   r-•----1 ~~
                                         no e    Guthrie
                                 Assistant sp ctor General
                                  for Plans and Programs
                                    Initial Denial Authority


Enclosure as stated

cc:
SISCC
                 UNCLASSIFIED/




                              EXECUTIVE SUMMARY

-   CASE NUMBER: 09-054

                ed Time and Attendance Abuse and Misuse of the Shuttle Bus by a
                                            Employee




( U / - In response to the complaint, we analyzed documents, including access
con'tro1records, master time history records, time sheets, and training records pertaining
t o - during the period from 7 Decembe~2008
obtained sworn testimony from -              and
supervisor during the majority oT"tti"e"'iTmeriod un er review.
                                                                       , who was   •
                                                         throu h 6 June 2009. We also



( U - ) Our investigation deveioed evidence t h a t - committed time and
attendance fraud. Our analysis of

                 •
period under review (7 December 08 through 6 June 2009)
workplace during
                                                              •
                                     time and attendancerecords found that durini.l!!e
                                                                   was absent from•
                     scheduled tour of duty without authorization for a total of
155 hours and 24 minutes, which equated to $7,282.45.




                                                              to 17 June 2009. During this
                                                               in the U.S. Navy. -  retired
                                                                           , supporting-
UNCLASSIFIED/

            , , review this matter and consult with the
                                      and




                  ii
UNCLASSIFIED/
                   UNCLASSIFIED/




                                EXECUTIVE SUMMARY
(U)- CASE NUMBER: 10-004

(U) TITLE: Alleged Time and Attendance Abuse

(U) ALLEGATION

            An -       employee alleged time and attendance (T&A) abuse by


                      The complainant alleged that              was absent for entire days
and arrived at work late and left early without taking leave.

(U/~       According to the complainant, the behavior continued for months even after
it was brought to the attention of          supervisors,




(U/        The complainant also alleged that            spent "a lot" of government time
and resources on a personal pursuit to salvage a ship from the bottom o f -


(U) INVESTIGATION

(U/~         The investigation produced evidence that on 100 dates for the period of
24 May 2009 through 2 January 2010,                 was not present at• assigned duty
                            •
location for all of the hours    claimed on• time sheets. We found that    •    claimed
228 hours when     •   was not present for duty and did not take leave, a value of
$11,156.04. This would be in violation of 18 USC§ 287, False, Fictitious or Fraudulent
Claims; 18 USC § 1001, Fraud and False Statements; 5 CFR § 2635.101, Basic
obligation of public service; NI 1422.1R10, Work Hours and Overtime; NI 1402.1 R11,
Leave and Other Absences; and NI 1455.1 R6, Employee Adverse Action and
Discipline.

(U/~       We did not find evidence to corroborate the allegation that
         , o r • • • did not take appropriate action concerning                   T&A
abuse.




                   UNCLASSIFIED/
                  UNCLASSIFIED/

(U/        We did not substantiate the allegation that            used government time
and resources (phone) for• personal business.               testified that most of•
business was done at home. We found that               used his work phone in
accordance with NI 8470.3R8, which allowed limited use of telephones for personal
reasons.

(U) RECOMMENDATION

(U/         We recommend that the
review this report and, in coordination with the
                                  , take appropriate action.




                                             ii
                 UNCLASSIFIED/
                  UNCLASSIFIED/




                               EXECUTIVE SUMMARY

(U) -CASE NUMBER: 10-015

(U) TITLE: Alleged Misuse of the Government Purchase Card

(U) ALLEGATION



                                                            misused the GPC by charging
$21,506.40 to it for an off-site meeting, which    identified as a training expenditure.

(U) INVESTIGATION

( U / - We developed evidence that the GPC was u s ~ t a t i o n
services and customized training by            a t _ , in violation
of DoD regulations and the FAR.

(U) RECOMMENDATION

(U/        We recommend that the                  review this re ort and, in coordination
with the                        and the                                        , take
appropriate action.




                 UNCLASSIFIED/
                 UNCLASSIFIED/




                              EXECUTIVE SUMMARY

(U)- CASE NUMBER: 10-017

(U) TITLE: Alleged Time and Attendance Abuse

(U) ALLEGATION




(U) INVESTIGATION

            We developed evidence that on 80 dates from 7 June to 19 December 2009,
              violated Title 18 U.S. Code (USC)§ 287, False, Fictitious or Fraudulent
  aims;      SC § 1001, Fraud and False Statements; Title 5 Code of Federal
Regulations§ 2635.101, Basic obligation of public service; and       Instruction (NI)

87 hours and 37 minutes when
cost of $4,279.04.
                               •
1422.1R10, Work Hours and Overtime. On those dates
                                    was not present for uty an
                                                                       claimed a total of
                                                                I not take leave, a



( U / - We also found that
                          •
the start and conclusion of  activity
NI 6200.1 R9, Wellness Program.
                                        in   t e
                                                   did not alwa s re ort to    supervisor at
                                                                              , as required by


( U / - Our investigation disclosed evidence t h a t - may have violated
the ~nancial Management Regulation, which r e ~ w h o approve time
and attendance to ensure that recorded work schedules are true, correct, and accurate
to the best of their knowledge. In addition, the regulation stipulates that time and
attendance data shall reflect a proper and accurate accounting of an employee's actual
time, attendance, and leave.

( U / - Based on witness testimony that T&A recording rules were not enforced, we
conciudedthat internal T&A management controls in PVX were inadequate.




                 UNCLASSIFIED/
                  UNCLASSIFIED/

( U / - We did not find evidence to c o r r o ~ a t i o n t h a t - did
not 'ta'keaction after having been informed o f - T&A abuse.

(U) RECOMMENDATION

( U / - We recommend that the
reviewttiis' re ort and, in coordination wit t e
                                   , take appropriate action.




                                              ii
                  UNCLASSIFIED/
                  UNCLASSIFIED/




                                EXECUTIVE SUMMARY

(U)-CASE NUMBER: 10-018

(U) TITLE: Alleged Time and Attendance Abuse

(U) ALLEGATIONS




           The complainant alleged that                 was absent for entire days and
arrived at work late and left early without taking leave. The behavior continued for
months even after it was brought to the attention of                first-line supervisor,




(U) INVESTIGATION



claimed on                      •
                    was not present at
                time sheets.
                                       •
           We developed evidence that on 82 dates from 21 June to 23 December

                                                                                   • •
                                           assigned duty location for all of the hours
                                claimed 143 hours and 12 minutes of time when          was
not present for duty and did not take leave, a value of $6,994.04.

(U/-                        provided sworn testimony that                     approved his


meetings were not relevant to
                                                 •
leave and absences from the workplace to attend monthly meetings of professional
organizations. But                     testified that    did not authorize the leave, as the
                                                   duties~ s i b i l i t i e s . -
said the investigation was already underway when . . . . . s o u g h t ~
that               had approval to be absent from work without requesting leave to
attend the meetings.                        testimony would indicate that
violated 18 USC 1001 by making a false statement under oath and attempted to
interfere with an official investigation in violation of NI 1455.1 R6.

( U / ~ l y , the investigation found that                    authorized 22 hours of
l e a ~ could shop for, prepare food for, and clean up after an office
party-a cost of $1,074.48 to the government. This authorization appeared to have
violated 31 USC § 1301 (a), the "necessary expense doctrine" which states:



  I I       I I         I   I



                  UNCLASSIFIED/
                   UNCLASSIFIED/

       (U) Appropriations shall be applied only to the objects for which the
       appropriations were made except as otherwise by law.

( U / - The time off did not appear to bear a logical relationship to the purpose of
the appropriation nor were party preparation and cleanup mission-related functions for
which general appropriations were available.

( U / - Based on the testimony from all interviewees, the internal controls of .
were inadequate in all aspects of T&A management.

            We did not find evidence to corroborate the allegation concerning


(U) RECOMMENDATION

( U / - We recommend that the
review this report and, in coordination with the
                                  , take appropriate action.




                                                ii
                  UNCLASSIFIED/
                 UNCLASSIFIED//




                             EXECUTIVE SUMMARY

(U)-CASE NUMBER: 10-027

(U) TITLE: Alleged Time and Attendance Abuse

(U) ALLEGATION




(U) INVESTIGATION




( U / - ) We developed evidence that-violated 18 USC§ 287, False,
Fictitious or Fraudulent Claims; 18 USC § 1001, Fraud and False Statements; 5 CFR


•
Overtime.
   claime
                                         •
§ 2635.101, Basic obligation of public service; and NI 1422.1R10, Work Hours and
                        was not present at    assigned duty location for all of the hours
                    time sheets from 13 September 2009 to 14 February 2010. We found

•
that             claimed 51.90 hours or 51 hours and 54 minutes of time worked when
   was not present for duty and did not take leave; the claims included 10.75 hours or
10 hours and 45 minutes in overtime. The total value of this unworked time was
$2,194.85.


when][finished
Wellness Program.
                 •
( U / - ) Our investi ation also found that               did not report to• supervisor
                                                  actIvIty, as required by ffl 6200.1 R9,


(U) RECOMMENDATION

(U/                                              review this re ort and in coordination
with the                                                                      take
appropriate action.




                 UNCLASSIFIED//
                      UNCLASSIFIED/




                                     EXECUTIVE SUMMARY

(U) -      CASE NUMBER: 10-033

(U) TITLE: Time and Attendance Fraud by a
Employee




attendance fraud from 3 March 2009 to 15 March 2010.

(U/           The investigation developed evidence to support a finding that
                    was not present at.assigned duty location for 1,644.77 hours from
3 March 2009 through 8 April 2011. 1        claimed this time on. time sheets and
received $63,333.58 in salary for it but was not charged any leave. According to the
evidence, on multiple occasions during the period under review -                  did not
physically enter any     1111facility. - could not provide e v i d e n c ~ d any
of this time.

             During the investigation, we developed evidence that
                                      , failed to adhere to the approving official's
responsibilities listed in the DoD Financial Management Regulation, volume 8, chapter
2,   ,m
      020102 (B); 020208 (A), (8), and (D); 020401; and 020402 (A), by signing and
approving inaccurate time sheets for                      , including times when -   did not
enter an   1111 building.

(U/                                                , review this report and, in coordination
with the                                      and the                             , take
appropriate action to include recoupment of funds, or leave, or both from
                 . We also recommend that the -                  take appropriate action with
                        failure to fulfill .supervisory responsibilities of ensuring that
                  accurately recorded         time and attendance.




1
  The initial complaint a g a i n s t - - w a s made for the period March 2009 to March 2010. As a result of
i n f o r m a t i o n - ~ interview, we broadened the scope of the investigation through 8
April 2011.
(U




                     UNCLASSIFIED/
                               UNCLASSIFIED/




                                                                      SEP 1 9 1011

MEMORANDUM FOR

ATTENTION:

SUBJECT:                  (U) Referral of Report of Investigation -         Case Number
                          10-035)

               The
                recently completed an investigation into an allegation
             I yee, received dual educational benefits from both the
                 and the                                       for the same courses, in violation
of 38 USC§ 3681 (a)(2). We developed evidence that the subject violated statutory limitations
governing veterans' education benefits. The allegation was initially filed with the Department of
Defense Inspector General Hotline, and we prepared the enclosed report of investigation in
response to their request. We are forwarding our report, along with the following items gathered
by us, to your office for your information and action as appropriate:




                                         dates from 4 February 2008 through 28 March 201 O.

2. ( U / - I also wish to express my appreciation to your office in connection with

-           receipt of•
your support of our investigation by providing us with records and other information pertaining to
                           educational benefits.

3. (U) If you have questions or require additional information, please contact




Enclosures
As stated




                   UNCLASSIFIED/
                       UNCLASSIFIED/




                                    EXECUTIVE SUMMARY

    -   CASE NUMBER: 10-039

    (U} TITLE: Alleged Time and Attendance Fraud

    (U) ALLEGATION




    (U) INVESTIGATION

( U / - Our investigation determined that for the 80-day period of 3 January-
24 April 2010, -              had no official work schedule, was consistently tardy to work,
and consistently left work early. We found that over 25 workdays, there were 78. 71
hours at issue, at a total compensation cost of $4,645. 1 On 22 workdays, -
was not in                for the total required ~ular workhours. We found no leave,

that    •was not at  •
travel, or training records that would explain• absences. -
                        workstation during the hours at issue.
                                                                          did not dispute


( U / - - and                supervisor disagreed on                  start time. •
supervisor testified that         worked an eight-hour day from 0900 to 1730, but
-           said
We determined that
                   •  had   pervisor's verbal approval to arrive anytime before 1000.
                              was scheduled to work a straight eight-hour work shift,
Monday through Friday from 0900 to 1730, in keeping with 1111 policy.

                       consistently arrived afterlllll core hours had begun at 0900.
(U/- -
During the period under review,      •                       •
                                    arrived late more than 96 percent of the time,
according to access control records, which recorded      entry time on 60 of the 80 days.
On 34 of the 60 days, he arrived at 1000 or later.

(U/- -
recorcfs.11 left work early on all 22 workdays when        •
                            consistently left work before 1730. According to access control
                                                            exit times were recorded. He

1
  (U/-We calculated the total compensation cost by multiplying- hourly pay rate by the
total hours at issue (78.71 hours X $59.02 = $4,645). The total compensation cost ($4,645) was rounded
to the nearest dollar.




                    UNCLASSIFIED/
                      UNCLASSIFIED/

       •                                  Ill
                         • •
  said     left to conduct research for      at the Library of Congress, local university
                            2
  libraries, or bookstores.     could not provide verification and we could not determine
  by other means that       was at those locations.

  ( U / - In addition, we found t h a - was paid for working three days in

 -
  February 201 0 when he was away w ~ . The evidence demonstrated that
              did not follow   1111
                                  policy requirements to justify      •
                                                                   absence from 3 through

 -            advised that    • •
  5 February 201 O under NI 1402.1 R11, "Leave and Other Absences." In testimony,
                              and      family w ~ c o n d home located in West

 •
 Virginia from 03 through 05 February 2010. -                signed time sheet, certified by
     supervisor, for the pay period 31 January through 13 February 201 0 showed eight
 hours regular time for 03 February 2010, eight hours sick leave for 04 February 2010,
 and four hours sick leave and four hours administrative leave for 05 February 2010.
               -Master Time History showed t h a t - was credited with 24
 regular hours worked for 03 through 05 February 2010.

( U / - - thought there should be an
 or Approved Absence" attached to       •
                                       timesheet indicating
leave for 03 through 05 February 2010. We found no
                                                                     , "Request for Leave
                                                                  took three days of sick
                                                                        for the pay period
 31 January through 13 February 201 0 and                    supervisor could not recall


-        was not aware of     •
could not explain the differences between        •
w h e t h e r - requested sick leave for 03 through 05 February 2010.
                                                 time sheet and the
                               responsibilities to report time accounting errors, and rarely
reviewed .leave and earning statements to ensure that there were no errors
regarding     time and attendance.

(U) RECOMMENDATION

( U / - We recommend that the
review this report and in coordination with the
                            take action deemed appropriate.




:t (U) The Library of Congress, Geography and Map Reading Room located in the James Madison
Memorial, Madison Building, hours of operation are from 0830 through 1700, Monday through Friday
except for Federal Holidays.

                                                 ii
                   UNCLASSIFIED/
                       UNCLASSIFIED/




                                                                              JUL 2 0 2012

MEMORANDUM FOR

SUBJECT:                 (U) Time and Attendance Abuse and Misuse of Government
                         Computer, -         Case Number 10-041

1. ( U / - Your office referred a matter to us in October 2010 involving a .
employee assigned to          offices at   Headquarters and           facilities in the area.
The employee is
                                                                    and        allegedly was
involved in time and attendance abuse and computer misuse. We provided your
investigator access control records for  1111facilities prior to October 2010 for the
period in 2009 that your office was reviewing.

2. ( U / - We looked at time and attendance records, access control records, and
1111 computer system records for the period of 3 January 2010 to 4 June 2011 and did
not identify any abuse or misuse b y - for that period. Since you found issues
with -          time and attendance and use of Sametime software for an earlier period,
we are referring the case back to your office for action. We are enclosing spreadsheets
showing the results of our data analysis and the methods used to determine those
results. Since -         is working in an  1111 organization and facility, we request that
you provide us information regarding any action taken against-·

3. ( U / - We appreciate the opportunity to work with your staff and look forward to
doing so in the future. Should If ou have uestions or require additional information,
please contact                                                                     , at




Enclosures
as stated




                  UNCLASSIFIED/_R _
                                  UNCLASSIFIED/


                              Case 10-041, -     Time and Attendance Analysis

(U/        Th                                       conducted an analysis of
(employee number          time and attendance records for the period of 01 Jan 2010 through 01 Jun
2011. Based on. timesheets and access control records,
the time period analyzed.
                                                            •••  was on an 8-hour schedule during


   1.    (U/       Compensation -We obtained the following information regarding
         compensation from        . We divided the annual salary by 2,087 to get the hourly rate.

                Date              Action
          01/03/2010         Pay Rate Change
          01/03/2010         Pay Rate Change
          01/02/2011         Pay Rate Change
          06/19/2011           Data Change
          01/01/2012         Pay Rate Change

   2.   (U/        Timesheets -We reviewed               timesheets from the. for pay period
        201002 (03 Jan 2010 -16 Jan 2010) through pay period 2011012 (22 May 2011- 04 Jun 2011);
        however, time sheets were missing for the following pay periods: 201104 (30 Jan 2011-12 Feb
        2011), 201105 (13 Feb 2011- 26 Feb 2011), and 201106 (27 Feb 2011-12 Mar 2011).
        Therefore, we used the. analysis spreadsheet provided by. to get the time worked during
        those pay periods.

   3.    (U/        Travel - We searched the                              for           local and TOY
        vouchers. • did not have any TOY vouchers during the specified timeframe of the analysis .
        •    had one local voucher during the specified timeframe. The voucher was for I-days of
        parking costs during a training session on 24-25 February 2010. We gave
        full 8-hour day on these two days.
                                                                                 •••       credit for a



   4.   ( U / - Training-We searched the--raining Summary f o r - training
        records. According to the - - r a i n i n g Summary, all of the training that          I
        attended during the specified timeframe of analysis was computer-based training, which would
        have been completed during the normal work day. Therefore, no adjustments to the time and
        analysis spreadsheet were made to account for time out of the office due to training reported in


  5.    (U/                                       -We obtained- data (badge reader data) from the
        following locations. This data was used to calculate the total hours   worked per day .
        •    work day should include. mandatory and uncompensated half-hour meal break for time
        worked over 6 hours.


           a.                  • - • provided a spreadsheet that noted            access records for
                 •     locations.

           b.    (U/                     - We downloaded- data from -            Bethesda locations
                 from the 2010 and 2011 Microsoft Access databases for the specified time period.


                                                    1
                                 UNCLASSIFIED/
                              UNCLASSIFIED/




         c.   ( U / - - - W e downloaded. data from -                              locations from
              the 2010 and 2011 Microsoft Access databases for the specified time period.

        d.                                              We downloaded- data from-
                                      location from the 2010 and 2011 Microsoft Access databases for
              the specified time period. (Note: Due to a badge reader system error, 2 0 1 0 -
              -          data was only available from 31 October - 31 December 2010.)




        f.    ( U / - Adjustments-• data lacked formal building exit records for the following
              dates (04/06/10, 11/08/10, 12/16/10, 03/16/11, and 05/19/11) and adjustments were
              made to give credit for a complete work day.

        g.    ( U / - Other Notes - The analysis generally includes only the initial entry and final
              exit records. I f - traveled from one -         location to another during. work
              day, we gave. credit as time worked. On the following dates (08/04/10, 08/30/10,
              09/09/10, 09/15/10, 09/20/10, and 09/29/10)- had large amounts of time with
              no badge reader activity during the work day. For these dates, we did not include the
              missing time as time worked, and therefore, there are. entry records and. exit
              records.

6. (U/          Early Release Dates and Excused Absences -We included the following known early
   releases on the time and attendance spreadsheets. I - w a s in the office, we gave.
   credit for the early release to equal a complete 8-hour day. I f . didn't have any badge reader
   data for the date, we did not give credit for the early release.

                 Date             Source                               Hours
                01/15/10          NGA (MLI< Day)                       4
                02/05/10          CIA (Fed Gov't closed: weather)      4
                02/08-11/10       CIA (Fed Gov't closed: weather)      32
                05/28/10          NGA (Memorial Day)                   4
                07/02/10          NGA (4 th of July)                   4
                09/03/10          NGA (Labor Day)                      4
                11/24/10          NGA (Thanksgiving)                   4
                12/23/10          NGA (Christmas)                      4
                12/30/10          NGA (New Year's Day)                 4
                01/14/11          NGA (MLK Day)                        4
                05/27/11          NGA (Memorial Day)                   4

7. ( U / - Calendar- We did not r e v i e w - calendar to conduct this analysis.



(U) Prepared by:

                                                2
                             UNCLASSIFIED/
                  UNCLASSIFIED/




                              EXECUTIVE SUMMARY

-       CASE NUMBER: 10-064

(U) TITLE: Misuse of Position for Financial Gain and Postemployment Restrictions

(U) ALLEGATIONS

(U/-The                                           received a complaint on 3 September
2010, regarding

                                  The complaint resulted in two allegations involving


                  That •   violated Title 18 U.S.C. § 208 when. was employed by
                  egotiated an agreement between    11111 and .future employer,


    2. (U/-That        • violated 18 U.S.C. § 207 by contacting
       advocafelll interests after • retired.
                                                                  11111 employees to

( U / - Investigators uncovered a third allegation during the investigation when they
found e-mails of a sexual nature sent on the   network between               and

                     . This use of the     network violated
8470.3R8, Electronic Mail and Other Electronic Communications.

(U) INVESTIGATION

( U / - We developed evidence to support a finding that                    violated
18 U.S.C. § 208 while •    was employed bylllll and negotiated an
                                 •
                     position with     future employar, Investigators found that after

employm~nt,   •
          created a financial interest with- through
                 acted in an official capacity as an
between ~ n d ~ Specifically, -
                                                              negotiation for future
                                                            employee to promote a contract

as  •                                              testified t h a t - appointed.
      point of contact for an Office of Government Ethics waiver of the one-year
postgovernment service restriction and a n . memorandum of agreement. In addition,




                  UNCLASSIFIED/
                  UNCLASSIFIED/

48 e-mails between                  officials, and -  officials demonstrated that while
          was still employed at
       participated "personally and substantially" in
         with . .
                                                     •
                                     and had established a financial relationship with
                                                        official capacity to implement


( U / - Investigators also developed evidence t h a t - had official,

following•   retirement frornllllll when •
nonpersonnel contact with ~mployees within the one-year restricted period

                                                                              ••
                                             was employed by . . It should be noted,
however, that this contact, involving the 2010 analytic review, was initiated by

an••
employees and did not appear to be a contact b y - seeking official action from

207(c).
          employee on behalf of . . or any other person, as required under 18 U.S.C. §


             We presented the potential violations of 18 U.S.C. § 207(c) and§ 208 to the
                                                                                      '
and were advised that the case did not satisfy the "specific-intent" requirements needed
for criminal prosecution under the statutes.

( U / - Our investigation provided evidence t h a t - and -                    violated
NI 8470.3R8, Electronic Mail and Other Electronic Communications, which states that
unauthorized use may subject the individual to criminal sanctions or other administrative
adverse or disciplinary action.

(U) RECOMMENDATION

                                                         and                      , the
                                                    , the
                                  for information and any action deemed appropriate.




                                             ii
                  UNCLASSIFIED/
                  UNCLASSIFIED/




                              EXECUTIVE SUMMARY

(U) -    CASE NUMBER: 11-007

(U) TITLE: Misuse of Government Resources (Vehicle)




                                         , drove a government vehicle assigned to
team in              , for            I use from April 2009 through October 2010. The
complainant alleged that               made daily personal use of the government van
from home to work and back.

{U) INVESTIGATION

( U / - Our investigation developed clear evidence that                    violated
provisions of 31 USC§ 1344, DoD Directive 4500.36-R, and NI 4500.9R9, by using a
government vehicle for a nonofficial pur oses. Our investigator obtained testimony from
Ill   witnesses who directly observed
commute on numerous occasions between
                                         •      residence and •
                                                     use the government vehicle to
                                                                  official duty location.
Additionally,             confirmed that
                                                  •
                                            understood the rules concerning the use of
government vehicles, and provided testimony that       used the government vehicle for
~ convenience on numerous occasions without any supervisory approval.
-
supplies between the commissary and
so was wrong and "over-the-line."
                                       •   place of residence, and that•
              also confessed to using the government vehicle to transport personal party
                                                                             knew doing


(U) RECOMMENDATION

            We recommend that the               review this report and, in coordination
with the                            and the                                   , take
appropriate action. We request that the             please notify the      of any
administrative action taken in response to               conduct as described above.
We specifically request that you describe how the action taken conforms or fails to
conform to the statutory requirements of 31 U.S.C. § 1349.




                 UNCLASSIFIED/
                  UNCLASSIFIED/




                               EXECUTIVE SUMMARY

(U) -    CASE NUMBER: 11-015




-
(U) TITLE: Time and Attendance Abuse and Violation of the




(U) INVESTIGATION

( U / - We developed evidence that                         violated        Instruction (NI)
6200.1 R9, when ~iled to adhere to requirements of the
-         by limiti~ participation to one hour a day three days a week. Our evidence
resulted from our analysis of                     access control records, time and
attendance records, computer log-on and log-off records, and testimony. We also found
that                violated this NI by failing to notify. immediate supervisor when
•    departed for and returned from -          activity.

(U) OTHER MATTERS
( U / - During the investigation, we developed evidence that
management failed to adhere to requirements in the
limiting. participation to one hour a day three days a week.
supervisors also violated this NI by failing to require
before and after -        activity.




                  UNCLASSIFIED/
                      UNCLASSIFIED//




                                EXECUTIVE SUMMARY

(U) -    CASE NUMBER: 11-018

(U) TITLE: Misuse of Government Travel Charge Card

(U) ALLEGATION




violated the terms of use        government travel charge card
airline tickets with it when    was not in an official travel status.

(U) INVESTIGATION



                               •• •-
 ( U / - ) - t admitted and we developed corroborating evidence
t h a t ~ l a ~ e of
5 and 23 July 2010, when
paid for these purchases from
                              was not on'omcial travel.      •
                                               by purchasin~~ith it on
                                                            - t promptly
                                   personal funds; however, the expenses were incurred

regard to •-
in violation of 41 CFR § 301-51.6. We did not find other infractions of regulations with
                     use.                        ·

(U) RECOMMENDATION

( U / - ) We recommend that the
review"'t1iT's re ort and, in coordination wit t e
                               , take any action deeme




                                                         '                       '
            ~                                      m             ~
                  .                                                                   '




                      UNCLASSIFIED//
                   UNCLASSIFIED/




                       REPORT OF PRELIMINARY INQUIRY


(U) -    CASE NUMBER: 11-028

(U) SUBJECT




(U) ALLEGATIONS

1. ( U / - Misuse o f - privileges 1

2. ( U / - Abuse of authority

(U) BACKGROUND

           On 31 March 2011, the
                                   referred this matter to the
                                  e complaint on 28 March 2011 from an anonymous


complainant alleged that
                                                         •
                                         had been "stirring the pot," trying to pit the people
                                                             against one another. The
                                          had been using information in -               to
create animosity by giving out salary information so people knew others' salaries.
             allegedly had also been telling employees that. knew some of them
were not technically qualified for promotion, performance raises, or assignments they
received. The source also alleged that                  forwarded e-mails sent t o . but
edited them or removed context to frame people in a bad light.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

   •    (U) Title 5 U.S. Code§ 552a, The Privacy Act of 1974, states:

           (U) Records maintained on individuals

             (U) (i) Criminal penalties



1. ( U / - - i s - human resources database.




                  UNCLASSIFIED/
              UNCLASSIFIED/

          (1) Any officer or employee of an agency, who by virtue of his
          employment or official position, has possession of, or access to, agency
          records which contain individually identifiable information the disclosure of
          which is prohibited by this section or by rules or regulations established
          thereunder, and who knowing that disclosure of the specific material is so
          prohibited, willfully disclose the material in any manner to any person or
          agency not entitled to receive it, shall be guilty of a misdemeanor and
          fined not more than $5,000.

          (3) Any person who knowingly and willfully requests or obtains any record
          concerning an individual from an agency under false pretenses shall be
          guilty of a misdemeanor and fined not more than $5,000.

•   (U) 5 Code of Federal Regulations § 2635.702, Use of Public Office for
    Private Gain, states:

          (a) Inducement or coercion of benefits. An employee shall not use or
          permit the use of.a   Government position or title or any authority
          associated with --public office in a manner that is intended to coerce or
          induce another person, including a subordinate, to provide any benefit,
          financial or otherwise to -     or to friends, relatives, or persons with
          whom the employee is affiliated in a nongovernmental capacity.

          (d) Performance of official duties affecting a private interest. To ensure
          that the performance of his official duties does not give rise to an
          appearance of use of public office for private gain or giving preferential

          of a friend, relative or person with whom
          nongovernmental capacity.
                                                   •
          treatment, an employee whose duties would affect the financial interests
                                                         is affiliated in a


•   (U) . . Instruction 5500.7R9      ,r 7.i., DoD Privacy Program Implementation,
    states:

      Penalties. The Privacy Act makes it a misdemeanor subject to maximum fine
      of $5,000 to knowingly and willfully request or obtain any record concerning
      an individual under false pretenses. The Act also establishes similar penalties
      for violations of the Privacy Act by . . employees.

•   (U) Human Development Information System(s) Privileged Users
    Acknowledgement

•   (U) AO/PAR Manage Positions Desk Guide, July 2005, . . Privacy Act
    Rules of Conduct




             UNCLASSIFIED/
                  UNCLASSIFIED/

(U) ALLEGATION 1

(U) Facts




                                    search to determine if             had permission
       to access                    manner described in the complaint and to find out if
       •  could access                 searches for the past six months.

   •   ( U / - On 13 April 2011, in a preliminary response
       20 November 2006,               supervisor,




  •    (U/-                   re orted that neither the              nor
       role would provide             access to employees' salaries, although those
       roles would have enabled     to enter monetary and nonmonetary awards and
                           I
       approve awards for and the

  •    ( U / - Furthermore, if
       during the
       panel or review board,      would have seen salary information for the entire pay
       pool or organization; that would have been outside of the -           framework,
       however.

  •    ( U / - On 6 June 2011,
       inquiry into
                                                 provided an e-mail summarizing
                                              use.              had -
                                                                                  •
                        status, meaning that. could access some components of
                    be ond
                             and a                  for•.
                               own self-service capabilities. -  had full privileges as an


                 -            stated there was a record o f - accessing
                  since the 2005 time frame but no record ~ g queries that
       revealed employee salaries.

  •    (U/- -                 stated thatl analysis of                log-in history
       since January 2005 indicated that   followed a fairly consistent pattern of
                  access that w o ~ of a user with regular self-service and
                            and-roles.

  •    ( U / - There was no indication that                  accessed awards or salary
       data of other employees.



                 UNCLASSIFIED/
               UNCLASSIFIED/

                        testified:

                               is presently   •
•   ( U / - In 2006. was also part of             •
                                                  staff that was responsible for
    maintaining training and travel records, personnel actions, and all of the human
    resources requirements through           , so    assigned. as the lead in these
    areas and granted • access to

•   ~              had duties as the compensation workbench operator in
    ~ ran the spreadsheet. Accordingly, •  had access to the salary
    information for all of the employees and knew what awards they received.

•   (U/-                     had not heard of                      providing employee's
    salary information to other employees in the office.




                             and                  told                of the -    complaint.
                   denied abusing                        privileges and creating a hostile
    environment.

                             stated  •did not know i f - had used
               to gather information about other e m p ~ a i d
    would not do that.

                       testified:

                     was the                              in -      and. supervisor was


•   (U/- -           described. responsibilities as managing, monitoring inbound
    and outbound personnel, transfer of personnel from one organization to another,
    releasing agency opportunity notice -      information, processing . . packets,
                              planning, movements of_~II -       organizations from
    the various locations to    , and maintaining the ~rformance
    management systems.




              UNCLASSIFIED/
                  UNCLASSIFIED/

   •   (U/,..                    said. had not abused· -privileges to
       ascertain the salaries of the employees and had not misused those privileges to
       determine who was qualified or unqualified for promotion within their office.

   •   (U/,..                   denied spreading -          information to other
       employees in

(U) Conclusions

( U / - Based on the information obtained during the preliminary i n q ~ n d
no evidence to substantiate t h ~ that                 misused· -
authority while performing·- duties.

(U) Recommendation

( U / - Recommend no further investigative work on this matter and that this inquiry
be closed.

(U) ALLEGATION 2

(U) Facts

                         testified:

   •   ( U / ~ 2011, -              told. that someone from the -   told
       - ~ w a ~ have been creating a hostile environment by
       accessing information in - and using it to create animosity.

   •   (U/~The complaint also alleged that                 had been giving out
       salary information, so people knew who was making more money than they
       were.

   •   (U/-                     allegedly had also been telling the employees that.
       knew some of them were not technically qualified for promotion, performance
       raises, or assignments they received.




                                          •
                                 stated that and
                      attention and. denied abusing
                                                                  ht these concerns to
                                                                       privileges and
       creating a hostile environment.




                 UNCLASSIFIED/
               UNCLASSIFIED/


•   (U/-                     explained that               had been employed in their
    office as a contractor employee with                                  before
    accepting a government position.

•   (U/-After
    the office includi
                                  accepted   • government position, several people in
                                     , questioned whether   •
                                                           was qualified for the
    position, and               was outspoken about it.


                                           and
                                   preferential treatment, which caused some


•   ( U / - During this time                  said   would ask ~ d o
    something and               would respond that     could not b e c a u ~
    ~ wanted           o do something else.               said that scenario would
    "drive              crazy."              would say, "Why do we have contractors
    out here that have a job, have a function, and we can't get them to do what
    they're supposed to do?"

•   (U/-
    governmen
                              testified that after - was selected for
                                          process~age and submitted the
                                                                            •
    package to                      for signature.

                 At that time. could have seen the job announcement and
                   resume and viewed the findings of the selection panel; however,
                  did not know i f . reviewed these documents.

•   (U/-                     stated  •  had no knowledge that
    editing e-mails to frame others in the office in a bad light.
                                                                            was


•   (LI/-                     said nobody complained t o . about an e-mail being
    changed.

•   (U/-                   described              as being "very straightforward"
    and often coming across as "condescending" to others.

•   (U/-       •   said an area where
    ability to communicate.
                                                    needed to improve was.
                                           communicated well enough to get -1ob
    done, but. needed to work on            communication.

•   (U/-                     said in -   view everything was "black or
    white"; there were no gray a r e a ~




               UNCLASSIFIED/
                  UNCLASSIFIED/

   •   (U/
       would ask                 a question during a staff meetin and
       sound condescending or combative. After the meeting,
       of the others would tell •   that              was out of hand and
       to talk t o -




                         testified:

   •   (U/- -          did not edit any e-mails of others in an attempt to frame them in
       a bad light.

   •   (U/-                    said the allegation was not true that. was not
       performing   · duties and was too busy trying to find out what others were doing
       s o . could complain to management.

(U) Conclusions

( U / - Based on the information obtained durin            reliminary inquiry, we found
no evidence to substantiate the alle ation that             abused •     authority while
performing • duties as the

(U) Recommendation

( U / - Recommend no further investigative work on this matter and that this inquiry
be closed.




                  UNCLASSIFIED/
                    UNCLASSIFIED/

                                                                                            NOV 2 S 20\l
MEMORANDUM FOR

SUBJECT:                (U) Referral of Time and Attendance Analysis,
                        -       Case Number 11-031

1. (U/111111 The                                           has completed a prelimina
of an allegation that                                     ged in time and attendance
abuse from 01 Janu



2. (U/111111 Our analysis o f - access control records, T&A documents, and
training and travel records for the period referenced above revealed a discrepancy of 19 hours
and 09 minutes, worth $1,315.59                    ). The analysis disclosed the amount of time
that-claimed on.T&A records, compared with the amount of time we could
confirm i n d ~ that              was present at ~l>signed duty location. The value of the
hours that . . . . . did not work falls below t ~ $5,000 threshold for pursuing a T&A
fraud investigation.

3. (U/111111 We are providing this information for your review and action as you deem
appropriate. We did not interview -            o r . immediate supervisor or conduct any
further inquiry regarding the T&A discrepancy. We recommend that you ensure that -
and. supervisor have the opportunity to provide input regarding the matter. Should you
determine that disci linar action is appropriate, we recommend that you coordinate the action
with the                             Please consider recouping any funds paid to -
when

4. (U) Please furnish us with a report of action taken or planned within
of this memorandum. A tasking was established in -
                                                                        •    days of your receipt
                                                                to track the suspense.

                        ou have questions or require additional information, please contact




Enclosure
As stated




                   UNCLASSIFIED/
                  UNCLASSIFIED/


                                                                                    JAN 2 3 2012

                      REPORT OF PRELIMINARY INQUIRY

(U)- CASE NUMBER: 11-048

(U) SUBJECT




(U) ALLEGATION

(U) Computer Misuse

(U) BACKGROUND



         , who reported that             spent hours on the Internet at work.
          stated that the behavior h a d ~on for some time, even before.
became a supervisor. -    alleged that -            made extensive use of the "Home
Shopping Guide" and printed pages of material after surfing the Web.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

   •   (U) Title 5 Code of Federal Regulations§ 2635.702, Use of public office for
       private gain

   •   (U)Ill   Instruction (NI) 8470.2R8 7 (c) (1), Internet Use, 9 December
       2009, states:

          (U) Employees are authorized limited personal use of network resources and
          use of an -          e-mail address for electronic communications. Personal
          use of the Internet resources should not adversely affect the performance of
          official duties, should be of reasonable duration and frequency, and whenever
          possible, made during the employee's break time such as after duty hours or
          lunch periods.




                 UNCLASSIFIED/
                   UNCLASSIFIED/



(U/--
(U) FACTS



  • (U/-- became
                          testified:

                                                  supervisor in March 2011, but has known
      •    since 2004.

  •   Everyone who had sat next to            or supervised •   complained about
      the amount of time. spent on the Internet, although no one had said anything
      about it before.

  •   (U/- -             estimated that               spent five or six hours online on any
      given day.

  •   -  stated that                   was "always" on the phone placing orders from.
      computer shopping.

  •   (U/- -                  said to the best o f . knowledge no one had addressed
      the Internet usage with               . Prior to March 2011 •    and
      were coworkers, so                   supervisor at that time would have been
      responsible for addressing the issue with



                                 did not want to pursue the matter but finally advised   to
      report it.




  ••     conducted an analysis of
      computer network for the period of 1 April 2010 - 30 May 2010.

  ••     concluded that               had used •       Ill
                                                        for personal use to include
      shopping online and printing documents; however, there were no signs of the
      misuse or excessive use t h a t - reported.

(U) CONCLUSIONS

           We did not find sufficient evidence to substantiate the allegation that
            misused the    Ill  computer system by spending hours at a time on the
              supervisor reported.



                                              2
                   UNCLASSIFIED/
                UNCLASSIFIED/

(U) RECOMMENDATION

( U / - Recommend no further investigative work on this matter and that this inquiry
be closed.




                UNCLASSIFIED/
                  UNCLASSIFIED/




                                EXECUTIVE SUMMARY


(U) -    CASE NUMBER: 11-052

(U) TITLE: Alleged Violation of Intelligence Oversight Regulations

(U-)The
allegation that
community utilizing
an


( U - ) A report of investigation prepared by the                                   and
provided to the -    contained an admission by           that, while in    official
position,•   used a government computer to capture a screen shot of       community,
print the image, and download the image onto a thumb drive.

residence. -         also stated that•                                      •
                                                                        subsequently
took the printed image and the thumb drive, which contained the image, to
                                       destroyed the thumb drive and the printed
image.


•
( U - ) We found that -

-
                                   committed an intelligence oversight violation when
  collected domestic imagery that was not necessary to conduct a function assigned to
      as required by DoD Directive 5240.1 R.




                 UNCLASSIFIED/
                  UNCLASSIFIED/

                                                                              1   2 DEC 20H



                                                                             1111-
MEMORANDUM FOR

SUBJECT:                (U) Report of Unused Telecommunication Circuit at
                                            Case Number 11-056

                                                              received an email alleging
                                                      whose path was completed by
                                                      ary 2007, and whose commercial
path was completed on 8 May 2007.                                                  , has
been waiting for an approval letter from the                                      since
02 August 2010.11111 paid $4,339 a month for 51 months (1 May 2007 to 15 July 2011)
a total of $221,144, waiting for the accreditation of the circuit.

2. ( U / - This is the -           complaint that we have received about
an unused telecommunication circuit
                                                                 Please address the
allegation about the circuit forwarded above and review           circuit use to determine
if the Agency is paying for other circuits that are not being used.

3. (U) We request that you take appropriate action to address these issue and furnish
us with a report of any action taken or planned within 30 days of your receipt of this
memorandum. An -               tasker was opened to track the suspense.

                                  uestions or require additional information, please

                                                                                       staff,




Enclosure
As stated




                  UNCLASSIFIED/
                  UNCLASSIFIED/

                                                                                NOV     5 2010
MEMORANE>UM FOR

SUBJECT:


REFERENCE:               (U) Report of Unused Telecommunication Circuit at      11111

              The following reply is in response to
                                    I                                       ,dated 30
August 2010.     has conducted a thorough analysis of the claim and has concluded that
the claim submitted to the Defense Hotline is accurate.  Ihas taken immediate steps to
                               I
remedy the situation. Further, has taken several significant steps in the last five
months to improve the efficiency of its telecommunications activities. Details of the
steps taken as related to the subject inquiry are below.

2. ( U / - . l n April 2010, . . established the
realigning former Telecommunications Certifying Official activities over to the
                           , so that the appropriate oversights could be applied toward
this agency's transport infrastructure.


                                     d the
                                      by which unused or underutilized circuits would be
identified and either discontinued or combined with other existing operational
requirements currently in place to reduce the agency's telecommunications expenses.

4. ( U / - On 21 June 2010, the program manager for the subject circuit- was
informed that the circuit had been identified as a candidate for disconnection and that
the subject circuit would be processed for disconnect on 21 July 2010. As stated within
~                                                                            .~
program manager was afforded a rebuttal opportunity. The following is an excerpt from
the disconnect notification provided to the program manager:

     "There has been no activity on this circuit for over 10 years. Further investigation
     reveals that the affiliated hardware supporting this circuit has never been
     accredited and that components of this system may be substandard to the
                               architectural minimum requirements. The monthly recurring
     charges for this circuit are $1,135.00. A total of $136,200.00 has been expended
     on this circuit since its inception on 9 March 1999."




                 UNCLASSIFIED/
                    UNCLASSIFIED/




SUBJECT:


            On 6 July 2010, the program manager responded to the -
                          expressing a desire to provide a response to the 21 June
2010 communication.

6. ( U / - O n 12 July 2010, the circuit- program manager briefed the
circumstances surrounding the delay in this circuit becoming operational. The program
manager stated that the circuit connection had been delayed because of accreditation
issues. It was at this forum the program manager agreed to the disconnection of the
subject circuit.

7. ( U / - O n 13 July 2010, circuit-was added to the                              ·
-       and awaiting further disposition. This disposition included the execution of an
engineering order, the updating to configuration management documentation and
removal from all baseline documentation, review of supporting hardware that may need
to be terminated or relocated, and the subsequent creation of a circuit disconnect order.

8. (U//FOUO) On 1 September 2010, a disconnect order for circuit- was submitted
through the                                            order entry process,
                                                   and
                                      and has seen been disconnected.

6.(U/-                               is committed to provide fiscal accountability on all
transport-related activities.




                   UNCLASSIFIED/
               UNCLASSIFIED/




                           EXECUTIVE SUMMARY

-   CASE NUMBER: 11-058

(U) TITLE: Harassment and Hazing

(U) ALLEGATIONS

                                                         - -,            ·- .
                    , who reported that   was being harassed and hazed by




                                                                        --   ..-


(U) INVESTIGATION

                           did not develop evidence which showed that -
                                           did not develop evidence which showed
                                         during their deployment.

(U) RECOMMENDATION

(U/,..) Provide the -            a copy of this report for information purposes.




               UNCLASSIFIED/
12 August 2011

MEMORANDUM FOR THE RECORD

SUBJECT: DoD IG Hotline Issue regarding. and -

   On 21 July, 2011, I met with                                               , concerning a hotline
                                                        . The complainant stated that
was attending meetings with                        and was involved in issues outside of those
associated w i t h · - assignment a t - . The complainant also stated t h a t _
mistreated •  staff, and that members of the front office staff had all left.

  -           stated that  •wife had recently started doing work for- as part o f · - assignment
because o f . Congressional Affairs background a t .    •  stated that- wanted to use. expertise
on t h e - issue since there will be significant Congressional interaction i n - .         •
acknowledged that  •--           agreement has not been amended and that t h e - workforce
may not be aware of these new duties.  •           •
                                           said that   had replaced much of the I              staff
                                                                •
because they had been in those staff jobs much too long and that wanted the staff to operate at a
much faster pace.

   Later in the day, I attended a meeting with -       and             , the new
They agreed that t h e - must be updated and that          needs to publicize their- activities
and personnel. -              also noted that tasking o - must come from -         and not from        •
-         I noted t h a t - must be very careful that any workplace interactions with -       be
totally above board because the workforce is watching.

  On 26 July, I met with                              and -           to review the.
Ill and discuss chain of command issues.
                                  We were surprised to learn that               was with
the                and n.ot between. a n d - . -                  a n d - discussed
ways to ensure t h a - remained totally within the- chain of command and how to reflect
thatinthe-

   On 28 July, I discussed this matter with t h e - · • was concerned about the terms of
the- and was surprised to learn that the existing. was not with. a s . had been told . •
stated that. would discuss this w i t h - ·

  On 29 J u l y , _ informed me that t h e - had put a hold on having t h e -
amended to include-work until~ spoke w i t h -
                      UNCLASSIFIED/




                                 EXECUTIVE SUMMARY

 (U) . .CASE NUMBER: 11-061

 (U) TITLE: Misuse of Official Position and Possession of a Firearm in an      11111 Facility



             The -
                  own admission that      used  •
                       investigation produced evidence through witness testimony and
                                                                 credentials in violation of


                                                                              • •11111
      SOP 0013 (6)(d)(4) to identify          as a                         during a traffic
stop on 15 August 2011. Specificall ,                  testified that     did not use
-
ffiafSprovided    • Ill
              credentials to identify       as an
                            credential case that contained
officer on at least one occasion when stopped for speeding.
                                                                        , but    admitted
                                                                driver's license to the


(U,..) The voluntary search of
tha~ought a personal firearm on the
testimony provide evidence that
                                                    installation. This action and
                                                    violated 11111412 (6)(e).
                                                                                  •
                                                          vehicle on 25 August 2011 revealed
                                                                                   own


 (U
that
                      •was not truthful d u r ~ ~ with                                •
               Testimony and the search results also provide evidence to support a finding
                                                                                       .

••
initially testified that   did not m i s u s e • - cred
     personal firearm onto the          installation. However,
                                                                      i I

                                                                              •
                                                                                 never brought
                                                                               later admitted
that      gave the
license, and the search of
the11111    installation.
                                   an
                                  vehicle revealed that            •
                                                     credential case containing
                                                       •      brought
                                                                                    driver's
                                                                          personal firearm onto


(U/                                                 review this report and, in coordination
with the                                     and the                             , take
appropriate action.




                  UNCLASSIFIED/
                       UNCLASSIFIED/



MEMORANDUM FOR

SUBJECT:                 (U) Referral of Time and Attendance Analysis,
                         -       Case Number 11-062

1. (U/-The
of an allegation tha

may have engaged in time and attendance (T&A) abuse from 01 April through 17 June 2011.

2. ( U / - Our analysis of                   access control records, T&A documents, and
training and travel records for the       f renced above revealed a discrepancy of 75 hours
and 43 minutes, worth $3,845.05                   The analysis disclosed the amount of time
that -             claimed o ~ T&A records, compared with the amount of time we could
confirm independently that  .-Was   present a t . a3ned duty location. The value of the
hours t h a t - did not work falls below the- $5,000 threshold for pursuing a T&A
fraud investigation.

3. ( U / - We are providing this information for your review and action as you deem
appropriate. We did not i n t e r v i e w - o r . immediate supervisor o ~
further inquiry regarding the T&A discrepancy. We recommend ensuring that . . . . . . and
•    supervisor have the opportunity to provide input regarding the matter. Should you
determine that disciplinary action is appropriate, we recommend that you coordinate the action
with the                                   and the                            . Please consider
recouping any funds paid to                when       was not present for duty.

4. (U) Please furnish us with a report of action taken or planned within 30 days of your receipt
of this memorandum. A tasking was established in -              to track the suspense.

                                                 uire additional information, please contact
                                                                       at




Enclosure
As stated




                   UNCLASSIFIED/
                             Unclassified



27 October 2011

Memorandum for File

On 14 Sep 2011 at approximately 1400,

                                          met with me in the       spaces.             had
called and left a voice message earlier in the day asking that• meet with me.

                         •
Upon arrival,•••• requested assistance in retrieving messages made on        by
a - contractor who• claimed was making disparaging comments about• that were
                                           •
both unwelcome and not appreciated.•••• identified t h e - as
         who worked for t h e • • • • • • • • • • • • • • • • •• in
             told me that• had asked ••••• to stop with the comments and it was
not until 16 Aug 2011, when• contacted• supervisor by email that the comments ceased.
            identified the supervisor a s • • • • a t -

             described              as a former "acquaintance" who was assigned to the same
                       as• in 2002. A mutual friend,  •••••• •,           who also worked at
-    with             , had informed             of the comments.                  also knew
          since 2002, and had met• while in the

           relayed that on 16 Aug 2011, between 1400 and 1500,. received a phone call
on• secure line            a t - The unidentified- caller said "I'll get you back."

             relayed that on 8 Sep 2011• met with-                in                . The
• had contacted• 6 Sep 2011 at approximately 1430 and had requested a meeting - they
did not tell• the subject. The          name was                At the 8 Sep 2011 meeting,
             relayed that the• "asked generic questions" and suspected that• was a
            "and were interested in• communications with• family members,
 particularly-- and      ••••••••••          explained that- had not spoken with
• family for at least•years-they had "disowned"• after high school.

            stated that• suspected that the "unidentified- who called• on 16 Aug
2011, was            who was upset a t - because• had contacted• supervisor and
asked- to cease with the disparaging comments. - also suspected it was         who
contacted the-



                                              1
                            Unclassified



On 15 Sep 2011,             called at approximately 0930 and asked that I see-
immediately. At 0945 we met in          spaces. With regard to the phone call from the
unidentified-••••             • stated:
That it was" .... not                  I suspected that it may be           ... The whole
weekend is when I thought it might b e - ... I felt it was- ... I don't have proof."
              stated that- had not heard from            since 16 Aug 2011.

I pressed          to identify t h e - caller and why- would think it was
who made the anonymous call. There were long silent pauses in the conversation.

                then admitted that "I made it [the phone call] up. There was no phone call."
When asked why- would make up a story of a phone call from an unidentified- who
stated "I'll get you back" and relay that story to a member of t h e - - replied "Because I
                                                                 •
wanted to know who made the complaint to t h e - • • • • stated that- thought
that the••••          sessions might help- in identifying who made the complaint to the-
-                                           ••••
    had been told that in order to obtain the              sessions,. had to request it through
the-

I then asked               if there was anything else- wanted to admit to me or discuss. -
said "no" and the interview was concluded.




                                               2
                  UNCLASSIFIED/




                      REPORT OF PRELIMINARY INQUIRY

-    CASE NUMBER: 11-067

SUBJECT




ALLEGATION

Destruction of Government Property (Internal Working Files)

BACKGROUND

On 28 July 2011, at 1330 hours, the -              Hotline received a call from a -
caller who did not want to reveal •     identity. The caller related that a co-worker of
11111 _ ,           was committin "sabotage." The caller related that within the past
two weeks of the call,               had deleted working files (instructions) from shared
folders within the                                      The caller did not believe any of the
files were classified, but related that             is deleting or has deleted files on
purpose ~ is upset with                         I   ent in the agency. The caller left the
name o f - supervisor,                                   . The caller did not know Jfa
         was aware that                 was deleting the files but said that even if.-Was,
     would do nothing to correct the problem/issue" because "for the past. years,.
        has been allowed to do what. wants with no repercussions fro~
         "

APPLICABLE STATUTORY AND REGULATORY STANDARDS

•   18 U.S.C. § 1361 Destruction of Government Property, states:

       Section 1361 protects 'any property' of the United States or an agency or
       department thereof, or any property being manufactured or constructed for
       the United States or an agency or department thereof, from willful
       depredation or attempted depredation. 'Depredation' has been
       characterized as the act of plundering, robbing, pillaging or laying waste.

•   NI 8040.1R10 Appendix 1, Records and Information Life-Cycle Management,
    § 101-05 Office Administration, states:




                  UNCLASSIFIED/
                       UNCLASSIFIED/

        These files relate to the performance of internal or housekeeping activities
        within an Office.

            •     101 Series-General Administration. These files are for routine
                  administrative operations or procedures that do not pertain to the
                  direct mission of the office.

            •     101-05--Office Administration Records are defined as paper,
                  electronic, or both, that relate to the internal administration or
                  housekeeping activities of an office. Such records include: internal
                  activity reports, reference files, and other non-mission activities.
                  Disposition of these files is designated as "Temporary;
                  Destroy/delete when 2 years old."

•   NI 4160.3R6, Investigations of Lost, Damaged, or Destroyed Property,
    Approved 10 June 2009, 7.b. Procedures, states:

        Investigations are required for all accountable property that is lost,
        damaged, or destroyed, when caused by or in possession of       1111
        personnel. Investigations may be conducted for non-accountable
        property, when determined appropriate by the approving authority.

FACTS




    ••     had not heard anything a b o u ~ deleting~one
        complaining about files missing. ~ a t while . . . . . worked for -
        · • did an excellent job logistics-wise."

    ••     did not think t h a t - would delete any files or do anything "on
        purpose" or for "sabotage."

                , testified :

    •   -       had not deleted any files.




                      UNCLASSIFIED/
                  UNCLASSIFIED/


   •                              "had some conflict in trying to schedule time for •
                         to be trained."

              I did sit down and train. for approximately an hour. I wrote out
              step-by-step directions on how to do the job, the program
              management of security incidents and lost property. I also wrote
              out a step-by-step process on how to do the metrics for the two
              programs. I tried to actu~walk. through one of the processes,
              but. refused to do it. -      said I didn't g i ~ enough
              information or something. I started training~ May 2011.

   •   In August 2011, ~ a s still "technically" the program manager for the.
       programs becau~ was still "doing the metrics for it and I was still kind of
       training the. people."

   •   On 3 August 2011,                 accessed the
       the                             folder to update the week's submission, and
       saw that                  had already written a submission. However, instead of
       submitting the status of lost property and security incidents,
       complained in the  11111  and . . . that. had not been trained on either the
       lost property or security programs and therefore, would have difficulty in reporting
       the metrics. "It had nothing to do with the programs or the status of the
       programs."

   •   -tookout                               submission and sent it t o - • and
       put in an updated status in           and  11111on both of the programs because
       "I knew that                    personal comments], [were] inappropriate for the


   •                     complaints were the only things. ever took out of either the
                       "It wasn't nothing [sic] deleted, a file or anything. I just updated
       what     had written and I updated it to reflect the status report." "I never
       deleted anything, any files or anything."

CONCLUSION

-     inquiry found that there was no evidence to suggest that -             committed
"sabota e" or deleted workin files (instructions) from shared folders within the


RECOMMENDATION

Close this case without further investigation.



                                             3
                  UNCLASSIFIED/
                                      UNCLASSIFIED

                  UNCLASSIFIED/




                               EXECUTIVE SUMMARY

-    CASE NUMBER: 11-070

{U) TITLE: Time and Attendance Fraud by an -          Employee

{U) ALLEGATION

(U/~       ) This investigation addressed an allegation of time and attendance fraud
referred to the                                        ) by the
          on 30 August 2011, regarding



{U) INVESTIGATION

(U/~        )                  reviewed access control records, organizational time and
attendance sheets, master time history from the
                                 , Wellness Center sign-in records,
                      e-mail records of 59-minute release authorizations, visitor
itineraries, and team-building events. We interviewed•••• team lead, former
supervisor, and current supervisor.

(U/~       ) The investigation developed evidence to support a finding that
was not present at• assigned duty location for 54.55 hours from 26 April through
2 December 2011. • claimed this time on• time sheets and received $2,275.28 in
salary, but was not charged any leave.• could not provide evidence that      •
                                                                            worked
any of this time.

{U) RECOMMENDATION

(U/        ) We recommend that the                 review this report and, in coordination
with the                                    ,                                     , and
                           , take appropriate action to include recoupment of funds or
leave or both from             . We also recommend that the                 take appropriate
action to ensure that all employees understand the provisions o f - Instruction
6200.1 R9, Wellness Program, especially Appendix 2,
4 April 2007.




                  UNCLASSIFIED/
                                     UNCLASSIFIED
                                     UNCLASSIFIED

                 UNCLASSIFIED/




                             EXECUTIVE SUMMARY

-   CASE NUMBER: 11-072

(U) TITLE: Mismanagement and Misconduct

(U) ALLEGATIONS

(UI--
-
        •)
      initiated this investigation on 9 September 2011, based on information received
from the

                                                    . They requested an investigation
into the following issues relating to possible mismanagement and misconduct b y _
employees leading up to the death of their

1. (U
              and other          violated the -  protocol by failing to delay a
scheduled 22 June 2011 polygraph examination f o r • • • • after•
provided documented medical reasons for postponement of the examination.

2. (U/                  violated -      protocol by failing to grant
advanced medical leave.



                                                                 , engaged in
misconduct during• questioning of                   during a polygraph exam on 6 June
2011.

(U) INVESTIGATION

(U/~       ) We conducted a review of the
investigation o f • • • • • death (determined to be a suicide), t h e - policies on
granting leave, the -    and -     policies for conducting polygraph exams, the
counterintelligence investigation by
                                                       , the documents found at
                 desk by                                     after• death, the access
control records and computer logon activity for                in the days before•




                 UNCLASSIFIED/
                                     UNCLASSIFIED
                                      UNCLASSIFIED

                  UNCLASSIFIED/
death, and the audio recording of                   6 June 2011 polygraph examination.
We interviewed


 (U/~       ) On 6 June 2011,                took a suitability polygraph exam as part of
•     clearance update.              rendered a "No Opinion" result for this exam and
scheduled with                 to re-take the exam on 22 June 2011. • • • • went
to a doctor mid-day on 21 June 2011 and received doctor's notes that recommended
                                                                                    •
-     not take the polygraph exam at that time. These notes were never provided to

On 23 June 2011 -
                                          •
               o r • • • • • • • • did not show for• 22 June 2011 exam.
                        was found dead i n • home. A search o f • office on 24 June
2011 revealed the doctor's notes in a folder on• desk. Access control records and
                                                   •
computer logon activity showed t h a t • • • • had returned to work the afternoon
after• 21 June doctor's appointment.

(U/       ) During the months leading up to June 2011,                   requested
several leaves, all of which were handled by           within -         policy guidelines.

(LI                       conduct during the 6 June 2011 polygraph examination of
               was professional and abided b y - and- guidelines.

(U/JJ        The -    investigation did not develop sufficient evidence to substantiate the
original allegations.

(U) RECOMMENDATION

(U) No further action is required. The report of investigation is provided for information
only.




                                              ii
                  UNCLASSIFIED/

                                      UNCLASSIFIED
                 UNCLASSIFIED/

MEMORANDUM FOR RECORD                                                 30 January 2012

SUBJECT: Case No. 11-074, Possible Time and Attendance Fraud

   1.                             .. - .. - . .. - .
                                        -      -           - -
                                   assistance in collectin the        access control
        records for                                                from 1 June 2011 to
        23 September 2011.

   2. (U) In response to the request,   11111 undertook the following actions to resolve
      the matter:

          -   (U) On 23 September 2011,                requested               control
              records from

          -   (U) On 23 September 2011,                                provided the
              requested records.

          -   (U) On 4 October 2011, the requested records were provided to


          -   (U) On 27 January 2012,
                                        advised that

                 i. ( U / ~ - employment was terminated.

                 ii. (U) They identified 130.2 hours falsely charged. At a billing rate of
                     $114.18, this totaled $14,864.33. They will work with our
                     finance/contracting offices to make the contract whole.

  3. (U) No further -     action on this matter is required. Recommend this case be
     closed.




        (~~r/~onconcur with recommendation.




cc:AC


                 UNCLASSIFIED/
                     UNCLASSIFIED/



MEMORANDUM FOR

SUBJECT:                  -   Case Number 11-075, -             Computer Misuse Report,
                          Case Number RES0249-11

REFERENCE:                (U) . . Instruction 8470.2R8, Internet Usage, 9 December 2009

1. ( U / - Attached is a co
investigative report,
misused government computer resources.
                  ; who formerly worked in      under contract number
since been terminated, and current! works under contract number
the




3. (U) We determined that this matter did not warrant criminal investigation or additional investigation by
this office. We are forwarding the 11111 report for your review and determination of any action you deem
appropriate.

4. (U) Please provide us with a report of action taken or proposed within 30 da s of recei t of this
memorandum. This suspense will be tracked to ~ t i o n through the
-       I  will report overdue suspenses at t h e - key components meeting.

                        ou have uestions or require additional information, please contact
                                             or                         of my staff,
                               Thank you for your cooperation and prompt attention to this matter.




Enclosure
As stated




                     UNCLASSIFIED/
                   UNCLASSIFIED/




                                EXECUTIVE SUMMARY

-    CASE NUMBER: 12-002

TITLE: Time and Attendance Abuse

(U) ALLEGATION

(U-)The
on 3 October 20 1

                                                        signed out and left work early
"multiple times." The complaint also alleged that management was aware of the issue
but had done nothing about it.

(U) INVESTIGATION

(U/,..) Investigators conducted an analysis of                       access control
records and master t i ~ the period 27 June-16 December 2011. Initial
results indicated that 111111111111111 had 87.44 hours of unaccounted-for time, a loss to
the government of $5,254.07. However, after interviewing                    and
supervisors and e x a m i n i ~ information and documentation that they provided,
                                                                                 •
we revised the time that 111111111111111 claimed but was not entitled to from 87.44 hours
to 1.84 hours, a loss to the government of $110.77. The fewer hours were determined
by giving                credit for daily, 45-minute- participation, occasional excused

reflected on •
early absences of 59 minutes or less, and other instances that were not accurately
                 master time history.
                                                             •
                                                     was not charged leave for the
remaining 1.84 hours and could not provide evidence that       worked this time.

(U) OTHER MATTERS

(U/,..)                     supervisors knew about and approved                        early
departures to participate in the- and take advantage of early releases.
Instruction (NI) 1402.1 R11 and 1422.1 R11 require documentation of any excused
absence and NI 6200.1 R9 requires documentation of absence for participation in the
...                   did not follow . . . policy in either instance. As a result of the
investigation,                 stated they have "implemented new procedures to
document time and attendance of each employee to ensure their hours are consistent
with . . policy."




                  UNCLASSIFIED/
              UNCLASSIFIED/

(U) RECOMMENDATION

(U/tlllllll) We recommend that the             , review this report,
and in coordination with the            and the
- · take any action deemed necessary.




              UNCLASSIFIED/
                    UNCLASSIFIED/




                            EXECUTIVE SUMMARY

-       CASE NUMBER: 12-003

TITLE: Alleged Travel Abuse by a


ALLEGATIONS




INVESTIGATION

( U / - We analyzed                    Defense Travel System records for the period
4 January 2010-17 February 2012. We also interviewed                current and
f o r m e r - supervisors, as well as the


-   .         . • .- • • • • ••
             •. -                      . •• . ••
                                           •       •
                                                     • •••
                                                         ••
                                                                      .-• •
                                                                    • ••
                                                                        .
                                                                   ••           I I I



                                                                                        •
                                          •            ·- •• • •            •
    •     •• •
RECOMMENDATION

( U / - ) We recommend that no further action be taken in regard to this matter.




                    UNCLASSIFIED/
                  UNCLASSIFIED/




                              EXECUTIVE SUMMARY

•    CASE NUMBER: 12-005

(U) TITLE: Alleged Abuse of Authority and Creating a Hostile Work Environment

(U) ALLEGATIONS

            This investigation addressed two allegations received as an
                   Hotline com laint on 7 October 2011, regarding

                                                    The complaint alleged that
              (1) consistently abused       authority by asking contractors to perform
work outside of the contract, and (2) created a hostile work environment for
government and contractor employees.

(U) INVESTIGATION




            Our investigation did not develop evidence to support the allegation that
               consistently abused • authority by asking contractors to perform work
outside of the contract. We did find, however, that a contractor performed some
administrative duties that were not completely in line with the duties of a technical
advisor.

(U/-Testimony disclosed conflict between                         and a former employee.
Testimony also revealed that                 was aggressive, demanding, and at times
abrasive. This conduct had a negative effect on some o f . professional relationships.
We did not, however, identify specific actions or incidents which showed that
              created and fostered a hostile work environment.

(U) RECOMMENDATION

( U / - ) We are providing this report to                  management for information.




                 UNCLASSIFIED/
                  UNCLASSIFIED/




                               EXECUTIVE SUMMARY

-    CASE NUMBER: 12-008

(U) TITLE: Time and Attendance Fraud and Forgery by an        11111 Employee
(U) ALLEGATIONS

           ) This investigation addressed two alle ations about

                                       . The complaint alleged that             (1)
engaged in time and attendance abuse between 4 May and 22 October 2011, and (2)

care of•
submitted eight forged doctor's notes, giving the appearance that   •
                                                                    was under the
           physician between 4 August and 19 October 2011 whe~ was not.

(U) INVESTIGATION

(U-)
records, organizational time and attendance sheets, master pay records and
calendars. They also reviewed the automated records of a medical practice whose
                                                                                  •
                               reviewed and analyzed access control records, training
                                                                                 activity

services                  had used and met with                 physician.

(U-)                      developed evidence that
attendance abuse. The evidence disclosed that
locations for 223.33 hours that    claimed on
                                                   was not present at    •
                                                                  engaged in time and
                                                                          assigned duty
                                                 time sheets, a value of $14,833.87.
The                also found that
notes, giving the appearance that     was under   •
                                                submitted forged and false doctor's
                                                    physician's care when     •
                                                                              was not.

                            retired from Federal Service during the investigation. The
                                                                         , declined to
pursue this matter criminally, and advised that      should seek administrative
remedies.

(U) RECOMMENDATION

(U/,_) We recommend that the                              , review this report and, in
coordination with the                                                                 , and
                                   , take appropriate action, to include recoupment of
funds from                  retirement account. In accordance with 31 USC§ 3711,
Federal agencies are required to attempt collection of debts owed to the U.S.
Government.




                  UNCLASSIFIED/
                 UNCLASSIFIED/




                             EXECUTIVE SUMMARY

-   CASE NUMBER: 12-009

(U) TITLE: Alleged Hostile Work Environment and Time and Attendance Fraud

(U) ALLEGATIONS

           This investigation addressed two complaints received through the
                            Hotline regarding

                                   . The complaints alleged that
a hostile work environment and committed time and attendance fraud.

(U) INVESTIGATION

( U / - We did not find evidence t h a t - created or fostered a hostile
working environment. -  was demanding and used a direct management style, which
some o f . employees did not appreciate. - employees found -          to be
belittling at times.

( U / - We did not find evidence t h a t - committed time and attendance
fraud by arriving at work late and departing early. We obtained testimony from
-            and reviewed and analyzed relevant documents and data. The review
revealed that for the period of 1 January through 15 December 2011, -
worked 15.25 more hours than. claimed on. time sheets.

( U / - We found t h a t - and. supervisor did not comply with the
requirement in NI 1422.1R10 to establish and retain a written work schedule.

(U) RECOMMENDATION

( U / - We are providing this report to                supervisor for informational
purposes and appropriate action, which should include establishing and retaining a
written work schedule in accordance with NI 1422.1R10.




                 UNCLASSIFIED/
                   UNCLASSIFIED/
                                                                                             MAR 21 2012

MEMORANDUM FOR


SUBJECT:                  (U) Transmittal of Final Action Report, -      Case Number 12-016




admitted the following:

    •   On one occasion between 1989 and 1990,           masturbated in a   11111 at the -
    •   On one occasion between 1989 and 1992,
                               11111
                                                         masturbated in  •    vehicle while inside the

   •
        security fence line at

        •
        Sometime between 1991 and 1992,
           residence,
                                                              penis on   •-            face while at

    •   Sometime between 2004 and 2005,                               personnel vehicle in the
        parking lot of a closed restaurant in

2. (U/          The information regarding the incident with                          was provided to


                                                    • ••
the                                                  -      initiated an investigation into the

interviewed b y ~     •
allegation of sexual abuse of a minor.
                          admitted that    placed
                                                   waived
                                                      penis on
                                                                 Miranda rights and agreed to be
                                                                                 face for only

to•
seconds while _.-ray on a bed in an upstairs bedroom.

gratified or aroused by•
        being young and stupid and that   •was trying to be funny.    •
                                                                explained that     actions were due
                                                                         denied being sexually
                           actions, and ever touching any other child inappropriately.

3. ( U / - The -         made several attempts to interview                          ; however,

     against_, as the investigation could not move forward without
cooperation.
                                                                                 •
they declined to be interviewed or discuss the case. No criminal charges will be filed by the
-                                                                                one -


4. ( U / - We are providing this information for any action that you deem to be appropriate.
We are not establishing an -           tasker for this memorandum; however, if you do take
action against-· please let us know what action ou take. If you have questions or
require additional information, please contact                         at
                             or myself at




                   UNCLASSIFIED/
                  UNCLASSIFIED/

                                                              6 December 2011

MEMORANDUM FOR:

(U} SUBJECT: Misuse of Government Information System

1. (U) AUTHORITY: A preliminary inquiry was conducted under the authority and
guidance of: U.S.C title 18 Part 1 Chapter 47 Section 1030; "Fraud and Related Activity
in Connection with Computers"; "OMB A-130, Appendix Ill"; Nl8010.2R7,.
Instruction for Information Systems Security and Training"; Nl8470.2R8, '
Instruction for Internet Usage"; Nl8470.3R8, "1111  Instruction for Use of Electronic Mail
and other Electronic Communications"

2. (U) MATTER INVESTIGATED: Misuse ofllll provided
-      network and computer system (Pornography).

3. (U//FOUO) FACTS:
      a. ( U / - On 21 October 2011, an audit of the
      to discover any potential                                     misuse. The audit
      reflected that a specific system and user account were potentially being utilized
      to query for pornographic images.

      b. ( U / - On 9 September 2011 between 1230-1244 hours, 15 September
      2011 between 1227-1229 hours, 19 September 2011 between 1222-1250 hours,
      20 September 2011 between 1233-1239 hours, and 23 September 2011
      between 1234-1240 hours the audit showed that userid - · assigned to
                                      according to network records, performed
                                                  on the computer name


      c. ( U / - On 14 October 2011 during the 1900 hour, on 22 October 2011
      during the 1700 hour, on 11 November during the 2000 hour, and on 18
      November 2011 during the 1900 hour the audit showed that userid
      assigned to                                  according to network records,
      performed queries for pornographic images               on the computer name


      d. ( U / - On 29 October 2011 during the 1800 hour and on 3 November
      2011 during the 1800 hour the audit showed that userid - • assigned to
                 UNCLASSIFIED/
                  UNCLASSIFIED/

                                          according to network records, performed
                                                      on the computer name


              CONCLUSION: Base on the evidence obtained to d a t e , ~ -
                                                                     concludes that a


separate
                                                                        •
                                           network and computer system exists ~ s t
                                      past internet usage revealed that   used -
              workstations to actively search and view pornographic images during the
period of 9 September 2011 to 18 November 2011 in direct violation of Nl8470.2R8,
Paragraph 7, Section D, Number 1.

5. ( U / - ACTION: Following this report's review by the                             , it
is requested that                  supervisor provide                              a
written response to this investigation. The response should include a planned course of
action regarding                 within 30 days of receipt of this report.

6. ( U / - RECOMMENDATIONS:

      a. ( U / -                   shall be cited for the misuse o f - (Internet-
      Pornography).

      b. ( U / - A copy of this report should be forwarded by the supervisor for
      inclusion in the personnel file of                , to facilitate official record
      keeping.

      c. ( U / - General Counsel considers legal action as appropriate.

      d. ( U / -                            investigates any relevant time and
      attendance issues associated with this investigation.

      e. ( U / - All~ employees and contractors must attend the required
      mandatory training prior to receiving access to any~
                esource. The mandatory training is accessible through the
                                              web site on the - · The following
      training is required and must be attended annually: NGC 013414 "CBT
      Information Assurance Awareness" and NGC 016094 "CBT-NGA Annual
      Security Refresher Training."

      f. (U/-The supervisor should obtain a copy of NI 1455.1 R6 • ~
      Instruction for Employee Adverse Action and Discipline." This NI applies to
      civilian employees only. The supervisor should reference Table 2 "Table of
      Offenses and Penalties," section 5 "Computer Misuse" and follow the guidelines
      established for the administration of disciplinary and a d v e ~
      ~ 4 5 5 . 1 R6 instruction is available on t h e - - -
      111111111111111 web site located on the -
                                           2
                 UNCLASSIFIED/
                  UNCLASSIFIED/

7. (U) Questions regarding this investigation may be directed to the




                      ------------      --------------------------   ---
 •




                                           3
                 UNCLASSIFIED/
                   UNCLASSIFIED/


MEMORANDUM FOR RECORD                                                         13 July 2012

SUBJECT: (U) Case No. 12-026, Alleged Time and Attendance Abuse

               This case was opened based on a re uest for assistance from




                    and     deputy,                     , would review the records and
                 he      of the results of their analysis. Prior to this request,
                  requested the     Illobtain. days of r e c o r d s ~ to
   determine if      was at work for full days and whether or not llwasTn1he building
   during that time.

   (U) (This case was originally assigned to                                     but was
   reassigned to                                        on 1 March 2012, f o l l o w i n g -
   deparlure from

2. ( U / - In response to the request,         Ill undertook the following actions:
                       11 Jul 12: Pulled - d a t a o n - and determined
                      si ned from emplo ment with . . on 6 Apr 12. Contacted
                          to confirm that            was no longer on       either in an
            employee or contractor capacity.                confirmed that
            had resigned on the specified date, after a day's notice to the
                                                           also requested that we close


                        29 Mar 12: Phone records were received and provided to


                        28 Mar 12:   Ill records were received and provided to
         • ( U / - 7 Mar 12:             requested a full calendar year of. .
           records f o r - (1 Jan-30 Jun 11)

         • ( U / - 6 Mar 12:                    informed     Ill
                                                              that they had informally
           counseled -regarding the amount o ~ e n t on the phone
           and also r e ~ time and attendance. -                      stated that since

           those issues; however,
           include a possible   I
                               issue.
                                      • •
           • counseling, they haven't had any further significant problems regarding
                                     said that another issue may have arisen, to
                                           stated       •
                                                     would be meeting with      •
                                        stated      •
           management chain to discuss alternatives and options. • offered their
           assistance and                          would keep the       informed and



                  UNCLASSIFIED/
                 UNCLASSIFIED//FOR OFFICIAL USE ONLY '

           also requested additional . . and phone records for -         for the
           period 1 Jan-30 Jun 2011.

         • ( U / - 20 Jan 12: Received phone records f o r - and
           forwarded them to

        • ( U / - 12 Jan 12: Delivered phone records to
          review.
                                                                         for   •
3. (U) No further- action on this matter is required. Recommend this case be closed.




4. ( ~ n c o n c u r .




                 UNCLASSIFIED/
                      REPORT OF PRELIMINARY INQUIRY

(U)- CASE NUMBER: 12-028

(U) SUBJECT




(U) ALLEGATION

( U / - Time and attendance abuse

(U) BACKGROUND

(U) The                                                      examined contractor
employees assigned to the               facility to determine if they were working full
scheduled workdays in accordance with the contract statement of work.
selected contract number
              Subject Matter Expertise, awarded to the firm,
because it met the following predetermined parameters:

   •   It was a level-of-effort contract.
   •   The contractors had permanent work space at
   •   The work performed in the                                             had to be
       done either onsite at a government facility or offsite at a contractor facility.
   •   Based on access control records, some of the contractor employees were
       physically in the -        facility for fewer than eight hours a day.

(U/- -           identified  • contractor employees assigned to the contract who each

from 1 June through 31 August 2010. -                               •
seemed to have missed a minimum of~ s of work over th~Jlll-month period

                                                          •
                                               was one of the ----en,p"loyees. As a
result we opened an investigation to examine whether     was abusing time and
attendance at government expense.

(U) SCOPE

(U) Our investigation was conducted in accordance with      Ill
                                                              Instruction 7410.8R3,
Inspector General Investigations and Ombudsman Intervention, 27 July 2007, and the
"Quality Standards for Investigations," December 2003, set forth by the President's




                  UNCLASSIFIED/
                  UNCLASSIFIED/

Council on Integrity and Efficiency (now the Council of Inspectors General on Integrity
and Efficiency).


                           •
            We reviewed and compared -
             facilities with
                                                       access control records from all
                                 signed time sheets for the period 1 June through 31
August 2010. We counted only those days when the access control records were

than those claimed on
disregarded.
                       •
available and showed through entry and exit times that -             worked fewer hours
                             time sheets. Dates showing no entry or exit time were


(U) We reviewed the contract statement of work, dated 5 November 2008. It did not
specify whether contract employees should take a half-hour lunch break; therefore, we
adjusted our analysis of time and attendance to examine straight time without a lunch
break.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

   •   (U) 18 USC§ 287, False, Fictitious, or Fraudulent Claims

   •   (U) 18 USC§ 1001 (a), Fraud and False Statements

(U) FACTS

   •   ( U - We prepared an Excel spreadsheet o f - time and

       The spreadsheet contained data from
       records.
                                                •
       attendance for each workday from 1 June through 31 August 2 0 1 0 - .
                                              time sheets and access control


   •
       may have abused     •
       ( U / - As the result of the initial analysis, -
                         time and attendance.
                                                             determined that -


   •   (U) We asked                        , the prime on the contract, to conduct an
       internal review and disclose any time and attendance violation.

   •   (U/-Since                                                assigned as a
       subcontractor,                                          legal department to assist
       with the time sheet assessment.

   •   ( U / - - was asked to r e v i e w - time sheet history and
       access control records for the period in question to assess whether
       charges appeared appropriate and to disclose any discrepancies.
                                                                            •
                                                                           time


   •   ( U / - We provided                                                      for the
       period. In addition,             legal department obtained           time sheet
       history from its system for the same time period. The legal department compared
       -           access control records to the time sheet history.

                                            2
                 UNCLASSIFIED/
                  UNCLASSIFIEDl>FOR OFFICIAL USE ONL¥

-    CASE NUMBER: 12-028


( U / - (U/                       interviewed -           about a..!:ime for the period
under review.                    at, as a subject matter expert~ spent considerable
time working o                     facility and attending meetings. -           officials
confirmed that           worked a considerable amount of time offsite and this would
account for the shortages detailed in -

(U) CONCLUSIONS

( U / - Based on documents and information provided by             legal department
and our analysis, we determined that          was properly recording his time and
attendance and there was no shortage of hours. Therefore, we found no evidence that
he engaged in time and attendance abuse.

(U) RECOMMENDATION

(U/-We recommend no further investigative work on this matter and closing this
inquiry.




                                            3
                 UNCLASSIFIED/
                    UNCLASSIFIED/




                        REPORT OF PRELIMINARY INQUIRY

(U) -     CASE NUMBER: 12-029

(U) SUBJECT




(U) ALLEGATION

( U / - Time and attendance abuse

(U) BACKGROUND

(U) The                                                        examined contractor
employees assigned to the                 facility to determine if they were performing
their full scheduled workdays in accordance with the contract statement of work.
        selected contract number
                Subject Matter Expertise, awarded to the firm,
because it met the following predetermined parameters:

   •    It was a level-of-effort contract.
   •    The contractors had permanent work space at
   •    The work performed in the                                           , had to be
        done either onsite at a government facility or offsite at a contractor facility.
   •    Based on their access control records, some of the contractor employees
        were physically in the -         facility for fewer than eight hours a day.

(U/- -           identified   •contractor employees assigned to the contract who each
seemed to have missed a minimum of        tll
                                           hours of work over th~-month period
from 1 June through 31 August 2010. r
result we opened an investigation to examine whether
attendance at government expense.
                                                           •
                                                was one of the ~ployees. As a
                                                         was abusing time and


(U) SCOPE

(U) Our investigation was conducted in accordance with       Ill
                                                              Instruction 7410.8R3,
Inspector General Investigations and Ombudsman Intervention, 27 July 2007, and the
"Quality Standards for Investigations," December 2003, set forth by the President's




                   UNCLASSIFIED/
                    UNCLASSIFIED/

-       CASE NUMBER: 12-029

Council on Integrity and Efficiency (now the Council of Inspectors General on Integrity
and Efficiency).


             facilities with •
            We reviewed and compared -                  access control records from all
                                 signed time sheets for the period 1 June through 31
August 2010. We counted only those days when the access control records were

than those claimed on
disregarded.
                         •
available and showed through entry and exit times that -              worked fewer hours
                             time sheets. Dates showing no entry or exit time were


(U) We reviewed the contract statement of work, dated 5 November 2008. It did not
designate whether contract employees should take a half-hour lunch break; therefore,
we adjusted our analysis of time and attendance to examine straight time without a
lunch break.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

    •    (U) 18 USC§ 287, False, Fictitious, or Fraudulent Claims

    •    (U) 18 USC§ 1001 (a), Fraud and False Statements

(U) FACTS

    •    ( U / - We prepared an Excel spreadsheet of                time and

         The spreadsheet contained data from
         records.
                                                  •
         attendance for each workday from 1 June through 31 August 2 0 1 0 -
                                                time sheets and access control


    •
         may have abused     •
         ( U / - As the result of the initial analysis, -
                           time and attendance.
                                                               determined that -


    •    (U) We asked                        , the prime on the contract, to conduct an
         internal review and disclose any time and attendance violation.

    •    ( U / - Since              was a ~ e assigned as a
         subcontractor,                   ~ legal department to assist
         with the time sheet assessment.

    •    (U/- -               was asked to review -
                                                                              •
                                                                  time sheet history and
         access control records for the period in question to assess whether
         charges appeared appropriate and to disclose any discrepancies.
                                                                                  time


    •    ( U / - We provided                   access control records to
         period. In addition,           legal department obtained

                                              2
                   UNCLASSIFIED/
                 UNCLASSIFIED/

-     CASE NUMBER: 12-029

       history from its system for the same period. The legal department compared
                    access control records to the time sheet history.

(U/        -           interviewed -           abou!.a time for the period under review.
           stated that, as a subject matter expert, ~pent considerable time working
offsite at            facility and attending meetings. -        officials confirmed that
           worked a considerable amount of time offsite and this would account for the
shortages detailed in -

(U) CONCLUSIONS


and our analysis, we determined that -         was properly recording   •
( U / , _ Based on documents and information provided b y - legal department
                                                                         time and

•
attendance and there was no shortage of hours. Therefore, we found no evidence that
   engaged in time and attendance abuse.

(U) RECOMMENDATION

( U / , _ We recommend no further investigative work on this matter and closing this
inquiry.




                                           3
                 UNCLASSIFIED/
                  UNCLASSIFIED/




                      REPORT OF PRELIMINARY INQUIRY

(U)- CASE NUMBER: 12-030

(U) SUBJECT




(U) ALLEGATION

( U / - Time and attendance abuse

(U) BACKGROUND

(U) The                                                      examined contractor
employees assigned to the               facility to determine if they were working full
scheduled workdays in accordance with the contract statement of work.
selected contract number
              Subject Matter Expertise, awarded to the firm,
because it met the following predetermined parameters:

   •   It was a level-of-effort contract.
   •   The contractors had permanent work space at
   •   The work performed in the                                             had to be
       done either onsite at a government facility or offsite at a contractor facility.
   •   Based on access control records some of the contractor employees were
       physically in the -        facility for fewer than eight hours a day.

(U/- -           identified  • contractor employees assigned to the contract who each
seemed to have missed a minimum of~ s of work over th~--month period
from 1 June through 31 August 2010. -                               •
                                                was- of the employees. As a
result we opened an investigation to examine whethe~ was abusing time and
attendance at government expense.

(U) SCOPE

(U) Our investigation was conducted in accordance with      11111
                                                              Instruction 7410.8R3,
Inspector General Investigations and Ombudsman Intervention, 27 July 2007, and the
"Quality Standards for Investigations," December 2003, set forth by the President's




                  UNCLASSIFIED/
                    UNCL"'SSIFIED/

-       CASE NUMBER: 12-030

Council on Integrity and Efficiency (now the Council of Inspectors General on Integrity
and Efficiency).


facilities with•
( U / - We compared -                 access control records from all
                 signed time sheets for the period 1 June through 31 August 2010. We
counted only those days when the access control records were available and showed

•
through entry and exit times that -         worked fewer hours than those claimed on
    time sheets. Dates showing no entry or exit time were disregarded.

(U) We reviewed the contract statement of work, dated 5 November 2008. It did not
specify whether contract employees should take a half-hour lunch break; therefore, we
adjusted our analysis of time and attendance to examine straight time without a lunch
break.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

    •    (U) 18 USC§ 287, False, Fictitious, or Fraudulent Claims

    •    (U) 18 USC§ 1001 (a), Fraud and False Statements

(U) FACTS

    •    ( U / - We prepared an Excel spreadsheet o f - time and

         The spreadsheet contained data from
         records.
                                               •
         attendance for each workday from 1 June through 31 August 2 0 1 0 - .
                                                time sheets and access control


    •
         may have abused   •
         ( U / - As the result of the initial analysis, -
                           time and attendance.
                                                               determined t h a t _


    •    (U) We asked                        , the prime on the contract, to conduct an
         internal review and disclose any time and attendance violation.

    •    (U/-Since
         subcontractor,                       asked             ' legal department on
         26 July 2011 to assist with the time sheet assessment.

    •    (U/-                    was asked to review -
                                                                              •
                                                                   time sheet history and
         access control records for the period in question to assess whether
         charges appeared appropriate and to disclose any discrepancies.
                                                                                 time


    •    ( U / - W e provided                    access control records to          for
         the period. In addition,             'legal department obtained           time

         compared  •
         sheet history from their system for the same period. The legal department
                        access control records to the time sheet history reported.
                                              2
                   UNCLASSIFIED/
                 UNCLASSIFIED//rOR OFFICIAL US! ONLY°

-   CASE NUMBER: 12-030



                about  •
                 On 1 September 2011, the owners of
                         time for the period under review.
      considerable time workin offsite on a project and that



(U) On 24 October 2011, -          provided the following statement in an e-mail:




(U) -         mentioned during                                     completed
unclassified work creating a                                   at home after normal
business hours to support the program. It was determined that the work was
unclassified and the time was not charged to  11111
(U) CONCLUSIONS

( U / - It was determined that Based on the information obtained during the inquiry,
we found no evidence that -          engaged in time and attendance abuse.

(U) RECOMMENDATION

( U / - W e recommend no further investigative work on this matter and closing this
inquiry.




                                          3
                UNCLASSIFIED/
                  UNCLASSIFIED/




                      REPORT OF PRELIMINARY INQUIRY

(U)- CASE NUMBER: 12-033

(U) SUBJECT




(U) ALLEGATION

( U / - Time and attendance abuse

(U) BACKGROUND

(U) The                                                      examined contractor
employees assigned to the               facility to determine if they were working full
scheduled workdays in accordance with the contract statement of work.
selected contract number
                                        awarded to the firm,
because it met the following predetermined parameters:

   •   It was a level-of-effort contract.
   •   The contractors had permanent work space at
   •   The work performed in the                                           , must be done
       either onsite at a government facility or offsite at a contractor facility.
   •   Based on their access control records, some of the contractor employees
       were physically in the -         facility for fewer than eight hours a day.

( U / - - identified        •  contractor employees assigned to the contract who each
seemed to have missed a minimum o f ~ of work over the---month period
from 1 June through 31 August 2010. - w a s - of the l(employees. As a
result we opened an investigation to examine whether --was abusing time and
attendance at government expense.

(U) SCOPE

(U) Our investigation was conducted in accordance with . . Instruction 7410.8R3,
Inspector General Investigations and Ombudsman Intervention, 27 July 2007, and the
"Quality Standards for Investigations," December 2003, set forth by the President's
Council on Integrity and Efficiency (now the Council of Inspectors General on Integrity
and Efficiency).



                  UNCLASSIFIED/
                    UNCLASSIFIED/

-       CASE NUMBER: 12-033


             facilities with •
            We reviewed and compared                     access control records from all
                                 signed time sheets for the period 1 June through 31
August 2010. We counted only those days when the access control records were

than those claimed on
disregarded.
                         •
available and showed through entry and exit times t h a t - worked fewer hours
                             time sheets. Dates showing no entry or exit time were


(U) We reviewed the contract statement of work, dated 5 November 2008. It did not
designate whether contract employees should take a half-hour lunch break; therefore,
we adjusted our analysis of time and attendance to examine straight time without a
lunch break.

{U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

    •    (U) 18 USC§ 287, False, Fictitious, or Fraudulent Claims

    •    (U) 18 USC§ 1001 (a), Fraud and False Statements

{U) FACTS

    •    (U/-We prepared an Excel spreadsheet of                      time and
         attendance for each workday from 1 June through 31 August 2 0 1 0 - .
         The spreadsheet contained data from his time sheets and access control
         records.

    •    ( U / - As the result of the initial analysis -      determined t h a t _
         may have abused his time and attendance.

    •    (U/-We asked            11111
                                    the prime on the contract, to conduct an internal
         review and disclose any time and attendance violation.

    •    (U/- -            legal department reviewed
                                                                              •
                                                                     time sheet history and
         access control records for the period in question to assess whether
         charges appeared appropriate and to disclose any discrepancies.
                                                                                 time


    •    ( U / - We provided                     access control records toIll    for the
         period 1 June through 31 August 2010. In addition, -        legal department
         obtained                time sheet history from their system for the same time
         period. The legal department compared                   access control records to
         the time sheet history reported.




                                              2
                   UNCLASSIFIED/
                 UNCLASSIFIED/

-   CASE NUMBER: 12-033

      confirmed that -           worked a considerable amount of time offsite and this
      would account for the shortages detailed in -

(U) CONCLUSIONS ( U / - Based on documents and information provided by
-
recording•
       legal department and our analysis, we determined that -          was properly
              time and attendance and there was no shortage of hours. Therefore, we
found no evidence that -           engaged in time and attendance abuse.

(U) RECOMMENDATION

( U / - We recommend no further investigative work on this matter and closing this
inquiry.




                                          3
                 UNCLASSIFIED/
                   UNCLASSIFIED/




                        REPORT OF PRELIMINARY INQUIRY

(U) -     CASE NUMBER: 12-034

(U) TITLE: Alleged Time and Attendance Fraud

(U) SUBJECT




(U) ALLEGATION

( U / - Time and attendance fraud

(U) BACKGROUND




                                          awarded to the firm
        because it met the following predetermined parameters:

   •    It was a level-of-effort contract.
   •    The contractors had permanent work space at
   •    The work performed in the                                             , had to be
        done either onsite at a government facility or offsite at a contractor facility.
   •    Based on access control records, some of the contractor employees were
        physically in the -        facility for fewer than eight hours a day.

(U//FOUO) During its preliminary review of the contract,         noted that from 1 June
through 31 August 2010, -            was absent from the           facility more than.
hours and that the hours were billed to the agency. As a result,      initiated an
investigation to determine whether -          defrauded the government.

(U) SCOPE

( U / - Our investigation was conducted in accordance with           Ill
                                                                    Instruction (NI)
7410.8R3, Inspector General Investigations and Ombudsman Intervention, 27 July
2007, and the "Quality Standards for Investigations," November 2011, set forth by the
Council of Inspectors General on Integrity and Efficiency.



                   UNCLASSIFIED//FOR OFFICIAL USE ONLY
                     UNCLASSIFIED//FOR OFFICIAL USE ONLY•

-       CASE NUMBER: 12-034

                                                                                           Ill
-      facilities with   •
(U) We reviewed and compared -               access control records from all
                         signed time sheets for the period 01 June through 31 August
2010. We counted only those days when the access control records were available and

claimed on   •
showed through entry and exit times t h a t - worked fewer hours than those
                time sheets. Dates showing no entry or exit time were disregarded.

(U) We verified with the contracting officer's representative that           was assigned
full time to -     in support of the contract statement of work. The          specifies the
government sites and contractor facilities where work may-eerformed. We obtained
and reviewed the                 that supports the contract        for allowable classified
work locations. 1

The following table lists the allowable locations where -                     may perform work to
support the contract.

 U Place of Performance
                                          Work Required: Onsite(Government Facility), Offsite
             Location                            (Contractor Facility), No Preference
                                                               No Preference
                                                               No Preference


(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

    •    (U) Title 18 U.S. Code (USC)§ 287, False, Fictitious, or Fraudulent Claims,
         states:

                Whoever makes or presents to any person or officer in the civil,
                military, or naval service of the United States, or to any department
                or agency thereof, any claim upon or against the United States, or
                any department or agency thereof, knowing such claim to be false,
                fictitious, or fraudulent, shall be imprisoned not more than five years
                and shall be subject to a fine in the amount provided in this title.

    •    (U) 18 USC § 1001 (a), Fraud and False Statements, states:

                Except as otherwise provided in this section, whoever, in any
                matter within the jurisdiction of the executive, legislative, or judicial
                branch of the Government of the United States, knowingly and
                willfully:


1. (U) In DD Form 254, Contract Security Classification Specification item number 13.2, reference item
number 8 (Actual Performance).
                                                    2

                    UNCLASSIFIED/
                  ·UNCLASSIFIED/

-       CASE NUMBER: 12-034

               Falsifies, conceals, or covers up by any trick, scheme, or device a
               material fact;

                Makes any materially false, fictitious or fraudulent statement or
                representation;

               Or makes or uses any false writing or document knowing the same
               to contain any materially false, fictitious, or fraudulent statement or
               entry; shall be fined under this title or imprisoned not more than five
               years, or both.

    •    (U) Federal Acquisition Regulation 31.201-2 Determining Allowability,
         states:

               (a) A cost is allowable only when the cost complies with all of the
                   following requirements:

                  (1) Reasonableness.
                  (2) Allocability.
                  (3) Standards promulgated by the Cost Accounting Standards
                  (CAS) Board, if applicable, otherwise, generally accepted
                  accounting principles and practices appropriate to the
                  circumstances.
                  (4) Terms of the contract.
                  (5) Any limitations set forth in this subpart.

               (c) When contractor accounting practices are inconsistent
               with this Subpart 31.2, costs resulting from such inconsistent
               practices in excess of the amount that would have resulted
               from using practices consistent with this subpart are
               unallowable.

              (d) A contractor is responsible for accounting for costs appropriately
              and for maintaining records, including supporting documentation,
              adequate to demonstrate that costs claimed have been incurred,
              are allocable to the contract, and comply with applicable cost
              principles in this subpart and agency supplements. The contracting
              officer may disallow all or part of a claimed cost that is inadequately
              supported.




                                             3

                  UNCLASSIFIED/
                        ·UNCLASSIFIED//FOR OFFfCIAL USE ONLY -.,

-        CASE NUMBER: 12-034

(U) FACTS

(U) We prepared an Excel spreadsheet o f - time and attendance for each

data from      •
work day from 1 June through 31 August 2010 (exhibit 1). The spreadsheet contained
             time sheets and access control records.

(U) We asked            the prime on the contract, to conduct an initial review and verify the
hours billed for

and attendance.
                              , and notify this office of any discrepancies discovered. As the
result of the initial analysis, -     determined that -              may have abused      time           •
( U / - We provided -                access control records to                      1111
                                                                    for the period in
question, and -    legal staff obtained -            time sheet history and compared
the. sets of records for the period under review.

(Ul-1111 interviewed -                  regarding • time charging during the period
under review and 1111 provided the following statement in an e-mail, dated 1 December
2011:

                  works for
                  1111 has stated that some of the discrepancies in time are
           accounte~for   b the fact that sometimes a_does work at
                                                                               I
                                                          , a small subcontractor to 1111

                                                                            home office
           either before    goes to client-site or afte~ returns from client-site. In
           addition,
                                 •
                           has also stated that
           was on travel with
                                                     •
                                                     has a tri re art which shows that
                                  Govt. clients to the                                  from
                                                                                                 •
           18 - 20 August.

(U) As a result of the information provided by                1111
                                                   in their internal review, -
determined that -            may have improperly received payment for hou~ did not
work and expanded the scope of the review for the timeframe: 1 June 2010 to
31 December 2010; 1 to 31 January 2011; and 1 June 2011 to 30 September 2011.

(U//FOUO) We prepared an Excel spreadsheet o                 time and attendance for
each workday from 1 June 2010 to 31 December 2010; 1 to 31 January 2011; and

•
1 June 2011 to 30 September 2011 -             The spreadsheet contained data from
    time sheets and access control records. The completed spreadsheet for the leave
year 2010, 1 June 2010 to 18 December 2010, revealed t h a t - was missing
6 hours and 22 minutes. The completed spreadsheet for the leave year 2011,
19 December 201 Oto 31 January 2011 and 1 June 2011 to 30 September 2011
revealed t h a t - w a s missing 20 hours and 44 minutes. 2




2
    Leave year is a term designated by OPM to describe the federal government's pay periods on an annual basis.
                                                          4

                         UNCLASSIFIED/
               ~· UNCLASSIFIED/JFOR OFFICIAL US! ONLY4

-      CASE NUMBER: 12-034

(U) Testimony

(U//FOUO)- testified:

        (U/-        •  owns . . a subcontractor to
        matter expert supportin the
        -onthe
        do collaboration and outreach across the


                    -         was asked what the address of
                     home address,
                      is the                    and it is certified by the
                               as an approved contractor facility to conduct unclassified
                  company complies with all of  1111
                                                  requirements . . . issued
                   a DD Form 254 on 4 May 2009.


        •
        (U/-        • would work from . . if    •                         •         •
                                                   had unclassified work to complete.
           also attended unclassified meetings by dialing in from111111     said that
        would catch up on work and drive over to -       after the meetings.

(U) As a result of the internal review- conducted, statements made b y _ ,
and the email from the contract specialist,                             , per the new
                                                , that states "unclassified work may be

attendance spreadsheet and accounted for all time that  •
performed at an official contractor facility," we updated his automated time and
                                                                 worked.

(U) We determined that ~ m e is an ~ved contractor facility per the

                •
DD Form 254 and a c c o r ~ contract- and DD Form 254, the work
performed from    home office is allowable and complies with the contractor places of
                                                                                     •
performance, government sites and/or contractor facilities.

(U) CONCLUSIONS

(U/          Based on the information obtained during the inquiry, we found no evidence
that           engaged in time and attendance abuse.

(U) RECOMMENDATION

( U / - We recommend no further investigative work on this matter and closing this
inquiry.




                                            5

                  UNCLASSIFIED/
                          I
                   UNCL""SSIFIED/




                       REPORT OF PRELIMINARY INQUIRY



(U)-CASE NUMBER: 12-035

(U) TITLE: Alleged Time and Attendance Fraud

(U) SUBJECT




(U) ALLEGATION:

(U//FOUO) Alleged Time and Attendance Fraud

(U) BACKGROUND

(U) The                                                          examined contractor
employees assigned to the                  facility as part of a proactive initiative by
this office to determine if they were working full scheduled workdays in accordance
with the contract statement of work.         selected contract number
                                                                                 awarded
                                  , because it met the following predetermined


   •   It was a level-of-effort contract.
   •   The contractors had permanent work space at
   •   The work performed in the                                             had to be
       done either onsite at a government facility or offsite at a contractor facility.
   e   Based on access control records some of the contractor employees were
       physically in the -        facility for fewer than eight hours a day.

(U) SCOPE

( U / - Our investigation was conducted in accordance with 1111111 Instruction (NI)
7410.8R3, Inspector General Investigations and Ombudsman Intervention, 27 July
2007, and the "Quality Standards for Investigations," December 2003, set forth by the




                  UNCLASSIFIED/
                    UNCL"'SSIFIED/

-        CASE NUMBER: 12-035

President's Council on Integrity and Efficiency (now the Council of Inspectors General
on Integrity and Efficiency [CIGIE]). 1

( U / - As part of the proactive review -       identified         •
                                                            contractor employees
assigned to the contract who each seemed to have missed a m i n i ~ hours of

of the   •
work over the three-month period from 1 June to 31 August 2010. -          was.
         employees. As a result we opened an investigation to examine whether he
was abusing time and attendance at government expense.

(U) We verified with the contracting officer's representative that            was
assigned full time to -         supporting work breakdown structure           13.2 of the
contract statement of work, that states the specific government sites and contractor
facilities that work may be performed. The following table lists the allowable locatfons
where work may be performed to support the contract.

    U Place of Performance WBS
                                        Work Required: Onsite(Government Facility), Offsite
              Location                         (Contractor Facility), No Preference
                                                            No Preference
                                                            No Preference

(U) We reviewed the DD Form 254, Contract Security Classification Specification item
#13.2 reference item #8 (Actual Performance), that states the specific government sites
and contractor facilities that work may be performed. This form supports the contract
statement of work for allowable work locations.


facilities with•
(U//FOUO) We compared                 access control records from all
                signed time sheets for the period 1 June to 31 August 2010. We
counted only those days when the access control records were available and showed
thr~h entry and exit times that              worked fewer hours than those claimed
on• time sheets. Dates showing no entry or exit time were disregarded.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

     •    (U) Title 18 U.S. Code (USC)§ 287, False, Fictitious, or Fraudulent Claims,
          states:

                Whoever makes or presents to any person or officer in the civil,
                military, or naval service of the United States, or to any department
                or agency thereof, any claim upon or against the United States, or
                any department or agency thereof, knowing such claim to be false,
1
 (U) The Inspector General Reform Act of 2008 created the CIGIE, combining what were the President's
Council on Integrity and Efficiency and the Executive Council on Integrity and Efficiency.
                                                 2

                   UNCLASSIFIED/
              · UNCL"'SSIFIED/
IIG CASE NUMBER: 12-035

            fictitious, or fraudulent, shall be imprisoned not more than five years
            and shall be subject to a fine in the amount provided in this title.

  "   (U) 18 USC§ 1001 (a), Fraud and False Statements, states:

            Except as otherwise provided in this section, whoever, in any
            matter within the jurisdiction of the executive, legislative, or judicial
            branch of the Government of the United States, knowingly and
            willfully:

            Falsifies, conceals, or covers up by any trick, scheme, or device a
            material fact;

             Makes any materially false, fictitious or fraudulent statement or
             representation;

            Or makes or uses any false writing or document knowing the same
            to contain any materially false, fictitious, or fraudulent statement or
            entry; shall be fined under this title or imprisoned not more than five
            years, or both.

  @   (U) FAR Clause 131.201-2 Determining Allowability

           (a) A cost is allowable only when the cost complies with all of the
                following requirements:
           ( 1) Reasonableness.
           (2) Allocability.
           (3) Standards promulgated by the Cost Accounting Standards
           (CAS) Board, if applicable, otherwise, generally accepted
           accounting principles and practices appropriate to the
           circumstances.
           (4) Terms of the contract.
           (5) Any limitations set forth in this subpart.

           (b) Certain cost principles in this subpart incorporate the
           measurement, assignment, and allocability rules of selected
           CAS and limit the allowability of costs to the amounts determined
           using the criteria in those selected standards. Only
           those CAS or portions of standards specifically made applicable
           by the cost principles in this subpart are mandatory
           unless the contract is GAS-covered (see Part 30). Business
           units that are not otherwise subject to these standards under a
           CAS clause are subject to the selected standards only for the
           purpose of dete·rmining allowability of costs on Government

                                            3

               UNCLASSIFIED/
                   UNCL""SSIFIED//FOR OFFICIAL USc. vNLY

-       CASE NUMBER: 12-035

                contracts. Including the selected standards in the cost principles
                does not subject the business unit to any other GAS rules
                and regulations. The applicability of the GAS rules and regulations
                is determined by the GAS clause, if any, in the contract
                and the requirements of the standards themselves.

                (c) When contractor accounting practices are inconsistent
                with this Subpart 31.2, costs resulting from such inconsistent
                practices in excess of the amount that would have resulted
                from using practices consistent with this subpart are
                unallowable.

                (d) A contractor is responsible for accounting for costs appropriately
                and for maintaining records, including supporting documentation,
                adequate to demonstrate that costs claimed have been incurred,
                are allocable to the contract, and comply with applicable cost
                principles in this subpart and agency supplements. The contracting
                officer may disallow all or part of a claimed cost that is inadequately
                supported.

(U) FACTS

    •    (U/       We prepared an automated time and attendance Excel spreadsheet
         of
         August 2010             The spreadsheet contained data from
         and access control records.
                                                                          •
                       time and attendance for each workday from 1 June through 31
                                                                       time sheets


    •
         may have abused   •
         ( U / - As the result of the initial analysis, -
                           time and attendance.
                                                               determined that


    •    (U) We asked  11111 the prime on the contract, to conduct an internal review and
         disclose any time and attendance violation.

    •    ( U / - Sin~\J\fclS a n ~ employee assigned as a
         subcontractor, ~ legal department to assist with the time sheet
         assessment for the period of 1 June to 31 August 2010 and assess whether
         time charges appeared appropriate and/or self disclose any discrepancies.
                                                                                          •
    •    ( U / - We p r o ~ access control r ~ for the
         period. In addition, llllll[iegafdeprtment obtained ~ e sheet

        •history from their system for the same period. The legal department compared
             access control records to the time sheet history reported.



                                              4

                   UNCLASSIFIED/
                            \
                     UNCLASSIFIED/--
IIG CASE NUMBER: 12-035

    0
         (U) On 01 December 2011, -           Legal Department provided a summary via
         email with the results of the internal review. The email provided the following
         information:

            (U) . . works for                                    an independent contractor
            temporary agency to               .            esentatives have interviewed . . and
            have stated that for the followi!l[ days        has evidence (e-mails and outlooks
            calendar entries) to show that •    was off-site for meetings:

                I
                ,
                I
                I
                I
                ii
                I
                I
                I
                I
              •I
               I
               I
(U) As a result of the internal review . . conducted and the statements made by
- • we updated the automated time and attendance spreadsheet to account for
all time t h a t - worked. Also, the email provided the following information:

        (U) . . has identified a number of days where       knows     worked from home; note
        that most of these are weekend days: 7/10, 8/7, 8/8, 8/15, 8/31. For the rest of the time,

        or perhaps not accounting for time that
        grab something to eat or drink.
                                                •
        . . has stated that possible explanations may include: working from home, traveling,
                                                 stepped outside the turnstiles to stretch or


(U) We reviewed the contract statement of work and the DD Form 254, Contract
Security Classification Specification item #13.2 reference item #8 (Actual Performance),
to determine whether working from home is allowable based on the terms of the
contract. We determined based on the contract statement of work and the DD Form 254
that specifically states work may only be performed at Government Sites and/or
Contractor Facilities. Neither of these documents allow for work to be completed at a
contractor's residence.

(U) Based on all the information provided by . . and our analysis of
sheets, master time history, access control records, and travel records showed that
did work all of the hours billed to the government.
                                                                                   time
                                                                                             •
                                                 5

                     UNCLASSIFIED/
                   UNCLASSIFIED/

-      CASE NUMBER: 12-035

(U) Testimony




                   -    has been the
                 or two and a half years and has oversight responsibilities for the contract.
                 is currently acting as the         and                       since the previously
                                                            has moved onto a different team.

        (U/- -                 was asked if working from home or teleworking was
        allowed as part of this contract. -       replied "right now we have no agreement
        w i t h - for them or their subcontractors to do telework that. was aware of."

        ( U / - In addition, in an email dated 1 February 2012,
        contractor has not been authorized by the. or the
        Representative to telework. The. has requested        to provide the organization's
        policy on Telework."

(U) CONCLUSIONS

(U/          Based on the information obtained during the inquiry, we found no evidence
that            engaged in time and attendance abuse.

(U) RECOMMENDATION

( U / - We recommend no further investigative work on this matter and closing this
inquiry.




                                               6

                  UNCLASSIFIED/
                                                                     05 January 2012

MEMORANDUM FOR:          Ill INSPECTOR GENERAL
(U) SUBJECT: Misuse of Government Information Technology

 1. ( U / - AUTHORITY: A preliminary inquiry was conducted under the authority of:
DCID 6/3 "Protecting Sensitive Compartmented Information within Information
Systems"; ICD Number 503, "Intelligence Community Information Technology Systems
Security risk Management, Certification, and Accreditation"; DOD Directive 5220.22-M,
National Industrial Security Operating Manual (NISPOM); DOD Directive 8500.1,
"Information Assurance"; DOD Directive 8520.1, "Protection of Sensitive
Compartmented Information (SCI)"; NI 5205.1 R3,     '1111 Instruction for Protection of
Sensitive Compartmented Information"; NI 8010.11 R5,     11111  Instruction for -
-           Computer Network Connectivity at Contractor and Other Facilities"; NI
8010.15R7, "Access to Removable Media on Classified Networks"; NI 8010.16R2,
'1111  Instruction for Managing Compartmented and Sub-Compartmented Information
on Sensitive Compartmented Information Systems"; NI 8010.2R7,        '1111  Instruction for
Information System Security and Training"; NI 8100.1 R13,    '1111  Instruction for Portable
Electronic Devices"; NI 8470.2R8,   '1111Instruction for Internet Usage."

              MATTER INVESTIGATED: Misuse oflll provided
                 network and computer system.

3. (U) FACTS: On 24 October 2011, the




review of the LEF and
content.




                  UNCLASSIFIED/
                  UNCLASSIFIED/

       b.                                                    Investigator physically
acquired a forensic image of the                     system's hard drive. Detailed
forensic analysis was performed on the entire contents of the hard drive. Analysis of
the hard drive did not reveal any additional inappropriate images.

       c. (U) However, multiple automated network auditing captures of the
               computer system from 29 September 2011-04 January 2012 revealed the
            profile accessing pornographic images received via
personal Yahoo webmail accounts. In addition, the personal Yahoo webmail accounts
were being used for the pur ose of composing sexually explicit emails. The Yahoo
account userids used by                    were identified as -
and                             . The automated network auditing capture also revealed
an attempt to delete the internet history and associated images contained in the Internet
Explorer Cache and Cookies repository

       d. (U) Nl8470.2R8, • ~ Instruction for Internet Usage" specifically states
"Examples of prohibited uses include: 1) Accessing pornographic sites or downloading
images from such sites using 11111-sponsored accounts or computer equipment. 2)
Requesting, ordering, creating, downloading, viewing, storing, copying, or transmitting
sexually explicit or sexually oriented materials or services for personal recreation or
                            Ill
entertainment while utilizing       sponsored Internet accesses."

4. ( U / - CONCLUSION: Based on the data obtained to date,
concludes that an ongoing case o f . Misuse exists with regard to the
-
has misused   •-
           account. This report has included evidence which supports
                            computer system to view inappropriate and pornographic

of evidence suggests t h a t - - - knew         •
images as well as c o m p o s ~ l i c i t emails. In addition, the manual deletion
                                                   actions were a violation of
policy and attempted to delete evidence of wrongdoing.
                                                                               Ill
5. ( U / - ACTION: Followin this re ort's review by            Inspector General, it is
requested that                                                            provide the
Ill   Inspector General          ) a written respon                gation. Response
should include a planned course of action regarding                within 30 days of
receipt of this report.

6. (U) RECOMMENDATIONS:

                                     should be cited for the unauthorized usage of   Ill
        b. ( U / - A ~ o r t should be forwarded by the . . for inclusion
in the personnel file of - - - - in order to facilitate official record keeping.

      c.   (U/-1111 General Counsel considers legal action as appropriate.
                                           2
                  UNCLASSIFIED/
                 UNCLASSIFIED/

        d. ( U / - All 1111    employees must attend the required mandatory training
                               1111
prior to receiving access to any                                    resources. The
mandatory training is accessible through the
-       web site on the           The followin
attended annually:


7. (U) Questions regarding this investiga~cted to the
                                      at-.-i




                                          3
                 UNCLASSIFIED/
                 UNCLASSIFIED/

                                                              9 January 2012

MEMORANDUM FOR:        !Ill Inspector General
(U) SUBJECT: Misuse of Government Information System

1. (U) AUTHORITY: A preliminary inquiry was conducted under the authority and
guidance of: U.S.C title 18 Part 1 Chapter 47 Section 1030; "Fraud and Related Activity
in Connection with Computers"; "OMB A-130, Appendix Ill"; Nl8010.2R7,'
Instruction for Information Systems Security and Training"; Nl8470.2R8, '
Instruction for Internet Usage"; Nl8470.3R8, " - Instruction for Use of Electronic Mail
and other Electronic Communications"

2. (U) MATTER INVESTIGATED: Misuse of        1111
                                              provided
-      network and computer system (Pornography).

3. ( U / - FACTS:

      a. ( U / - On 30 November 2011, an audit of the SBU network was
      conducted to discover any potential                                       misuse.
      The audit reflected that a specific system and user account were potentially
      being utilized to view pornographic images.

      b. ( U / - On 30 November 2011 between 1400-1500 hours, the audit
      showed that userid -           assigned to
      according to network records, was used to access pornographic images in a
      folder within   home networked 'H:\' directory from the computer name
                      . The filenames of the images viewed were



      c. ( U / - On 12 December 2011, a forensic acquisition o f - home
      direct<;>ry revealed that the ima es discovered b the network audit were
      previously resident within                                          However, the
      images had been deleted. This was confirmed by a review of the thumbs.db
      database file, located within the folder, which captures a thumbnail of all images
      that have been viewed within the current folder at any time.                ). •
                                      folder path is a mapped network drive to the active



                UNCLASSIFIED/
                          •
                  UNCLASSIFIED/

       directory verified home d i r e c t o r ~ which is


       d. ( U / - The forensic case processor confirmed that userid -             had
       the securit identifier
                      The same   was the owner of the


                   A review of the system security audit logs for workstation
                      confirms that user -          was logged on to the workstation
       between 1400-1500 hours on 30 November 2011.

               CONCLUSION: Based on the evidence obtained to date,
                                                               concludes that a
case of misuse of the                 network and computer system exists with
regard to the usage of

5. ( U / - ACTION: Following this report's review by the          Inspector General, it
is requested that                                                      provide the
                                     a written response to this investigation. The
response should include a planned course of action regarding -          within 30 days
of receipt of this report.

6. ( U / - RECOMMENDATIONS:

      a. ( U / - - shall be cited for the misuse o f - (Internet-
      Pornography).

      b. ( U / - A copy of this report should be forwarded by the~ for inclusion
      in the personnel file of                  to facilitate official record keeping.

      c. ( U / - ~ General Counsel considers legal action as appropriate.

      d. ( U / - ~ Inspector General investigates any relevant time and
      attendance issues associated with this investigation.

      e. ( U / - All 111111 employees and contractors must attend the required
      mandatory training prior to receiving access to any
             resource. The mandatory training is accessible through the
                                              web site on the       . Th
                                           nded annually:
                                           and


      f. ( U / - The~ should consult the contractor's statement of work and
      contracting company's policies pertaining to disciplinary actions.


                                          2
                UNCLASSIFIED/
      •
 UNCLASSIFIED/




                 3
UNCLASSIFIED/
                  ·UNCLASSIFIED/




                       REPORT OF PRELIMINARY INQUIRY


(U) -     CASE NUMBER: 12-040

(U) SUBJECT




(U) ALLEGATIONS

1. ( U / - -              did not attend class on several days so


     ••
   personal vacation while attending the


2. ( U / -
   relationships with the
                                  sou ht out and established unduly familiar
                                               military officers attending the course
   and frequently associated with them outside of class.

3.              -         claimed residency status f o r - to avoid paying taxes in
              the state where. resided.

(U) BACKGROUND

(U//FOUO) On 17 January 2012, this office received a complaint via the   1111  Office of
Inspector General Hotline, which reflected            did not attend the required
training while attending -     had relationships with                        military
officers and claimed residency in a state where. did not reside.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

•    (U) 18 USC § 287, False, Fictitious or Fraudulent Claims

•    (U) 18 USC § 1001, Statements or Entries Generally

{U) ALLEGATION 1

{U) Facts
                 UNCLASSIFIEDl}FOR OFFICIAL USE ONLY·


                                                                     stated there was a
requirement for instructors to report students who did not attend classes. -     reviewed
their student accountability records and -           was never reported absent from.
classes.                       also coordinated with the senior team leader, who did not
have any reports of              missing any classes.

(U/- -               was questioned about missing several days of class while on
temporary duty (TOY) at                . -    stated:

           ( U / - "I only missed maybe four hours, if that for a dental appointment.
           My front tooth crown cracked. And it was a front tooth. And I talked to the
           professor, and then between the professor, I made up the assignments I
           missed. So I missed four hours by going to the dentist appointment at the
           beginning of the actual session."

          ( U / - "Because what happens, the -                and
          week before everyone else because everyone else is                          . So
          only the -        and               military come the week prior for like an
          integration period. Right there is where you meet all the                and
          maybe -             in that class. And that is the same week I went to the
          dentist."




                                      performance at
                                 ularl outstanding.
                                           as well as t
                                        course at the
          class participation during the course reflected
          and an in-depth knowledge of our
          strategies and their interrelationship with the
                                      "

          ( U / - · - was personally selected b y . team of instructors to serve
          in key leadership positions and essential staff positions throughout the
          exercise period of study. • perspective on national security issues and •
          experience in national level-intelligence added a critical dimension and were
          eagerly sought by students and faculty alike."

                      "Overall, -       represented
                  in a highly professional manner, exemplifying the highest of
          standards. •    attitude throughout was one of cooperation and
          understanding. -      is the hardest working student I have ever had in class.



                 UNCLASSIFIED/
                   UNCLASSIFIED/

                    always took. assignments seriously and gave them • full effort.
                 was a pleasure to have as a part of this class. •     performance clearly
            indicates a strong potential for handling duties of increased scope and
            responsibility in leadership."

( U / - Conclusion. The -           investigation found that -          attended the
required classes a t -

(U) Recommendation. Close this case without further investigation.

(U) ALLEGATION 2

(U) Facts

                                  was questioned about                interaction with
                         military officers.    stated that      encourages -
students to build relationships with the         students. One of the goals of the course
is to provide t h e - students positive experiences with the -                students in
an effort to demonstrate that what they see on television is not a reflection of all
              -          was one of many o u t g o i n g ~who helped the
         students adapt to the environment. Lastly, -                     stated there was
nothing inappropriate about                 behavior.

 ( U / - - w a ~ ~ e l a t i o n s h i p with international
students d u ~ Y at _ _ _ _ stated:

            (U/-"Wehad          •
            about. That is why it is called            . And I mean it takes them about
            •    years to get cleared to come through. They get to go the
            all that good stuff."

            (U/,_,'But we are assi ned. And           of the team leaders in the class,
            you are assigned to these                 o, myself and the instructor were
            ~ e d - we had a . from              a     from              , a . from
            -       And those were like our bonding group to help them."

            ( U / - "So we kind of split up with some of the civilians where, okay, we
            will work with these, these, these, and make them feel comfortable until they
            joined and integrated the second week with either our group or their group or
            wherever they were."

            ( U / - "So we were out just like some of the            people where you
            build relationships within that - week course,              week course·,
            however long it was."




                  UNCLASSIFIED/
                 UNCLASSIFIED/

( U / - Conclusion. The ~ o n did not find that ~ d unduly
familiar relationships with the - military officers a t t ~

(U) Recommendation. Close this case without further investigation.

(U) ALLEGATION 3

(U) Facts




( U / - - was asked about. state of residency. She stated:

                ( U / - "When I was active duty, my residency was
                came here                    , my residency was
                moved                 across the bridge to                   , my
                resid~s                So it was         m time in the military. And it
                was -         when I came aboard             And it has been
                since I have been here and moved across the bridge                   "

            Conclusion. The -       investigation found that -         did not claim
             state of residency while residing in -        and paid taxes owed to


(U) Recommendation. No further investigative work on this matter and that this
investigation be closed.




                UNCLASSIFIED/
                        UNCLASSIFIED/

                             REPORT OF PRELIMINARY INQUIRY
-      CASE NUMBER: 12-042

(U) TITLE: Alleged Conflict of Interest; Acceptance of a Gift from a Prohibited Source

(U) SUBJECTS:




(U) BACKGROUND

( U / - This office received. anonymous handwritten letters alleging possible
misconduct b y - government employees. The complainant provided the
following information:

         ( U / - It is my duty to report several instances of employee and
         employer/contractor misconduct involving improper gifts solicited and received by
         the former and iven b the latter. On Thurs~ November 2011 at
                      in                           o f - paid a $200 tab for
         and             This I personally witnesses. Questions about ethical implications
         were met with jokes then with a negative rebuke. Next it was strongly insinuated
         that I would be expected to pay for everyone at the next outing on 17 November.
         I did not attend this happy hour. The deputy task lead,                    was in
         attendance. At this point the task l e a d , - - • was aware of the situation.

         The occurrences between a government employer and employee give the
         appearance of impropriety particularly within the context of the elaborate baked
         goods prepared for government employee, the unusual personnel comfort levels

1
  (U) - w a s hired as a government employee in February 2012.
2  (U) This office contacted                      to get a copy of the receipt; however, due to the time which lapsed
since the incident, there was no record of the transaction.
3
   (U) - - - and •                  are no longer contractors a t -
                                                           1
                       UNCLASSIFIED/
                 UNCLASSIFIED/

       and lack of physical boundaries between them". "There is a correlation in time
       between there activities becoming more frequent and praise for the government
       contractor, at the expense of others who do not participate". "This behavior
       appears to have resulted in resentment and rumors generated from contractors
       from other companies particularly given   1111 surge support and contract
       decisions currently taking place. An expectation among -          per similar
       treatment; The inability of executive leadership to convey exemplary offer policy
       due to unwitting association with offending individuals and giving the impression
       that the behavior is not only acceptable but encouraged; feelings of isolation
       among rank and file employees who are uncomfortable with the situation but feel
       obligated to play along; and the public humiliation and reprimand of a contractor
       suggested of making a complaint by purposefully exposing admin information
       pertaining to that individual.

(U) SCOPE

               conducted this investigation in accordance with the standards set forth in
      Instruction (NI) 7410.8R3, Inspector General Investigations and Ombudsman
Intervention, 27 July 2007, and the "Quality Standards for Investigations," 15 November
2011, set forth by the Council of Inspectors General on Integrity and Efficiency. We
obtained testimony from . . employees believed to have information pertinent to the
allegations and issues.

(U) APPLICABLE STATUTORY AND REGULATORY STANDARDS

(U) 18 USC § 208, subsection (a), Acts affecting a personal financial interest

(U) 5 CFR § 2635.101, 202(a), 204, 501 (a) Basic obligation of public service

(U) 5 CFR § 2635.203 (d) (2), Prohibited Source

(U) NI 1000.7R1, Personal Relationships in the Workplace

(U) Testimony

( U ) - was questioned about the 3 November happy hour.               •   testified:

             "It was just again team building.               went out for happy hour:
             mysel                                                       also joined us,


                                      picked up the tab that time."

             ••-          just grabbed the bill before any of us could grab it so, and
             wouldn't let us pay."
                                                                                         •
                                            2
                 UNCLASSIFIED/
                       UNCLASSIFIED/

                   "I did not know    • •
                                        Wa.!.9oing to do that. That's the first time I met. so
                   that's, I did not know     was going to do that."

                  "After that we all paid our own." "I think we were just a little, we knew what

                  got it before   •
                  to expect then after that, that
                                   did."
                                                    •was going to try to get the receipt, so we


                  "During that time frame, no. I think we had a great working relationship
                  with our contractors. Now the contract has switched. We have a different
                  company working. And now there are circles forming where government
                  people and contractors are maybe classified as having inappropriate
                  relationships. 4

(U) -              testified:

          "Honestly, I don't know. I don't know what happened. Basically we were all
          getting all of our money out. We were ready to start paying and the. brought
          the check and -       grabbed it and just paid for it."

           ••  basically voluntarily did it. We were not thinking government/contracting. We
           weren't really thinking that. We were thinking friend."

(U)                  testified:

        "Often go to happy hours. We've been friends, personal friends for a while. A long
        time actually. We celebrate birthdays and anniversaries and, you know,
        graduations and things like that. But we had the happy hour a t - which is
        one of the places that we went because it's midpoint between where we live and
        where -        and      • 1111-     live."


        "Look, we've got to go. Let me just grab the check. And         •
        "It was one of those where the wait staff is really slow. And m y - just said,

                                                                                 •
                                                                       wasn't even thinking
        that, you know, we were thinking friends, not the government part.       just grabbed
        it and we paid it and left. So that was sort of all that happened."

        "But I can say each of us had time for one drink and a couple of appetizers. So it
        wasn't like we were sitting down to this big dinner or anything like that with a few
        drinks or, you know, bottles of wine or anything. It was very simple because we
        didn't have a lot of time."

(U) Conclusion

( U / - We did not find evidence to substantiate a conflict of interest or substantiate
the allegation t h a t - o r - accepted of a gift from a prohibited source.

4
    (U) The allegation reported b y - is being investigated i n - Case 13-049.
                                                    3
                      UNCLASSIFIED/
                        UNCLASSIFIED/

Investigation determined that                          ,-          and - w e r e friends prior
to attending the happy hour.                          testified that. husband is also a government
employee, grabbed the tab a                   id for the appetizers and drinks 5 before -
and-could pay.                                    paid the tab because of their personal relationship
and not because                                           were government employees.

( U / - Additionally, there was no evidence of impropriety within the context of the
elaborate baked goods reportedly prepared for government employees. There were
occasions when government and contractors would bring in baked goods for everyone,
no one was excluded. There was no evidence of a lack of physical boundaries or
unusual personnel comfort levels between government and contractors.

(U) Recommendation

(U) Close this investigation. No further investigative activity required.




5(U) None of the people involved could recall the actual cost of the drinks and appetizers due to the amount of time
that passed since the happy hour.
                                                         4
                       UNCLASSIFIED/
                   UNCLASSIFIED/




                                                                        14 February 2012

MEMORANDUM FOR: . . INSPECTOR GENERAL

(U) SUBJECT: Misuse of Government Information Technology

 1. ( U / - AUTHORITY: A preliminary inquiry was conducted under the authority of:
 DCID 6/3 "Protecting Sensitive Compartmented Information within Information
 Systems"; ICD Number 503, "Intelligence Community Information Technology Systems
 Security risk Management, Certification, and Accreditation"; DOD Directive 5220.22-M,
National Industrial Security Operating Manual (NISPOM); DOD Directive 8500.1,
"Information Assurance"; DOD Directive 8520.1, "Protection of Sensitive
Compartmented Information (SCI)"; NI 5205.1 R3,      'Ill  Instruction for Protection of
Sensitive Compartmented Information"; NI 8010.11 RS,    'Ill     Instruction for -
-            Computer Network Connectivity at Contractor and Other Facilities"; NI
8010.15R7, "Access to Removable Media on Classified Networks"; NI 8010.16R2,
· ~ Instruction for Managing Compartmented and Sub-Compartmented Information
on Sensitive Compartmented Information Systems"; NI 8010.2R7,         'Ill    Instruction for
Information System Security and Training"; NI 8100.1R13,      'Ill   Instruction for Portable
Electronic Devices"; NI 8470.2R8,   'Ill  Instruction for Internet Usage."

               MATTER INVESTIGATED: Misuse ofllll provided
                   network and computer system.


                                                    received notification of a     user
profile using offensive and inappropriate language via a web based Short Message
Service (SMS) application.                     inve~he notification and
confirmed the SMS messages originated from the - - profile, which is assigned to
                         accord in to the 11111Active Directory network management
tool                                   has opened an official investigation and found the
following:

      a. (U) 01 December-27 December 2012, multiple automated network auditing
captures of the -        profile revealed -
                                                                            • 11111
                                                    utilized the SMS application,
              , to communicate and send sexually explicit messages via
computer system to an unknown cell phone recipient.




                  UNCLASSIFIED/
                  UNCLASSIFIED/

       b. (U) A review of                 email account and computer system did not
reveal any additional evidence of misuse.

      c. (U) Nl8470.2R8,    'a.I Instruction for Internet Usage" specifically states
"Examples of prohibited uses include: 1) Accessing pornographic sites or downloading
images from such sites using NGA-sponsored accounts or computer equipment. 2)
Requesting, ordering, creating, downloading, viewing, storing, copying, or transmitting



     U/-
sexually explicit or sexually oriented materials or services for personal recreation
or entertainment while utilizing   11111sponsored Internet accesses."

4.            CONCLUSION: Based on the evidence obtained to date, -
      concludes that a ~ s u s e case exists with regard to the use of the
               profile. -               has included evidence which supports the



     (U/-
conclusion of misuse with regard to use o f - systems to send sexually explicit
and inappropriate communications.

5.             ACTION: Following this report's review by-nspector General, it is
requested that                                     11111
                              supervisor provide the       Inspector General -
a written response to this investigation. The response should include a planned course
of action regarding -           within•   days of receipt of this report.

6. (U) RECOMMENDATIONS:

                                 should be cited for the unauthorized usage of   11111
       b. ( U / - A copy of t ~ h o u l d be forwarded by the supervisor for
inclusion in the personnel file of . . . . . to facilitate official record keeping.

       c. (Ul-11111 General Counsel considers legal action as appropriate.
       d. ( U / - All 11111 e~ees must attend the re uired mandatory training
prior to receiving access to any -                                     resources. The
mandatory training is accessible through the
-       web site on the          . The followi
attended annual! :


7. (U) Questions regarding this investigation may be directed to the
                                       at




                                             2
                  UNCLASSIFIED/
UNCLASSIFIED/}FOR OFFICIAL USE ONLY •




                 3
UNCLASSIFIED/
Allegation: Hostile Work Environment

Subject:-

                                                                     heard
                                           and- o r - other employees talking about suicide. •
-                                    •
         made a comment about how would commit suicide.         •                •
                                                                     stated that if used a bag,
be tempted to pull it off. Another employee made a comment about using helium. After about 15/20
                                                                                                 •    would

minutes,                            said that the conversation was going wrong or •    did not like the way
the conversation was going (words to that affect). -            said well I am not talking about doing
anything to you; I'm talking about to myself (words to that affect) .The conversation continued for about
5 or 10 minutes. -           decided to report this infmmation t o . supervisor. -           stated that,
every morning the same group of employee,                                  ) would talk loudly about
different topics and most of the t i m e - stated. tried to ignore them ..

14 Feb 12: -           made a comment "at least l didn't do a - After that comment, -
stated. did not listen to the rest of their conversation.

15 Feb 12: -          notified. supervisor,
saw. since the conversation took place). -                  informed
                     division. Within ten minutes,                    gathered everyone in the area and
directed them to cease all conversation about suicide and inappropriate comments. • did not allow any
questions or comments. • guidance was very clear. After the meeting, -                and other
employees made light o                        guidance. The employee who made the comment about the
helium said "I hope my helium comment didn't cause that".

 16 Feb 12: -          was interviewed by this office and reiterated the information aforementioned
information. • concern was that the conversation was "grossly inappropriate".
who sits across the partition from them,. committed suicide. years ago. The group should not be
talking about suicide, as it was very insensitive of them.


 in the conversation). On 15 Feb
 visit t o - area. -
                                12,_
 17 Feb I 2: This office interviewed

                                            informed. that
 instructed them to stop all inappropriate conversations. -
                                                                    (supervisor for the employees engaged
                                                                                               •
                                                whose office is on the North side, went over for
                                                                                  had a meeting and
                                                                                                     daily

                                                                       was not sure of the cause for the
 meeting, but another employee came over and said it was probably because o f - -                     •
-      has known -             for over seven years and has nver had a performance issue, but•    is aware
o f - demeanor and attitude. According t o _ , _ and the other section
members are "grumpy people", but very professional, knowledgeable and experienced in their duties.
One of the members on the team was having medical problems which caused- to be in a lot of pain.
-                                                   •
           was not there during the conversation, but thinks the conversation statted because of the pain
the one employee talked about. Perhaps, they made some comments which were inappropriate, but •
-did not t h i n k - or any of the other employees were serious when they made the comments
or aware that someone may be offended by the comments.
2 Mar 12:                 briefed                   on the finding of this inquiry. The information was
referred to Management for action deemed appropriate.
                   UNCLASSIFIED/

                                                                        24 February 2012

 MEMORANDUM FOR:         Ill INSPECTOR GENERAL
 (U) SUBJECT: Misuse of Government Information System

1. (U) AUTHORITY: A preliminary inquiry was conducted under the authority and
guidance of: U.S.C. title 18 Part 1 Chapter 47 Section 1030, "Fraud and Related Activity
ih Connection with Computers"; "OMB A-130, Appendix Ill"; NI 8010.2R7~
Instruction for Information System Security and Training"; NI 8470.3R8,     "Ill--
Instruction for Use of Electronic Mail and other Electronic Communications"; NI
8470.2R8, I I ~ Instruction for Internet Usage."

~ MATTER INVESTIGATED: Misuse of               1111 provided
-      network and computer system.

                        On 23 Se tember 2011, the
                                     received notification from
                           that profile                connected to the
                      network made multiple outbound traffic attempts to a
                     and '                      "               investigated the notification
and confirmed the multiple outbound traffic attempts                      -            opened
an official investigation and found the following:

      a. ( U / - On 21 October 2011,
software tool to review and confirm profile
                           s stems
                                                  ) during the unusual web traffic attempts
dated 09/21/2011-11/15/2011. A network monitori~vided activity logs that were
collected referencing the vi~\/\.li119 of • - " and · - " during work hours for
extended periods of time. ( - - -

3. ( U / - CONCLUSION: Based on the evidence o b t a i n e d ~ has
included evidence which supports                 has m i s u s e d - ~ r
system to access              and               Policy (Nl8470.2R6) references the
personal obligations of       personnel for access to the Internet at work for personal
use and official use. Personal use of electronic communication system must not
adversely affect the performance of official duties by the individual or the individual's
organization, result in added costs to the government, or overburden the system. An

                 UNCLASSIFIED/
                   UNCLASSIFIED/

Ill Policy (NI 8470.3R8) also reference the use of electronic communication is a
privilege and misuse of these privileges is a violation of the Standards of Ethical
Conduct.

4. ( U / - ACTION: Following this report's review by
requested that                                                       provide the
Ill   Inspector General      a written response to ~ a t i o n . The response
should include a planned course of action regarding . . . . . within 30 days of
receipt of this report.

5. ( U / - RECOMMENDATIONS:

                                   should be cited for the misuse of   Ill-
        b. ( U / - A ~ r t should be forwarded by the                    1111  for inclusion
in the personnel file oflllllllllllllll to facilitate official record keeping.

       c. (Ut-111 General Counsel considers legal action as appropriate.
       d. (U/-111 Inspector General investigates any relevant time and
attendance issues associated with this investigation.

        e. ( U / - All  Ill    employees must attend the required mandatory training
prior to receiving access to any                                    resources. The
mandatory training is accessible through the
-       web site on the           The followin train'
attended annually:


6. (U) Questions regarding this investigation may be directed to the
                                       at




                                             2
                  UNCLASSIFIED/
                   UNCLASSIFIED/
                                                                                MAY 1 4 2012

 MEMORANDUM FOR

 SUBJECT:             (U) All~ Contract Employee Time and Attendance Fraud
                      111111 •Case Number 12-061)




2. ( U / - Our review consisted of c o m p a r i n ~ access control data for
. . facilities in -         a n d - with .111111(1lmesheets for the period 01 May
- 31 October 2010. We counted only those days when access control records were
available and reflected both an entry and an exit time showing that -     worked
fewer hours than those. claimed on . . . time sheet records. We communicated
with the       contracting officers. We also communicated with
                                            . We determined that




                                                                           , stated that
work will be performed within the                   metropolitan area. All work will
occur within government facilities with government provided work area, computers and
other routine office equipment and supplies.



       , stated that work will be performed within the
    metropolitan areas. All work will occur within government facilities with government
provided work area, computers and other routine office equipment and supplies.

5. ( U / - Enclosed for your review and action is our analysis o f - · time
and attendance records. We found that from 1 May 2010 through 31 October 2010,
-          claimed 22 hours and 35 minutes on . . . time sheets, at a fully
burdened cost of $3,171.19, when the access control data showed that. was not in
a n - ; . assigned duty station.

6. (U) We are forwarding this information for action as you deem appropriate. We
request that you furnish the -   with a report of action taken within 30 days of receipt of
this memorandum. Upon request, the -        will provide specific evidentiary documents
as necessary. A tasking was established in -             to track the suspense.

                 UNCLASSIFIED/
                UNCLASSIFIED//FOR OFFICIAL USE ONI!. Y



SUBJECT:           (U) All~d Contract Employee Time and Attendance Fraud
                   ~ - Case Number 12-061)


  (U) Should you have questions or re uire additional information, please contact
                                                                     at




                                         2

               UNCLASSIFIED/
                 UNCLASSIFIED/



MEMORANDUM FOR

SUBJECT:               (U) Referral of Time and Attendance Analysis, Office of Inspector
                       General Case Number 12-062

1. ( U / - The••         •
analysis of an allegation that
                                                      has completed a preliminary
                                              may have engaged in time and
attendance (T&A) abuse from 27 February through 30 November 2011. -             is



2. ( U / - Our analysis of                     access control records, T&A documents,
and training and travel records for the period referenced above revealed a discrepancy
of 114 hours and 35 minutes, worth $4,467.40                    ). The analysis disclosed
the amount of time t h a t - claimed on-T&A records, compared with the
amount of time we could confirm independently that• was present a t • assigned
duty location. The value of the hours t h a t - did not work falls below the -
$5,000 threshold for pursuing a T&A fraud investigation.

3. (U/~        We are providing this information for your review and action as you deem
appropriate. We did not i n t e r v i e w - or• supervisor or conduct any further
inquiry regarding the T&A discrepancy. We recommend that you ensure that
-            and• supervisor have the opportunity to provide input regarding the
matter. Should you determine that disciplinary action is appropriate, we recommend
that you coordinate the action with the                           . Please consider
recouping any funds paid to -             when• was not present for duty.

4. (U) Please furnish us with a report of action taken or planned within•    days of your
receipt of this memorandum. A tasking was established in -             to track the
suspense.




Enclosure as stated




                 UNCLASSIFIED/
                  UNCLASSIFIED/


                                                                            MAR 2 6 2012
MEMORANDUM FOR

SUBJECT:                (U) Referral of Time and Attendance Analysis, Office of Inspector
                        General Case Number 12-063




2. ( U / - Our analysis of                   access control records, T&A documents,
and training and travel records for the period referenced above revealed a discrepancy
of 85 hours and 58 minutes, worth $4154.39 -                     The analysis disclosed
the amount of time t h a t - claimed o ~ s . compared with the
amount of time we could confirm independently that ~ s e n t at
duty location. The value of the hours that it appears -
                                                                        •  assigned
                                                                 did not work falls below
the- $5,000 threshold for pursuing a T&A fraud investigation.

3. ( U / - We are providing this fnformation for your review and action as you deem
appropriate. We did not interview -            or conduct any further inquiry ~arding
the T&A discrepancy. We recommend that you ensure that -                 and•
supervisor have the opportunity to provide input regarding the matter. Should you
determine that disciplina action is ap ropriate, we recommend that you coordinate the
action with the                           . Please consider recouping any funds paid to
-           when     was not present for duty.

4. (U) Please furnish us with a report of action taken or planned within
receipt of this memorandum. A tasking was established in -
                                                                        •    days of your
                                                                       to track the
suspense.




Enclosures as stated




                  UNCLASSIFIED/
                UNCLASSIFIED/

                                                                   4 April 2012

MEMORANDUM FOR RECORD

SUBJECT:                 Summary o f ~ - Case #12-072

1. (U//FOUO) Background

The                                           uncovered a series of emails on
24 February 2012, as a result of data mining, that discussed the loss/theft of
vials of vaccines from the medical dispensary at    11111 The emails suggested a
                                                                                  •
lack of controls that resulted in the loss of medical supplies. Subsequent
inventory of the vaccines revealed the following mis~ items: ~of
-           vaccine, •    vials of 11111 vaccine, and -     vials of___ There is
no lock on the refrigerator door; access to the room is controlled via badge reader.

The -   alerted                         and • staff and recommended an
immediate invent     to confirm the lost/missing items. On 16 March 2012,
                   and the undersi ned met with                               and
                                      , who has oversight of the medical clinic.  •
                                                    administers the clinic and that
                           staffs it with contractors.
advised that    would need a police report to begin an inv~ation into the
missing items. The issue of who would provide the report, -       or -     was
pending at the end of the meeting.

On 20 March 2012,                               , called the und~ned and
confirmed that        with responsibility for the dispensary at -  would file the
police report and that                   would ensure they did so.

On 29 March 2012,                            and the undersigned spoke with
                        to inquire on the status of the police report. -
confirmed that
that the police officer had started•
                        had filed a report with the ~olice. -
                                          interview~ coordination with
                                                                       further confirmed

                indicated that the loss was probably due to a lack of proper and
routine administrative and accountability procedures. Since implementing checks
       times a da , there have been no incidents.                     called -

stated that the report was complete and awaiting review by     •
                    , to inquire about the status of the police investigatio~
                                                                      deputy.

On 30 March 2012, the undersigned picked up the police report from
-    for -  review. The report revealed that the refrigerator that houses the




               UNCLASSIFIED/
               UNCLASSIFIED/


vaccines does not appear to have its own locking device. While it is located in a
room with badge-only access, the witness statements revealed high traffic into the
room for reasons unrelated to retrieving or administering vaccines, i.e., access to
other supplies and reference books.

On 3 April 2012,                 confirmed that there is a locking device on the top
of the refrigerator, but he was not sure when it was installed or if it was being
routinely utilized.


Scope

2. ( U / - Our preliminary inquiry focused on monitoring the possible
loss/theft of the vials of vaccines to ensure the issue was handled within the
appropriate channels.

Findings

3. ( U / - There were no routine accountability checks prior to the possible
loss/theft. Since the inception of checks11111
                                          times a day, there have been no
incidents.

4. ( U / - The refrigerator in question is located in an area that is highly
trafficked by the medical staff for reasons unrelated to the administration of
vaccines.

Conclusion

5. ( U / - The issue of the possible loss/theft of vaccines was handled in
appropriate channels.,

Recommendation

6. (U) Recommend that no further investigative work be conducted on \his case
and that this matter be closed. Further recommend that. require the clinic to
routinely utilize the locking device on the refrigerator as an additional security
measure.




                                         2
              UNCLASSIFIED/
                  UNCLASSIFIED/




                               EXECUTIVE SUMMARY

-CASE NUMBER: 12-074

(U) TITLE: Alleged Alteration of Official Records

(U) ALLEGATION

              This investigation addressed an allegation referred to the                  by
                                                 in a memorandum dated 24 February
                                                           obtained evidence "indicating
                                                            be deleted for contractor
personnel currently working in                                  requested that 111111 identify
the official who issued the directive and determine the rationale behind the decision to
alter official government records. While gathering information in response to the
1111    which began in July 2011, the -    received an e-mail record in which an
official requested that some contractors be removed from -                That official was
identified as                      . The            investigation focused on the allegation
that

                     directed the removal of contractors' records from                 for
purposes of altering government records to impede a -         audit of
with the Base Realignment and Closure (BRAC) law.

(U) INVESTIGATION

( U / - Investigators did not find credible evidence that -           directed the
removal of contractors from           or alteration of government records with the
specific intent of impeding the     audit of         compliance with BRAC law. The
contractors were not removed from              but their records were altered to clarify
their location and function as               who, therefore, were not subject to
BRAC.

(U) RECOMMENDATION

( U / - Based on our i ~ d i n g s , we have no recommendation and are
providing this report to t h e - • for informational purposes.




                  UNCLASSIFIED/
                  UNCLASSIFIED/

                                                                               APR 2 5 2012

MEMORANDUM FOR

SUBJECT:               (U) Theft of Government Property, -Case Number 12-075

 1. ( U / - On 12 March 2012, the
an e-mail from the
                 ., a contractor with
 19 December 2011, during a routine poly
while working in the destruction facility in
-    computer hard drives,. sticks of RAM, and

2. ( U / -            c~eliminary inquiry into the m a t t e r - · When
interviewed b
~ith
                     ,-               cha~ his previous statement and said
                   computer hard drives, -     sticks of RAM, and
                                                                                •
                                                                       PDAs without
                                                                                    left

~ advised-that these items were destroyed.
knew unauthorized removal of government property from an
                                                                               said •
                                   is prohibited. -        determined that there was
"no evidence of compromise of classified information."

3. ( U / - We are forwarding t h e - investigative report for your review and

or planned within•
any action deemed necessary. We request that you inform the
                     days of your receipt of this package. An
opened to track the suspense.
                                                              of any action taken
                                                                  tasker was


              Should you have questions or re uire additional information, please
                                                                             at!I.
                                                          ...




Enclosure as stated




                 UNCLASSIFIED/
                 UNCLASSIFIED/

MEMORANDUM FOR RECORD                                             2 May 2012

SUBJECT: Case No. 12-076, Improper Time Charging

   1.             This case was opened on 21 March 2012 based upon a disclosure

                                                                         , who was
        working on the                                                        , and
        found. had improperly billed 171 hours between July and October 2011.

  2. ( U / - On 2 May 2012, -                 provided a copy of a letter
     provided to       , titled "Notification of Time Charging lnconsis
     letter            described how they had terminated
     employment and they were processing a credit to  11111  of $22,242.72.

  3. (U) On 2 May 2012,   1111   confirmed t h a t - was in receipt of the -
     Systems notification letter.

  4. (U) No further- action on this matter is required. Recommend this case be
     closed.




        ~eReorteur,with recommendation.




-
                 UNCLASSIFIED/
               UNCLASSIFIED/


                                                              1 May 2012

MEMORANDUM FOR RECORD

SUBJECT:               Summary of   1111 Case #12-080
1. ( U / - Background




-        further indicated that the
requested documentation from the contractor,             ,
claim o f - hours b y - individual. On 15 March 2012,
them a deadline of the following week to provide the documentation.




Scope

2. (U!IIIIII Our preliminary inquiry focused on determining whether_,
_ _ the appropriate documentation to justify the labor charges for


Findings

3. ( U / - -               responded to the contracting officer's request for
appropriate documentation to substantiate the labor charges for
providing timesheets and a spreadsheet.




              UNCLASSIFIED/
              UNCLASSIFIED/


4. ( U / - The complainant,                , is also the                 of the
contract in question. Once                rovided the documentation to justify the
labor charges for                           was satisfied.

Conclusion

5. ( U / - The issue of the unrealistic labor charges was resolved by
documentation that showed that                •    hours were worked over
-weeks, not. weeks as originally believed.

Recommendation

6. (U) Recommend that no further investigative work be conducted on this case
and that this matter be closed.




                                      2
             UNCLASSIFIED/
                   UNCLASSIFIED/

MEMORANDUM FOR RECORD                                                   13 July 2012

SUBJECT: Case No. 12-087, Subcontractor Reporting Overpayment

   1.               This case was opened on 30 A ril 2012 based u on a disclosure




                                                                         ternal investigation
        and found that         employees                          and                  ) had
        misreported their mileage and travel time after their duty location changed in April
        2011.11111 policy allows employees to charge time and mileage for traveling to a
        client site if the time and distance to the site exceeds the time and mileage for
        the employee to travel between their home and the             office to which the
        employee is assigned. When -                 and              assignment location
        changed in April 2011, the time and distance from their home was no longer
        more than it would be to their assigned  111111   office.11111 did not determine
        definitively that either employee knowingly claimed mileage and travel time when
        they should not have done so.

  2.               On 10 July 2012,
                         , provided an email titl
        Attached to this email were. letters        each for           and                )
        from                   describing how they had already processed a credit to
        ~ of $44,482.21.

  3. (U) On 12 July 2012,
     confirmed that~ had received the credit of $44,482.21 from

  4. (U) No further- action on this matter is required. Recommend this case be
     closed.




        (~Nonconcur with recommendation.




-                  UNCLASSIFIED/
                    UNCLASSIFIED/

                                                                                   MAY~ 8 2012

  MEMORANDUM FOR


  SUBJECT:                     Case Number 12-091, SISCI Computer Misuse Report,


  REFERENCES:             a. (U) ~ Instruction 8470.2R8, Internet Usage, 9 December
                             2009

                          b. (U) NI 8470.3R8, Use of Electronic Mail and Other Electronic
                             Communications, 9 January 2006




 ~ On 13 May 2011, an
 ~ m e d a routine audit of                 BlackBerry server SMS (Short Message
 Service) logs. A log file contained      outg~essages from -
 containing sexual dialog. A further review o f - BlackBerry records revealed
 multiple text messages containing inappropriate dialog.

 3. (U) Reference a prohibits accessing pornographic sites, downloading pornographic
 images, or requesting, ordering, creating, viewing, storing, copying, or transmitting
 sexually explicit or sexuall~nted materials or services for personal recreation or
 entertainment while using --sponsored Internet access. Reference b prohibits
 inappropriate use o f ~ electronic communications, to include disparaging or
 derogatory comments attacking someone's character or integrity, including profanity and
 other abusive language.

4. (U) We determined that this matter did not warrant criminal investigation or additional
investigation by us. We enclosed the report to aid with your determination of

tak~n or proposed within   •
appropriate action to take regarding -            Please provide us with a report of action

                                                                              •
                             days of receipt of this _memorandum. This suspense will be
tracked to completion through the                                          .   will report
overdue suspenses at the-key components meeting.

 5. ( U / - Please contact us if you need to view the entire -           file, which includes
·the supporting exhibits. We ask that you limit access to this report to those who have




                   UNCLASSIFIED/
                  UNCLASSIF-IED//rOR OFFICIAL USE ONL¥



SUBJECT:         Case Number 12-091, -        Computer Misuse Report,


an official need to review it. .These documents and materials should not be released or
                                                    1111
further disseminated without the prior approval of the     Inspector General.

•
    •
                  • • •       -•      •   • -   . ..
                                                   -- •           •     •    .-


        • •
                                                      •    ...   -- •       ••• •
                                                      Z'


Enclosures as stated




                                          2
                UNCLASSIFIED/
                UNCLASSIFIED/

MEMORANDUM FOR RECORD                                                21 September 2012

SUBJECT: Case No. 12-098, Possible Time and Attendance Fraud

   1. ( U / - This case was opened based upon a request for assistance on 5
      June 2012 from




     from 2 April to 1 June 2012.

  2. (U) In response to the request,   Ill undertook the following actions to resolve
     the matter:

        -   (U) On 7 June 2012,                          requested
            ~.obtain-.

        -   (U) On 18 June 2012,                           , provided the . . data.

        -


        -   -
            (U) On 19 June 2012, the requested records were provided to


            (U) On 21 September 2012, -
            that -
                                                     advised that Ill    had determined
                              had legitimate work activities outside the . . facilities
            during that time period and therefore they had no concerns about
            mischarging.

  3. (U) No further- action on this matter is required. Recommend this case be
     closed.




     (UtConcur/~,9>nconcur with recommendation.




               UNCLASSIFIED/
                    UNCLASSIFIED/

                                                                                        JUL 1 3 2012
 MEMORANDUM FOR

 SUBJECT:               (U) Misuse of Government Property, -       Case Number 12-110

1. (U/-The
2012, regarding

           The complainant reported that         may have used    computer system
privileges atIll to obtain personal information about an    Ill
                                                             employee.




supervisor,                                                                                   , and
-          government point of contact                   plainant opined that           may have
~omputer privileges to look u                            license plate and/or       parking "hang
tag" in an . . database to identify                 and send. the e-mail.

                On 29 June 2012,
                              talke to           about using the       computer system for

that  •
personal reasons. Since
         actions were isolated due to
acquired position at11111 -
                                     •
                                     started working in -       in May 2012, it was determined
                                           lack of understanding of the parameters of
                                       i n s t ~ to contact the
                                                                                         newly
                                                                                             if a
similar situation occurred in the future. ~ e d -                    that   would not con ront
employees in the future and would be more professional when working with customers.

4. ( U / - We are forwarding this memorandum for your review and any action you deem
necessary. We request that you inform t ~ any action taken or planned within
of your receipt of this memorandum. An -
                                                                              days
                                          tasker was opened to track the suspense.
                                                                                        •




-
cc:




                   UNCLASSIFIED/
                  UNCLASSIFIED/
                                                                                     AUG O6 2012

MEMORANDUM FOR

SUBJECT:


REFERENCES:            a. (U) Ill Instruction 8470.2R8, Internet Usage, 9 December
                          2009

                       b. (U) I l l Instruction 8470.3R8, Use of Electronic Mail and
                          Other Electronic Communications, 9 January 2006




2. ( U / - On 18 June 2012, the Forensics Branch received notification as a result
of a random network audit that an   1111user identified as                was preparing
and sending sexually explicit correspondence. Branch staff confirmed that the
inappropriate behavior originated from that profile, which was assigned to

3. ( U / - On 20 June 2012, -           found multiple automated network captures of
the profile composing and sending sexu~mails us.!!!a._Hotmail account
                         . A search of . . . . . profile, -       e-mail account, and
home directory found nothing else of interest.

4. (U) The references cited prohibit inappropriate use of Ill-sponsored Internet
accounts, including requesting, ordering, creating, downloading, viewing, storing
copying, or transmitting sexually explicit or sexually oriented materials or services for
personal recreation or entertainment.

5. ( U / - This office maintains -          full report, including the supporting exhibits.
Please contact us if you need to view it. We ask that you limit access to the file to those
who have an official need to know. These documents and materials should not be
released or further disseminated without the prior approval of the I l l Inspector
General.

6. (U) We determined that this matter did not warrant criminal investigation or additional
investigation by us. We enclosed the         report to aid with your determination of
appropriate action to take regarding




                 UNCLASSIFIED/
                 UNCLASSIFIED//FOR OFFICIAL USE ONl::Y·



SUBJECT:


                                                                       •
7. (U) Please provide us with a report of action taken or proposed within    days of


key components meeting.
                                      .•
receipt of this memorandum. This suspense will be tracked to completion through the
                                            will report overdue suspenses at the -




           Thank you for your cooperation and prompt attention to this matter.




Enclosure as stated




                                           2
                 UNCLASSIFIED/
                 · UNCLASSIFIED/


                                                                                  AUG O6 2012
MEMORANDUM FOR

SUBJECT:


REFERENCES:             a. (U)  Ill Instruction 8470.2R8, Internet Usage, 9 December
                           2009

                        b. (U)  Ill  Instruction, Use of Electronic Mail and Other
                           Electronic Communications, 9 January 2006

~ Attached is an
~ i g a t i v e report in
contractor. The contractor is



2. ( U / - On 24 April 2012, the Forensics Branch received notification as a result
of a random network audit that an   l.i computer system identified as
was being used to write and send foul a n d ~explicit correspondence. The



-
inappropriate behavior originated from the . . . . profile, which is assigned to


               From 05 February through 14 June 2012, automated software captured
              profile accessing YouTube, Gmail, Jabber, and Google Chat for personal
use. The Gmail accounts were being used to compose and send sexually explicit e-
mails and instant messages. Software also found t h a t - was using an . . .
computer system identified as                  to compose sexually explicit content.

4. (U) The references cited prohibit inappropriate use of Ill-sponsored Internet
accounts, including requesting, ordering, creating, downloading, viewing, storing
copying, or transmitting sexually explicit or sexually oriented materials or services for
personal recreation or entertainment.

5. ( U / - This office maintains -          full report, including the supporting exhibits.
Please contact us if you need to view it. We ask that you limit access to the file to those
who have an official need to know. These documents and materials should not be
released or further disseminated without the prior approval of the . . . Inspector
General.




                  UNCLASSIFIED/
                   UNCLASSIFIED/



 SUBJECT:


 6. (U) We determined that this matter did not warrant criminal investigation or
 additional investigation by us. We have enclosed the        re ort to aid with your
 determination of appropriate action to take regarding

                                                                          •
  7. (U) Please provide us with a report of action taken or proposed within days of
· receipt of this memorandum. This suspense will be tracked to completion through the
                                 - · SI will report overdue suspenses at the -
  key components meeting.

 8. (U//FOUO) Should ou have questions or re uire additional information, lease
 contact
          . Thank you for your cooperation and prompt attention to this matter.




 Enclosure as stated




                                            2
                  UNCLASSIFIED/
                      UNCLASSIFIED/

                                                                                JUL 2 9 2013
MEMORANDUM FOR

SUBJECT:                  (U) Referral of Time and Attendance Analysis,
                          - C a s e Number 13-132
1. (U/-The
into an allegation that
from June 2012 to Ju


2. ( U / - Our assessment of                         access control records, T&A documents,
and training and travel records for the period referenced above revealed a discrepa~ of
     hours, worth $4,307.37 (see enclosure). The analysis disclosed the time that•
           claimed o_ri__a T&A records, compared with the time we could confirm
independently that .-Was present a t . assi~d duty location. The value of the hours
that                 did not work falls below the- $10,000 threshold for pursuing a T&A
fraud investigation.

3. ( U / - Additionally,                  submitted time during deployment averaging -
hours per day for -    days. This submitted time appears to be excessive, and therefore, we
request management revisit the certified time for               during the deployment period
and verify its accuracy.
4. ( U / - We are providing this information for your review and action as you deem
appropriate. We did not interview                o r . supervisor or conduct any further
inquiry regarding the T&A discrepancy and deployment period. We recommend that you
ensure that                 and • supervisor have the opportunity to provide input regarding
the matter. Additionally, in accordance with 31 USC§ 3711, Federal agencies are required
to attempt collection of debts owed to the U.S. Government. Please contact the 1111111
                                                                               to pursue
recovery of unearned income paid to
5. (U) Please furnish us with a report of action taken or planned within
receipt of this memorandum. A tasking was established in -
                                                                          •  days of your
                                                                       to track the suspense.
6. (U//FOUO) Should you have questions or require additional information, please contact




Enclosure as stated




                      UNCLASSIFIED/