Fired, Preet Bharara and $100 Million Dollars

With the approval of President Trump, Attorney General Jeff Sessions fired several attorneys general including the United States Attorney General for the Southern District of New York, Preet Bharara. In many instances, this may have been a prudent decision, however, Bharara did in fact perform some stellar legal work and credit must be offered where it is due.

This post is not so much about the Attorney General being fired as it is about the matter of hacking and phishing and costing two domestic internet tech companies $100 million dollars. These schemes are a very common daily event and few if any companies ever talk about it publically as they reveal cyber protection vulnerabilities and how employees are duped to the schemes. To be more clear, this is how Hillary Clinton’s campaign architect, John Podesta had his emails scooped up such that WikiLeaks got them, posted them for global access during the United States campaign and election cycle.

Further, to those out there that are angry with the FBI, this case in some fairness illustrates the work rank and file agents are tasked to investigate. When it comes to cyber/hacking cases, they are among the hardest to solve especially with international operatives.

Image result for preet bharara  BusinessInsider

Now enter Preet Bharara and the case he prosecuted against EVALDAS RIMASAUSKAS. The indictment is found here.

In an additional disclosure, Bharara is also being sued by a hedge-fund.

The summary of the case:

Department of Justice

U.S. Attorney’s Office

Southern District of New York

FOR IMMEDIATE RELEASE

 

Lithuanian Man Arrested For Theft Of Over $100 Million In Fraudulent Email Compromise Scheme Against Multinational Internet Companies

Joon H. Kim, the Acting United States Attorney for the Southern District of New York, and William F. Sweeney Jr., the Assistant Director-in-Charge of the New York Office of the Federal Bureau of Investigation (“FBI”), announced criminal charges against EVALDAS RIMASAUSKAS for orchestrating a fraudulent business email compromise scheme that induced two U.S.-based internet companies (the “Victim Companies”) to wire a total of over $100 million to bank accounts controlled by RIMASAUSKAS. RIMASAUSKAS was arrested late last week by authorities in Lithuania on the basis of a provisional arrest warrant.  The case has been assigned to U.S. District George B. Daniels.

Acting U.S. Attorney Joon H. Kim said:  “From half a world away, Evaldas Rimasauskas allegedly targeted multinational internet companies and tricked their agents and employees into wiring over $100 million to overseas bank accounts under his control. This case should serve as a wake-up call to all companies – even the most sophisticated – that they too can be victims of phishing attacks by cyber criminals. And this arrest should serve as a warning to all cyber criminals that we will work to track them down, wherever they are, to hold them accountable. The charges and arrest in this case were made possible thanks to the terrific work of the FBI and the cooperation of the victim companies and their financial institutions. We thank the companies and their banks for acting quickly, coming forward promptly, and cooperating with law enforcement; it led not only to the charges announced today, but also the recovery of much of the stolen funds.”

FBI Assistant Director William F. Sweeney Jr. said:  “As alleged, Evaldas Rimasauskas carried out a business email compromise scheme creatively targeting two very specific victim companies. He was initially successful, acquiring over $100 million in proceeds that he wired to various bank accounts worldwide. But his footprint would eventually lead investigators to the truth, and today we expose his lies. Criminals continue to commit a wide variety of crimes online, and significant cyber data breaches have had a negative impact across a variety of industries. The FBI will continue to work with our domestic and international partners to pursue criminals who engage in this type of activity, wherever they may be hiding.”

According to the allegations contained in the Indictment unsealed today[1]:

From at least in or around 2013 through in or about 2015, RIMASAUSKAS orchestrated a fraudulent scheme designed to deceive the Victim Companies, including a multinational technology company and a multinational online social media company, into wiring funds to bank accounts controlled by RIMASAUSKAS.  Specifically, RIMASAUSKAS registered and incorporated a company in Latvia (“Company-2”) which bore the same name as an Asian-based computer hardware manufacturer (“Company-1”), and opened, maintained, and controlled various accounts at banks located in Latvia and Cyprus in the name of Company-2.  Thereafter, fraudulent phishing emails were sent to employees and agents of the Victim Companies, which regularly conducted multimillion-dollar transactions with Company-1, directing that money the Victim Companies owed Company-1 for legitimate goods and services be sent to Company-2’s bank accounts in Latvia and Cyprus, which were controlled by RIMASAUSKAS.  These emails purported to be from employees and agents of Company-1, and were sent from email accounts that were designed to create the false appearance that they were sent by employees and agents of Company-1, but in truth and in fact, were neither sent nor authorized by Company-1.  This scheme succeeded in deceiving the Victim Companies into complying with the fraudulent wiring instructions.

After the Victim Companies wired funds intended for Company-1 to Company-2’s bank accounts in Latvia and Cyprus, RIMASAUSKAS caused the stolen funds to be quickly wired into different bank accounts in various locations throughout the world, including Latvia, Cyprus, Slovakia, Lithuania, Hungary, and Hong Kong.  RIMASAUSKAS also caused forged invoices, contracts, and letters that falsely appeared to have been executed and signed by executives and agents of the Victim Companies, and which bore false corporate stamps embossed with the Victim Companies’ names, to be submitted to banks in support of the large volume of funds that were fraudulently transmitted via wire transfer.

Through these false and deceptive representations over the course of the scheme, RIMASAUSKAS, the defendant, caused the Victim Companies to transfer a total of over $100,000,000 in U.S. currency from the Victim Companies’ bank accounts to Company-2’s bank accounts.

*                *                *

RIMASAUSKAS, 48, of Vilnius, Lithuania, is charged with one count of wire fraud and three counts of money laundering, each of which carries a maximum sentence of 20 years in prison, and one count of aggravated identity theft, which carries a mandatory minimum sentence of two years in prison.

The maximum potential sentences are prescribed by Congress and are provided here for informational purposes only, as any sentencing of the defendant will be determined by the judge.

Mr. Kim praised the outstanding investigative work of the FBI, and thanked the Prosecutor General’s Office of the Republic of Lithuania, the Lithuanian Criminal Police Bureau, the Vilnius District Prosecutor’s Office and the Economic Crime Investigation Board of Vilnius County Police Headquarters for their assistance in the investigation and arrests, as well as the Department of Justice’s Office of International Affairs.

The case is being prosecuted by the Office’s Complex Frauds and Cybercrime Unit.  Assistant U.S. Attorney Eun Young Choi is in charge of the prosecution.  Assistant U.S. Attorney Edward Diskant is handling the forfeiture aspects of the prosecution.

The charges contained in the Indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty.

 

[1] As the introductory phrase signifies, the entirety of the text of the Indictment, and the description of the Indictment set forth herein, constitute only allegations, and every fact described should be treated as an allegation.

About that Trump Server with Pings from Alfa Bank

A matter of note: Alfa Bank has FIFA as a customer. Under Loretta Lynch at DoJ, she prosecuted the FIFA fraud, Further, that pesky Trump dossier that was crafted by Christopher Steele is the same person that broke the case on FIFA. (Note the end of this press release).

Image result for alfa bank  Image result for alfa bank russia

Press Statement: Alfa Bank confirms it has sought help from U.S. authorities, and discloses new cyberattacks linked to Trump hoax  —

Alfa Bank, a privately owned Russian bank, confirmed today that it has contacted U.S. law enforcement authorities for assistance and offered U.S. agencies its complete co-operation in finding the people behind attempted cyberattacks on its servers that have made it appear falsely that it has been communicating with the Trump Organization.

Alfa Bank confirmed a story in Circa News that it had been subjected to three new attempted domain name server (DNS) cyberattacks of increasing intensity over the last few weeks. In the attacks, multiple DNS requests were made by unidentified individuals, mostly using U.S. server providers, to a Trump Organization server. The DNS requests were made to appear as if they originated from Alfa Bank. The DNS responses from the Trump server were then erroneously returned to Alfa Bank, activating Alfa Bank’s automated security systems on February 18 and again on March 11 and 13. Alfa Bank has engaged the U.S.-based cyber forensics firm Stroz Friedberg to investigate these new attacks.

Alfa Bank believes that these malicious attacks are designed to create the false impression that Alfa Bank has a secretive relationship with the Trump Organization. In fact, there is not and never has been such a relationship.

New February 2017 attack on Alfa Bank server

On February 18, 2017, Alfa Bank experienced suspicious cyber-activity from an unidentified third-party. Specifically, the unidentified third-party repeatedly sent suspicious DNS queries from servers in the U.S. to a Trump Organization server. The unidentified individuals made it look as though these queries originated from variants of MOSCow.ALFAintRa.nET. As a result, the DNS responses from the Trump server were returned incorrectly to Alfa Bank’s server, which triggered Alfa Bank’s automated security system.

Alfa Bank believes that unknown individuals — using an identified U.S.-based service provider — are behind this recent attack, and that they are attempting to trigger verification signals between Alfa Bank and a server associated with the Trump Organization.

It believes that someone or some group manufactured this deceit by «spoofing» or falsifying DNS lookups to create the impression of communication between Alfa Bank and the Trump Organization. However, Alfa Bank’s DNS servers neither send nor receive email. Instead, they react when contacted by unwanted and unsolicited messages by sending out DNS verification signals asking, in effect, who is the server contacting Alfa Bank.

An Alfa Bank spokesperson said:

“The cyberattacks are an attempt by unknown parties to manufacture the illusion of contact between Alfa Bank’s DNS servers and ’Trump servers’.

«A simple analogy would be someone in the U.S. sending an empty envelope (in this case a DNS signal) to a Trump office (server) addressed to Trump, but on the back of the envelope the return address is Russia (Alfa Bank) instead of its own real address. The Trump office, recognizing there is nothing in the empty envelope to deal with, returns it as undelivered to Russia instead of to the U.S.-based sender. So, on cursory examination, Alfa Bank appears to have been receiving responses to queries it never actually sent.

«We have gone to the U.S. Justice Department and offered our complete co-operation to get to the bottom of this sham and fraud.»

Other indications of human intervention include the fact that the queries occurring in these logs included mixed uppercased and lowercased letters. The majority of DNS queries are machine based queries (for example, browsers and email clients), which would send lowercased queries to the DNS servers.

A few days after the February 18 DNS attack, Alfa Bank again started to receive inquiries from U.S. media outlets, including CNN, about allegations of cyber links with Donald Trump. No such link exists or, in fact, has ever existed between Alfa Bank and Mr. Trump or his organization.

An anonymous group has been trying for months to persuade news organizations to publish stories that such a link is real. Alfa Bank has asked reporters who have contacted it about the traffic to assist by letting the bank know if someone is trying to create the false impression that Alfa Bank has business or other dealings with Mr. Trump.

Two new confirmed March 2017 attacks on Alfa Bank server

On March 11 and 13, Alfa Bank was subjected to two new DNS attacks using similar methods. These attacks appear to have been orchestrated from multiple servers primarily in the U.S.

Between 02:00 and 07:00 (Moscow Time) on March 11 and at 21:00 on March 13, Alfa Bank experienced suspicious cyber activity from an unidentified third party or parties. The unidentified third parties or party repeatedly sent unusual DNS queries to a Trump server, the responses to which again ultimately triggered Alfa Bank’s automated security system.

Over a five-hour period on Saturday — and again on Monday — Alfa Bank received more than 1,340 DNS responses containing mail.trump-email.com.moscow.alfaintra.net.

These malicious and seemingly co-ordinated DNS attacks are coming from unidentified users using a variety of predominantly U.S. servers, including Google and Amazon web services. These IP service providers are inadvertently allowing their infrastructure to be used to attack Alfa Bank.

Alfa Bank suspects the unidentified parties are attempting to cover their tracks by using cloud services from these providers.

Given the frequency of the attacks and the variety of Internet service providers used in the attacks, Alfa Bank’s working hypothesis is that these new attacks are being launched from a botnet.

Possible third new attack In March 2017

Alfa Bank has now started to monitor all incoming messages to its servers containing the word «trump.» This monitoring has revealed that Alfa Bank also is receiving unsolicited marketing emails from «[email protected].» These incoming spam marketing emails also trigger Alfa Bank’s security system, which automatically sends multiple DNS verification requests back to the originating server — here, the Trump server — in order to ascertain the identity of the sender.

Alfa Bank does not know whether these marketing emails are legitimate, or whether a third-party is orchestrating the campaign in another attempt to create the false impression of inappropriate communications between Alfa Bank and the Trump Organization.

In response to media questions that started last September, Alfa Bank asked Mandiant, one of the world’s leading cyber experts, to investigate allegations suggested by an anonymous cyber group of a link between Alfa Bank and Trump, based on unverified DNS logs.

Mandiant completed its independent investigation late last year. After examining Alfa Bank’s system both remotely and on the ground in Moscow, and the unverified DNS data presented to the media by the anonymous cyber group, Mandiant concluded that there is no evidence of substantive contact, such as emails or financial links, between Alfa Bank and the Trump Campaign or the Trump Organization.

Mandiant investigated (1) the DNS data given to the media, which journalists had shared with independent DNS experts, and (2) Alfa Bank servers for any evidence of links.

Mandiant concluded:

DNS data — There is no information that indicates where the list (obtained by reporters) has come from. The list contains approximately 2,800 look ups of a Domain Name over a period of 90 days. The information is inconclusive and is not evidence of substantive contact or a direct email or financial link between Alfa Bank and the Trump Campaign or Organization.

Alfa Bank servers — Nothing we have or have found alters our view as described above that there is no evidence of substantive contact or a direct email or financial link between Alfa Bank and the Trump Campaign or Organization.

Mandiant’s working hypothesis is that the activity the reporters’ sources alleged last year was caused by an email marketing/spam campaign possibly targeted at Alfa Bank employees by a marketing server, which triggered security software.

Earlier this year, Alfa Bank launched another investigation to find out who was — and maybe still is — behind this elaborate hoax.

Access to other’s DNS data is highly privileged and is usually independently examined for academic purposes and cyber security research. Therefore, the examination and sharing of DNS data by the people involved in these fraudulent activities brings into question whether these data were acquired lawfully and whether it was ethical to misuse privileged access in order to manufacture a deceit.

Alfa Bank’s working hypothesis is that an individual — possibly well known in internet research circles — may have fed selected DNS data to an anonymous cyber group to ensure they reached a specific (and erroneous) conclusion. Alternatively, the cyber group may have been complicit in the deceit. In the most recent cases, unknown individuals demonstrably attempted to insert falsified records onto Alfa Bank’s computer systems designed to create the same impression.

An Alfa Bank spokesperson said: «The anonymous cyber group, which is led according to news accounts by ‘Tea Leaves,’ cannot produce evidence of a link because there never has been one. Alfa Bank believes that it is under attack and has pledged its complete cooperation to U.S. authorities to find out who is behind these malicious attacks and false stories.»

Visa Overstays are a Bigger Issue then the Border Wall

Primer: If you overstay your visa for 180 days or more (but less than one year), when you depart the U.S. you will be barred from reentering the U.S. for three years. If you overstay your visa for one year or more, when you depart the U.S. you will be barred from reentering the U.S. for ten years.

Image result for visa overstay

Related reading: Rep. Henry Cuellar (D-TX), reports on 30 countries that refuse to take back their criminals. He appeared on CSpan and Full Measure explaining the issue. The Washington Times reports under federal law, the U.S. government can refuse to issue visas to nationals of countries that refuse to take back their citizens who have been ordered deported from the United States. But according to Cuellar, the government is not enforcing the law.
***

TruthRevolt reports in part: The Center for Migration Studies reports that “two-thirds of those who arrived in 2014 did not illegally cross a border, but were admitted (after screening) on non-immigrant (temporary) visas, and then overstayed their period of admission or otherwise violated the terms of their visas.” This is a trend, far above illegal crossings, which is anticipated to continue climbing from now on.

“That’s because, incredibly, the U.S. doesn’t have an adequate system to assure the foreigners leave when they’re supposed to,” Judical Watch reports. “This has been a serious problem for years and in fact some of the 9/11 hijackers overstayed their visa to plan the worst terrorist attack on U.S. soil. More than a decade and a half later little has changed. Securing the famously porous southern border is essential to national security but so is a reliable system that cracks down on visa overstays.”

According to the CMS study, there have been 600,000 more overstays than illegal border crossings since 2007. Mexico leads in both overstays and EWIs, or entries without inspection. Here are the breakdowns:

  • California has the largest number of overstays (890,000), followed by New York (520,000), Texas (475,000), and Florida (435,000).
  • Two states had 47 percent of the 6.4 million EWIs in 2014: California (1.7 million) and Texas (1.3 million).
  • The percentage of overstays varies widely by state: more than two-thirds of the undocumented who live in Hawaii, Massachusetts, Connecticut, and Pennsylvania are overstays. By contrast, the undocumented population in Kansas, Arkansas, and New Mexico consists of fewer than 25 percent overstays. More here.

*** So who is responsible for control of this? ICE holds all accountability, which reports to the Department of Homeland Security. What about Congress you ask?

Check this out…

Well, there was a bill introduced in 2013, 2015 and again in January of 2017. Yup. The current bill was only introduced and has a 1% chance of passing. It is only a 2 page bill to amend current law noted as H.R. 643. This bill would make it a crime for visa overstays with defined penalties. It is the U.S. State Department, Bureau of Consular Affairs that is responsible for issuing visas and waivers in the case of denials. If you can stand reading the steps and caveats to this process, go here.

Related reading: DHS Releases Entry/Exit Overstay Report For Fiscal Year 2015

For context on how DHS under Secretary Jeh Johnson at the time packaged the report, here is a sample:

DHS conducts the overstay identification process by examining arrival, departure and immigration status information, which is consolidated to generate a complete picture of an individual’s travel to the United States.  The Department identifies two types of overstays – those individuals for whom no departure has been recorded (Suspected In-Country Overstay) and those individuals whose departure was recorded after their lawful admission period expired (Out-of-Country Overstay).

This report focuses on foreign nationals who entered the United States as nonimmigrant visitors for business (i.e., B1 and WB visas) or pleasure (i.e., B2 and WT visas) through an air or sea port of entry, which represents the vast majority of annual nonimmigrant admissions.  In FY 2015, of the nearly 45 million nonimmigrant visitor admissions through air or sea ports of entry that were expected to depart in FY 2015, DHS determined that 527,127 individuals overstayed their admission, for a total overstay rate of 1.17 percent.  In other words, 98.83 percent had left the United States on time and abided by the terms of their admission.

The report breaks the overstay rates down further to provide a better picture of those overstays that remain in the United States beyond their period of admission and for whom CBP has no evidence of a departure or transition to another  immigration status. At the end of FY 2015, the overall Suspected In-Country Overstay number was 482,781 individuals, or 1.07 percent.

Due to further continuing departures by individuals in this population, by January 4, 2016, the number of Suspected In-Country overstays for FY 2015 had dropped to 416,500, rendering the Suspected In-Country Overstay rate as 0.9 percent.  In other words, as of January 4, DHS was able to confirm the departures of over 99 percent of nonimmigrant visitors scheduled to depart in FY 2015 via air and sea POEs, and that number continues to grow.

This report separates Visa Waiver Program (VWP) country overstay numbers from non-VWP country numbers.  For VWP countries, the FY 2015 Suspected In-Country overstay rate is 0.65 percent of the 20,974,390 expected departures. For non-VWP countries, the FY 2015 Suspected In-Country Overstay rate is 1.60 percent of the 13,182,807 expected departures. DHS is in the process of evaluating whether and to what extent the data presented in this report will be used to make decisions on the VWP country designations.

Overall, CBP has improved the collection of data on all admissions to the United States by foreign nationals, biometric data on most foreign travelers to the United States, and processes to check data against criminal and terrorist watchlists.  CBP has also made tremendous progress in accurately reporting data on overstays to better centralize the overall mission in identifying overstays.  CBP will continue to roll out additional pilot programs during FY 2016 that will further improve the ability of CBP to accurately report this data.

U.S. Immigration and Customs Enforcement’s (ICE) Counterterrorism and Criminal Exploitation Unit (CTCEU) is the program dedicated to the enforcement of nonimmigrant visa violations.  Each year, ICE analyzes records of hundreds of thousands of potential status violators from various investigative databases and DHS entry/exit registration systems. The goal is to identify, locate, prosecute when appropriate, and remove overstays consistent with DHS’s immigration enforcement priorities, which prioritize those who pose a risk to national security or public safety.

Read more here.

The Counterterrorism and Criminal Exploitation Unit prevents terrorists and other criminals from exploiting the nation’s immigration system. Really? Yup, that is what the website reads. In a hearing from 2012, you may be interested in reading the testimony on the matter of visa overstays delivered by DHS Deputy Counterterrorism Coordinator John Cohen and ICE Homeland Security Investigations Deputy Executive Associate Director Peter Edge.

510,000 calls, 25% Go to Untrained Backups, VA

On November 28, 2016, President Obama signed into law the No Veterans Crisis Line Should Go Unanswered Act. This law requires VA to develop a quality assurance document to improve VCL functions. The document will outline clearly defined and measurable performance indicators and quantifiable timeframes. It is to be submitted to the Committees on Veterans’ Affairs of the House of Representatives and the Senate no later than 180 days after the date of enactment of the Act. The Act is also intended to ensure that all incoming communications received by the VCL and backup centers be answered in a timely manner by a person.

Image result for Veterans Crisis Line

For the full Inspector General report on issues, context and solutions, go here.

Image result for Veterans Crisis Line CNN

Report: More than one-fourth of veterans’ suicide hotline calls to go to backup lines

WASHINGTON — More than one-fourth of calls to the Veterans Crisis Line end up being redirected to other emergency response services because of ongoing problems with the services’ operations, according to a new report released Monday.
Those problems persist despite leadership changes and promised reforms at the crisis hotline in the last year, and a years-long emphasis on suicide prevention efforts from Department of Veterans Affairs officials.
“Staff did not respond adequately to a veteran’s urgent needs during multiple calls to the (crisis line) and its backup call centers,” officials from the VA Inspector General’s office said in the report. “Supervisory staff did not identify the deficiencies in their internal review of the matter.”
Last spring, a similar report by the office found at least 23 callers to the crisis line were transferred to voicemail systems instead of reaching emergency help. That revelation prompted harsh criticism from lawmakers, who said the mistakes literally could kill unstable veterans trying to get help.
The new analysis of crisis line operations for the last six months of 2016 found that more than 28 percent of calls to the hotline were redirected to backup centers that might not have the same training and resources to help veterans in crisis.
VA has set a goal of no more than 10 percent for “rollover” calls to the crisis line.

The report also found “deficiencies in governance and oversight” of the program’s operations, including poor record keeping to detect and correct problems with missed calls.

In a statement, VA’s acting Under Secretary for Health Poonam Alaigh said the crisis line “is the strongest it’s ever been since its inception in 2007” but acknowledged that further improvements are needed in the system.

The department opened a new Atlanta satellite office for the New York-based crisis line in October — midway through the inspector general’s review — and “has implemented a comprehensive workforce management system and optimized staffing patterns” to “provide callers with immediate service” in the future.
But officials critiquing the system say that’s not enough. The Inspector General’s office has recommended better staff education, technology support, performance reviews and call monitoring to better the system.
Calls which go unanswered by the line are mandated to be directed to backup crisis centers, so veterans seeking help aren’t left without help. But the inspector general notes that those backups may not have the same training in military-specific issues and services, limiting some of the assistance they can provide.
In a statement, House Veterans’ Affairs Committee Chairman Phil Roe, R-Tenn., called the ongoing problems “unacceptable” and asked for immediate fixes.
“The Veterans Crisis Line is intended to be the first line of defense against veteran suicide, and we must ensure calls are being answered by a trained professional in a timely manner,” he said. “I am extremely frustrated by the findings and will continue to conduct oversight so the men and women who answered the call to serve have their calls answered when they need help the most.”

The Veterans Crisis Line, launched in 2007, has fielded 2.5 million calls in the last decade and dispatched emergency services more than 66,000 times to callers in need of emergency help.

In fiscal 2016 alone, staffers answered more than 510,000 calls, 53,000 chat requests and 15,000 texts.

VA statistics show roughly 20 veterans a day nationwide commit suicide. Of those, only six are active users of VA services.

To contact the Veteran Crisis Line, callers can dial 1-800-273-8255 and select option 1 for a VA staffer. Veterans, troops or their families members can also text 838255 or visit VeteransCrisisLine.net for assistance.

Government ‘Dark’ Regulations Mapped Out

Read the report in .pdf form here.

One of the first Executive Orders signed by President Trump was on Regulations. Read that text here from the White House.

Image result for government regulations 2015

Mapping Washington’s Lawlessness: CEI Releases Updated Inventory of “Regulatory Dark Matter”

The Competitive Enterprise (CEI) released the 2017 update to its comprehensive report Mapping Washington’s Lawlessness: An Inventory of “Regulatory Dark Matter.” This analysis covers how, in addition to Congress’s own laws and the many thousands of rules issued by unelected regulators, regulatory dark matter exists in the form of thousands of additional issuances from executive and independent agencies. This dark matter goes around Congress, the Administrative Procedure Act’s (APA) public notice and comment requirements, and the American people themselves.

Examples include presidential and agency memoranda, guidance documents, bulletins, and public notices. These directives interject the federal government into our businesses, our communities, and our personal lives on matters such as healthcare, retirement, labor policy, education policy, and more.

President Trump is already taking certain steps to “deconstruct” the administrative state’s excesses, starting with a temporary regulatory freeze that includes agency guidance documents and rules. His executive orders concerning deregulation are helping, but a regulatory hangover from the Obama administration still lingers.

CEI’s Vice President for Policy Clyde Wayne Crews, Jr., the author of the report, calls on Congress to remedy the problem:

“Congress needs to take back its authority over federal agencies. The problem with regulatory dark matter is that it allows the executive branch of our government to rule sectors of our economy through mere announcements, rather than actual lawmaking or even proper rulemaking. This allows the government to interfere in many aspects of Americans’ lives without our input or that of Congress.

“We’ve been pleased to see the president’s aggressive out-of-the-gate actions to free up the economy, but agencies under President Trump could still create new dark matter behind the scenes. That is why Congress must tackle regulatory reform legislation to ensure an end to this problem.”

Some quick takeaways on regulatory dark matter:

  • Regulatory dark matter has accompanied the rollout of programs ranging from Obamacare to Dodd Frank to drone regulations from the Federal Aviation Administration.
  • Recent major Labor Department mandates like the franchising and independent contracting rules were dark matter, not formal regulations as they should have been.
  • No one really knows for certain how many federal regulatory agencies there are:
    • The Unified Agenda lists 61 agencies
    • The Administrative Conference of the United States lists 115
    • The Federal Register office 440 agencies
  • The Obama administration issued 3853 rules in 2016, while Congress passed and the president signed 214 bills into law – a ratio of 18 rules for every enacted law.
  • The report’s conclusion lists specific ways the Trump administration, either alone or with Congress, can tackle regulatory dark matter so that agencies are not incentivized to use it.
    • APA “notice and comment” provisions should apply to any proposed rule
    • Each piece of regulatory reform legislation passed in the 115th Congress and beyond needs to incorporate language to address dark matter, not just rules

*** A weekday never passes without new regulations being issued or proposed. Yet beyond those rules, Congress lacks a clear grasp of the amount and cost of the thousands of executive branch and federal agency proclamations and issuances, including guidance documents, memoranda, bulletins, circulars, and letters that carry practical (if not always technically legally) binding regulatory effect. There are hundreds of “significant” agency guidance documents now in effect, plus many thousands of other such documents that are subject to little scrutiny or democratic accountability.

It has long been the case that there are far more regulations than laws. That is troublesome enough. But with tens of thousands of agency proclamations annually, agencies may articulate interpretations and pressure regulated parties to comply without an  actual formal regulation or understanding of costs, generally with judicial deference to what agencies contend, an issue of increasing concern to Congress. The result is that no one knows how much the regulatory state “weighs,” or even the number of agencies. The Administrative Procedure Act (APA) of 1946 established the process of public notice for proposed rulemakings, providing the opportunity for public input and comment before a final rule is published in the Federal Register, and a 30-day period before the rule becomes effective. But the APA’s requirement of publishing a notice of proposed rulemaking and allowing public comment does not apply to “interpretative rules, general statements of policy, or rules of agency organization, procedure, or practice.”