The Permission Problem

Why America’s Biggest Fraud Isn’t Hidden — It’s Protected

The Permission Problem: Why America’s Biggest Fraud Isn’t Hidden — It’s Protected

Inventor’s Mind Press

---

I. The Premise

Fraud is theft. What’s stolen changes — money, identity, citizenship, valor, welfare, admission — but the mechanism stays constant: misrepresentation for gain. By that definition, fraud in America is not rare, marginal, or hidden in any real sense. It is documented, quantified, and published by government auditors every year. What’s actually scarce is prosecution at the level where the money is largest.

This isn’t a story about a few bad actors skimming benefits at the bottom. It’s a story about the machinery that decides which fraud gets pursued, which gets a press release and a plea deal, and which gets protected by the very people whose job is oversight. Small fiefdoms — a corrupt caseworker, a crooked storefront — are the visible, prosecutable layer. They are not the only corruption centers, and treating them as the whole problem is itself part of how the larger problem stays underestimated.

---

II. The Six Currencies

Money. The Government Accountability Office’s cumulative estimate of federal improper payments since 2003 exceeds $2.7 trillion, with $236 billion flagged in fiscal year 2023 alone. Pandemic-era fraud — PPP loans, unemployment insurance, PPE procurement — is estimated above $200 billion by the Department of Justice and multiple agency inspectors general.

Welfare. Minnesota’s “Feeding Our Future” case is the largest pandemic-fraud prosecution in the country: more than $250 million siphoned from a federal child-nutrition program through a network of shell nonprofits, over 70 people charged. It is the same fraud network independent journalist Nick Shirley’s reporting first drew national attention to before he moved his investigation to California.

Food assistance. The USDA reported roughly $12 billion in SNAP losses in 2024, driven heavily by EBT card skimming — magnetic-stripe cards with no chip, cloned by organized rings including one operating out of Romania. Separately, longtime USDA employee Arlasa Davis was convicted of selling stolen EBT retailer license numbers to co-conspirators, enabling roughly $66 million in fraudulent SNAP terminal access. A Propel survey found more than a third of EBT theft victims never filed a claim because they didn’t know they could.

Identity and citizenship. The Social Security Administration’s Earnings Suspense File — wages reported on W-2s that can’t be matched to a valid Social Security number and name — holds more than $1 trillion in unmatched wages accumulated since the 1930s. Separately, synthetic identity fraud (a real SSN, often a child’s or a deceased person’s, fused with a fabricated name) cost U.S. lenders $3.2 billion by mid-2024, according to TransUnion, up 18% year over year and concentrated in auto lending.

Valor. The original 2005 Stolen Valor Act was struck down by the U.S. Supreme Court in United States v. Alvarez (2012) for criminalizing the lie itself, regardless of gain. The 2013 replacement law survived only by narrowing its scope to lies made for tangible benefit — Congress conceded it could not criminalize false claims of military honors on their own, only false claims used to steal something material.

Merit. Operation Varsity Blues: college counselor Rick Singer ran a $25 million admissions-fraud scheme across at least eight universities — including USC, Yale, Stanford, and Georgetown — using two vulnerabilities: bribed SAT/ACT administrators who corrected answers or substituted test-takers, and fabricated athletic-recruit profiles that exploited a discretionary admissions channel nobody was cross-checking against actual team rosters. Fifty-three people were charged, including actors Lori Loughlin and Felicity Huffman. Legacy admissions and large donor gifts timed to a child’s application cycle are not prosecutable fraud, but they exploit the same discretionary “side door” — institutionalized rather than smuggled in.

---

III. The Prosecution Gap

Across every category above, enforcement clusters at the bottom. Pandemic fraud task forces pursued individual PPP applicants first — one signature, one bank account, easy to prove in court. Institutional fraud — a network of nonprofits, a healthcare billing scheme, a synthetic-identity ring spanning state lines — requires subpoena power and years of litigation against parties with lawyers and lobbyists. Eleven arrests over $50 million, in the California fraud case that triggered the legislative response discussed below, is a rounding error against a $200 billion pandemic-fraud estimate. It is a countable result, not a structural fix.

The ratio between fraud identified and fraud recovered stays in the low single digits across most federal programs — and that ratio is public. GAO publishes it every year. The fraud isn’t the secret. What happens to it after an auditor documents it is the part that rarely gets fixed, and because prosecutions are so rare relative to the dollar figures involved, most people never develop an intuition for how large the problem actually is. A story about eleven arrests reads as an isolated crime. It is not built to communicate that it represents a fraction of a fraction of what auditors already know is missing.

---

IV. The Tool Already Exists

The Centers for Medicare & Medicaid Services’ Fraud Prevention System uses predictive analytics on billing data and is credited with hundreds of millions of dollars in prevented payments annually. The IRS’s data-matching models catch more return fraud than manual audits ever could. The Pandemic Response Accountability Committee cross-referenced PPP loan data against death records and duplicate business addresses at a scale no manual review team could match. What independent journalists like Nick Shirley do — cross-referencing public records, spotting duplicate patterns across hundreds of organizations — is a manual version of what automated data matching already does at scale.

The technology to compile, cross-reference, and flag institutional fraud exists and has already proven itself in narrow deployments. The limiting factor is not capability. It is authorization — who is allowed to point which tool at which data, and who is allowed to publish what it finds.

The clearest case of a working cross-check being deliberately narrowed involves Social Security “no-match letters” — notices sent to employers when a W-2’s reported SSN didn’t match SSA’s records. In 2007, the Department of Homeland Security proposed a rule requiring employers to terminate no-match employees within 90 days. Federal courts blocked the rule (AFL-CIO v. Chertoff), and SSA scaled the letters back sharply afterward — not because the underlying mismatch problem went away, but because of the legal and political fallout from trying to act on the data. E-Verify, the newer voluntary alternative, remains optional in most states outside federal contracting. The data that would resolve the mismatch has existed for decades. The enforcement layer built on top of it was constructed, then deliberately weakened.

---

V. When the Blocker Gets a Bill Number

Disclosure: The following account of California’s AB 2624 relies on public reporting and the plaintiff’s own filed complaint. Nick Shirley’s characterization of the bill’s timing as targeted at him personally is an allegation made in active litigation (Shirley v. Bonta, E.D. Cal., filed September 4, 2026) — it has not been adjudicated, and this section should be read as reporting his claim, not confirming it as legal fact. AB 2624’s supporters, including its author, dispute that characterization and frame the law as workplace-safety protection for immigration-aid workers facing real harassment risk. Both framings are represented below.

The documented sequence:

• January 31, 2026 — Nick Shirley announces on social media that he is in California investigating alleged fraud, following earlier reporting on daycare fraud in Minnesota.

• Early February 2026 — Gov. Gavin Newsom publicly describes scrutiny of the San Diego Somali community as coming from “right-wing provocateurs,” a remark Shirley says was directed at him.

• February 5, 2026 — California Attorney General Rob Bonta holds a press conference calling fraud allegations “reckless, false, outrageous, and ridiculous.”

• February 20, 2026 — Assemblymember Mia Bonta — the attorney general’s wife — introduces AB 2624.

• May 2026 — The bill passes the California Assembly. Republican Assemblymember Carl DeMaio brands it the “Stop Nick Shirley Act.” State Assemblyman David Tangipa tells reporters it would “limit the release of video recordings by independent journalists who investigate taxpayer-funded programs.”

• August 22, 2026 — Newsom signs the bill.

• September 4, 2026 — Shirley, represented by America First Legal Foundation, sues the state, alleging the law is unconstitutionally content-based and viewpoint-discriminatory.

Separately, and in the same general window, the FBI arrested eleven people in connection with roughly $50 million in fraud tied to organizations Shirley’s reporting had scrutinized. The law that followed restricts publication of identifying information about immigration-support-service workers — not the fraud itself, the person identifying who to investigate.

AB 2624’s actual text is narrower than some coverage suggests: it targets publishing personal information with intent to incite imminent harm or induce fear for safety, not investigative reporting generally, and it extends California’s existing Safe at Home address-confidentiality program to a new category of workers. That is a legitimate, separately defensible policy goal. What makes this case study useful is not that the law is obviously illegitimate — it’s that the fifteen-day gap between the attorney general’s press conference dismissing fraud allegations and his wife’s introduction of a bill restricting the person who made them is a documented fact, independent of how the underlying constitutional question resolves.

---

VI. Sixty Years Is Not Enough Time

If the mechanism for uncovering the truth were simply the passage of time, the JFK assassination files would be fully public. They are not. The 1992 JFK Records Act mandated release and still built in an exemption letting agencies withhold documents the President finds “clearly necessary” to protect intelligence sources and methods — an exemption invoked repeatedly across three decades and multiple presidential release orders, including under President Trump in both his terms.

Martin Luther King Jr.’s FBI surveillance files present a different mechanism with the same effect: many were sealed by court order tied to the original wiretap authorization, with release timelines running past 2027, separate from any congressional records act. That material documents the Bureau’s own conduct — a COINTELPRO-era surveillance campaign built on no legitimate predicate — which is a different kind of institutional exposure than sources-and-methods protection.

Sixty-plus years, an act of Congress, and direct presidential intervention have not been sufficient to force full disclosure in either case. What has moved them, incrementally, has been forcing events — a feature film that shifted political will in 1991, lawsuits, changes in administration — not the calendar. That has a direct bearing on how to think about COVID-19 origins, where the documentary record is only five years old and the UNC records fight (Ralph Baric’s lab, sought by U.S. Right to Know under public-records law and currently before the North Carolina Supreme Court) is still being actively litigated, not five decades along. If sixty years wasn’t enough for JFK, five years should not be mistaken for close to enough for COVID.

---

VII. Why the Scale Doesn’t Register

Two forces keep the public underestimating how large this problem is, and both are separate from whether the underlying numbers are public.

The first is prosecution rarity itself. When enforcement clusters at the bottom — a caseworker, a corner store, eleven low-level arrests — each case reads to the public as an isolated crime story rather than as a sample from a much larger, already-quantified population. GAO’s $2.7 trillion figure and a local news story about a $50,000 EBT skimming ring live in completely different registers of public attention, even though the second is a rounding error of the first. Small fiefdoms are real and worth prosecuting. They are also the fraud that’s easiest to see, which makes them a poor proxy for the fraud that’s hardest to reach — and treating the visible layer as the whole problem is itself a form of underestimation, whether or not anyone intends it that way.

The second is more uncomfortable to state plainly: institutional and merit-based fraud implicates people and systems the public — and often the people documenting the fraud — would rather not examine too closely. It’s easier to accept a story about a caseworker skimming benefits than a story about admissions offices, licensed lenders, and named administrators declining to act on data they already have. Neither of these dynamics requires bad faith from any individual reporter, prosecutor, or voter to produce the effect. The scale stays invisible not because it’s hidden, but because the visible cases are the ones that get told, and the larger cases are the ones people have the least appetite to sit with.

---

VIII. Opportunity and Fraud Are the Same Detection Problem

Forensically, cost-savings analysis and fraud detection are the same operation run on the same data. Both ask: does this pattern deviate from the expected baseline, and by how much? A system built to find billing inefficiencies in a hospital network is structurally the same system that finds billing fraud in that network. A system built to find undervalued auto-loan risk is structurally the same system that finds synthetic-identity auto-loan fraud. The industry wants one output and not the other, but the underlying detection function doesn’t distinguish — it just surfaces anomalies. What happens next is a human decision, not a technical one.

That framing produces three separate questions, and they don’t have the same answer.

1) Who can find both? The capability already sits inside a small number of institutions: CMS’s Fraud Prevention System, TransUnion and the major credit bureaus, IRS return-matching, and private forensic-accounting practices (the Big Four’s forensic divisions, boutique firms, licensed forensic engineers and CPAs doing after-the-fact reconstruction). Palantir and similar data-integration firms hold government contracts built explicitly to do this kind of cross-referencing at scale. Independent journalists doing manual cross-referencing — Shirley’s model — are the low-budget, human version of the same function. The capability is not scarce. It is concentrated in whoever already has lawful access to the underlying data, which is a much smaller list than the list of people who could technically run the analysis if given access.

2) Who wants to stop that skill set? Not the tool generally — nobody objects to AI finding cost savings. The resistance shows up specifically when the same tool is pointed at an organization’s own books, grant records, or admissions data. That resistance takes different forms depending on who’s exposed: a university restricting access to athletic-recruit and donor records, a state legislature narrowing who can publish identifying information about organizations under investigation (AB 2624’s practical effect, whatever its stated intent), a lab or agency invoking a records exemption years past the point the underlying secret still matters operationally. None of these actors necessarily object to fraud detection as a category. They object to it being pointed at them specifically, and the tools available to slow that down are legal and legislative, not technical — which is why this piece keeps landing on records law and bill numbers rather than on the AI itself.

3) Who will enforce the bad once it’s found? This is the weakest link in the chain, and the one least discussed. A flagged anomaly is not a conviction. CMS’s system prevents payments; it doesn’t prosecute. TransUnion’s synthetic-identity flag protects a lender’s balance sheet; it doesn’t refer anyone to a U.S. Attorney. Enforcement still runs through the same resource-constrained, politically exposed prosecutorial pipeline covered in Section III — DOJ, state attorneys general, agency inspectors general — and that pipeline is the part conflicts of interest can reach directly, as in a state attorney general publicly dismissing fraud allegations weeks before his spouse, a state legislator, introduces a bill restricting the person who raised them. Better detection without a corresponding, insulated enforcement mechanism just produces a longer list of documented, unprosecuted fraud — which is close to the situation GAO’s own improper-payment reporting already describes.

The honest forensic conclusion: AI does not change who wants fraud found. It changes how cheaply and how completely fraud can be found, which raises the stakes on the second and third questions without touching them at all. Detection was never the bottleneck once government-scale systems already existed. Authorization to point the detector, and will to prosecute what it finds, remain exactly as scarce as they were before the tool got faster.

---

IX. Conclusion

Institutional secrecy that outlives its stated justification does more lasting damage to public trust than a declared adversary ever could, because it corrupts the machinery citizens depend on to hold power accountable. A foreign adversary doesn’t hide that it’s an adversary — opposition is the point, and it can be named, sanctioned, or fought openly. A domestic blocker’s entire function is to make its own existence look procedural: a records exemption, a workplace-safety bill, a quietly scaled-back letter program, a discretionary admissions channel nobody audits.

The tools to close most of the gaps documented here — automated data matching at AI scale, cross-state title and identity databases, existing public-records law — are already built and, in narrow pilot programs, already working. What’s missing in every case in this piece isn’t capability. It’s permission, and the political will to keep the permission in place once it starts finding something.

---

---

Herbert Roberts, P.E. is a licensed professional engineer with 32 years in aviation research and development across three companies, and has spent eight years analyzing accidents under his P.E. license.

Sources

• GAO, Federal Improper Payments, cumulative estimate since 2003 and FY2023 figures — gao.gov

• DOJ, Pandemic Response Accountability Committee and Inspector General reporting on PPP/UI fraud

• U.S. Attorney’s Office, District of Minnesota — “Feeding Our Future” prosecution filings

• USDA, SNAP fraud and EBT skimming loss estimates (2024); U.S. v. Arlasa Davis

• Propel, survey on EBT theft claim-filing rates

• SSA, Earnings Suspense File data

• TransUnion, H2 2024 State of Omnichannel Fraud Report

• United States v. Alvarez, 567 U.S. 709 (2012)

• DOJ, Operation Varsity Blues case filings, District of Massachusetts

• AFL-CIO v. Chertoff, N.D. Cal. (2007), on the SSA no-match rule injunction

• The Daily Signal, Legal Insurrection, Deseret News, Bloomberg Law — AB 2624 reporting, Feb.–Sept. 2026

• Shirley v. Bonta, E.D. Cal., No. 2:26-at-01477, complaint filed 9/4/26

• National Archives, JFK Records Act release history

• U.S. Right to Know, UNC public-records litigation filings

• NAIIC, Fukushima Nuclear Accident Independent Investigation Commission Report (2012)

• Rogers Commission, Report on the Space Shuttle Challenger Accident (1986), Appendix F

This draft is for editorial review. Verify all figures against primary sources before publication, and confirm the legal-disclosure language in Section V with counsel given the active litigation it references.