The Fed's Insider-Risk Fix Sat Open for a Decade

In November 2016, the Federal Reserve's own inspector general⧉ told the Board of Governors' Division of Information Technology to "develop and implement an agency-wide insider threat strategy for sensitive but unclassified Board information."▸ Ten years later, a July 15, 2026 OIG evaluation⧉ found that program still doesn't exist -- the Board's insider risk activities "do not proactively or effectively identify and manage risks to the agency's information and assets," the report concluded, superseding the decade-old recommendation with nine new ones.

The same day, the Justice Department announced that John Harold Rogers, a former senior adviser in the Fed's Division of International Finance, had been sentenced to 38 months in prison for lying to investigators about sharing restricted Fed information with a Chinese intelligence operative he'd been meeting since 2017 -- squarely inside the window the 2016 recommendation was meant to close.

The OIG's 2016 audit found the Board was building an insider-threat program for classified information but had not decided which parts should extend to the far larger universe of sensitive-but-unclassified material -- interest-rate deliberations, bank-supervision data, unpublished economic analysis.▸ The Board did not engage a third-party vendor to even begin designing that unclassified strategy until November 2024, eight years after the recommendation was made.

A senior Board official told the OIG the delay reflects a deliberate choice: the Board "has been resistant to adopting a comprehensive insider risk program because the current ad hoc approach allows each division to respond to incidents based on its own security needs."▸ The 2026 report treats that ad hoc approach as the core problem, not a defensible design.

Instead of one program, the Board runs four: a classified-information Insider Threat Program with 3 part-time staff; the Division of IT's Incident Response Program with 5 full-time staff; the Division of Supervision and Regulation's Security Incident Management Program with 1 full-time staff; and the FOMC Secretariat's Program for Security of FOMC Information -- the office guarding interest-rate deliberations before they're public -- staffed at 0.35 of a full-time position.▸ None of the four has a dedicated budget, per the report's Table 1, and the OIG found no individual or committee accountable for the four collectively.

By contrast, the report says an unnamed peer federal financial regulatory agency already runs "a centralized hub with a dedicated program manager and policies and procedures, including reporting metrics, training, and records retention requirements." The Fed does not.

Buried in a redacted sidebar, the OIG report describes "a then-Board employee, now retired, [who] shared sensitive Board and FOMC information and other documents with Chinese security and intelligence operatives beginning in 2017."▸ The report does not name him. But the timeline matches the Rogers prosecution point for point: DOJ says Rogers, who worked at the Fed from 2010 to 2021, began a clandestine relationship that year with Hummin Lee, a Chinese intelligence operative he met at a conference in China, and used the guise of teaching academic "classes" in Chinese hotel rooms to pass along Fed information Lee had specifically requested.

DOJ says Rogers understood China could trade profitably on advance knowledge of Fed rate decisions in its roughly $1.5 trillion holdings of U.S. Treasury securities.▸ When Fed OIG investigators asked him directly, on February 4, 2020, whether he'd ever shared restricted information outside the Board, Rogers answered: "Never." A federal jury convicted him of that lie on February 3, 2026 -- while acquitting him of the more serious charge of conspiracy to commit economic espionage. Prosecutors had sought 60 months; Judge Dabney Friedrich imposed 38, plus 12 months of supervised release.