The government may have paid twice for small-business research

The Small Business Innovation Research and Small Business Technology Transfer programs pay small companies more than $4.4 billion a year in federal research money.▸ Two 2024 GAO reports tested that spending for two different kinds of exposure. One found 842 of 10,570 tested awardees tripped four or more of GAO's 27 fraud, waste, and abuse risk indicators, and that $445 million -- the largest dollar total in any category GAO tested -- went to awardees for research that may have already been funded elsewhere. The other found that three of the program's 11 participating agencies still have no documented process for how they request or share the classified counterintelligence findings they say they already rely on to screen applicants for foreign ties.

SBIR turns 44 this year: since its 1982 start, federal agencies have made more than 180,000 awards worth about $61.6 billion; STTR, launched in 1992, has made more than 18,000 awards worth $6.4 billion more.▸ In fiscal year 2022 alone, the program's 11 participating agencies -- USDA, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Transportation, NASA, EPA, and the National Science Foundation -- handed out over 6,500 awards worth $4.4 billion to more than 4,000 small businesses. The Small Business Act requires GAO to review the program every four years; its September 2024 report⧉ is the fourth.

GAO built 27 analytic tests -- covering things like conflicts of interest, principal investigators listed on suspiciously many awards, and foreign ownership -- and ran them against 10,570 awardees from fiscal years 2016 through 2021.▸ Only 1,842 awardees, about 17 percent, cleared every test cleanly. The rest tripped at least one; 842 of them, about 8 percent, tripped four or more, a threshold GAO treats as signaling elevated risk warranting further review.

GAO's separate review of publicly reported fraud cases -- convictions, civil settlements, and administrative actions from fiscal years 2016 through 2023 -- found 37 distinct fraud schemes tied to 43 individuals and 36 businesses: 18 schemes ended in criminal action, 22 in civil action, and 9 in administrative action, with some schemes producing more than one type of outcome.▸ In one illustrative case, a man and two businesses he owned won seven SBIR/STTR awards from the Army, Air Force, DARPA, the Missile Defense Agency, NASA, and the Department of Energy, then subcontracted sensitive work to engineers in Venezuela despite certifying that only U.S. citizens or permanent residents working at U.S. facilities would perform it. He was sentenced to 32 months in prison; both businesses were placed on three years' probation; all three defendants were ordered to pay $2.9 million in restitution.

GAO also tested awards data directly against five specific eligibility rules: an applicant can't be more than 50 percent foreign-owned, can't exceed 500 employees, must list a principal investigator primarily employed by the business, must list a real research facility address, and can't receive funding twice for essentially the same research.▸ Every rule turned up money at risk. Text-mining awardee abstracts for duplicated language, GAO flagged 280 awardees -- across 10 of the 11 agencies -- with potentially essentially equivalent work funded more than once, totaling about $445 million. That is more than the dollars flagged in any of the other four categories combined with foreign ownership, and more than triple the amount tied to potentially ineligible facility addresses.

The address test showed how thin the program's verification runs.▸ Using only the address SBIR.gov had on file, GAO flagged 157 awardees, worth about $157 million, with addresses the U.S. Postal Service listed as undeliverable or vacant. GAO's criminal investigators then physically visited 17 of the flagged addresses tied to 12 awardees -- and confirmed only 3 as genuine independent office suites. The rest turned out to be a vacant lot, an address that appears not to exist, a government facility with no sign of the business, two mailboxes inside shared office suites with no physical presence, a private home, and several more without confirmable business activity. Neither the Policy Directive nor the statute requires agencies to verify an applicant's address at all; most rely solely on the applicant's own certification.

As of April 2023, only three of the 11 participating agencies -- Energy, Homeland Security, and Health and Human Services, through five agency subcomponents -- had conducted any SBIR/STTR-specific fraud risk assessment at all, the practice GAO's own Fraud Risk Framework treats as foundational.▸ Agencies told GAO they lacked staff, training, and clear guidance from SBA on how to do one; SBA, for its part, said detailed fraud risk assessment guidance isn't required by the statute and pointed agencies toward their own inspectors general instead. GAO made eight recommendations in this report -- six to SBA, one to DOD, one to USDA -- and all three agencies agreed to act on them.

A separate, newer mandate governs a different risk: foreign government access to the research itself.▸ The SBIR and STTR Extension Act of 2022 required every participating agency to stand up, by June 27, 2023, a due diligence program screening applicants for ties to a 'foreign country of concern' -- defined in the statute as China, North Korea, Russia, Iran, or any other country the Secretary of State designates -- across cybersecurity practices, patents, employee affiliations, and foreign ownership. All 11 agencies met that deadline, and GAO's November 2024 follow-up report⧉ found the screening working as intended in specific instances.

The National Institutes of Health denied an award after determining an undisclosed principal investigator had likely received funding from a Chinese 'malign talent recruitment program'; the National Science Foundation denied an award to an applicant that had raised significant investment from a Chinese firm and generated revenue through a Chinese subsidiary; the Air Force denied an award after finding an applicant held patents filed with a Chinese government-affiliated university and had concealed funding from a Chinese venture capital firm; and Homeland Security denied an award to an applicant with overseas offices, including in Hong Kong, that had major cybersecurity deficiencies.

Other findings ended differently.▸ NASA discovered an applicant had received a small equity investment from a company partly owned by a Chinese government-owned aerospace and defense corporation -- and decided it could manage that risk with increased monitoring, then made the award anyway. USDA found that a key project staffer had failed to disclose foreign relationships as recently as 2020; the applicant removed that person after USDA raised the issue, and the award went forward.

Six of the 11 agencies -- the Air Force, DHS, DOE, EPA, NASA, and NIH -- told GAO they lean on their agency's own counterintelligence office, including classified sources, to help make these calls.▸ Only three of those six -- the Air Force, NIH, and DOE -- have a documented process describing how that classified information reaches the program office making the award decision. At DHS, GAO found the gap had already produced an unresolved internal disagreement: the counterintelligence office said staff handling its information needed Top Secret clearance, while the SBIR program office said no one there had needed that clearance level so far -- a disagreement nobody had reason to formally resolve, because there was no documented process requiring them to.

GAO's conclusion was procedural, not accusatory: without written agreements on how the program office and the counterintelligence office share information, decisions rest on institutional memory held by a handful of people rather than a documented, repeatable process.▸ GAO recommended EPA, DHS, and NASA each document their procedures for requesting and sharing analytical support, including classified information, with their counterintelligence offices. All three agencies concurred.