ProPublica

by Ellis Simani

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

In September 2020, the Federal Trade Commission joined regulators in four states to sue four men behind a notorious telemarketing company called Outreach Calling. The FTC alleged that the company, which it described as a “sprawling fundraising operation,” had raised millions on the promise of helping the needy — cancer patients, veterans, firefighters — but instead used the money to line its pockets.

The case was meant to put fundraisers on notice. The FTC would not only go after charities that improperly spent donor dollars, but it would “aggressively pursue their fundraisers who participate in the deception,” a news release said.

The executives and corporate entities behind the operation were fined more than $58 million. They were also banned from all charitable fundraising for life. But regulators kept one door open in most of the settlements: the ability to continue fundraising for political purposes.

For Thomas Berkenbush, who was a co-manager at Outreach, that provision would prove to be a windfall.

Before the deal with the FTC was even finalized, Berkenbush filed paperwork to establish a new company, Office Edge LLC. Since then, Office Edge has been paid about $866,000 for fundraising from organizations that similarly claim to be working on behalf of cancer patients, veterans and firefighters. The difference? These groups are not charities, they’re political nonprofits that claim to use donations to influence elections and support broad political causes.

The groups that are hiring Berkenbush are known as 527s, after a section of the tax code. They include federal political action committees — organizations that raise money to elect or defeat candidates and are regulated by the Federal Election Commission — but also a lesser-known group of nonprofits. These 527 groups limit their direct support to political candidates, removing them from the jurisdiction of the FEC or similar state agencies and leaving their regulation to the IRS. They do not have restrictions on how much donors can contribute, but the donations are not tax deductible.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

A ProPublica investigation has connected Berkenbush to a network of at least 10 of these 527 groups that have raised more than $33 million on the promise of supporting admirable causes, but that have spent little on activities that could be construed as having a political purpose. Most of the money goes to fundraisers who have only been paid by 527s in the group ProPublica identified.

Experts say that it’s hard for the public to follow the business practices of 527 groups because of how difficult it is to access the records that the IRS publishes about their activity. Data about 527 organizations is published on an IRS website in a hard-to-use data file with a limited search interface. On top of that, experts said that there is lax oversight by the federal agencies in charge of regulating the groups.

“There is no enforcement whatsoever,” said William Josephson, the former head of the charities bureau within New York’s attorney general’s office. “It’s just not a big enough issue for the IRS.”

None of the organizations responded to ProPublica’s requests for comment. But during the process of our reporting, the eight groups that have websites added prominent “Transparency Statements” with essentially identical language.

“We advocate for the needs of veterans, by informing voters of these needs and asking them to take action. This is our only purpose,” the statement for the National Coalition for Disabled Veterans reads. It also says, “When you make a contribution, we want you to know that a minimum of 90 cents of every dollar will be dedicated to covering our fundraising costs and outreach efforts.”

Over 90% of Money Raised Went to Fundraising

The vast majority of money raised by a network of 527s identified by ProPublica went to support fundraising efforts. Only a small amount went to media and outreach, according to the groups’ IRS filings.

*This includes website services, book production, advertising, billboards, and voter advocacy and outreach. Figures are rounded. (Source: ProPublica analysis of expenditures by 527 groups)

The IRS did not respond to questions from ProPublica about our findings in any detail. The FTC declined to comment on why some of the settlement agreements in its case against Outreach Calling permitted political fundraising. The New York attorney general’s office, whose lawyers played a significant role in the case, told ProPublica that it can’t prohibit political fundraising because of First Amendment protections. But it maintained that the settlement agreements forbid the defendants from engaging in any fraudulent conduct while fundraising, regardless of the organization’s tax status or stated purpose.

Under the terms of the settlements, the defendants — who did not admit or deny any of the allegations in the FTC complaint — were required to submit yearly compliance reports to New York, disclosing all fundraising activity for five years after the agreement was reached. The office confirmed that some of the defendants have reported business activity with 527 groups but did not say whether this prompted any investigations. Berkenbush did not respond to requests for comment.

One of the organizations ProPublica identified, the American Breast Cancer Coalition, contacted retiree Laurence Eggers in April for a donation.

Eggers (Ryan Young for ProPublica)

Eggers lives in Pasadena, California, has Parkinson’s disease and frequently volunteers his time and money for various causes. He made a pledge to give $100 to the group, later telling a reporter that he gives out of appreciation for the people they claim to be helping.

Payments to Office Edge LLC

All 10 of the nonprofits in the network paid Office Edge, the company owned by Thomas Berkenbush.

(Source: ProPublica analysis of expenditures by 527 groups)

“They really do need it,” he said in an interview. “They’ve worked hard enough to deserve it.”

Eggers has given at least $1,500 to the nonprofit in the past three years. He said his phone rings two to three times a day with different causes asking him for money. However, there is scant evidence the organizations calling Eggers do what they claim.

The American Breast Cancer Coalition, for example, has taken in nearly $9 million from donors since 2019 and has spent less than half of 1% of that on “voter advocacy and outreach.” The rest of the money — millions of dollars — goes to companies with names like Action Committee Marketing, Capital Vendor Management and Berkenbush’s Office Edge. Berkenbush’s company pulled in $222,000 just from this one organization.

The network has paid millions to a handful of other vendors, including one of Berkenbush’s former colleagues at Outreach Calling, whose company brought in more than $3.4 million in expenditures. He and his firm did not respond to requests for comment.

Another man, Alan Bohms, was paid more than $575,000 by the American Breast Cancer Coalition through a company he controlled named Campaign Marketing Inc., which also did business under the names Insight Data Management and Prestige Tax & Payroll. The company has taken in close to $1.5 million from the network of nonprofits ProPublica identified. Bohms was not a member of Outreach Calling or subject to the FTC order, but he has previously paid the company millions to fundraise for one of his nonprofits.

In an email, Bohms defended the money that the groups spend on fundraising, writing that the phone calls are central to “educating and engaging the community about the PAC’s mission and objectives.”

Payments to Companies Owned by Bohms

Five of the nonprofits in the network paid Campaign Marketing Inc., a company Alan Bohms controlled that did business under three different names.

(Source: ProPublica analysis of expenditures by 527 groups)

ProPublica reporters uncovered the web of connections between the groups by compiling the reports they file into a searchable database, offering a level of visibility similar to what’s available for records collected by the FEC. (Read more about our new database.)

Web of Connections

Even on their surface, the connections between these groups are obvious: Six of the organizations in this network have websites that were built using the same platform and share similar designs. All but one process donations using an obscure payment system also used by several political nonprofits that federal prosecutors began investigating after a New York Times story last year.

Nearly all used similar or identical language when describing the purpose of the organization in IRS filings. They share significant overlap in both donors and contractors, and they often reuse the same language when describing expenditures or donors, including multiple organizations listing an identical description for services from different companies: “Fundraising, Donor Management, Database Services, Direct Mail Services, Postage.”

Screenshots of the donation pages on an obscure payment website used by nine of the 10 groups in the network (MySecurePay.org)

At least half of the organizations ProPublica identified worked with the same Morristown, Tennessee-based accounting firm on their IRS filings, Purkey, Carter, Compton, Swann & Carter. Bohms also uses the firm for his own nonprofit, the Volunteer Firefighter Alliance, telling ProPublica that the firm maintained high standards of integrity. The firm did not respond to requests for comment.

Fire departments across the country warned people against donating to Bohms’ charity, and both he and the charity were written about in a 2020 Salon story that connected Bohms to a network of “scam PACs.”

“VOLUNTEER FIREFIGHTER ALLIANCE is a FRAUD!” exclaimed one 2021 post on Facebook from the Alpha Fire Company in Centre County, Pennsylvania. “Do not give money to this organization! They are not your local fire company.”

Records show that one of the charity’s main fundraisers was Outreach Calling, the company shut down by the FTC. The Volunteer Firefighters Alliance paid $4.8 million to the company for fundraising in total. Bohms defended Outreach’s work, telling ProPublica that he “found Outreach Calling to be very professional and had never experienced any problems with them.”

Bohms’ family members also appear to help run the nonprofits that pay his companies. His sister, Julie Forsythe, is listed as the treasurer of the National Cancer Alliance, which “works to establish the end of childhood cancer by making it a state and national priority.” Another organization, the National Coalition for Disabled Veterans PAC, reports its treasurer as Bohms’ aunt, Judith Gragert. In the last five years, these two organizations have raised over $7 million from more than 700 donors around the country.

Like all of these groups, neither used much of the money they raised in support of their stated efforts. Effectively all of the expenditures that both groups reported were for either fundraising or other administrative costs. Together, the organizations paid more than $300,000 to Campaign Marketing Inc., the company owned by Bohms.

Gragert and Forsythe did not respond to requests for comment. Bohms told ProPublica that he works with 527 groups “strictly in the capacity of a vendor,” and that the payments made to his companies were for legitimate services. He denied any involvement in decision-making at the groups that listed his aunt and sister as treasurer.

“It is important to understand that the payments made to fundraisers encompass more than just fundraising activities,” Bohms wrote in an emailed response. “These funds support a broad range of outreach efforts, including phone calls and direct mail campaigns that are designed to inform the public about the PAC’s goals and initiatives.”

At least one of the groups ProPublica identified has been sued over its fundraising practices. A pair of call recipients filed a lawsuit seeking class-action status in 2022 against the National Police & Sheriffs Coalition PAC. Lawyers for the plaintiffs alleged that the group used prerecorded voice calls to contact potential donors without their consent, in violation of FCC rules that are meant to protect consumers from telemarketers.

“Many of these PACs are illegitimate,” said Eric Weitz, whose law firm is on the team representing plaintiffs. “They prey on people’s political leanings.”

One of the defendants named in the lawsuit was Frank Pulciani, the organization’s treasurer. Pulciani maintained that prerecorded messages were not improperly used in calls to donors, and that the fundraising company the group hired was responsible for ensuring that calls complied with the law. Pulciani settled with the plaintiffs for undisclosed terms, and the organization was dissolved in February of last year.

Pulciani is also closely connected to Bohms. The two men, who both produce and act in low-budget films, recently worked on a project called “Murder by Association.” In its trailer, posted to YouTube, Bohms and Pulciani can be seen decked out in suits and dark sunglasses.

Pulciani did not respond to requests for comment. Robert Bernhoft, whose firm represented Pulciani in the lawsuit, declined to comment.

Alan Bohms, right, and Frank Pulciani, second from left, pose for a photo on a movie set. (YouTube) Used and Abused

For Eggers, the donor who gave to the American Breast Cancer Coalition, the revelation that some of the organizations he’s been supporting are using almost none of what they raise for their stated purpose was discouraging.

“I feel like I’m being used and they’re being abused,” he said, referring to those he aimed to help with his donations.

On the mantle above Eggers’ fireplace rests a selection of plaques, framed photographs and certificates that showcase his commitment to giving. One award from 2012, titled “Lending a Helping Hand,” recognizes his 31 years of volunteering for a local organization providing services to the homeless. Another, from a regional branch of the American Red Cross, celebrates his donations to a blood platelet program.

He showed ProPublica a letter he received from the American Breast Cancer Coalition this past April.

“Through your much-needed support, we hope to educate the public about our nation’s important Breast Cancer health bills,” reads the letter, thanking him for his donation. It noted that the group was not a charity — key to the FTC order against former Outreach Calling employees. And further down, it stated, “A large portion of proceeds from this campaign are used to defray the costs of fundraising.”

Eggers received a letter from the American Breast Cancer Coalition thanking him for his donation and saying that a “large portion of proceeds from this campaign are used to defray the costs of fundraising.” (Ryan Young for ProPublica)

Do You Have a Tip for ProPublica? Help Us Do Journalism.

Ruth Talbot contributed data reporting. Graphics by Nat Lash.

by Ruth Talbot and Brandon Roberts

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Each year, people and companies contribute hundreds of millions of dollars to tax-exempt political organizations in an effort to influence elections nationwide. These organizations, commonly known as 527s after a section of the tax code, can raise unlimited sums for political spending. Today, ProPublica is releasing a database that will allow journalists, researchers and others to more easily search 527s’ finances and find patterns.

It’s a wide-ranging trove of data that includes well-known groups such as the Democratic Governors Association, which influences pivotal races nationwide, and many obscure ones, including the Minnesota-based organization Garbage Haulers for Citizen Choice, which says it advocates for local freedom of choice in waste pickup.

While the organizations in our database can affect the outcome of elections, their direct support of political candidates is often limited. This means much of their activity is not regulated by the Federal Election Committee or a state equivalent, and is therefore unavailable on the FEC’s easily searchable website.

The 527s in our database instead file reports with the Internal Revenue Service, much like charities, but their filings do not appear in the same locations as most nonprofits. Instead, they’re published on an entirely separate part of the IRS website that uses a dated, difficult-to-use search tool. But buried behind that clunky interface is some significant and useful information, from the names of organizations’ leaders all the way down to line-item expenditures and contributions.

We got firsthand experience of the utility of this data last year when former ProPublica contributor Ilya Marritz used it to report on corporations that had resumed making donations to the Republican Attorneys General Association after Jan. 6, 2021.

RAGA, one of the largest and most influential 527s, used robocalls to urge then-President Donald Trump’s supporters to march to the Capitol on that day. In the aftermath of the attack, many of RAGA’s reliable donors publicly condemned its actions, but an analysis of the data showed that many of them merely paused their donations and then quietly returned months later. It was only possible for us to understand this after downloading and parsing the hard-to-use dataset.

Our new database makes it easy to search all the donations to RAGA and discover how companies like Microsoft not only stopped giving to the Republican group but also halted donations to the Democratic Attorneys General Association. It also makes it obvious that Johnson & Johnson cut a large check to the Republican group later that year.

Using 527 Explorer, you can easily find contributions to political groups by year, the contributor’s location and the amount.

Despite the influence of many 527s, experts said they receive little scrutiny and are rarely audited. Lloyd Mayer, a professor of law at Notre Dame, says that because these organizations’ filings don’t appear in the same place as those of most other nonprofits or political groups, they aren’t viewed as often. “FEC filings are a lot more searchable and therefore a lot more visible, and therefore it’s easier for reporters to make stories based on those and even for opponents or law enforcement investigators to discover stuff,” Mayer told us.

In this environment, questionable spending often goes unnoticed. ProPublica found a network of 527s that purport to support police, veterans, cancer patients and firefighters, but appear to largely be spending their donation money on a small group of fundraisers and administrative companies that support more fundraising efforts. They’ve raked in millions of dollars from Americans but appear to use little of it for their stated causes.

Last year, The New York Times found a group of 527s that similarly appeared to be putting almost all the money they raised into fundraising and organizations affiliated with the founders. ProPublica identified the network we reported on by looking at similar contributions and expenditures to those going to and from the group that the Times uncovered. In our new database, we’ve created a feature that will show you 527s that appear to have similar donors and expenditures so researchers and the public can do the same thing.

The database helps you find interesting things to dig into further. It makes it easy to see that some organizations withhold the names of large donors, pay most of their money to a single company, or appear to give most of their money back to their largest donors. Whether this behavior is legal often depends on the context, experts say.

The American Dental PAC Education Fund, for example, spent so much money on suites and tickets — about $1.5 million between 2005 and 2020 — to see artists like Taylor Swift and Celine Dion that the company that owns the Capital One Arena in Washington, D.C., makes up about 12% of the PAC’s reported expenditures. According to experts, if the tickets furthered the organization’s purpose, for instance by being used as prizes in a fundraiser, then that is a valid expense. If it is completely unrelated to furthering a political purpose, it would not be. Emails and phone calls to the group were not returned.

Now that this data is more easily explorable, we look forward to seeing what you discover in it. You can drill into state-level data to find the biggest players and largest organizations in your state, or you can take advantage of the powerful search and look up notable people, or sort and filter to see the largest donations made in a year or to a specific organization.

In addition to our similar organizations feature, we’ve added another way to help you uncover connections across organizations. Each contribution and expenditure has its own page, which uses machine learning to show similar contributions and expenditures, allowing you to do things like find other contributions that likely came from Walmart, regardless of minor variations in name or address.

If you write a story using this new information, come across bugs or issues, or have ideas for improvements, please let us know!

by Ruth Talbot, Brandon Roberts and Nat Lash

A 527 is a nonprofit formed under Section 527 of the Internal Revenue Code, which grants tax-exempt status to organizations whose primary purpose is attempting to influence the election of one or more people to public office at the national, state or local level. But contributions to these organizations are not considered tax-deductible, unlike gifts to charities.

This database has at least summary information for any organizations that filed for tax-exempt status with the IRS under Section 527. Additional information, including financial details, is available for organizations whose political activity is not regulated by the Federal Election Commission or state equivalents. The political activity of 527s is often for purposes other than expressly advocating for a federal or state candidate. Depending on the scope of their work, organizations may have filed additional reports or reports covering the same information at the federal or state level.

Visit ProPublica’s site to explore the database.

by ProPublica

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

After Russian hackers exploited a flaw in a widely used Microsoft product during one of the largest cyberattacks in U.S. history, the software giant downplayed its culpability. However, a recent ProPublica investigation revealed that a whistleblower within Microsoft’s ranks had repeatedly attempted to convince the company to address the weakness years before the hack — and that the company rebuffed his concerns at every step.

Here are the key things you need to know about that whistleblower’s efforts and Microsoft’s inaction.

Years before the SolarWinds hack was discovered in 2020, a Microsoft engineer found a security flaw these hackers would eventually exploit.

In 2016, while researching an attack on a major tech company, Microsoft engineer Andrew Harris said he discovered a flaw in the company’s Active Directory Federation Services, a product that allowed users to sign on a single time for nearly everything they needed. As a result of the weakness, millions of users — including federal employees — were left exposed to hackers.

Harris said the Microsoft team responsible for handling reports of security weaknesses dismissed his concerns.

The Microsoft Security Response Center determines which reported security flaws need to be addressed. Harris said he told the MSRC about the flaw, but it decided to take no action. The MSRC argued that, because hackers would already need access to an organization’s on-premises servers before they could take advantage of the flaw, it didn’t cross a so-called “security boundary.” Former MSRC members told ProPublica that the center routinely rejected reports of weaknesses using this term, even though it had no formal definition at the time.

Microsoft product managers also refused to address the problem.

Following the MSRC’s decision, Harris escalated the issue to Microsoft product leaders who, he said, “violently agreed with me that this is a huge issue.” But, at the same time, they “violently disagreed with me that we should move quickly to fix it.”

Harris had proposed the temporary solution of suggesting that customers turn off the seamless single sign-on function. That move would eliminate the threat but result in users needing to log on twice instead of once. A product manager argued that it wasn’t a viable option because it risked alienating federal government customers and undermined Microsoft’s strategy to marginalize a top competitor.

Microsoft was also concerned that going public with the flaw could hurt its chances of winning future government contracts worth billions of dollars, Harris said.

At the time Harris was trying to convince Microsoft product leaders to address the flaw, the federal government was preparing to make a massive investment in cloud computing, and Microsoft wanted the business. Acknowledging this security flaw could jeopardize the company’s chances, Harris recalled one product leader telling him.

Harris eventually learned that the flaw was even more dire than he originally thought. Once again, Microsoft opted to not take action, he said.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

In 2018, a colleague of Harris’ pointed out how hackers could also bypass a common security feature called multifactor authentication, which requires users to perform one or more additional steps to verify their identity, such as entering a code sent via text message.

Their discovery meant that, no matter how many additional security steps a company puts in place, a hacker could bypass them all.

When the colleagues brought this new information to the MSRC, “it was a nonstarter,” Harris said.

Researchers outside of Microsoft also warned the company about the flaw.

In November 2017, cybersecurity firm CyberArk published a blog post detailing the same flaw Harris had identified.

Microsoft would later claim this blog post was the first time it had learned of the issue, but researchers at CyberArk told ProPublica they had reached out to Microsoft staff at least twice before publication.

Later, in 2019, cybersecurity firm Mandiant would publicly demonstrate at a cybersecurity conference how hackers could exploit the flaw to gain access to victims’ cloud services. The firm said it had given Microsoft advance notice of its findings.

Russian hackers ultimately exploited the very flaw Harris and the others had raised.

Within months of Harris leaving Microsoft in 2020, his fears became reality. U.S. officials confirmed reports that a state-sponsored team of Russian hackers used the flaw in the SolarWinds hack. Exploiting the weakness, hackers vacuumed up sensitive data from a number of federal agencies, including, ProPublica learned, the National Nuclear Security Administration, which maintains the United States’ nuclear weapons stockpile. The Russians also used the weakness to compromise dozens of email accounts in the Treasury Department, including those of its highest-ranking officials.

In congressional hearings after the SolarWinds attack, Microsoft’s president insisted the company was blameless.

Microsoft President Brad Smith assured Congress in 2021 that “there was no vulnerability in any Microsoft product or service that was exploited” in SolarWinds, and he said customers could have taken more steps to secure their systems.

When asked what Microsoft had done to address the flaw in the years before the attack, Smith responded by listing a handful of steps that customers could have taken to protect themselves. His suggestions included purchasing an antivirus product like Microsoft Defender and securing devices with another Microsoft product called Intune.

After ProPublica published its investigation, lawmakers pressed Microsoft’s Smith if his prior testimony before Congress was incorrect.

Hours after the ProPublica investigation was published, Microsoft’s Smith appeared before the House Homeland Security Committee to discuss his company’s cybersecurity failures.

Rep. Seth Magaziner, D-R.I., asked Smith about his prior congressional testimony, in which he said that Microsoft had first learned about this weakness in November 2017 from the CyberArk blog post. ProPublica’s investigation, Magaziner noted, found that Harris had raised it even earlier, only to be ignored. The lawmaker asked Smith if his prior testimony was incorrect.

Smith demurred, saying he hadn’t read the story. “I was at the White House this morning,” he told the panel.

He also complained that ProPublica’s investigation was published the day of the hearing and said that he’d know more about it “a week from now.”

However, ProPublica had sent detailed questions to Microsoft nearly two weeks before the story was published and had requested an interview with Smith. The company declined to make him available. Instead, Microsoft had issued a statement in response. “Protecting customers is always our highest priority,” a spokesperson said. “Our security response team takes all security issues seriously and gives every case due diligence with a thorough manual assessment, as well as cross-confirming with engineering and security partners. Our assessment of this issue received multiple reviews and was aligned with the industry consensus.”

by Jessica Miller, The Salt Lake Tribune

This article was produced for ProPublica’s Local Reporting Network in partnership with The Salt Lake Tribune. Sign up for Dispatches to get stories like this one as soon as they are published.

A frustrated woman recently called the Utah official in charge of professional licensing, upset that his office couldn’t take action against a life coach she had seen. Mark Steinagel recalls the woman telling him: “I really think that we should be regulating life coaching. Because this person did a lot of damage to me.”

Reports about life coaches — who sell the promise of helping people achieve their personal or professional goals — come into Utah’s Division of Professional Licensing about once a month. But much of the time, Steinagel or his staff have to explain that there’s nothing they can do.

If the woman had been complaining about any of the therapist professions overseen by DOPL, Steinagel’s office might have been able to investigate and potentially order discipline, including fines.

But life coaches aren’t therapists and are mostly unregulated across the United States. They aren’t required to be trained in ethical boundaries the way therapists are, and there’s no universally accepted certification for those who work in the industry.

Simply put, anyone can call themselves a life coach — an industry that is rapidly growing. The International Coaching Federation has estimated that, in 2022, active life coaches generated more than $4.5 billion in revenue worldwide.

But with that growth have come complaints by clients about mistreatment by their life coaches and growing calls for some type of oversight.

In California, a woman sued her life coach in 2020, claiming the coach convinced her to sign over her home to the coach's nonprofit organization. She settled her lawsuit and got the title to her home back. A Connecticut life coach was given probation after he was charged last year with stealing money from a client with a traumatic brain injury. And this year, a Nevada life coach was sentenced to a year in jail after he admitted to taking money from clients that he was supposed to use for investments on their behalf — but that he spent at casinos instead.

In Utah, there’s a heightened sense of urgency after a therapist-turned-life-coach named Jodi Hildebrandt was sentenced to prison for abusing two of her business partner’s children.

One former client, who was not a part of Hildebrandt’s criminal case, also flagged concerns about how she conducted life coaching with him. Ethan Prete told The Salt Lake Tribune and ProPublica that Hildebrandt had ordered him to cut off contact with friends and family, and at one point asked him to live in a tent in order to “humble” himself. He also said Hildebrandt told him she didn’t want to be limited by the regulations therapists have to follow in Utah.

“She was like, ‘Without all these rules and regulations, now I have free rein to actually change peoples’ lives because the system is corrupt,’” Prete said.

Right now, the only Utah rules that apply kick in when life coaches diagnose clients or develop plans to manage mental health conditions. When that happens, Utah licensers can cite them with what’s known as unauthorized practice. But a records analysis by The Tribune and ProPublica shows citations and fines are seldom used and aren’t always effective — some life coaches have been cited for this multiple times.

Prosecutors can also file criminal charges, but a review of court records shows that no such cases have been brought against a life coach in at least a decade.

For more than a year, The Tribune and ProPublica have investigated obstacles that Utahns face when seeking justice against medical providers who they say hurt them — including what happens when they go to state licensers to file complaints. An August investigation by the news organizations showed how patients of a Utah County therapist had reported alleged inappropriate touching to both state licensers and local leaders within The Church of Jesus Christ of Latter-day Saints; neither group reported the therapist to law enforcement. Both said they take allegations of sexual assault seriously and indicated that they had addressed the complaints through their own processes. The Tribune and ProPublica’s reporting led to a police investigation, and that therapist was charged last summer with nearly a dozen felonies. He’s expected to enter a plea in August.

In light of the growth of the life coaching industry, Steinagel said he feels there’s a legitimate question that he plans to work with state legislators to address: “Has life coaching become one of those fields where the potential to harm people who are vulnerable is great enough,” he asks, “that the government should step in and regulate it? I think both the Legislature and we — from what we have seen, especially in the last few years — we think the answer is probably yes.”

Mark Steinagel, who heads Utah’s licensing division, thinks it may be time to regulate life coaches. (Rick Egan/The Salt Lake Tribune) Promises to “Rewire Your Brain,” “Untangle” Your Chaos

The scope of what life coaches can offer is undefined and broad: They can promise to help someone lose weight, run their business, change their parenting style, have better sex or improve other aspects of their lives.

Onstage at a recent natural health and wellness conference in Utah, near tables advertising essential oils, drink supplements and chiropractic adjustments, one life coach told assembled audiences she could help women reach their weight loss goals; her yearlong course cost $800.

Next on the program were a couple who, based on their experiences of both twice being divorced, said they could help people “untangle” their emotional “chaos”; another life coach advertised that he could “rewire your brain” to rid yourself of anxiety.

When licensers hear complaints about life coaches, they are most often from the customers themselves, or from a concerned family member or therapist whose patient disclosed past care from a life coach that seemed questionable, said Steinagel, DOPL’s director.

Investigators in his office usually ask dissatisfied clients the same questions: Did they diagnose you? Did they create a treatment plan? Did they treat you for anxiety, depression or another mental health disorder? If the person lodging the complaint answers “no” to these questions, Steinagel said, DOPL can’t do anything.

The public also can’t see any of the specific grievances that have been made against Utah life coaches because of this catch-22: DOPL doesn’t release complaints unless they result in disciplinary action — and DOPL can’t discipline life coaches.

A review of records shows that DOPL has cited 25 people for unauthorized practice in the mental health field in the last decade, a number that included four life coaches and at least one online “influencer” offering “therapy” services.

It appears citations have been successful a handful of times — including with the online influencer, who stopped offering those services on her Patreon account.

But at least two men have been cited for unauthorized practice multiple times and still continue working as life coaches.

One was cited twice by licensers — in 2012, and then again a year later — and now runs a program that trains life coaches. He had previously worked as a therapist, according to public records, but his license had expired. In his second citation, licensers fined him $1,000 after they said he advertised himself as a “psychotherapist” in a marketing brochure for a seven-day retreat.

Another man, Denim Slade, was cited and fined $250 just three months after he surrendered his therapy license after DOPL received two reports that he engaged in inappropriate conduct with female clients. DOPL cited him, according to public records, for advertising that he did “Lifespan Integration Therapy” and could treat trauma in his life coaching business. A year later, he was cited again for unauthorized practice after DOPL received reports that he continued to advertise that he treated mental health issues like depression, anxiety, trauma and post-traumatic stress disorder. The life coach told a DOPL investigator he didn’t realize those posts were still active after he gave up his license and agreed to remove them.

Slade told The Tribune and ProPublica that he has never conducted therapy or mental health treatment as a life coach. He admitted that, in his therapy practice, he had allowed “some mild boundaries to be crossed” with one client. But he also said the DOPL records did not contain “the full picture” and that he felt pressured to admit to doing something wrong after licensers received a second report years later; he denied that allegation, but rather than fighting it, he decided to relinquish his license and turned to life coaching.

“I was excited at the prospect of working with an appropriate coaching population and transitioning to helping people who were already doing fairly well in their lives and wanting, but not necessarily knowing, how to excel,” Slade said. And he said while he feels there can be “some overlap” between life coaching and therapy, he believes “these are two definably different populations with different needs. I do not think life coaches should be conducting therapy.”

He also said he believes there are already safeguards in place for people doing mental health work that requires a license, and it’s already against the law to practice therapy without a license.

“I think people ought to be able to hire someone to help them with things in their lives that they want extra help with,” he said. "Do you regulate someone wanting to get help organizing their house, teaching art to kids, teaching piano, coaching Little League sports? I don’t know where that line should be.”

Therapist organizations in Utah have been a driving force in advocating for some measure of state oversight of life coaches. “Regulation really keeps them in their lane, us in our lane, and just increases consumer safety all around,” said Sarah Stroup, a licensed therapist who is on the legislative committee for the Utah Association for Marriage and Family Therapy.

Jessica Black, a licensed therapist who works with the Legislature in her role with the Utah Mental Health Counselors Association, said she sees particular vulnerabilities when life coaches try to help someone struggling with their mental health.

“There’s a difference between a business coach coaching you on how to build a business,” Black said. “But when you’re dealing with somebody’s mental health, or when you’re dealing with their life — that’s how people get taken advantage of.”

When Therapists Become Life Coaches

There have been Utah therapists who have lost their licenses for misconduct who, despite being deemed unsafe to work with patients, have still been able to continue their careers working in the mental health field — often in the unregulated realm of life coaching.

At least 43 Utah mental health professionals have surrendered their licenses or had them revoked, denied or expired on suspension since 2010, according to a review of publicly available DOPL disciplinary records. Of those, it appears that a third have continued working in mental health, according to searches of LinkedIn profiles and business websites — as mental health “associates,” motivational speakers and life coaches.

Some of those who have continued to work with clients on their mental health or well-being had lost their therapy licenses for serious reasons, DOPL records show. Several struggled with drug or alcohol use. Others lost their licenses after being accused of having inappropriate contact with patients, including Slade, who admitted in 2013 he had an inappropriate relationship with a married client. He gave up his license in 2019 after another patient reported to DOPL that he had engaged in “inappropriate physical and verbal conduct” with her; he denied this accusation in licensing records. A second therapist was charged with sexual exploitation by a medical care professional in Idaho, and a third touched a teenage girl’s leg and torso during a therapy session in an effort to “sexually stimulate” her as part of a therapeutic technique. (This man subsequently got his license back and was again accused of unprofessional conduct; he has now agreed to stop practicing entirely — including as a life coach — while DOPL and the police investigate.)

Steinagel said it’s “very frustrating” when therapists who lose their licenses continue doing mental health work as life coaches. He also said that while licensers can’t prohibit them from working in the unregulated field of life coaching, investigators often keep a close eye on such coaches to ensure they don’t cross into therapy.

Therapist-turned-life-coach Jodi Hildebrandt appears in court earlier this year for a sentencing hearing after she was convicted of abusing two children. (Sheldon Demke/Pool/St. George News)

In Hildebrandt’s case, it appears she deliberately decided to leave the regulated field of therapy. Over a decade ago, in 2012, promotional materials for her self-help company leaned into her credentials as a licensed therapist and experience as an addiction counselor.

But after more than a decade of running ConneXions Classroom, Hildebrandt had changed her website: References to her credentials as a therapist were gone, and she instead began calling herself a life coach. (At the time, she was still licensed as a clinical mental health worker and could have used that designation.)

“I began practicing in the psychotherapy world, and my patients were not healing,” she wrote on her website in 2022. “When I began empowering people by educating them with principles of Truth (learning to be honest, responsible, and humble), I saw my patients radically change right in front of me!”

Prete, the former client, met Hildebrandt as he was struggling in his marriage during the pandemic and after the birth of their first child. His now-ex-wife wanted to try the ConneXions program, he said.

Ethan Prete said his life coach told him to cut off contact with family and friends. (Rick Egan/The Salt Lake Tribune)

The help he was seeking came with a cost: To start, he had to pay a monthly charge to participate in a group video call every Saturday morning. He paid another weekly fee to be part of a men’s small group. On top of that, he paid weekly to meet one-on-one with Hildebrandt. In total, he was spending more than $1,000 a month.

“I would meet with her every week for almost a year,” he said of Hildebrandt. “And it was always like, your wife is going to leave you. If you ever want to see her again, you’ll do what I say.”

After Hildebrandt told him to cut off contact with friends and relatives, he said, he was living separately from his family and Hildebrandt told him and his wife not to speak to each other. Hildebrandt, he said, “had complete control.”

Hildebrandt is currently in prison, and DOPL revoked her license as a clinical mental health worker in May in response to her child abuse convictions. Her attorney did not respond to a list of questions sent to him for this article.

A Moment for Utah

In the final days of Utah’s 2024 legislative session, Kevin Franke, the father of the children abused by Hildebrandt, made a plea to lawmakers in a letter, asking them to pass a bill that would require life coach registration.

He wrote about the impact of being a client of Hildebrandt’s with his now-ex-wife, how his marriage ended and how his children were deeply harmed. All of it, he wrote, had been at the directive “of a dangerous mental health professional who believes that she could act outside the ethical balance of her profession by labeling herself as a life coach.“

Franke also asserted that Utah’s culture makes its citizens particularly vulnerable. The state’s attorney general has acknowledged that Utah has held a decades-long reputation for being the “fraud capital of the United States.” That’s in large part because of a local culture of trust in institutions among members of the dominant religion, The Church of Jesus Christ of Latter-day Saints. Investment fraud targeting LDS church members, Ponzi schemes and scams carried out in a style that mimics Utah’s significant multi-level marketing industry are prevalent in the state.

Black, the therapist with the Utah Mental Health Counselors Association, said that’s why Utah legislators should lead in regulating life coaches.

“I think it is a national problem. I think Utah’s unique in the sense that they’re very easily bought into MLMs,” she said about multi-level marketing. ”That’s kind of the structure of a lot of these life coaches. The more you pay, the more access you get. The more perks you get.”

Legislators in a handful of other states have tried to enact some oversight, but so far no proposals have become law.

New Hampshire legislators debated a bill in 2019 that would have studied whether life coaches should be regulated. The bill didn’t pass.

Two years later, in Oregon, legislators considered establishing a voluntary registry for those who provide “alternative therapy,” like life coaches. It also would have allowed the state to impose discipline for certain violations. But the measure failed after several life coaches pushed back.

“Coaching is not, nor claims to be, a form of therapy,” one Oregon coach wrote. ”Coaching is partnering with clients in a thought-provoking and creative process that inspires them to maximize their personal and professional potential.”

Life coaches are not required to be certified by the International Coaching Federation or any other organization. There’s no Utah ICF chapter, and the ICF did not respond to interview requests.

The ICF did release a statement to The New York Times, which recently reported the experiences of several people who felt they had been tricked into paying for courses to become life coaches as part of a “pyramid scheme.”

Carrie Abner, the vice president of credentials and standards at the ICF, told the newspaper that coaching is a “self-regulated industry,” and clients should make sure they are working with coaches that are trained, are experienced and have credentials. Credentialed ICF members, she added, agree to abide by an ethics code.

In Utah, state Sen. David Hinkins’ bill to require life coaches to register with DOPL never got past a first hearing. State lawmakers, however, are expected to continue the discussion this month during legislative committee meetings.

Franke said in his letter that he was able to get a measure of accountability because Hildebrandt and his ex-wife — who also participated in abusing the children — broke the law and went to prison. But not every ethical violation is a crime. And people who have been taken advantage of emotionally or financially, he said, have little recourse.

“These individuals are literally ghosts,” he wrote, “and are free to sell their supposed life expertise to anyone willing to purchase it.”

Mollie Simon contributed research, and Jeff Kao contributed data reporting.

by Doug Bock Clark

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for Dispatches, a newsletter that spotlights wrongdoing around the country, to receive our stories in your inbox every week.

Last fall, out of public view, the North Carolina Supreme Court squashed disciplinary action against two Republican judges who had admitted that they had violated the state’s judicial code of conduct, according to three sources with direct knowledge of the decisions.

One of the judges had ordered, without legal justification, that a witness be jailed. The other had escalated a courtroom argument with a defendant, which led to a police officer shooting the defendant to death. The Judicial Standards Commission, the arm of the state Supreme Court that investigates judicial misconduct by judges, had recommended that the court publicly reprimand both women. The majority-Republican court gave no public explanation for rejecting the recommendations — indeed, state law mandates that such decisions remain confidential.

The sources spoke to ProPublica on the condition of anonymity because many of the actions and decisions of both institutions are confidential and because the sources said they feared retaliation.

When it comes to disciplining judges, North Carolina is one of the most secretive states in America, according to data from the National Center for State Courts’ Center for Judicial Ethics. Over half of states make disciplinary proceedings against judges public once charges are filed with their judicial ethics commission. Another dozen make them public if they reach the state’s supreme court. North Carolina is one of only three states, in addition to the District of Columbia, to release information only at the last possible stage of the process — after the Supreme Court orders discipline.

Stephen Gillers, a professor emeritus at New York University’s law school who specializes in legal and judicial ethics, said that making some parts of disciplinary cases against judges confidential can be necessary to protect private or personal information. But North Carolina goes too far, he added. “While secrecy has a place in judicial discipline, it can be used to conceal wrongdoing,” Gillers said. “Once there is a finding of wrongdoing by a disciplinary commission, the case should become public.”

The North Carolina Supreme Court’s decisions not to publicly discipline the two judges, which have not previously been reported, appear to be the only instances in more than a decade in which the Supreme Court did not follow the commission’s recommendation to issue punishment. Those decisions come at a time of accusations and recriminations about politics influencing North Carolina’s high court. Last year, Justice Anita Earls, a Democrat, sued the commission after it launched an investigation into comments she made suggesting that Republican justices were influenced by conservative ideology, remarks that she defended as free speech. And a Republican justice personally attacked Earls in a Supreme Court order in September. In addition, the year before, outside groups sought recusals of more than half of the court’s justices over various conflict-of-interest accusations.

Justice Anita Earls, a Democrat, voiced concerns about the influence of conservative ideology on the state Supreme Court. (Cornell Watson/The Assembly)

Spokespeople for the North Carolina Supreme Court and the Judicial Standards Commission declined to comment or respond to a detailed list of questions.

Asher Hildebrand, a professor of public policy at Duke University, explained that in the 2010s, North Carolina had policies designed to keep the judiciary above the political fray, such as nonpartisan judicial elections. However, the gradual dismantling of these policies by the Republican-controlled legislature has driven the court’s polarization, according to Hildebrand.

Get in Touch

Do you have any information about the North Carolina Supreme Court or state court system that we should know? Contact reporter Doug Bock Clark at doug.clark@propublica.org or 678-243-0784. He can be reached securely on Signal at 678-243-0784. If you’re concerned about confidentiality, check out our advice on the most secure ways to share tips.

“While we might long for the days when courts were perceived as being above politics, courts are very much a partisan battleground,” he said.

Bob Orr, a former Republican justice, said partisan disputes over the judicial standards process have intensified in recent years.

“The judicial standards process needs a major overhaul in that I don’t think it was set up to deal with the current political atmosphere that judges have been embroiled in,” said Orr, who back in the early 2000s was investigated and received a private warning from the then-Democratic-controlled commission over comments that it deemed to be an impermissible political endorsement. He left the Republican Party in 2021 after being a vocal critic of former President Donald Trump.

Orr added, “It’s important for all the decision-makers in the judicial standards process — the commission, its staff and the Supreme Court — to act in a nonpartisan way to increase trust in the judicial system.”

Since 2011, North Carolina’s Judicial Standards Commission has referred 19 cases to the Supreme Court for judicial discipline, according to the court’s annual reports. In that time, the court has issued 17 public disciplinary orders, ranging from reprimands to suspensions without pay.

Had the Supreme Court followed the commission’s recommendations in the cases of the two Republican judges, it would have meant publicly reprimanding them ahead of elections for both in 2024. Judge Lori Hamilton, a longtime Republican, had campaigned with the slogan, “the ideal conservative.” Judge Caroline Burnette had previously been a Democrat — but she switched her registration before her case got to the Supreme Court, according to public records.

In September 2021, Burnette was conducting a trial when she got into a shouting match with the defendant, Christopher Vaughan, who was facing charges of false imprisonment. Court recordings later published by WRAL News captured a three-minute argument, which escalated after Burnette told Vaughan to “shut up.” When Burnette ordered the bailiff to “take him,” Vaughan rushed Burnette. The bailiff blocked him, the two grappled, and the bailiff shouted that Vaughan had his gun. A police officer who was in the courtroom to testify shot Vaughan in the head, killing him, an incident that was widely reported.

The commission’s work is confidential, but sources say that it soon began investigating Burnette, who had potentially violated multiple parts of the judicial code, including the requirements that a “judge should maintain order and decorum in proceedings” and a “judge should be patient, dignified and courteous.” Burnette declined to comment. A spokesperson for the state court system said Burnette would not respond to ProPublica’s detailed list of questions.

Not long after, in November 2021, Hamilton was overseeing the trial of a man charged with sex crimes against minors. According to court transcripts, Hamilton accused the victims’ mother of bringing them to court late and previously being uncooperative with the state’s lawyers. “I’m going to take you into protective custody to ensure your appearance here at trial,” Hamilton told the mother, ordering that she be handcuffed, detained throughout the trial and denied an attorney. Hamilton also said that the victims should be turned over to Child Protective Services. Court staff were so unsure of how to execute their orders that the bailiff explained to Hamilton that they “don’t know how to book” the mother.

The mother of the victims, whose name is being withheld to protect the identities of her children, said she spent her four days of incarceration worrying about her daughters, crying and asking court staff, “How can you hold me if I’m not charged with nothing?”

The commission soon launched an investigation into Hamilton, sources say. She had potentially violated multiple canons, including that “a judge should uphold the integrity and independence of the judiciary” and that a “judge should be faithful to the law and maintain professional competence in it.” In response to a detailed list of questions from ProPublica, Hamilton answered only one, which asked if she thought that her political affiliation had anything to do with the conservative majority of the Supreme Court going against the commission’s recommendation. “No, I do not,” she replied.

During the commission’s investigations and hearings process, both Hamilton and Burnette stipulated that they had violated the judicial code, according to sources. Those sources said that the commission sent the cases to the Supreme Court to determine final discipline and that the commission recommended that the court give them public reprimands. When the commission determines there to be minor violations, it issues a letter of caution or a verbal warning, which remains private. The vast majority of disciplinary action falls into these categories. But all judicial discipline serious enough to be issued by the Supreme Court becomes public, according to the rules of the commission.

Months after the Supreme Court decided in the fall of 2023 to let Hamilton and Burnette off without public consequences, it issued its most recent disciplinary order. In March 2024, the court concurred with the commission’s recommendation for punishment of Angela Foster, a Black Democratic judge who had pressured a court official to reduce a bond for her son and had taken over a courtroom reserved for other court officials, thereby delaying over 100 cases. The Supreme Court suspended her without pay for 120 days.

At the same time as the court was considering how to handle the two white Republican judges, the commission was weighing another fraught matter.

In March 2023, Earls, the Supreme Court’s lone Black justice and a Democrat, received a letter from the commission informing her that she was under investigation. The letter stated that Earls had been accused of disclosing “confidential information concerning matters being currently deliberated in conference by the Supreme Court.” If the commission found evidence of a serious violation, it could send the case to the Supreme Court, which would make a final determination and could go as far as to expel her.

At the center of the anonymous complaint was the allegation that Earls had told lawmakers and state bar members at two different meetings about proposed rule changes that would give more power to the Republican justices. The complaint, which was made after WRAL News published an article describing the meetings, also alleged that she’d provided confidential information to a reporter.

In her response to the letter, which later was filed in court, her lawyer argued that it had been standard practice for justices to discuss the court’s rule changes with affected parties and that no information had been leaked. Earls’ lawyer also wrote that if the matter proceeded to a hearing, Earls planned to make the investigation public and subpoena “current and former Justices” about their “actions.” In May, the commission dismissed the complaint, providing Earls with verbal and written warnings “to be mindful of your public comments,” according to court documents.

In June, Earls, the only person of color on the court, gave an interview to Law360 in which she criticized Chief Justice Paul Newby and other conservative justices for refusing to address the lack of diversity in the state’s court system. She revealed that Newby had effectively killed its Commission on Fairness and Equity by not reappointing its members and that he had ended implicit bias trainings for judges, which Earls had helped set up. Much of the interview was framed around a Law360 analysis and an outside study that found that the vast majority of state appellate court judges, and the attorneys arguing before them, were white and male. In reference to the findings, Earls said that “our court system, like any other court system, is made up of human beings and I believe the research that shows that we all have implicit biases.” She said that her five Republican colleagues “very much see themselves as a conservative bloc” and that “their allegiance is to their ideology, not to the institution.”

In August, Earls received another letter from the commission alerting her that it had “reopened” the former investigation. The letter warned: “Publicly alleging that another judge makes decisions based on a motivation not allowed under” the code, such as racial or political biases, without “definitive proof runs contrary to a judge’s duty to promote public confidence in the impartiality of the judiciary.”

Rather than letting the investigation proceed in secret again, Earls sued the commission in federal court, seeking an injunction to stop “an on-going campaign” by the commission to “stifle the First Amendment free-speech rights of Justice Earls and expose her to punishment.”

Two weeks after the lawsuit was filed, Democratic state lawmakers held a press conference to call the investigation into Earls “a political hit job” — and one state representative accused Newby of pushing it, though he said he could not reveal his sources. Four sources knowledgeable about Newby’s or the commission’s actions told ProPublica that the chief justice encouraged the investigation. The sources requested anonymity because the inner workings of the commission are confidential and because they feared retaliation.

Newby and Earls declined to comment through a North Carolina Supreme Court spokesperson. Neither responded to questions submitted to the North Carolina Judicial Branch.

The lawsuit led to public outcry, which was fiercely critical of the investigation and which was partially fueled by the fact that Newby had himself made remarkably similar statements alleging that his Democratic colleagues were biased. In the summer of 2019, when Newby was a justice campaigning to become chief justice, he made a speech, first reported by WRAL News, in which he called Earls an “AOC” — referencing progressive U.S. Rep. Alexandria Ocasio-Cortez. He also accused Earls of wanting “to cause social change through our judicial branch,” suggested that she was part of a Democratic strategy to “sue till you’re blue” and warned, “See what kind of judicial activism occurs on your North Carolina court.”

After the speech, the commission, which at the time was under a Democratic court, fielded complaints about Newby. The existence of those complaints has not been previously reported. According to multiple sources, the commission issued Newby a confidential verbal warning, emphasizing he should not so overtly criticize his fellow justices again.

At the time, experts told news outlets that Newby’s statements about Earls were probably protected by the fact that he was campaigning, as the code allows justices greater leeway when seeking reelection. However, in 2023, Earls was also technically in campaign mode and subject to the same protections as Newby. According to Earls’ lawsuit, she had declared her candidacy for her next election many years in advance, as had become standard practice among justices.

Two sources with direct knowledge of the investigations into both Newby and Earls said that Earls faced more scrutiny in terms of both the length and depth of the investigative process. One of those sources, however, said that “there was no bias” in the treatment of Earls. The source chalked up the difference between the two investigations to the fact that in the intervening years, the commission had intensified efforts to rein in the justices as they became more openly contentious about their differing political views.

In January 2024, as Earls’ lawsuit barreled toward a trial, the commission abruptly dropped its investigation. It did not recommend the Supreme Court take any disciplinary action against her.

by McKenzie Funk

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for Dispatches, a newsletter that spotlights wrongdoing around the country, to receive our stories in your inbox every week.

When the COVID-19 pandemic upended the workplace, jobs went remote, offices had to adopt new technologies and longtime employees suddenly departed. Federal stimulus dollars flooded into state and local government accounts, and fraudsters had a heyday.

The pandemic was only one of several recent disruptions to roil the financial operations of state and local governments, which oversee $4 trillion a year in spending. Payments — and paper trails — have gone digital. Scammers can now use AI tools to streamline their hunt for victims, including within government agencies. And local newspapers in the United States, one historic line of defense against graft, are disappearing at a rate of 2.5 a week.

Few states have a better view into the latest ways people are stealing and otherwise misspending local government dollars than Washington.

Its Office of the State Auditor is the second-biggest state auditing shop in the country by budget ($64 million) and fifth by employee count (400). By state statute, the office must regularly examine the books and operations of Washington’s every town, county, port, stadium authority, asparagus commission, cemetery district, drainage district and mosquito control district. It conducts as many as 2,400 state and local audits a year, rooting out fraud and waste.

To get a better sense of what these audits can tell us about how fraud is evolving, ProPublica met twice recently with Brandi Pritchard, a careerlong Washington auditor who helps lead the state’s fraud-preventing special investigations unit.

In our conversations, which have been edited for length and clarity, Pritchard described how fraudsters seem to be stealing more money more quickly and why her job hasn’t made her lose her faith in humanity.

Has fraud changed since the pandemic?

Right as the pandemic was happening, when everybody was remote, there was a huge increase in fraud risk. All so quickly, governments had to change their entire internal control structure. We’re used to walking into somebody’s office and setting a piece of paper on their desk to review. Now you could no longer do that. But since then it feels like it’s mostly back to normal, with exceptions.

What are the exceptions?

With remote work, we’re starting to see some problems with folks working two “full-time jobs” with different agencies. They’re supposed to be working the full 40 hours from 8 to 5 for two agencies. Clearly, that’s physically impossible.

Another thing that came out of the pandemic: It forced governments to move to a more electronic documentation system. That’s great and more efficient, but the downside is it can be more difficult to spot forgery or somebody making an edit, using Photoshop or other tools, to financial statements. [In one recent case, the auditor’s office said that an altered utility bill led to an investigation of a former city clerk-treasurer, who was eventually charged with forgery involving checks totaling $3,700. Danni Lee Speelman pleaded not guilty and awaits trial in July. According to the auditor’s report, the clerk said she was “not responsible for the altered customer utility statement and attributed it to a computer system change.”]

Obviously, technology has made a lot of advances since the pandemic, AI being a big part of that. There’s FraudGPT, which is like ChatGPT — but it’s for fraudsters. [The bot’s developer claims it can create malicious computer code, write scam letters and hack websites.] It’s paving the path for them to easily get fake checks, fake statement templates, emails to do phishing schemes and so on. We wouldn’t know whether folks are using FraudGPT or not in the schemes we see, but I could guess based on the emails our governments are falling for.

You see the phishing emails they fall for?

Our governments are required to give us a copy. And it’s amazing how many commonalities I have found, which tells me either these originated from one particular crime ring, or maybe they’re all using FraudGPT. The word “kindly” shows up in almost every email. “Can you kindly change this?” “Kindly reply back to me?” and so on.

Any other examples beyond “kindly”?

There’s a sense of urgency. You know, they’ll wait till the day before payroll, then suddenly it’s, “I know payroll is going out tomorrow. Can you quickly change it to my new bank account?”

So is fraud getting worse? Better?

I don’t know that our case counts have really changed a ton, but people are stealing more and quicker, and we’ve had a few cases where it didn’t appear that they tried very hard to cover it up.

The town of Cusick is a great example of that. The town’s clerk treasurer drained the bank account from $200,000 to $240-something in a matter of months. It was alarming, the intensity with which that case unfolded. [In March, the clerk treasurer, Luke Michael Servas, was indicted on accusations of wire fraud and bank fraud, among other charges. He pleaded not guilty and awaits trial. Servas did not respond to ProPublica’s requests for comments before publication.]

How did you find that one?

We were attempting to start a routine audit, reaching out to the clerk treasurer, and to be honest, he was kind of ghosting us. He wasn’t giving us the records we needed. We eventually reached out to the mayor, who worked in concert with a council member to get ahold of the bank statements. As soon as they saw the statement, they noticed.

Is this typical? How often do you uncover fraud through routine audits?

Most fraud is detected by tips. About 5% of fraud is detected by auditors. I will say that more recently, in the last year or so, it feels like our auditors are finding more. And the cases that involve very, very large dollar amounts, we’re the ones finding those: Pierce County Housing Authority, close to $7 million. [A former Housing Authority executive, Cova Campbell, pleaded guilty to wire fraud in early 2021. Through her attorney, she declined to comment on her case.] We’re drafting a report right now about one we found that was close to a million. Then there’s Cusick. That was hundreds of thousands, and we found that one.

Any guesses as to why the auditor’s office is the one finding these high-dollar cases?

I wish that I knew the answer to that, because then we’d probably find them more quickly. Thinking back, we found most by reviewing bank statements. So that gets down to the question, “Why are governments struggling to do their own reviews?” In some cases, I think it’s because the elected officials didn’t run for election to review bank statements. We try to convince them of their fiduciary role and how down in the weeds that might have to be.

That’s like Cusick, right? For years you had been warning them they didn’t have proper financial controls. Are repeat offenders common, or does one bad audit convince most governments to get their affairs in order?

I wish I could say it was an outlier. We have probably four or five other small towns I could name offhand. Because they’re small, they put a lot of trust in the people they hire to do these finance roles. One thing we feel is problematic is when elected officials are related to each other. What good is a review if the person reviewing you is your wife or your mother or your father? But when we talk to governments about this, they say these are the only people who are willing to serve. [In its response to the auditor’s report, the town of Cusick said it opened a new bank account that allows multiple town officials to review online statements and that now its “transactions and payrolls are cross-checked by clerks.”]

What about the psychology of all this? How do fraudsters justify what they did?

One thing we hear a lot is that it wasn’t fraud: “I didn’t take the money. It wasn’t a misappropriation. It was a loan, and I intended to pay it back.” I don’t know if they actually convince themselves of that, but I do feel like some of them have, because it’s easier to look yourself in the mirror as somebody who borrowed money. I could speculate all day long. One thing I do know is that many of them have gambling problems.

You enjoy catching people in the act?

Yes and no. My honest answer is that we don’t want to catch it. We want our governments to have the right controls to catch it themselves.

What’s the most shocking fraud you’ve ever run across?

Pierce County Housing Authority comes to mind. As far as we can tell, it’s the largest government misappropriation [by an employee] in Washington state’s history. And considering who the users of that particular district are, low-income folks needing housing assistance, that makes it even more staggering.

But on the fraud-nerdy side of things, it’s a wonderful case study. The way our auditor used professional skepticism was absolutely magnificent, in that she wasn’t just paying attention to the physical pieces of paper in front of her. She was capturing the environment, the culture there, and it felt off to her. The way our subject treated her staff compared to the way she treated the auditors felt off. So by the time the auditor looked at that bank statement and saw that weird wire to some title company, she was on high alert.

How did your subject treat auditors differently than she treated her employees?

She raised her voice quite often at her staff. She did not treat them very well. But when we had a question, she was incredibly kind. The auditor felt like the subject was trying to butter us up. The other part of it was, if we had a question, we weren’t allowed to talk to staff. Everything went straight to our subject, which was another red flag.

After two decades in this job, has your view of humanity darkened?

Not really. I think working here has made me think better overall of humanity. I’m seeing so many people choose a career in public service. Whether that’s elected officials, department heads or down to the finance staff, there’s just so many people that work so incredibly hard and probably get a lot of grief, unfortunately. We have our fraudsters, but it’s such a small percentage.

by Renee Dudley

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Members of Congress pressed Microsoft on Thursday to strengthen how it handles reported security flaws in its ubiquitous products after a series of cyberattacks struck the federal government.

The criticism from members of the House Homeland Security Committee came in response to a new ProPublica investigation that found Microsoft repeatedly rebuffed a company engineer who, beginning in 2017, warned that a product flaw left millions of users vulnerable to attack, including federal employees. Russian hackers later exploited that weakness in one of the largest cyberattacks in U.S. history, widely known as SolarWinds.

Rep. Bennie Thompson of Mississippi, the committee’s top Democrat, entered the news organization’s story into the congressional record. He then asked Microsoft President Brad Smith if the company has since established a process “to ensure that employee concerns about security at Microsoft or their products are prioritized and addressed.”

Smith, sitting alone at the witness table in a packed hearing room, told lawmakers that the company is shifting its approach to security. Microsoft is trying “to empower every employee to focus on continuous improvement and speak up ... and to ensure that those voices are heard and heeded,” he said.

Smith added, “We want a culture that encourages every employee to look for problems, find problems, report problems, help fix problems and then learn from the problems.”

As ProPublica reported, that is not the corporate culture that the former Microsoft engineer, Andrew Harris, encountered in the years leading up to SolarWinds. Harris said product leaders, who were focused on Microsoft’s drive to dominate the cloud computing market, told him that addressing the weakness he’d identified would undermine the company’s business goals of securing federal government contracts and marginalizing competitors.

The federal Cyber Safety Review Board, in its own examination of Microsoft’s role in a separate hack perpetrated last year by Chinese attackers, also found the company’s security culture “inadequate” and in need of an “overhaul.” Microsoft “deprioritized both enterprise security investments and rigorous risk management,” the board found, resulting in a “cascade of … avoidable errors.”

On Thursday, Smith said Microsoft accepted responsibility for the board’s findings and has since moved to tie executive bonuses to cybersecurity. He said security would also be part of every Microsoft employee’s performance review, and thus would indirectly impact compensation across the company.

Microsoft’s promise to change its security culture echoes a similar pledge from founder Bill Gates more than 20 years ago. “When we face a choice between adding features and resolving security issues, we need to choose security,” Gates wrote at the time.

In the decades since, former employees told ProPublica, developing new products and features was often prioritized over fixing security bugs in existing offerings.

While the official subject of Thursday’s hearing was the cybersafety board’s report on the China hack, members of the committee asked Smith question after question about ProPublica’s SolarWinds investigation, which Rep. Delia Ramirez, D-Ill., called a “bombshell report.”

She said the hearing was a “reckoning moment” for the company, which has repeatedly downplayed its role in SolarWinds. One of the flaws the Russians exploited involved a Microsoft application, which was supposed to ensure users had permission to log on to cloud-based programs. The weakness allowed intruders to masquerade as legitimate employees and rummage through sensitive data in the cloud, including emails.

Rep. Seth Magaziner, D-R.I., asked Smith about his prior congressional testimony, in which he said that Microsoft had first learned about this weakness in November 2017, when an outside cybersecurity firm published a report on it. ProPublica’s investigation, Magaziner noted, found that Harris had raised it even earlier, only to be ignored. The lawmaker asked Smith if his prior testimony was incorrect.

Smith demurred, saying he hadn’t read the story. “I was at the White House this morning,” he told the panel.

Later, Smith complained that ProPublica’s investigation was published the day of the hearing and said that he’d know more about it “a week from now.” ProPublica sent detailed questions to Microsoft nearly two weeks before the story was published on Thursday and requested an interview with Smith. The company declined to make him available.

On Thursday, Smith pointed out that the weakness in Microsoft’s product could also be found in other companies’ software. Cybersecurity specialists have noted, however, that Microsoft’s version was one of the most widely used, including by the federal government.

When Ramirez asked how Harris’ discovery would have been handled differently today, Smith said, “I think what’s most important for today is simply to note how we are changing … how we elevate these issues and reward people for finding, reporting and helping to fix problems.”

by Justin Elliott, Joshua Kaplan and Alex Mierjeski

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Billionaire political donor Harlan Crow provided at least three previously undisclosed private jet trips to Supreme Court Justice Clarence Thomas in recent years, an investigation by Senate Judiciary Committee Democrats has found.

The flights, which were detailed by Crow’s lawyer in response to inquiries from the committee, took the justice to destinations including the region near Glacier National Park in Montana and Thomas’ hometown in Georgia.

The committee launched its investigation in response to ProPublica reporting last year that revealed numerous undisclosed gifts Crow provided to Thomas, including private school tuition for a relative and luxury vacations virtually every year for more than two decades. Democrats on the committee authorized a subpoena for information from Crow last November, but the subpoena was not issued, and the new information came as a result of negotiations between the Senate and Crow’s attorneys.

It’s possible more revelations are yet to come. The office of the panel’s chair, Sen. Dick Durbin, D-Ill., said that a report detailing the full findings of committee Democrats’ investigation would be released later in the summer.

“As a result of our investigation and subpoena authorization, we are providing the American public greater clarity on the extent of ethical lapses by Supreme Court justices,” Durbin said in a statement. He added that the newly discovered gifts make “crystal clear that the highest court needs an enforceable code of conduct.”

Crow’s office said in a statement that he gave the senators information covering the past seven years and that the committee “agreed to end its probe with respect to Mr. Crow.”

“Despite his serious and continued concerns about the legality and necessity of the inquiry, Mr. Crow engaged in good faith with the Committee,” the statement said.

Thomas did not immediately respond to a request for comment.

The newly revealed flights add to the picture of Thomas’ frequent use of Crow’s jet for personal travel, allowing the justice to fly in the style of the ultrawealthy. Crow owns a high-end Bombardier Global 5000, a jet that can cost over $10,000 per flight hour to charter, according to charter company estimates. Thomas has repeatedly flown to a destination and back again on the same day.

The relationship between the two men began on Crow’s jet: In 1996, Crow offered to fly the justice to Dallas for a speech and while they were in the air, they hit it off, Crow has said. Crow has since flown Thomas to destinations around the world.

The new details released by the Senate don’t make clear the purpose of the trips, only listing flight dates and locations. They include a May 2017 trip from St. Louis to Kalispell, Montana — the location of Glacier Park International Airport — then from Montana to Dallas two days later. Thomas was scheduled to be in St. Louis at the time for a speech to a local bar association.

In one instance, he flew on June 29, 2021, from the East Coast to San Jose, California, and returned home later that day. In another, the justice took a round-trip flight on March 23, 2019, from Washington, D.C., to Savannah, Georgia.

ProPublica could not immediately find evidence of Thomas making public appearances in Montana, Georgia or California on the dates in question.

Last May, Senate Democrats requested detailed information from Crow about his relationship with Thomas, including an itemized list of all gifts he’d given to Supreme Court justices over the years. In November, Democrats upped the pressure by authorizing a subpoena. That decision met fierce Republican opposition, with GOP senators on the committee walking out of the hearing in protest.

The committee also authorized a subpoena for conservative legal activist Leonard Leo. Leo joined Thomas on at least one trip with Crow and also helped organize a luxury fishing vacation for Justice Samuel Alito, which was paid for by political donors. Leo has said he will not comply with the subpoena.

Last fall, amid public outcry about ethics controversies, the Supreme Court adopted a code of conduct for the first time in its history. The code, however, has no enforcement mechanism.

On Wednesday, Senate Democrats attempted to pass a bill that would tighten the court’s ethics rules and create a process for fielding and investigating complaints of potential misconduct. Sen. Lindsey Graham, R-S.C., called the legislation “unconstitutional overreach” and led a group of Republican senators who blocked the bill from advancing.

Last week, Thomas acknowledged for the first time that he should have told the public about food and lodging he received from Crow on a pair of free vacations, both of which were first uncovered by ProPublica. Thomas said he “inadvertently omitted” the gifts on previous financial disclosure filings. Thomas has not reported the recent private jet trips from Crow, which many legal experts have described as a violation of the federal financial disclosure law. Thomas’ attorney has maintained that the justice did not need to report the free flights.

Do you have any tips on the Supreme Court? Justin Elliott can be reached by email at justin@propublica.org or by Signal or WhatsApp at 774-826-6240. Josh Kaplan can be reached by email at joshua.kaplan@propublica.org and by Signal or WhatsApp at 734-834-9383.

by Renee Dudley, with research by Doris Burke

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Microsoft hired Andrew Harris for his extraordinary skill in keeping hackers out of the nation’s most sensitive computer networks. In 2016, Harris was hard at work on a mystifying incident in which intruders had somehow penetrated a major U.S. tech company.

The breach troubled Harris for two reasons. First, it involved the company’s cloud — a virtual storehouse typically containing an organization’s most sensitive data. Second, the attackers had pulled it off in a way that left little trace.

He retreated to his home office to “war game” possible scenarios, stress-testing the various software products that could have been compromised.

Early on, he focused on a Microsoft application that ensured users had permission to log on to cloud-based programs, the cyber equivalent of an officer checking passports at a border. It was there, after months of research, that he found something seriously wrong.

The product, which was used by millions of people to log on to their work computers, contained a flaw that could allow attackers to masquerade as legitimate employees and rummage through victims’ “crown jewels” — national security secrets, corporate intellectual property, embarrassing personal emails — all without tripping alarms.

To Harris, who had previously spent nearly seven years working for the Defense Department, it was a security nightmare. Anyone using the software was exposed, regardless of whether they used Microsoft or another cloud provider such as Amazon. But Harris was most concerned about the federal government and the implications of his discovery for national security. He flagged the issue to his colleagues.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

They saw it differently, Harris said. The federal government was preparing to make a massive investment in cloud computing, and Microsoft wanted the business. Acknowledging this security flaw could jeopardize the company’s chances, Harris recalled one product leader telling him. The financial consequences were enormous. Not only could Microsoft lose a multibillion-dollar deal, but it could also lose the race to dominate the market for cloud computing.

Harris said he pleaded with the company for several years to address the flaw in the product, a ProPublica investigation has found. But at every turn, Microsoft dismissed his warnings, telling him they would work on a long-term alternative — leaving cloud services around the globe vulnerable to attack in the meantime.

Harris was certain someone would figure out how to exploit the weakness. He’d come up with a temporary solution, but it required customers to turn off one of Microsoft’s most convenient and popular features: the ability to access nearly every program used at work with a single logon.

He scrambled to alert some of the company’s most sensitive customers about the threat and personally oversaw the fix for the New York Police Department. Frustrated by Microsoft’s inaction, he left the company in August 2020.

Andrew Harris shared his Microsoft employee badge on his LinkedIn page when he announced his departure from the company in 2020. (Screenshot by ProPublica)

Within months, his fears became reality. U.S. officials confirmed reports that a state-sponsored team of Russian hackers had carried out SolarWinds, one of the largest cyberattacks in U.S. history. They used the flaw Harris had identified to vacuum up sensitive data from a number of federal agencies, including, ProPublica has learned, the National Nuclear Security Administration, which maintains the United States’ nuclear weapons stockpile, and the National Institutes of Health, which at the time was engaged in COVID-19 research and vaccine distribution. The Russians also used the weakness to compromise dozens of email accounts in the Treasury Department, including those of its highest-ranking officials. One federal official described the breach as “an espionage campaign designed for long-term intelligence collection.”

Harris’ account, told here for the first time and supported by interviews with former colleagues and associates as well as social media posts, upends the prevailing public understanding of the SolarWinds hack.

From the moment the hack surfaced, Microsoft insisted it was blameless. Microsoft President Brad Smith assured Congress in 2021 that “there was no vulnerability in any Microsoft product or service that was exploited” in SolarWinds.

Get in Touch

We’re still reporting on the cybersecurity industry and cyberspace regulation. If you have specific information to share about these topics, you can contact Renee Dudley by email at renee.dudley@propublica.org or on Signal at 929-317-0748.

He also said customers could have done more to protect themselves.

Harris said they were never given the chance.

“The decisions are not based on what’s best for Microsoft’s customers but on what’s best for Microsoft,” said Harris, who now works for CrowdStrike, a cybersecurity company that competes with Microsoft.

Microsoft declined to make Smith and other top officials available for interviews for this story, but it did not dispute ProPublica’s findings. Instead, the company issued a statement in response to written questions. “Protecting customers is always our highest priority,” a spokesperson said. “Our security response team takes all security issues seriously and gives every case due diligence with a thorough manual assessment, as well as cross-confirming with engineering and security partners. Our assessment of this issue received multiple reviews and was aligned with the industry consensus.”

ProPublica’s investigation comes as the Pentagon seeks to expand its use of Microsoft products — a move that has drawn scrutiny from federal lawmakers amid a series of cyberattacks on the government.

Smith is set to testify on Thursday before the House Homeland Security Committee, which is examining Microsoft’s role in a breach perpetrated last year by hackers connected to the Chinese government. Attackers exploited Microsoft security flaws to gain access to top U.S. officials’ emails. In investigating the attack, the federal Cyber Safety Review Board found that Microsoft’s “security culture was inadequate and requires an overhaul.”

Microsoft President Brad Smith testifies during a Senate Select Committee on Intelligence hearing about SolarWinds on Feb. 23, 2021. (Drew Angerer/Getty Images)

For its part, Microsoft has said that work has already begun, declaring that the company’s top priority is security “above all else.” Part of the effort involves adopting the board’s recommendations. “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security,” the company’s CEO, Satya Nadella, told employees in the wake of the board’s report, which identified a “corporate culture that deprioritized both enterprise security investments and rigorous risk management.”

ProPublica’s investigation adds new details and pivotal context about that culture, offering an unsettling look into how the world’s largest software provider handles the security of its own ubiquitous products. It also offers crucial insight into just how much the quest for profits can drive those security decisions, especially as tech behemoths push to dominate the newest — and most lucrative — frontiers, including the cloud market.

“This is part of the problem overall with the industry,” said Nick DiCola, who was one of Harris’ bosses at Microsoft and now works at Zero Networks, a network security firm. Publicly-traded tech giants “are beholden to the share price, not to doing what’s right for the customer all the time. That’s just a reality of capitalism. You’re never going to change that in a public company because at the end of the day, they want the shareholder value to go up.”

A “Cloud-First World”

Early this year, Microsoft surpassed Apple to become the world’s most valuable company, worth more than $3 trillion. That triumph was almost unimaginable a decade ago. (The two remain in close competition for the top spot.)

In 2014, the same year that Harris joined Microsoft and Nadella became the CEO, Wall Street and consumers alike viewed the company as stuck in the past, clinging to the “shrink-wrapped” software products like Windows that put it on the map in the 1990s. Microsoft’s long-stagnant share price reflected its status as an also-ran in almost every major technological breakthrough since the turn of the century, from its Bing search engine to its Nokia mobile phone division.

As the new CEO, Nadella was determined to reverse the trend and shake off the company’s fuddy-duddy reputation, so he staked Microsoft’s future on the Azure cloud computing division, which then lagged far behind Amazon. In his earliest all-staff memo, Nadella told employees they would need “to reimagine a lot of what we have done in the past for a … cloud-first world.”

Microsoft CEO Satya Nadella promotes the company’s cloud offerings at an event in San Francisco in 2014. (David Paul Morris/Bloomberg via Getty Images)

Microsoft salespeople pitched business and government customers on a “hybrid cloud” strategy, where they kept some traditional, on-premises servers (typically stored on racks in customers’ own offices) while shifting most of their computing needs to the cloud (hosted on servers in Microsoft data centers).

Security was a key selling point for the cloud. On-site servers were notoriously vulnerable, in part because organizations’ overburdened IT staff often failed to promptly install the required patches and updates. With the cloud, that crucial work was handled by dedicated employees whose job was security.

The dawn of the cloud era at Microsoft was an exciting time to work in the field of cybersecurity for someone like Harris, whose high school yearbook features a photo of him in front of a desktop computer and monitor with a mess of floppy disks beside him. One hand is on the keyboard, the other on a wired mouse. Caption: “Harris the hacker.”

Harris’ high school yearbook (Classmates.com)

As a sophomore at Pace University in New York, he wrote a white paper titled “How to Hack the Wired Equivalent Protocol,” a network security standard, and was awarded a prestigious Defense Department scholarship, which the government uses to recruit cybersecurity specialists. The National Security Agency paid for three years of his tuition, which included a master’s degree in software engineering, in exchange for a commitment to work for the government for at least that long, he said.

Early in his career, he helped lead the Defense Department’s efforts to protect individual devices. He became an expert in the niche field known as identity and access management, securing how people log in.

As the years wore on, he grew frustrated by the lumbering bureaucracy and craved the innovation of the tech industry. He decided he could make a bigger impact in the private sector, which designed much of the software the government used.

At Microsoft he was assigned to a secretive unit known as the “Ghostbusters” (as in: “Who you gonna call?”), which responded to hacks of the company’s most sensitive customers, especially the federal government. As a member of this team, Harris first investigated the puzzling attack on the tech company and remained obsessed with it, even after switching roles inside Microsoft.

Eventually, he confirmed the weakness within Active Directory Federation Services, or AD FS, a product that allowed users to sign on a single time to access nearly everything they needed. The problem, he discovered, rested in how the application used a computer language known as SAML to authenticate users as they logged in.

To understand how a SAML attack would unfold, let’s imagine a robber who wants to gain access to all of the apartment buildings owned by a landlord.

(Anuj Shrestha, special to ProPublica)

The robber finds an open window in a single apartment and climbs in, similar to how a hacker could use a phishing email to log on to a single user’s account.

(Anuj Shrestha, special to ProPublica)

Once inside, the robber roams the halls looking for the landlord’s office, where keys to all the building’s units are kept. Likewise, a hacker moves through an organization’s on-premises servers. Their first target is Microsoft’s equivalent of the landlord’s office, a directory that stores information such as usernames and passwords.

(Anuj Shrestha, special to ProPublica)

The robber, however, wants to break into all the landlord’s buildings, just as a hacker wants to breach the cloud. The robber unlocks the office safe, which contains a master key. In a cyber break-in, the safe is AD FS, the weak link that Harris identified.

(Anuj Shrestha, special to ProPublica)

The robber makes a copy of the master key, which provides access to all of the landlord’s buildings and apartments. In a SAML attack, a hacker extracts the private key from the AD FS server and forges “tokens” that allow the intruder to masquerade as a user with the highest levels of access.

(Anuj Shrestha, special to ProPublica)

Now the robber can access any apartment in any building with little trace. And because the landlord’s keys are still in the office, no one suspects anything is amiss. Likewise, in a SAML attack, the hacker goes unnoticed because their sign-in information looks legitimate.

This is what makes a SAML attack unique. Typically, hackers leave what cybersecurity specialists call a “noisy” digital trail. Network administrators monitoring the so-called “audit logs” might see unknown or foreign IP addresses attempting to gain access to their cloud services. But SAML attacks are much harder to detect. The forged token is the equivalent of a robber using a copied master key. There was little trail to track, just the activities of what appear to be legitimate users.

Harris and a colleague who consulted for the Department of Defense spent hours in front of both real and virtual whiteboards as they mapped out how such an attack would work, the colleague told ProPublica. The “token theft” risk, as Harris referred to it, became a regular topic of discussion for them.

A Clash With “Won’t Fix” Culture

Before long, Harris alerted his supervisors about his SAML finding. Nick DiCola, his boss at the time, told ProPublica he referred Harris to the Microsoft Security Response Center, which fields reports of security vulnerabilities and determines which need to be addressed. Given its central role in improving Microsoft product security, the team once considered itself the “conscience of the company,” urging colleagues to improve security without regard to profit. In a meeting room, someone hung a framed photo of Winston “the Wolf,” the charismatic fixer in Quentin Tarantino’s movie “Pulp Fiction” who is summoned to clean up the aftermath of bloody hits.

Members of the team were not always popular within the company. Plugging security holes is a cost center, and making new products is a profit center, former employees told ProPublica. In 2002, the company’s founder, Bill Gates, tried to settle the issue, sending a memo that turned out to be eerily prescient. “Flaws in a single Microsoft product, service or policy not only affect the quality of our platform and services overall, but also our customers’ view of us as a company,” Gates wrote, adding: “So now, when we face a choice between adding features and resolving security issues, we need to choose security.”

At first, Gates’ memo was transformational and the company’s product divisions were more responsive to the center’s concerns. But over time, the center’s influence waned.

Its members were stuck between cultural forces. Security researchers — often characterized as having outsized egos — believed their findings should be immediately addressed, underestimating the business challenges of developing fixes quickly, former MSRC employees told ProPublica.

Product managers had little motivation to act fast, if at all, since compensation was tied to the release of new, revenue-generating products and features. That attitude was particularly pronounced in Azure product groups, former MSRC members said, because they were under pressure from Nadella to catch up to Amazon.

“Azure was the Wild West, just this constant race for features and functionality,” said Nate Warfield, who worked in the MSRC for four years beginning in 2016. “You will get a promotion because you released the next new shiny thing in Azure. You are not going to get a promotion because you fixed a bunch of security bugs.”

Former employees told ProPublica that the center fielded hundreds or even thousands of reports a month, pushing the perennially understaffed group to its limits. The magazine Popular Science noted that volume as one of the reasons why working in the MSRC was one of the 10 “worst jobs in science,” between whale feces researchers and elephant vasectomists.

“They’re trained, because they’re so resource constrained, to think of these cases in terms of: ‘How can I get to ‘won’t fix,’” said Dustin Childs, who worked in the MSRC in the years leading up to Harris’ saga. Staff would often punt on fixes by telling researchers they would be handled in “v-next,” the next product version, he said. Those launches, however, could be years away, leaving customers vulnerable in the interim, he said.

The center also routinely rejected researchers’ reports of weaknesses by saying they didn’t cross what its staff called a “security boundary.” But when Harris discovered the SAML flaw, it was a term with no formal definition, former employees said.

(Jaap Arriens / Sipa USA via AP Images)

By 2017, the lack of clarity had become the “butt of jokes,” Warfield said. Several prominent security researchers who regularly interacted with the MSRC made T-shirts and stickers that said “____ [fill in the blank] is not a security boundary.”

“Any time Microsoft didn’t want to fix something, they’d just say, ‘That’s not a security boundary, we’re not going to fix it,’” Warfield recalled.

Unaware of the inauspicious climate, Harris met virtually with MSRC representatives and sketched out how a hacker could jump from an on-premises server to the cloud without being detected. The MSRC declined to address the problem. Its staff argued that hackers attempting to exploit the SAML flaw would first have to gain access to an on-premises server. As they saw it, Harris said, that was the security boundary — not the subsequent hop to the cloud.

Business Over Security

“WTF,” Harris recalled thinking when he got the news. “This makes no sense.”

Microsoft had told customers the cloud was the safest place to put their most precious data. His discovery proved that, for the millions of users whose systems included AD FS, their cloud was only as secure as their on-premises servers. In other words, all the buildings owned by the landlord are only as secure as the most careless tenant who forgot to lock their window.

Harris pushed back, but he said the MSRC held firm.

Harris had a reputation for going outside the chain of command to air his concerns, and he took his case to the team managing the products that verified user identities.

He had some clout, his former colleagues said. He had already established himself as a known expert in the field, had pioneered a cybersecurity threat detection method and later was listed as the named inventor on a Microsoft patent. Harris said he “went kind of crazy” and fired off an email to product manager Mark Morowczynski and director Alex Simons requesting a meeting.

He understood that developing a long-term fix would take time, but he had an interim solution that could eliminate the threat. One of the main practical functions of AD FS was to allow users to access both on-premises servers and a variety of cloud-based services after entering credentials only once, a Microsoft feature known as “seamless” single sign-on. Harris proposed that Microsoft tell its customers to turn off that function so the SAML weakness would no longer matter.

According to Harris, Morowczynski quickly jumped on a videoconference and said he had discussed the concerns with Simons.

“Everyone violently agreed with me that this is a huge issue,” Harris said. “Everyone violently disagreed with me that we should move quickly to fix it.”

Morowczynski, Harris said, had two primary objections.

First, a public acknowledgement of the SAML flaw would alert adversaries who could then exploit it. Harris waved off the concern, believing it was a risk worth taking so that customers wouldn’t be ignorant to the threat. Plus, he believed Microsoft could warn customers without betraying any specifics that could be co-opted by hackers.

According to Harris, Morowczynski’s second objection revolved around the business fallout for Microsoft. Harris said Morowczynski told him that his proposed fix could alienate one of Microsoft’s largest and most important customers: the federal government, which used AD FS. Disabling seamless SSO would have widespread and unique consequences for government employees, who relied on physical “smart cards” to log onto their devices. Required by federal rules, the cards generated random passwords each time employees signed on. Due to the configuration of the underlying technology, though, removing seamless SSO would mean users could not access the cloud through their smart cards. To access services or data on the cloud, they would have to sign in a second time and would not be able to use the mandated smart cards.

Harris said Morowczynski rejected his idea, saying it wasn’t a viable option.

Morowczynski told Harris that his approach could also undermine the company’s chances of getting one of the largest government computing contracts in U.S. history, which would be formally announced the next year. Internally, Nadella had made clear that Microsoft needed a piece of this multibillion-dollar deal with the Pentagon if it wanted to have a future in selling cloud services, Harris and other former employees said.

Killing the Competition

By Harris’ account, the team was also concerned about the potential business impact on the products sold by Microsoft to sign into the cloud. At the time, Microsoft was in a fierce rivalry with a company called Okta.

Microsoft customers had been sold on seamless SSO, which was one of the competitive advantages — or, in Microsoft parlance, “kill points” — that the company then had over Okta, whose users had to sign on twice, Harris said.

Harris’ proposed fix would undermine the company’s strategy to marginalize Okta and would “add friction” to the user experience, whereas the “No. 1 priority was to remove friction,” Harris recalled Morowczynski telling him. Moreover, it would have cascading consequences for the cloud business because the sale of identity products often led to demand for other cloud services.

“That little speed bump of you authenticating twice was unacceptable by Microsoft’s standards,” Harris said. He recalled Morowczynski telling him that the product group’s call “was a business decision, not a technical one.”

“What they were telling me was counterintuitive to everything I’d heard at Microsoft about ‘customer first,’” Harris said. “Now they’re telling me it’s not ‘customer first,’ it’s actually ‘business first.’”

DiCola, Harris’ then-supervisor, told ProPublica the race to dominate the market for new and high-growth areas like the cloud drove the decisions of Microsoft’s product teams. “That is always like, ‘Do whatever it frickin’ takes to win because you have to win.’ Because if you don’t win, it’s much harder to win it back in the future. Customers tend to buy that product forever.”

According to Harris, Morowczynski said his team had “on the road map” a product that could replace AD FS altogether. But it was unclear when it would be available to customers.

In the months that followed, Harris vented to his colleagues about the product group’s decision. ProPublica talked to three people who worked with Harris at the time and recalled these conversations. All of them spoke on the condition of anonymity because they feared professional repercussions. The three said Harris was enraged and frustrated over what he described to them as the product group’s unwillingness to address the weakness.

Neither Morowczynski nor Simons returned calls seeking comment, and Microsoft declined to make them available for interviews. The company did not dispute the details of Harris’ account. In its statement, Microsoft said it weighs a number of factors when it evaluates potential threats. “We prioritize our security response work by considering potential customer disruption, exploitability, and available mitigations,” the spokesperson said. “We continue to listen to the security research community and evolve our approach to ensure we are meeting customer expectations and protecting them from emerging threats.”

Another Major Warning

Following the conversation with Morowczynski, Harris wrote a reminder to himself on the whiteboard in his home office: “SAML follow-up.” He wanted to keep the pressure on the product team.

Soon after, the Massachusetts- and Tel Aviv-based cybersecurity firm CyberArk published a blog post describing the flaw, which it dubbed “Golden SAML,” along with a proof of concept, essentially a road map that showed how hackers could exploit the weakness.

Years later, in his written testimony for the Senate Intelligence Committee, Microsoft’s Brad Smith said this was the moment the company learned of the issue. “The Golden SAML theory became known to cybersecurity professionals at Microsoft and across the U.S. government and the tech sector at precisely the same time, when it was published in a public paper in 2017,” Smith wrote.

Lavi Lazarovitz of CyberArk said the firm mentioned the weakness — before the post was published — in a private WhatsApp chat of about 10 security researchers from various companies, a forum members used to compare notes on emerging threats. When they raised the discovery to the group, which included at least one researcher from Microsoft, the other members were dismissive, Lazarovitz said.

“Many in the security research community — I don’t want to say mocked — but asked, ‘Well, what’s the big deal?’” Lazarovitz said.

The CyberArk headquarters in Newton, Massachusetts (Sipa via AP Images)

Nevertheless, CyberArk believed it was worth taking seriously, given that AD FS represented the gateway to users’ most sensitive information, including email. “Threat actors operate in between the cracks,” Lazarovitz said. “So obviously, we understood the feedback that we got, but we still believed that this technique will be eventually leveled by threat actors.”

The Israel-based team also reached out to contacts at Microsoft’s Israeli headquarters and were met with a response similar to the one they got in the WhatsApp group, Lazarovitz said.

The published report was CyberArk’s way of warning the public about the threat. Disclosing the weakness also had a business benefit for the company. In the blog post, it pitched its own security product, which it said “will be extremely beneficial in blocking attackers from getting their hands on important assets like the token-signing certificate in the first place.”

The report initially received little attention. Harris, however, seized on it. He said he alerted Morowczynski and Simons from the product group as well as the MSRC. The situation was more urgent than before, Harris argued to them, because CyberArk included the proof of concept that could be used by hackers to carry out a real attack. For Harris, it harkened back to Morowczynski’s worry that flagging the weakness could give hackers an advantage.

“I was more energetic than ever to have us actually finally figure out what we’re going to do about this,” Harris said.

But the MSRC reiterated its “security boundary” stance, while Morowczynski reaffirmed the product group’s earlier decision, Harris said.

Harris said he then returned to his supervisors, including Hayden Hainsworth and Bharat Shah, who, as corporate vice president of the Azure cloud security division, also oversaw the MSRC. “I said, ‘Can you guys please listen to me,’” Harris recalled. “‘This is probably the most important thing I’ve ever done in my career.’”

Harris said they were unmoved and told him to take the problem back to the MSRC.

Microsoft did not publicly comment on the CyberArk blog post at the time. Years later, in written responses to Congress, Smith said the company’s security researchers reviewed the information but decided to focus on other priorities. Neither Hainsworth nor Shah returned calls seeking comment.

Defusing a Ticking Bomb

Harris said he was deeply frustrated. On a personal level, his ego was bruised. Identifying major weaknesses is considered an achievement for cybersecurity professionals, and, despite his internal discovery, CyberArk had claimed Golden SAML.

More broadly, he said he was more worried than ever, believing the weakness was a ticking bomb. “It’s out in the open now,” he said.

Publicly, Microsoft continued to promote the safety of its products, even boasting of its relationship with the federal government in sales pitches. “To protect your organization, Azure embeds security, privacy, and compliance into its development methodology,” the company said in late 2017, “and has been recognized as the most trusted cloud for U.S. government institutions.”

Attendees walk through the exhibition floor during the Microsoft Developers Build Conference in Seattle in 2017. (David Ryder/Bloomberg via Getty Images)

Internally, Harris complained to colleagues that customers were being left vulnerable.

“He was definitely having issues” with the product team, said Harris’ former Microsoft colleague who consulted for the Defense Department. “He vented that it was a problem that they just wanted to ignore.”

Harris typically pivoted from venting to discussing how to protect customers, the former colleague said. “I asked him to show me what I’m going to have to do to make sure the customers were aware and could take corrective action to mitigate the risk,” he said.

Harris also took his message to LinkedIn, where he posted a discreet warning and an offer.

“I hope all my friends and followers on here realize by now the security relationship” involved in authenticating users in AD FS, he wrote in 2019. “If not, reach out and let’s fix that!”

In 2019, Harris posted a discreet warning and an offer on LinkedIn. (Screenshot by ProPublica)

Separately, he realized he could help customers with whom he had existing relationships, including the NYPD, the nation’s largest police force.

“Knowing this exploit is actually possible, why would I not architect around it, especially for my critical customers?” Harris said.

On a visit to the NYPD, Harris told a top IT official, Matthew Fraser, about the AD FS weakness and recommended disabling seamless SSO. Fraser was in disbelief at the severity of the issue, Harris recalled, and he agreed to disable seamless SSO.

In an interview, Fraser confirmed the meeting.

“This was identified as one of those areas that was prime, ripe,” Fraser said of the SAML weakness. “From there, we figured out what’s the best path to insulate and secure.”

More Troubling Revelations

It was over beers at a conference in Orlando in 2018 that Harris learned the weakness was even worse than he’d initially realized. A colleague sketched out on a napkin how hackers could also bypass a common security feature called multifactor authentication, which requires users to perform one or more additional steps to verify their identity, such as entering a code sent via text message.

They realized that, no matter how many additional security steps a company puts in place, a hacker with a forged token can bypass them all. When they brought the new information to the MSRC, “it was a nonstarter,” Harris said. While the center had published a formal definition of “security boundary” by that point, Harris’ issues still didn’t meet it.

Nadella delivers the keynote address at a 2018 conference in Seattle for software developers. (Elaine Thompson/AP)

By March 2019, concerns over Golden SAML were spilling out into the wider tech world. That month, at a conference in Germany, two researchers from the cybersecurity company Mandiant delivered a presentation demonstrating how hackers could infiltrate AD FS to gain access to organizations’ cloud accounts and applications. They also released the tools they used to do so.

Mandiant said it notified Microsoft before the presentation, making it the second time in roughly 16 months that an outside firm had flagged the SAML issue to the company.

In August 2020, Harris left Microsoft to work for CrowdStrike. In his exit interview with Shah, Harris said he raised the SAML weakness one last time. Shah listened but offered no feedback, he said.

“There is no inspector general-type thing” within Microsoft, Harris said. “If something egregious is happening, where the hell do you go? There’s no place to go.”

SolarWinds Breaks

Four months later, news of the SolarWinds attack broke. Federal officials soon announced that beginning in 2019 Russian hackers had breached and exploited the network management software offered by a Texas-based company called SolarWinds, which had the misfortune of lending its name to the attack. The hackers covertly inserted malware into the firm’s software updates, gaining “backdoor” access to the networks of companies and government agencies that installed them. The ongoing access allowed hackers to take advantage of “post-exploit” vulnerabilities, including Golden SAML, to steal sensitive data and emails from the cloud.

Despite the name, nearly a third of victims of the attack never used SolarWinds software at all, Brandon Wales, then acting director of the federal Cybersecurity and Infrastructure Security Agency, said in the aftermath. In March 2021, Wales told a Senate panel that hackers were able to “gain broad access to data stores that they wanted, largely in Microsoft Office 365 Cloud … and it was all because they compromised those systems that manage trust and identity on networks.”

Microsoft itself was also breached.

In the immediate aftermath of the attack, Microsoft advised customers of Microsoft 365 to disable seamless SSO in AD FS and similar products — the solution that Harris proposed three years earlier.

As the world dealt with the consequences, Harris took his long simmering frustration public in a series of posts on social media and on his personal blog. Challenging Brad Smith by name, and criticizing the MSRC’s decisions — which he referred to as “utter BS” — Harris lambasted Microsoft for failing to publicly warn customers about Golden SAML.

Microsoft “was not transparent about these risks, forced customers to use ADFS knowing these risks, and put many customers and especially US Gov’t in a bad place,” Harris wrote on LinkedIn in December 2020. A long-term fix was “never a priority” for the company, he wrote. “Customers are boned and sadly it’s been that way for years (which again, sickens me),” Harris said in the post.

In the months and years following the SolarWinds attack, Microsoft took a number of actions to mitigate the SAML risk. One of them was a way to efficiently detect fallout from such a hack. The advancement, however, was available only as part of a paid add-on product known as Sentinel.

The lack of such a detection, the company said in a blog post, had been a “blind spot.”

“Microsoft Is Back on Top”

In early 2021, the Senate Select Committee on Intelligence called Brad Smith to testify about SolarWinds.

Although Microsoft’s product had played a central role in the attack, Smith seemed unflappable, his easy and conversational tone a reflection of the relationships he had spent decades building on Capitol Hill. Without referencing notes or reading from a script, as some of his counterparts did, he confidently deflected questions about Microsoft’s role. Laying the responsibility with the government, he said that in the lead-up to the attack, the authentication flaw “was not prioritized by the intelligence community as a risk, nor was it flagged by civilian agencies or other entities in the security community as a risk that should be elevated” over other cybersecurity priorities.

Smith also downplayed the significance of the Golden SAML weakness, saying it was used in just 15% of the 60 cases that Microsoft had identified by that point. At the same time, he acknowledged that, “without question, these are not the only victims who had data observed or taken.”

When Sen. Marco Rubio of Florida pointedly asked him what Microsoft had done to address Golden SAML in the years before the attack, Smith responded by listing a handful of steps that customers could have taken to protect themselves. His suggestions included purchasing an antivirus product like Microsoft Defender and securing devices with another Microsoft product called Intune.

“The reality is any organization that did all five of those things, if it was breached, it in all likelihood suffered almost no damage,” Smith said.

Neither Rubio nor any other senator pressed further.

Ultimately, Microsoft won a piece of the Defense Department’s multibillion-dollar cloud business, sharing it with Amazon, Google and Oracle.

Since December 2020, when the SolarWinds attack was made public, Microsoft’s stock has soared 106%, largely on the runaway success of Azure and artificial intelligence products like ChatGPT, where the company is the largest investor. “Microsoft Is Back on Top,” proclaimed Fortune, which featured Nadella on the cover of its most recent issue.

In September 2021, just 10 months after the discovery of SolarWinds, the paperback edition of Smith’s book, “Tools and Weapons,” was published. In it, Smith praised Microsoft’s response to the attack. The MSRC, Smith wrote, “quickly activated its incident response plan” and the company at large “mobilized more than 500 employees to work full time on every aspect of the attack.”

In the new edition, Smith also reflected on his congressional testimony on SolarWinds. The hearings, he wrote, “examined not only what had happened but also what steps needed to be taken to prevent such attacks in the future.” He didn’t mention it in the book, but that certainly would include the long-term alternative that Morowczynski first promised to Harris in 2017. The company began offering it in 2022.

Development by Lucas Waldron.

by Duaa Eldeib

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

The Senate on Tuesday passed legislation that, for the first time, expressly permits states to spend millions of federal dollars on stillbirth prevention.

The Maternal and Child Health Stillbirth Prevention Act, which passed the House in mid-May, now goes to President Joe Biden, who is expected to sign the measure into law.

ProPublica has spent the past two years reporting on the crisis around stillbirth, the death of an expected child at 20 weeks of pregnancy or more. Every year in the U.S., more than 20,000 pregnancies end in stillbirth. Research shows as many as 1 in 4 stillbirths may be preventable.

The bipartisan bill, which does not allocate any new money, amends the Social Security Act to add stillbirth prevention and research to the programs that can use existing Title V funds dedicated to improving the health of mothers and children.

“This bill is the first step to preventing stillbirths across America, and I will keep pushing to deliver the federal resources needed to bring down the shockingly high rate of stillbirths and maternal mortality in the United States,” said Sen. Jeff Merkley, D-Ore., who credited ProPublica for keeping a spotlight on the stillbirth crisis.

Merkley introduced the bill with Sen. Bill Cassidy, R-La., and U.S. Reps. Ashley Hinson, R-Iowa, and Alma Adams, D-N.C., introduced the measure in the House.

For decades, Adams said, Congress has underinvested in addressing stillbirths, despite having tremendous power to direct money and resources toward research, awareness and effective interventions.

“This does not have to be a silent crisis anymore,” she said, adding that several thousand lives can be saved every year.

“I’m very thankful to ProPublica,” Adams said. “They’ve raised this issue to the forefront of U.S. politics.”

The U.S. has long lagged behind other wealthy countries in reducing stillbirths, but Adams said she hopes that will change.

The bill, which was first introduced in 2022 but never voted on, was reintroduced last July. The Senate passed the measure unanimously, but it was sent back to the Senate because of minor changes made in the House.

Emily Price, CEO of the Iowa-based nonprofit Healthy Birth Day, which has championed the measure, said when Title V was written in the 1930s, stillbirth was left out because of the outdated belief that stillbirths just happen. The bill’s passage, she said, means stillbirth “is finally being recognized for the crisis that it is in America.”

“Now we know better, and we must do better,” she said. “The impact will affect families immediately and for generations to come.”

She said that after ProPublica’s stillbirth series was published, more people opened up about their experiences, and members of Congress and their staffs began sharing how stillbirth had affected their own families and friends.

“It was in these moments that we saw change coming,” Price said.

Fewer than 20 state health departments use money allocated under Title V Maternal and Child Health block grants for stillbirth prevention, Price said.

The new legislation includes examples of services that states can implement, many of which have been adopted in other countries. Programs include tracking fetal movement, improving the timing of birth when risk factors are present, encouraging safe sleep positions during pregnancy, supporting pregnant patients to stop smoking and monitoring for signs that the fetus is not growing as expected.

Without a federal law in place, states have had to look for local solutions. Minnesota mother Amanda Duffy, who was at the center of a November 2022 ProPublica story, enlisted the help of Minnesota lawmakers, including newly elected state Sen. Susan Pha, who was pregnant. Pha tested Healthy Birth Day’s Count the Kicks app, which encourages expectant parents to track their baby’s movement in the womb, during her third trimester. She was convinced.

“This needs to be in the hands of every single expectant mom who is pregnant because it is such a powerful tool,” Pha said.

She was lead author of the Minnesota bill to establish a stillbirth prevention pilot program that incorporates Count the Kicks. The Minnesota Legislature passed the bill last month.

North Carolina doesn’t have a state stillbirth prevention law in place, which is part of the reason Tomeka James Isaac had been advocating for the Maternal and Child Health Stillbirth Prevention Act.

In 2018, the North Carolina mother was rushed into emergency surgery. She delivered her stillborn son, Jace, and then nearly died herself. Isaac, a Black woman, is now executive director of the nonprofit Jace’s Journey, which addresses disparities in maternal and infant health. Black women are more than twice as likely to have a stillbirth than white women, and they face an increased risk of dying during or soon after pregnancy.

Isaac traveled to Washington, D.C., last month with Price and other stillbirth families to advocate for the bill’s passage and a second bipartisan stillbirth bill pending in Congress. That bill, the Stillbirth Health Improvement and Education (SHINE) for Autumn Act, proposes $45 million over the next five years for improving data collection, stillbirth research, awareness and education, as well as supporting training for fetal autopsies.

Jessica Brady Reader, a former congressional aide, is now pushing for SHINE. After Reader gave birth to her stillborn daughter, Francesca, in 2021, she and her husband parked in front of the funeral home to read their daughter a nightly bedtime story until her body was cremated and they could bring her remains home.

“I view this as the beginning, not the end,” she said. “Passing SHINE is a necessary next step. We can’t stop.”

by Ken Schwencke

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

We updated our “Supreme Connections” database on Wednesday with new entries from recently released financial disclosures from Supreme Court justices, as well as five filings from 2003 to 2007 we had previously been missing.

“Supreme Connections” is our database that makes it easy for anyone to browse justices’ financial disclosures and to search for connections to people and companies mentioned within them.

This update includes data from eight disclosures made public last Friday, covering the 2023 calendar year. It does not include data for Justice Samuel Alito, who received a 90-day extension.

The latest update includes two 2019 vacations retroactively added by Justice Clarence Thomas, which were paid for by billionaire Harlan Crow and which the justice had previously failed to disclose. ProPublica was the first to reveal those and an array of other significant gifts from several billionaires. Thomas previously argued he did not need to disclose such gifts.

We have also added information from a 2003 filing from Alito and information from Chief Justice John Roberts’ 2004-07 filings that were previously obtained by JudicialWatch and archived by the Internet Archive. While federal ethics law requires judges to file these disclosures each year, the law requires most of them to be destroyed after six years, making many disclosures from earlier years hard to find.

In total, the update adds $50,000 worth of gifts disclosed (including concert tickets given to Justice Ketanji Brown Jackson by Beyoncé herself), 18 new organizations and individuals, and more than 200 new connections, such as book deals, trips and reimbursements.

Browse the database to learn more.

Do you have any tips on the Supreme Court? Josh Kaplan can be reached by email at joshua.kaplan@propublica.org and by Signal or WhatsApp at 734-834-9383. Justin Elliott can be reached by email at justin@propublica.org or by Signal or WhatsApp at 774-826-6240.

by Justin Elliott

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

A few hours after we published a story on the luxury travel a billionaire provided to Supreme Court Justice Clarence Thomas, the email arrived in my inbox.

A reader had tapped out a single sentence on their iPhone and hit send: We should look, it said, at a relative Thomas had taken in and raised as a son. The reader informed me that Harlan Crow, the same politically connected billionaire who had bankrolled the justice’s travels around the globe, had also paid private school tuition for the relative.

My colleagues and I chased down the tip; a key break came when we found direct evidence of the billionaire’s tuition payments in some bankruptcy filings for one of the private schools in question. As we reported in the resulting story a few weeks later, the billionaire had paid roughly $100,000 for private school tuition, essentially a gift of cash to a sitting Supreme Court justice.

Crow’s office told us that he “has long been passionate about the importance of quality education and giving back to those less fortunate.” Thomas didn’t respond to questions for the story. On Friday, the justice acknowledged for the first time in a new financial disclosure filing that he should have publicly reported two free vacations he received from Crow.

At ProPublica, we often discuss the concept of the “maximum story.” It comes up when we’re deciding whether it’s worth spending a chunk of time reporting on a given topic. In gambler’s terms, it translates to what’s the biggest potential payoff of making this bet? What’s the best story, the one most vital to the public, that we might land?

It’s a useful idea, but the truth is the maximum story is often one we can’t even imagine. That was the case with the private school tuition tip. My co-workers and I had spent the previous four months piecing together the luxury travel provided to Thomas, but we had not dreamed that a billionaire was also secretly paying basic living expenses for a justice.

And we never would have thought to look if not for the reader who made the decision to write in with that tip. I’ve been a reporter here at ProPublica for more than 12 years covering politics and business, and every major story I’ve worked on has been propelled forward by tips.

I spent years reporting on how Intuit, the maker of TurboTax, has worked against making tax preparation easier and less costly. When I wrote about misleading marketing tactics by Intuit that cost Americans tax filers billions of dollars, I relied on tips from employees at all levels of the company. Sometimes we heard from executives who attended strategy meetings; other times we heard from customer service reps who were unsettled by what they were being asked to do.

After we published, we heard from hundreds of readers who’d experienced deceptive tactics, and we wrote about that, too. In the end, those stories directly led to a legal settlement that delivered $141 million back to consumers.

Many of my sources need to be anonymous, so I’m somewhat limited in what I can tell you about them. In the past, they’ve included company insiders like the Intuit employees or whistleblowers who have seen something that troubled them. But I’m constantly surprised by what I think of as the hydraulics of information: something heard in a restaurant, seen on the street or mentioned by a relative. Those, too, are often important leads for our reporting.

The team behind the award-winning Supreme Court series: from left, Brett Murphy, Alex Mierjeski, Justin Elliott, Kirsten Berg and Joshua Kaplan (Sarahbeth Maney/ProPublica)

Going from a tip or rumor to a confirmed story can take weeks or months of reporting, of course. That’s especially true because I focus on the rich and powerful: people, companies and organizations that use money and influence to shield themselves from scrutiny. My ability to home in on those important stories relies on hearing from people like you.

Right now I’m reporting on the election. There’s no shortage of political coverage, but I’m still convinced there are important stories about wrongdoing that haven’t been told yet. I’m interested in the world of Donald Trump — his campaign, businesses and the people around him — as well as the broader 2024 political scene. Tips about other candidates, Democrats and Republicans, are also welcome.

I’m also always looking for under-covered stories about business and politics more broadly, no matter the specific subject.

If you know something you think I should know — a rumor, an observation, something you’ve noticed that’s unusual or concerning — please get in touch. Even if it seems small or you heard it second hand, what you know may be hugely important.

How to Reach Me

My email is justin@propublica.org. You can call or text me at 774-826-6240. If you use the secure messaging apps Signal or WhatsApp, I’m also at that number.

My Mailing Address

Justin Elliott ProPublica 155 Ave. of the Americas 13th Floor New York, NY 10013

Here’s What to Expect if You Reach Out

I’ll read whatever you send. I check my texts and email often. You can also leave a voicemail or even send a physical letter.

Many of my stories rely on people who need to be anonymous, and I take privacy very seriously.

If you have an idea but you think it’s a better fit for another reporter, you can find instructions for how to share information with us securely on our general tips page.

by Stephannie Stokes, WABE

This article was produced for ProPublica’s Local Reporting Network in partnership with WABE. Sign up for Dispatches to get stories like this one as soon as they are published.

Malik Johnson thought he was doing well after he turned 21 and left foster care, working two jobs to afford his apartment south of Atlanta.

But last fall, everything started to fall apart: His car transmission failed, so he couldn’t reach his second job. He fell behind on rent.

He didn’t know about a federal housing program that could have reduced his housing costs. It’s open to foster youth in all states as long as local government agencies put in an application for the funding. But in Georgia, they didn’t make that request for Johnson — or for almost anyone else.

Instead, at 23, he was on his own. As he faced his mounting bills, the stress got to be overwhelming.

“I was to the point where I was so behind on everything, I just almost stopped caring,” Johnson said.

In Georgia’s foster care system, about 500 young people become adults each year and, sometime between age 18 and 21, they’ll have to make it on their own. Without the safety net the foster care system provides, they’re especially vulnerable to becoming homeless.

That risk is why, in 2019, the U.S. Department of Housing and Urban Development created the Foster Youth to Independence program, which offers between three and five years of rental assistance to young adults who have moved on from foster care. The program is the only long-term federal housing assistance targeted at former foster youth as they navigate adulthood, and advocates hoped it would help prevent situations like Johnson’s from ever happening.

But there’s a catch: The money comes not directly through the federal government, but through the states, which have to apply for and coordinate the funding. WABE and ProPublica found Georgia has barely done that.

Through the program, each local housing authority can request up to 25 FYI vouchers each year. In Georgia, where 20 housing authorities are eligible, that means as many as 500 vouchers could be available, bringing in as much as $5 million in rent money from the federal government each year.

According to HUD’s latest data from last fall, housing authorities in Georgia have received only eight FYI vouchers total since the program began. By contrast, a third of states have each received at least 75 of these vouchers in the program’s first several years. Texas, Florida and Washington have received more than 400 each; California has upwards of 800, helping hundreds of young people afford stable housing. Only five states, all significantly smaller than Georgia, had requested fewer vouchers.

The failure to tap federal vouchers for foster youth in Georgia is a symptom of a child welfare system that has paid little attention to the housing needs of families and children, WABE and ProPublica have found. Previous reporting showed how the state Division of Family and Children Services had put few of its resources toward housing assistance for families in recent years, even as it cited “inadequate housing” among its reasons for removing 20% of children from their parents.

In the case of the FYI vouchers, the U.S. Department of Health and Human Services has instructed state welfare agencies to work with local housing authorities to ensure the program is used, and in states that have received the most vouchers, child welfare agencies have actively promoted the program and sometimes hired new staff.

But in Georgia, staffers at roughly half of the state’s eligible housing authorities said they hadn’t heard from the state agency about the vouchers in the program’s first five years. A couple of housing authorities said they struggled to get in touch with DFCS to complete the application, while others said they were not eligible to apply because the agency had not helped them to use up other housing funds they needed to distribute before they could tap the program.

DFCS spokesperson Ellen Brown said the staff overseeing services for older foster youth had recently changed and she couldn’t speak to what had happened previously. But she said the agency is now working to strengthen partnerships with housing authorities — efforts that have taken place as WABE and ProPublica started reporting on the issue in recent months and after a local volunteer began pushing the state to expand its use of the FYI program.

Brown also said DFCS staff meet regularly with young people before they exit foster care to “discuss their future plans,” which includes figuring out their housing. “Our team works tirelessly to help them plan and prepare for a safe, stable and successful transition out of care and into adulthood,” she said.

Still, Ruth White, who directs the National Center for Housing and Child Welfare and was central to getting the federal program created, questioned why DFCS wasn’t more aggressive in bringing the vouchers to the state.

“Imagine being an entity that goes in and removes a kid from their house,” White said, “and then not being the agency that’s chomping at the bit to make sure you get a housing voucher for that young person.”

Study after study has shown the high risk of homelessness among young adults who age out of foster care. A 2021 national survey of 21-year-olds who had been in foster care across the country showed that a little more than a quarter of them had been homeless during the previous two years. The same survey also showed similar numbers in Georgia.

For years, child welfare advocates and former foster youth pushed Congress to address this housing crisis.

“We have the numbers, and we have the data,” said Lisa Dickson of the foster youth alumni organization ACTION Ohio in her 2018 testimony to Congress. “What our nation needs is a sense of urgency about this problem.”

HUD already had its Family Unification Program, which provides housing funds to families and youth who’ve been affected by the foster care system. But HUD found that, in the competition for those limited resources, young people were losing out: They received just 5% of those vouchers in 2019, with the rest going to families.

So HUD created the Foster Youth to Independence program, earmarking some vouchers exclusively for young people. As with any Section 8 housing voucher, young people contribute a third of their income toward rent; the federal government covers the rest.

But unlike other voucher programs, FYI requires significant buy-in from child welfare agencies, which must identify eligible young adults and also offer them other support, like job training and financial counseling. That’s why housing authorities and child welfare agencies have to work together to take advantage of the program.

That didn’t happen in Georgia. In Cobb County, northwest of Atlanta, the chief operations officer of the Marietta Housing Authority tried to pursue vouchers in 2020. Mark Wright reached out to the local DCFS director, but he didn’t get the signed agreement from the agency that the program requires. After that, Wright said, “I kind of felt like we were not going to get the kind of buy-in from other agencies to make it successful.” He gave up.

Housing authorities in Atlanta and neighboring DeKalb County already had partnerships with DFCS because they offered the Family Unification Program. But they still had a hard time accessing the FYI funding. In recent years, they said, DFCS hadn’t identified enough young adults or families for the Family Unification Program, and this prevented them from qualifying for the FYI vouchers under HUD’s rules.

In Texas, by contrast, the child welfare agency took the lead in making sure the vouchers reached young people. The Texas Department of Family and Protective Services hired Jim Currier as housing specialist. He, in turn, designated liaisons in each of the child welfare system’s regions, trained them in the rules of the program and incorporated information about the vouchers in the manuals for foster youth aging out of care. The child welfare agency now has 40 partnerships, and DFPS initiated 38 of them.

Currier said vouchers have transformed the lives of some of the young people they’ve gone to. “They now have a safe, permanent home; they can begin to work on their well-being; they can work on their education,” he said.

Recently, in Georgia, DFCS and housing authorities began talking about how to serve more of those former foster youth — thanks in part to the work of one persistent volunteer.

Anne Carelli got to know teenagers in foster care when she volunteered at a group home in Atlanta. As they aged out of the system, she saw some of those teenagers end up homeless. So when she learned about the FYI vouchers a few months ago, she couldn’t believe Georgia wasn’t using them.

“To have housing vouchers for youth aging out of care — that is an incredible opportunity for all of us to come together and figure this out,” said Carelli, who has founded a nonprofit called Up3 to help connect young adults with the resources they need.

Carelli said she has sent more than 60 emails to housing authorities, public officials and DFCS to kickstart meetings about getting vouchers to young people she knows who qualify.

“I was to the point where I was so behind on everything, I just almost stopped caring,” Johnson said about his financial problems. (Matthew Pearson/WABE)

She’s hoping one of them will be Johnson, who she met through the group home. He’s still spending nearly four hours every day on buses and trains to get to work. The assistance would help him save for another car.

Johnson knows the value of a little outside support. Last fall, Carelli loaned him the money that allowed him to make up his rent until his income was stable again. As much as he’s tried to be responsible for himself — keeping his apartment vacuumed and clear of clutter, earning an employee of the month plaque from his job — he faced a crisis he couldn’t handle on his own.

“But I had help,” Johnson said. “And that was the best part about it too — being able to receive help when you need it.”

by Connor Goodwin

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Last week, President Joe Biden signed an executive order to curb immigration, effectively blocking most asylum claims when border crossings spike to a certain level. The move comes amid mounting concerns from across the political spectrum over immigration, which has emerged as a major voter issue this election year.

Some Democrats and human rights advocates have warned the Biden administration that the executive order could exacerbate the humanitarian crisis at the border, putting immigrants at greater risk as they wait on the Mexican side of the border. A recent analysis by ProPublica and The Texas Tribune found lawmakers, advocates and government officials previously issued similar warnings that went unheeded before a fire in a Ciudad Juárez, Mexico, detention center killed 40 men in March 2023.

Two weeks before the fire, which was one of the deadliest incidents involving immigrants in Mexico’s history, the Congressional Research Service published a report saying that the Mexican government did not have adequate resources to handle the influx of U.S.-bound migrants. “As a result, migrants remain vulnerable to crime and other abuses,” the report concluded.

The ProPublica and Tribune examination, which was accompanied by an 18-minute documentary titled “The Right Way,” unpacks the deadly consequences of policies such as Title 42, an emergency health code used by former President Donald Trump to slow immigration and continued under Biden. Even though the pandemic-era policy, which enabled the quick expulsion of 2.8 million immigrants, ended in May 2023, migrants continued to be stranded in Mexican cities because of other U.S. policies.

The week before Biden’s executive order, ProPublica and the Tribune hosted a virtual panel with experts to discuss U.S. policies that contributed to the fire, changes to the U.S. asylum system and why immigration has become a leading concern among voters as they prepare for this year’s presidential election. Speakers included:

• Andrew Selee, president of the Migration Policy Institute
• Maureen Meyer, vice president for programs at the Washington Office on Latin America
• Victor Manjarrez, director of the Center for Law and Human Behavior at the University of Texas at El Paso and a former chief patrol agent for the U.S. Border Patrol
• Perla Trevizo, reporter for the ProPublica-Texas Tribune investigative unit

Below are excerpts from the panel’s discussion, which have been edited for clarity and concision.

Perla Trevizo: We’ve been hearing a lot about a crisis — Biden’s crisis, the border crisis. Is there really a crisis, and what do we mean by that?

Andrew Selee: The American public overwhelmingly thinks it’s a crisis. At least four polls that came out recently tell the same story, which is that Americans are quite pro-immigration, but they’re also really worried about the border. This cuts across party lines now. Yes, Republicans are more concerned about the border than Democrats, but Democrats have moved on this issue as have independents.

When you have a system that can’t make decisions about who should come into the country, that undermines the credibility of your immigration system. It makes people more worried about immigration in general and less willing to support things like legal pathways that would actually help.

We don’t have a crisis in terms of our well-being as a society, but we do have a crisis in terms of being able to make decisions about who comes in and keep some sort of control over immigration policy. I’m worried if we don’t figure this part out, we’re going to see a backlash against immigration that will hurt all of us.

Maureen Meyer: As the administration looks to reduce numbers at the border so that it doesn’t seem like a crisis, what you end up having is a humanitarian crisis on the Mexican side of the border. As numbers have dropped here, especially since last December, Mexico is encountering over 120,000 migrants a month. So what you have is a crisis that you’re exporting farther south.

Trevizo: We’ve recently seen a significant drop in border apprehensions or encounters, which is not common for this time of the year. We’re hearing a lot about numbers going up or down and Mexico’s role in it. What do these numbers tell us?

Victor Manjarrez: Normally, I would say that that’s pretty significant, but that 50% drop is compared to December, when we had historically large numbers in terms of arrests along the southwest border.

Even with that drop, it’s estimated that there is going to be between 1.6 to 1.7 million arrests. The high-water mark was 1.6 million in 2000 for the longest time. When the numbers went up in 2022 and 2023 to 2.2 million, it was crushing because it does a number of things. You have to collapse your operations, and you have to vacate areas to handle the flows that come in.

The dynamic used to be that most people try to evade early detection. Now, people surrender to claim asylum. That doesn’t take away from the fact that it takes a large number of resources, from transportation to the logistics of processing.

Watch the Panel Discussion Trevizo: What would a more orderly process look like?

Selee: I think you want three elements. You want people to be able to come on legal pathways to take available jobs. Right now, we have 8 to 10 million jobs a month that are open, and it’s a very tight labor market. You want a way of connecting employers with willing workers. We don’t have that right now. We have a system built in 1990 that has numbers set in stone by Congress 34 years ago in a different economy. That’s one element you have to update.

Secondly, you need a refugee system where people who are fleeing things that would put their lives in danger can get into the United States through asylum, either by applying at the border or ideally earlier. Ideally, we want a humanitarian protection system that starts in the region, particularly since we know most people are coming from somewhere in Latin America and the Caribbean, but then has a fail-safe at the border.

You have to be able to return people who don’t meet those two characteristics: who aren’t coming on a legal pathway and aren’t granted asylum. You have to make decisions on protection fairly quickly, by the way. If it takes four or five years, which is what it takes right now to get a decision, you’re not giving protection to people who need it. But you’re also creating a pull factor for people who might not have otherwise applied for protection. We don’t tend to remove a lot of people who’ve been in the country that long. People know that if they make it to the U.S. border, they are likely to get in.

That’s a system that doesn’t make sense for people who need protection, but it also doesn’t make sense from a migration protection standpoint. We then turn to Mexico and other countries along the way and say, let’s make it harder for people to get here. We would be much better off with a system that gave protection that had legal pathways but also returned people who don’t come through those ways. But we’ve ended up with a system that simply tries to slow people down.

Trevizo: When you talk to the administration or when you hear Homeland Security Secretary Alejandro Mayorkas talk, they do point to legal pathways: the CBP One App, humanitarian parole, more guest worker visas. The administration was moving in that direction, but we’re still seeing record numbers. What happened?

Selee: They’ve really stretched the limits of what they can do with the executive branch to create legal pathways. They’ve tried to increase employer interest. They created quite a large pathway for Cubans, Haitians, Venezuelans and Nicaraguans, groups of people where there are displacement crises. It made sense to stretch what they call humanitarian parole powers to allow people to enter the country and have a work permit for two years. They’ve tried to speed up asylum and create incentives for people to go to ports of entry to apply for asylum rather than going between ports of entry. But without resources, without authorities, without Congress, it’s hard to create legal pathways. Unless Congress gets involved, appropriates money and provides some authorities, particularly on the legal pathway side, it becomes very hard to get done.

We saw an attempt by Republicans and Democrats, but that fell apart so we’re back to where we were

Trevizo: The Senate recently revived a failed immigration bill, but once again, Congress tanked the bill. If it had passed, what would it have done?

Selee: It would have codified some of the things they did to restrict asylum. For decisions on asylum, it would’ve put more money into the Border Patrol and into ICE, for processing people and for returns. It’s a Band-Aid, but sometimes Band-Aids are important too. It would have at least created a more virtuous cycle for people who have strong asylum claims to present themselves at the border and a disincentive for people who know they don’t have strong claims.

On the flip side, Mexico came out for the first time ever with a national strategy on migration. How does Mexico relate to its own diaspora, i.e., the 12 million Mexicans that live in the U.S.? How does Mexico deal with asylum-seekers? Like with the U.S., it’s a question of resources and authorities and how you actually do it.

Trevizo: Immigration is a top issue for voters. On the one hand, Biden has tightened his position on immigration. On the other hand, you have Trump saying that he would call for mass deportations. Heading into November, what do you expect to see around immigration?

Meyer: In terms of the Biden administration, we will continue to see a harder-line policy. President Biden and Mexico President Andrés Manuel López Obrador spoke a few weeks ago and talked about how they’re going to increase enforcement to reduce the number of migrants reaching the borders.

If it is a Biden second term, we will hopefully see a shift back to expanding legal pathways, improving the system, adding more resources and a continuation of these programs, especially the regional programs.

With Trump’s first term, we saw canceling refugee resettlement numbers or dramatically lowering them, canceling programs that Biden restarted like the Central America’s Minors Program, building more wall and, as you said, increased mass deportation. It’s a very contrasting view of the situation at the border that will have stark differences come January 2025.

by Joshua Kaplan, Justin Elliott and Alex Mierjeski

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Supreme Court Justice Clarence Thomas acknowledged for the first time in a new financial disclosure filing that he should have publicly reported two free vacations he received from billionaire Harlan Crow.

The pair of 2019 trips, one to Indonesia and the other to the Bohemian Grove, an all-male retreat in northern California, were first revealed by ProPublica. Last year, Thomas argued that he did not need to disclose such gifts. “Justice Thomas’s critics allege that he failed to report gifts from wealthy friends,” his lawyer previously said in a statement issued on the justice’s behalf. “Untrue.”

In the new filing released Friday, however, Thomas amended his financial disclosure for 2019, writing that he “inadvertently omitted” the trips on his previous reports.

Last year, ProPublica documented an array of undisclosed luxury vacations and other gifts Thomas has received over the years from several billionaires, including Crow. ProPublica revealed Crow had treated Thomas to numerous private jet flights and international yacht cruises, covered private school tuition for Thomas’ relative, and paid Thomas money in an undisclosed 2014 real estate deal.

Legal ethics experts said that Thomas appeared to have violated the law by failing to disclose the trips and gifts.

The Thomas revelations helped plunge the Supreme Court into its biggest ethical crisis in the modern era. Justice Samuel Alito also failed to disclose a luxury fishing trip that was paid for by wealthy political donors, one of whom had cases before the court. In recent weeks, Alito has faced criticism for politicized flags that flew at two of his homes. The public’s approval of the court has plummeted in the last few years, polls show.

In response, the court last year adopted a code of conduct for the first time in its history. The code, however, has no enforcement mechanism.

This is not the first time that Thomas has responded to public controversy about his disclosure practices by amending an old form. The forms are required by a federal law passed after Watergate that says justices must annually report income, assets and most gifts. At least twice before, Thomas has similarly defended his failure to make required disclosures as an unintentional error or a misunderstanding of the rules.

Last summer, Thomas amended his 2014 disclosure to include the real estate deal with Crow after ProPublica reported on the transaction. At the time, he wrote that he “inadvertently failed to realize” that the deal needed to be publicly reported and said he “continues to work” with judiciary staff to determine “whether he should further amend his reports from any prior years.”

Thomas engaged an outside lawyer last year to review his past filings. The new filing does not make clear whether that review is finished. The justice and his attorney did not immediately respond to requests for comment. In a statement last year, Thomas’ attorney, Elliot Berke, said that “after reviewing Justice Thomas’s records, I am confident there has been no willful ethics transgression.”

A committee of judges of the Judicial Conference, the principal policymaking body for federal courts, also said last year it had launched a review of the allegations against Thomas. By law, if there is “reasonable cause” to believe a justice intentionally omitted information from a report, the conference is supposed to refer the matter to the attorney general. Such a referral would be unprecedented. A judiciary spokesperson told ProPublica on Friday there is no update on that review.

Even after the new amendments, there are many gifts Thomas received that he has still not disclosed.

As ProPublica previously reported, in 2019, Thomas flew to Indonesia on Crow’s private jet for an extended island cruise on Crow’s superyacht. If Thomas had chartered the plane and the yacht himself, it could have cost more than half a million dollars. Seven ethics-law experts said that Thomas appeared to have violated federal law by failing to disclose the free travel.

Thomas did not mention the flight to Indonesia or the yacht trip in his new filing. However, he disclosed a previously unknown detail about the trip: that Crow and his wife paid for Thomas’ stay at a hotel in Bali. Thomas acknowledged that he should have reported that.

ProPublica also reported that Thomas had taken at least six undisclosed trips with Crow to the Bohemian Grove. Thomas’ amendments to his reports include only one of those trips. Members typically must pay thousands of dollars to bring a guest to the retreat.

In his new filing, Thomas disclosed receiving one gift last year: photo albums that he valued at $2,000 from Terrence and Barbara Giroux. Terrence Giroux was the executive director of the Horatio Alger Association, a nonprofit that provides college scholarships to low-income students. Thomas is an honorary board member of the nonprofit.

Thomas reported no free trips last year, which would make 2023 an anomaly. Thomas received undisclosed vacations from Crow and other wealthy benefactors virtually every year for more than two decades.

In the disclosure forms released Friday, Justice Ketanji Brown Jackson was the only other Supreme Court justice to report receiving a gift in 2023. Jackson said she received $12,500 worth of artwork for her chambers at the court, as well as a gift from Beyoncé of four concert tickets, which she valued at $3,711.84.

Alito, who has said he did not need to disclose his fishing trip, received a 90-day extension for filing his disclosure form for last year.

Do you have any tips on the Supreme Court? Josh Kaplan can be reached by email at joshua.kaplan@propublica.org and by Signal or WhatsApp at 734-834-9383. Justin Elliott can be reached by email at justin@propublica.org or by Signal or WhatsApp at 774-826-6240.

by Anna Clark, photography by Sarahbeth Maney

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for Dispatches, a newsletter that spotlights wrongdoing around the country, to receive our stories in your inbox every week.

When Gretchen Whitmer campaigned for Michigan governor in 2018, she took aim at Michigan’s bottled water industry — and the state policy that gave it unfettered access to free water.

Nestle was extracting hundreds of millions of gallons of groundwater a year, which it bottled and sold under the Ice Mountain brand. The only cost: a $200 yearly fee per site. The company asked the state for a 60% boost in how much it could take from a well that draws from the source of two cold-water trout streams. At the time, the Flint water crisis was still in the spotlight, contributing to broad pushback. Nearly 81,000 public comments opposed the permit request; 75 supported it.

In April of that year, state officials said they didn’t have any grounds to deny the request and gave Nestle the go-ahead. The same week, the state said it would stop providing bottled water to Flint.

The contrast seemed clear: Nestle gets free water, Flint families don’t. And one of the staunchest critics of the arrangement was Whitmer, a rising Democratic leader who had served 14 years in the Legislature.

Michigan Gov. Gretchen Whitmer at a 2022 campaign rally (Brandon Bell/Getty Images)

“When it comes to Nestle, I don’t believe that they should be taking the water out of our ground and selling it, and I want to stop that,” Whitmer said in a gubernatorial debate.

She told a news outlet that Nestle “is abusing our water here in Michigan.”

And her campaign water plan emphasized the disparities that set off the controversy in the first place, noting that some Michiganders struggled to pay bills for water of questionable quality. The state should be preserving freshwater, the plan said, “not selling it at a nominal price.”

Whitmer vowed to do things differently.

But six years later, well into her second term and with a Legislature controlled by fellow Democrats, little has changed.

Whitmer’s X account posted photos from an event where she helped distribute bottled water in Flint while running for governor in 2018. (Screenshot by ProPublica)

Most of Nestle’s North American water brands were bought in 2021 by a private equity firm and an investment firm in a $4.3 billion deal. The company, now called BlueTriton Brands, gave up the controversial permit, but it still pumps groundwater from the same wells at minimal cost.

Since Whitmer was elected, at least nine bills proposing changes — from new groundwater protections to closing oversight gaps — were left to languish in the Legislature. Bottled water faded as a talking point. The administration and lawmakers turned to other priorities: reproductive rights, economic development, education, infrastructure.

Peggy Case remembers meeting Whitmer when she was running for governor. “I have a picture of me with her,” said the board president of Michigan Citizens for Water Conservation, a nonprofit that twice challenged Nestle in court. “And yes, she was very strong. She was going to really help us out.”

But, Case added: “She’s basically kind of ignored us for the last six years. Which is sad. I mean, she didn’t ignore us before the election.”

Peggy Case, board president of Michigan Citizens for Water Conservation, stands outside a former township hall in Osceola County, where the community has debated the public benefit of having water bottling operations in the area.

Whitmer’s office didn’t provide a response to questions from ProPublica.

Rep. Rachel Hood, a Democrat who sponsored bills to protect Michigan’s water, said the governor is a “remarkable leader” who “has been diverted from the fundamentals” by crises that include the pandemic and flooding that followed massive dam failures. “She’s done some good work, but there’s just so much to do,” Hood said.

The Whitmer administration has overseen significant investment in water infrastructure, including lead pipe replacement, and signed a new law requiring filtered faucets in schools and child care centers.

But in Whitmer’s first four years as governor, the Legislature was still under Republican control, and leaders refused to consider bills aimed at groundwater withdrawals and bottled water, said Rep. Laurie Pohutsky, another Democrat who sponsored water bills.

Her party took over both the state House and the Senate in 2023, the first time it controlled the Legislature and the governor’s office in nearly four decades. Now, Pohutsky is speaker pro tempore and chair of the environmental committee. She’s hopeful for future bills, she said, but there’s no timetable for them. First, she said, the Legislature needs to undo the limits put in place almost two decades ago on the ability of the state’s environmental agency to update water quality rules and standards.

BlueTriton said in a statement that it’s committed to collaborating with policymakers and others to strengthen water quality and stewardship policies. It carefully monitors its water sources for sustainability, the company said. Its Ice Mountain brand also “has a long history of supporting communities in times of need,” such as delivering bottled water weekly to Flint for about four years after the state program ceased, the company said. (This effort was featured in a company video.)

The bottling of Michigan water has tested leaders from both parties over the years. In 2001, when a New York town advertised its willingness to sell “crystal clear well water,” Republican Gov. John Engler wrote the mayor to remind him that the water was likely connected to Lake Ontario. Per an informal agreement signed in the 1980s, he said, any such sale would require the approval of all Great Lakes governors. The town dropped the plan.

Months later, after public resistance killed Perrier’s efforts to locate in Wisconsin, Engler welcomed the Nestle-owned business to Michigan. It began pumping water from rural Mecosta County, about 110 miles northwest of Lansing.

“Perrier should be thankful that the raw material is free,” wrote an Engler adviser in a memo, according to Dave Dempsey’s book, “Great Lakes for Sale.” “If it was trees, natural gas, minerals, oil, or even sand, they would compensate the state.”

Around the same time, a Canadian company proposed shipping water from Lake Superior to Asia. In 2007, Bill Richardson, a presidential candidate from New Mexico, floated the idea of piping Great Lakes water to the thirsty Southwest. Unnerved at the prospect of losing a precious resource, Michigan and neighboring states implemented policies to keep the water in its natural basin: the watershed where it flows back toward the lakes.

They established the Great Lakes-St. Lawrence River Basin Water Resources Compact in 2008 to coordinate efforts. The landmark agreement by eight states, along with a parallel agreement that includes two Canadian provinces, bans nearly all water diversions — a stronger version of the policy Engler referenced. And in 2009, Michigan introduced its first system for assessing and permitting large withdrawals.

But bottled water remained a tripwire, even though other industries, like agriculture, use significantly more. Officials who called for new protections ran up against established water law and intersecting economic concerns.

BlueTriton’s water pipeline facility operates not far from Chippewa Creek, one of two creeks in the area that environmentalists are monitoring for signs of reduced flow.

Americans spent about $49 billion last year on bottled water, even though most can access water safely in their homes. The Beverage Marketing Corporation, a research and consulting firm, called it the largest beverage category by volume in the United States. The group has said that water bottlers’ revenues are growing “largely due to higher prices.”

What’s happening in Michigan with bottled water is also happening elsewhere. BlueTriton sued California regulators last fall when they drastically limited how much water it can draw from the source of springs that flow through a national forest, which has been bottled and sold under the Arrowhead brand for more than 100 years.

Dempsey, the author who’s also a senior adviser to the Michigan-based nonprofit For Love of Water, believes there’s a difference between the bottled water industry and other commercial water users, such as farms and breweries. It’s one thing to use the water and another thing to take it and sell it, he told ProPublica.

The industry “gets the water almost for free” and “sells it at a huge markup,” Dempsey said. “And that’s just not fair to the public interest.”

FLOW developed model legislation under which Michigan would license companies for small container withdrawals, like those used by Ice Mountain, and subject them to royalties. This could raise at least $250 million a year, said executive director Liz Kirkwood, which could go toward other priorities, such as eliminating lead pipes or establishing an emergency fund so communities in crisis “never have to pay for bottled water.”

Peter Lucido, then a Republican representative, introduced a bill in 2017 that would levy a 5-cent-per-gallon tax on water bottling companies, which, he told ProPublica, could go toward fixing Michigan’s out-of-date stormwater infrastructure. His bill died without a hearing in the GOP-led Legislature. A similar bill met the same fate in 2018.

Lucido, now a prosecutor, blames industry influence. He said he remembers four Nestle lobbyists in his office after he introduced his bill.

“When you’re making billions of dollars on bottled water, it doesn’t take much to get a team of lawyers and lobbyists to go ahead and put the fire out,” he said. And anyway, Lucido added, “not everybody has the guts to stand up.”

The company is also a major source of jobs in a rural part of the state, employing 285 people in Mecosta County in 2021, according to a study commissioned by BlueTriton. It contributed more than $76 million to the regional economy that year, the report estimated, and over $179 million to the state economy. The company pays the city of Evart, in Osceola County, for water from two wells owned by the municipality; that water is used for its Ice Mountain brand.

But bottlers have avoided additional fees for removing groundwater, even though Whitmer promoted the idea as a candidate. Her 2018 water plan noted that the state charges companies a “severance tax” for mining other types of natural resources, or “severing” them from the soil. A similar fee for water, the plan said, could “control the siphoning of water for water bottling and my administration will work to see it done.”

Some environmentalists are skeptical. Collecting money for withdrawn water contributes to its commodification, they say, and might even motivate the state to expand the bottled water industry. It could also add to consumer costs, burdening people who don’t have safe water at home.

A locked gate leads to land leased by BlueTriton to draw water for bottling.

Instead of grappling with water royalties or taxes in the years since Whitmer was elected, Democratic lawmakers have proposed broad policy changes that could limit how much groundwater companies can extract, bottle and sell.

They introduced at least three bills to eliminate a measure that allows water to leave the basin if it’s in a small container — the so-called bottled water loophole. And they introduced at least six bills that would give the state more authority to weigh whether a withdrawal request is in the public interest, giving it greater grounds for a potential denial.

Eight of those nine bills, including one that had 28 sponsors, died without a hearing in a GOP-led Legislature. Hood said they were “largely messaging bills” — unlikely to become law, but meant to signal concern and ignite a conversation. Only one was introduced after Democrats took control of the Legislature: a public trust measure with a single sponsor, introduced last September. It hasn’t had a hearing.

On top of a “crowded agenda” pushing withdrawals off the priority list, there’s a lack of unanimity, said Sen. Jeff Irwin, sponsor of two earlier water bills. “Do you really have the votes on some of these environmental concerns that end up having an effect on commerce and industry?”

Hood is trying a different tack. She recently introduced a proposal to amend the state constitution to establish a right to a clean environment. Similar to the public trust bills, it would compel the state to act as a trustee for its natural resources. Hood said it’s modeled on an amendment in Pennsylvania’s constitution. Montana and New York have similar amendments.

The proposal was referred to the environmental committee chaired by Pohutsky in April. Changing Michigan’s constitution through the Legislature requires a two-thirds majority in both chambers, a formidable challenge.

The ongoing budget debate in Lansing is also an opportunity for lawmakers to fund a state council’s recommendations to improve how Michigan monitors and calculates water withdrawals. Pending since 2022, they echo concerns raised last month by the auditor general. “We were told, ‘We’ll get to you,’” a member of the Water Use Advisory Council said at a February meeting. She urged others to reach out to their legislators. “Every contact does help.”

For now, the environmentalists who have long worried about the bottled water industry’s effect on the cold creeks of Northern Michigan aren’t expecting much. Groundwater is easy for government officials to overlook, said Dempsey. Case, the board president of Michigan Citizens for Water Conservation, said she and her colleagues are ready to testify if a bill ever has a hearing.

And Steve Petoskey, an MCWC board member who lives in the area where BlueTriton pumps water, said he wishes that decision-makers considered the interests of regular people, not just businesses.

“They’re getting all the breaks,” he said of companies like BlueTriton. “Our concerns don’t seem to be heard.”

A volunteer with the Michigan Citizens for Water Conservation goes to observe water levels in Osceola County.

Do You Have a Tip for ProPublica? Help Us Do Journalism.

Correction

June 7, 2024: This story originally misstated where water from the city of Evart, in Osceola County, ends up after being purchased by BlueTriton Brands. It is used for its Ice Mountain brand, not Pure Life.

by Molly Parker and Beth Hundsdorfer, Capitol News Illinois

This article was produced for ProPublica’s Local Reporting Network in partnership with Capitol News Illinois. Sign up for Dispatches to get stories like this one as soon as they are published.

It was on L.J.’s 11th birthday, in December 2022, that child welfare workers finally took him away. They arrived at his central Illinois home to investigate an abuse allegation and decided on the spot to remove the boy along with his baby brother and sister — the “Irish twins,” as their parents called them.

His mother begged to keep the children while her boyfriend told child welfare workers and the police called to the scene that they could take L.J.: “You wanna take someone? Take that little motherfucker down there or wherever the fuck he is at. I’ve been trying to get him out of here for a long time.”

By that time, L.J. told authorities he hadn’t been in a classroom for years, according to police records. First came COVID-19. Then, in August 2021 when he was going to have to repeat the third grade, his mother and her boyfriend decided that L.J. would be homeschooled and that they would be his teachers. In an instant, his world shrank to the confines of a one-bedroom apartment in the small Illinois college town of Charleston — no teachers, counselors or classmates.

In that apartment, L.J. would later tell police, he was beaten and denied food: Getting leftovers from the refrigerator was punishable by a whipping with a belt; sass was met with a slap in the face.

L.J. told police he got no lessons or schoolwork at home. Asked if he had learned much, L.J. replied, “Not really.”

L.J. told police that he was sometimes left alone to care for his baby siblings and punished for eating food without permission, according to Charleston Police Department records. (Obtained by Capitol News Illinois and ProPublica. Highlighted and redacted by ProPublica.)

Reporters are using the first and middle initials of the boy, who is now 12 and remains in state custody, to protect his identity.

While each state has different regulations for homeschooling — and most of them are relatively weak — Illinois is among a small minority that places virtually no rules on parents who homeschool their children: The parents aren’t required to register with any governmental agency, and no tests are required. Under Illinois law, they must provide an education equivalent to what is offered in public schools, covering core subjects like math, language arts, science and health. But parents don’t have to have a high school diploma or GED, and state authorities cannot compel them to demonstrate their teaching methods or prove attendance, curriculum or testing outcomes.

The Illinois State Board of Education said in a statement that regional education offices are empowered by Illinois law to request evidence that a family that homeschools is providing an adequate course of instruction. But, the spokesperson said, their “ability to intervene can be limited.”

Educational officials say this lack of regulation allows parents to pull vulnerable children like L.J. from public schools then not provide any education for them. They call them “no schoolers.”

No oversight also means children schooled at home lose the protections schools provide, including teachers, counselors, coaches and bus drivers — school personnel legally bound to report suspected child abuse and neglect. Under Illinois law, parents may homeschool even if they would be disqualified from working with youth in any other setting; this includes parents with violent criminal records or pending child abuse investigations, or those found to have abused children in the past.

The number of students from preschool to 12th grade enrolled in the state’s public schools has dropped by about 127,000 since the pandemic began. Enrollment losses have outpaced declines in population, according to a report by Advance Illinois, a nonprofit education policy and advocacy organization. And, despite conventional wisdom, the drop was also not the result of wealthier families moving their children to private schools: After the pandemic, private school enrollment declined too, according to the same report.

In the face of this historic exodus from public schools, Capitol News Illinois and ProPublica set out to examine the lack of oversight by education and child welfare systems when some of those children disappear into families later accused of no-schooling and, sometimes, abuse and neglect.

Reporters found no centralized system for investigating homeschooling concerns. Educational officials said they were ill equipped to handle cases where parents are accused of neglecting their children’s education. They also said the state’s laws made it all but impossible to intervene in cases where parents claim they are homeschooling. Reporters also found that under the current structure, concerns about homeschooling bounce between child welfare and education authorities, with no entity fully prepared to step in.

“Although we have parents that do a great job of homeschooling, we have many ‘no schoolers’” said Angie Zarvell, superintendent of a regional education office about 100 miles southwest of Chicago that covers three counties and 23 school districts. “The damage this is doing to small rural areas is great. These children will not have the basic skills needed to be contributing members of society.”

Regional education offices, like the one Zarvell oversees, are required by law to identify children who are truant and try to help get them back into school.

We have many ‘no schoolers.’ The damage this is doing to small rural areas is great. These children will not have the basic skills needed to be contributing members of society.

—Angie Zarvell, superintendent of a regional education office that covers 23 school districts

But once parents claim they are homeschooling, “our hands are tied,” said Superintendent Michelle Mueller, whose regional office is located about 60 miles north of St. Louis.

Even the state’s child welfare agency can do little: Reports to its child abuse hotline alleging that parents are depriving their children of an education have multiplied, but the Department of Children and Family Services doesn’t investigate schooling matters. Instead, it passes reports to regional education offices.

Todd Vilardo, who since 2017 has been superintendent of the school district where L.J. was enrolled, said he is seeing more and more children outside of school during the day. He wonders, “‘Aren’t they supposed to be in school?’ But I’m reminded that maybe they’re homeschooled,” said Vilardo, who has worked in the Charleston school district for 33 years. “Then I’m reminded that there are very few effective checks and balances on home schools.”

“A Huge Crack in Our System”

There’s no way to determine the precise number of children who are homeschooled. In 2022, 4,493 children were recorded as withdrawn to homeschool, a number that is likely much higher because Illinois doesn’t require parents to register homeschooled children. That is a little more than double the number a decade before.

In late fall of 2020, L.J. was one of the kids who slipped out of school. After a roughly five-month hiatus from the classroom during the pandemic, L.J.’s school resumed in-person classes. The third grader, however, was frequently absent.

At home, tensions ran high. In the 640-square-foot apartment, L.J.’s mother, Ashley White, and her boyfriend, Brian Anderson, juggled the demands of three children including two born just about 10 months apart.

White, now 31, worked at a local fast-food restaurant. Anderson, now 51, who uses a wheelchair, had applied for disability payments. Anderson doesn’t have a valid driver’s license. The family lived in a subsidized housing complex for low-income seniors and people with disabilities.

In an interview with reporters in late February, 14 months after L.J. had been taken into custody by the state, the couple offered a range of explanations for why he hadn’t been in school. L.J. had been suspended and barred from returning, they said, though school records show no expulsion. They also said they had tried to put L.J. in an alternative school for children with special needs, but he didn’t have a diagnosis that qualified him to attend.

The couple made clear they believed that L.J. was a problem child who could get them in trouble; they said they thought he could get them sued. In the interview, Anderson called L.J. a pathological liar, a thief and a bad kid.

“I have 11 kids, never had a problem with any of them, never,” Anderson said. “I’ve never had a problem like this,” he said of L.J. The boy, he said, lacked discipline and continued to get “worse and worse and worse every year” he’d known him.

To support the idea that L.J. was combative, White provided a copy of a screenshot taken from a school chat forum in which the boy cursed at his schoolmates.

At the end of the school year, in spring 2021, the principal told White and Anderson that the boy would have to repeat the third grade. Rather than have L.J. held back, the couple pulled him out of school to homeschool. They didn’t have to fill out any paperwork or give a reason.

On any given day in Illinois, a parent can make that same decision. That’s due to a series of court and legislative decisions that strengthened parents’ rights against state interference in how they educate their children.

In 1950, the Illinois Supreme Court heard a case involving college-educated parents who kept their 7-year-old daughter at home. Those parents, Seventh-day Adventists, argued that a public school education produced a “pugnacious character” and believed the mother was the best teacher and nature was the best textbook. The judges ruled in their favor, finding that, in many respects under the law, homeschools are essentially like private schools: not required to register kids with the state and not subject to testing or curriculum mandates.

In 1989, the legislature voted to change how educational neglect cases are handled. Before the vote, DCFS was allowed to investigate parents who failed to ensure their child’s education just as it does other types of neglect. In a bipartisan vote, the General Assembly changed that, in part to reduce caseloads on DCFS — which has been overburdened and inadequately staffed for decades — and also in response to concerns about state interference from families who homeschool.

Since then, DCFS has referred complaints about schooling that come in to its child abuse hotline over to regional offices of education. The letter accompanying the educational neglect referral form ends with: “This notice is for your information and pursuit only. No response to this office is required.”

The Department of Children and Family Services forwards educational neglect claims made to its hotline to regional offices of education handling truancy, stating educational officials need not report findings back. (Obtained by Capitol News Illinois and ProPublica. Highlighted by ProPublica.)

Tierney Stutz, executive deputy director at DCFS, said that regional education officials are welcome to report back findings, but that “DCFS does not have statutory authority to act on this information.”

“Unfortunately, this is a huge crack in our system,” said Amber Quirk, regional superintendent of the office of education that covers densely populated DuPage County in the Chicago suburbs.

To see how this system is working, reporters obtained more than 450 of these educational neglect reports, representing over a third of the more than 1,200 forwarded by DCFS over three years ending in 2023. About 10% of them specifically cited substandard homeschooling claims. But officials said that in many of the other reported cases of kids out of school, they found that families also claimed they were homeschooling.

Faced with cases of truancy or educational neglect, county prosecutors can press charges against parents. But if they do, parents can lean on Illinois’ parental protections when they defend themselves in court from a truancy charge.

That’s been the experience of Dirk Muffler, who oversees truancy intervention at a regional office of education covering five counties in west-central Illinois. “We’ve gone through an entire truancy process, literally standing on the courthouse steps getting ready to walk in to screen a kid into court and the parents say, ‘We are homeschooling.’ I have to just walk away then.”

More recently, the ISBE made one more decision to loosen the monitoring of parents who homeschool: For years, school districts and regional offices distributed voluntary registration forms to families who homeschool, some of whom returned them. Then last year, the state agency told those regional offices that they no longer had to send those forms to ISBE.

All we want is to be left alone. And Illinois has been so good. We have probably the best state in the nation to homeschool.

—Kirk Smith, executive director of Illinois Christian Home Educators

“The homeschool registration form was being misinterpreted in some instances that ISBE was reviewing or approving homeschool programs, which it does not have statutory authority to do,” an ISBE spokesperson told the news organizations.

Over the years, the legislature has taken up proposals to strengthen the state’s oversight of homeschooling. In 2011, lawmakers considered requiring parents to notify their local school districts of their intent to homeschool, and in 2019 they considered calling for DCFS to inspect all homeschools and have ISBE approve their curriculum.

Each time, however, the state’s strong homeschooling lobby, mostly made up of religious-based organizations, stepped in.

This March, under sponsorship of the Illinois Christian Home Educators, homeschoolers massed at the state Capitol as they have for decades for Cherry Pie Day, bringing pies to each of the state’s 177 lawmakers.

Families who homeschool and their supporters assembled at the Illinois Capitol in March to give lawmakers cherry pies, a gesture of gratitude for maintaining regulation-free homeschooling. (Dominique Martinez-Powell/Saluki Local Reporting Lab, for Capitol News Illinois)

Kirk Smith, the organization’s executive director and former public school teacher, summed up his group’s appeal to lawmakers: “All we want is to be left alone. And Illinois has been so good. We have probably the best state in the nation to homeschool.”

“Nobody Knows. He’s Not in School.”

Just days after child protection workers took 11-year-old L.J. into protective custody on his birthday, a 9-year-old homeschooled boy, 240 miles away, disappeared and was missing for months before police went looking for him.

Though the case of Zion Staples was covered in the media, it has not been previously reported that his homeschooling status delayed the discovery of his death.

Zion had been living in Rock Island, in the northwest part of the state, with his mother, Sushi Staples. The family had a long history of abuse and neglect investigations by DCFS, and Staples had lost two kids to foster care in Illinois nearly two decades before because she mistreated them; the children were not returned to her. The most recent investigation by DCFS was in 2021. The department did not find enough evidence to find mistreatment and the case was closed.

Despite her past involvement with child welfare services, no Illinois laws restricted her from homeschooling the children who remained in her care, including Zion and five others who were then ages 8 to 14.

When reporters asked DCFS for his schooling status, the agency’s responses revealed considerable confusion about where he was being educated. DCFS originally told the news organizations that Zion was enrolled in an online school program, but the company that DCFS said had been providing his schooling told reporters that Zion had never been enrolled. DCFS later clarified that his mother said he was leaving public school in August 2021 to attend an online program, but no one was required to verify this information.

On a December morning in 2022, Staples told police she returned home from running errands and found Zion dead. A coroner would later find that he died from an accidental, self-inflicted shot fired from a gun the children found in the house. His mother hid the body and later confided to her friend, Laterrica Wilson, that she did it because she did not want to risk losing her other children.

“She said: ‘Nobody knows. He’s not in school. He’s homeschooled. I’ve got this figured out,’” Wilson recalled in an interview with a reporter about a conversation she had with Staples a few months after the child had died. “She said she had too much to lose.”

Wilson, who lives in Florida, said it was one of several calls she had with Staples over the course of months as she tried to figure out what had happened and what to do about it. Police records indicate that in July, in response to a call from Wilson, they visited the home. Staples denied the child even existed. Later, when police executed a search warrant, officers found Zion’s body in a metal trash can in the garage; he was still wearing his Spiderman pajama bottoms. He’d been dead for seven months, an autopsy revealed.

Staples was charged with concealing a death, failure to report the death of a child within 24 hours and obstructing justice. Staples pleaded guilty to felony endangering the health of a child in February and was sentenced to two years in prison in April.

Staples did not respond to a letter sent to her in prison seeking comment on this case.

DCFS and its university partners study all sorts of risks to children involved with the child welfare system, but they’ve never examined homeschooling and do not track the number of children the agency comes in contact with who are homeschooled. While the agency’s inspector general is required to file reports on every child who dies in foster care or whose family the agency had investigated within the preceding year of the child’s death, the children’s schooling status is rarely noted in them.

For L.J., homeschooling rules also blinded school officials to abuse he suffered, although their administrative office is within sight of his apartment complex. About five months passed from when he was withdrawn to homeschool in the summer of 2021 before the first signs of help arrived. Following a call to its hotline in January 2022, DCFS found White and Anderson neglectful, citing inadequate supervision, but that did not result in L.J. returning to school. DCFS offered services, but Anderson and White declined.

DCFS received more calls to its hotline in June 2022 and again that September, alleging that Anderson and White had mistreated L.J. In both of those cases, DCFS investigators did not find enough evidence to support those allegations and closed the cases.

The caller in September told DCFS the boy appeared malnourished. L.J. hadn’t been in school since 2019, the caller reported. But DCFS said they did not pursue an investigation into his schooling matters because it wasn’t in their policies to do so.

It did send an educational neglect report to Kyle Thompson, the superintendent of schools overseeing the regional office of education in Charleston. The form didn’t mention physical abuse, but it did say that L.J. had begged for food from neighbors, that doctors were concerned about his weight and that a DCFS caseworker had recently visited the home but no one had answered the door.

DCFS fielded a complaint about L.J. to its hotline in September 2022 that included concerns about his eating and weight; it also said he hadn’t been in school for years. The department forwarded these details on an educational neglect report to the regional office of education in Charleston. (Obtained by Capitol News Illinois and ProPublica. Highlighted by ProPublica.)

Thompson was in his office when the educational neglect report ended up on his desk on an October afternoon. Alarmed when he read the allegations, Thompson went to the apartment that same day. White and Anderson came to the door, Thompson recalled, and eventually agreed to meet with school officials.

“I really feel like we may have saved that kid’s life that day,” Thompson said.

But Anderson and White continued to keep L.J. at home.

In November, a grocery store manager found L.J. in the parking lot begging for quarters and called police, who took L.J. home and later issued a ticket to White and Anderson for violating a city truancy ordinance. L.J. hadn’t been to school the whole year — 70 days.

Anderson said he didn’t know why he was cited, since he was homeschooling. “Apparently, it wasn’t good enough for the school system,” he told reporters.

A few days later, police and child welfare services again visited the home and found welts and bruises on L.J.’s back. L.J. said Anderson had beaten him with a belt as punishment for eating leftover Salisbury steak and potatoes without permission. The boy also told child welfare workers he had not showered for two weeks.

Anderson and White would later tell reporters L.J. was on a diet of fruits and vegetables because he was too fat and prediabetic, but L.J. told police he ate mostly cereal. Though DCFS found credible evidence of both neglect and abuse in its November and December investigations, the couple said they did not abuse L.J. or deny him an education. They are still trying to get the two younger children back, but they say they don’t want L.J. In an April court custody hearing, a judge in their child welfare case admonished them for not accepting responsibility for their treatment of L.J., including keeping him from school.

For its part, the state did ultimately take responsibility for L.J.’s schooling: Caseworkers took the children into custody on a Friday. The following Monday, L.J. returned to public school.

Help ProPublica Report on Education

Have a news tip regarding homeschooling, chronic truancy or educational neglect? Email them to Molly Parker or Beth Hundsdorfer at investigations@capitolnewsillinois.com.

Mollie Simon of ProPublica contributed research. Andrew Adams of Capitol News Illinois contributed data reporting.

by Andrea Bernstein

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

There’s a tape that both the defense and the prosecution played in summations in former President Donald Trump’s criminal trial. In it, you can hear the chaos of Trump’s office at Trump Tower in September of 2016: Trump seems to be having multiple conversations almost simultaneously. He talks to an unidentified person on the phone. He discusses polls with Michael Cohen, his executive vice-president at the time. Trump and Cohen talk about a diversity initiative and stopping the media from unsealing the records of Trump’s first divorce. His executive assistant pops in with word of a call from a developer. Trump calls for a Coke.

And then, very clearly, you can hear Cohen saying, “I need to open up a company for the transfer of all of that info regarding our friend, David, you know, so that — I’m going to do that right away. I’ve actually come up and I’ve spoken … I’ve spoken to Allen Weisselberg” — then the Trump Organization’s chief financial officer — “about how to set the whole thing up.”

Trump interrupts and says, “So, what do we got to pay for this, 150?” Then he says, “Cash?”

“No, no, no, no no,” Cohen says. “I got it.”

On the most literal level, the tape showed Trump discussing the logistics of paying off a woman who said she had an affair with him. This was key evidence for the jury’s ultimate finding that he had intended to alter the outcome of the 2016 election by making unlawful hush money payments.

When this tape was first made public, in 2018, it was hard to pin down exactly what it all meant. But as Trump’s seven-week trial proceeded, the broader meaning of the tape emerged in sharp relief: Everything is connected in Trump world, ethical borders are easily crossed and Trump is on top of every detail.

The verdict in the criminal trial provided answers to a narrow series of questions, not least of which was whether a presidential candidate had used illicit means to prevent voters from learning about a payoff to conceal a sexual encounter. (Trump has vowed to appeal.) But the trial also unveiled a broad array of evidence that went far beyond the charges. It revealed a lot about how Trump went about running his company and the presidency — and provided hints of how that might play out in a second Trump administration.

For most of Trump’s presidential term, I co-hosted the ProPublica/WNYC podcast “Trump, Inc.,” whose mission was to delve into the conflicts of interest between Trump’s business and his presidency. Because there was so much that journalists didn’t — and couldn’t — understand about a privately held company that clung tightly to its secrets, “Trump, Inc.” billed itself as “an open investigation.” We were candid about what we did and did not know because we lived in a world of doubt.

“Trump, Inc.” uncovered a lot, including unearthing Cohen’s dubious connections in 2018 and outlining how his role as Trump’s lawyer (then still intact) created a cloak of legal privilege that hid their interactions.

But we saw just tiny glimpses of the documents that have now been revealed in their entirety in the criminal trial; we had no access to the many Trump employees, current and former, who have now described, under oath, the inner workings of the Trump Organization.

That testimony confirmed what that tape seemed to show: that Trump pays close, close attention to all his business affairs, and always has. This, in turn, suggests that the mixing of Trump’s presidency and business that “Trump, Inc.” and others documented occurred under that same watchful eye. And if voters elect Trump a second time — this time knowing that he was convicted of a crime, one where key acts were committed in the Oval Office, on top of his two impeachments — Trump can conclude that America’s voters have blessed his way of doing business. There’s every reason to believe his conflicts of interest will only be more open and more unapologetic.

The Trump campaign did not respond to a request for comment.

Trump employees testified to his intense level of control in three trials against Trump or his company over the past two years. These were among five trials since 2022, each of which I covered in person, including the criminal trial of his company for tax fraud, two defamation suits brought by the writer E. Jean Carroll and the New York attorney general’s civil fraud trial. Each trial ended badly for Trump or his company (and each is being appealed).

Donald Trump’s criminal trial in New York offered one sharp revelation after the next. The disclosures came not just from the talked-about witnesses, such as former National Enquirer publisher David Pecker, Stormy Daniels and Cohen himself, but also from Trump’s former comptroller, his executive assistant and the aide who sat closest to the Oval Office. Some of these individuals, including a junior bookkeeper for the Trump Organization and the head of the company’s accounts payable department, work in Trump Tower to this day.

The picture that emerges from their testimony is of a boss — “The Boss” is what they nearly uniformly call him — who manages the tiniest of details but leaves the faintest of traces of all that management. Up until the throes of the 2016 campaign, Trump had to approve every payment over $2,500, an extraordinarily tiny sum for a mogul with assets around the globe. (For the duration of the campaign, until he became president, that amount inched up, to $10,000.) Trump would reject checks he didn’t want to pay and send them back to his underlings, with the word “VOID” scrawled on them in Sharpie.

Trump watched every expense in this way, his comptroller Jeff McConney testified. Trump once told him, early in his time at the company, “You’re fired,” because McConney hadn’t made an effort to reduce Trump’s bills before presenting Trump with payment documents. “It was a teaching moment,” McConney said on the stand. This close attention and tight-fistedness extended company wide: When it came to Trump University, Cohen testified, it was part of his job to offer a vendor 20% of what they were owed, or to pay them nothing at all.

Trump brought this ethos to the White House, where, as his lawyers liked to point out, he was the “leader of the free world.” He took time to write “PAY” on a $6,974 invoice sent by Trump Organization executive assistant Rhona Graff for an annual membership and “food minimum” at the Winged Foot Golf Club in Mamaroneck, New York.

Trump, of course, handed over control of the Trump Organization, including the oversight of its payments, to his older sons and Weisselberg at the outset of his administration. But he never gave up ownership of his company. He always made money from it, and does to this day.

And Trump, while president, went to extraordinary lengths to keep control of his “personal” checking account. That account actually belonged to a Trump Organization business entity, which underscored the lack of separation between Trump and the company he had ostensibly separated himself from. Trump’s personal checks were approved by Weisselberg; generated by Deborah Tarasoff, the head of Trump’s accounts payable department; stapled to the approved invoice; and sent via FedEx by Trump’s junior bookkeeper, Rebecca Manochio, to the Washington home of Trump’s bodyguard-turned-White House aide, Keith Schiller, who would bring them over for Trump to sign. That’s how the checks that Trump signed to Cohen made their way to the Oval Office.

“Checks came in a FedEx envelope” that Schiller delivered, testified Madeleine Westerhout, Trump’s director of Oval Office operations. “I opened the envelope. And inside was a manila folder with a stack of checks. And I brought the manila folder in to the president for him to sign.”

Money wasn’t the only thing Trump paid close attention to. He wrote all of his social media posts, save for a few written by an aide, Dan Scavino. Sometimes, Trump would dictate tweets to Westerhout. She would type them up, print them out and show them to Trump so the president of the United States could take time to scrutinize, and adjust, the punctuation. “He liked to use the Oxford comma,” Westerhout testified.

Trump did not send emails or text messages. This aversion has long been known, but the trial testimony laid out a whole series of ways in which Trump communicated without leaving precise documentation.

He was on the phone beginning at 6 in the morning and “late into the night after I went to bed, so I always felt guilty about that,” Westerhout testified. He’d often use Schiller’s cellphone to make calls, and employees would use that number to reach Trump. There were no Trump memos, no notepads, no Post-it notes, just an occasional Sharpie scrawl. And largely, except for Cohen’s, no testimony that what these employees did, they did “at the direction of” and “for the benefit of” Donald Trump. (This was an essential part of the judge’s charge to the jury: that Trump “personally, or by acting in concert with another person or persons, made or caused a false entry in the business records of an enterprise.”)

This is the backdrop for the conflicts “Trump, Inc.” and other news media covered while Trump was president. To recap some of them (at a moment when polls show many Americans have forgotten much of what transpired during his administration): Trump’s hotel in Washington became a must stop-by for foreign officials, earning his company millions. He caused the U.S. Treasury to spend more than $1 million to house Secret Service agents in rooms with top-of-the-market rates at Mar-a-Lago and had the government pick up the tab for $1,005.60 in cocktails apparently enjoyed by administration officials and friends at his resort’s bar.

During Trump’s presidency, the response to questions about all this went something like this: As a global businessman, he or his allies would say, how could he possibly pay attention to whether the presidential seal was used on his golf courses? Or whether his son, Don Jr., was trading on the name “Donald Trump” to sell condos in India. Or whether businesspeople with foreign ties were trying to make a buck, or millions, from his presidency?

Indeed, this was part of Trump’s defense in the criminal trial, and in the civil fraud trial at which Trump was ordered to pay hundreds of millions of dollars to New York state for what a judge found was a yearslong practice of lying about the value of his assets. When he testified at that civil trial, Trump distanced himself from the fraud: “All I did was authorize and tell people to give whatever is necessary for the accountants to do the statements,” he said. And the false statements of financial condition? “I would look at them, I would see them and maybe on some occasions, I would have some suggestions.”

As is his right, Trump chose not to testify at his criminal trial, but his lawyer Todd Blanche argued on his behalf that Trump “had nothing to do, had nothing to do with the invoice, with the check being generated, or with the entry on the ledger” and that he was so busy being president he maybe didn’t even look at the checks he signed. “Sometimes he would sign checks even when he was meeting with people, while he was on the phone, and even without reviewing them,” Blanche said during closing arguments.

The jury did not buy that defense.

Trump is currently leading in the polls. It’s entirely possible he will be elected president. Yet he’s continuing to aggressively pursue business deals in countries that will have a long list of issues on which they will be seeking U.S. support.

The Trump Organization entered a full-on partnership with LIV Golf, an entity majority-owned by the government of Saudi Arabia, for tournaments at his golf courses. And last year, a New York Times reporter and photographer visited what the reporter called a “multibillion-dollar project backed by Oman’s oil-rich government that has an unusual partner: former President Donald J. Trump.” The project was launched and is being built while Trump is the front-runner for a second presidency. But neither the Trump Organization nor the Trump campaign tried to defend or separate the project from the candidate who, while not running the company, still makes money from it.

“It’s like the Hamptons of the Middle East,” Eric Trump, who now runs the Trump Organization, told the Times. The paper wrote: “Oman, in fact, is nothing like the Hamptons. It is a Muslim nation and absolute monarchy, ruled by a sultan, who plays a sensitive role in the Middle East: Oman maintains close ties with Saudi Arabia and its allies, but also with Iran, with which it has considerable trade.”

It isn’t just the foreign deals. In April, right around the time Trump was about to be criminally tried in New York, he offered oil executives gathered at Mar-a-Lago “a deal,” the Washington Post reported. The publication summarized his message as: “You all are wealthy enough that you should raise $1 billion to return me to the White House.” In exchange, the Post said, Trump promised to reverse President Joe Biden’s initiatives to slow climate change, vowing to roll back some of them “on Day 1.”

And, as has been widely reported, with Truth Social going public, Trump has set up what Vox called “a perfect avenue for potential corruption.” As Vox noted, it’s “a way for Trump’s supporters to personally offer him financial support at a time when he desperately needs it.” By propping up the share price of the stock of the cash-hemorrhaging social media company, shareholders have potentially put billions of dollars in Donald Trump’s pocket.

It’s clear that Trump plays favorites and rewards loyalty; nearly eight years after he was inaugurated in 2017, it’s hard to imagine that any savvy businessperson or foreign leader fails to recognize this.

Certainly, those who were once in Trump’s orbit, if only briefly, testified to the dark side of that equation. Both Cohen and Daniels described the torrent of retribution they’ve experienced. Trump is unapologetic about his quest for vengeance. As he put it in one social media post last summer, “IF YOU GO AFTER ME I’M COMING AFTER YOU.”

Merely having been once employed by Trump seems to have taken a toll, on even relatively minor figures. In the civil fraud trial, Trump’s former comptroller, McConney, started weeping when he was asked why he no longer worked at the Trump Organization. He said he could no longer “deal with” the legal scrutiny he’d suffered. In the criminal trial, both former communications director Hope Hicks and Westerhout burst into tears on the stand, reflecting on their work history with Trump. Both said they remained loyal, but both had been banished from Trump’s graces.

And as for Weisselberg, he was not called to testify in this trial. His previous testimony in the trial of Trump’s company resulted in felony convictions on 17 counts and a five-month jail sentence. He is now serving a second jail sentence, in Rikers Island, for committing perjury in Trump’s civil fraud trial.

In the courthouse, Trump spent long stretches of time in an uncomfortable room with the shades always drawn, the fluorescent lighting unforgiving. He was required to listen to weeks of unflattering testimony, including, several times, to his own voice on that tape Cohen made of him, utterly cognizant of the tawdry deal he was striking. Saying, “So, what do we got to pay for this, 150?” After all the testimony in his criminal trial, this no longer seems like a random moment. It sounds like who Trump is: his attention to detail, his willingness to subvert the rules, the way he wields money to enhance his power, and vice versa, and is utterly unashamed.

The public knows all this now. In a second Trump presidency, it’s exactly what we’d get. Except this time, it will be all out before us, not in a secretly recorded tape.

by Jennifer Smith Richards and Jodi S. Cohen

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up for Dispatches, a newsletter that spotlights wrongdoing around the country, to receive our stories in your inbox every week.

Two national civil rights groups accused Illinois’ third-largest school district on Tuesday of relying on police to handle school discipline, unlawfully targeting Black students with tickets, arrests and other discipline.

In a 25-page complaint against Rockford Public Schools, filed with the U.S. Department of Education’s Office for Civil Rights, the National Center for Youth Law and the MacArthur Justice Center said that Rockford police officers have been “addressing minor behaviors that should be handled as an educational matter by parents, teachers, and school leaders — and not as a law enforcement matter by police officers.”

The complaint adds: “Black students bear the brunt of this harm.”

The groups, which shared a copy of the complaint with ProPublica, asked the Education Department to find that the district violated federal law prohibiting discrimination and to order it to change its discipline practices and reliance on police. Using data obtained from the Rockford district and the Rockford Police Department, the groups argue that the district’s partnership with police funnels Black students — but not their white peers — into the justice system, even for the same infractions at school.

A spokesperson for Rockford schools declined to answer questions from ProPublica, saying the district had not been told by the Office for Civil Rights that a complaint had been filed and that it “will respond accordingly” if an investigation is opened.

The two national groups have won civil rights claims in school districts previously and also prompted change on criminal justice issues, such as solitary confinement in prisons. The groups began to investigate school-based ticketing in Rockford after a 2022 investigation by ProPublica and the Chicago Tribune into the practice in Illinois that included a database of thousands of student tickets issued across the state, including in Rockford.

“The Price Kids Pay” investigation found that even though Illinois law bans school officials from fining students directly, districts skirt the law by cooperating with police. It also found that Black students were twice as likely to be ticketed at school than their white peers.

The municipal tickets — for violating ordinances including those against vaping, truancy and disorderly conduct — can include fines of as much as $750 in Rockford and are difficult to fight. They’ve left some families with debt and other serious financial consequences. Unlike in juvenile court, students in local ticket hearings cannot get a public defender.

Rockford is the second large district in Illinois to face a civil rights investigation for racial disparities in ticketing since “The Price Kids Pay” was published. An investigation by the Illinois attorney general’s office into Township High School District 211, the state’s biggest high school district, was opened in May 2022 and is still ongoing, the office said Monday. The district has denied that students’ race plays a role in discipline there.

The Rockford district has about 28,000 students: 26% white, 31% Black and 32% Latino. The district oversees 41 schools for students in kindergarten through high school. According to the complaint, Black students were more than three times as likely as their white peers to be sent to a school police officer during the past three school years up until March.

As a result of disproportionate police involvement, the complaint alleges, Black students are then more likely to get ticketed. For example, at least nine Black students received police tickets for “trespassing,” or being on campus without permission this year. While 27 white students were accused of trespassing during the same period, none were referred to police or ticketed.

Representatives from the two legal groups said they attended about a dozen administrative ticket hearings, as recently as May, held at Rockford City Hall during the school day. They found that ticketed students were almost exclusively students of color.

“I have seen parents and families in the City Hall very confused and distraught that they were being ticketed for these things,” Zoe Li, an attorney with the MacArthur Justice Center, said in an interview with ProPublica. “The fact that I have not seen a single white kid at a ticket hearing in Rockford is a little surprising.”

Illinois lawmakers and advocates twice have introduced bills that would curb school-based ticketing in Illinois, including this spring, but both efforts fizzled. Even though the state schools superintendent and governor have said they support an end to the practice, some legislators and school leaders worry that banning student ticketing might unintentionally limit when police can get involved in more serious incidents.

But ordinance violations are by definition not criminal; students who bring weapons to school, for example, typically would be arrested, not ticketed. Rockford is a good example of the harm caused by ticketing and the need for a change in state law, said Angie Jimenez, an attorney focused on justice and equity at the National Center for Youth Law, which has pushed for reforms in Illinois law.

“The plan is to still move forward with the legislative advocacy to stop the practice of school ticketing,” Jimenez said. “We are hopeful that this complaint will help to support those efforts overall.”

The complaint also highlights racial disparities in discipline overall in Rockford. Black students are more likely to be suspended or expelled than their white peers, the groups found, even if the district’s code of conduct prescribed a lesser consequence such as detention.

The Rockford district has been the subject of discrimination complaints before. In 1993, a federal judge ruled that the district was illegally segregating students, including by steering Black and Latino students into lower-level classes. As a result of its disparate treatment of students, the district remained under a federal desegregation order until 2001.