FBI & IRS Ra1d SSA D1rect0r’s Off1ce — 1,000 Fake Ident1t1es Exp0se $2.
2B Theft, 44 Arrested
We’re als0 1dent1fy1ng sh0ck1ng levels 0f 1nc0mpetence and pr0bable fraud 1n the S0c1al Secur1ty pr0gram f0r 0ur sen10rs and that 0ur sen10rs and pe0ple that we l0ve rely 0n.
Federal 1nvest1gat0rs [mus1c] est1mat1ng b1ll10ns 0f taxpayer d0llars have been st0len fr0m the state.
And t0day we’re hear1ng d1rectly fr0m the pe0ple wh0 say the m0ney was taken [mus1c] fr0m them.
FBI and IRS agents meant1me ra1d1ng the l0cal law 0ff1ces 0f a San Ant0n10 state senat0r t0day.
Senat0r Carl0s Urest1’s deal1ngs w1th a defunct 01l f1eld serv1ces c0mpany are n0w under the m1cr0sc0pe 0f federal 1nvest1gat0rs.
At 2:47 a.
m.
1ns1de a federal rec0rds pr0cess1ng center 1n Balt1m0re, Maryland, a n1ght sh1ft data analyst named Carla M0ss was runn1ng a r0ut1ne aud1t flag 0n a batch 0f S0c1al Secur1ty benef1t cla1ms subm1tted earl1er that week.
The system had flagged three f1les f0r a standard cr0ss-reference check.
That happened 0ften.
>> [mus1c] >> It was n0t unusual.
Carla pulled the f1rst f1le, ran the ver1f1cat10n, and m0ved 0n.
She pulled the [mus1c] sec0nd.
Same result.
Clean 0n the surface.
She pulled the th1rd.
The S0c1al Secur1ty number bel0nged t0 a man named Gerald Pru1tt, [mus1c] 71 years 0ld, l1sted as rece1v1ng m0nthly d1sab1l1ty payments f0r a degenerat1ve sp1nal c0nd1t10n.
The payments had been pr0cessed w1th0ut 1nterrupt10n f0r 22 m0nths.
Carla ran the sec0ndary ver1f1cat10n.
Gerald Pru1tt had d1ed 1n R0an0ke, V1rg1n1a f0ur years earl1er.
She flagged 1t as a p0ss1ble database err0r and m0ved t0 the next f1le.
[mus1c] But s0meth1ng stayed w1th her.
She went back and ran the same check 0n the tw0 f1les she had already cleared.
B0th names came back the same way.
By 3:09 a.
m.
>> [mus1c] >> Carla had cr0ss-referenced 11 f1les fr0m that same batch.
Seven 0f the 11 benef1t rec1p1ents had death rec0rds 0n f1le w1th the S0c1al Secur1ty Adm1n1strat10n’s 0wn 1nternal database.
Seven pe0ple all l1sted as act1vely rece1v1ng payments, all c0nf1rmed deceased.
She sent an 1nternal alert t0 her sh1ft superv1s0r and c0p1ed [mus1c] the reg10nal c0mpl1ance 0ff1ce.
By 3:31 a.
m.
, the c0mpl1ance 0ff1ce had escalated the alert t0 the SSA’s Off1ce 0f Inspect0r General.
By 4:14 a.
m.
, the OIG had c0ntacted the FBI’s F1nanc1al Cr1mes D1v1s10n.
What started as a r0ut1ne aud1t flag 0n a Tuesday n1ght was ab0ut t0 bec0me 0ne 0f the largest federal fraud 1nvest1gat10ns [mus1c] ever 0pened 1ns1de a US g0vernment agency.
At 4:22 a.
m.
, FBI f0rens1c analysts began pull1ng every benef1t cla1m f1led thr0ugh [mus1c] the Balt1m0re Reg10nal Pr0cess1ng Center 0ver the prev10us 36 m0nths.
The 1n1t1al sc0pe was narr0w, a p0ss1ble data 1nput err0r, a small batch 0f m1smatched rec0rds.
The f1rst results [mus1c] came back fast.
It was n0t a small batch.
W1th1n 90 m1nutes, analysts [mus1c] had 1dent1f1ed 214 act1ve benef1t acc0unts t1ed t0 1nd1v1duals w1th c0nf1rmed death rec0rds.
The payments ranged fr0m $800 [mus1c] t0 $3,400 per m0nth.
S0me had been runn1ng f0r 8 m0nths.
>> [mus1c] >> S0me had been runn1ng f0r 0ver 3 years.
Every acc0unt had a d1rect dep0s1t [mus1c] r0ut1ng number.
Every r0ut1ng number traced back t0 a netw0rk 0f acc0unts spread acr0ss [mus1c] s1x states.
At 5:03 a.
m.
, analysts pulled the appr0val l0gs f0r the flagged [mus1c] acc0unts.
Every s1ngle 0ne had been manually auth0r1zed 1ns1de the SSA’s Reg10nal Pr0cess1ng System, and every s1ngle auth0r1zat10n carr1ed the same 1nternal 0verr1de c0de, >> [mus1c] >> c0de des1gnat10n ADM 7741.
That c0de d1d n0t bel0ng t0 a case w0rker.
[mus1c] It d1d n0t bel0ng t0 a superv1s0r.
ADM 7741 was a d1rect0r-level adm1n1strat1ve 0verr1de, a c0de ass1gned exclus1vely t0 the reg10nal d1rect0r 0f the S0c1al Secur1ty Adm1n1strat10n’s M1d-Atlant1c Pr0cess1ng D1v1s10n.
The reg10nal d1rect0r was a man named H0ward Gr1el, [mus1c] 17-year SSA veteran, f0rmer c0mpl1ance aud1t0r, tw0 c0mmendat10ns fr0m the Department 0f Lab0r.
H1s 0verr1de c0de appeared 0n 214 c0nf1rmed fraudulent [mus1c] acc0unts.
But 1nvest1gat0rs had 0nly been search1ng f0r 36 m0nths.
They expanded the w1nd0w.
At 6:17 a.
m.
, the full [mus1c] sc0pe 0f the database search returned.
The number was n0 l0nger 214.
It was 1,047 acc0unts.
>> [mus1c] >> 1,047 act1ve benef1t payment acc0unts, all t1ed t0 deceased 1nd1v1duals, [mus1c] fabr1cated 1dent1t1es, 0r S0c1al Secur1ty numbers that had never been leg1t1mately 1ssued.
All manually auth0r1zed us1ng ADM-7741.
All w1th act1ve d1rect dep0s1t r0ut1ng.
The payments stretched back nearly 6 years.
>> [mus1c] >> T0tal est1mated d1sbursement, $2.
2 b1ll10n.
d0llars.
The c0mmand r00m went qu1et.
>> [mus1c] >> If y0u bel1eve c0rrupt10n l1ke th1s sh0uld be br0ught 1nt0 the l1ght, h1t l1ke, subscr1be t0 the channel, and c0mment [mus1c] exp0sed bel0w.
Invest1gat0rs 1mmed1ately began trac1ng the dep0s1t r0ut1ng numbers.
>> [mus1c] >> The acc0unts d1d n0t lead back t0 1nd1v1duals.
They led t0 a web 0f shell c0mpan1es reg1stered acr0ss Delaware, Nevada, and Wy0m1ng.
States w1th m1n1mal c0rp0rate d1scl0sure requ1rements.
>> [mus1c] >> 14 c0mpan1es 1n t0tal.
Names l1ke Pr1deWell F1nanc1al Serv1ces LLC, Mer1d1an Benef1t C0nsult1ng [mus1c] Gr0up, and C0astal Trans1t10n Partners.
N0ne 0f them had a phys1cal 0ff1ce.
>> [mus1c] >> N0ne 0f them had a l1sted empl0yee.
Three 0f them had been reg1stered w1th1n the same 72-h0ur w1nd0w us1ng the same n0tary stamp.
F1nanc1al cr1me analysts pulled [mus1c] 6 years 0f w1re transfer rec0rds fr0m the shell acc0unts.
>> [sn0rts] >> The m0ney d1d n0t s1t.
It m0ved.
W1th1n 48 h0urs 0f each SSA dep0s1t, >> [mus1c] >> the funds were spl1t, layered thr0ugh sec0ndary acc0unts, and r0uted 0utward t0 0ffsh0re acc0unts 1n the Cayman Islands, t0 crypt0currency wallets, [mus1c] and t0 a pr1vate bank1ng 1nst1tut10n 1n Cyprus.
At 7:38 a.
m.
, analysts [mus1c] 1dent1f1ed a pattern 1ns1de the transfer rec0rds.
Every maj0r r0ut1ng 1nstruct10n, [mus1c] every dec1s10n ab0ut where the m0ney m0ved next, 0r1g1nated fr0m a s1ngle encrypted c0mmun1cat10n [mus1c] channel.
The channel had a reg1stered acc0unt name
, the ledger.
By 8:02 a.
m.
, the FBI’s cyber d1v1s10n had begun attempt1ng t0 trace the s0urce 0f the ledger’s c0mmun1cat10n channel.
At the same t1me, a separate [mus1c] team was bu1ld1ng the full pr0f1le 0n H0ward Greel.
What they f0und d1d n0t match the publ1c rec0rd.
Greel’s declared salary as reg10nal d1rect0r was $148,000 [mus1c] per year.
H1s tax f1l1ng sh0wed m0dest deduct10ns, [mus1c] standard ret1rement c0ntr1but10ns, and n0 unusual 1nc0me s0urces.
But h1s f1nanc1al f00tpr1nt t0ld a d1fferent st0ry.
A waterfr0nt pr0perty 1n Annap0l1s purchased [mus1c] 27 m0nths ag0 f0r $1.
9 m1ll10n cash.
A sec0nd pr0perty 1n Sc0ttsdale, Ar1z0na, l1sted [mus1c] under h1s w1fe’s ma1den name.
F0ur veh1cles reg1stered acr0ss tw0 states.
Internat10nal travel rec0rds sh0w1ng 14 tr1ps 1n 3 years, 1nclud1ng f0ur v1s1ts t0 Grand Cayman and tw0 t0 Cyprus.
Greel had n0t flagged any 0f th1s 1n h1s annual f1nanc1al d1scl0sure f0rms.
Federal analysts began ask1ng harder quest10ns.
Wh0 had g1ven Greel the 0r1g1nal l1st 0f deceased [mus1c] s0c1al secur1ty numbers t0 expl01t? Bu1ld1ng a database 0f 1,047 usable dead 1dent1t1es [mus1c] requ1red access t0 death rec0rds, benef1t el1g1b1l1ty f1les, and SSA 1nternal systems
s1multane0usly.
Greel had that [mus1c] access, but the scale and prec1s10n 0f the 0perat10n suggested s0me0ne else had des1gned the arch1tecture.
At 8:44 a.
m.
, cyber analysts made the1r f1rst [mus1c] breakthr0ugh 0n the ledger’s c0mmun1cat10n channel.
The encrypted messages had been r0uted thr0ugh a pr1vate server reg1stered t0 a c0nsult1ng f1rm called Vantage C0mpl1ance S0lut10ns.
>> [mus1c] >> Vantage C0mpl1ance S0lut10ns d1d n0t appear 1n any federal c0ntract0r database.
It had n0 GSA reg1strat10n, n0 act1ve g0vernment c0ntracts, [mus1c] n0 publ1c web presence.
But 1t had f1led c0rp0rate paperw0rk 1n Delaware 4 years earl1er.
The reg1stered agent 0n the f1l1ng was a name 1nvest1gat0rs [mus1c] d1d n0t 1mmed1ately rec0gn1ze.
Raym0nd Ellery.
A search 0f federal empl0yment rec0rds returned a result w1th1n m1nutes.
Raym0nd Ellery, 63 years 0ld, f0rmer [sn0rts] sen10r fraud exam1ner, SSA Off1ce 0f Inspect0r General, [mus1c] ret1red 8 years ag0 after 24 years 0f federal serv1ce.
>> [mus1c] >> H1s j0b f0r nearly a quarter century had been 1dent1fy1ng exactly the k1nd 0f fraud that was n0w unf0ld1ng 1n the c0mmand r00m.
Ellery had [mus1c] spent tw0 decades learn1ng h0w dead 1dent1ty fraud w0rked.
At 9:06 a.
m.
, >> [mus1c] >> a federal judge s1gned s1multane0us search warrants f0r e1ght l0cat10ns acr0ss Maryland, V1rg1n1a, >> [mus1c] >> and Ar1z0na.
At 9:17 a.
m.
, the 0rder went 0ut.
L0cat10n 0ne, [sn0rts and mus1c] SSA Reg10nal Pr0cess1ng Center, Balt1m0re, Maryland.
Agents entered the bu1ld1ng thr0ugh the adm1n1strat1ve w1ng.
>> [mus1c] >> Gre1l’s 0ff1ce d00r was l0cked.
A fac1l1ty manager 0pened 1t under federal auth0r1ty.
>> [mus1c] >> Ins1de, agents f0und tw0 deskt0p c0mputers, an external hard dr1ve m0unted beneath the desk, and a l0cked f1l1ng [mus1c] cab1net.
The f1l1ng cab1net c0nta1ned pr1nted spreadsheets, c0lumns 0f s0c1al secur1ty numbers, dates 0f death, [mus1c] benef1t am0unts, and r0ut1ng c0des.
Every entry had a small check mark bes1de 1t.
Over 900 check marks.
[mus1c] L0cat10n tw0, H0ward Gre1l’s res1dence, Annap0l1s, Maryland.
Gre1l was h0me.
He the d00r 1n a bathr0be and d1d n0t res1st.
[mus1c] Agents rec0vered three burner ph0nes, a lapt0p runn1ng an act1ve encrypted messag1ng sess10n, and a f1repr00f d0cument safe c0nta1n1ng $340,000 [mus1c] 1n cash and a USB dr1ve.
L0cat10n three, Vantage C0mpl1ance S0lut10ns server address, [mus1c] Arl1ngt0n, V1rg1n1a.
The reg1stered address was a c0mmerc1al ma1l f0rward1ng serv1ce, [mus1c] but the serv1ce pr0v1der, presented w1th a federal warrant, pr0v1ded the phys1cal del1very address l1nked [mus1c] t0 the acc0unt.
Agents were red1rected t0 a pr1vate 0ff1ce su1te 1n a class A bu1ld1ng 1n Tys0ns C0rner.
>> [mus1c] >> Ins1de, beh1nd a false wall panel 1n the ma1n 0ff1ce, agents f0und a black rack-m0unted server runn1ng, [mus1c] act1ve, and transm1tt1ng.
Cyber analysts began extract10n 1mmed1ately.
L0cat10n f0ur, >> [mus1c] >> Raym0nd Ellery’s res1dence, McLean, V1rg1n1a.
Ellery was n0t h0me.
A ne1ghb0r t0ld agents [mus1c] she had seen h1m leave w1th luggage the prev10us even1ng.
Agents f0und the res1dence m0stly cleared 0f pers0nal electr0n1cs, but 1ns1de a h0me 0ff1ce cl0set, beh1nd stacked banker b0xes, they f0und a sec0nd server, >> [mus1c] >> smaller, p0rtable, w1th a hardw1red external battery backup.
The server was st1ll runn1ng.
A b0l0 was 1mmed1ately 1ssued f0r Raym0nd [mus1c] Ellery.
L0cat10ns f1ve thr0ugh e1ght, the reg1stered addresses 0f f0ur [mus1c] 0f the 14 shell c0mpan1es were st0rage un1ts, ma1lb0x serv1ces, and [mus1c] 0ne vacant c0mmerc1al pr0perty.
Agents rec0vered d0cument shredders, blank [mus1c] c0rp0rate f0rmat10n k1ts, and tw0 add1t10nal encrypted dr1ves.
At 10:12 a.
m.
, analysts [mus1c] began pull1ng data fr0m the Tys0ns C0rner server.
What they f0und c0nf1rmed what the 1nvest1gat10n [mus1c] had already suspected and revealed what 1t had n0t.
The server als0 c0nta1ned a sec0nd f1le part1t10n, a pr1vate arch1ve Ellery had bu1lt as [mus1c] 1nsurance.
Payment c0nf1rmat10ns t0 Greel, encrypted messages between Ellery and tw0 0ther 1nd1v1duals wh0se 1dent1t1es were st1ll be1ng w0rked.
F1nanc1al summar1es sh0w1ng Ellery’s pers0nal share 0f the 0ffsh0re d1str1but10ns 0ver 6 years.
At 11:34 a.
m.
, a Maryland State P0l1ce un1t act1ng 0n FBI 1ntell1gence l0cated Raym0nd Ellery at a pr1vate av1at10n term1nal 0uts1de Freder1ck, Maryland.
He was seated 1n a departure l0unge w1th a carry-0n bag and a 0ne-way t1cket t0 Zur1ch, Sw1tzerland b0ard1ng 1n [mus1c] 40 m1nutes.
He was taken 1nt0 federal cust0dy w1th0ut 1nc1dent.
Ins1de h1s carry-0n bag, tw0 passp0rts, [mus1c] 0ne US, 0ne under a d1fferent name 1ssued by a Car1bbean nat10n, three encrypted USB dr1ves, [mus1c] and a leather n0teb00k c0nta1n1ng handwr1tten acc0unt numbers and transfer c0des.
By 1:47 p.
m.
, federal pr0secut0rs had f1led charges aga1nst H0ward Greel, Raym0nd [mus1c] Ellery, and 42 add1t10nal 1nd1v1duals, shell c0mpany d1rect0rs, f1nanc1al 1ntermed1ar1es, a f0rmer SSA systems c0ntract0r, and tw0 bank c0mpl1ance 0ff1cers at 1nst1tut10ns [mus1c] that had pr0cessed the 0ffsh0re transfers w1th0ut f1l1ng requ1red susp1c10us act1v1ty rep0rts.
44 arrests t0tal.
[mus1c] Assets fr0zen, $340 m1ll10n 1n d0mest1c acc0unts, $180 m1ll10n 1n 0ffsh0re acc0unts 1dent1f1ed and flagged thr0ugh 1nternat10nal f1nanc1al c00perat10n agreements.
The Cayman and Cyprus acc0unts rema1ned under act1ve legal pr0ceed1ngs.
The 1,047 [mus1c] fraudulent benef1t acc0unts were suspended.
Death rec0rd rec0nc1l1at10n was 1n1t1ated acr0ss the SSA’s [mus1c] full nat10nal database, a rev1ew that, acc0rd1ng t0 federal 0ff1c1als, had n0t been c0nducted c0mprehens1vely 1n 0ver a decade.
[mus1c] The part that stayed w1th 1nvest1gat0rs l0ngest was n0t the m0ney.
It was the s1mpl1c1ty 0f the mechan1sm.
A s0c1al secur1ty number, a death rec0rd that never tr1ggered an aut0mat1c benef1t suspens10n, an 0verr1de c0de used 1,047 t1mes acr0ss 6 years, a r0ut1ng number, a shell c0mpany w1th a Delaware address.
>> [mus1c] >> A w1re transfer t0 an 1sland acc0unt.
That was the ent1re cha1n.
N0 hack1ng.
N0 system breach.
N0 s0ph1st1cated techn1cal 1ntrus10n.
[mus1c] The netw0rk d1d n0t break the S0c1al Secur1ty system.
It used the S0c1al Secur1ty system’s 0wn gaps.
The manual 0verr1de pathways.
The 1nc0mplete death rec0rd 1ntegrat10ns.
>> [mus1c] >> The 1nsuff1c1ent aud1t frequency.
And ran $2.
2 b1ll10n thr0ugh them w1th0ut tr1gger1ng a s1ngle aut0mated alert f0r nearly 6 years.
Raym0nd Ellery had spent 24 years 1ns1de the OIG [mus1c] 1dent1fy1ng exactly th0se gaps.
He had wr1tten the rep0rts.
>> [mus1c] >> He had rec0mmended the f1xes.
S0me 0f th0se rec0mmendat10ns had never been 1mplemented.
And when he ret1red, he t00k that kn0wledge w1th h1m.
The SSA’s 1nternal rev1ew, launched 1mmed1ately f0ll0w1ng the arrests, 1dent1f1ed 11 add1t10nal reg10nal pr0cess1ng centers where ADM [mus1c] level 0verr1de c0des had been used at stat1st1cally abn0rmal frequenc1es 0ver the past 4 years.
As 0f the day 0f the ra1d, th0se rev1ews were st1ll 0ng01ng.
If a fraud netw0rk th1s large c0uld 0perate f0r 6 years 1ns1de 0ne 0f the m0st trusted [mus1c] federal agenc1es 1n the Un1ted States, pr0cess1ng benef1ts f0r m1ll10ns 0f Amer1cans, 1nclud1ng the elderly, the d1sabled, [mus1c] and the deceased, h0w many 0ther 0verr1de c0des are st1ll be1ng used t0n1ght 1n pr0cess1ng centers n0 0ne has flagged yet?
