No one is yet sure how much money appropriated under the CARES Act last spring was expended on fraudulent loans. But for the second big chunk of business relief spending, enacted last week, the Small Business Administration has revised its procedures. Gary Shiffman teaches national security at Georgetown University and is the founder and CEO of Giant Oak and Consilient. He talked to Federal Drive with Tom Temin about what he’s been seeing.
Federal News Network's Cyber Industry Exchange: Where does cybersecurity end and physical security begin for federal agencies? Find out at Federal News Network’s Industry Exchange: Cyber.
Tom Temin: Gary, good to have you back.
Gary Shiffman: Tom, it’s great to be back with you. Thank you.
Tom Temin: And we spoke last summer about the inability perhaps of SBA to be able to see into the data to know where the loans were going. But also some rules made it easier for businesses, they might have been intending to get money being overlooked. What’s different this time around?
Gary Shiffman: Yeah, Tom. So the big, the bargain, the trade off, if you will, that we talked about last time was we have to get money out into people’s hands as quickly as possible, because there’s real suffering in the economy, and people need the money. But we also want to try to deter fraud, waste, and abuse. And we talked about how it was going to be a banner year for fraud in the United States and globally. And I think the data will show that, in fact, was a banner year, unfortunately for fraud in the United States and around the world. What’s happening now is the Biden administration has come in and they’ve put some new rules in place around the PPP program, to further get money out quickly, and to address the fraud issue. So I think we’re just collectively getting smarter about the PPP program and we’re learning a lot and we’re starting to incorporate those lessons learned and I think this is all just goodness, and we’re moving in the right direction.
Tom Temin: So what should be a good oversight regime then? Because I think the whole oversight and review setup from the CARES Act is barely in gear at this point.
Gary Shiffman: Yeah, that’s right. So what, the purpose of law enforcement is to deter crime from ever happening. And sometimes people miss that point, because we focus on catching the perpetrators of crime and arresting and convicting them. The goal is not to arrest and convict more and more people. But goal is to be so good at identifying crime, and imposing a punishment on a crime that people choose just not to do it. And that’s what we’re missing out on. So in this bargain that I just talked about, to get money out into people’s hands as quickly as possible. We are unfortunately incentivizing crime, or we’re not disincentivizing crime. And so that’s why there’s this massive spike in fraud. What we need to do is realize that screening upfront, screening upfront has to be a part of getting the money out the door quickly. It’s a false choice that you can either deter fraud or you get the money out the door quickly. Technology enables us to do both. And I think we need to get past this false dichotomy or this false choice of you have to do one or the other, we have to do both.
Tom Temin: Because when you look at trying to get money into the hands of micro businesses, single person or two person types of businesses, which is one way of getting more equitable, I guess, and more even distribution of the money among everybody, it becomes harder to establish, I think, is this really a business or just someone who calls themselves or whatever, just to get a chunk of dough? How does the federal government possibly know this? You could check if the person has a D&B number, or if they’re registered with a state authority that licenses businesses, that kind of thing. So how can you make sure basically, individuals or very tiny operations are who they say they are?
Gary Shiffman: Right. That’s exactly right. That’s a great question. So the, when we first did PPP, if you recall, one of the big criticisms beyond the fraud point that I raised, is that only the kind of the larger, more established companies were getting the money or they were getting it faster. And, you know, rural companies, minority owned companies, companies of less than 20 people, sole proprietors, independent contractors were at the end of the line, and were disproportionately neglected in the first tranche. The Biden administration is now prioritizing this class of businesses. And I think again, this is a good lesson learned and we’re moving in the right direction. The other thing that they’re adding, or that the SBA is adding, is they are putting responsibility on the SBA for clearing and vetting businesses. So before the SBA gave the money to the banks and the banks were were solely responsible for doing the vetting in that business, a legitimate business. SBA is now responsible for that vetting. And they have to pass SBA fraud, SBA fraud checks, as well as database checks, public records checks, and in the banking world they’re very, very familiar with something called an adverse media check. Adverse media is casting a very wide net across publicly available information to determine are people who they say they are? Do they have the employees they say they have? Are they running the businesses that they say that they do? And this is what the SBA needs to incorporate is these wider checks that the banking industry is already very familiar with.
Tom Temin: We’re speaking with Gary Shiffman, founder and CEO of Giant Oak Search Technology, also a professor of national security at Georgetown University. This information then is in public databases, and it becomes a matter of, what, subscribing to the right data, and then doing some sort of analytic approach to it?
Gary Shiffman: Yeah, that’s right, the the data are available and out there. We did a study in my own firm, where we looked at the first 70 cases brought by the Department of Justice for felony fraud under the PPP program. And according to our internal research, a full 20% of the cases brought by the Department of Justice never should have been issued, like the loan should have never been granted in the first place. It just proved the fact that the checks were not happening. So the capability to do both, this idea that we have to get beyond this false dichotomy between you either get the money out quickly, or you do the screening, is you adopt technology. So machine learning, artificial intelligence technologies today allow us to do large scale, high speed screening of populations in a way that allows you to kind of break this knot of having to choose between one or the other. We can do large scale screening, we can mitigate risk, we can deter fraud, which is the goal, not to catch fraud, but deter fraud from ever happening, and get money into the hands of the struggling businesses, and the people in the independent contractors and people wherever they are. We can get it into their hands quickly. And the answer is we just need to adopt technologies that exist. It’s machine learning. It’s artificial intelligence. We live in that era. It’s already here. One of the things that happened that the banking industry knows really well, Tom, is that the one year, after a year of Coronavirus, digital transformation, which is a topic I know you’ve covered, digital transformation is only accelerating, it’s accelerating throughout the banking industry. It’s accelerating in government agencies. This has to happen in the SBA program, so that way we can deter the fraud, deter the crime, and get the money out the door quickly.
Tom Temin: Because at some point, this becomes almost surveillance in a sense. Suppose someone is just by the innate nature of their business, I’ll make up one, say they build homes, and they’re not a massive, publicly traded home builder, but just a private operator, they may have two or three full time employees and use a bunch of 1099’s to do framing. That’s a small micro business, and it would qualify for a loan. But shouldn’t The program also know well, maybe he applied for a loan, but how would you know if also they might have landed a $3 million mansion contract three days earlier?
Gary Shiffman: Right. It’s a great question. And I think there are limits to what a government agency can and should do. There are three kinds of fraud that we’ve seen after the first year of PPP. There are people who claim to have a business that doesn’t actually exist. There are people who have a business but fraudulently claim more employees or more higher paid employees than they have, and there are people who have a business who rightly claimed the number of employees but use the money for fraudulent purposes. I think those are the patterns that we’ve seen over a year. And I think that’s where we need to focus on which is, is a PPP applicant, do they actually have a business? And is that business, do they actually employ 10 people like they claim or do they employ 10 people and yet they claim to employ 100 people? A lot of the fraud that the law enforcement that the DOJ has identified has been really kind of simple, basic people just lying and saying, well, I have 100 employees, and they all make $150,000 a year exactly. Like things like that, we shouldn’t be tripping up on these anymore. We should be doing the screening, we should be doing the vetting to identify is the business real? And does the business have about the number of employees that they claim to have? And I think if we do that, Tom, I think that’s a pretty straightforward, simple step, and it will deter most of the crime that we’ve seen after the first year.
Tom Temin: Gary Shiffman is founder and CEO of Giant Oak Search Technology, teaches national security at Georgetown University. Thanks so much.
Gary Shiffman: Thanks, Tom. Appreciate it.