Techdirt (RSS/Atom feed)

Everyone In This LEGO Dispute Should Have Spoken To A Lawyer Earlier Than They Did
On Techdirt, we often complain about lawyers and bad lawyering and bad cases. But there are times when lawyers are helpful, and my one-sentence summary after spending many days trying to understand a viral dispute about [checks notes] some old Star Wars LEGO sets is that a lot of people should have spoken to competent lawyers before doing… whatever the fuck they decided to do here.
If you haven’t been following the Bricks & Minifigs saga, congratulations on your peaceful existence. It’s a genuinely difficult story to track, partly because you have to watch a bunch of long YouTube videos to piece it together, and partly because almost everyone covering it is pushing a specific angle. Just as a point of reference, Bricks & Minifigs is a company that franchises its concept of stores for buying and selling lego blocks and sets — and, yes, minifigs. They have about 300 stores, most of which are franchised.
The basic summary (and some of this is disputed) is that a local Bricks & Minifigs franchise in Keizer, Oregon made an agreement with a guy named Bryan Mansell to sell a very large collection that his father had put together over many years of collectable unopened Star Wars LEGO sets. The intention of the collection had (we are told) always been to pay for college for Bryan’s children. His father, an 83-year-old man, had agreed to have Bryan sell the sets via the Keizer store on consignment. The collection was advertised, including on [the store’s Instagram page][1] where they made it clear that it was “one of the largest, most valuable privately held collections of Star Wars LEGO in the world” and that it was about to go on sale.
Later photos in that post detailed that they believed the collection was “worth well over $200,000” and that the entire collection would be sold through the store. The actual value of the legos in question is disputed, but the lowest number I’ve seen is closer to $60k. The entirety of the Instagram post text reads:
> *Saturday and Sunday, the 11th and 12th of November, the Bricks and Minifigs store in Salem-Kaiser will display one of the largest, most valuable privately held collections of Star WarsTM LEGO in the world. The event will be open to journalists and the public for photos before the collection goes on sale.*
> *In the early 90s, Ed Mansell predicted Star WarsTM LEGO would be a good investment. Over the next 15 years, he purchased approximately $20,000 of Star WarsTM LEGO and preserved them, sealed, in their original boxes. The investment really paid off. The collection is now estimated to be worth well over $200,000. Multiple sets, including the highly prized, incredibly rare Cloud City set, are now worth more than $10,000 each. Some of the individual minifigs are worth more than $1,300 each. The ten-fold increase in the value of Mansell’s collection is a greater return than if Mansell had put the same amount of money into the stock market in a Dow Jones Index Fund.*
> *When Ed Mansell decided it was time to divest, he turned to his son, Bryan Mansell. Bryan knows more about his father’s comic book and baseball card collection but didn’t feel confident in his knowledge of the LEGO secondary market. He saw the sign for the Bricks and Minifigs store while passing by on North River Road, came in, and asked the store owner, Chrystal Law, if she could help. “I told him, even if we couldn’t sell the collection, I would help him figure out how much it was worth because I didn’t want him to get ripped off. And I think that’s why he trusted me,” Law said. The entire collection will be sold through Law’s store, but first they wanted to put it all on display so the public can see it in its entirety.*
> *The collection will be on display in the store’s party room from 10am till 6pm on Saturday, November 11th, and 11am till 6pm on Sunday. The collection will be available for sale immediately, so the best time for pictures will be Saturday morning. The collection will not be stored on-site after hours for security reasons, and after Sunday the sets will be available for purchase but stored elsewhere. Bricks and Minifigs is located at 3670 River Road in Kaiser.*
Apparently, over the course of 2024, various parts of the collection were sold off and Mansell would stop by each month to collect his cut of the sales. There is a dispute over how much of the collection was actually sold before everything went off the rails in late 2024.
In November 2024, as you may have heard, Donald Trump was elected. Chrystal’s partner, Ben Gorman, runs a small publishing company called Not A Pipe Publishing, which (among other things) publishes something called the “Antifa Lit Journal.” Gorman felt like publishing such things in the US under a Trump regime might be problematic and looked into moving out of the country. As part of that, Law contacted corporate Bricks & Minifigs about selling or closing their franchise (exactly what she told them is disputed).
This next part is also disputed. Law & Gorman say corporate told them they had a franchisee who was interested in taking over the franchise. Bricks & Minifigs corporate claims that Law had told them she was shuttering the store and that she wasn’t allowed to do that, so they had to rush to reclaim the store. Almost immediately someone associated with Bricks & Minifigs, Brandon Best, showed up at the store, saying he was taking over the store and demanding the keys and that Law leave immediately. There’s also a dispute over whether or not Law & Gorman were in violation of their franchise agreement (Law & Gorman claim that the breach was due to failures by BAM corporate, which had been worked out months prior, and any claim of ongoing breach is misleading).
There’s a bit that is caught on video where Law tells Brandon and someone from the company on the phone that they have a large collection on consignment and that they owe Mansell money, and Bricks and Minifigs corporate tells Law they’ll “take on the consignment liability.”
Law and Gorman push back on Bricks & Minifigs just taking over the store, but are told by a B&M “official” name Ki McAllister (recorded by Gorman) that if they try to fight this, B&M will make their lives difficult: “If we go the legal route, it’s gonna be a very expensive battle for you and it’s not going to be a good position for you guys to get into. There’s not a whole lot of options for you. If you want to go the legal route, it’s just going to be a mess and it’s gonna be expensive for you.” When Gorman pushes back and asks if McAllister spoke “with” or “at” Crystal, McAllister admits he spoke “at” her and then says: “If you fight this, then you’re putting yourself into a whole lot of shit. I**t sounds like a threat and I can acknowledge that, because in a way it is.**“
From there, it appears corporate Bricks & Minifigs transferred the franchise to two of its partners, Joshua Johnson and Brandon Best (the guy who showed up at the store) and they just… basically denied owing Mansell anything at all or even having his legos. Or sometimes they’d admit it and sometimes they wouldn’t. It became messy. Mansell claims that the people he spoke to store gave an almost identical message to him that Ki McAllister gave to Gorman & Law that it would be too expensive for him to go to court to get back what he owes.
Mansell then reached out to YouTubers, some of whom detailed how Bricks & Minifigs appeared to have effectively stolen all these lego sets. But then (according to one of the YouTubers) Bricks & Minifigs threatened to sue them (sense a pattern?) and they took down the videos.
Mansell then contacted another YouTuber named Ben Schneider, who goes by the handle Reckless Ben — best described as a Temu Nathan Fielder. He puts himself in ridiculous situations, goes to equally ridiculous lengths to justify them, and stares blankly into the camera with that specific combination of cluelessness and overconfidence that comes from someone who has talked himself into believing every move he makes is correct.
In this case, that included (not a complete list) trying to get back Mansell’s money and/or remaining legos by going to the store, confronting the employees, confronting the owners (who were difficult to track down), showing up at Bricks & Minifigs corporate, speaking to the CEO, setting up a registered religion in order to run a raffle for the lego sets to try to make this a criminal case to get law enforcement involved (not how any of this works), filing a bunch of small claims cases against the store and the company and the owners of the store, creating a company called We Steal from Old People, setting up a “franchise” structure for We Steal from Old People to use a mirror argument of Bricks & Minifigs that he can’t be held liable for franchisee actions, putting up signs for that store, and much more.
Some of these moves are interesting. Some are genuinely clever. Many are very stupid — particularly agreeing to talk to cops without a lawyer present after being arrested (more on that shortly), and believing that tricking a store employee into signing what she thought was a delivery receipt, but which was actually an unenforceable “contract” against trespassing him, accomplished anything at all. Mostly what all of this does is generate attention, rather than anything *legally* compelling.
The one potentially legally interesting move in all of this was filing the ten separate small claims cases against the store (I won’t even get into how they were able to structure things to file the ten separate claims even though that’s interesting, because this is freaking long enough, and the details are in some of the videos below). The store refused to show up in the cases, meaning that default judgments were entered in each case. When Schneider went to the store to try to collect, he found that the store had been permanently shuttered the day after the default judgments came down (which looks very, very bad for Bricks & Minifigs and the franchise owners).
The cops get called on Schneider repeatedly through all of this. When he’s in Utah trying to confront both Bricks and Minifigs CEO Ammon McNeff and the supposed franchise owners, Joshua Johnson and Brandon Best. He tries to take Johnson to small claims court and the court tells him he needs to first try to resolve the issue with Johnson, but Johnson (who at one point offers to give Mansell the lego back if Mansell apologizes, but then doesn’t) has blocked Schneider’s phone number and calls the police when he sees Schneider and associates near his house.
At multiple points the police stop cars that Schneider is in (one time after falsely claiming they didn’t stop at a stop sign, even though the dash cam shows they clearly did) and generally appear to be harassing Schneider and his colleagues. In what appears to be a tremendously egregious move, they pull them over and hold them for hours claiming that they believe there are drugs in the car which they search for and are unable to find. Later the cops get a warrant and raid the Airbnb where Schneider and others are staying, arresting them all.
Schneider and some of the others working with him are arrested at various points for stalking and harassment, while Schneider insists he’s just trying to serve Johnson with the papers from the small claims case. There’s also an attempt to claim that the Go Fund Me campaign that Schneider set up at some point violates some law. The whole thing goes off the rails in so many ways.
Schneider also gets access to various bodycam footage, some of which is redacted in places that look sketchy but happens all the time with police body cams. Some of the bodycam footage looks damning against the police (including a couple of admissions that they don’t really think Schneider and his friends have violated the law, even if the police chief later disputes that).
Very stupidly, Schneider and his friends/colleagues repeatedly talk to cops without a lawyer present. This is a very bad thing to do. Multiple people who were arrested later put up their own videos about it, including one (the guy who was arrested for trying to lock his phone when a cop tried to take it), [who claims][2] that he’s got a high IQ so was never going to get bested by a cop (this is also a stupid thing to say).
Bricks & Minifigs’ position on all of this appears to be that (1) anything bad that happened was because of the franchise owners and not corporate, both the previous ones and the ones they arranged to take over who appear to be closely associated with corporate Bricks & Minifigs anyway, (2) Law & Gorman violated their franchise agreement in many ways and the takeover of the store was necessary because of that, (3) that Gorman & Law “stole” Mansell’s legos and the new store really didn’t have any, (4) that Gorman & Law weren’t allowed to do consignment deals in the first place (despite evidence to the contrary, including the franchise agreement that lays out that consignment is acceptable), (5) that Ki McAllister is a low level employee and his statements don’t matter (not how it works), (6) that they didn’t know about any consignment deal (clearly untrue given video evidence as well as notifications from both Law and Mansell), (7) that Schneider is only giving a one-sided account
(true, but doesn’t deal with many of the factual claims), and (8) that this is all an illegal harassment campaign against them designed to get them to pay out way more money than they owe (if they owe anything at all).
On top of all that we have competing additional civil lawsuits filed in Utah state courts and the various misdemeanor (not felony) charges against Schneider (though he claims he’s also being threatened with felony charges, though as far as I can tell none have been filed yet). Oh and the potential of criminal charges against… someone… in Oregon for the possible theft of Mansell’s collection.
Phew.
Let’s now insert some of the many videos on this. I will say that Bricks & Minifigs corporate (and the replacement franchise owners) come out of this all looking very, very, very sketchy. Ben Schneider comes out of it looking like both a hero for getting a tremendous amount of viral attention to all of this, but also kind of a dumbass for doing a bunch of very stupid things that he thinks helps his cause but don’t, which he could have avoided by… actually talking to a lawyer. Yes, Schneider got a ton of attention on the issue, but also did a ton of things that likely made everything worse for Mansell and himself.
If literally *anyone* involved had spoken to a lawyer at any point, an awful lot of this mess could have been avoided.
That’s why I’ll start with the most even-handed summary I’ve seen of the whole thing, from the always excellent Lawful Masses with Leonard French, who walks through [the legal reality in exhaustive detail][3]. It’s more complicated than any of the other coverage suggests, though yes, Bricks & Minifigs still comes out of it looking like people who took control of collectible legos they had no rights to.
Some of the key points highlighted by French that haven’t made it into most of the other videos I’ve seen:
1. Mansell should have filed a [UCC-1 financing statement][4] with the consignment to protect his property (this is genuinely useful information for anyone ever looking to sell things on consignment) but even if he didn’t do that, he’s probably protected by the “[merchant exception][5]” related to the Statute of Frauds. This is far beyond my own legal understanding, but is fascinating.
2. Mansell sent a termination letter to the new owners of the franchise, putting them on actual notice that the sets were his.
3. Mansell had a friend go in and purchase one of his sets *after* he had clearly informed the store not to sell one. As French points out, this is now a pretty clear theft case.
4. Bricks & Minifigs has some ways that they could (potentially successfully) challenge the small claims default judgments against them in Oregon, but the clock is ticking on that, and if they fail to, those judgments could follow them around.
Then as I was finishing up this already incredibly long article, I saw French has released part II, [looking at some of the filed lawsuits][6] that I discuss below and coming to similar conclusions that I do (i.e., no one comes out of any of this looking good).
Then there are some of Schneider’s amusing/cringey videos, [starting with][7] him talking about the effort to get back the legos. This is the main video that made this go viral and currently has around 3 million views.
He then published a follow up detailing how the police in American Fork [treated him and his friends][8] including stopping them multiple times and eventually raiding their AirBNB and arresting them.
And also a short video reading through and reacting to a leaked letter that Bricks & Minifigs corporate [sent to their franchisees][9] about how to deal with the controversy.
There is also a short video from Law and Gorman [regarding their side of the story][10].
Then there are the American Fork police who released [this bizarre video][11] showing their side of the story, which appears to be set in… I dunno… heaven? John Oliver’s void? The entirely white background is a freaking choice is all I’m saying. So too is the “I’m reading you a bedtime story” tone of voice from police chief in the video.
The police chief also fails to address the weird redactions in the bodycam footage, and the multiple times his cops are caught effectively admitting that Schneider and his crew weren’t actually breaking the law.
Schneider has released [a response video][12] using a similar backdrop and highlighting problems and inconsistencies with the claims in the police video.
Then there’s Bricks & Minifigs CEO Ammon McNeff going on a livestream and [doing a poor job of defending the company][13], including saying a few things that won’t do him any favors in court.
Believe it or not, there’s even more in all these videos that I don’t have time to go into, but we’re at almost 3,000 words already and we haven’t gotten to some of the competing lawsuits.
We have discussed the small claims cases (which have mostly ended in default because BAM folks ignored them) but the bigger deal are the competing lawsuits that have been filed in Utah’s state court and have received less direct attention. While it’s one thing to say things on a one-sided YouTube video, what you say in court can be a bit more serious. And we have two competing cases to look at. The first was filed by Law and Gorman and the LLC they had set up to run the Oregon store, and [filed in Utah’s Chancery Court][14] back in March.
It adds some useful details to the whole mess, including saying that the only breach they had regarding their franchise agreement with BAM corporate was… because BAM themselves refused to live up to the requirements of the agreement. Apparently Law had simply managed the store before this, but had approached corporate about taking on the franchise, which they agreed to do. But after working out a deal, the company failed to transfer the lease *and the bank account* over to Law & Gorman, which caused a bunch of problems regarding payments:
> *Shortly after the sale closed, BAM failed to fulfill its obligations to properly transfer the store’s bank account and assign the store lease to Plaintiffs’ LLC. These were not minor administrative oversights—they were fundamental obligations without which the franchisee could not operate the business. Without control of the bank account, Plaintiffs could not make the automated payments required under the Franchise Agreement. Without the lease in their name, Plaintiffs had no direct relationship with the landlord and no ability to ensure rent was paid. BAM’s failure to complete these transfers was the first material breach of the Franchise Agreement and the proximate cause of every subsequent “default” BAM later cited as grounds for termination.*
>
> *BAM did not return the bank’s documentation needed to change account ownership, causing the account to be frozen without Plaintiffs’ knowledge. As a result, automated payments for franchise royalties and for the remaining purchase price were not withdrawn as scheduled.*
>
> *Similarly, because BAM never assigned the store’s lease to BAMF Salem 1, LLC, the landlord’s notices of bounced ACH rent payments went to BAM as the tenant of record—not to Plaintiffs. BAM did not promptly inform Plaintiffs of these issues, effectively concealing the problem until it had compounded. Plaintiffs thus could not pay rent through no fault of their own: the lease was not in their name, the bank account was frozen, and the party responsible for both failures—BAM—kept Plaintiffs in the dark. BAM’s own Director of Operations later confirmed this failure on a recorded call, admitting that “the lease is technically in our name still.”*
That is a pretty bad look. Especially given that, in BAM’s own lawsuit, they claim the reason they repossessed the store and handed its franchise to someone else was… the very things that Law & Gorman say they caused. BAM corporate’s[ massive lawsuit][15] filed against Ben Schneider, Bryan Mansell, and a bunch of folks working with them (and, of course, claiming civil RICO because why not?) claims that they took back Law & Gorman’s franchise because of breaches to the agreement, such as those that Law & Gorman say were BAM’s fault n the first place (oddly, the BAM lawsuit refers to everyone by their first names, rather than last, which would be more typical).
> *Despite the foregoing plain requirements, Chrystal and Benjamin materially breached their obligations, as required APA payments were not completed, FA royalty payments became delinquent, the lease and various accounts were never properly transferred and lease amounts were unpaid. Chrystal’s outstanding contractual obligations mounted, eventually exceeding an estimated $175,000….*
>
> *… Based on the foregoing uncured breaches and anticipatory repudiation, BAM, inter alia, issued a written 11/14/24 Notice of Immediate Termination to Salem LLC pursuant to the FA, exercised its priority rights to the collateral in the Security Agreement, pre-scheduled a repossession with Chrystal and repossessed the Salem LLC store on or after 11/14/24 and assumed the lease, as expressly permitted under the FA and APA, including any and all fixtures, inventory and other assets, and credited an estimated $38,000 paltry value thereof as an offset to the unpaid $175,000 debt.*
That’s a pretty big factual dispute that the two courts are going to need to dig into.
The BAM lawsuit also claims that they had no notice of Mansell’s consignment, which is plainly bullshit given the video clip that shows up in basically all of the videos above:
> *Excepting only respecting the foregoing unpaid lease, BAM did so as a bona fide purchaser, without notice of any third party claims or liens of any kind, including Chrystal and Benjamin’s undisclosed and alleged 11/22/23 Consignment Agreement with Brian, referenced infra.*
>
> *Prior to and at the time of repossession, BAM’s representative, Brandon, conducted an informal and video inventory of the Salem LLC fixtures and inventory. While he did not locate or identify any product that was identified as consigned or not owned by Salem LLC, he concluded that the maximum value of any residual inventory was less than $38,000. Less than $5,000 worth of Star Wars LEGO product could be located and identified in the entire residual Salem LLC onsite inventory.*
This is quite a claim to make given the video evidence to the contrary, which had already gone viral by the time this lawsuit was filed last week.
There are other claims in the BAM lawsuit that seem problematic including this:
> *Bryan showed up later that day and began yelling at personnel and holding up purported consignment paperwork demanding the immediate return thereof or payment of $80,000. Josh interceded and asked to review it and briefly did so and pointed out that neither BAM (nor Josh and Brandon) were a party to this purported arrangement.*
Again, taking over the store also meant taking over the consignment liability, which they had already been made aware of and which they admitted they were taking over (as recorded in the security camera video). That they hadn’t personally been a party to the arrangement doesn’t matter, because when they took over the franchise they also took over that agreement.
The complaint then says that Johnson and Best tried to find the alleged sets owned by Mansell but were unable to do so, concluding that they were all gone. This is, obviously, contested by Mansell and others who have pointed to evidence that the sets were still in the store, including Mansell having someone go in and purchase one of the sets after he had demanded them back in a written notification.
The complaint also claims that it was only in late 2025 and early 2026 that Best was able to dig into the old franchise’s accounting system to find details of sales of what were likely many of Mansell’s legos. The complaint argues that it appears most, if not all, were sold by Law prior to the takeover and if Mansell is owed money, it’s from Law and Gorman.
> *Many months later in the fall of 2025, and only after Baker Salem had entered its 3/27/25 Business and Asset Purchase Agreement, Brandon gained access to Salem LLC’s archived and incomplete POS accounting system, which he discovered identified Star Wars “lot sets” from Star Wars regular “lots” inventory sales. This inventory sale distinction was unclear to Brandon and Josh, and Chrystal had never explained the significance, if any, to anyone, but Brandon much later in 2026 discovered that approximately 367 purchases of lot sets (for an estimated retail value of $46,000) and 336 purchase of lots (for an estimated retail value of $12,600) had occurred after 2023. He still could not, however, confirm the specific products sold (and whether they had been consigned or not).*
Then we get the RICO claims. The supposed “conspiracy”:
> *Upon information and belief, though they had no legitimate legal recourse or evidence upon which to file a claim, Chrystal, Benjamin and Bryan conspired to, inter alia, threaten, intimidate, extort and defraud Plaintiffs anyway possible, as detailed herein, including the formation of an Enterprise to engage in wrongful activities.*
>
> *As an initial step, Salem LLC caused a 12/24/24 legal demand letter to be sent to BAM, variously alleging it had been damaged based on the termination of its FA, which was a private business matter between Chrystal and Salem LLC. On 1/10/25, BAM responded, denying the allegations and providing support for its termination. Neither Salem LLC, nor Chrystal or Benjamin, thereafter pursued any claim in the letter further with BAM until 1/2/26, when a separate legal demand letter was sent, as discussed infra.*
>
> *Instead, upon information and belief and in furtherance of such threats, Chrystal, Benjamin and/or Bryan learned of Schneider and communicated with him, whereby they provided information regarding their unsupported claims against Baker Salem and/or BAM, ignoring and excluding Salem LLC and/or Chrystal’s sole obligation regarding any private consignment agreement with Bryan. In connection therewith, they, together with others (i.e., DOES 1-15) conspired to intentionally, maliciously, fraudulently and illegally threaten, extort, harass, profiteer, interfere with and damage Plaintiffs in furtherance of the Enterprise, including based on the unlawful activities described herein.*
>
> *Upon information and belief, Schneider and the Schneider Group acquired a direct or indirect financial interest in Bryan, Chrystal, Benjamin and/or Salem LLC’s unsupported claims against Plaintiffs, whereby co-Defendants (with Bryan, Chrystal, Benjamin and/or Salem LLC’s assistance and support) organized and established the Enterprise that would launch a campaign of deception, disinformation and destruction intended to cause Plaintiffs injury and damage, to extort a demand of over $200,000, to deceive and manipulate Plaintiffs, to interfere with Plaintiffs economic and family relations, to harass Plaintiffs, to cause private and public nuisances, to trespass and to otherwise engage in a pattern of unlawful activities, as described herein.*
They then claim that this “enterprise” engaged in numerous “unlawful activities” in support of the supposed conspiracy:
> *Commencing after Baker Salem began operations as a new franchisee and continuing to date, Schneider and the Schneider Group (with the support of Bryan and Chrystal) waged a malicious and intentional campaign of extortion and destruction through independent episodes of unlawful activities against Plaintiffs. Such included periodic harassment through phone calls, numerous disruptive store or office visits, repeated instances of trespass, deceptively staged events (i.e., disingenuous coronation, rally, raffle, store front table promotion, a fictitious Lego Club rally, manufactured and frivolous complaints to police, private and public nuisances, threatening phone calls, numerous deceptive live and telephonic impersonations, in person and remote threats (and via proxies), frivolous sham lawsuits (splitting claims in multiple ineffective small claims actions), etc.), issuing the Publications of defamatory and disparaging images and content, all in furtherance of the Enterprise.*
The complaint quotes Schneider’s viral video in ways that… Schneider himself made easy for them to quote. The “we have to do something illegal” is not a great line for Schneider and the other defendants in this case. They also highlight this bit, which is also not a great fact for Schneider:
> *5/21/26 YouTube Video, Minute 12:46 through 14:46 (Schneider attempted extortion and directly threatened Ammon by stating that, “if you just want to give it back now, it’s going to be a lot easier for you guys. You know, I think you guys would prefer the easy way” or “the hard way. I don’t think you guys are really going to like it”. An implied depiction of the threatened violence associated with the “hard way” is an explosion at BAM’s corporate headquarters).*
Of course it’s a bit rich for them to complain about the “easy or hard way” complaint when they apparently made similar statements to Law & Gorman as well as Mansell.
Once again, so so so much of all of this could have been avoided if either side had competent lawyers and listened to them.
Johnson and Best also claim that they tried to settle with Mansell and he rejected their offer, which they claim is evidence that “the enterprise” was seeking more than they were legitimately entitled to:
> *In late 2025 and based on co-Defendants’ ongoing harassment, Brandon and Josh further investigated the Baker Salem store inventory, and though they still could not reliably identify any product that appeared to belong to Bryan, they located a few (approximately 20) Star Wars LEGO sets in a back office lockable cupboard, on which they noticed stickers not previously recognized. As a precaution only, but still without knowledge that Bryan in fact had any right thereto, they directed that such not be sold from Baker Salem’s inventory and remain locked up pending completion of their ongoing investigation and receipt of reliable evidence of ownership and other conditions.*
>
> *On or about 12/3/25, in a text exchange between Josh and Bryan (deceptively orchestrated by Schneider) and after sustaining incredible business disruption and harm, Josh discussed a possible settlement scenario under economic duress. Purely as an accommodation (and without any legal obligation to do so), Josh discussed a possible settlement scenario to allow Bryan to retrieve the few sets that had been provisionally identified as merely Star Wars related product in the back office (i.e., described above, though not necessarily belonging to Bryan), which as a precautionary matter, Josh had set aside pending receipt of ownership documentation from Bryan. Josh indicated a written apology and other concessions would need to be made and the harassment must stop. Bryan rejected this proposal outright and responded, “Unless you are going to make us whole on the whole Lego collection, I don’t see where we have anything to discuss.” This confirmed the Enterprise’s interest. Referring to the
> sets he had identified, Josh replied, “We can give you what was left when [presumably Chrystal] left. We can’t and aren’t responsible for what she sold the two years yall were working together. If you want what she left let me know.” Bryan refused this offer. This exchange further evidenced Bryan’s objectives were not about recovering a LEGO collection, but rather about extorting payment for the Enterprise beyond any legitimate claim.*
That argument may sound good to the BAM folks, but I’m pretty sure they’re wrong when they claim they’re not responsible for what Law sold prior to them taking over, because (again) when they took over the store they took on any liabilities with the store. And that would be one of them. Also, there appears to be some evidence in the videos that some of the times they offered to return Mansell’s legos and then… didn’t.
Believe it or not, the 5,000+ words I’ve already written here barely scratches the surface.
Strip it all back and the core of this is pretty simple: an 83-year-old man’s carefully assembled lego collection — built over 15 years, meant to fund his grandkids’ college — appears to have been taken (at least in part) by people who calculated that it would cost more to fight them than to walk away. That bet almost paid off. The only reason this became a national story is that Bryan Mansell found someone willing to be very, very extremely online about it.
But “going viral” is not a legal strategy. And Schneider’s willingness to do basically anything for content — including things that are genuinely legally stupid, like talking to cops without a lawyer present, or making statements on camera that now appear in a civil RICO complaint — may have made things considerably worse for Mansell in the long run, even as it made things considerably more uncomfortable for Bricks & Minifigs in the short run. If Schneider had talked to a lawyer before doing half of what he did, he might have accomplished more with less collateral damage.
Though it might not have made such “good content.”
Meanwhile, if Bricks & Minifigs had talked to a lawyer — a good one, not just whoever is filing these complaints — they might have been advised that explicitly threatening people on recorded calls, taking over a store while explicitly acknowledging a consignment liability on video, and then denying that consignment existed in court filings, was not a sequence of events that tends to end well. And that shuttering the store the day after default judgments came down looks, to put it diplomatically, quite bad.
The deeper structural problem here — one that Leonard French articulates better than I can — is that the US legal system has a genuine dead zone around mid-five-figure disputes. Too big for small claims (even with Schneider’s claim splitting exploit), too small to justify the cost of a full civil suit, it’s exactly the range where a well-resourced defendant can make a calculated bet that the other side will run out of money or patience before getting justice. That’s a feature of the system Bricks & Minifigs happened to exploit, but is not unique to them.
The answer to that structural problem shouldn’t be “find a YouTuber willing to go to ridiculous lengths to get attention on this issue.” Though in 2026, that does appear to be working better than most alternatives — at least in the court of public opinion, where the verdict has already come in decisively on the side of Mansell and Schneider. That’s a real problem for Bricks & Minifigs and every one of their ~300 franchisees, regardless of how the legal cases resolve. You don’t get to un-become the lego store that allegedly stole an old man’s retirement collection. That story is going to follow this brand around for a long time.
None of this had to go this way. A competent lawyer on either side, at almost any point in this saga, probably changes the outcome significantly. Instead, both sides made calculated bets — Bricks & Minifigs that the costs of fighting would deter anyone from trying, and Schneider that going maximally viral would substitute for having an actual legal strategy. The first bet nearly worked. The second is still being litigated, in multiple senses of that word.
[1]: https://www.instagram.com/p/CzXGqtBPby0/?utm_source=ig_web_copy_link&img_index=2
[2]: https://www.youtube.com/watch?v=f3XfOxYmkE0
[3]: https://www.youtube.com/watch?v=14ktgvoH4Mc
[4]: https://en.wikipedia.org/wiki/UCC-1_financing_statement
[5]: https://definitions.lsd.law/merchant-exception
[6]: https://www.youtube.com/watch?v=imD2U3kCZTA
[7]: https://www.youtube.com/watch?v=wscQpkcwgNU
[8]: https://www.youtube.com/watch?v=cxZPfj8AlmY
[9]: https://www.youtube.com/watch?v=nny2ojTqW3A
[10]: https://www.youtube.com/watch?v=zedmOopRTm0
[11]: https://www.youtube.com/watch?v=IcVmSQpIPRY
[12]: https://www.youtube.com/watch?v=2YEzhDn0jY8
[13]: https://www.youtube.com/watch?v=9dmR3Flk49k
[14]: https://s3.documentcloud.org/documents/28180727/law-gorman-v-bam.pdf
[15]: https://s3.documentcloud.org/documents/28180726/bam-v-schneider.pdf
https://www.techdirt.com/2026/06/02/everyone-in-this-lego-dispute-should-have-spoken-to-a-lawyer-earlier-than-they-did/

Federal Cyber Experts Thought Microsoft’s Cloud Was “A Pile Of Shit.” They Approved It Anyway.
*This story was [originally published][1] by ProPublica.* *Republished under a [CC BY-NC-ND 3.0][2]* *license.*
In late 2024, the federal government’s cybersecurity evaluators rendered a troubling verdict on one of Microsoft’s biggest cloud computing offerings.
The tech giant’s “lack of proper detailed security documentation” left reviewers with a “lack of confidence in assessing the system’s overall security posture,” according to an internal government report reviewed by ProPublica.
Or, as one member of the team put it: “The package is a pile of shit.”
For years, reviewers said, Microsoft had tried and failed to fully explain how it protects sensitive information in the cloud as it hops from server to server across the digital terrain. Given that and other unknowns, government experts couldn’t vouch for the technology’s security.
Such judgments would be damning for any company seeking to sell its wares to the U.S. government, but it should have been particularly devastating for Microsoft. The tech giant’s products had been at the heart of two major cybersecurity attacks against the U.S. in three years. In one, Russian hackers exploited a weakness to steal sensitive data from a number of federal agencies, including the National Nuclear Security Administration. In the other, Chinese hackers infiltrated the email accounts of a Cabinet member and other senior government officials.
The federal government could be further exposed if it couldn’t verify the cybersecurity of Microsoft’s Government Community Cloud High, a suite of cloud-based services intended to safeguard some of the nation’s most sensitive information.
Yet, in a highly unusual move that still reverberates across Washington, the Federal Risk and Authorization Management Program, or FedRAMP, authorized the product anyway, bestowing what amounts to the federal government’s cybersecurity seal of approval. FedRAMP’s ruling — which included a kind of “buyer beware” notice to any federal agency considering GCC High — helped Microsoft expand a government business empire worth billions of dollars.
“BOOM SHAKA LAKA,” Richard Wakeman, one of the company’s chief security architects, boasted in an online forum, celebrating the milestone with a meme of Leonardo DiCaprio in “The Wolf of Wall Street.” Wakeman did not respond to requests for comment.
It was not the type of outcome that federal policymakers envisioned a decade and a half ago when they embraced the cloud revolution and created FedRAMP to help safeguard the government’s cybersecurity. The program’s layers of review, which included an assessment by outside experts, were supposed to ensure that service providers like Microsoft could be entrusted with the government’s secrets. But ProPublica’s investigation — drawn from internal FedRAMP memos, logs, emails, meeting minutes, and interviews with seven former and current government employees and contractors — found breakdowns at every juncture of that process. It also found a remarkable deference to Microsoft, even as the company’s products and practices were central to two of the most damaging cyberattacks ever carried out against the government.
FedRAMP first raised questions about GCC High’s security in 2020 and asked Microsoft to provide detailed diagrams explaining its encryption practices. But when the company produced what FedRAMP considered to be only partial information in fits and starts, program officials did not reject Microsoft’s application. Instead, they repeatedly pulled punches and allowed the review to drag out for the better part of five years. And because federal agencies were allowed to deploy the product during the review, GCC High spread across the government as well as the defense industry. By late 2024, FedRAMP reviewers concluded that they had little choice but to authorize the technology — not because their questions had been answered or their review was complete, but largely on the grounds that Microsoft’s product was already being used across Washington.
Today, key parts of the federal government, including the Justice and Energy departments, and the defense sector rely on this technology to protect [highly sensitive information][3] that, if leaked, “could be expected to have a severe or catastrophic adverse effect” on operations, assets and individuals, the government has said.
“This is not a happy story in terms of the security of the U.S.,” said [Tony Sager][4], who spent more than three decades as a computer scientist at the National Security Agency and now is an executive at the nonprofit Center for Internet Security.
For years, the FedRAMP process has been equated with actual security, Sager said. ProPublica’s findings, he said, shatter that facade.
“This is not security,” he said. “This is security theater.”
ProPublica is exposing the government’s reservations about this popular product for the first time. We are also revealing Microsoft’s yearslong inability to provide the encryption documentation and evidence the federal reviewers sought.
The revelations come as the Justice Department ramps up scrutiny of the government’s technology contractors. In December, the department [announced the indictment][5] of a former employee of Accenture who allegedly misled federal agencies about the security of the company’s cloud platform and its compliance with FedRAMP’s standards. She has pleaded not guilty. Accenture, which was not charged with wrongdoing, [has said][6] that it “proactively brought this matter to the government’s attention” and that it is “dedicated to operating with the highest ethical standards.”
Microsoft has also faced questions about its disclosures to the government. As ProPublica reported last year, [the company failed to inform the Defense Department][7] about its [use of China-based engineers][8] to maintain the government’s cloud systems, despite Pentagon rules stipulating that “No Foreign persons may have” access to its most sensitive data. The department [is investigating the practice][9], which officials say could have compromised national security.
Microsoft has defended its program as “tightly monitored and supplemented by layers of security mitigations,” but after ProPublica’s story published last July, the company announced that it would stop using China-based engineers for Defense Department work.
In response to written questions for this story and in an interview, Microsoft acknowledged the yearslong confrontation with FedRAMP but also said it provided “comprehensive documentation” throughout the review process and “remediated findings where possible.”
“We stand by our products and the comprehensive steps we’ve taken to ensure all FedRAMP-authorized products meet the security and compliance requirements necessary,” a spokesperson said in a statement, adding that the company would “continue to work with FedRAMP to continuously review and evaluate our services for continued compliance.”
But these days, ProPublica found, there [aren’t many people left][10] at FedRAMP to work with.
The program was an early target of the Trump administration’s Department of Government Efficiency, which slashed its staff and budget. Even FedRAMP acknowledges it is operating “with an absolute minimum of support staff” and “limited customer service.” The roughly two dozen employees who remain are “entirely focused on” delivering authorizations at a record pace, [FedRAMP’s director has said][11]. Today, its annual budget is just $10 million, its lowest in a decade, even as it has boasted record numbers of new authorizations for cloud products.
The consequence of all this, people who have worked for FedRAMP told ProPublica, is that the program now is little more than a rubber stamp for industry. The implications of such a downsizing for federal cybersecurity are far-reaching, especially as [the administration encourages agencies][12] to adopt cloud-based [artificial intelligence tools][13], which draw upon reams of sensitive information.
The General Services Administration, which houses FedRAMP, defended the program, saying it has undergone “significant reforms to strengthen governance” since GCC High arrived in 2020. “FedRAMP’s role is to assess if cloud services have provided sufficient information and materials to be adequate for agency use, and the program today operates with strengthened oversight and accountability mechanisms to do exactly that,” a GSA spokesperson said in an emailed statement.
The agency did not respond to written questions regarding GCC High.
### A “Cloud First” World
About two decades ago, federal officials predicted that the cloud revolution, providing on-demand access to shared computing via the internet, would usher in an era of cheaper, more secure and more efficient information technology.
Moving to the cloud meant shifting away from on-premises servers owned and operated by the government to those in massive data centers maintained by tech companies. Some agency leaders were reluctant to relinquish control, while others couldn’t wait to.
In an effort to accelerate the transition, the Obama administration issued its “Cloud First” policy in 2011, requiring all agencies to implement cloud-based tools “whenever a secure, reliable, cost-effective” option existed. To facilitate adoption, the administration created FedRAMP, [whose job was to ensure the security of those tools][14].
FedRAMP’s “do once, use many times” system was intended to streamline and strengthen the government procurement process. Previously, each agency using a cloud service vetted it separately, sometimes applying different interpretations of federal security requirements. Under the new program, agencies would be able to skip redundant security reviews because FedRAMP authorization indicated that the product had already met standardized requirements. Authorized products would be listed on a government website known as the FedRAMP Marketplace.
On paper, the program was an exercise in efficiency. But in practice, the small FedRAMP team could not keep up with the flood of demand from tech companies that wanted their products authorized.
The slow approval process frustrated both the tech industry, eager for a share in the billions of federal dollars up for grabs, and government agencies that were under pressure to migrate to the cloud. These dynamics sometimes pitted the cloud industry and agency officials together against FedRAMP. The backlog also prompted many agencies to take an alternative path: performing their own reviews of the products they wanted to adopt, using FedRAMP’s standards.
It was through this “agency path” that GCC High entered the federal bloodstream, with the Justice Department paving the way. Initially, some Justice officials were nervous about the cloud and who might have access to its information, which includes highly sensitive court and law enforcement records, a Justice Department official involved in the decision told ProPublica. The department’s [cybersecurity program][15] required it to ensure that only U.S. citizens “access or assist in the development, operation, management, or maintenance” of its IT systems, unless a waiver was granted. Justice’s IT specialists recommended pursuing GCC High, believing it could meet the elevated security needs, according to the official, who spoke on condition of anonymity because they were not authorized to discuss internal matters.
Pursuant to FedRAMP’s rules, Microsoft had GCC High evaluated by a so-called third-party assessment organization, which is supposed to provide an independent review of whether the product has met federal standards. The Justice Department then performed its own evaluation of GCC High using those standards and ruled the offering acceptable.
By early 2020, Melinda Rogers, Justice’s deputy chief information officer, made the decision official and soon deployed GCC High across the department.
It was a milestone for all involved. Rogers had ushered the Justice Department into the cloud, and Microsoft had gained a significant foothold in the cutthroat market for the federal government’s cloud computing business.
Moreover, Rogers’ decision placed GCC High on the FedRAMP Marketplace, the government’s influential online clearinghouse of all the cloud providers that are under review or already authorized. Its mere mention as “in process” was a boon for Microsoft, amounting to free advertising on a website used by organizations seeking to purchase cloud services bearing what is widely seen as the government’s cybersecurity seal of approval.
That April, GCC High landed at FedRAMP’s office for review, the final stop on its bureaucratic journey to full authorization.
### Microsoft’s Missing Information
In theory, there shouldn’t have been much for FedRAMP’s team to do after the third-party assessor and Justice reviewed GCC High, because all parties were supposed to be following the same requirements.
But it was around this time that the Government Accountability Office, which investigates federal programs, [discovered breakdowns in the process][16], finding that agency reviews sometimes were lacking in quality. Despite missing details, FedRAMP went on to authorize many of these packages. Acknowledging these shortcomings, FedRAMP began to take a harder look at new packages, a former reviewer said.
This was the environment in which Microsoft’s GCC High application entered the pipeline. The name GCC High was an umbrella covering many services and features within Office 365 that all needed to be reviewed. FedRAMP reviewers quickly noticed key material was missing.
The team homed in on what it viewed as a fundamental document called a “data flow diagram,” former members told ProPublica. The illustration is supposed to show how data travels from Point A to Point B — and, more importantly, how it’s protected as it hops from server to server. FedRAMP requires data to be encrypted while in transit to ensure that sensitive materials are protected even if they’re intercepted by hackers.
But when the FedRAMP team asked Microsoft to produce the diagrams showing how such encryption would happen for each service in GCC High, the company balked, saying the request was too challenging. So the reviewers suggested starting with just Exchange Online, the popular email platform.
“This was our litmus test to say, ‘This isn’t the only thing that’s required, but if you’re not doing this, we are not even close yet,’” said one reviewer who spoke on condition of anonymity because they were not authorized to discuss internal matters. Once they reached the appropriate level of detail, they would move from Exchange to other services within GCC High.
It was the kind of detail that other major cloud providers such as Amazon and Google routinely provided, members of the FedRAMP team told ProPublica. Yet Microsoft took months to respond. When it did, the former reviewer said, it submitted a white paper that discussed GCC High’s encryption strategy but left out the details of where on the journey data actually becomes encrypted and decrypted — so FedRAMP couldn’t assess that it was being done properly.
A Microsoft spokesperson acknowledged that the company had “articulated a challenge related to illustrating the volume of information being requested in diagram form” but “found alternate ways to share that information.”
Rogers, who was hired by Microsoft in 2025, declined to be interviewed. In response to emailed questions, the company provided a statement saying that she “stands by the rigorous evaluation that contributed to” her authorization of GCC High. A spokesperson said there was “absolutely no connection” between her hiring and the decisions in the GCC High process, and that she and the company complied with “all rules, regulations, and ethical standards.”
The Justice Department declined to respond to written questions from ProPublica.
### A Fight Over “Spaghetti Pies”
As 2020 came to a close, a national security crisis hit Washington that underscored the consequences of cyber weakness. Russian state-sponsored hackers had been quietly working their way through federal computer systems for much of the year and vacuuming up sensitive data and emails from U.S. agencies — [including the Justice Department][17].
At the time, most of the blame fell on a Texas-based company called SolarWinds, whose software provided hackers their initial opening and whose name became synonymous with the attack. But, [as ProPublica has reported][18], the Russians leveraged that opening to exploit a long-standing weakness in a Microsoft product — one that the company had refused to fix for years, despite repeated warnings from one of its engineers. Microsoft has defended its decision not to address the flaw, saying that it received “multiple reviews” and that the company weighs a variety of factors when making security decisions.
In the aftermath, the Biden administration took steps to bolster the nation’s cybersecurity. Among them, the Justice Department [announced a cyber-fraud initiative][19] in 2021 to crack down on companies and individuals that “put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.”
Deputy Attorney General Lisa Monaco said the department would use the False Claims Act to pursue government contractors “when they fail to follow required cybersecurity standards — because we know that puts all of us at risk.”
But if Microsoft felt any pressure from the SolarWinds attack or from the Justice Department’s announcement, it didn’t manifest in the FedRAMP talks, according to former members of the FedRAMP team.
The discourse between FedRAMP and Microsoft fell into a pattern. The parties would meet. Months would go by. Microsoft would return with a response that FedRAMP deemed incomplete or irrelevant. To bolster the chances of getting the information it wanted, the FedRAMP team provided Microsoft with a template, describing the level of detail it expected. But the diagrams Microsoft returned never met those expectations.
“We never got past Exchange,” one former reviewer said. “We never got that level of detail. We had no visibility inside.”
In an interview with ProPublica, John Bergin, the Microsoft official who became the government’s main contact, acknowledged the prolonged back-and-forth but blamed FedRAMP, equating its requests for diagrams to a “rock fetching exercise.”
“We were maybe incompetent in how we drew drawings because there was no standard to draw them to,” he said. “Did we not do it exactly how they wanted? Absolutely. There was always something missing because there was no standard.”
A Microsoft spokesperson said without such a standard, “cloud providers were left to interpret the level of abstraction and representation on their own,” creating “inconsistency and confusion, not an unwillingness to be transparent.”
But even Microsoft’s own engineers had struggled over the years to map the architecture of its products, according to two people involved in building cloud services used by federal customers. At issue, according to people familiar with Microsoft’s technology, was the decades-old code of its legacy software, which the company used in building its cloud services.
One FedRAMP reviewer compared it to a “pile of spaghetti pies.” The data’s path from Point A to Point B, the person said, was like traveling from Washington to New York with detours by bus, ferry and airplane rather than just taking a quick ride on Amtrak. And each one of those detours represents an opportunity for a hijacking if the data isn’t properly encrypted.
Other major cloud providers such as Amazon and Google built their systems from the ground up, said Sager, the former NSA computer scientist, who worked with all three companies during his time in government.
Microsoft’s system is “not designed for this kind of isolation of ‘secure’ from ‘not secure,’” Sager said.
A Microsoft spokesperson acknowledged the company faces a unique challenge but maintained that its cloud products meet federal security requirements.
“Unlike providers that started later with a narrower product scope, Microsoft operates one of the broadest enterprise and government platforms in the world, supporting continuity for millions of customers while simultaneously modernizing at scale,” the spokesperson said in emailed responses. “That complexity is not ‘spaghetti,’ but it does mean the work of disentangling, isolating, and hardening systems is continuous.”
The spokesperson said that since 2023, Microsoft has made “security‑first architectural redesign, legacy risk reduction, and stronger isolation guarantees a top, company‑wide priority.”
### Assessors Back-Channel Cyber Concerns
The FedRAMP team was not the only party with reservations about GCC High. Microsoft’s third-party assessment organizations also expressed concerns.
The firms are supposed to be independent but are hired and paid by the company being assessed. Acknowledging the [potential for conflicts of interest][20], FedRAMP has encouraged the assessment firms to confidentially back-channel to its reviewers any negative feedback that they were unwilling to bring directly to their clients or reflect in official reports.
In 2020, two third-party assessors hired by Microsoft, Coalfire and Kratos, did just that. They told FedRAMP that they were unable to get the full picture of GCC High, a former FedRAMP reviewer told ProPublica.
“Coalfire and Kratos both readily admitted that it was difficult to impossible to get the information required out of Microsoft to properly do a sufficient assessment,” the reviewer told ProPublica.
The back channel helped surface cybersecurity issues that otherwise might never have been known to the government, people who have worked with and for FedRAMP told ProPublica. At the same time, they acknowledged its existence undermined the very spirit and intent of having independent assessors.
A spokesperson for Coalfire, the firm that initially handled the GCC High assessment, requested written questions from ProPublica, then declined to respond.
A spokesperson for Kratos, which replaced Coalfire as the GCC High assessor, declined an interview request. In an emailed response to written questions, the spokesperson said the company stands by its official assessment and recommendation of GCC High and “absolutely refutes” that it “ever would sign off on a product we were unable to fully vet.” The company “has open and frank conversations” with all customers, including Microsoft, which “submitted all requisite diagrams to meet FedRAMP-defined requirements,” the spokesperson said.
Kratos said it “spent extensive time working collaboratively with FedRAMP in their review” and does not consider such discussions to be “backchanneling.”
FedRAMP, however, was dissatisfied with Kratos’ ongoing work and believed the firm “should be pushing back” on Microsoft more, the former reviewer said. It placed Kratos on a “corrective action plan,” which could eventually result in loss of accreditation. The company said it did not agree with FedRAMP’s action but provided “additional trainings for some internal assessors” in response to it.
The Microsoft spokesperson told ProPublica the company has “always been responsive to requests” from Kratos and FedRAMP. “We are not aware of any backchanneling, nor do we believe that backchanneling would have been necessary given our transparency and cooperation with auditor requests,” the spokesperson said.
In response to questions from ProPublica about the process, the GSA said in an email that FedRAMP’s system “does not create an inherent conflict of interest for professional auditors who meet ethical and contractual performance expectations.”
GSA did not respond to questions about back-channeling but said the “correct process” is for a third-party assessor to “state these problems formally in a finding during the security assessment so that the cloud service provider has an opportunity to fix the issue.”
### FedRAMP Ends Talks
The back-and-forth between the FedRAMP reviewers and Microsoft’s team went on for years with little progress. Then, in the summer of 2023, the program’s interim director, Brian Conrad, got a call from the White House that would alter the course of the review.
Chinese state-sponsored hackers had infiltrated GCC, the lower-cost version of Microsoft’s government cloud, and stolen data and emails from the commerce secretary, the U.S. ambassador to China and other high-ranking government officials. In the aftermath, Chris DeRusha, the White House’s chief information security officer, wanted a briefing from FedRAMP, which had authorized GCC.
The decision predated Conrad’s tenure, but he told ProPublica that he left the conversation with several takeaways. First, FedRAMP must hold all cloud providers — including Microsoft — to the same standards. Second, he had the backing of the White House in standing firm. Finally, FedRAMP would feel the political heat if any cloud service with a FedRAMP authorization were hacked.
DeRusha confirmed Conrad’s account of the phone call but declined to comment further.
Within months, Conrad informed Microsoft that FedRAMP was ending the engagement on GCC High.
“After three years of collaboration with the Microsoft team, we still lack visibility into the security gaps because there are unknowns that Microsoft has failed to address,” Conrad wrote in an October 2023 email. This, he added, was not for FedRAMP’s lack of trying. Staffers had spent 480 hours of review time, had conducted 18 “technical deep dive” sessions and had numerous email exchanges with the company over the years. Yet they still lacked the data flow diagrams, crucial information “since visibility into the encryption status of all data flows and stores is so important,” he wrote.
If Microsoft still wanted FedRAMP authorization, Conrad wrote, it would need to start over.
A FedRAMP reviewer, explaining the decision to the Justice Department, said the team was “not asking for anything above and beyond what we’ve asked from every other” cloud service provider, according to meeting minutes reviewed by ProPublica. But the request was particularly justified in Microsoft’s case, the reviewer told the Justice officials, because “each time we’ve actually been able to get visibility into a black box, we’ve uncovered an issue.”
“We can’t even quantify the unknowns, which makes us very uncomfortable,” the reviewer said, according to the minutes.
### Microsoft and the Justice Department Push Back
Microsoft was furious. Failing to obtain authorization and starting the process over would signal to the market that something was wrong with GCC High. Customers were already confused and concerned about the drawn-out review, which had become a hot topic in an online forum used by government and technology insiders. There, Wakeman, the Microsoft cybersecurity architect, deflected blame, saying the government had been “dragging their feet on it for years now.”
Meanwhile, to build support for Microsoft’s case, Bergin, the company’s point person for FedRAMP and a former Army official, reached out to government leaders, including one from the Justice Department.
The Justice official, who spoke on condition of anonymity because they were not authorized to discuss the matter, said Bergin complained that the delay was hampering Microsoft’s ability “to get this out into the market full sail.” Bergin then pushed the Justice Department to “throw around our weight” to help secure FedRAMP authorization, the official said.
That December, as the parties gathered to hash things out at GSA’s Washington headquarters, Justice did just that. Rogers, who by then had been promoted to the department’s chief information officer, sat beside Bergin — on the opposite side of the table from Conrad, the FedRAMP director.
Rogers and her Justice colleagues had a stake in the outcome. Since authorizing and deploying GCC High, she [had received][21] [accolades][22] for her work modernizing the department’s IT and cybersecurity. But without FedRAMP’s stamp of approval, she would be the government official left holding the bag if GCC High were involved in a serious hack. At the same time, the Justice Department couldn’t easily back out of using GCC High because once a technology is widely deployed, pulling the plug [can be costly and technically challenging][23]. And from its perspective, the cloud was an improvement over the old government-run data centers.
Shortly after the meeting kicked off, Bergin interrupted a FedRAMP reviewer who had been presenting PowerPoint slides. He said the Justice Department and third-party assessor had already reviewed GCC High, according to meeting minutes. FedRAMP “should essentially just accept” their findings, he said.
Then, in a shock to the FedRAMP team, Rogers backed him up and went on to criticize FedRAMP’s work, according to two attendees.
In its statement, Microsoft said Rogers maintains that FedRAMP’s approach “was misguided and improperly dismissed the extensive evaluations performed by DOJ personnel.”
Bergin did not dispute the account, telling ProPublica that he had been trying to argue that it is the purview of third-party assessors such as Kratos — not FedRAMP — to evaluate the security of cloud products. And because FedRAMP must [approve the third-party assessment firms][24], the program should have taken its issues up with Kratos.
“When you are the regulatory agency who determines who the auditors are and you refuse to accept your auditors’ answers, that’s not a ‘me’ problem,” Bergin told ProPublica.
The GSA did not respond to questions about the meeting. The Justice Department declined to comment.
### Pressure Mounts on FedRAMP
If there was any doubt about the role of FedRAMP, the White House [issued a memorandum][25] in the summer of 2024 that outlined its views. FedRAMP, it said, “must be capable of conducting rigorous reviews” and requiring cloud providers to “rapidly mitigate weaknesses in their security architecture.” The office should “consistently assess and validate cloud providers’ complex architectures and encryption schemes.”
But by that point, GCC High had spread to other federal agencies, with the Justice Department’s authorization serving as a signal that the technology met federal standards.
It also spread to the defense sector, since [the Pentagon required][26] that cloud products used by its contractors meet FedRAMP standards. While it did not have FedRAMP authorization, Microsoft marketed [GCC High][27] as meeting the requirements, selling it to companies such as Boeing that research, develop and maintain military weapons systems.
But with the FedRAMP authorization up in the air, some contractors began to worry that by using GCC High, they were out of compliance. That could threaten their contracts, which, in turn, could impact Defense Department operations. Pentagon officials called FedRAMP to inquire about the authorization stalemate.
The Defense Department acknowledged but did not respond to written questions from ProPublica.
Rogers also kept pressing FedRAMP to “get this thing over the line,” former employees of the GSA and FedRAMP said. It was the “opinion of the staff and the contractors that she simply was not willing to put heat to Microsoft on this” and that the Justice Department “was too sympathetic to Microsoft’s claims,” Eric Mill, [then GSA’s executive director for cloud strategy][28], told ProPublica.
### Authorization Despite a “Damning” Assessment
In the summer of 2024, FedRAMP hired a new permanent director, government technology insider [Pete Waterman][29]. Within about a month of taking the job, he restarted the office’s review of GCC High with a new team, which put aside the debate over data flow diagrams and instead attempted to examine evidence from Microsoft. But these reviewers soon arrived at the same conclusion, with the team’s leader complaining about “getting stiff-armed” by Microsoft.
“He came back and said, ‘Yeah, this thing sucks,’” Mill recalled.
While the team was able to work through only two of the many services included in GCC High, Exchange Online and Teams, that was enough for it to identify “issues that are fundamental” to risk management, including “timely remediation of vulnerabilities and vulnerability scanning,” according to a summary of the team’s findings reviewed by ProPublica.
Those issues, as well as a lack of “proper detailed security documentation” from Microsoft, limit “visibility and understanding of the system” and “impair the ability to make informed risk decisions.”
The team concluded, “There is a lack of confidence in assessing the system’s overall security posture.”
A Microsoft spokesperson said in a statement that the company “never received this feedback in any of its communications with FedRAMP.”
When ProPublica read the findings to Bergin, the Microsoft liaison, he said he was surprised.
“That’s pretty damning,” Bergin said, adding that it sounded like language that “would’ve generally been associated with a finding of ‘not worthy.’ If an assessor wrote that, I would be nervous.”
Despite the findings, to the FedRAMP team, turning Microsoft down didn’t seem like an option. “Not issuing an authorization would impact multiple agencies that are already using GCC-H,” the summary document said. The team determined that it was a “better value” to issue an authorization with conditions for continued government oversight.
While authorizations with oversight conditions weren’t unusual, arriving at one under these circumstances was. GCC High reviewers saw problems everywhere, both in what they were able to evaluate and what they weren’t. To them, most of the package remained a vast wilderness of untold risk.
Nevertheless, FedRAMP and Microsoft reached an agreement, and the day after Christmas 2024, GCC High received its FedRAMP authorization. FedRAMP appended a cover report to the package laying out its deficiencies and noting it carried unknown risks, according to people familiar with the report.
It emphasized that agencies should carefully review the package and engage directly with Microsoft on any questions.
### “Unknown Unknowns” Persist
Microsoft told ProPublica that it has met the conditions of the agreement and has “stayed within the performance metrics required by FedRAMP” to ensure that “risks are identified, tracked, remediated, and transparently communicated.”
But under the Trump administration, there aren’t many people left at FedRAMP to check.
While the Biden-era guidance said FedRAMP “must be an expert program that can analyze and validate the security claims” of cloud providers, the GSA told ProPublica that the program’s role is “not to determine if a cloud service is secure enough.” Rather, it is “to ensure agencies have sufficient information to make these risk decisions.”
The problem is that agencies often lack the staff and resources to do thorough reviews, which means the whole system is leaning on the claims of the cloud companies and the assessments of the third-party firms they pay to evaluate them. Under the current vision, critics say, FedRAMP has lost the plot.
“FedRAMP’s job is to watch the American people’s back when it comes to sharing their data with cloud companies,” said Mill, the former GSA official, who also co-authored the 2024 White House memo. “When there’s a security issue, the public doesn’t expect FedRAMP to say they’re just a paper-pusher.”
Meanwhile, at the Justice Department, officials are finding out what FedRAMP meant by the “unknown unknowns” in GCC High. Last year, for example, they discovered that [Microsoft relied on China-based engineers to service their sensitive cloud systems][30] despite the department’s prohibition against non-U.S. citizens assisting with IT maintenance.
Officials learned about this arrangement — which was also used in GCC High — not from FedRAMP or from Microsoft but from [a ProPublica investigation into the practice][31], according to the Justice employee who spoke with us.
A Microsoft spokesperson acknowledged that the written security plan for GCC High that the company submitted to the Justice Department did not mention foreign engineers, though he said Microsoft did communicate that information to Justice officials before 2020. Nevertheless, Microsoft has since ended its use of China-based engineers in government systems.
Former and current government officials worry about what other risks may be lurking in GCC High and beyond.
The GSA told ProPublica that, in general, “if there is credible evidence that a cloud service provider has made materially false representations, that matter is then appropriately referred to investigative authorities.”
Ironically, the ultimate arbiter of whether cloud providers or their third-party assessors are living up to their claims is the Justice Department itself. The recent indictment of the former Accenture employee suggests [it is willing][32] to use this power. In a court document, the Justice Department alleges that the ex-employee made “false and misleading representations” about the cloud platform’s security to help the company “obtain and maintain lucrative federal contracts.” She is also accused of trying to “influence and obstruct” Accenture’s third-party assessors by hiding the product’s deficiencies and telling others to conceal the “true state of the system” during demonstrations, the department said. She has pleaded not guilty.
There is no public indication that such a case has been brought against Microsoft or anyone involved in the GCC High authorization. The Justice Department declined to comment. Monaco, the deputy attorney general who launched the department’s initiative to pursue cybersecurity fraud cases, did not respond to requests for comment.
She left her government position in January 2025. Microsoft hired her to become its president of global affairs.
A company spokesperson said Monaco’s hiring complied with “all rules, regulations, and ethical standards” and that she “does not work on any federal government contracts or have oversight over or involvement with any of our dealings with the federal government.”
[1]: https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government
[2]: https://creativecommons.org/licenses/by-nc-nd/3.0/
[3]: https://www.fedramp.gov/archive/2017-11-16-understanding-baselines-and-impact-levels/
[4]: https://www.cisecurity.org/about-us/leadership/tony-sager
[5]: https://www.justice.gov/opa/pr/senior-manager-government-contractor-charged-cybersecurity-fraud-scheme
[6]: https://fedscoop.com/government-contractor-fedramp-compliance-justice-department-army-veterans-affairs/
[7]: https://www.propublica.org/article/microsoft-china-defense-department-cloud-computing-security
[8]: https://www.propublica.org/article/microsoft-digital-escorts-pentagon-defense-department-china-hackers
[9]: https://www.propublica.org/article/microsoft-china-defense-department-digital-escorts-investigation-warning
[10]: https://www.fedramp.gov/2025-09-30-fedramp-built-a-modern-foundation-in-fy25-to-deliver-massive-improvements-in-fy26/
[11]: https://github.com/FedRAMP/roadmap?tab=readme-ov-file#how-fedramp-delivers
[12]: https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf
[13]: https://www.fedramp.gov/ai/
[14]: https://www.slideshare.net/slideshow/fedramp-conceptofoperationsconops/11524944
[15]: https://www.justice.gov/jmd/page/file/964941/dl?inline
[16]: https://www.gao.gov/assets/gao-20-126.pdf
[17]: https://www.justice.gov/opcl/department-justice-statement-intrusion-department-s-microsoft-o365-email-environment
[18]: https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers
[19]: https://www.justice.gov/archives/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative
[20]: https://www.propublica.org/article/microsoft-china-defense-department-cloud-computing-security
[21]: https://meritalk.com/event/fitara-awards-fedramp-celebration/
[22]: https://web.archive.org/web/20221117133526/https://fedscoop.com/list/fedscoop-announces-the-winners-of-the-2022-fedscoop-50/
[23]: https://www.propublica.org/article/microsoft-white-house-offer-cybersecurity-biden-nadella
[24]: https://help.fedramp.gov/hc/en-us/articles/27704465482139-How-does-a-company-become-a-FedRAMP-recognized-third-party-assessment-organization-3PAO-How-is-the-independence-and-quality-of-a-3PAO-validated
[25]: https://bidenwhitehouse.archives.gov/omb/management/ofcio/m-24-15-modernizing-the-federal-risk-and-authorization-management-program-fedramp/
[26]: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
[27]: https://techcommunity.microsoft.com/blog/publicsectorblog/support-for-fedramp-in-microsoft-365-government-gcc-high/4112262
[28]: https://www.gsa.gov/about-us/newsroom/news-releases/gsa-announces-new-political-appointee-01022024
[29]: https://www.fedramp.gov/archive/2024-08-27-welcoming-a-new-leader-for-a-new-fedramp/
[30]: https://www.propublica.org/article/microsoft-tech-support-government-cybersecurity-china-doj-treasury
[31]: https://www.propublica.org/article/microsoft-digital-escorts-pentagon-defense-department-china-hackers
[32]: https://www.hoganlovells.com/en/publications/doj-brings-individual-criminal-charges-for-fedramp-fraud-what-government-contractors-need-to-know
https://www.techdirt.com/2026/04/01/federal-cyber-experts-thought-microsofts-cloud-was-a-pile-of-shit-they-approved-it-anyway/