On October 6, 2026, the Department of Justice announced that David J. Rush, 49, of Ashburn, Virginia, pleaded guilty to executing a scheme to defraud the federal government by misusing his government position. The loss: approximately $194 million. Rush held a senior executive-level position with a federal agency and a Top Secret/SCI clearance. He is scheduled to be sentenced on January 28, 2027, and faces a maximum of 20 years in prison.
This case is not about leaked secrets. It is about something just as damaging: a trusted insider who used the language and secrecy of classified programs as cover to steal.
What Happened
According to the Department of Justice:
- Rush reached his senior position, in part, by lying about his education and military experience.
- He used his position of public trust to create fictitious government authorities, including a fabricated Special Access Program, and obtained about $193.6 million in government funds for his own benefit.
- He bought gold bars that cost the government about $46 million and directed about $145 million in wire transfers to buy luxury real estate, watches, and at least one car.
- On May 19, 2026, the FBI searched his home and recovered 298 gold bars, about $2.1 million in cash, more than €104,000, and numerous luxury watches.
- Under his plea agreement, Rush will forfeit the gold and currency, the fraudulently obtained properties, 30 watches, and two 2026 BMW Alpina vehicles.
- The CIA referred the matter to the FBI after an internal investigation. NCIS assisted, and the Director of National Intelligence requested an Intelligence Community Inspector General investigation. The Justice Department says its investigation is ongoing.
As Attorney General Todd Blanche put it, “Federal employees are entrusted with serving the American people, not themselves.”
Lessons for Every Insider Threat Program
1. Verify the résumé, not just the clearance. Rush got where he was partly by lying about his education and military experience. A clearance confirms someone passed an investigation at a point in time. It does not guarantee every claim on a résumé. Verify degrees and service records directly, and treat discovered falsehoods as a serious integrity indicator, not a paperwork issue.
2. Secrecy cannot replace oversight. A fabricated Special Access Program worked as a funding vehicle because few people are allowed to ask questions about compartmented work. Every program, especially a restricted one, needs an independent way to confirm it actually exists and is authorized before money moves.
3. Senior leaders are privileged users too. Insider threat programs often focus monitoring on system administrators and junior staff. Executives with signature authority over budgets and contracts hold some of the most dangerous access in any organization. Monitoring, separation of duties, and audit must apply at every level.
4. Follow the money and the lifestyle. Gold bars, luxury homes, and 30 luxury watches are the definition of unexplained affluence. Financial disclosure review, continuous evaluation, and coworker reporting all exist to surface exactly this kind of mismatch between salary and spending.
5. Build the path from detection to referral. This case moved forward because an internal investigation led to a referral to the FBI. Programs need clear procedures, legal coordination, and trained investigators so a concern becomes a case, not a rumor.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
We help organizations:
- Build or assess insider threat programs that cover executives and privileged users, not just the workforce
- Fuse user activity monitoring with behavioral and financial indicators to spot risk early
- Train leaders and employees to recognize and report concerning behavior, and set up the processes that turn reports into action
To talk with our team, contact info@tmpcinc.com or 813.524.6935.