The outcome categories do not line up neatly
NIH received 697 allegations of potential foreign interference involving research personnel from 2017 through 2025. It identified a disclosure violation in 264 cases, but an action by NIH or a recipient institution was not a reliable shorthand for that finding. The federal audit publicly released October 16 shows actions in 45 cases without an identified disclosure violation, while 41 cases with a violation had no action recorded.
What’s the Scoop With Broach reconstructed the four outcome groups and compared them with the detailed action table and agency explanations. Actions appeared in 223 of the 264 violation cases, or 84.5%, and in 45 of the 433 cases without an identified violation, or 10.4%. These are proportions of recorded allegation outcomes, not rates of foreign interference across all NIH-funded research.
The distinction is consequential for public accountability. Counting every sanction, restriction or removal as a proven foreign-interference violation would overstate what NIH’s categories establish. Calling every unrecorded action an agency refusal to enforce its rules would likewise omit ongoing cases and responses the database did not capture.
What happened in the no-violation group
Among 433 allegations without an identified disclosure violation, NIH removed 44 people from possible service as peer reviewers. One person was referred for government-wide suspension or debarment, and one person either resigned or had employment terminated by the recipient institution. These action counts cannot be added to get a count of distinct people: a single individual could face more than one action. The audit’s 45-case total is the appropriate distinct-case measure.
NIH officials told GAO that actions without serious or identified disclosure violations could reflect other integrity or enforcement concerns not captured by the foreign-interference categories. They cited institutional or law-enforcement investigations, peer-review integrity, research misconduct, harassment, misrepresentation and other compliance matters. Recent participation in a malign foreign talent recruitment program could also prompt peer-review removal.
The records therefore do not establish that 45 people were punished improperly, or that every person in the group was cleared of every concern. They establish a mismatch between a particular disclosure-violation field and a broader action field. Evaluating the merits of an individual action would require case records beyond this aggregate audit.
A blank action field also needs explanation
Of the 41 violation cases without recorded action, 31 involved violations NIH classified as serious. NIH’s serious categories included undisclosed foreign funding and participation in a foreign talent recruitment program; an undisclosed foreign affiliation by itself was not classified as serious. These are NIH’s administrative classifications, not findings by this publication that a person committed espionage.
Officials offered several explanations for the no-action category as of December 2025: proceedings could still be ongoing; the violation might not create a conflict warranting action; a researcher might have been approached by a program without accepting; or an institution might have required training or closer disclosure oversight not reflected in NIH’s data. The table cannot tell readers how many of the 41 belong to each explanation.
The audit also says the rare civil and criminal outcomes described in the record involved fraud charges rather than misappropriation of funded research for foreign parties. We do not relabel those outcomes as research theft. Nor do we use NIH officials’ roughly 1% estimate as a measured prevalence rate: GAO says the allegation data were not designed to estimate prevalence across the award portfolio.
A disclosure-based system still needs a risk test
The audit credits NIH with implementing 14 of 15 selected federal research-security requirements. It nevertheless finds that self-reported disclosures generally are not independently verified beyond required pre-award checks unless an allegation arises. Seven deliberately selected, nongeneralizable case studies illustrate limits in visibility, not a population-wide incidence of undisclosed foreign activity. A foreign coauthor is not by itself proof of an undisclosed foreign component.
HHS’s September 11 response agrees that NIH should periodically document a fraud-risk assessment tailored to extramural research. The response promises to incorporate applicable parts of GAO’s framework into existing risk and internal-control processes. It also identifies a training clarification NIH made in August; GAO accepted that completed change and removed the corresponding draft recommendation. Reporting two outstanding recommendations would therefore be wrong. The remaining recommendation was open on the official page October 18.
Our original contribution is separating distinct cases from overlapping actions and testing what each category can legitimately establish. We read the complete GAO-27-107848 report, methods, table 2 and actual HHS response; the report is dated October 5 and publicly released October 16. We did not interview researchers or independently access their confidential files. The public record supports stronger risk assessment and more careful interpretation of enforcement totals—not presuming guilt from nationality or innocence from a single database field.
Sources and further reading
GAO release and current recommendation status, checked October 18, 2026 ↗
Accessible full report, methods and seven case studies ↗
Photograph source and attribution: Chris Spielmann / National Cancer Institute ↗