DEA administrator Michele Leonhart. Thomson Reuters

The Drug Enforcement Administration's management of its confidential sources violated guidelines and exposed the agency to potential "fraud, waste, and abuse," according to a report released by the Justice Department on Thursday.

In total, from fiscal year 2011 to 2015, the DEA shelled out over $9 million to at least 800 deactivated sources, the report found.

Doing so went against official policy with respect to its Confidential Source Program. Sources are typically "deactivated" when they have arrest warrants issued against them or have committed serious offenses.

In another instance of breaking policy, the DEA used a confidential source who had given false testimony under oath in the past. This source "was used by 13 DEA field offices" and was paid close to $500,000, according to the report.

The report also found misconduct related to "Limited Use" sources or "tipsters," who are supposed to provide information to the DEA of their own accord and without the direction of the agency. The report found that, in multiple instances, the DEA gave explicit directions to tipsters on the information it wanted from them.

Tipsters, despite requiring the least supervision by the agency, were among the highest-paid, with 477 tipsters getting a total of $26.8 million, according to the report. One airline employee who was designated as a Limited Use source was paid over $600,000 in fewer than four years. Another employee was paid over $1 million in five years.

The DEA was also found to have acted against government protocol when it paid Amtrak and Transportation Security Administration (TSA) employees a total of nearly $1.6 million for information during the time period investigated by the report.

Federal regulations currently stipulate that information can be shared between government-owned and operated entities (such as Amtrak, TSA, and the DEA) at no cost. By paying Amtrak and TSA employees for information, the DEA essentially wasted federal funds.

It's not the first instance of the DEA violated the policy.

In November 2015, the Justice Department released an investigation which found that the DEA had violated policy by paying two Amtrak workers and one TSA worker for information. This audit found that the DEA had actually paid 33 Amtrak workers and 8 TSA workers from 2011 to 2015. The agency continued to pay seven Amtrak employees even after the DOJ released the findings of its 2015 investigation. Payment continued until a new policy was instated last March.

Who the DEA paid wasn't the only issue. The Justice Department found that the DEA failed to:

appropriately track sources' activity or document information

safeguard sensitive information

adequately assess the reliability of its sources or the information provided by those sources.

Because of these gaps, the report notes that it is possible that DEA agents may have approached and questioned innocent civilians based on faulty information.

On a number of occasions, the DEA also condoned the use of "sub-sources," which the report cites as "individuals a source recruits and pays to perform activities or provide information related to the source’s work for the DEA."

In addition to having questionable reliability, these sub-sources could also have placed major liability on the DEA and DOJ if they acted illegally at any point, according to the report.

The DOJ recommended, among other things, that the DEA work in conjunction with other federal agencies to improve its management of the Confidential Source Program and to tighten regulation of sources and sub-sources.

In a written response to the report, the DEA noted that a new policy it had implemented in July addressed majority of the concerns raised by the investigation.

This is the second report the Justice Department commissioned as part of an audit of the DEA's Confidential Source Program. The report was initially commissioned in July 2015, but because of "obstacles and delays" the DEA reportedly imposed to prevent review of its program, the Justice Department was not able to release its findings until over a year later.