A new report by the Pentagon’s internal watchdog found that two major federal contractors submitted more than $91 million—and possibly as much as $123 million—in questionable costs on a contract to support the military’s fight against drug-funded terrorism. The Project On Government Oversight obtained the May 13 report, which is labeled “For Official Use Only” and is otherwise available only through a Freedom of Information Act request.

The Department of Defense Inspector General (DoD IG) investigated a whistleblower hotline tip that Northrop Grumman and DynCorp International overcharged the government for services on a Counter Narco-terrorism Technology Program Office (CNTPO) contract. The IG found that Northrop, the prime contractor, and DynCorp, a subcontractor, knowingly applied excessive labor rates on the contract from October 2007 through March 2013, billing $91.4 million for 360 DynCorp employees who did not possess the required qualifications. The companies might have also improperly billed the government $10 million for 33 other employees, and $21.7 million for labor that exceeded the 8-hours-per-day/40-hours-per-week work schedule stipulated in the contract ($3.2 million of that was for employees recorded as working more than 24 hours in a day).

For example, the IG found that Northrop charged the government $1.2 million for one DynCorp employee classified as a program manager, even though he lacked a bachelor’s degree—the primary requirement for the position. In another example, Northrop classified an employee as a depot aircraft mechanic, a senior general engineer, an integrated logistics manager, a quality assurance manager, a program manager, a senior pilot, and a senior technical writer. Northrop billed 16,270 hours over a 5-year period for this apparent jack-of-all-trades, receiving nearly $2 million. However, the IG found that the employee’s work history and education only qualified him as a mechanic, and only 161 of his hours were properly billed. Northrop also submitted questionable labor charges for 33 other DynCorp employees whose qualifications the IG could not determine because DynCorp did not provide their résumés. (According to the report, DynCorp could not provide the résumés because “some personnel files were archived and extremely difficult to obtain.”)

Most astonishing is the finding that Northrop and DynCorp got away with billing more hours than are in a day. Northrop charged $3.2 million for 29,401 labor hours in excess of 24 hours per day. One employee billed 1,208 labor hours over a 12-day period (that’s more than 100 hours per day!), resulting in an overpayment of $176,900. Northrop billed an additional $1.5 million for employees it claimed had worked between 20 and 24 hours in a day.

When we sought comment from both companies about the report, Northrop Grumman told POGO that it has been cooperating with the DoD IG “for some time on their investigation into the conduct of one of our subcontractors on the CNTPO contract.” DynCorp responded to POGO that it is also cooperating with investigators, and that the company “has complied fully with our obligations under the subcontract, and nothing improper was submitted by [DynCorp] to our customer.”

Certainly, a large share of the blame must go to the contracting officers at the Army Contracting Command-Redstone Arsenal, who relied on Northrop to verify employees’ qualifications and did not adequately review contractor invoices prior to approving payment. Job Number One for a government contracting officer is safeguarding the government’s interest by ensuring compliance with the terms of the contract. In the context of this contract, then, you could say that the Army failed to protect the country.

The report makes no mention of sanctions or legal actions against Northrop or DynCorp, aside from seeking a refund for the improper charges. Nor is there an indication that the Army personnel managing the contract faced any sort of discipline.

This is particularly surprising given the checkered history of the CNTPO program. The DoD IG reviewed the program in 2011 and found that weak contract oversight by the Army—specifically, the failure to adequately review contractor invoices—resulted in overpayments of $815,000 to Raytheon, $168,279 to Northrop, and $77,000 to U.S. Training Center (part of the company once known as Blackwater). DoD IG’s analysis of CNTPO in 2009 also highlighted problems with contract oversight and management.

The DoD IG noted in last week’s report that the five CNTPO support contracts the Army awarded in 2007 (to ARINC, Lockheed Martin, Northrop Grumman, Raytheon, and Blackwater) have a potential value of $15 billion and fund activities throughout Asia, Africa, and Latin America. Yet according to national security reporter Spencer Ackerman, who profiled CNTPO for Wired magazine in 2011, the office’s oversight staff at that time consisted of only 10 contracting officers.

The latest troubling assessment of CNTPO makes us wonder how extensive contractor overbilling and other abuses are throughout the program. If oversight staff is indeed spread so thin that contractors are basically being left to their own devices with regard to billing, the Army has two choices: either significantly beef up contract management or insource the work.

Finally, it bears repeating that the government will be recouping tens of millions of taxpayer dollars thanks to the action of a whistleblower. Whistleblowers truly are the first line of defense against fraud, waste, and abuse. This is why they need to be protected and encouraged to speak out.