The Government Accountability Office says the Trump administration broke the law when it withheld US security aid to Ukraine last year that had been appropriated by Congress.