When you think of a federal sting operation involving weaponry and military gear, the Government Accountability Office doesn’t immediately jump to mind. The office is tasked with auditing other federal agencies to root out fraud and abuse, usually by asking questions and poring over paperwork.

This year, the agency went a little more cowboy. The GAO created a fictitious law enforcement agency — complete with a fake website and a bogus address that traced back to an empty lot — and applied for military-grade equipment from the Department of Defense.

And in less than a week, they got it.

A GAO report issued this week says the agency’s faux cops were able to obtain $1.2 million worth of military gear, including night-vision goggles, simulated M-16A2 rifles and pipe bomb equipment from the Defense Department’s 1033 program, which supplies state and local law enforcement with excess materiel. The rifles and bomb equipment could have been made functional with widely available parts, the report said.

“They never did any verification, like visit our ‘location,’ and most of it was by email,” said Zina Merritt, director of the GAO’s defense capabilities and management team, which ran the operation. “It was like getting stuff off of eBay.”

In its response to the sting, the Defense Department promised to tighten its verification procedures, including trying to visit the location of law enforcement agencies that apply and making sure agents picking up supplies have valid identification, the GAO report said. The department also promised to do an internal fraud assessment by April 2018.

A Defense Department spokesman declined to comment further.

The sting operation has its roots in the 2014 fatal police shooting of Michael Brown in Ferguson, Mo. At the time, many were surprised to see law enforcement respond to protests with armored trucks, sniper rifles, tear-gas bombs and other weapons of war.

Reporting by The Marshall Project and others found that much of the equipment came from the obscure 1033 program, which dates back to the Clinton era. Any equipment the U.S. military was not using — including Humvees, grenades, scuba-diving gear and even marching-band instruments — was available to local cops who could demonstrate a need.

The program has transferred more than $6 billion worth of supplies to more than 8,600 law enforcement agencies since 1991.

After Ferguson, then-President Barack Obama issued an executive order prohibiting the military from giving away some equipment and deeming other equipment “controlled,” establishing strict oversight and training requirements for law enforcement agencies that wanted it. The order also required a Defense Department and Justice Department working group to ensure oversight.

But since President Donald Trump took office, the group has not met, according to the Constitution Project, a bipartisan thinktank that had been participating in the meetings. Trump has said that he will revoke Obama’s executive order, although he has not yet.

Congress ordered the GAO to look into the program last year. A survey of local law enforcement did not turn up any instances of outright abuse at the state level but did find one illegitimate agency that had applied as a federal entity and was approved for equipment, Merritt said.

That’s when the agency launched the sting. Contrary to its public image, GAO has snagged other agencies with undercover work in the past, including an investigation of the Affordable Care Act in which the agency submitted fictitious applications and was approved for subsidized healthcare coverage.

In this case, the GAO created the fake law enforcement agency — whose name the agency would not reveal — and claimed it did high-level security and counterterrorism work. Once approved, the agency easily obtained the items from a Defense Department warehouse of unused military goods.

Jim Pasco, executive director of the Fraternal Order of Police, which lists rescinding Obama’s executive order one of its top priorities for the Trump administration, said the possibility of fraud does not indict the whole program.

“It suggests only that the U.S. military is one of the world’s largest bureaucracies and as such is going to have some lapses in material control,” Pasco said. “Law enforcement is going to get that equipment and we’re going to use it, to protect both officers and civilians. And if we don’t get it free from the military, we’re going to have to buy it with taxpayer dollars.”

But to Madhuri Grewal, senior counsel for the Constitution Project, and other opponents of police militarization, the problem is more fundamental.

“There just aren’t many everyday policing uses for military equipment like this,” Grewal said. “The question is why can real law enforcement agencies get some of this stuff, let alone fake ones?”