The warning

Scott Stillman

A digital-forensics supervisor at the Minnesota Department of Human Services who, in March 2017, told his supervisors in writing that organized-crime cases were defrauding Minnesota programs of hundreds of millions of dollars a year and that money was leaving the country. In May 2018 he said it to the state Senate. In March 2026 he said it again, under oath, to the House Fraud Committee.

Source: Minnesota House of Representatives, Public Information Services · original. Played here unaltered except as noted on this page; rights remain with the publisher.

Playing: his statement to the House Fraud Committee, March 23, 2026 · then the chair's questions

Transcript of his testimony (machine transcript, checked against the video for quotes)

Thank you, Chair, Robbins, for having me here today.
Welcome to the committee.
Please state your name for the record and begin your testimony.
My name is Scott Stillman, and I have a brief statement I'd like to say.
I'd like to lay out a brief outline of why I'm here today, how I got to this point.
Can you all hear me okay?
My background is in law enforcement as a white-collar fraud investigator.
I also worked in the private sector, and I've received training in many areas,
including five advanced courses and investigative topics at the Federal Law
Enforcement Training Center.
In 2007, I was hired at DHS, and I was later promoted to be the supervisor
of the DHS's forensic lab.
In approximately 2011, I was informed DHS was receiving reports from citizens
about daycare frauds.
Because of this, my job duties expanded to include daycare,
Medicaid, and Medicare fraud investigations.
In approximately 2015, I became concerned about what I was seeing
in the digital evidence I analyzed, and I began providing verbal warnings to,
I'm just going to use redacted because I don't have the ability
to get an attorney to protect me here, so I'm just going to not name names.
In 2016, DHS and I were served with an unrelated tort and defamation lawsuit.
On March 13, 2017, I mailed, redacted my concerns about the daycare fraud.
Drafting my concerns in an email was fraught with risk, but I had been verbally
warning DHS senior managers repeatedly over the last year, but their responses
consisted of inaction or the excuse that it was impossible to detect
and fight frauds involving collusion.
On March 28, 2017, I emailed, redacted again about fraud concerns,
including what I described as a systemic problem at DHS of fraud and lack
of control to prevent fraud.
Meanwhile, the lawsuit was progressing.
The Attorney General lawyers asked me about work I had conducted
for another state agency.
The AG lawyers reported they received information and discovery
about a possible issue causing them great concern.
I told the lawyers in an email the case they were concerned
about was something DHS senior staff above me had conducted.
Conducting work as a DHS employee for a company that held contracts
with DHS was against policy, was potentially illegal.
On May 5, 2017, redacted entered the digital forensics lab
with the hard drive from his DHS computer.
He instructed one of my staff to erase the drive in his presence.
That hard drive was under the lawsuit preservation order
at the time.
In June of 2017, DHS and AG lawyers informed me the lawsuit required me
to sign a plea agreement stating I had made false statements.
This was less than three months after I wrote my whistleblower emails
about daycare fraud and possible national security issues.
Prior to this, I was told the lawsuit was weak
and I had nothing to worry about.
The settlement DHS and the AG polls required me
to admit the things I did not do.
I refused to sign it and pointed out to the AG attorneys
that they did not interview key witnesses
about a relevant contract issue.
When I pressed them on this, they moved ahead to interview only two
of three witnesses concluding there was no proof
that the contract matter occurred.
I later told my business attorney about this finding
that he was astonished stating the lawsuit's discovery located
emails about the contract issue.
Nevertheless, I was told I was required
to sign the lawsuit statement.
I refused.
This back and forth continued for about two weeks
that the AG lawyers sat me down in a conference room
where they said, number one, you are required
to sign this plea agreement.
Number two, we know you did not do these things
but we don't care.
Number three, if you did not sign the plea agreement,
DHS will settle their portion of the lawsuit,
pull all my legal representation, leaving me with all
of the obligations of the lawsuit
and DHS would testify against me.
Number four, this plea agreement is in the best interest
of the state.
Number five, we think you will survive this.
DHS and the AG abruptly changed course
after I wrote that whistleblower emails exposed my flank
and it forced me underdressed to sign a plea agreement
destroying my credibility.
They wore me down and eventually I felt
I had no choice but to sign the settlement.
After the settlement meeting, the AG lawyers told me
they found something in discovery that would hurt the state
and they needed to settle to protect the state.
This was the second time they told me this.
In January 2020, DHS mailed me copies of the emails
related to the lawsuit.
And that mailing was a letter from DHS saying
I was prevented from disclosing the contents
of the emails to anyone.
That requirement from DHS prevents me
from disclosing the DHS emails I have
that include my protest to suddenly lawsuit
showing you exculpatory evidence
or disclosing information clearing my conduct.
On December 22nd, 2017, my supervisor informed me
HR had removed my supervisory status.
I took the rest of the day off
and resigned the following day.
It is my belief DHS used their positions,
knowledge and immense power
to force a settlement on me for two purposes.
They've senior entities, state entities
from the liabilities of the lawsuit
and to destroy my credibility in light of the issues
I brought up in my March, 2017 emails.
The end result was I was smeared with the label of a liar.
I lost my job, my career, my business and my reputation.
Possibly the biggest fraud perpetrated
against the citizens of Minnesota
wasn't necessarily the theft of public funds.
It was how the government ignored
and covered up my findings,
hiding the truth from the public.
Thank you.
Thank you, Mr. Stillman.
So I think since you're at the witness table,
I'll start with questions for you
and maybe others have them as well.
So my first question is the emails you referenced,
are they still, I know you cannot disclose them,
but do they still exist to your knowledge?
The emails regarding my lawsuit,
yes, I have copies of those, yes.
Right, but you can't disclose them.
Do they still exist sort of in DHS world
that you're aware of?
If they done, fairly certain they would,
I'm not 100% certain, but if they did,
they'd be in their legal servers.
Okay, so could you go back
and I would like to drill down more on your work
as at the forensics lab.
So my understanding is that DHS,
at that time when the childcare fraud first came up,
that you, at the forensics lab,
as part of a DHS criminal investigative unit
that was larger than the forensic lab,
there were other people involved,
that you did look at wire transfers.
I've spoken to another source
who had particularly worked on the wire transfer issue,
as well as people who were involved at that time
in looking at the role of the Hualas.
And my understanding from your work
and their work is that how,
if you could just sort of describe,
like they would set up surveillance at these daycares.
They had subpoenas for cell phones and computers
and were doing forensic analysis.
Can you explain what the scope of the work was
at that time at DHS
when there was criminal investigations going on?
This scope was enormous.
We were doing search warrants.
At one point we were doing two search warrants a week.
We would do search warrants all over Minnesota,
but primarily in Minneapolis,
Ramsey County, Hennepin County.
The Office of Inspector General, OIG,
I think that your referencing,
was run by a retired state patrol captain,
highly claimed, highly respected captain.
And he managed most of the investigations.
He had a list on the wall of his office,
listing all of the daycares that had,
he had received information about relevant fraud.
He collected most of the top ones,
nothing under a million.
And I can't recall how many were on that list.
I want to say there were a hundred.
I can't swear that.
It was a long list.
And he had the names of the daycares
and the dollar amounts of frauds.
And that tallied roughly a hundred million dollars.
And that was his estimation based on the fraud.
He and his staff would conduct investigations,
interviews, they would set up surveillance cameras
around the suspected daycare that were committing the fraud.
They would watch the businesses for,
on average three months to record who came and went.
I helped them with some of the technical issues
on that surveillance system
and how to analyze it a little more quickly.
My job was when they set up a search warrant,
I would go with, I would grab the computers,
the laptops, the cell phones, the servers,
the networks, the video surveillance systems
and anything else that we found.
And then we would take that back to the lab
where we would analyze it.
Most of the evidence we found was in the cell phones.
Some of them we had to get translated.
But in the cell phones, I would see apps overseas,
company apps for transfer and money.
I would see wire transfers.
There would be comments and things of that nature.
And that evidence, by the way, still exists.
It's at the DHS Forensics Lab evidence
from where I started.
It's still there.
All of it is.
My emails, the evidence I'm talking about wire frauds,
all the issues.
I've got some emails here regarding our concerns
about terrorism and funding.
All the evidence for that, all the proof for that exists
at the DHS lab.
Some of it exists at the Office of Legislative Auditors
as well.
Thank you.
So could you describe how the,
so the nexus of our committee is that
some money was stolen for fraud.
And then some of that fraudulently obtained money
was transferred through bank accounts or shell companies
to places through the Huala Network overseas.
And that's the point at which,
according to our colleagues in the federal government
and others, we lose sight of where the money goes.
But because some of it is going to regions controlled
by Al-Shabaab in Somalia and other places,
they expect that at a minimum,
some of it was directly funding terrorism
as we have those court cases from 2012.
But by far, it seems like the most indirect route
is that when money is sent overseas,
they take the terrorist organizations, take a cut of it.
So can you explain on this side of the money transfer,
how the shell companies worked,
how the money transfers worked, what you were looking for?
And because the concern for us is once it leaves the country
in suitcases, we don't get it back.
So how do we spot that on the front end
and what were you looking for?
And are those, now that the criminal investigation unit
DHS is no longer functioning, who does that work?
When we would do the preliminary intelligence analysis
on these businesses, we would see if they were registered
with the state as a corporation or LLC,
and we would track the owners.
And we found that the ownership would change,
sometimes monthly, so that one month there'd be
one board and then another and another,
making it very difficult to track and prove ownership.
The shell companies, which are basically
a fraudulent company, a non-existing company
that was just used on paper to start a business.
I'm sorry, can you speak a little closer to the mic?
Thank you.
The shell companies, which were just fraudulent
or non-existing companies that were used
to collect money for a business.
But we found what the OIG's team found was
DHS's computer systems paid these companies
typically at three o'clock in the morning.
It was an automatic bank transfer.
And from there on, the bank fraud investigator
that was looking at these transactions,
he would see that these transactions would go
into their business account, and then within seconds
it would go into, be transferred to another account.
And in seconds of that, it would be transferred
into another account.
In seconds of that it would be transferred
into another account.
It would go through 50 different bank accounts
around the world and usually end up
in the United Arab Emirates or Dubai,
which once it got there, banking laws
and US laws don't apply.
So it goes into an area that can't be tracked
for the most part.
Now, there was a case, one of the first cases
I worked on, which was the Salama case.
It was an enormous case.
I think I got that from Ramsey County Attorney's Office
and it's been a few years,
but I think it was 100 computers, phones, servers.
And it was enormous.
And I uncovered Excel spreadsheets
in that trove of evidence.
And now DHS was paying that company Salama
through their computer system.
But this company, and I believe it's possible
this was the precursor to feeding our fraud.
This company would pay another company,
a restaurant in Minneapolis,
to provide food for the children.
And that restaurant, if memory serves me correctly,
was involved with recruiting young people
to join El Shabaab.
I had the spreadsheet showing thousands of dollars
being funneled directly to that restaurant.
And from there it can be transported into cash.
And what they do with it from there is a little different.
Now I went into one business on another search warrant
in South Minneapolis and immediately encountered
the owner and the gentleman had a,
it wasn't a suitcase, it was a duffel bag.
And it was roughly two to three feet long,
foot wide, foot high, it was full of cash.
And he, I was curious about it.
And he said, well, I'm a member of the Huala.
I'm on my way to the airport right now
and I'm gonna take this cash overseas.
And he was very open about it.
And so I've seen some of the money going through Huala.
It was astonishing to see the different ways
that this could be done.
Now, I don't know if this answers your question,
but I have an email here
that may give a little bit of light on that.
Jay Swanson, the member of the OIG, the manager there.
This is an email I got from the Freedom of Information Act.
And it's dated April 30th, 2015.
And it says, and we were trying to get some computer logs.
They're called internet protocol logs, IP logs.
So just to give you some background,
it's like when the post office delivers a letter,
it goes to an address from,
it goes from like Texas to Minneapolis,
and they have to find out where it goes to.
So there's a zip code, there's a city,
a street address and a house address.
That's what an IP log is in the computer system.
So we were trying to find that because this individual
who was associated with, I believe, Salama,
had a laptop and she was back and forth
overseas all the time.
And there were some concerns,
and I'll just give you a brief summary of it here.
Jay's writing to the minute technical system.
He says, to shed some light on the importance
of these types of cases,
this provider is believed to have over bill DHS
and the Child Care Assistance Program
an excessive $1 million in calendar year 2014
with over billing continuing at the same rate
for calendar year 2015.
To make matters worse, we have seen evidence
that very quickly after the DHS funds
are electronically deposited in the account
as a child care center owner,
they are quickly wired to other accounts
in the Middle East.
We have reason to believe that those funds
are a means of financing for
one or more terrorist organizations.
Just to be clear, while this case is our most pressing,
we have a number of others just like this,
of the same magnitude,
that will be coming up in the upcoming months.
It is vital to our investigations.
So DHS paid these daycares through,
I believe it was the MEC squared billing system.
And we discovered when we wanted to find out
who was billing and where they were billing from,
that the MEC squared system
was not designed to include IP numbers.
It was, it's a major oversight.
It'd be like buying a brand new car that didn't have brakes.
It's a basic and computer system.
If you ask any computer person out there,
your home router has IP address tracking on it.
This system did not.
So that meant, so that told us
we weren't able to tell who was billing,
when they were billing or where they were billing from.
So we went to, Jay and I went to Minut,
the state's IT department,
and we said, look, we had this.
This is the email that was part I just read to you.
We said, we need these IP addresses.
Well, we don't really have that,
and it's impossible to do that.
We need to do that.
So after some negotiating, a gentleman over there,
a very smart person, set up a temporary IP trap.
And he had it, it took him a while,
but he was able to trap the IP numbers.
And he saw people from Japan
logging into our state system to bill for CCAP.
And that's all documented.
And the evidence is at the DHS lab,
and it probably has evidence of it.
So that case, because we suspected
that lady had ties to terrorism,
we could only get her on wire fraud.
We couldn't get her on anything more from that
because the system wasn't designed to detect fraud.
Thank you.
So do you know if the DHS system,
that temporary trap was only, I think,
up from my reading a couple weeks?
Two weeks.
Two weeks.
So does DHS now have the capability to track IP addresses?
I do not know.
I don't know, after the time I left, I was told no.
But what's happened in the last seven, eight years,
I don't know.
So why would the system be set up without that ability
when it's kind of standard on most computers?
I would be hesitant to give an answer to that.
Okay, thanks.

What the committee report says about him

The committee particularly thanks Faye Bernstein, Scott Stillman and Jay Swanson, who it says spoke out years ago at great personal and professional cost and stepped forward again to share their stories. p. 12Faye Bernstein, Scott Stillman and Jay Swanson, who spoke out years ago at great personal and professional cost
Scott Stillman, who headed the forensic analysis lab at DHS, testified with Jay Swanson that the effort to minimize their findings and end criminal investigations pressured employees and let CCAP fraud continue basically unhindered. p. 18Whistleblowers, including Jay Swanson and Scott Stillman, who had headed up the forensic analysis lab at DHS, testified
The summary says allegations that CCAP money was sent overseas to support terrorism were downplayed despite two criminal convictions and forensic evidence uncovered by Stillman. p. 21despite two criminal convictions and forensic evidence uncovered by Scott Stillman

The record, in order

Stillman March 2017 emails to DHS supervisors 2017-03-01 document
FOX 9: suitcases of cash at MSP, CCAP fraud 2018-05-13 article
Stillman, Senate HHS Reform Finance and Policy 2018-05-15 hearing
MPR: Stillman prior false statements (Lanterman) 2018-05-18 article
OLA CCAP Assessment of Fraud Allegations 2019-03-13 document
Stillman testimony cut, Dave the Lawyer 2025-12-30 video
Fraud Committee: Cash leaving MSP and itnternational remittances oversight concerns 2026-03-23 hearing
Stillman, NewsNation 2026-03-30 video

What the record establishes. Stillman warned in writing in March 2017 and testified in May 2018; investigators in the CCAP unit broadly agreed with him on the scale, and the 2019 auditor called him honorable and talented.

What it does not. The 2019 auditor could not substantiate the $100 million-a-year figure or terrorist use of CCAP money. That is not a finding that the fraud was small. A 2016 defamation settlement over statements about a competitor is a caveat about him, not about the CCAP warrants.