There’s a $400 million question facing the Pentagon’s largest contractor, KBR, the former Halliburton subsidiary responsible for more than 50,000 personnel in Iraq and billions in government contracts: Will the mammoth corporation be forced to repay the government nearly half a billion dollars because it hired private security forces in Iraq, including Blackwater USA, when the Army itself was supposed to be providing it with protection?

It’s a scandal that has been brewing for more than two years, kept alive largely through the efforts of Representative Henry Waxman. The California Democrat has been on a warpath against Halliburton and KBR almost since the Bush Administration took power in 2000. But it was actually an incident involving the private military company Blackwater USA that sparked the current controversy, which could result in the hefty KBR repayment to the government.

It began with one of the most iconic incidents of the Iraq War: the March 31, 2004, ambush of four Blackwater contractors in the Sunni city of Falluja. The men were burned, dragged through the streets and strung from a bridge. For many in Congress–and the broader population–it was the first they had heard of private soldiers operating in the war zone. Finding out who exactly they were working for in Falluja that day would take nearly three years.

As Waxman investigated the circumstances surrounding the ambush, one fact in particular bothered him: The contract the Blackwater men were working under indicated that they were ultimately servicing KBR. For its part, KBR initially denied this, and Waxman became increasingly frustrated that for eighteen months he could not get the military, KBR or any of the companies involved to explain whom taxpayers were ultimately paying for the Blackwater security services, and how much.

That question was finally answered in early February, when Waxman convened a heated hearing of the House Government Reform and Oversight Committee to investigate the Falluja incident: The contract was indeed traceable to KBR.

This was a complete about-face. Tina Ballard, the Army’s head contracting officer, had assured the same committee six months earlier that Blackwater had not been hired under a KBR subcontract.

But during the February hearing, Ballard said that “after extensive research” it turned out her earlier statements had been wrong. Further, she said that if KBR “knowingly or unknowingly incurred costs for private security subcontractors…the US Army will take appropriate steps under the contract terms to recoup any funds paid for those services.” At the end of the hearing, Ballard announced that the Army would dock KBR $20 million now that it was clear that–under several layers of subcontracts–Blackwater had in fact been hired.

But this is not just a matter of secretive markups, tacked on through the subcontracting maze and passed on to the taxpayers. KBR may have knowingly violated military policy, which effectively bans its contractors from engaging any security other than official US forces.

Under the terms of KBR’s master contract, the Army is specifically tasked with providing force protection for KBR’s thousands of employees. Since 2002 KBR has held what is known as the LOGCAP III contract, which stands for Logistics Civil Augmentation Program. Under that contract it provides support services for the Army ranging from serving meals to delivering fuel, washing laundry and delivering mail, duties that used to be handled by the Army itself.

An official military document called LOGCAP 101 explains that “contractors and their employees are not combatants, but civilians accompanying the force. This status must not be jeopardized by the ways in which they provide contracted support. The government has a duty to provide them with Force Protection for this reason.” Indeed, in a July 2006 letter to Waxman, then-Secretary of the Army Francis J. Harvey (who recently resigned in the wake of the Walter Reed scandal) asserted, “Under the provisions of the LOGCAP contract, the US military provides all armed forces protection from KBR unless otherwise directed.”

At the February hearing George Seagle, director of security for KBR’s government and infrastructure division, admitted that “KBR uses private security on our non-LOGCAP work and, in certain circumstances, our LOGCAP subcontractors did, as well.” The theory seemed to be that while KBR, under its LOGCAP contract, could not directly hire private security, its subcontractors could do whatever they wanted.

Here’s the problem: The line Seagle floated to Congress is contradicted by KBR’s own internal communications dating back nearly three years, when KBR officials appeared to be not only aware of the general prohibition against hiring private security under LOGCAP but also aware that if any of KBR’s subcontractors used private forces, that was tantamount to KBR using them.

In a June 2004 e-mail, KBR’s lead administrator for the LOGCAP contract, James Ray, told other company officials, “Our contract states that the government provides us with force protection…. We should not attempt to effect a material change in our contract with the government by hiring a company that we know uses armed escorts. That company is an agent of KBR and if anything happens KBR is in the pot with them. Even with lipstick, a pig is a pig. This decision is something to address squarely…. I do not recommend proceeding with this option without senior management’s approval.”

Despite that e-mail, the lipstick apparently was still on the pig three years later, as KBR’s Seagle seemed to assert that KBR’s subcontractors were entitled to hire private security. Not so, says the Army. Not only that, but the military has now begun an extensive audit of KBR’s and its subcontractors’ relationships with private security in Iraq.

The situation could be so serious for KBR that, as the company officially informed its investors a month after the Waxman hearing, it might be forced to return up to $400 million in payments stemming from alleged subcontracted private security services in Iraq.

Many disturbing questions linger: If the Army was responsible for providing security for KBR’s 50,000 employees, why didn’t it do so? Is the command and control in Iraq in such disarray that $400 million in private security services that should have been provided by the Army was not, and no one noticed? Did no one realize that tens of thousands of private soldiers were performing the Army’s security duties?

Apparently not–at least officially.

Republican Representative Tom Davis, the committee’s ranking member, asked Tina Ballard, “Does the Army have enough personnel on the ground to support military convoys for the LOGCAP subcontractors? Do you know the answer to that?”

“I don’t have the answer to that, sir,” Ballard replied.

As the hearing progressed, both KBR and Army officials professed ignorance as to how security was–or was not–being provided to the 50,000 people working under KBR. Much to the amazement of legislators, not only did they not know, they seemed to not want to know.

Republican Representative Chris Shays asked Seagle whether one of KBR’s subcontractors would have to “eat that cost” of providing its own security.

“LOGCAP contracts state that the military will provide our force protection,” Seagle replied.

“And you don’t think it’s being provided adequately, and you choose to get security, contract out security–you’re allowed to do that, but then you have to pay the cost?” Shays asked.

“We haven’t asked any subcontractors to contract for security,” Seagle said. According to the Army, KBR never asked it for protection either. Ballard told the committee the military has “in writing from KBR that [neither] they, nor any of their subs, ever requested in writing for this security.”

When Seagle said that he didn’t know whether one of his subcontractors had negotiated with Blackwater for security, Shays shot back, “OK, I understand you don’t know, but it’s not comforting because what it’s like is, you can be Pontius Pilate and wash your hands of it. In other words, you contract with someone else, they get the job done and it’s their responsibility and not your responsibility. That’s what you’re saying.”

Seagle continued to insist that he had no idea who his subcontractors employ, frustrating Shays. “I’m going to just tell you what I think,” Shays told him. “I think you should know. I think the system should somehow require it. I think there should be some responsibility to it…. I just can’t believe that if I were doing a contract for a building and I was subcontracting, that I would be oblivious to who my subcontractors were dealing with.”

Shays then turned his attention to Ballard and said, “I’m surprised that you can’t give us an idea of the number of contracts and the number of contracts in-theater. Is that because you just tired out from the first and then from then on, you don’t feel you have an interest or a responsibility to know who they subcontracted? In other words, once you put out that contract, whoever is subcontracted is not your interest or responsibility?”

Ballard stumbled in her response, mentioning a “quality surveillance plan” for contractors before Shays cut her off. “I don’t know what that means,” he said. “I honestly don’t.”

In the bigger picture, $400 million is a drop in the bucket to KBR–the company has raked in more than $17 billion from Iraq-related work since 2003. But what remains unanswered is why alarm bells weren’t sounded about tens of thousands of civilians running around Iraq, servicing the military, apparently without protection? And why, if KBR was supposed to be provided with security, did it not request it, since it would have avoided having to pay private companies? Did KBR and an overstretched Army essentially collude in a “don’t ask, don’t tell” policy regarding security in Iraq?

KBR and the Army are apparently still negotiating whether the company will be stripped of the $400 million it is estimated that its subcontractors spent on private security. KBR says the Army has informed the company it will dock KBR “unless [KBR] can provide timely information sufficient to show that such action is not necessary to protect the government’s interest. We are working with the Army to provide the additional information they have requested.”

It took nearly two years for the Army and KBR to provide Waxman with details of the contract that resulted in it being docked $20 million for using Blackwater’s security services. KBR has sixty days before the Army begins suspending payments. It will be interesting to see if its ability to answer questions drastically improves. That is the $400 million question.