Yesterday a Congressional committee published a 157-page report alleging a government contractor used questionable behavior to win federal contracts that could be worth more than $500 million. The worst part: While the contractor’s methods smell bad, some of his actions appear to be in line with the letter of the law.

In case you missed it: the House Committee on Oversight and Government Reform report (pdf) focused on the recent activities of Braulio Castillo, whose company, Strong Castle, took advantage of programs that give preferential treatment to certain types of small businesses to win IT contracts from the Internal Revenue Service.

Among Strong Castle’s alleged transgressions is the abuse of a federal program that sets aside some contracts for disabled veterans. According to the report, the company qualified for the program due to a foot injury that Castillo suffered when he was a student at the U.S. Military Academy Preparatory School, even though Castillo was later well enough to play college football at the University of San Diego and didn’t complete further military service.

Strong Castle was more devious still in seeking contracts through the government’s Historically Underutilized Business Zones (HUBZone) program, intended to create jobs in economically distressed areas. To qualify, the report says, Castillo opened an office in Washington, D.C.’s Chinatown and declared it Strong Castle’s principal location, even though he continued to work out of an office in a wealthy Virginia suburb. Rather than hire poor neighborhood residents, Strong Castle hired students at nearby Catholic University—who helped the company meet HUBZone requirements, even though the school’s annual tuition exceeds $36,000, according to the report.

Of course, if you really want to cheat to win government contracts, there’s nothing better than having a friend on the inside: The report says that Castillo’s decade-long friendship with IRS Deputy Director Greg Roseman was crucial to Strong Castle’s success winning contracts. Roseman invoked the Fifth Amendment in declining to answer questions during the hearing.

Castillo, who said in a statement that he “never received preferential treatment,” wouldn’t be the first government contractor to abuse set-aside programs. In 2010, amid reports that veterans were serving as straw men for businesses controlled by others, Congress passed a law requiring the Veterans Administration to take greater pains to ensure that companies applying for certification were truly veteran-owned. That same year, the Government Accountability Office published the results of an undercover investigation of HUBZone, reporting that the program was vulnerable to fraud and abuse.

Strong Castle was stripped of its HUBZone designation earlier this year, but the report indicates that the low bar for qualification in the disabled-veterans set-aside program means that Castillo seems to have qualified. To that end, Castillo told Congressional investigators that he first considered buying a company that qualified for the program, before deciding to apply for the designation himself.

Possibly the most disturbing finding in the report has less to do with Castillo and more to do with the way the IRS’s contracting department uses small businesses to funnel jobs to larger companies. By federal law, agencies are supposed to award 23 percent of prime contracts to small businesses, as well as certain set-asides for businesses owned by women and veterans. Most agencies fall short of those goals, but the IRS met targets in the past two years. Here’s how, according to the report:

“It is not unusual for the IRS to award a large sum contract to a small disadvantaged business such as Strong Castle, only to have the bulk of the funds go to a large computer manufacturer such as IBM (IBM) or Hewlett-Packard (HPQ). This practice completely undermines the goals of these programs. It is, in fact, a ‘pass through’ because in the end, a large corporation receives the funds, and in many cases, performs the work.”