A single missing letter in an email address cost Sensis Inc. its shot at challenging a five-year Secret Service advertising contract. In a decision issued September 15, 2026, the Government Accountability Office dismissed the Glendale, California small business's protest as untimely, ruling that an email sent to "[email protected]" instead of the correct "[email protected]" never counted as a filing at all — in Sensis Inc., B-424694.7.
The underlying fight was over serious money and a long runway: a single-award, five-year indefinite-delivery, indefinite-quantity contract for the Secret Service's national recruitment advertising campaign, solicited under RFP No. 70US0926R70093666. Recruitment advertising for a federal law enforcement agency is not a small line item — a five-year IDIQ of this kind typically covers everything from digital and broadcast media buys to creative production across a sustained hiring push. The Department of Homeland Security component picked Avvy, LLC, a small-business joint venture based in Fairfax, Virginia, over Sensis, a small business of its own out of Glendale, California. Sensis wanted GAO to take a second look at that award decision. Instead, the case never got that far — it turned entirely on whether a protest ever legally existed in the first place.
How a GAO System Outage Set Up the Fatal Typo
Sensis did not simply forget to protest. The company tried to file electronically through GAO's Electronic Protest Docketing System (EPDS) on August 3, 2026, the last day of its 10-day protest window, and could not create an account. GAO's decision confirms the problem was real and on GAO's end, not Sensis's: "Our records confirm that EPDS was experiencing a limited, systemwide technical error on August 3, at the time the protester was attempting to create an EPDS account and file its protest."
That kind of outage is exactly the scenario GAO has a fallback for. When EPDS is down, GAO's posted instructions tell protesters to email their protest directly to a specific backup address rather than lose their filing window. Sensis followed that instinct — it just typed the address wrong, dropping the "s" from "[email protected]." GAO was unambiguous about the consequence: "The protester, however, used an incorrect email address, sending the protest to '[email protected],' rather than to the designated address, '[email protected].' Filing is not accomplished by emailing a protest document to any other address in GAO."
Why GAO Rejected the Good-Cause Argument
Sensis's remaining hope was GAO's "good cause" exception, which can excuse a late or defective filing when the protester's failure stems from circumstances genuinely outside its control — an unexpected system failure, for instance, rather than a party's own error. Sensis had a real argument that the EPDS outage was unexpected. But GAO drew a sharp line between the outage itself, which GAO acknowledged, and what Sensis did in response to it. The agency had already told protesters exactly what to do if EPDS failed, and Sensis did not do it correctly.
GAO's decision put the responsibility squarely on the protester: "It was the protester's failure to follow these EPDS instructions that resulted in Sensis's inability to file a timely protest." The good-cause exception, GAO explained, is not a general safety net for any mistake connected to a bad day at the docketing system — it requires that the protester's inability to file result from something "unexpected or unanticipated," and a typo in a published, previously announced email address does not qualify. As GAO put it: "However, we do not find that the protester's inability to file its protest was the result of a development that was unexpected or unanticipated."
The result is that GAO never reached the substance of Sensis's challenge to the Avvy award at all. Whatever arguments Sensis had about the Secret Service's evaluation, the cost comparison, or the joint venture's qualifications went unexamined, because the protest was procedurally dead the moment it landed in the wrong inbox. Avvy's five-year IDIQ for Secret Service recruitment advertising stands undisturbed, and the agency proceeds with a contractor whose award was never tested on the merits.
What It Means for Contractors
The lesson here is uncomfortable but simple: GAO's 10-day protest clock does not bend for administrative bad luck, and it especially does not bend for a protester's own clerical error made while trying to work around that bad luck. A contractor watching its filing window close because of a GAO system failure is not automatically protected — it still has to execute the posted contingency procedure exactly, character for character. An email address that is one letter off is treated the same as no email at all.
For government contractors preparing to protest, especially small businesses without in-house protest counsel handling every filing, the practical takeaway is to build redundancy into the filing process itself: confirm the exact destination address from GAO's current instructions at the moment of filing rather than from memory or a saved contact, and consider sending backup copies to multiple verified recipients when a primary electronic system is down and the clock is running out. It is also worth having a second person on the team independently read back the address character by character before the email goes out, since a solo filer racing a deadline is exactly the scenario in which a typo like this one slips through. Protest deadlines at GAO are jurisdictional in practice — miss one on a technicality, even a one-character technicality caused by GAO's own outage, and there is no path back to a merits review, no matter how strong the underlying challenge to the award might have been.
The decision also underscores that GAO treats its own systemwide failures and a protester's response to them as two separate legal questions. Acknowledging that EPDS broke down does not excuse whatever a company does next if that response itself falls short of the posted instructions. Contractors who find themselves locked out of EPDS during a live protest window should treat the backup email address as being just as procedurally strict as the electronic system it is replacing — because GAO plainly does, and it dismissed a fully substantive protest over exactly that distinction.
