"Seems like the sub should cough up their chunk too. "
Every contract that I've had, it's part of the responsibility of the subcontractor to verify hours claimed. Typically by reconciling the claim against the end client's timesheet program, or even getting end client's timesheet data directly.
So whoever was signing off on this guys' timesheets (whether an NSA line manager or the subcontractor's project manager ) for 6 months + without noticing almost double hours claimed vs worked should be looked at
Biting the hand that feeds IT
