As you would expect it is fairly common on larger projects in the defense arena where multiple tiers of subcontractors are used as needed.  Sounds good.

However, it appears that the typical subcontractor has no experience or skill in the subcontract that they have been awarded (I guess lowest price keeps winning).  Examples I have seen recently:

• Subcontractor making authorization wizard is basing the algorithm on the availability of ADSI.  However, ADSI will not be available on the target platform.  LDAP may be available.  All parties are aware of this but progress and time-lines keep moving on.
• Subcontractor responsible for lower level protocol handling in a secure environment has no expertise in networking or cryptography.  Subcontractor has to ask for designs from lead contractor so they can make any progress.

These subcontractors are making a lot of money doing the wrong thing or the unknown thing.  I don’t think its supposed to work this way.