1. The research is funded, in part, by the DOJ. However, this is only certain projects. At any point there can be up to 10 different experiments going on, many of them unfunded or done through volunteered time and effort.
2. Unfortunately, as with most university-based psychology studies, we are limited to the population of the University or the people that can be recruited around town (in this case Evanston, IL). Where P300 differs from most deception-detection methods is that it doesn't necessarily test guilt, but rather tests recognition. The same test could be used to identify, for instance, someone's birthday, Sister's name, or a variety of other information that the person could recognize.
Other researchers are working on alternative methods that more directly test DECEPTION. That is to say, while we test whether or not someone RECOGNIZES something, they want to test the neural correlates of deception or whether or not we can use EEG to figure out whether or not someone is about to make a deceptive response. A lot of this research relies on parts of the CNV component (which precedes a behavioral response like 'yes or no' or 'true or false'). While this is a good approach, it has a lower detection rate and a higher false positive rate.
I agree with that it would be very interesting to conduct a study based on this on a population with psychopathy, but that has not been conducted by us (yet). Also, who knows, maybe some US agency has already used this in the field. Can we ever really be sure?