If You Have a ‘Secret’ Clearance, Prepare for Greater Scrutiny
The Pentagon is wrapping up an eight-month effort to overhaul security policies to deal with “insider” threats. The focus is on trying to prevent a repeat of the Sept. 16 Washington Navy Yard shooting when a contractor employee with a secret clearance killed 12 coworkers.
Anindependent review in November made several proposals for improving security practices, including more frequent scrutiny of the 3.4 million population of government and contractor employees who are eligible to receive secret level clearances. It also suggested that the Pentagon should cut back on the number of clearances given, in order to keep a tighter grip.
Now comes the tough part, which is the implementation plan. The officials in charge, Undersecretary of Defense for Intelligence Michael Vickers and his deputy, Marcel Lettre, are expected to present a blueprint in June to Defense Secretary Chuck Hagel.
Navy Cmdr. Amy Derrick-Frost, a Pentagon spokeswoman, said Vickers remains “on track” to deliver a plan by mid-June.
One of Vickers’ tasks will be to figure out how to close what Hagel described as “troubling gaps” in the Defense Department’s ability to detect insider threats before it is too late.
Among the proposed fixes is to begin a program of “continuous evaluation” of everyone who has access to Defense Department facilities or classified information. Cleared personnel currently undergo reviews periodically, every five or 10 years.
Hagel said in March that one of the goals is to set up an “insider threat management and analysis center” that would perform automated record checks, connect the dots and determine whether follow-up action is needed.
To perform continuous evaluations, the Pentagon will need to expand its reach into law enforcement and other government databases, said Paul N. Stockton, co-chair of the independent review of the Washington Naval Yard shooting. A former assistant secretary of defense for homeland defense, Stockton also led the review of the 2009 mass shooting at Fort Hood, Texas.
Stockton is now a private industry consultant and is not involved in the implementation phase.
He said the Pentagon is going to need a more “robust” information system than it currently has in order to be able to monitor employees and identify insider threats. “We have a strong foundation on which to build” such a system, Stockton said in an interview. “The Defense Department needs to be able to access a larger number of law enforcement databases, and aggregate data in a way that helps highlight potential insider threats for further analysis.”
Much of the monitoring would be computerized, he said. “We need an automated system that accesses more law enforcement databases,” said Stockton. “And we need to ensure that the system is in full compliance with relevant guidelines for protection of privacy and civil liberties.”
Stockton suggested the Pentagon adopt some of the “best practices” that private sector firms have developed over many years in internal security. “Industry needs to have a strong voice” in the Defense Department’s implementation plan, he said.
Government contractors also have to be concerned about the possibility that their employees will receive fewer clearances under the new policy. Pentagon contractors currently hold 460,000 top-secret clearances, compared to 1.2 million held by government workers. Stockton and review co-chair retired Adm. Eric Olson recommended that the Pentagon start to draw down the number of cleared personnel by at least 10 percent. “This is simply about resources," said Stockton. "We can concentrate on a smaller body of cleared employees.”
Vickers will be looking at whether too many clearances have been awarded to people who do not really need them. The rule is that employees apply for clearances based on their “need to know” information that is classified secret. Since 9/11 the size of the cleared population has tripled, Stockton said. “Industry needs to be part of the dialogue on how we get back to the ‘need to know’ standard.”
Another change will be the consolidation of security policy under Vickers’ office. Responsibilities today are spread across many agencies.
A central question is whether Vickers will seek to end the Pentagon’s reliance on the Office of Personnel Management to conduct background investigations. The Defense Department paid OPM $698.7 million for background investigations in fiscal year 2013.
Stockton said the Defense Department should take back responsibility for investigations, not necessarily for cost reasons but for efficacy.
“I believe there are structural advantages to having the Defense Department take greater control over background investigations,” he said, “so there can be closer coordination between those who conduct the investigations and those who adjudicate security clearances based on those investigations.”
Even before the Navy Yard shooting, the role of the Office of Personnel Management in overseeing background investigations already was the target of criticism after revelations that OPM contractor USIS had screened National Security Agency leaker Edward Snowden for his top-secret clearance.
Derrick-Frost said the Pentagon’s office of cost assessment and program evaluation was directed by the 2014 National Defense Authorization Act to “compare the quality, cost and timeliness of background investigations conducted by both OPM and Defense, and to identify ways to improve their transparency and cost structure.”
The results of that analysis will inform Vickers’ decisions, she said. The findings from that report are due to Congress at the end of July.
Stockton said the toughest challenge for the Defense Department might be how to handle the mental health issues associated with security clearances. The Navy Yard shooter, Aaron Alexis, had been mentally ill but “not getting the care he needed,” Stockton said. “The red flags were all out there.” A key question for the Defense Department is how it will deal with personnel who may have preexisting mental health issues.