Our Stupid Security Clearance System
John Hamre, a former deputy secretary of defense and current president of CSIS, a major foreign policy think tank, says our current security clearance system is stupid.
I once served on the board of a major company that collected computer records and provided knowledge services (for example, credit reports) and customer verification services to the insurance industry. The company could detect fraud in more than 99 percent of cases by asking a potential claimant five questions along the lines of: “Did you live at 123 Maple Ave., 345 Apple Ave. or 456 Oak Ave.?” “At 123 Maple Ave., did your house have two bathrooms, two and a half, or four?” “Did the house at 345 Apple Ave. have one fireplace, two or none?”
It needed only five such questions. Why, then, does OPM have workers reading applicants the forms that the applicants themselves have filled out, then asking whether this is the truth?
My friends in intelligence say that across all federal agencies, we spend nearly $1 billion on background investigations built on obsolete procedures such as the one I experienced. In an era of countless data sources and intelligence data analysis, why does our government rely on forms designed in the 1950s? This system is patently naive.
Consider that the spies in U.S. jails passed polygraphs — and held clearances granted by a system like the one I describe.
Technology has produced powerful tools. Today, people can check identities using multiple channels of information that cannot be spoofed, even by sophisticated hostile intelligence services. These commercial data sources are available for pennies. If the think tank where I work can buy a complete background investigation on potential employees for less than $100, why is our nation’s security clearance process frozen in decades-old administrative rules and refined to ludicrous dimensions?
The very first piece I wrote for the defunct Tech Central Station, way back in June 2004, was called “Bouncing the Security Check.” It told much the same story.
[T]he process itself is hopelessly outdated, designed to meet the needs of a Cold War world in which we no longer live.
The amount of paperwork necessary to apply for a Top Secret clearance is simply staggering. The SF-86, which is increasingly completed electronically but is still done on paper by several agencies, requires applicants to give extensive information on every school, employer, and residence they have had from their sixteenth birthday to present, including the names, addresses, and phone numbers of two neighbors from each place. While this was simple enough for a typical applicant in 1950, joining right out of high school or college and having lived in the same town his entire life, it is a daunting task indeed for someone in today’s mobile society. Most applicants in their thirties have had numerous jobs, lived in several states, and barely know their current neighbors, let alone the whereabouts of people with whom they were casually associated in 1985. Further, even if the applicant can find this information, almost all of the bosses, co-workers, and neighbors have likely themselves moved on.
Once the form is processed, an investigation is launched by one of several agencies (there is not a single process that covers the entire federal government) into a dozen areas: a national agency check to verify that people have not had run-ins with the FBI, have paid their taxes, registered with the Selective Service, and look into their military service; a credit check to ensure that the subject is not so deeply in debt as to be a blackmail target; local agency checks for each place lived during the investigation period; citizenship records for the subject, his immediate family, and anyone with which whom he has cohabitated; corroboration of education records; review of employment records, including interview with supervisors and coworkers; interviews with neighbors and others listed on the SF-86 which are done solely to generate leads for others to interview; national agency checks on current and former spouses and other cohabitants; various other public record checks to answer any questions about bankruptcy, divorce, and criminal and civil cases raised by the investigation so far; and, finally, a subject interview to resolve any inconsistencies. For especially sensitive positions, polygraph and drug tests will also be administered. It is also noteworthy that most this check is repeated periodically even for people who have received a clearance.
The point of this exercise is to ensure that the person in question is loyal to the country, emotionally stable, and does not engage in a lifestyle that would make him susceptible to blackmail. While these goals remain vital, almost all of the current process is unnecessary in the computer age. With fingerprints and a Social Security number, a reasonably competent government researcher can obtain all the information he needs in a matter of seconds. Indeed, the lady who signs new tenants at the apartment complex, the guy at the pawn shop who sells firearms, and the girl who takes your American Express at your favorite restaurant do it every day. The added value of talking to nosy neighbors and bitter ex-spouses is questionable at best.
The clearance process really does nothing more than ensure people do not have a criminal record, a history of drug abuse, so much debt as to be likely blackmail candidates, or ties to subversive organizations. Almost everyone meets this standard. Real security comes from maintaining strict protocols in the handling of sensitive information and monitoring the activities of the people who handle that information once hired. Remember, Robert Hanssen and Aldrich Ames had the highest clearance known to man and still sold secrets to our enemies.
Shockingly, the Powers That Be failed to heed my warning. While Hamre has a wee bit more clout, I suspect he is similarly spitting into the wind.
I have an (inactive) TS/SCI DoD clearance plus clearances from a half-dozen non-DoD agencies (oddly, the hardest one to get was with the USFS – DEA and Customs were easy *shrug*). I’m a retired USAF O-6 and used to have DISCO (the security clearance folks, not the dance) in my contact list, and a very well-used contact it was.
I agree with the article, at least mostly. Most of the polygraph tests are just to gauge your “allegiance to foreign powers” and aren’t “lifestyle” checks intended to determine if you’re a closet druggie. I’m not sure that the people mentioned in the article really do have a handle on that, although I am skeptical at best about the efficacy of polygraph tests in general.
As someone who has dealt with this system for the past 27 years, all I can say is “I agree…”
Also, I’m probably due for a PR soon. Blargh. At least with them being so far behind it only happens every seven years or so instead of every five. (Which strikes me as yet another problem with the current system…)
I held a secret throughout my military career and had to go through more hoops when I was tasked with teaching law of war/rules of engagement classes for persons being deployed. I also agree that the current system needs to be revamped.
I have had various security clearances over the years and what everybody has said here is true. What also is true is I think information is overclassified and people’s security clearances are higher than they need for the job at hand. On the other hand, it is also true that it is in my best interest to hold the highest clearance possible because it makes me more marketable and it makes the companies who employ me better able to market me.
Hmm…this would be absolutely impossible for me to do. I’ve lived in about 19-20 different apartments and houses in four different states since I was 16, on a conservative estimate, and don’t even remember all the addresses and phone numbers I had, much less being able to remember any neighbors.
@Rafer Janders: I’ve moved about as often over the last 30 years. I was actually able to piece it all together through a combination of my tax records and Google and now how it stored somewhere in case I need to activate my clearance again. But, yes, it’s absurd and pointless.
@Scott: Quite so. As I noted in that longago piece:
If you’ve got a TS/SCI clearance, you’re almost automatically hirable because it’s so complicated and expensive to get someone uncleared cleared.
@James Joyner:
And there’s no guarantee they’ll get cleared. Even pre-screening doesn’t always pick up disqualifying information, and–infuriatingly!–what one big three-letter agency thinks is just fine will keep another big three-letter agency from granting a clearance.
@James Joyner:
I don’t even think I could piece it all together through tax records, since I didn’t always file taxes from each address (if, for example, I lived in one apartment only for the summer between school semesters, and filed from my regular semester school address instead).
And much of this moving occurred before the Internet era, so I only have paper records of that time — or, more accurately, don’t have them anymore since they were lost in one of my frequent moves.
@Rafer Janders: Yeah, it’s absurd. I was able to, for example, figure out the address of a couple apartment complexes where I’d lived years ago via Google. But the whole process is a farce.
Hell, I routinely get security interview requests based on neighbors at my current residence, where I’ve been some six years, and don’t really know much about them.
This is an area where different government agencies are particularly working at cross-purposes (or at completely disconnected purposes). I had clearances from Treasury (1975) and State (1976) before I had to apply for a DOE clearance (1988). Did DOE cross-check either of those other agencies? Apparently not; when I went for my interview, they asked me questions to which I had already provided the answers in getting my earlier clearances.
I’ve had a clearance for 20 years, I agree the process sucks, polygraphs are shit, yadda, yadda, yadda, but I think Hamre makes a bad comparison. He says:
Well, that’s not exactly how it works. There’s a lot of other stuff that goes on behind the scenes, obviously (interviews, records checks, etc.), but the investigator is not doing what Hamre thinks she’s doing. The investigator is not there to merely verify the information on the SF-86 was written by Hamre – the purpose is to monitor Hamre as he answers to see if there’s anything he might be lying about.
So, yes, Hamre points out that it’s easy to check identities, but that is not the purpose of a background investigation and checking identities is not nearly the same thing as checking loyalty to the USA and personal reliability.
Or, this guy/gal says it better than I could.