DOD Personnel: More Accurate Estimate of Overdue Security Clearance
Reinvestigations Is Needed (Testimony, 09/20/2000, GAO/T-NSIAD-00-246).
Pursuant to a congressional request, GAO discussed the Department of
Defense's (DOD) backlog of overdue personnel security reinvestigations,
focusing on: (1) how DOD estimates estimates the backlog; (2) the
soundness of DOD's backlog estimates; and (3) DOD's plans to address the
backlog problem.
GAO noted that: (1) in the absence of a Department-wide database that
can accurately measure the reinvestigation backlog, DOD the backlog on
an ad hoc basis; (2) since 1998, various DOD estimates documents and
statements have cited several widely divergent backlog
estimates--ranging from about 452,000 to 992,000; (3) more recently, DOD
has attempted to develop formal and more accurate estimates using two
primary methods--manual counts and statistical sampling; (4) using the
counting method, the military services and Defense agencies ask
securities managers to review their personnel and count those overdue
for reinvestigation; (5) DOD uses statistical analysis to refine
rough--and known to be inaccurate--estimates extracted from existing
security databases; (6) the reliability of DOD's recent formal backlog
estimates is questionable because the estimates had methodological
limitations, were 6 or more months old by the time they were reported
and excluded thousands of overdue reinvestigations; (7) the military
services used inconsistent methods and different time periods to
determine their backlog counts, and DOD did not verify the accuracy of
the counts; (8) using the counting method, DOD reported in January 2000
that the backlog totalled about 505,000; (9) using the sampling method,
a DOD contractor reported in February 2000 that the backlog also
totalled about-- 505,000; (10) however, both estimates excluded as many
as 94,000 overdue reinvestigations that had been submitted for
processing but were not yet completed as of February 2000; (11) knowing
the accurate size of the backlog is an important step towards
effectively managing and eventually eliminating the backlog; (12) DOD
recognizes this and plans to implement a new personnel security database
in mid-2001 designed to include information that could allow real-time
counts of overdue reinvestigations; and (13) however, DOD has not
specified how it plans to use the information in the new database to
help manage the reinvestigation program or ensure that future
reinvestigation requests are submitted when they are due.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: T-NSIAD-00-246
TITLE: DOD Personnel: More Accurate Estimate of Overdue Security
Clearance Reinvestigations Is Needed
DATE: 09/20/2000
SUBJECT: Security clearances
Military personnel
Data bases
Classified information
Statistical methods
Contractor personnel
Projections
IDENTIFIER: DOD Personnel Security Investigation Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO/T-NSIAD-00-246
* For Release on Delivery
Expected at 10:00 a.m.
Wednesday,
September 20, 2000
GAO/T-NSIAD-00-246
dod personnel
More Accurate Estimate of Overdue Security Clearance Reinvestigations Is
Needed
[0x08 graphic]
Statement of Carol R. Schuster, Associate Director
National Security Preparedness Issues
National Security and International Affairs Division
[0x08 graphic]
[0x08 graphic]
Testimony
Before the Subcommittee on National Security, Veterans Affairs, and
International Relations, Committee on Government Reform, House of
Representatives
United States General Accounting Office
GAO
[0x08 graphic]
Mr. Chairman and Members of the Subcommittee:
We are pleased to be here today to discuss our recent evaluation of the
Department of Defense's (DOD) backlog of overdue personnel security
reinvestigations. This evaluation was conducted at the request of the
Subcommittee Chairman, who was concerned about the size of the backlog. In
January 2000, DOD estimated that the backlog had grown to over 505,000, or
about one out of every five individuals with a security clearance. However,
DOD has also reported that it does not know the actual backlog size because
existing personnel security databases cannot provide an accurate count of
overdue reinvestigations.
To lessen the government's vulnerability to espionage and reduce national
security risks, federal standards require a periodic reinvestigation of
individuals with security clearances. An individual's security clearance is
outdated if a reinvestigation has not been initiated in the past 5 years for
top secret clearances, 10 years for secret clearances, and 15 years for
confidential clearances. Undertaking reinvestigations on time is
particularly important because DOD regulations permit individuals to
maintain access to classified information regardless of whether and how long
their reinvestigations are overdue.
Today, we will discuss (1) how DOD estimates the backlog, (2) the soundness
of DOD's backlog estimates, and (3) DOD's plans to address the backlog
problem. But first, we would like to provide a brief summary of our
testimony.
Summary
[0x08 graphic]
In the absence of a Department-wide database that can accurately measure the
reinvestigation backlog, DOD estimates the backlog on an ad-hoc basis. Since
1998, various DOD documents and statements have cited several widely
divergent backlog estimatesranging from about 452,000 to 992,000. More
recently, DOD has attempted to develop formal and more accurate estimates
using two primary methodsmanual counts and statistical sampling. Using the
counting method, the military services and Defense agencies ask security
managers to review their personnel and count those overdue for a
reinvestigation. Using the sampling method, DOD uses statistical analysis to
refine roughand known to be inaccurateestimates extracted from existing
security databases.
However, the reliability of DOD's recent formal backlog estimates is
questionable because the estimates had methodological limitations, were 6 or
more months old by the time they were reported, and excluded thousands of
overdue reinvestigations. For example, using the counting method, DOD
reported in January 2000 that the backlog totaled about 505,000. However,
the military services used inconsistent methods and different time periods
to determine their backlog counts, and DOD did not verify the accuracy of
the counts. Using the sampling method, a DOD contractor reported in February
2000 that the backlog also totaled about 505,000. However, only half of the
individuals sampled responded to the survey, and the necessary follow-up was
not performed to make the estimate statistically valid. Moreover, both
estimates excluded as many as 94,000 overdue reinvestigations that had been
submitted for processing but were not yet completed as of February 2000.
Knowing the accurate size of the backlog is an important step towards
effectively managing and eventually eliminating the backlog. DOD recognizes
this and plans to implement a new personnel security database in mid-2001
designed to include information that could allow real-time counts of overdue
reinvestigations. However, DOD has not specified how it plans to use the
information in the new database to help manage the reinvestigation program
or ensure that future reinvestigation requests are submitted when they are
due. Our August 2000 report recommended that DOD design routine reports that
show the full extent of the backlog and that DOD develop incentives to keep
reinvestigation information current and have requests for reinvestigations
submitted on time. DOD agrees with these recommendations and has begun to
implement them.
Background
[0x08 graphic]
The federal government uses personnel security investigations to determine
whether an individual should be granted access to classified information. In
addition to requiring an initial investigation, federal standards require
periodic reinvestigations of individuals granted access to classified
information. Although such investigations do not guarantee that individuals
will not later engage in espionage activities, they remain a critical part
of identifying those who can be trusted to access and safeguard classified
information. Of the 2.4 million DOD military, civilian, and contractor
employees with personnel security clearances at the end of fiscal year 1998,
96,000 held confidential clearances, 1.8 million held secret clearances, and
524,000 held top secret clearances.
The Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence) is responsible for DOD's personnel security program, including
the periodic reinvestigation program. The Assistant Secretary oversees the
Defense Security Service, which is responsible for investigations and
reinvestigations of DOD's civilian and military personnel and contractors.
Over 5,000 security managers within the services and Defense agencies are
responsible for ensuring that individuals submit reinvestigation requests as
their updates become due.
DOD Regulation 5200.2-R, Personnel Security Program, states that a clearance
shall not be suspended or downgraded solely because a periodic
reinvestigation has not been conducted precisely within 5 years for top
secret clearances and 10 years for secret clearances. The regulation
requires that DOD agencies, in recognition of mission requirements, be
flexible in administering the reinvestigation requirement. Thus, as a matter
of practice, the services and DOD agencies normally do not suspend or
downgrade individuals' access to classified information when
reinvestigations are overdue.
Although DOD has historically reported a large backlog of overdue
reinvestigations, the size of the backlog has reportedly increased
significantly over the past few years due to several factors. First, new
standards, approved in 1997, increased periodic reinvestigation requirements
by shortening the time interval between reinvestigations for secret
clearances from 15 to 10 years and by establishing a new, 15-year periodic
reinvestigation requirement for confidential clearances. Second, for 4 years
starting in fiscal year 1996, DOD tried to help the Defense Security Service
clear up its backlog of pending investigations by imposing quotas on the
number of reinvestigations the services and Defense agencies could request.
This led to pent-up demand for reinvestigation requests. Finally, in October
1998, the Defense Security Service began having significant difficulties
implementing a new automated case control management system. The problems
led to reduced productivity and longer completion times.
Lack of Database Led DOD to Use Two Methods to Estimate Its Backlog
DOD does not have a Department-wide information system to track the status
of security clearances. Without a central database to help it determine the
reinvestigation backlog, DOD has used two primary methods for ad-hoc
estimates of the backlogmanual counts of individuals with overdue
reinvestigations and statistical sampling techniques to refine rough
estimates of overdue reinvestigations from existing databases. DOD's primary
existing database containing personnel security information, the Defense
Clearance and Investigations Index, contains about 28 million records of
past and current military, civilian, and contractor personnel who have been
the subjects of criminal or security clearance investigations. Managed by
the Defense Security Service, the index is used to study policy options and
to prepare required and ad-hoc reports on the functioning of the personnel
security program. Although the index was not designed to provide real-time,
actual counts of overdue reinvestigations, it can provide a rough estimate
of the backlog. The problem is that the rough estimate overstates the
backlog because the index includes (1) many individuals no longer employed
by DOD, (2) many individuals eligible for clearances but no longer requiring
access to classified information, and (3) data showing only the highest
eligible classification level of many individuals who currently require
access only at a lower classification level.
[0x08 graphic]
Reliability of DOD's Backlog Estimates Is Questionable
DOD's two most recent backlog estimatesone by a DOD process team and the
other by a contractor, the MITRE Corporationwere developed independently and
used different estimating methods but coincidentally arrived at similar
estimates of about 505,000 overdue reinvestigations. The process team's
estimate originated in November 1999, when the Deputy Secretary of Defense
formed the team to review the accuracy of the reinvestigation backlog and
develop solutions to manage and eliminate the backlog. To develop its
backlog estimate, the team first defined the backlog and included only
reinvestigations that were (1) overdue according to the time lapsed since
the individual's last investigation,
(2) currently required, and (3) not yet submitted to the Defense Security
Service for an update. Also, individuals with security clearances were
evaluated according to the classified access level required to do their
current jobs and not according to the highest level of classified access for
which they were eligible. For example, an individual needing only a secret
clearance but holding a top secret clearance was not considered overdue for
a reinvestigation until 10 years, not 5 years, after the last investigation.
The team then calculated its estimate by asking the services to count the
number of individuals overdue for a reinvestigation.
The team's estimate contained three key limitations that raise questions
about the reliability of the estimate. First, the team did not review the
methods used or the accuracy of the backlog counts reported by the services.
Second, the services were inconsistent in the way they arrived at their
counts and used different points in time to determine their backlog:
* The Army asked its commands and units for a backlog count as of
September 30, 1999.
* Navy leaders did not want to ask commands and units to count overdue
reinvestigations, stating that this would disrupt mission
responsibilities. Instead, the Navy (1) counted overdue
reinvestigations of civilian personnel in one major command as of
September 1999 and, on the basis of that count, extrapolated an
estimate of its total civilian personnel backlog; (2) estimated its
military personnel backlog by analyzing military jobs requiring
clearances and the years of service of the individuals occupying those
jobs (for example, individuals with over 6 years of service in jobs
requiring a top secret clearance were considered overdue for a
reinvestigation); and (3) used a count of overdue reinvestigations of
civilian and military personnel in the Marine Corps as of September 10,
1999.
* Rather than performing another count of its backlog, the Air Force
adjusted an April 1999 backlog estimate to approximate its backlog as
of December 1999. To do this, the Air Force added all reinvestigation
requests that it had submitted between May and December 1999 and
subtracted them from its April 1999 estimate. The Air Force did not
verify whether the requests subtracted from this estimate had been
included in the original April 1999 estimate, and it did not add
individuals that had become overdue for a reinvestigation from May
through December 1999.
The third limitation was that, rather than developing new backlog counts,
the team used previously developed estimates of overdue reinvestigations
among DOD agencies and contractors, even though these accounted for about
one-third of the backlog. Finally, the team's estimate used a definition of
overdue reinvestigations that excluded those overdue reinvestigations
submitted to but still pending at the Defense Security Service. Normally,
the Defense Security Service does not open a reinvestigation immediately
after it receives a request and usually requires about 5 to 7 months to
complete a reinvestigation. When the team reported its estimate in January
2000, about 86,000 reinvestigations were still pending at the Defense
Security Service; according to DOD officials, the vast majority of these
were overdue.
DOD's other recent backlog estimatemade by a contractor using statistical
samplingoriginated from a 1999 Defense Security Service study to measure the
backlog and determine how the Service should prioritize backlog cases so
that those with the highest security risk could be completed first. As a
starting point, the Defense Security Service obtained a rough, and known to
be inaccurate, estimate of the reinvestigation backlog using existing
databases. This estimate indicated that 954,445 individuals were overdue for
reinvestigation as of June 30, 1999. From this estimate, a random sample of
1,200 cases was taken. Each case was surveyed to determine whether it was a
true backlog casemeaning that the individual held an active clearance,
needed access to classified information at the clearance level indicated,
and had no clearance update request in process. When the contractor wrote
its report, it had received 617 survey responses (51 percent of the sample
cases). Of these, 246 identified true backlog cases.
The contractor's estimate also included limitations that raise questions
about its reliability. One was the low survey response rate. No survey
follow-up was performed to increase the response rate, and because responses
were fewer than 1,200, the estimate rested on the assumption that there were
no statistical differences between respondents and nonrespondents. However,
to determine whether this assumption was true, sampling and follow-up of
nonrespondents were required; but neither was performed.
Another key limitation of the contractor's estimate was that, similarly to
the process team's estimate, it did not include all overdue
reinvestigations. The estimate excluded overdue confidential
reinvestigations, which number about 15,000, according to Defense Security
Service officials. The estimate also excluded overdue reinvestigations
pending at the Defense Security Service. In February 2000, when the
contractor issued its report, about 94,000 reinvestigations were in process,
and DOD officials stated that the vast majority of these were overdue.
Other widely divergent backlog estimates have been cited in various DOD
documents and statements in 1998 and 1999. However, these estimates cannot
be compared either with each other or with the more recent estimates by the
process team and the contractor because they included different clearance
levels and were developed using different methods, time periods, and
criteria for determining when an individual is overdue for a
reinvestigation. Appendix I summarizes key data on reinvestigation backlog
estimates by DOD and others.
DOD Is Taking Steps to Address the Backlog
[0x08 graphic]
In a June 9, 1999, memorandum, the Deputy Secretary of Defense directed the
services and Defense agencies to eliminate the backlog by the end of fiscal
year 2000 by ensuring that (1) all individuals had current clearances in
accordance with national standards or (2) all requests for reinvestigation
were submitted and in process. The memorandum also called for shifting some
Defense Security Service workload to the Office of Personnel Management and
to private investigative companies to expand DOD's investigative capacity.
The memorandum also stated that, contrary to established practice,
clearances were to be administratively terminated or downgraded if they were
not based upon a current investigation or were not in process for a
reinvestigation by September 30, 2000.
Although DOD shifted initial investigations and reinvestigations (except
overseas investigations) of its civilian personnel to the Office of
Personnel Management in 1999, the services and Defense agencies did not
submit overdue reinvestigation requests at the rate required to eliminate
the backlog by September 30, 2000. The services and Defense agencies had
planned to submit 505,786 overdue reinvestigation requests (the same number
estimated by the process team) in fiscal year 2000, plus 131,000 that were
becoming due. DOD analyses of the first 7 months of fiscal year 2000 showed
that the services and agencies submitted only about
28 percent of the anticipated reinvestigation requests from October 1999
through April 2000. This was only about 34,000 more than the number of
reinvestigations expected to become due during this period, indicating only
a modest dropabout 7 percentin overdue reinvestigations not submitted for
update. To meet the goal of eliminating the entire backlog by September 30,
2000, the backlog should have been reduced by over
50 percent (about 250,000) by the end of April.
According to DOD officials, the services and Defense agencies did not submit
more overdue reinvestigations primarily because they had not budgeted the
additional funds needed to cover the costs of the increased workload and did
not shift funds from other programs. Recognizing the problem, subsequent DOD
memorandums issued on March 31, 2000, and June 22, 2000,
* extended the deadline for eliminating the backlog to March 31, 2002
(now extended to September 30, 2002);
* directed that all secret and confidential initial investigations and
reinvestigations of military personnel be transferred to the Office of
Personnel Management to further reduce the Defense Security Service's
investigative workload;
* estimated that an additional $201.6 million was needed to pay for work
transferred to the Office of Personnel Management in fiscal years 2001
and 2002; and
* directed the services and other components to (1) allocate funds from
existing resources to pay for investigations performed by both the
Defense Security Service and the Office of Personnel Management during
fiscal year 2001 and (2) include all investigation funding that would
be required for fiscal year 2002 in their budget submissions.
Neither memorandum issued in 2000 stated that clearances would be cancelled
or downgraded if reinvestigations were not current or in process by the new
deadline. Thus, unlike the Deputy Secretary of Defense's initial June 9,
1999, memorandum, they did not provide the same incentive urging security
managers to submit future reinvestigation requests on time.
DOD is also implementing a new personnel security database, the Joint
Personnel Adjudication System, to consolidate its security clearance data
systems and provide real-time input and retrieval of clearance-related
information. Assuming that the data will be accurate and reliable, DOD
officials stated, the system will be able to provide accurate information on
the status of security clearances, including counts of overdue
reinvestigations. With this capability, DOD should no longer need to expend
resources to produce ad-hoc estimates of the backlog. The officials said,
however, that they had not yet determined how and when the system's periodic
reinvestigation information will be extracted and used to monitor program
performance.
[0x08 graphic]
DOD Is Implementing Our Recommendations
To improve the management of DOD's personnel security reinvestigation
program, we recommended that DOD (1) design routine reports with key data
from the Joint Personnel Adjudication System database to show the full
extent of overdue reinvestigations, including those overdue but not yet
submitted for update and those in process, and (2) develop appropriate
incentives to encourage agency security managers to keep information in the
database current and to submit reinvestigation requests on time. DOD agreed
with the contents of our report and our recommendations and stated that it
would take steps to implement the recommendations. DOD stated, for example,
that it would require that security clearances be downgraded or cancelled
for those individuals who do not have a current clearance or who have not
had the request for a periodic reinvestigation submitted to the Office of
Personnel Management or the Defense Security Service by September 30, 2002.
Mr. Chairman and Members of the Subcommittee, this concludes our formal
statement. We will be happy to answer any questions you may have.
Contact and Acknowledgments
[0x08 graphic]
For future contacts regarding this testimony, please contact
Carol Schuster at (202) 512-5140. Individuals making key contributions to
this testimony included Christine Fossett, Gary Phillips, and James Ellis.
Appendix I
Estimates of DOD's Periodic Reinvestigation Backlog
Various entities have estimated the extent of the Department of Defense's
(DOD) periodic reinvestigation backlog, as shown in the following table. To
determine whether an individual is overdue for a reinvestigation, DOD
normally considers the reinvestigation interval standard for the clearance
access level required to do the job. According to DOD officials, many
individuals are eligible for a higher clearance than required to do the job.
Existing databases always include the individual's eligibility level, but
they do not always include the individual's required access level. The last
column in the table shows which basis was used to determine the number of
overdue investigations.
Estimated Basis for
Source of the backlog Clearance Estimating Backlog as determining
estimate size levelsa method of date overdue
reinvestigations
Recent refined estimates
Process teamb 505,786 TS, S, C Head count Sept./Dec. Access
1999
MITREc 505,155d TS, S Statistical June 1999 Access
survey
Prior refined estimates
Assistant
Secretary of Access, but
Defense (Command, eligibility was
Control, 624,215 TS, S, C Head count Sept. 1999 used for many
Communications, individuals
and Intelligence)
Joint Security Statistical
Commission II 73,160e TS survey Oct. 1998 Access
Unrefined estimates
Defense Manpower Rough Access, if
Data Center for estimate/ information was
the Defense 992,231 TS, S, C existing June 1999 in the database;
Security Service databases otherwise
eligibility
Defense Manpower Rough Access, if
Data Center for 868,943f estimate/ information was
the Assistant TS, S, C existing Oct. 1998 in the database;
Secretary 611,652g databases otherwise
eligibility
aTop secret (TS), including sensitive compartmented information. Secret (S).
Confidential (C).
bEstimate made by Personnel Security Overarching Integrated Process Team.
cEstimate made by the Defense Security Service and its contractor, the MITRE
Corporation.
dThe estimate was between 451,757 and 558,552 with a mean estimate of
505,155.
eThe estimate was between 64,790 and 81,685 with a mean estimate of 73,160.
fBased on lapsed time since last investigation date.
gBased on lapsed time since the individual's case was adjudicated; that is,
the date the decision was made to grant the clearance.
Source: GAO analysis of data provided by DOD.
(702095)
[0x08 graphic]
Orders by Internet
For information on how to access GAO reports on the Internet, send an e-mail
message with info in the body to:
Info@www.gao.gov
or visit GAO's World Wide Web home page at:
http://www.gao.gov
[0x08 graphic]
[0x08 graphic]
Contact one:
Web site: http://www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
1-800-424-5454 (automated answering system)
DOD Personnel: More Actions Needed to Address Backlog of Security Clearance
Reinvestigations (GAO/NSIAD-00-215, Aug. 24, 2000).
The backlog can include overdue reinvestigations from the following DOD
services and agencies: Army, Navy, Air Force, Marine Corps, Uniformed
Services University of the Health Sciences, National Imagery and Mapping
Agency, Defense Advanced Research Project Agency, Defense Information
Systems Agency, Defense Threat Reduction Agency, Washington Headquarters
Services, National Security Agency, Inspector General, Defense Logistics
Agency, Defense Contract Audit Agency, Defense Finance and Accounting
Service, Defense Security Service, Defense Intelligence Agency, Joint Staff,
and DOD contractors.
The contractor's study developed an algorithm to prioritize reinvestigation
requests on the basis of security risk. By comparing historical data on
clearance revocations with information submitted with each individual's
reinvestigation request, the algorithm predicts the likelihood that the
individual's clearance might be revoked. Defense Security Service officials
stated that they plan to begin using the algorithm during summer 2000 to
give priority to those reinvestigations considered the riskiest.
The Defense Security Service would continue to perform overseas
investigations, top secret initial investigations and reinvestigations of
military personnel, and all investigations and reinvestigations of
contractor personnel.
*** End of document. ***