DOD Personnel: Inadequate Personnel Security Investigations Pose National Security Risks (Letter Report, 10/27/1999, GAO/NSIAD-00-12). Pursuant to a congressional request, GAO reviewed the Department of Defense's (DOD) personnel security investigative functions, focusing on; (1) the completeness and timeliness of DOD personnel security investigations; (2) what factors, if any, might be hindering the completeness and timeliness of the investigations; and (3) what actions DOD has taken to address any program weaknesses. GAO noted that: (1) DOD personnel security investigations are incomplete and not conducted in a timely manner; (2) as a result, they pose a risk to national security by making DOD vulnerable to espionage; (3) in the 530 cases GAO reviewed, DOD granted clearances notwithstanding that: (a) 92 percent of the 530 investigations were deficient in that they did not contain the information in at least one of the nine investigative areas required by the federal standards for granting clearances; (b) 77 percent of the investigations were deficient in meeting federal standards in two or more areas; and (c) 16 percent of the investigations identified issues that the Defense Security Service did not pursue pertaining to individuals' prior criminal history, alcohol and drug use, financial difficulties, and other problems that could be cause to deny a security clearance; (4) Defense Security Service clearance investigations are also not timely; (5) half of the 530 investigations GAO reviewed took 204 or more days to complete even though DOD components and contractors requesting the investigations want them completed in 90 days; (6) completeness and timeliness problems in DOD's personnel security program have resulted largely from a series of Defense Security Service management actions that weakened quality assurance and led to delays in processing cases; (7) DOD is taking steps to address these problems; however, it will take a significant amount of time and money to identify and implement all of the actions and steps needed; (8) DOD recently appointed a new acting Defense Security Service Director who has: (a) negotiated with the Office of Personnel Management and private contractors to assist in eliminating the large backlog of clearance reinvestigations; (b) directed a review of all investigative policies; (c) begun reinstating quality control mechanisms and established a new training organization; and (d) appointed a team to assess automation problems; (9) DOD has not developed a strategic plan for the program that includes measurable program goals and performance measures; (10) DOD has recognized the need for a strategic plan for the personnel security investigation program, but the plan is only in the early stages of development; and (11) moreover, despite the serious and widespread nature of the completeness and timeliness problems affecting the personnel security investigation program, DOD has not planned to report these problems as material weaknesses under the Federal Managers' Financial Integrity Act of 1982. --------------------------- Indexing Terms ----------------------------- REPORTNUM: NSIAD-00-12 TITLE: DOD Personnel: Inadequate Personnel Security Investigations Pose National Security Risks DATE: 10/27/1999 SUBJECT: Federal employees Internal controls Security clearances Contractor personnel Classified information Strategic planning Quality assurance IDENTIFIER: National Performance Review DOD Quadrennial Defense Review SSA Case Management Control System ****************************************************************** ** This file contains an ASCII representation of the text of a ** ** GAO report. Delineations within the text indicating chapter ** ** titles, headings, and bullets are preserved. Major ** ** divisions and subdivisions of the text, such as Chapters, ** ** Sections, and Appendixes, are identified by double and ** ** single lines. The numbers on the right end of these lines ** ** indicate the position of each of the subsections in the ** ** document outline. These numbers do NOT correspond with the ** ** page numbers of the printed product. ** ** ** ** No attempt has been made to display graphic images, although ** ** figure captions are reproduced. Tables are included, but ** ** may not resemble those in the printed version. ** ** ** ** Please see the PDF (Portable Document Format) file, when ** ** available, for a complete electronic file of the printed ** ** document's contents. ** ** ** ** A printed copy of this report may be obtained from the GAO ** ** Document Distribution Center. For further details, please ** ** send an e-mail message to: ** ** ** ** <info@www.gao.gov> ** ** ** ** with the message 'info' in the body. ** ****************************************************************** Report to the Ranking Minority Member, Committee on Armed Services, House of Representatives October 1999 DOD PERSONNEL Inadequate Personnel Security Investigations Pose National Security Risks ***************** <Graphic -- Download the PDF file to view.> ***************** GAO/NSIAD-00-12 Letter 3 Appendixes Appendix I:Recent Broad-Based Studies of the Personnel Security Investigation Process 38 Appendix II:Scope and Methodology 42 Appendix III:Defense Security Service Resources and Workload 46 Appendix IV:Deficient Investigations in Our Sample 48 Appendix V:Investigators' Recall of Recent Training Received on Federal Investigative Standards 49 Appendix VI:Comments From the Department of Defense 53 Appendix VII:GAO Contacts and Staff Acknowledgments 62 Table 1: Comparison of DSS Investigations Sent for Adjudication Before and After CCMS Implementation 29 Table 2: Status of Joint Security Commission Recommendations39 Table 3: Status of Joint Security Commission II Recommendations40 Table 4: Status of Secrecy Commission Recommendations41 Table 5: Number of DSS Investigations Sent to Four DOD Adjudication Facilities and Sampled by GAO 42 Table 6: Precision Rates for Investigations Sampled at Four DOD Adjudication Facilities43 Table 7: Personnel Security Investigation Budget46 Table 8: Personnel Security Investigation Staff46 Table 9: Personnel Security Investigation Workload47 Table 10: Number of Deficient DSS Investigations at Four DOD Adjudication Facilities48 Table 11: Investigators' Responses to Survey Questions on Recent Training Received on Federal Standards 49 Figure 1: Personnel Security Investigation and Adjudication Process 8 Figure 2: Percent of Personnel Security Investigations With Deficiencies 13 Figure 3: Percent of Deficient Investigations in Nine Required Investigative Areas 14 Figure 4: Calendar Days Needed to Complete Investigations17 Figure 5: Percent of Investigators Without Recent Training on Investigative Requirements 26 Figure 6: Investigators Views on Workload 28 CCMS Case Control Management System DOD Department of Defense DSS Defense Security Service GPRA Government Performance and Results Act NSA National Security Agency OCB Operations Center Baltimore National Security and International Affairs Division B-283901 October 27, 1999 The Honorable Ike Skelton Ranking Minority Member Committee on Armed Services House of Representatives Dear Mr. Skelton: The federal government uses personnel security investigations to determine whether an individual should be granted access to classified information. Because these investigations are a critical first step in safeguarding national security information, the federal government has established standards to ensure that various aspects of an individual's background are consistently investigated and considered when a federal agency decides if a clearance should be granted. Although such investigations do not guarantee that individuals will not later engage in espionage activities, they remain a critical step in identifying those who can be trusted to access and safeguard classified information./Footnote1/ The Department of Defense's (DOD) Defense Security Service, with oversight by the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), conducts the investigations for DOD and forwards the results to one of eight DOD adjudication facilities, which decide whether to grant or deny the clearance. These decisions are referred to as adjudications. At the end of fiscal year 1998, about 2.4 million DOD active duty military, civilian, and contractor employees held personnel security clearances: 96,000 employees held confidential clearances, 1.8 million held secret clearances, and 524,000 held top secret clearances. From 1982 through September 1999, 80 federal employee and contractor personnel, 68 of whom were employed by DOD, were convicted of committing espionage against the United States. These individuals had undergone personnel security investigations and held security clearances; 19 held clearances that allowed access to top secret information. Top secret, secret, and confidential clearances require reinvestigations every 5, 10, and 15 years, respectively. In view of the importance of these investigations to national security, you asked us to review DOD's personnel security investigative functions. Specifically, we assessed (1) the completeness and timeliness of DOD personnel security investigations; (2) what factors, if any, might be hindering the completeness and timeliness of the investigations; and (3) what actions DOD has taken to address any program weaknesses. As you requested, we are also providing information on recent broad-based studies that examined federal personnel security investigations and the status of actions taken on these studies' recommendations to improve the process. This information is presented in appendix I. To address these objectives, we reviewed the extent to which a sample of 530 randomly selected personnel security investigations conducted by the Defense Security Service included the information required by the federal standards. These investigations included 226 (43 percent) investigations conducted for the purposes of determining whether to grant or deny an initial top secret clearance and 304 (57 percent) reinvestigations conducted to determine whether to continue or revoke a top secret clearance already held. We randomly selected the investigations from four of the eight DOD adjudication facilities: the Air Force, the Army, the Navy, and the National Security Agency. Our findings can only be generalized to the investigations done during the January and February 1999 period at the four adjudication facilities. However, these facilities accounted for 73 percent of the investigative work done by the Defense Security Service in fiscal year 1998; therefore, these findings suggest systemic program weaknesses. In addition, we surveyed all Defense Security Service investigators and case analysts about their workload, training, the manner in which they conduct investigations, and the adequacy of the investigative policy guidance they received. A detailed discussion of the scope and methodology for conducting our work is presented in appendix II. Results in Brief DOD personnel security investigations are incomplete and not conducted in a timely manner. As a result, they pose a risk to national security by making DOD vulnerable to espionage. In the 530 cases we reviewed, DOD granted clearances notwithstanding that o 92 percent of the 530 investigations were deficient in that they did not contain the information in at least 1 of the 9 investigative areas required by the federal standards for granting clearances, which include confirming the subject's residency, birth and citizenship, and employment records; checking records for prior criminal history, divorces, and financial problems; and interviewing character references; o 77 percent of the investigations were deficient in meeting federal standards in two or more areas; and o 16 percent of the investigations identified issues that the Defense Security Service did not pursue pertaining to individuals' prior criminal history, alcohol and drug use, financial difficulties, and other problems that could be cause to deny a security clearance. Defense Security Service clearance investigations are also not timely. Half of the 530 investigations we reviewed took 204 or more days to complete even though DOD components and contractors requesting the investigations want them completed in 90 days. Less than 1 percent of the 530 investigations met this 90-day time frame. This lack of timeliness causes defense contractors to incur costs because their personnel cannot begin work on DOD contracts without a security clearance. Also, about 600,000 individuals holding clearances are overdue for reinvestigations. Delays in initiating reinvestigations create risks because DOD may be unaware of changes in employees' personal circumstances or behaviors that make them a greater security risk. Completeness and timeliness problems in DOD's personnel security program have resulted largely from a series of Defense Security Service management actions that weakened quality assurance and led to delays in processing cases. Specifically, the Defense Security Service o adopted relaxed investigative policy guidance causing confusion about investigative requirements and raising concerns about the sufficiency of information available for clearance decisions and the impact on uniformity in all personnel security investigations; o eliminated quality control mechanisms such as quality assurance and supervisory review of completed investigations; o ineffectively managed implementation of a new automated investigative case processing system that caused delays in processing cases; and o did not adequately train its staff on the new federal investigative standards, causing much confusion among Defense Security Service staff about conducting investigations in compliance with the federal standards. These problems arose and persisted, in part, because the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) did not provide proper oversight of the program. DOD is taking steps to address these problems; however, it will take a significant amount of time and money to identify and implement all of the actions and additional steps needed. DOD recently appointed a new acting Defense Security Service Director who has (1) negotiated with the Office of Personnel Management and private contractors to assist in eliminating the large backlog of clearance reinvestigations; (2) directed a review of all investigative policies; (3) begun reinstating quality control mechanisms, such as quality assurance reviews, and established a new training organization; and (4) appointed a team to assess automation problems. DOD has not developed a strategic plan for the program that includes measurable program goals and performance measures. Such a plan is needed to institute sound management practices and to assess progress in overcoming identified problems. DOD has recognized the need for a strategic plan for the personnel security investigation program, but the plan is only in the early stages of development. Moreover, despite the serious and widespread nature of the completeness and timeliness problems affecting the personnel security investigation program, DOD has not planned to report these problems as material weaknesses under the Federal Managers' Financial Integrity Act of 1982./Footnote2/ This act mandates that federal agencies conduct ongoing evaluations of their internal control systems to protect federal programs against fraud, waste, abuse, and mismanagement. Reporting the Defense Security Service's material weaknesses under the act would focus needed attention on a formal corrective action plan with specific milestones and actions to address their underlying causes. This report makes recommendations to the Secretary of Defense to improve oversight and identify the personnel security program as containing material internal control weaknesses in DOD's next report to the President and the Congress in accordance with the Federal Managers' Financial Integrity Act. We are also recommending that the Secretary require that the Defense Security Service Director develop a strategic plan and performance measures to improve the quality of the investigative work and correct other identified weaknesses. Background Espionage against the United States is any overt, covert, or clandestine activity designed to obtain information relating to national defense with the intent to injure the United States or to provide an advantage to a foreign nation. Acts of espionage have had serious consequences for the United States: intelligence personnel have been killed, critical information has been compromised, and U.S. military forces have been put at risk. Although the number of acts of espionage appears small in comparison to the number of security clearances in effect, according to DOD counterintelligence officials, hundreds of other potential instances have been detected but have not resulted in convictions because (1) individuals defected or committed suicide or (2) the cases were settled in other ways. To commit espionage, a person must have access to national security information, contacts with foreign personnel seeking it, and a willingness to compromise the information. The primary motive for the 80 individuals convicted of espionage was greed--the chance for financial gain--but ideology was often another important factor. These two issues are among the areas that are to be addressed in personnel security investigations and considered in decisions to grant clearances. Personnel Security Investigations in DOD ---------------------------------------- The personnel security investigation is a critical step toward ensuring that individuals can be trusted to protect classified information. In granting a security clearance, DOD determines that the person's loyalty to the United States, character, trustworthiness, honesty, reliability, discretion, and judgment are such that the person can be expected to comply with government policy and procedures for safeguarding classified information. The process of obtaining a security clearance, as shown in figure 1, begins with a request from a military commander, contractor, or other DOD official for a security clearance for an individual because of the sensitive nature of his or her duties. The individual then completes a security questionnaire that asks for the personal details needed to conduct the investigation, which is forwarded to the Defense Security Service's (DSS) Operations Center Baltimore, in Linthicum, Maryland. The Center's case analysts review clearance requests to ensure that all necessary forms are complete, develop a scope for the investigation, and assign the required work to the 12 DSS field-operating locations throughout the United States. An investigation may be sent to one or more operating locations depending on where the individual seeking the clearance (referred to as the subject) has lived, worked, or attended school. Once received in the field, an investigation is assigned to an investigator who seeks information in that geographic location about the subject's loyalty, character, reliability, trustworthiness, honesty, and financial responsibility. The investigation must be expanded to clarify and resolve any information that raises questions about the subject's suitability to hold a position of trust. As investigative elements are completed, the field sends reports to the DSS Operations Center, where case analysts determine if all investigative criteria have been met and all issues relevant for a clearance decision have been resolved. The case analysts also request information from other federal agencies, such as the Office of Personnel Management, Federal Bureau of Investigation, the Central Intelligence Agency, and the Immigration and Naturalization Service. DSS sends the completed investigation to the appropriate adjudication facility, which decides whether to grant or deny a clearance. Every 5 to 15 years, personnel are supposed to undergo a reinvestigation, depending on the type of clearance. Figure****Helvetica:x11****1: Personnel Security Investigation and Adjudication Process ***************** <Graphic -- Download the PDF file to view.> ***************** Source: Defense Security Service. DSS Resources and Workload -------------------------- Over the past 7 years, financial and personnel resources at DSS and investigative workloads have fluctuated, but have declined overall. In fiscal year 1998, DSS had a budget of $190 million and spent approximately 75 percent of its budget on personnel security investigations. The agency had approximately 2,500 employees, half of whom worked on personnel security investigations. The remainder of DSS's budget and staff are used for DSS's industrial security program and other areas related to its responsibilities, such as administrative support. DSS received about 126,000 investigation requests and completed 142,000 investigations in fiscal year 1998, some of which were submitted in prior years. These workload figures do not include about 600,000 reinvestigations for confidential, secret, and top secret clearances that are overdue but have not been submitted for reinvestigation. On average, a top secret investigation or reinvestigation costs about $1,600 to $2,600. DSS's budget, staffing, and investigative workload for fiscal years 1991 through 1998 is presented in appendix III. Federal Standards for Personnel Security Investigations and Adjudication ------------------------------------------------------------------------ In 1994, the President established the Security Policy Board as a new interagency body to develop directives for U.S. security policies, procedures, and practices; in addition, the National Security Act was amended to require the President to establish uniform executive branch procedures to govern access to classified information./Footnote3/ In August 1995, under Executive Order 12968, the President directed the Board to develop a common set of investigative standards and adjudicative guidelines for determining eligibility for access to classified information. In March 1997, the President approved federal standards developed by the Board. These standards apply to all U.S. civilian and military personnel, consultants, contractors, and other individuals who require access to classified information. The objectives of the standards are to (1) investigate and assess various aspects of an individual's trustworthiness and reliability, taking into account both positive and negative issues (a practice known as the whole person concept), and (2) standardize federal processes to achieve reciprocity and avoid unnecessary and costly reinvestigations when an individual switches agencies. The purpose of initial investigations for top secret clearances is to provide information in the following nine areas:/Footnote4/ o corroboration of subject's proof of date and place of birth; verification of citizenship for foreign-born subjects and their foreign- born immediate family members; o corroboration of education; o verification of employment for the past 7 years (including all prior federal and military service and type of discharge) and interviews with supervisors and co-workers; o interviews with character references with social knowledge of the subject and any former spouse divorced within the last 10 years; o interviews with neighbors to confirm all residences for last 3 years; o a national agency check for the subject and spouse or cohabitant (searches of investigative files and other records held by federal agencies, including the Federal Bureau of Investigation and the Central Intelligence Agency); o a financial review, including a credit bureau check; o a local agency check of criminal history records and other public records to verify any civil or criminal court actions involving the subject; and o a personal interview of the subject. The standards call for investigations to be expanded to resolve issues that arise, such as potential criminal history, alcohol or drug usage, and financial matters, including unexplained affluence or a history of not meeting financial obligations. The standards for reinvestigations are essentially the same as those for initial investigations, with two exceptions. Reinvestigations do not require corroboration of proof of birth and citizenship for subjects and their family members or the subjects' education. According to officials of the Security Policy Board and in the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), the basis for not requiring this information in reinvestigations is that it is to be obtained in the initial investigation. However, the officials stated that if there were significant changes since the last investigation, such as a new spouse or claim of significant education attained, such as a college degree, reinvestigations are to include this information. In deciding if a clearance should be granted or denied, the federal adjudicative guidelines require adjudication facility staffs, using the results of the investigation, to base their decision on the following factors: o allegiance to the United States; o foreign influence; o sexual behavior; o personal conduct; o financial considerations; o alcohol consumption; o drug involvement; o emotional, mental, and personality disorders; o criminal conduct; o security violations; o outside activities; and o misuse of information technology systems. Investigations Have Been Incomplete and Untimely The DOD personnel security investigation program has resulted in investigations that o did not obtain the information required by the federal standards, such as residency, corroboration of birth or citizenship for foreign-born subjects or their immediate family members, verification of employment, interviews of character references, and local records checks for any prior criminal history, divorces, or financial problems; o did not address issues that the investigations revealed could disqualify individuals from holding security clearances, such as prior criminal history, financial problems, and alcohol and drug use; and o were not completed in a timely manner to meet the needs of DOD components and contractors. These weaknesses pose risks to national security in that individuals have been granted access to classified information without undergoing a personnel security investigation that complies fully with federal standards. In addition, the delays in completing the investigations have hindered some contractors' ability to meet their cost and performance schedules on DOD contracts, according to contractor officials. Further, the large number of overdue reinvestigations has allowed hundreds of thousands of individuals to continue to access classified information without having a current reinvestigation as required. In 1999, the Joint Security Commission II reported that delaying reinvestigations poses risks to national security because the longer individuals hold clearances, the more likely they are to be working with more critical information and systems./Footnote5/ Also, the longer a reinvestigation is delayed, the greater the risk that changes in an individual's behavior will go undetected. DSS Investigations Have Been Incomplete --------------------------------------- In our review of 530 randomly sampled top secret security clearance investigations and reinvestigations completed by DSS in January and February 1999 for the 4 DOD adjudication facilities that received most of DSS's investigations, we found that 92 percent (489) did not fully meet federal investigative standards because they were incomplete. The incompleteness rates for each adjudication facility were 95 percent for the Air Force facility, 94 percent for the National Security Agency facility, 91 percent for the Navy facility, and 88 percent for the Army facility. (These rates are projectable to the respective populations with a precision rate of +/- 3 to 5 percentage points. See app. II, table 6). Overall, o 92 percent of all 530 investigations****Symbol:xbe****90 percent of the 226 initial investigations and 94 percent of the 304 reinvestigations****Symbol:xbe****were deficient; that is, they did not contain the information in at least 1 of the 9 investigative areas provided in the federal standards for granting clearances; o 77 percent of the investigations were deficient in meeting the federal standards in two or more areas; and o initial investigations had an average of 3.1 investigative deficiencies per investigation and reinvestigations averaged 2.7 deficiencies. Figure 2 shows the percent of deficiencies among all four DOD adjudication facilities included in our sample. Appendix IV includes more information regarding these deficiencies. Figure****Helvetica:x11****2: Percent of Personnel Security Investigations with Deficiencies ***************** <Graphic -- Download the PDF file to view.> ***************** Note: An investigation could be deficient in up to nine areas. In our review, the maximum number of deficiencies was eight. Source: GAO sample of 530 DSS investigations. As shown in figure 3, we found problems primarily in six of nine areas required to be investigated for a security clearance by the federal standards./Footnote6/ Frequently, DSS did not obtain one or more of the following types of information: confirmation of residency; corroboration of birth or citizenship for a foreign-born subject, spouse, or family member; verification of employment; interviews of character references; check of local agency records for any criminal history, divorce, or financial problems; and corroboration of education. DSS frequently met the requirement to conduct national agency checks, and almost always conducted financial checks. Both checks are done in an automated manner. In addition, DSS almost always conducted subject interviews. Figure****Helvetica:x11****3: Percent of Deficient Investigations in Nine Required Investigative Areas ***************** <Graphic -- Download the PDF file to view.> ***************** Source: GAO sample of 530 DSS investigations. DSS also did not pursue issues needed for making clearance decisions that arose in 84 of the 530 investigations (16 percent) that we reviewed./Footnote7/ These issues included prior criminal history, failure of a prior polygraph examination, potential foreign allegiance, serious sexual issues, alcohol and drug use, and financial problems, including large outstanding debts and bankruptcy. Officials at DSS, the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), and the DOD adjudication facilities said that issues such as these should be pursued. Derogatory information on these issues could potentially disqualify an individual from being granted a clearance. Further, since financial gain has been the major reason individuals committed espionage, the failure to resolve issues pertaining to large outstanding debts and bankruptcy is of particular concern. The following are examples of the types of issues we found that DSS investigators did not pursue. o In an initial investigation for an individual involved in special operations, DSS did not address allegations by character references that the subject, a former police officer, had assaulted an inmate or had an affair that produced a child. In addition, DSS did not contact creditors owed nearly $1,000 in past due accounts with an additional $2,800 that had been charged off. o In an initial investigation for an individual assigned to a communications unit, the subject's credit report listed a bankruptcy. The investigative file did not show that DSS questioned the subject about the matter or made any further attempt to address it. o In a reinvestigation for an electronics technician, DSS did not verify the subject's claim of foreign military service and citizenship. In addition, DSS did not resolve whether the subject might have been involved in shooting another individual. o In a reinvestigation for a systems engineer, the subject stated that he had failed a polygraph test regarding loyalty to the United States. He claimed he was loyal, but he could not explain the test results. DSS did not perform an additional polygraph or provide documentation on the failed test. o In a reinvestigation for an individual in a joint service office, the subject's credit report showed $10,000 past due on a mortgage and indicated that the lender had begun foreclosure proceedings. The subject denied knowledge of the matter and DSS did not contact the lender. DSS Investigations Have Not Been Timely --------------------------------------- DSS investigations have not been timely in two respects. First, once requests for investigations are received and logged in as open cases, DSS has not completed them in the time that its customers, such as the military services and industrial contractors, need them to be completed. According to DSS customers and the Joint Security Commission, when investigations take longer than 90 days (1) the military services are unable to assign servicemembers to jobs that require clearances and (2) defense contractors incur financial costs because their personnel cannot begin work on DOD contracts. Second, periodic reinvestigations are overdue because they have not been initiated within the periods established by federal standards. In 1994 and 1999, the Joint Security Commission reported that delaying reinvestigations poses risks to national security because the longer individuals hold clearances, the more likely they are to be working with more critical information and systems. DSS investigation time has not met customers' needs The federal standards do not contain any specified time requirements for agencies to complete their investigative work. However, DSS's customers (the military services, DOD civilian agencies, and industrial contractors) and adjudication officials stated that they need DSS to complete its investigations within 90 days. The Office of Personnel Management, which conducts personnel security investigations for employees of non-DOD federal agencies, uses a standard of completing its work in 35, 75, or a maximum of 120 days, depending on the price the customer is willing to pay for the service./Footnote8/ From our review of 530 investigations, we found that the median time for DSS to complete investigative work was 204 days--more than twice as long as what its customers want./Footnote9/ Figure 4 shows that DSS completed 4 investigations, less than 1 percent, in less than 90 days; 11 percent (57 investigations) took more than 1 year. Figure****Helvetica:x11****4: Calendar Days Needed to Complete Investigations ***************** <Graphic -- Download the PDF file to view.> ***************** Source: GAO sample of 530 DSS investigations. Adjudication facility officials said that because of the amount of time it has taken to receive DSS investigative reports, they have been reluctant to return incomplete investigations to DSS because of further delays. When they have returned investigations to DSS for additional work, it has not been unusual to wait an additional 6 months for DSS to complete the work. Adjudication officials said that they frequently made decisions to grant or deny clearances based on incomplete investigations because it would simply take too long to have DSS obtain the missing information. They considered this a judicious weighing of the risks entailed. In 1994, the Joint Security Commission reported that the costs to DOD directly attributable to delays in obtaining security clearances was as high as several billion dollars in fiscal year 1994 for workers who were unable to perform their jobs while awaiting a clearance./Footnote10/ In February 1999, representatives of several contractors wrote a letter to the DSS Director complaining about the time taken to clear personnel scheduled to work on defense contracts and pointing out that the delays were threatening to affect some facilities' ability to effectively perform on contracts and meet cost schedules. They noted that 64 percent (1,426) of the 2,236 investigations they had requested were pending for more than 90 days, with 76 investigations pending since 1997. Periodic reinvestigations are overdue The federal standards require a periodic reinvestigation of individuals granted access to classified information. Clearances are outdated if a reinvestigation has not been initiated in the past 5 years for top secret clearances, 10 years for secret clearances, and 15 years for confidential clearances. Historically, DOD has had a large backlog of overdue reinvestigations. In fiscal year 1986, DOD had a backlog of 300,000 overdue reinvestigations./Footnote11/ According to the Deputy Secretary of Defense, in June 1999, about 600,000 DOD clearances were based on outdated investigations. However, DOD is not certain of the total number of overdue reinvestigations, and was analyzing the backlog at the time that we completed our work. According to the 1999 report by the Joint Security Commission II, as many as 700,000 reinvestigations are overdue and the backlog was continuing to grow./Footnote12/ The Commission recommended that DOD should (1) begin to fully enforce the standards for reinvestigations and (2) screen all individuals whose reinvestigations are overdue to identify those whose positions and access suggest the highest risk, and provide resources to complete those reinvestigations promptly. At the time we completed our work in September 1999, DOD was determining its response to this recommendation. Management Actions and Inadequate Oversight Have Weakened Investigations The lack of completeness and timeliness in the DSS personnel security investigation program can be traced, in part, to several management actions by DSS and inadequate oversight by the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence). Management actions that affected investigative completeness have included DSS (1) causing confusion and raising concerns by adopting relaxed investigative policy guidance that gives investigators greater discretion in doing their work, (2) eliminating important investigative quality control mechanisms, and (3) inadequately training its investigative staff and case analysts. Many of these actions were adopted from 1996 to 1998, under a policy of reinventing business practices. DSS based its mandate for these changes on (1) the National Performance Review, which called for improving government at less cost; (2) the 1994 report of the Joint Security Commission, which called for defining the security needed in terms of an affordable price; and (3) DOD's 1997 Quadrennial Defense Review, which called for DSS to streamline the security investigative process and charge its customers for investigations. Additionally, inadequate planning by DSS management for a new automation initiative has caused further delays in the timely completion of investigations. DSS Relaxed Its Investigative Guidance --------------------------------------- The incomplete DSS personnel security investigations stemmed, in part, from the organization's reinvention effort to streamline investigative requirements. DSS relaxed its prior investigative policy guidance, thereby allowing investigators greater discretion****Symbol:xbe****but also causing much confusion****Symbol:xbe****regarding the work needed to complete investigations. In two instances, DSS's relaxed guidance was inconsistent with federal standards. In adopting the relaxed guidance, DSS also ignored the concerns of DOD officials and the Security Policy Board about the adverse effects of the policy changes on the completeness of investigative work. The officials were concerned that these changes would result in the adjudicators not having sufficient information to make informed clearance decisions. The Security Policy Board was also concerned that DSS's policy changes would hinder efforts to achieve reciprocity of clearances between DOD and other federal agencies. DSS investigative policies give greater discretion to investigators In June 1996, the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) formally announced that DOD would adopt the new federal investigative standards as of July 1, 1996, while they were being reviewed by the National Security Council. In implementing the new standards, however, DSS began to relax its prior investigative requirements. Between August 1996 and February 1999, DSS issued 31 policy letters directly related to the manner in which investigations were to be conducted. Several letters announced policy changes that gave investigators greater discretion in how they would meet the standards or pursue issues that might be of significance in deciding to grant clearances. This greater discretion is illustrated below: o In August 1996, DSS eliminated its requirement to contact creditors about debts not listed on credit reports but revealed by the subject; and in November 1996, DSS eliminated its practice of routinely contacting creditors to verify the status of disputed accounts, instead relying on the subject's documentation. o In October 1996, DSS eliminated its requirement to confirm allegations of adultery and stated that the subject should be questioned "briefly" about the matter. o In October 1996, DSS issued policy guidance that allowed investigators "broad leeway" in deciding whether to obtain character references from the subject's neighborhood. In May 1997, DSS issued additional policy guidance that allowed investigators broad leeway in determining how the subject's residence will be confirmed. o In October 1996, DSS encouraged discretion in pursuing alcohol-related issues, stating that "only a minimal number of specific leads to resolve" alcohol-related issues are required and "cases will no longer be routinely expanded as issues based solely on one alcohol-related incident within the last three years." o In December 1996, DSS eliminated its previous requirement for its investigators to verify federal employment using personnel records if there was no issue to resolve. o In November 1998, DSS adopted a policy providing that the time period to be covered in a reinvestigation is to be the period since the last investigation or the most recent 5-year period, whichever is shorter. DSS currently has about 600,000 reinvestigations that are overdue, in that it has been more than 5 years since the last investigation. Thus, DSS policy allows for gaps in developing information that could be relevant in making a clearance decision. DSS's policies were also inconsistent with federal investigative standards in two areas****Symbol:xbe****the requirement to conduct local agency checks and to verify public records. o Federal standards require local agency checks of criminal history records for the last 10 years for all locations where a subject has lived, been employed, and/or attended school for 6 months or more. However, it has been DSS policy not to conduct these checks if the local jurisdiction charges a fee for this service, an exception not provided for in the federal standards. o With regard to public records, the federal standards require verification of divorces, bankruptcies, and other court actions, whether civil or criminal, involving the subject. For civil actions, DSS policy requires that records of divorce be routinely reviewed. In cases of bankruptcy, DSS policy requires review only if the bankruptcy occurred within the last 2 years. For all other civil actions, DSS policy requires review only if it appears likely that suitability issues are involved. The federal standards, however, do not provide for exceptions based on date of the event, "suitability issues," or any other reason. These policy changes have confused many investigators about what investigative work is to be done. In responding to our surveys, 59 percent (625) of the 1,061 investigator respondents and 90 percent (79) of the 88 case analyst respondents said that DSS policy guidance has resulted in confusing investigative requirements, while only 23 percent (239) of the investigators and 3 percent (3) of the case analysts said that it has clarified requirements. When we completed our work in September 1999, these policies were still in effect but being reviewed by the acting DSS Director. DOD officials and the Security Policy Board raised concerns about DSS's revised policies In our review of DSS policies, we discussed the DSS revised investigative policy guidance and the DSS process for adopting policy changes with officials in the DOD Office of the General Counsel assigned to DSS, the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), the eight adjudication facilities, and the Security Policy Board. These officials expressed two overall concerns about the impact of DSS's policy changes: (1) the DSS investigations have increasingly provided less complete information for use by adjudicators in determining whether to grant clearances and (2) the revised policies undercut the Security Policy Board's efforts to achieve uniformity among federal agencies conducting personnel security investigations. These officials stated that, for the most part, the DSS Deputy Director for Policy presented the policy changes to them after decisions had been made rather than consulting with them in advance. The officials also said that DSS had adopted certain policies that were not consistent with their expectations about how federal agencies would meet the federal standards. Adjudication facility officials described frequent shortfalls in many of the investigative areas covered by the federal standards, such as failures to corroborate citizenship of a foreign-born subject, spouse, or family member; verify employment; or conduct local agency checks for prior criminal histories. Adjudication officials also stated that DSS often failed to pursue issues, such as unexplained affluence. Furthermore, the officials from the Defense Office of Hearings and Appeals, which serves as the appeal board for DOD and industry personnel whose clearances have been denied or revoked, said that the investigative information provided by DSS was frequently insufficient to make an informed determination about a denial or revocation of a clearance being appealed. In addition, in their policymaking actions, DSS officials have ignored the explicit concerns of the Security Policy Board regarding the goal of achieving investigative uniformity. The following examples illustrate this problem: o In October 1996, DSS's Deputy Director for Investigations briefed the Board's Personnel Security Committee on DSS reinvention efforts and its proposal to eliminate neighborhood checks. The Committee disagreed with this change and noted that DOD was a full partner in the cooperative effort to develop new, standard investigative and adjudicative policy and that unilateral action by DSS would undermine the process. The Committee also said that a failure by DSS to meet the federal standards would constitute a serious deterioration in the quality of its investigations and would unacceptably increase risk. In correspondence dated October 28, 1996, the Board notified all Security Policy Forum members and others, including the Deputy Secretary of Defense and the DSS Director, of its concerns about DSS initiatives that it believed would run counter to the investigative standards, focusing especially on the adverse effect on reciprocity when agreed upon standards are ignored. It reiterated that Presidential Decision Directive 29 established the Security Policy Board structure as the vehicle for "vetting and proposing security policies" and advised DSS to bring any proposed changes to the standards to the Board. DSS, however, continued to revise and implement relaxed investigative policies after the Board's instruction. o In March 1998 correspondence to the Security Policy Board's Staff Director, the Chairman of the Board's Personnel Security Committee expressed concerns about DSS's intent to unilaterally initiate changes to investigative policies. The Chairman believed DSS's changes constituted a departure from federal standards. The Chairman noted that, in January 1997, the Personnel Security Committee advised that the Board's Personnel Security Research Subcommittee (comprised of representatives from DSS, the Central Intelligence Agency, and other agencies) was the appropriate organization to coordinate and vet research initiatives to change national standards. Moreover, the Committee emphasized that all personnel security investigative standards should continue to be assessed and refined under the cognizance of the Security Policy Forum. In April 1998, the Board's Staff Director notified all Personnel Security Committee members and DOD about these concerns and advised that any research initiatives regarding the standards should be vetted through the Board's processes. In February 1999, when we brought these concerns to the attention of DSS officials, the Deputy Director for Policy acknowledged that DSS's proposed policy changes were not sufficiently coordinated with key officials, including the DOD General Counsel, the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), the adjudication facilities, and the Security Policy Board. In July 1999, the acting DSS Director stated that he would review DSS policies and procedures to ensure that they are consistent with the federal standards. The Director also plans to improve the liaison with the Board, including meeting monthly to discuss investigative standards. Important Quality Control Mechanisms Have Been Eliminated --------------------------------------------------------- The elimination of important quality control mechanisms has also compromised the quality of DSS investigations. In the absence of such mechanisms, DSS investigations have been sent for adjudication with virtually no review to determine if they are complete and meet federal investigative standards. DSS had two major quality control procedures to review investigative work until 1996, when both were eliminated as a part of reinvention efforts. First, field supervisors routinely reviewed completed investigations before forwarding them to the DSS Operations Center. Second, the quality assurance branch, composed of seven investigators, conducted weekly reviews of a sample of completed investigations. The quality assurance branch also published a quarterly newsletter on common investigative problems. By eliminating both the quality assurance branch and supervisory reviews, the 112 case analysts in the DSS Operations Center became the only quality control mechanism, responsible for reviewing about 150,000 investigations per year. The analysts that we spoke with stated they have been so consumed with processing investigations that they have spent little time reviewing the quality of investigative work. Before 1996, DSS used two other programs to ensure quality. It sent letters to a sample of individuals interviewed by DSS investigators to determine if the investigators were respectful and courteous, and it periodically had supervisors accompany their subordinates to become familiar with how the work was being done. These programs allowed DSS to determine that investigators were actually and properly conducting their work. Both programs were eliminated in 1996 under reinvention efforts at DSS. DSS Staff Training Has Been Inadequate -------------------------------------- Investigative quality has also been diminished by a lack of training on the federal standards for the investigative and case analyst staffs. During the past 3 years, DSS provided almost no formal training, especially on the standards, and DOD dismantled the major training infrastructure that provided the training. Consequently, the investigative and case analyst staffs may not be fully aware of what the federal standards require. DSS acknowledged that it has conducted little training for its staff on the new federal investigative standards. Our analysis of DSS training data for fiscal year 1998 showed that DSS conducted 31 training courses attended by 2,468 DSS personnel. Only five of these courses covered personnel security topics; 414 staff attended these courses. The remaining 26 courses covered industrial security topics, classification procedures, technical computer training, adjudication, information security, and other topics. DSS officials stated that since few investigators have been hired in recent years due to a hiring freeze, DSS did not believe that training covering the new federal standards was necessary. In June 1999, the acting DSS Director stated that no formal training for case analysts has been conducted since 1991. Thus, the analysts may not be fully aware of what the federal standards require as they review investigations forwarded from DSS's field locations. Cutbacks in the DSS training infrastructure have contributed to a lack of training. In 1997, DOD eliminated the main investigator training organization at DSS, the DOD Security Institute in Richmond, Virginia. Besides training DSS staff on investigative and other security procedures, the Institute trained other federal agency and contractor personnel on security procedures. In November 1997, the functions of the DOD Security Institute were integrated into DSS, along with the DOD Personnel Security Research Center and the DOD Polygraph Institute. The Security Institute's functions were transferred to the DSS Office of Mission and Training in Baltimore, Maryland. One year after the transfer, DSS studied its investigative training program and found major deficiencies. DSS concluded, among other things, that (1) the infrastructure was not in place for quality training, (2) many training courses were obsolete, (3) no means existed to evaluate staff training needs, (4) training had not met the customers' needs, (5) refresher training and continuing education were lacking, and (6) a new curriculum was not developed because of a lack of resident expertise. Based on the study, DSS established a training task force to oversee the training office. In May 1999, DSS hired a training director, and in July 1999, the acting DSS Director established a new DSS training organizational entity, the Defense Security Service Academy. The respondents to our investigator survey provided information on their training, which we defined to include both staff meetings covering investigative standards and formal classroom training. Many of the 1,009 investigators who answered the questions on training in our survey said that they were not trained or could not recall receiving any training on many of the federal standards since 1996./Footnote13/ Figure 5 shows the areas where investigators most frequently cited a lack of training in their responses to our survey. A complete analysis of the investigators' training responses is presented in appendix V. Figure****Helvetica:x11****5: Percent of Investigators Without Recent Training on Investigative Requirements ***************** <Graphic -- Download the PDF file to view.> ***************** Note: We did not include information on national agency checks because investigators do not perform this function. Source: GAO survey of 1,009 DSS investigators who provided information on their training. Transition to Automated Case Management Has Led to Case Processing Delays ------------------------------------------------------------------------- DSS did not properly plan for the implementation of its new case management automation initiative, referred to as the Case Control Management System (CCMS). As a result, DSS has not been able to process its investigations, and the volume of investigations sent to DSS field agents for investigative work and to the adjudication facilities for clearance decisions has decreased. This has caused further delays in the processing of investigations. The CCMS was supposed to expedite case processing by linking all relevant information critical to an investigation through a series of subsystems. These subsystems include o the Electronic Personnel Security Questionnaire, which collects electronically the personnel security data to initiate and conduct an investigation; o the Field Information Management System, which generates field investigative reports that are then fed into the system; o the Files Automation Scanning System, which converts paper personnel security questionnaires and attachments into electronic form for storage and retrieval; o the Defense Clearance and Investigations Index, which integrates the system's applications with the central index of all DOD personnel security investigations and clearances; and o the Industrial Security System, which is a separate application that shares information in the corporate database. DSS officials acknowledged that CCMS (for which DOD has spent about $100 million) has not operated as intended, is not year 2000 compliant,/Footnote14/ and may cost about an additional $100 million to stabilize. DOD officials confirmed that DSS did not complete the system acquisition planning steps required by DOD Directive 5000.1 or adequately test the system before implementation./Footnote15/ In addition, when the system was implemented, DSS eliminated its existing capability before ensuring that the new system would operate as intended and ensure it could retrieve previously developed information. Further, even after this system achieves a stable operational status, DOD may have to replace it in order to meet user requirements. DSS officials estimated that they should know in 6 months to 1 year what alternatives are available and the approximate cost to complete this automation effort. DSS has experienced significant system start-up problems with CCMS. For example, CCMS has been unable to accept data from the electronic personnel security questionnaire needed to open investigations and cannot produce investigative reports. Instead of expediting the transmission of requests for investigations and reports to and from DSS field offices, system problems have caused serious delays in information processing and resulted in a dramatic drop in the number of case openings and field investigations. Our survey of DSS investigators reflected this drop in the number of investigations being undertaken in DSS's field offices. We asked the investigators about their workload before and after CCMS implementation. As shown in figure 6, 58 percent stated that they had too much investigative work before the new system was implemented; 23 percent said they had too little work; and 9 percent said their workload was appropriate. Since the new automation system was implemented the situation has reversed: 60 percent of investigators stated that they have had too little work, only 25 percent said that they have had too much work, and 9 percent said that their workload has been appropriate. Figure****Helvetica:x11****6: Investigators Views on Workload ***************** <Graphic -- Download the PDF file to view.> ***************** Source: GAO survey of 1,061 DSS investigators. Our analysis of the volume of completed investigations sent for clearance decisions to the four DOD adjudication facilities included in our review corroborates the investigators' views about the substantial decrease in workload since the new case management system was implemented. For example, in fiscal year 1998, the Air Force adjudication facility received, on average, more than 2,200 completed investigations per month from DSS. From October 1998 through June 1999, it received about 900 completed investigations per month. Table 1 shows the volume of investigative receipts for four of the eight adjudication facilities before and after CCMS implementation. Adjudication facility officials stated that the delays in receiving completed investigations prevent DOD from assigning individuals to high-priority units that require a security clearance for their personnel. Table****Helvetica:x11****1: Comparison of DSS Investigations Sent for Adjudication Before and After CCMS Implementation -------------------------------------------------------------------------- | Adjudicat : Average monthly : Average monthly : Differe : Percent | | ion : receipts : receipts : nce : change | | facility : : : : | | : (Oct. 1997 - : (Oct. 1998 - : : | | : Sept. 1998) : June 1999) : : | |------------------------------------------------------------------------| | Air Force : 2,238 : 901 : -1,337 : -60 | |------------------------------------------------------------------------| | Army : 2,044 : 1,292 : -752 : -37 | |------------------------------------------------------------------------| | Navy : 1,920 : 947 : -973 : -51 | |------------------------------------------------------------------------| | NSA : 448 : 149 : -299 : -67 | -------------------------------------------------------------------------- Source: GAO analysis of data from Air Force, Army, Navy, and National Security Agency adjudication facilities. DSS officials stated that, for the most part, DSS has not been able to use CCMS to process investigations as intended. As a temporary solution to the start-up problems, DSS has recruited investigators, reserve military personnel, and Office of Personnel Management employees to open and scope investigations manually, and it has attempted to make emergency repairs to the system. The acting DSS Director has placed a high priority on correcting the problems with CCMS. He has established a project office to provide a short-term capability that will allow DSS to process investigations, and he is working on long-term alternatives for a permanent solution. The acting Director expects to study the long-term options in 2000. Inadequate Oversight of DSS Has Allowed Quality Problems to Persist and Increased the Number of Overdue Reinvestigations --------------------------------------------------------------------------- DSS has operated for at least 4 years with little or no oversight from the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), which is responsible for assessing the completeness of DSS investigative work. Officials in the Office of the Assistant Secretary stated that there had been little oversight of the management of DSS, including monitoring the investigative work and whether DSS was properly planning its automation efforts. Sound management practices call for such oversight. The officials stated that once DSS became a reinvention laboratory, it was allowed to operate, for the most part, at its own discretion. Inadequate oversight has also resulted in a large backlog of overdue reinvestigations. In June 1999, the Senior Civilian Official in the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) attributed the backlog to (1) DOD's need to implement the federal standards that lowered the interval for secret clearances from 15 to 10 years and set a new 15-year requirement for confidential clearances and (2) the restrictions his office imposed from fiscal year 1996 to the present on the number of reinvestigations that DOD components could request./Footnote16/ DOD implemented these restrictions in an effort to reduce the time for completing investigations received by DSS. However, the Office of the Assistant Secretary did not monitor the effect that these restrictions had on the number of overdue reinvestigations until the situation became critical. In 1995, the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) directed DOD components to cease submitting reinvestigation requests that were due to DSS because, if such action was not taken, the average investigation completion time would exceed 278 days. Instead, the Defense Manpower Data Center would identify individuals for reinvestigation based on (1) the length of time since the last investigation and (2) potentially disqualifying issues raised in the last investigation./Footnote17/ In June 1996, the Assistant Secretary revised the policy to allow DOD components to submit up to 40,000 secret and 42,000 top secret reinvestigation requests per year--commonly referred to as a quota. While these restrictions may have helped to reduce the time to complete DSS investigations, from 278 days to 204 days, the policy has contributed to a backlog of 600,000 overdue reinvestigations. DSS Has Acted to Improve Investigations but Lacks Corrective Action and Strategic Plans In recognition of the problems confronting DSS, DOD recently appointed an acting DSS Director who has been developing a series of corrective actions for the problems we identified. Despite the serious and widespread nature of the completeness, timeliness, and other problems affecting the personnel security investigation program, DOD has not planned to report these problems under the Federal Managers' Financial Integrity Act. Further, DOD has not yet developed a strategic plan for the program that includes measurable program goals and performance measures as required under the Government Performance and Results Act (GPRA) of 1993./Footnote18/ New Acting DSS Director Taking Steps to Improve Investigative Quality and Timeliness, but Formal Corrective Plan Is Needed --------------------------------------------------------------------------- DOD has begun to address several DSS management weaknesses that have affected the quality of personnel security investigations. In June 1999, the Deputy Secretary of Defense appointed a new acting DSS Director charged with improving the overall management of the organization. In June 1999, we briefed the acting Director on the preliminary results of our work. The Director stated that DSS would address the large backlog of clearance reinvestigations, the case management automation problems, any lack of consistency between DSS policy and investigations and the federal standards, and the lack of training and quality control mechanisms. In July and August 1999, the Director began to take a series of actions, including the following: o Working with the Defense Management Data Center, DSS will define the extent of the reinvestigation backlog to assist other DOD components in prioritizing those individuals in the most critical positions to support DOD missions. After preliminary discussions with the Office of Personnel Management and private contractors, DSS plans to seek their assistance to eliminate the backlog of overdue reinvestigations. o The Director has initiated a review of all investigative policy guidance and procedures to ensure that DSS complies with federal standards. DSS subsequently plans to issue a new investigative manual. o The Director stated that he is re-instituting a uniform quality assurance function in DSS and has tasked the DSS Inspector General to periodically review the quality of investigative work. o The Director has created a Defense Security Service Academy that will be responsible for training all DSS staff on the federal standards and implementing the recommendations from the 1998 DSS training report. o DSS, with the assistance of the U.S. Air Force, established a program office to lead the effort to stabilize the current automation system. As of August 1999, DSS officials could not estimate the level of effort or funds needed to resolve the automation problem. Preliminary estimates ranged from $100 million to over $300 million in additional funding requirements. DSS officials acknowledge it would be another 6 months to 1 year before alternatives could be identified and a course of action is planned. While the acting DSS Director is taking positive steps to improve the personnel security investigation program, at the time we completed our fieldwork in September 1999, DOD had not planned to report the identified control weaknesses in this program as material weaknesses under the Federal Managers' Financial Integrity Act. Under the act, agency managers are publicly accountable for correcting deficiencies; the head of each agency reports annually to the President and the Congress on material internal control weaknesses and on formal plans for correcting them./Footnote19/ According to officials in the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), the weaknesses are due, for the most part, to the discretion given to DSS over its management, which resulted in the issuance of relaxed investigative policy guidance, elimination of quality control mechanisms, and inadequate investigative work. The serious and widespread nature of the problems and the weaknesses in DSS's internal control systems for the personnel security investigation program would typically warrant reporting under the Federal Managers' Financial Integrity Act. DSS Improvements Have Not Been Guided by a Strategic Plan or Methods to Measure Performance --------------------------------------------------------------------------- Under GPRA, federal agencies are required to set strategic goals, measure performance, and report on the degree to which goals were met. GPRA incorporates performance measurement as one of its most important features. Executive branch agencies are generally required to develop annual performance plans that use performance measurement to reinforce the connection between strategic goals and the day-to-day activities of their managers and staff. The annual performance plans are to include performance goals for an agency's program activities as listed in the budget, a summary of the necessary resources to conduct these activities, the performance indicators that will be used to measure performance, and a discussion of how the performance information will be verified. DOD does not have a strategic plan for DSS's personnel security investigation program that includes goals and performance measures. The acting DSS Director has recognized the need for such plans, and DSS is in the early stages of developing them. In addition, DSS currently lacks adequate methods to measure the quality of its investigative work. DSS has used two primary measurement methods: (1) a customer assessment team that met periodically with adjudicators and requesters of investigations to determine their satisfaction with DSS investigative work and (2) the number of completed investigations returned by the adjudication facilities for re-work. Based on these measures, DSS determined that its customer assessments "have not raised any systemic issues" and that the adjudication facilities have returned only a small number of investigations (1 percent) for re-work due to incomplete investigations. Based on these results, former DSS officials stated that they believed DSS customers were satisfied with its work. Contrary to this DSS view, officials in all eight adjudication facilities told us that they had complained about the quality and timeliness of the investigative work on numerous occasions. As discussed earlier, DSS's reliance on the number of cases returned for re-work is not a valid indicator of the quality of its investigative work because the adjudication facility staffs only return a small number of incomplete investigations because they said that it takes too long for DSS to complete the work and return the cases. Without independent performance measures, DSS cannot be sure it has accurate data on work quality. In addition, although DSS has established time goals for completing its investigations, it has not met its customers' needs to have investigations completed within 90 days. In fiscal year 2000, DSS goals are to complete (1) 75 percent of top secret initial investigations for military and civilian personnel within 120 days and 90 percent within 220 days and (2) 50 percent of top secret periodic reinvestigations within 180 days and 90 percent within 300 days. However, DSS has not conducted any workload analysis to determine the caseload that its investigators and case analysts can carry and produce timely, high- quality work. Without such information, it is difficult to determine what level of staff is necessary. Conclusions DOD investigations have not fully complied with federal personnel security investigative standards, creating risks to national security by granting security clearances based on incomplete investigations. Although there is no guarantee that individuals fully investigated will not engage in espionage activities, these investigations are a critical first step in ensuring that those granted access to classified information can be trusted to safeguard it. At this time, DOD cannot make such assurances. Problems at the Defense Security Service, combined with the lack of adequate oversight by the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), have allowed the weaknesses in the Defense Security Service's personnel security investigations program to persist and go unreported. The Defense Security Service has implemented investigative policies that relaxed its prior requirements and gave its investigators greater discretion in doing their work. As a result, nearly 60 percent of the Defense Security Service investigators and 90 percent of the case analysts reported being confused about the investigative work required, and according to the Security Policy Board, DOD has hindered efforts to achieve uniformity among federal agencies in conducting clearance investigations. More importantly, the completeness of Defense Security Service investigations has been significantly compromised. DOD has stated that many of the changes in the management of personnel security investigations were undertaken as efforts to reinvent the Defense Security Service using better business practices; however, Defense Security Service actions have not achieved this result. Rather, the reinvention efforts have eroded the completeness and timeliness of clearance investigations. As a result, hundreds of thousands of individuals can access classified information without assurances of their trustworthiness and reliability because their investigations may be incomplete and the reinvestigations for many are overdue. Moreover, the reduced volume of investigations processed by the Defense Security Service since October 1998 has hindered contractors' efforts to meet cost and performance schedules. Finally, the Defense Security Service has not planned to report this program as containing material internal control weaknesses, in accordance with the Federal Managers' Financial Integrity Act. There are no quick and easy solutions to the problems in the Defense Security Service's personnel security investigations program. It may take several years before DOD can fully implement the needed corrective policy and infrastructure changes, and the cost of the corrective actions may be substantial. The actions that the acting Defense Security Service Director has taken are steps in the right direction, but few definitive plans for improvements have been developed and many planned actions have not yet been implemented. The Defense Security Service does not yet have a strategic plan that establishes program goals and measures to assess its performance against the goals. In addition, the plans for separate activities--such as revising investigative policy guidance, re-instituting quality control mechanisms, and providing an infrastructure for training-- have not yet been brought together into an overall corrective action plan. Additionally, the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) has not developed specific plans for improving its oversight of Defense Security Service activities. Recommendations Because of the significant weaknesses in the DOD personnel security investigation program and the program's importance to national security, we recommend that the Secretary of Defense direct the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) to o report the personnel security investigation program as a material weakness under the Federal Managers' Financial Integrity Act to ensure that the needed oversight is provided and that actions are taken to correct the systemic problems in the Defense Security Service personnel security investigation program; o improve its oversight of the Defense Security Service personnel security investigation program, including approving a Defense Security Service strategic plan; and o identify and prioritize overdue reinvestigations, in coordination with other DOD components, and fund and implement initiatives to conduct these reinvestigations in a timely manner. In addition, we recommend that the Secretary of Defense instruct the Defense Security Service Director, with oversight by the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), to o develop a corrective action plan as required under the Federal Managers' Financial Integrity Act that incorporates corrective actions and milestones for addressing material weaknesses in the Defense Security Service personnel security investigative program and performance measures for monitoring the progress of corrective actions; o establish a strategic plan that includes agency goals, performance measures, and procedures for tracking progress in meeting goals in accordance with sound management practices and the Government Performance and Results Act; o conduct analyses needed to (1) determine an appropriate workload that investigators and case analysts can manage while meeting federal standards and (2) develop an overall strategy and resource plan to improve the quality and timeliness of investigations and reduce the number of overdue reinvestigations; o review and clarify all investigative policy guidance to ensure that investigations comply with federal standards; o establish a process for identifying and forwarding to the Security Policy Board suggested changes to policy guidance concerning the implementation of the federal standards and other investigative policy issues; o establish formal quality control mechanisms to ensure that Defense Security Service or contracted investigators perform high-quality investigations, including periodic reviews of samples of completed investigations and feedback on problems to senior managers, investigators, and trainers; o establish a training infrastructure for basic and continuing investigator and case analyst training that includes formal feedback mechanisms to assess training needs and measure effectiveness, and as a high priority, provide training on complying with federal investigative standards for investigators and case analysts; and o take steps to correct the case management automation problems to gain short-term capability and develop long-term, cost-effective automation alternatives. Further, we recommend that the Secretary direct all DOD adjudication facility officials to (1) grant clearances only when all essential investigative work has been done and (2) regularly communicate with the Defense Security Service about continuing investigative weaknesses and needed corrective actions. Agency Comments In written comments on a draft of this report, DOD agreed that the deficiencies cited in the report represent a potential risk to the DOD personnel security program and the protection of classified information. DOD concurred with all our recommendations to improve its personnel security investigation program. DOD also stated that it plans to aggressively monitor and report on progress to remedy the problems we disclosed and to fully implement all recommendations, including complying with the reporting requirement under the Federal Managers' Financial Integrity Act. DOD further described many actions already planned or under way to implement each recommendation. When fully implemented, these actions should correct the significant weaknesses we found in our review. DOD's comments are presented in their entirety in appendix VI. DOD also provided technical comments, which we have incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 15 days after its issue date. At that time, we will send copies to the Honorable William S. Cohen, Secretary of Defense; the Honorable Arthur L. Money, Assistant Secretary of Defense (Command, Control, Communications, and Intelligence); the Honorable Louis Caldera, Secretary of the Army; the Honorable Richard Danzig, Secretary of the Navy; the Honorable F. Whitten Peters, Secretary of the Air Force; Lieutenant General Michael V. Hayden, Director, National Security Agency; and Lieutenant General (retired) Charles J. Cunningham, Jr., Acting Director, Defense Security Service. We are also sending copies to the Honorable Samuel Berger, Assistant to the President for National Security Affairs, and General (retired) Larry Welch, Chairman, and Mr. Dan Jacobson, Executive Director, Security Policy Board; and other interested parties. If you have any questions about this report, please call the contacts listed in appendix VII. Sincerely yours, ***************** <Graphic -- Download the PDF file to view.> ***************** Carol R. Schuster Associate Director, National Security Preparedness Issues -------------------------------------- /Footnote1/-^Personnel security investigations are the cornerstone of, but only a part of, DOD's personnel security program to prevent and detect espionage. Other mechanisms include employee education and counseling programs, continuing evaluations of employee workplace behavior, and counterintelligence operations. /Footnote2/-^See 31 U.S.C. 3512. /Footnote3/-^The Board, created by Presidential Decision Directive 29, consists of senior representatives from the following 10 federal agencies, departments, and other organizations: the Central Intelligence Agency; the National Security Council; the Office of Management and Budget; the Joint Chiefs of Staff; the Departments of Defense, Commerce, Energy, Justice, and State; and a non-defense agency rotated on an annual basis (now served by the Department of Transportation). /Footnote4/-^Secret and confidential clearances require proof of the subject's date and place of birth, national and local agency checks, and a financial review. /Footnote5/-^The Joint Security Commission was convened twice to review U.S. security policies and procedures. It issued reports on its work in 1994 and 1999. See appendix I for more detailed information on the Joint Security Commission's work. /Footnote6/-^For our analysis, we grouped interviews with former spouses with other character references. /Footnote7/-^Because the basic investigative work was incomplete in a high percentage of the cases we reviewed, we were unable to determine the extent to which other issues may have existed but were not identified. /Footnote8/-^OPM charges from $1,600 to about $3,000 for top secret investigations and reinvestigations. /Footnote9/-^The median is the point at which 50 percent of the investigations took longer than 204 days and 50 percent took less than 204 days. /Footnote10/-^In its 1994 report, the Joint Security Commission noted that DSS customers wanted clearance investigations completed within 90 days. At the time, it took DSS an average of 149 days to complete investigations. The Commission used an average cost of $250 per day beyond the 90-day standard for each DOD employee who was unable to perform their duties while awaiting a security clearance. /Footnote11/-^National Security: DOD Clearance Reductions and Related Issues (GAO/NSIAD-87-170BR, Sept. 18, 1987). /Footnote12/-^A Report by the Joint Security Commission II, August 24, 1999. /Footnote13/-^The Security Policy Board approved the new investigative standards in March 1996. In June 1996, DOD decided to implement the new standards while the National Security Council considered them for approval. The President approved the standards in March 1997. /Footnote14/-^The year 2000 problem results from the inability of a computer system at the year 2000 to interpret the century correctly from a recorded or calculated date having only two digits to indicate the year. As a result, the computer system could malfunction or produce incorrect information. To be year 2000 compliant, a computer system must be tested, verified, and validated to function or produce correct information when the year 2000 is encountered during its processing of automated data. /Footnote15/-^DOD Directive 5000.1, titled Defense Acquisition, contains policies and principles for all DOD acquisition programs. /Footnote16/-^From February 1998 until October 1999, a senior civilian official headed the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence). /Footnote17/-^The Defense Manpower Data Center, established in 1974, collects and maintains an archive of automated manpower, personnel, training, and financial databases for DOD. One of its databases (the Defense Clearance and Investigations Index) maintains data on active duty personnel, reservists, and DOD civilians and contractors who have been involved in a security clearance investigation or adjudication. /Footnote18/-^See 5 U.S.C. 306 and 31 U.S.C. 1115. /Footnote19/-^See 31 U.S.C. 3512 (d)(2). RECENT BROAD-BASED STUDIES OF THE PERSONNEL SECURITY INVESTIGATION PROCESS ========================================================================== Since 1974, 21 studies have assessed various aspects of the personnel security investigation process. The Department of Defense (DOD) Inspector General, GAO, special commissions, and other groups conducted these studies. Most recently, the Joint Security Commission and the Commission on Protecting and Reducing Government Secrecy conducted three broad-based studies of the policies and procedures used for security investigations. This appendix describes the 33 recommendations made by these broad-based studies to improve personnel security investigations. The Security Policy Board is responsible for evaluating the recommendations and is tracking the status of their implementation. As of August 1999, 19 recommendations had been implemented, 2 had been rejected, and 12 were still under consideration. Redefining Security: A Report by the Joint Security Commission, 1994 -------------------------------------------------------------------- In May 1993, the Secretary of Defense and the Director of Central Intelligence established the Joint Security Commission to review security policies and procedures. It reviewed security procedures in DOD and the intelligence community and obtained advice from policymakers at all levels, including the Congress, military and industrial leaders, and public interest groups. The Joint Security Commission's 1994 report covered a wide variety of topics relating to security, including personnel security, classifying documents, threat assessments, physical security, and protecting technology and information systems. However, the Commission devoted most of its report to the personnel security investigation and adjudication processes. The Commission found the security clearance process needlessly complex, fragmented, and costly. It noted that (1) security clearances were sought for personnel who did not need them, (2) too many forms were required, (3) automation and information sharing were insufficient among federal agencies, and (4) investigations and adjudication were practiced differently across agencies. It made 23 recommendations related to the personnel security investigation and adjudication processes. At the time we completed our work in August 1999, 17 recommendations had been implemented, 5 were in process, and 1 had been rejected. Table 2 lists the recommendations and their status. Table****Helvetica:x11****2: Status of Joint Security Commission Recommendations ------------------------------------------------------------------------ | Recommendation : Status | |----------------------------------------------------------------------| | Request clearances only for personnel requiring : Implemented | | access to classified information : | |----------------------------------------------------------------------| | Standardize personnel security questionnaire : Implemented | |----------------------------------------------------------------------| | Establish investigative standards for secret : Implemented | | clearances : | |----------------------------------------------------------------------| | Establish reinvestigative standards for secret : Implemented | | clearances : | |----------------------------------------------------------------------| | Establish investigative standards for top secret : Implemented | | clearances : | |----------------------------------------------------------------------| | Establish reinvestigative standards for top secret : Implemented | | clearances : | |----------------------------------------------------------------------| | Grant interim clearances based on favorable review : Implemented | | of security questionnaire : | |----------------------------------------------------------------------| | Adopt common adjudicative criteria : Implemented | |----------------------------------------------------------------------| | Do not re-adjudicate individuals with existing : Implemented | | clearances : | |----------------------------------------------------------------------| | Limit the authority of program managers when making : Implemented | | access determinations : | |----------------------------------------------------------------------| | Do not use trial-type procedures for clearance : Implemented | | appeals by DOD civilian employees : | |----------------------------------------------------------------------| | Inform employees facing loss of clearances of right : Implemented | | to counsel : | |----------------------------------------------------------------------| | Make available documents pertaining to loss of : Implemented | | security clearances for review by employees : | |----------------------------------------------------------------------| | Give DOD civilian employees the right to personally : Implemented | | appeal clearance revocations or denials to : | | adjudication facility : | |----------------------------------------------------------------------| | Give DOD civilian employees the right to appeal any : Implemented | | adverse clearance decision to an appeal board : | |----------------------------------------------------------------------| | Give DOD military personnel facing clearance denials : Implemented | | same rights as civilian employees : | |----------------------------------------------------------------------| | Appoint an executive agent for security training : Implemented | |----------------------------------------------------------------------| | Institute fee-for-service mechanisms to fund : In process | | security requests : | |----------------------------------------------------------------------| | Increase investment in automation : In process | |----------------------------------------------------------------------| | Begin process improvement programs in all : In process | | investigative and adjudicative agencies : | |----------------------------------------------------------------------| | Develop standard measurable objectives for : In process | | investigations, adjudications, and appeals : | |----------------------------------------------------------------------| | Merge all DOD adjudicative entities : In process | |----------------------------------------------------------------------| | Establish a joint investigative service : Rejected | ------------------------------------------------------------------------ Source: GAO analysis of Redefining Security: A Report by the Joint Security Commission, Joint Security Commission, February 28, 1994. A Report by the Joint Security Commission II, 1999 -------------------------------------------------- On August 24, 1999, the Joint Security Commission issued its second report on the security systems of the United States. The Deputy Secretary of Defense and the Director of Central Intelligence reconvened the Commission to (1) assess the progress toward meeting the goals recommended in the Commission's 1994 report and (2) examine emerging security issues that may require increased emphasis due to electronic data systems, networks, and communications systems due to the increasingly global nature of businesses and technologies. With regard to personnel security investigations, the Joint Security Commission noted some progress toward achieving reciprocity as individuals move from one agency's security purview to another due to the adoption of the uniform investigative standards and adjudicative guidelines. However, it recognized that there were important issues regarding the appropriateness of some of the standards that needed to be resolved, such as neighborhood checks and financial data reporting, and recommended that a research effort should be conducted to determine the efficacy and effectiveness of personnel security policies. The Commission made six recommendations related to personnel security investigation and adjudication processes. Since they were very recent, all six recommendations were in process. Table 3 lists the recommendations and their status. Table****Helvetica:x11****3: Status of Joint Security Commission II Recommendations ----------------------------------------------------------------------- | Recommendation : Status | |---------------------------------------------------------------------| | The Security Policy Board should fund research on : In process | | the efficacy and effectiveness of personnel security : | | policies : | |---------------------------------------------------------------------| | DOD should begin to fully enforce the : In process | | reinvestigative standards and within 90 days should : | | screen all individuals overdue for reinvestigation : | | and promptly complete reinvestigations for those : | | whose positions and access suggest the highest risk : | |---------------------------------------------------------------------| | DOD and the Central Intelligence Agency should limit : In process | | interim clearances to 180 days : | |---------------------------------------------------------------------| | Efforts to create, coordinate, and implement : In process | | security training for government and industry should : | | continue : | |---------------------------------------------------------------------| | The Security Policy Board should charter a : In process | | coordinated, government-wide security awareness : | | program within : | | 2 years : | |---------------------------------------------------------------------| | Funding should be created to initiate security : In process | | training, awareness, and research projects by : | | designated federal departments and agencies : | ----------------------------------------------------------------------- Source: GAO analysis of A Report by the Joint Security Commission II, Joint Security Commission, August 24, 1999. Secrecy: Report of the Commission on Protecting and Reducing Government Secrecy, 1997 --------------------------------------------------------------------------- Title IX of the Foreign Relations Authorization Act for fiscal years 1994 and 1995 (Pub. L. 103-236, Apr. 30, 1994) created the Commission on Protecting and Reducing Government Secrecy. The Congress sought to (1) make comprehensive proposals to reduce the volume of classified information, (2) strengthen the protection of legitimately classified information, and (3) improve existing personnel security procedures. This Commission was the first authorized by statute to examine these matters in over 40 years. The Commission noted that the personnel security system was established after World War II as a means of supporting the classification system and implementing programs to investigate the loyalty of federal employees. It found that a variety of directives and regulations had been issued to meet these objectives, resulting in a buildup of rules and other inefficiencies. It noted that although Executive Order 12968 provided for common investigative and adjudicative standards to improve clearance reciprocity, strengthen appeal procedures, and other things, it did not supersede prior directives. In effect, the Commission said that the new order simply added another regulatory layer to prior directives and regulations regarding the personnel security system. The Commission concluded that the solutions to these problems called for a fundamental reevaluation of the personnel security system. It made four recommendations to improve the process. Two recommendations were implemented, one was in process, and one was rejected. Table 4 lists the recommendations and their status. Table****Helvetica:x11****4: Status of Secrecy Commission Recommendations ----------------------------------------------------------------------- | Recommendation : Status | |---------------------------------------------------------------------| | Make clearances reciprocal from one agency to another : Implemen | | : ted | |---------------------------------------------------------------------| | Establish guiding principles for an effective : Implemen | | personnel security system : ted | |---------------------------------------------------------------------| | Achieve a greater balance between initial clearances : In | | and continuing employee evaluations : process | |---------------------------------------------------------------------| | Eliminate neighborhood and educational interviews : Rejected | ----------------------------------------------------------------------- Source: GAO analysis of Secrecy: Report of the Commission on Protecting and Reducing Government Secrecy, March 3, 1997. SCOPE AND METHODOLOGY ===================== This review focused on DOD policies and procedures for conducting personnel security investigations to determine individuals' eligibility to access classified information. To determine whether DOD complied with federal investigative standards, we reviewed 530 cases that the Defense Security Service (DSS) sent to four adjudication facilities in January and February 1999 for individuals seeking a top secret clearance. We selected this period because DSS stated that it had instituted some special reviews of investigations in fiscal year 1998 to improve the investigations and that these changes should have been fully implemented by January 1999./Footnote1/ We selected separate random samples for the Air Force, the Army, the Navy, and the National Security Agency adjudication facilities. In fiscal year 1998, these adjudication facilities accounted for 73 percent of the investigative work done by DSS. Table 5 shows the number of investigations completed by DSS in January and February 1999 for each of the four DOD adjudication facilities and the number we reviewed. Table****Helvetica:x11****5: Number of DSS Investigations Sent to Four DOD Adjudication Facilities and Sampled by GAO ------------------------------------------------------------------------ | DOD adjudication : Investigations sent : Investigations | | facility : to facility : sampled by GAO | |----------------------------------------------------------------------| | Air Force : 895 : 175 | |----------------------------------------------------------------------| | Army : 429 : 146 | |----------------------------------------------------------------------| | Navy : 190 : 105 | |----------------------------------------------------------------------| | National Security : 184 : 104 | | Agency : : | |----------------------------------------------------------------------| | Total : 1,698 : 530 | ------------------------------------------------------------------------ Note: All investigations were received by the adjudication facilities in January and February 1999. Source: GAO compilation of DSS completed investigations in January and February 1999 for four DOD adjudication facilities. The sampling strategy was designed to yield a precision of +/-7 percentage points, under the assumption that we would find that 50 percent of the investigations were done in accordance with federal standards and 50 percent did not comply with the standards. Since the percentage of noncompliant investigations was much greater than 50 percent, our precision increased. Table 6 shows the precision for the investigation deficiency rate for each of the sample DOD adjudication facilities. Table****Helvetica:x11****6: Precision Rates for Investigations Sampled at Four DOD Adjudication Facilities ---------------------------------------------------------------------------- | : Investigations with at : Investigations with two | | : least one deficiency : or more deficiencies | |--------------------------------------------------------------------------| | DOD : Number : Percent: Precis : Number : Percent: Precision | | adjudication : : : ion : : : | | facility : : : : : : | |--------------------------------------------------------------------------| | Air Force : 166 : 95 : +/-3 % : 138 : 79 : +/-6 % | |--------------------------------------------------------------------------| | Army : 129 : 88 : +/-5 % : 107 : 73 : +/-6 % | |--------------------------------------------------------------------------| | Navy : 96 : 91 : +/-4 % : 81 : 77 : +/-6 % | |--------------------------------------------------------------------------| | National : 98 : 94 : +/-3 % : 81 : 78 : +/-6 % | | Security Agency : : : : : : | |--------------------------------------------------------------------------| | Total : 489 : : : 407 : : | ---------------------------------------------------------------------------- Source: GAO sample of 530 DSS investigations. To review the completeness of investigations, we developed a data collection instrument that incorporated the federal investigative standards approved by the President in March 1997. Officials in the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) and the Army's adjudication facility reviewed the instrument, and we pretested it using Army investigations. To ensure the accuracy of our work, two of our staff reviewed each sampled investigation, and we returned a random subsample of deficient investigations to the Air Force, the Army, the Navy, and the National Security Agency adjudication facilities for their review. To determine the factors that might be hindering the investigative process, we reviewed DSS (1) investigative policies and procedures, (2) mechanisms to ensure the quality of investigative work, (3) methods to train investigative staff, and (4) automation initiatives. We reviewed DSS investigative policy guidance and DSS's process for implementing policy changes, including coordination with other organizations, such as the DOD General Counsel and the Security Policy Board. To assess quality control procedures, we reviewed what mechanisms had been established to ensure the completeness of the investigative work. To assess the adequacy of investigative training, we determined the number of training courses offered to investigative staff and the number of staff attending in fiscal year 1998. We supplemented this work with surveys mailed to all 1,174 DSS investigators and 112 DSS case analysts. Ninety percent (1,061) of the investigators and 79 percent (88) of the case analysts responded. The questionnaires asked respondents' views on (1) manageability of investigative workload, (2) adequacy of training, (3) clarity of investigative policy guidance, (4) manner of conducting investigations, and (5) frequency that investigations were returned for additional work. We also reviewed DOD's oversight of DSS and DOD's assessment of the internal controls in the personnel security investigation program. Further, we reviewed this program in relation to the Federal Managers' Financial Integrity Act of 1982, which mandates that federal agencies conduct ongoing evaluations of their internal control systems to protect federal programs against fraud, waste, abuse, and mismanagement./Footnote2/ That act further requires that the heads of federal agencies report annually to the President and the Congress on the condition of these systems and on actions to correct the weaknesses identified. We identified the actions DOD was taking to improve investigative work, but we were unable to assess their effectiveness because they had not been sufficiently developed or implemented at the time we completed our work in September 1999. We also determined the number of federal employees (including DOD military, civilian, and contractor personnel) convicted of espionage from 1982 through September 1999 and reviewed studies of the personnel security investigation process and determined the status of recommendations for improvement. We performed our work at the following DOD and other organizations: o Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), Washington, D.C.; o Headquarters, DSS, Alexandria, Virginia; o Gulf Coast Operating Location, DSS, Smyrna, Georgia; o Security Policy Board, Arlington, Virginia; o Army Central Personnel Security Clearance Facility, Fort Meade, Maryland; o Air Force Headquarters 497th Intelligence Group, Bolling Air Force Base, Washington, D.C.; o Department of the Navy Central Adjudication Facility, Washington, D.C.; and o National Security Agency Central Adjudication Facility, Linthicum, Maryland. We also discussed the personnel security investigation program, automation, and other issues with officials of the following adjudication facilities: the Defense Intelligence Agency, Joint Chiefs of Staff, Defense Office of Hearings and Appeals, and Washington Headquarters Service. In July 1999, we held a meeting with representatives from the Office of the Assistant Secretary of Defense (Command, Control, Communications, and Intelligence), DSS, and all eight adjudication facilities to obtain their views on the personnel security investigation program and any actions needed to improve it. We conducted our review from October 1998 to September 1999 in accordance with generally accepted government auditing standards. -------------------------------------- /Footnote1/-^DSS officials stated that DSS began a series of multiple reviews of investigations it had completed for the Army based on complaints DSS received from the Army about the completeness of the cases. DSS officials further stated that cases found to be incomplete were not to be sent forward to the Army's adjudication facility until all required investigative work was done. /Footnote2/-^See 31 U.S.C. 3512. DEFENSE SECURITY SERVICE RESOURCES AND WORKLOAD =============================================== This appendix describes the Defense Security Service's resources and workload for fiscal years 1991 through 1998 and the percent of changes during that period. Table 7 presents information on the personnel security budget. Table****Helvetica:x11****7: Personnel Security Investigation Budget ------------------------------------------------------------------------------ | Fiscal year 1998 : : : : : : : : | | dollars in : : : : : : : : | | millions : : : : : : : : | |----------------------------------------------------------------------------| | : Fiscal Year | |----------------------------------------------------------------------------| | : 1991 : 1992 : 1993 : 1994 : 1995 : 1996 : 1997 : 1998 | |----------------------------------------------------------------------------| | Investigative : $176 : $169 : $184 : $167 : $164 : $165 : $146 : $142 | | budget : : : : : : : : | |----------------------------------------------------------------------------| | Change from FY1991: : -4% : +5% : -5% : -7% : -6% : -17% : -19% | |----------------------------------------------------------------------------| | Other budget : 53 : 65 : 51 : 62 : 59 : 55 : 56 : 48 | |----------------------------------------------------------------------------| | Change from FY1991: : +23% : -4% : +17% : +11% : +4% : +6% : -9% | |----------------------------------------------------------------------------| | Total DSS budget : $229 : $234 : $235 : $229 : $223 : $220 : $202 : $190 | |----------------------------------------------------------------------------| | Change from FY1991: : +2% : +3% : 0% : -3% : -4% : -12% : -17% | ------------------------------------------------------------------------------ Source: Defense Security Service and GAO analysis of DSS data. Table 8 describes the number of investigative staff assigned as personnel security investigators, the number assigned to other DSS functions, and the total number of DSS staff. Table****Helvetica:x11****8: Personnel Security Investigation Staff ---------------------------------------------------------------------------- | : Fiscal Year | |--------------------------------------------------------------------------| | Staff : 1991 : 1992 : 1993 : 1994 : 1995 : 1996 : 1997 : 1998 | |--------------------------------------------------------------------------| | Investigators : 1,652: 1,562: 1,432: 1,324: 1,230: 1,120: 1,165: 1,251 | |--------------------------------------------------------------------------| | Change from : : -5% : -13% : -20% : -26% : -32% : -29% : -24% | | FY1991 : : : : : : : : | |--------------------------------------------------------------------------| | Other staff : 2,334: 2,198: 2,219: 1,956: 1,887: 1,739: 1,450: 1,260 | |--------------------------------------------------------------------------| | Change from : : -6% : -5% : -16% : -19% : -25% : -38% : -46% | | FY1991 : : : : : : : : | |--------------------------------------------------------------------------| | Total DSS staff : 3,986: 3,760: 3,651: 3,280: 3,117: 2,859: 2,615: 2,511 | |--------------------------------------------------------------------------| | Change from : : -6% : -8% : -18% : -22% : -28% : -34% : -37% | | FY1991 : : : : : : : : | ---------------------------------------------------------------------------- Source: Defense Security Service and GAO analysis of DSS data. Table 9 describes the personnel security workload, including the number of investigations opened, the number opened per investigator, the number of investigations closed, and the number closed per investigator. Table****Helvetica:x11****9: Personnel Security Investigation Workload ------------------------------------------------------------------------- | Investigations in : : : : : : : : | | thousands : : : : : : : : | |-----------------------------------------------------------------------| | : Fiscal Year | |-----------------------------------------------------------------------| | : 1991: 1992: 1993: 1994: 1995: 1996: 1997: 1998 | |-----------------------------------------------------------------------| | Investigations : 227 : 271 : 214 : 208 : 212 : 126 : 190 : 126 | | opened : : : : : : : : | |-----------------------------------------------------------------------| | Change from FY1991 : : +19%: -6% : -8% : -7% : -44%: -16%: -44% | |-----------------------------------------------------------------------| | Investigations : 137 : 173 : 149 : 157 : 172 : 113 : 163 : 101 | | opened per : : : : : : : : | | investigator : : : : : : : : | |-----------------------------------------------------------------------| | Change from FY1991 : : +27%: +9% : +15%: +26%: -18%: +19%: -26% | |-----------------------------------------------------------------------| | Investigations closed: 232 : 264 : 217 : 206 : 204 : 158 : 172 : 142 | |-----------------------------------------------------------------------| | Change from FY1991 : : +14%: -6% : -11%: -12%: -32%: -26%: -39% | |-----------------------------------------------------------------------| | Investigations : 140 : 169 : 152 : 156 : 166 : 141 : 148 : 114 | | closed per : : : : : : : : | | investigator : : : : : : : : | |-----------------------------------------------------------------------| | Change from FY1991 : : +21%: +8% : +11%: +18%: +1% : +5% : -19% | ------------------------------------------------------------------------- Source: Defense Security Service and GAO analysis of DSS data. DEFICIENT INVESTIGATIONS IN OUR SAMPLE ====================================== This appendix describes the number of deficiencies we found in our review of 530 DSS investigations completed in January and February 1999. A deficiency is an instance where an investigation was incomplete in that it did not contain all the information required by federal investigative standards. The numbers of deficiencies are presented for (1) each of the four DOD adjudication facilities in our sample and for the total 530 investigations and (2) initial investigations and reinvestigations. Table 10 describes the number of deficient DSS investigations at four facilities. Table****Helvetica:x11****10: Number of Deficient DSS Investigations at Four DOD Adjudication Facilities --------------------------------------------------------------------------- | : No : One : Two : Three or : Total | | : deficie : deficie : deficie : more : investiga | | : ncy : ncy : ncies : deficienci : tions | | : : : : es : | |-------------------------------------------------------------------------| | Air Force | |-------------------------------------------------------------------------| | Initial : 1 : 10 : 8 : 53 : 72 | | investigations : : : : : | |-------------------------------------------------------------------------| | Reinvestigations: 8 : 18 : 21 : 56 : 103 | |-------------------------------------------------------------------------| | Army | |-------------------------------------------------------------------------| | Initial : 13 : 12 : 12 : 37 : 74 | | investigations : : : : : | |-------------------------------------------------------------------------| | Reinvestigations: 4 : 10 : 18 : 40 : 72 | |-------------------------------------------------------------------------| | Navy | |-------------------------------------------------------------------------| | Initial : 5 : 7 : 11 : 37 : 60 | | investigations : : : : : | |-------------------------------------------------------------------------| | Reinvestigations: 4 : 8 : 11 : 22 : 45 | |-------------------------------------------------------------------------| | National : : : : : | | Security Agency : : : : : | |-------------------------------------------------------------------------| | Initial : 3 : 7 : 6 : 4 : 20 | | investigations : : : : : | |-------------------------------------------------------------------------| | Reinvestigations: 3 : 10 : 30 : 41 : 84 | |-------------------------------------------------------------------------| | All four adjudication facilities | |-------------------------------------------------------------------------| | Initial : 22 : 36 : 37 : 131 : 226 | | investigations : : : : : | |-------------------------------------------------------------------------| | Reinvestigations: 19 : 46 : 80 : 159 : 304 | |-------------------------------------------------------------------------| | Totals : 41 : 82 : 117 : 290 : 530 | --------------------------------------------------------------------------- Source: GAO review of 530 DSS investigations. INVESTIGATORS' RECALL OF RECENT TRAINING RECEIVED ON FEDERAL INVESTIGATIVE STANDARDS =========================================================================== This appendix describes the results of the investigators' responses about their training experiences on the federal investigative standards during the last 3 years. In our survey, we broadly defined training to include any courses, agent continuing education seminars, and office-held meetings that discussed personnel security investigation topics related to the federal standards. Table 11 presents the number and percent of responses indicating that "no****Symbol:xbe****the topic had not been covered in training,(c) (r)yes--it had been covered,(c) or (r)could not recall.(c) The responses are presented for three groups whose sizes varied according to the number of people who answered each question. The groups are all investigators (996-1,009 respondents), investigators with at least 4 years experience (921-934 respondents), and investigators with 3 or less year's experience (75-76 respondents)./Footnote1/ Because not all investigators answered every question, totals for each topic vary slightly. Table****Helvetica:x11****11: Investigators' Responses to Survey Questions on Recent Training Received on Federal Standards Continued from Previous Page ----------------------------------------------------------------------------- | : All : Investigators : Investigators | | : investigators : with 4 or more : with 3 or | | : : years DSS : less years | | : : experience : DSS experience | |---------------------------------------------------------------------------| | Topic related to : Number : Perce : Number : Perce : Number: Perce | | federal standards : : nt : : nt : : nt | |---------------------------------------------------------------------------| | Corroborate subject's birth | |---------------------------------------------------------------------------| | No : 512 : 51.0 : 496 : 53.4 : 16 : 21.1 | |---------------------------------------------------------------------------| | Yes : 379 : 37.7 : 320 : 34.5 : 59 : 77.6 | |---------------------------------------------------------------------------| | Do no recall : 113 : 11.3 : 112 : 12.1 : 1 : 1.3 | |---------------------------------------------------------------------------| | Corroborate subject's citizenship | |---------------------------------------------------------------------------| | No : 533 : 53.2 : 514 : 55.5 : 19 : 25.0 | |---------------------------------------------------------------------------| | Yes : 350 : 34.9 : 298 : 32.2 : 52 : 68.4 | |---------------------------------------------------------------------------| | Do not recall : 119 : 11.9 : 114 : 12.3 : 5 : 6.6 | |---------------------------------------------------------------------------| | Check family's legal status if foreign born | |---------------------------------------------------------------------------| | No : 566 : 56.5 : 542 : 58.6 : 24 : 31.6 | |---------------------------------------------------------------------------| | Yes : 274 : 27.4 : 232 : 25.1 : 42 : 55.3 | |---------------------------------------------------------------------------| | Do not recall : 161 : 16.1 : 151 : 16.3 : 10 : 13.2 | |---------------------------------------------------------------------------| | Corroborate education more than 3 years ago | |---------------------------------------------------------------------------| | No : 465 : 46.6 : 446 : 48.3 : 19 : 25.3 | |---------------------------------------------------------------------------| | Yes : 377 : 37.8 : 332 : 36.0 : 45 : 60.6 | |---------------------------------------------------------------------------| | Do not recall : 156 : 15.6 : 145 : 15.7 : 11 : 14.7 | |---------------------------------------------------------------------------| | Verify education within last 3 years | |---------------------------------------------------------------------------| | No : 399 : 39.9 : 388 : 41.9 : 11 : 14.7 | |---------------------------------------------------------------------------| | Yes : 510 : 50.9 : 448 : 48.4 : 62 : 82.7 | |---------------------------------------------------------------------------| | Do not recall : 92 : 9.2 : 90 : 9.7 : 2 : 2.7 | |---------------------------------------------------------------------------| | Verify all residences for last 3 years | |---------------------------------------------------------------------------| | No : 316 : 31.5 : 310 : 33.5 : 6 : 7.9 | |---------------------------------------------------------------------------| | Yes : 623 : 62.2 : 555 : 59.9 : 68 : 89.5 | |---------------------------------------------------------------------------| | Do not recall : 63 : 6.3 : 61 : 6.6 : 2 : 2.6 | |---------------------------------------------------------------------------| | Verify last 7 years of employment | |---------------------------------------------------------------------------| | No : 338 : 33.7 : 332 : 35.8 : 6 : 7.9 | |---------------------------------------------------------------------------| | Yes : 598 : 59.6 : 528 : 57.0 : 70 : 92.1 | |---------------------------------------------------------------------------| | Do not recall : 67 : 6.7 : 67 : 7.2 : 0 : 0 | |---------------------------------------------------------------------------| | Verify each employment more than 6 months | |---------------------------------------------------------------------------| | No : 351 : 35.1 : 345 : 37.3 : 6 : 7.9 | |---------------------------------------------------------------------------| | Yes : 573 : 57.3 : 503 : 54.4 : 70 : 92.1 | |---------------------------------------------------------------------------| | Do not recall : 76 : 7.6 : 76 : 8.2 : 0 : 0 | |---------------------------------------------------------------------------| | Interview each employment more than 6 months | |---------------------------------------------------------------------------| | No : 348 : 34.7 : 343 : 37.0 : 5 : 6.6 | |---------------------------------------------------------------------------| | Yes : 579 : 57.8 : 509 : 55.0 : 70 : 92.1 | |---------------------------------------------------------------------------| | Do not recall : 75 : 7.5 : 74 : 8.0 : 1 : 1.3 | |---------------------------------------------------------------------------| | Corroborate any unemployment of more than 60 days | |---------------------------------------------------------------------------| | No : 360 : 35.9 : 353 : 38.0 : 7 : 9.2 | |---------------------------------------------------------------------------| | Yes : 556 : 55.4 : 487 : 52.5 : 69 : 90.8 | |---------------------------------------------------------------------------| | Do not recall : 88 : 8.8 : 88 : 8.5 : 0 : 0 | |---------------------------------------------------------------------------| | Verify federal/military employment and discharge | |---------------------------------------------------------------------------| | No : 497 : 49.6 : 474 : 51.2 : 23 : 30.3 | |---------------------------------------------------------------------------| | Yes : 296 : 29.5 : 259 : 28.0 : 37 : 48.7 | |---------------------------------------------------------------------------| | Do not recall : 209 : 20.9 : 193 : 20.8 : 16 : 21.1 | |---------------------------------------------------------------------------| | Corroborate military service records | |---------------------------------------------------------------------------| | No : 598 : 59.8 : 565 : 61.1 : 33 : 43.4 | |---------------------------------------------------------------------------| | Yes : 189 : 18.9 : 160 : 17.3 : 29 : 38.2 | |---------------------------------------------------------------------------| | Do not recall : 213 : 21.3 : 199 : 21.5 : 14 : 18.4 | |---------------------------------------------------------------------------| | Interview subject | |---------------------------------------------------------------------------| | No : 215 : 21.5 : 211 : 22.8 : 4 : 5.3 | |---------------------------------------------------------------------------| | Yes : 736 : 73.5 : 663 : 71.7 : 72 : 94.7 | |---------------------------------------------------------------------------| | Do not recall : 51 : 5.1 : 51 : 5.5 : 0 : 0 | |---------------------------------------------------------------------------| | Interview four character references | |---------------------------------------------------------------------------| | No : 286 : 28.5 : 280 : 30.2 : 6 : 7.9 | |---------------------------------------------------------------------------| | Yes : 648 : 64.6 : 582 : 62.8 : 66 : 86.8 | |---------------------------------------------------------------------------| | Do not recall : 69 : 6.9 : 65 : 7.0 : 4 : 5.3 | |---------------------------------------------------------------------------| | Interview all former spouses | |---------------------------------------------------------------------------| | No : 341 : 33.9 : 328 : 35.3 : 13 : 17.1 | |---------------------------------------------------------------------------| | Yes : 557 : 55.4 : 496 : 53.4 : 61 : 80.3 | |---------------------------------------------------------------------------| | Do not recall : 107 : 10.6 : 105 : 11.3 : 2 : 2.6 | |---------------------------------------------------------------------------| | Conduct state and local government records' checks | |---------------------------------------------------------------------------| | No : 382 : 38.3 : 367 : 39.8 : 15 : 20.0 | |---------------------------------------------------------------------------| | Yes : 524 : 52.5 : 465 : 50.4 : 59 : 78.7 | |---------------------------------------------------------------------------| | Do not recall : 92 : 9.2 : 91 : 9.9 : 1 : 1.3 | |---------------------------------------------------------------------------| | Conduct financial checks and resolve credit issues | |---------------------------------------------------------------------------| | No : 37 : 3.7 : 31 : 3.3 : 6 : 8.0 | |---------------------------------------------------------------------------| | Yes : 949 : 94.1 : 881 : 94.3 : 68 : 90.7 | |---------------------------------------------------------------------------| | Do not recall : 23 : 2.3 : 22 : 2.4 : 1 : 1.3 | |---------------------------------------------------------------------------| | Verify bankruptcy | |---------------------------------------------------------------------------| | No : 156 : 15.5 : 151 : 16.2 : 5 : 6.7 | |---------------------------------------------------------------------------| | Yes : 799 : 79.5 : 731 : 78.6 : 68 : 90.7 | |---------------------------------------------------------------------------| | Do not recall : 50 : 5.0 : 48 : 5.2 : 2 : 2.7 | |---------------------------------------------------------------------------| | Verify divorces | |---------------------------------------------------------------------------| | No : 426 : 42.7 : 410 : 44.4 : 16 : 21.3 | |---------------------------------------------------------------------------| | Yes : 413 : 41.4 : 363 : 39.3 : 50 : 66.7 | |---------------------------------------------------------------------------| | Do not recall : 159 : 15.9 : 150 : 16.3 : 9 : 12.0 | |---------------------------------------------------------------------------| | Verify civil/criminal actions with court records | |---------------------------------------------------------------------------| | No : 342 : 34.3 : 333 : 36.2 : 9 : 12.0 | |---------------------------------------------------------------------------| | Yes : 537 : 53.9 : 476 : 51.7 : 61 : 81.3 | |---------------------------------------------------------------------------| | Do not recall : 117 : 11.7 : 112 : 12.2 : 5 : 6.7 | ----------------------------------------------------------------------------- -------------------------------------- /Footnote1/-^We separated the years of DSS investigative experience at 4 or more because DSS had a hiring freeze for investigators in effect from 1989 until late 1996. COMMENTS FROM THE DEPARTMENT OF DEFENSE ======================================= ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** ***************** <Graphic -- Download the PDF file to view.> ***************** GAO CONTACTS AND STAFF ACKNOWLEDGMENTS ====================================== GAO Contacts Norman J. Rabkin (202) 512-5140 Carol R. Schuster (202) 512-5140 Christine A. Fossett (202) 512-2956 Acknowledgments In addition to those named above, Mark E. Gebicke, Rodney E. Ragan, Frank Bowen, Jay S. Willer, Carole F. Coffey, Jack E. Edwards, Thomas W. Gosling, Ernie E. Jackson, Michael R. Kellermann, Stanley J. Kostyla, Tracy A. McCaffery, Joseph T. McDermott, Holly R. Plank, Madelon B. Savaides, Robert L. Williams, Jr., Susan K. Woodward, and William E. Woodward made key contributions to this report. (703242) Table 1: Comparison of DSS Investigations Sent for Adjudication Before and After CCMS Implementation 29 Table 2: Status of Joint Security Commission Recommendations39 Table 3: Status of Joint Security Commission II Recommendations40 Table 4: Status of Secrecy Commission Recommendations41 Table 5: Number of DSS Investigations Sent to Four DOD Adjudication Facilities and Sampled by GAO 42 Table 6: Precision Rates for Investigations Sampled at Four DOD Adjudication Facilities43 Table 7: Personnel Security Investigation Budget46 Table 8: Personnel Security Investigation Staff46 Table 9: Personnel Security Investigation Workload47 Table 10: Number of Deficient DSS Investigations at Four DOD Adjudication Facilities48 Table 11: Investigators' Responses to Survey Questions on Recent Training Received on Federal Standards 49 Figure 1: Personnel Security Investigation and Adjudication Process 8 Figure 2: Percent of Personnel Security Investigations With Deficiencies 13 Figure 3: Percent of Deficient Investigations in Nine Required Investigative Areas 14 Figure 4: Calendar Days Needed to Complete Investigations17 Figure 5: Percent of Investigators Without Recent Training on Investigative Requirements 26 Figure 6: Investigators Views on Workload 28 *** End of document. ***