DOD Personnel: Weaknesses in Security Investigation Program Are Being
Addressed (Testimony, 04/06/2000, GAO/T-NSIAD-00-148).
Pursuant to a congressional request, GAO discussed the Defense Security
Service's (DSS) personnel security investigation program, focusing on:
(1) how decisions to grant or deny security clearances to Department of
Defense (DOD) employees and contractors are made; (2) key findings from
GAO's October 1999 report; and (3) DOD's actions on GAO's
recommendations.
GAO noted that: (1) DOD uses a two-part process to determine whether an
individual should be granted a security clearance; (2) the first phase
is the personnel security investigation, in which DSS investigators
corroborate information provided by the applicant, interview character
references, and review federal and local records for financial
vulnerabilities and criminal activity; (3) the second phase is the
adjudication, which is conducted by 8 DOD components; (4) adjudicators
weigh favorable and unfavorable information with regard to a number of
factors (such as the nature, extent, and seriousness of any conduct);
(5) if, on balance, the evidence suggests the individual is a good
security risk, the clearance can be granted; (6) safeguarding sensitive
national security information is one of the most important
responsibilities entrusted to public servants; (7) it is critical that
only those individuals who have passed the scrutiny of rigorous
background investigations be granted security clearances; (8)
unfortunately, GAO's evaluation of DSS personnel security investigations
showed that the vast majority did not comply with federal standards for
conducting such investigations; (9) all of DOD employees investigated
were granted top secret security clearances even though DSS
investigators had not always verified such basic information as
residency, citizenship, or employment; (10) GAO also found that these
investigations were not completed in a timely manner; (11) at the time
of GAO's review, DSS estimated that there was a backlog of 600,000 cases
awaiting reinvestigation; (12) as a result, some of DOD's 2.4 million
personnel holding security clearances may be handling sensitive national
security information without having been thoroughly screened; (13)
several factors, including a series of ineffective management reforms at
DSS between 1996 and early 1999 contributed to these deficiencies; (14)
DOD has responded positively to GAO's recommendations for improving the
overall management of its personnel security investigation program; (15)
the Director of DSS has developed a strategic plan and is developing
performance measures to improve the quality of the investigative work,
has reinstituted training and quality control mechanisms, and has worked
out a plan for addressing the large backlog of cases awaiting
reinvestigation; (16) by May 2000, DSS must provide the Deputy Secretary
of Defense a plan to enhance or replace DOD's automated case management
system; and (17) however, due to the breadth of the problems, it may
take several years and many millions of dollars before all of the
necessary improvements are made.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: T-NSIAD-00-148
TITLE: DOD Personnel: Weaknesses in Security Investigation
Program Are Being Addressed
DATE: 04/06/2000
SUBJECT: Security clearances
Management information systems
Contractor personnel
Internal controls
Classified defense information
Strategic planning
Federal employees
Performance measures
IDENTIFIER: DOD Personnel Security Investigation Program
DOD Automated Case Management System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
Testimony Before the Committee on Armed Services
U.S. Senate
For Release on Delivery
Expected at
9:30 a.m.
Thursday,
April 6, 2000
DOD PERSONNEL
Weaknesses in Security Investigation
Program Are Being Addressed
Statement of Carol R. Schuster, Associate Director, National Security
Preparedness Issues, National Security and International Affairs Division
GAO/T-NSIAD-00-148
Mr. Chairman and Members of the Committee:
I am pleased to be here today to discuss our past work on personnel security
investigations conducted by the Defense Security Service. As you know, the
Defense Security Service is responsible for conducting background
investigations on Department of Defense (DOD) civilian and military
personnel, consultants, and contractors seeking security clearances. Today,
I would like to describe how decisions to grant or deny security clearances
to DOD employees and contractors are made; summarize the key findings from
our October 1999 report; and discuss DOD actions on our recommendations. The
centerpiece of our report was an analysis of the completeness and timeliness
of a representative sample of Defense Security Service investigations
finished in January and February 1999. Representative Ike Skelton requested
this work based on his concern about espionage committed by DOD employees
who held security clearances. From 1982 through September 1999, 68 of 80
individuals convicted of committing espionage against the United States were
DOD employees. All of these employees had undergone personnel security
investigations and held security clearances.
SUMMARY
The Department of Defense uses a two-part process to determine whether an
individual should be granted a security clearance. The first phase is the
personnel security investigation, in which Defense Security Service
investigators corroborate information provided by the applicant, interview
character references, and review federal and local records for financial
vulnerabilities and criminal activity. The second phase is the adjudication,
which is conducted by eight DOD components. Adjudicators weigh favorable and
unfavorable information with regard to a number of factors (such as the
nature, extent, and seriousness of any conduct). If, on balance, the
evidence suggests the individual is a good security risk, the clearance can
be granted.
Safeguarding sensitive national security information is one of the most
important responsibilities entrusted to public servants. Therefore, it is
critical that only those individuals who have passed the scrutiny of
rigorous background investigations be granted security clearances.
Unfortunately, our evaluation of Defense Security Service personnel security
investigations revealed serious lapses in the thoroughness and timeliness of
these investigations, raising questions about the risks such lapses pose to
national security. Our detailed analysis of 530 personnel security
investigations showed that the vast majority did not comply with federal
standards for conducting such investigations. Nevertheless, all of the DOD
employees investigated were granted top secret security clearances even
though Defense Security Service investigators had not always verified such
basic information as residency, citizenship, or employment. We also found
that these investigations were not completed in a timely manner. At the time
of our review, the Defense Security Service estimated that there was a
backlog of 600,000 cases awaiting reinvestigation. As a result of these
conditions, some of DOD's 2.4 million personnel currently holding security
clearances may be handling sensitive national security information without
having been thoroughly screened. In addition, in 1994, the Joint Security
Commission reported that delays in obtaining security clearances cost DOD
several billion dollars because workers were unable to perform their jobs
while awaiting a clearance. Several factors, including a series of
ineffective management reforms at the Defense Security Service between 1996
and early 1999 contributed to these deficiencies. During this period, the
Defense Security Service relaxed its investigative guidance, eliminated key
quality control mechanisms, inadequately trained its investigators, and
ineffectively managed automation of its case processing system. Moreover,
the Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence) did not provide effective oversight of the agency's operations
during this period.
DOD has responded positively to our recommendations for improving the
overall management of its personnel security investigation program. For
example, the Secretary of Defense has designated the program a key agency
vulnerability in his most recent report to the President and the Congress
filed in accordance with the Federal Managers' Financial Integrity Act. This
designation should provide added visibility that should enable the
Department to monitor progress in correcting identified problems. In
addition, the Director of the Defense Security Service has developed a
strategic plan and is developing performance measures to improve the quality
of the investigative work, has reinstituted training and quality control
mechanisms, and has worked out a plan for addressing the large backlog of
cases awaiting reinvestigation. By May 1, 2000, DSS must provide the Deputy
Secretary of Defense a plan to enhance or replace the agency's automated
case management system.
However, we must emphasize that, due to the breadth of the problems, it may
take several years and many millions of dollars before all of the necessary
improvements are made.
Before turning to the details of our findings on the security investigation
process, I would like to first provide background information on the process
currently used in DOD to determine whether an individual should be granted a
security clearance.
SECURITY CLEARANCES ARE GRANTED OR DENIED THROUGH
A TWO-PART PROCESS
DOD grants security clearances after completing two related processes. The
first phase involves an investigation into the individual's past to obtain
information related to making a determination whether he or she can be
entrusted with classified information. The second phase, termed the
adjudication process, involves a weighing of the information collected in
the first phase to determine whether a clearance should be granted or
denied.
Investigation Phase
With respect to the first phase, all federal departments and agencies that
conduct background investigations_including the Defense Security Service
(DSS) and others, such as the Office of Personnel Management, and the
Federal Bureau of Investigation_are expected to conduct their investigations
in accordance with federal investigative standards approved by the President
in 1997. For clearances at the top secret level, these standards require
investigations in the following nine areas:
* corroboration of a subject's date and place of birth, and verification
of citizenship for foreign-born subjects and their foreign-born
immediate family members;
* corroboration of education;
* verification of employment for the past 7 years and interviews with
supervisors and co-workers;
* interviews with character references and former spouses;
* interviews with neighbors to confirm residences;
* a national agency check on the subject and spouse or cohabitant, using
files and records held by federal agencies (such as the Federal Bureau
of Investigation);
* a financial review, including a credit bureau check;
* a local agency check of criminal history records and other public
records to verify any civil or criminal court actions involving the
subject; and
* a personal interview with the subject.
Adjudication Phase
Upon completion of the investigation, DSS forwards the information to one of
eight DOD adjudication facilities, which then initiate the adjudication
phase. Each case is to be judged on its own merits and the final
determination as to whether a security clearance should be granted or denied
is the responsibility of the specific DOD agency requesting the clearance.
In making their determinations, adjudication personnel are to consider 13
factors, such as the individual's allegiance to the United States; criminal
and personal conduct; and substance abuse or mental disorders. To assess
security risk, adjudicators employ a "whole person" approach in which they
carefully consider both favorable and unfavorable information, especially
noting factors that mitigate past unfavorable circumstances. In evaluating
unfavorable information about an individual's conduct, the adjudicator is to
consider
* the nature, extent, and seriousness of the conduct;
* the circumstances surrounding the conduct, including knowledgeable
participation;
* the frequency and recency of the conduct;
* the individual's age and maturity at the time of the conduct;
* the voluntariness of participation;
* the presence or absence of rehabilitation and other pertinent behavior
changes;
* the motivation for the conduct;
* the potential for pressure, coercion, exploitation, or duress; and
* the likelihood of continuation or recurrence.
For example, when considering an individual with a history of drug use,
successful completion of a drug rehabilitation program with no evidence of
recent drug use would be considered a mitigating factor. If after this
evaluation of the "whole person," the preponderance of evidence suggests
that the individual is a good security risk, the individual can be granted a
security clearance even though the investigation may have uncovered
significant unfavorable information. In making these determinations, the
federal adjudication guidelines state that "any doubt as to whether access
to classified information is clearly consistent with national security will
be resolved in favor of the national security."
At the request of Representative Ike Skelton, we are currently evaluating
DOD's adjudication program. Our work will include reviewing a representative
sample of cases from several of DOD's adjudication facilities to determine
how these facilities are conducting their work. As part of this work, we
expect to be able to provide statistical information on clearances granted
and denied by the various adjudication facilities and the extent to which
adjudication decisions are overturned after an appeal.
Now, I will turn to the results of our analysis of the first phase of the
security clearance process - the conduct of DSS background investigations.
DSS INVESTIGATIONS LACKED REQUIRED
INFORMATION AND WERE UNTIMELY
DOD's personnel security investigation program has resulted in
investigations that did not obtain the information required by federal
standards; did not address issues that the investigations revealed which
could disqualify individuals from holding security clearances; and were not
completed in a timely manner. The deficiencies in the program were due to a
series of ineffective management reforms at DSS and inadequate oversight by
the Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence).
DSS Investigations Were Incomplete
To determine the completeness of DSS investigations, we selected a
representative sample of 530 investigations finished by DSS in January and
February 1999 for four key customers_the Air Force, the Army, the Navy, and
the National Security Agency. Our findings are projectable only to the
investigations conducted by these four DOD components. However, because
these entities accounted for 73 percent of the investigative work conducted
by DSS in fiscal year 1998, we believe that our findings suggest systemic
program weaknesses. In the 530 cases we reviewed, DOD granted top secret
clearances notwithstanding that
* 92 percent of the 530 investigations were deficient in that they did
not contain information in at least one of the nine required
investigative areas, and
* 77 percent of the investigations were deficient in meeting federal
standards in two or more areas.
As shown in figure 1, we found problems primarily in six of the nine areas
that the federal standards require for a security clearance investigation.
Frequently, DSS did not confirm residency, corroborate birth or citizenship
for foreign-born subjects, spouses, or family members, verify employment,
interview character references, and/or check local agency records.
Figure 1: Percent of Deficient Investigations in Nine Required Investigative
Areas
Percent of deficient investigations
Source: GAO sample of 530 DSS investigations.
Importantly, in 16 percent of the investigations we examined, DSS did not
pursue issues pertaining to individuals' prior criminal history, alcohol and
drug use, financial difficulties, and other problems that its investigators
uncovered. Any of these issues, if corroborated, could prevent an individual
from being granted a security clearance. Of particular concern is the
failure to resolve issues pertaining to large outstanding debts and
bankruptcy, since financial gain has been the major reason individuals
committed espionage. The following cases illustrated these lapses.
* A reinvestigation for an individual working on cross-service issues
revealed that the subject's credit report showed $10,000 past due on a
mortgage and indicated that the lender had begun foreclosure
proceedings. The subject denied knowledge of the matter, and
investigative records do not show that DSS pursued the matter further
by contacting the lender.
* An initial investigation for an individual assigned to a communications
unit revealed a bankruptcy on the subject's credit report, but
investigative records do not show that DSS questioned the subject about
the matter or made any further attempt to address it.
* Records for a reinvestigation of an electronics technician do not show
that DSS attempted to verify the subject's claim to be a member of a
foreign military service and to hold foreign citizenship. Further,
although the investigative file indicated that the subject might have
been involved in shooting another individual, we found no evidence that
the matter was pursued by DSS.
Untimely Investigations Created Costly Delays and Backlog
DSS investigations take too much time. DOD components and contractors want
investigations completed in 90 days to avoid costly delays. Nevertheless,
half of the 530 investigations we reviewed took 204 or more days to
complete. In 1994, the Joint Security Commission reported that delays in
obtaining security clearances cost DOD several billion dollars in fiscal
year 1994 because workers were unable to perform their jobs while awaiting a
clearance. In February 1999, representatives of several contractors
complained to DSS about the time taken to clear their personnel, pointing
out that the delays threatened to affect some facilities' ability to
effectively perform on contracts and meet cost schedules. The
representatives noted that 64 percent (1,426) of the 2,236 investigations
they had requested were pending for more than 90 days, with 76
investigations pending since 1997. In addition, adjudication facility
officials said that they frequently made decisions to grant or deny
clearances based on incomplete investigations because it would take too long
to have DSS obtain the missing information. Figure 2 shows that DSS
completed only 4 of the 530 investigations we reviewed_less than 1
percent_under 90 days, whereas 11 percent took more than 1 year.
Figure 2: Calendar Days Needed to Complete Investigations
Note: Numbers in bars represent number of cases within each range.
Source: GAO sample of 530 DSS investigations.
At the time we completed our review in October 1999, about 600,000 DOD
individuals holding clearances were overdue for reinvestigations. This
backlog resulted, in large part, from quotas imposed by the Assistant
Secretary of Defense (Command Control, Communications, and Intelligence) in
1996 on the number of reinvestigations that DOD components could request in
a given year. In 1994 and 1999, the Joint Security Commission reported that
delays in initiating reinvestigations create risks to national security
because the longer individuals hold clearances the more likely they are to
be working with critical information systems. Also, the longer a
reinvestigation is delayed, the greater the risk that changes in an
individual's behavior will go undetected. DOD is currently initiating
several efforts to reduce this large backlog. The Chairman of the House
Subcommittee on National Security, Veterans Affairs, and International
Relations has asked us to examine the accuracy of DOD's estimate of its
backlog of cases awaiting reinvestigation. We expect to report the results
of this work later this year.
Ineffective Management Reforms and Inadequate
Oversight Led to Deficient Investigations
We believe that ineffective management reforms at DSS, made in the interest
of streamlining operations, are directly related to the deficiencies we
noted in its security investigations. Between 1996 and early 1999, DSS
relaxed its investigative requirements against the advice of the Security
Policy Board, eliminated critical investigative quality control mechanisms,
did not adequately train its staff on the new federal investigative
standards, and ineffectively managed the implementation of a new $100
million automation effort. The underlying cause of DSS's investigative
deficiencies was inadequate management oversight by the Assistant Secretary
of Defense (Command, Control, Communications, and Intelligence).
DSS Relaxed Investigative Guidance
From August 1996 through February 1999, DSS relaxed its investigative
requirements through a series of policy letters to its investigative staff.
Several of these letters gave investigators greater discretion in how they
would meet the federal standards or pursue investigative issues. For
example, although the federal standards require credit information on a
subject, DSS eliminated the requirement to contact creditors about debts
revealed by the subject. DSS also eliminated its practice of routinely
verifying disputed credit accounts. Although the federal standards require
investigators to obtain character references on the subject, DSS gave
investigators "broad leeway" in deciding whether to obtain references from
the subject's neighborhood. DSS also did not require its investigators to
make local agency checks for a subject's prior criminal history if local
jurisdictions charged a service fee_an exception not provided for in the
standards. These policy changes caused much confusion among agency staff. In
responding to our survey of nearly 1,300 DSS investigators and case analysts
, 59 percent of the investigators and 90 percent of the case analysts said
that the policy guidance had confused them about what investigative
requirements they were to follow.
In 1996 and again in 1998, the Security Policy Board advised DSS not to
adopt policies that ran counter to the federal investigative standards. The
Board noted that DOD was a full partner in developing the new standards and
that the planned actions would undermine the objectives of achieving
reciprocity in investigations among the federal government's agencies, cause
a serious deterioration in the quality of investigative work, and increase
security risk. It stated that if DSS wanted to change the standards, it
should bring such requests to the Board, which was specifically established
for that purpose. In spite of this advice, DSS adopted the relaxed
investigative guidance.
DSS Eliminated Key Quality Control and Training Mechanisms
In 1996, DSS eliminated two quality control mechanisms that were critical to
ensuring the quality of the investigative work_supervisory review of
completed investigations and its quality assurance branch. Previously, field
supervisors routinely reviewed all completed investigations before they were
forwarded to DSS headquarters and submitted to the adjudication facilities
for clearance decisions. The quality assurance branch conducted weekly
reviews of a sample of completed investigations and published a newsletter
on common investigative problems. Both programs were eliminated under DSS' s
reinvention efforts in order to shift personnel to the investigative staff.
Inadequate training on the federal standards for both investigators and case
analysts has also diminished investigative quality. During the past 3 years,
DSS provided almost no formal training on the standards, and DOD dismantled
the major training organization that provided the training. As a result,
from 43 percent to more than 80 percent of the investigators we surveyed
stated that they were inadequately trained on the various federal standards.
Figure 3 shows the areas where the investigators most frequently cited
training gaps.
Source: 1999 GAO survey of 1,009 DSS investigators who provided information
on their
training.
Costly Automation Initiative Has Been Plagued by Problems
DSS did not properly plan for the implementation of a new information system
designed to automate its personnel security investigation case processing.
As a result, DSS has not been able to process its investigations in a timely
manner, and the volume of investigations sent to field offices and the
adjudication facilities has decreased sharply. The automation system was not
adequately designed or tested before being implemented. Thus, DSS was unable
to achieve the paperless processing system that would have streamlined
processing and the flow of cases to investigative staff was significantly
reduced. According to DSS officials, DOD may have to add $100 million to
$300 million more to the $100 million already spent on its automation
efforts to have a workable system. The automation problems have also
exacerbated DSS' s efforts to cope with the large backlog of overdue
investigations.
Our survey of investigators shows the dramatic impact the automation
problems have had on their workload. Before the system was implemented in
October 1998, 58 percent of the investigators said they had too much work.
Since the system was implemented, the situation has reversed_60 percent said
they had too little work. A similar decrease in workload has occurred at the
adjudication facilities. The volume of investigative cases for four
facilities included in our review dropped between 37 percent and 67 percent
following the implementation of the new automated system.
DOD Exercised Inadequate Oversight
The problems we found in the completeness and timeliness of DSS
investigations and in its automation efforts were due to inadequate
oversight by the Assistant Secretary of Defense (Command, Control,
Communications, and Intelligence). For at least 4 years, DSS has operated
with little scrutiny of its programs by the Assistant Secretary, who is
responsible for DSS oversight. Sound management practices call for such
oversight. DOD officials stated that once DSS initiated its reinvention
efforts, it was allowed to operate, for the most part, at its own
discretion.
DOD IS IMPLEMENTING GAO's RECOMMENDATIONS
DOD agreed that the deficiencies we found represent a potential risk to the
personnel security program and the protection of classified information, and
it agreed to take action on all of our recommendations. For example, DOD has
complied with our recommendation to identify its personnel security
investigation program as a significant internal control weakness in its most
recent report to the President and the Congress under the Federal Managers'
Financial Integrity Act. This designation should provide added visibility
that should enable the Department to monitor progress in correcting
identified problems. In addition, the office of the Assistant Secretary of
Defense (Command, Control, Communications, and Intelligence) has been
holding periodic meetings with DSS to discuss the various problems we
identified and develop methods to correct them. In fact, the Director of DSS
began taking corrective actions after our briefings even before we completed
our review. Based on our recommendations, he has developed a strategic plan
and is developing performance measures to guide DSS in improving its
operations; reinstituted key quality control and training mechanisms;
reviewed DSS's investigative procedures with the goal of bringing them in
line with federal investigative standards; and taken several actions to
address the large backlog of cases awaiting reinvestigations. Further, he
has expressed his intention to improve cooperation with the Security Policy
Board. DSS has also established three separate teams to assess the problems
associated with its automation initiative and established a Program
Management Office to serve as the system's operational manager. By May 1,
2000, DSS must provide the Deputy Secretary of Defense a plan to enhance or
replace the agency's automated case management system.
The Director also established an Operational Standards and Quality Council
composed of representatives from the office of the Assistant Secretary, DSS,
and the adjudication facilities to discuss the approaches to deal with
various investigative and adjudicative issues with the overall objective of
improving the quality of the work. We also recommended that the adjudication
facilities be directed to grant clearances only when all essential
investigative work has been completed. Our ongoing analysis of cases
recently adjudicated should shed light on how the adjudicative process is
working.
Mr. Chairman and Members of the Committee, this concludes my prepared
remarks. I would be happy to answer any questions you may have.
Contacts and Acknowledgements
For future contacts regarding this testimony, please call Carol Schuster at
(202) 512-3958. Key contributors to this testimony included Christine
Fossett, Rodney Ragan, and Frank Bowen.
(702062)
ORDERS BY INTERNET
For information on how to access GAO reports on the INTERNET, send an e-mail
message with "info" in the body to
HYPERLINK mailto:Info@www.gao.gov Info@www.gao.gov
or visit GAO's World Wide Web Home Page at
HYPERLINK http://www.gao.gov http://www.gao.gov
TO REPORT FRAUD, WASTE, AND ABUSE
IN FEDERAL PROGRAMS
Contact one:
* website: HYPERLINK http://www.gao.gov/fraudnet/fraudnet.htm
http://www.gao.gov/fraudnet/fraudnet.htm
* e-mail: HYPERLINK mailto:fraudnet@gao.gov fraudnet@gao.gov
* 1-800-424-5454 (automated answering system)
*** End of document. *** mated answering system)