DOD Personnel: More Actions Needed to Address Backlog of Security
Clearance Reinvestigations (Letter Report, 08/18/2000, GAO/NSIAD-00-215).
Pursuant to a congressional request, GAO provided information on the
Department of Defense's (DOD) estimates of its reinvestigation backlog,
focusing on: (1) how DOD estimates the backlog; (2) the soundness of
DOD's backlog estimates; and (3) DOD's plans to address the backlog
problem.
GAO noted that: (1) in the absence of a Department-wide database that
can accurately measure the reinvestigation backlog, DOD estimates the
backlog on an ad-hoc basis, using two primary methods--manual counts and
statistical sampling; (2) using the counting method, the military
services and Defense agencies ask security managers to review their
personnel and count those overdue for a reinvestigation; (3) the counts
are totalled to provide a DOD-wide backlog estimate; (4) using the
sampling method, DOD makes a rough--and known to be inaccurate--estimate
from existing personnel security databases; (5) it then selects a random
sample of individuals from this estimate and surveys them to determine
whether they are associated with DOD, require a security clearance, and
are overdue for a reinvestigation; (6) DOD uses this information and
statistical analysis to develop a refined and more accurate estimate;
(7) DOD's two most recent estimates each used a different method and
arrived at similar results--about one of every five individuals with a
security clearance is overdue for a reinvestigation; (8) however, both
estimates had methodological limitations, were 6 months old or older by
the time they were reported, and excluded thousands of overdue
reinvestigations because they used a restricted backlog definition; (9)
using the counting method, DOD reported that the backlog totalled
505,786, however, the estimate's accuracy is questionable; (10) using
the sampling method, a DOD contractor estimated the backlog to be
between 451,757 and 558,552, however the contractor did not verify
certain data; (11) DOD recognizes that the reinvestigation backlog is a
problem; (12) after not making progress in meeting an earlier goal to
eliminate the backlog, the services and other Defense agencies, at the
direction of the Deputy Secretary of Defense and the DOD Comptroller,
have begun to formulate plans to eliminate the backlog by March 31,
2002; (13) DOD also plans to implement a new personnel security database
in mid-2001; (14) among other things, the database is designed to
include information that could allow real-time counts of overdue
reinvestigations; and (15) however, DOD has not specified how it plans
to ensure that future reinvestigation requests are submitted when they
are due or use the information in the new personnel security database
system to help manage the reinvestigation program.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: NSIAD-00-215
TITLE: DOD Personnel: More Actions Needed to Address Backlog of
Security Clearance Reinvestigations
DATE: 08/18/2000
SUBJECT: Security clearances
Military personnel
Classified information
Civilian employees
Contractor personnel
Data bases
Projections
Statistical methods
IDENTIFIER: DOD Personnel Security Investigation Program
DOD Joint Personnel Adjudication System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO/NSIAD-00-215
National Security and
International Affairs Division
B-285889
August 24, 2000
The Honorable Christopher Shays
Chairman, Subcommittee on National Security,
Veterans Affairs, and International Relations
Committee on Government Reform
House of Representatives
Dear Mr. Chairman:
At the end of fiscal year 1998, about 2.4 million Department of Defense
(DOD) military, civilian, and contractor personnel held security clearances
granting them access to classified information. To lessen the government's
vulnerability to espionage and thereby reduce national security risks,
federal standards require a periodic reinvestigation of individuals with
security clearances. An individual's security clearance is outdated if a
reinvestigation has not been initiated in the past 5 years for top secret
clearances, 10 years for secret clearances, and 15 years for confidential
clearances. Undertaking reinvestigations on time is particularly important
because DOD regulations permit individuals to maintain access to classified
information regardless of whether and how long their reinvestigations are
overdue. In January 2000, DOD estimated that its backlog of overdue
reinvestigations had grown to over 505,000. However, DOD has also reported
that the actual backlog size is unknown because existing personnel security
databases cannot provide an accurate count of overdue reinvestigations.
This letter responds to your concerns about DOD's estimates of its
reinvestigation backlog. Specifically, we (1) determined how DOD estimates
the backlog, (2) assessed the soundness of DOD's backlog estimates, and (3)
identified DOD's plans to address the backlog problem.
In the absence of a Department-wide database that can accurately measure the
reinvestigation backlog, DOD estimates the backlog on an ad-hoc basis, using
two primary methods--manual counts and statistical sampling. Using the
counting method, the military services and Defense agencies ask security
managers to review their personnel and count those overdue for a
reinvestigation. The counts are totaled to provide a DOD-wide backlog
estimate. Using the sampling method, DOD makes a rough--and known to be
inaccurate--estimate from existing personnel security databases. It then
selects a random sample of individuals from this estimate and surveys them
to determine whether they are currently associated with DOD, currently
require a security clearance, and are overdue for a reinvestigation. DOD
uses this information and statistical analysis to develop a refined and more
accurate estimate.
DOD's two most recent estimates each used a different method and arrived at
similar results: about one of every five individuals with a security
clearance is overdue for a reinvestigation. However, both estimates had
methodological limitations, were 6 months old or older by the time they were
reported, and excluded thousands of overdue reinvestigations because they
used a restricted backlog definition. Primarily using the counting method,
DOD reported in January 2000 that the backlog totaled 505,786. However,
because the estimate was composed of unverified counts from the military
services and other Defense agencies, and because these entities used
inconsistent methods and different time periods, the accuracy of the
estimate is questionable. Using the sampling method, a DOD contractor
reported in February 2000 that the backlog totaled between 451,757 and
558,552 (with a mean estimate of 505,155). Despite a low survey response
rate, the contractor assumed that there were no statistical differences
between respondents and nonrespondents and did not perform the necessary
follow-up to verify this assumption. Moreover, reinvestigations submitted
for processing but not yet completed were not included in either estimate
because the backlog definition excluded reinvestigations in process.1 These
totaled about 94,000 in February 2000, and, according to DOD, the vast
majority of them were overdue.
DOD recognizes that the reinvestigation backlog is a problem. After not
making progress in meeting an earlier goal to eliminate the backlog, the
services and other Defense agencies, at the direction of the Deputy
Secretary of Defense and the DOD Comptroller, have begun to formulate plans
to eliminate the backlog by March 31, 2002. DOD also plans to implement a
new personnel security database in mid-2001. Among other things, the
database is designed to include information that could allow real-time
counts of overdue reinvestigations. However, DOD has not specified how it
plans to ensure that future reinvestigation requests are submitted when they
are due or use the information in the new personnel security database system
to help manage the reinvestigation program.
We are recommending that DOD design routine reports that show the full
extent of the backlog and develop incentives to keep reinvestigation
information current and submit requests for reinvestigations on time. In its
comments on our draft report, DOD agreed with these recommendations.
The federal government uses personnel security investigations to determine
whether an individual should be granted access to classified information.2
In addition to requiring an initial investigation, federal standards require
periodic reinvestigations of individuals granted access to classified
information. DOD estimated in November 1999 that the typical cost to perform
a top secret and a secret reinvestigation was about $1,800 and $250,
respectively.3 Although such investigations do not guarantee that
individuals will not later engage in espionage activities, they remain a
critical step in identifying those who can be trusted to access and
safeguard classified information. Of the 2.4 million DOD military, civilian,
and contractor employees with personnel security clearances at the end of
fiscal year 1998, 96,000 held confidential clearances, 1.8 million held
secret clearances, and 524,000 held top secret clearances.
The Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence) is responsible for DOD's personnel security program, including
the periodic reinvestigation program. The Assistant Secretary oversees the
Defense Security Service, which is responsible for investigations and
reinvestigations of DOD's civilian and military personnel and contractors.
Over 5,000 security managers within the services and Defense agencies are
responsible for ensuring that individuals submit reinvestigation requests as
their updates become due.
DOD Regulation 5200.2-R, Personnel Security Program, states that a clearance
shall not be suspended or downgraded solely because a periodic
reinvestigation was not conducted precisely within 5 years for top secret
clearances and 10 years for secret clearances. The regulation requires that
DOD agencies, in recognition of mission requirements, be flexible in
administering the reinvestigation requirement. Thus, as a matter of
practice, the services and DOD agencies normally do not suspend or downgrade
individuals' access to classified information regardless of whether or how
long their reinvestigations are overdue.
Historically, DOD has reported a large backlog of overdue reinvestigations.4
In fiscal year 1986, DOD had a backlog of 300,000 overdue reinvestigations
that had not been submitted to the Defense Security Service for an update.
The backlog has reportedly increased significantly over the past few years
due to several factors. First, new standards, approved in 1997, increased
periodic reinvestigation requirements by shortening the time interval
between reinvestigations for secret clearances from 15 to 10 years and by
establishing a new, 15-year periodic reinvestigation requirement for
confidential clearances. Second, for 4 years starting in fiscal year 1996,
DOD tried to help the Defense Security Service clear up its backlog of
pending investigations by imposing quotas on the number of reinvestigations
the services and Defense agencies could request. This led to pent-up demand
for reinvestigation requests. Finally, in October 1998, the Defense Security
Service began having significant difficulties implementing a new automated
case control management system. The problems led to reduced productivity and
increased completion times.
DOD is developing but currently does not have an information system that can
routinely track and report on the status of security clearances. As a
result, DOD headquarters cannot identify when security clearances are due to
be updated, accurately project the investigative workload, or know the
extent of the reinvestigation backlog without extra effort and resources.
Without readily available information on the status of clearances, DOD has
estimated its reinvestigation backlog on an ad-hoc basis using two primary
methods--manual counting and statistical sampling.
Count
DOD does not have a Department-wide information system to track the status
of security clearances. DOD's primary database containing personnel security
information, the Defense Clearance and Investigations Index, contains about
28 million records of past and current military, civilian, and contractor
personnel who have been the subjects of criminal or security clearance
investigations. Managed by the Defense Security Service, the index is used
to study policy options and to prepare required and ad-hoc reports on the
functioning of the personnel security program. Although the index was not
designed to provide real-time, actual counts of overdue reinvestigations, it
can provide a rough estimate of the backlog. The problem is that the rough
estimate overstates the backlog because the index includes (1) many
individuals no longer employed by DOD, (2) many individuals eligible for
clearance but no longer requiring access to classified information, and (3)
data showing only the highest eligible classification level of many
individuals who currently require access only at a lower classification
level.
The Navy and the Air Force maintain personnel security databases for their
personnel. However, according to service officials, these databases have
many of the same limitations as DOD's index. As a result, the officials
stated, their databases cannot provide an accurate count of reinvestigation
backlogs. The Army does not maintain an Army-wide personnel security
database. The Defense Security Service maintains information on DOD
contractors in its new case control management system. However, this system
has experienced implementation problems, and summary backlog information is
not readily available on a real-time basis. Defense Security Service
officials stated that despite this limitation, the system's data on
contractor employees and their clearance details are accurate. Because
overdue reinvestigations from other Defense agencies appear to comprise less
than 5 percent of the total backlog, we did not determine the type of
personnel security databases these agencies maintain.
Without a central database to help it determine the reinvestigation backlog,
DOD has used two primary methods for ad-hoc estimates of the backlog--manual
counts and statistical sampling techniques to refine rough estimates. Using
the counting method, the military services and Defense agencies ask security
managers at units, installations, and command levels to review their
personnel and count those that are overdue for a reinvestigation. The
overdue counts are totaled to provide a DOD-wide backlog estimate.
Performing a manual count in this fashion requires input from a large number
of security managers, according to service officials--about 300 in the Army,
1,500-2,000 in the Navy, over 3,200 in the Air Force, and 150-200 in the
Marine Corps. DOD officials stated that because security managers are
responsible for knowing the clearance status of individuals under their
cognizance, this method should result in an accurate estimate of the
backlog.
Using the sampling method, first a rough backlog estimate is made using
information in the Defense Clearance and Investigations Index and other
databases of current military, civilian, and contractor personnel. This
estimate is known to be inaccurate because it is higher than the actual
backlog. Then, a sample of individuals included in the rough estimate is
selected, and the individuals are surveyed to determine whether they are
currently associated with DOD, require a security clearance, and are overdue
for a reinvestigation. DOD uses this information and statistical analysis to
make a more accurate backlog estimate.
DOD's two most recent attempts to determine the backlog size had
methodological limitations, produced estimates that were 6 months old or
older by the time they were reported, and did not include thousands of
overdue reinvestigations that had been submitted for reinvestigation. The
two estimates--one by a DOD process team and the other by a contractor, the
MITRE Corporation--were developed independently and used different
estimating methods but coincidentally arrived at similar estimates of about
505,000 overdue reinvestigations, or about 1 overdue reinvestigation for
every 5 individuals with a security clearance. These estimates differed from
several previous backlog estimates that have been cited in various DOD
documents and statements.
In November 1999, the Deputy Secretary of Defense formed the Personnel
Security Overarching Integrated Process Team to review the accuracy of the
reinvestigation backlog and develop solutions to manage and eliminate the
backlog. To develop its backlog estimate, the team first defined the backlog
and included only reinvestigations that were (1) overdue according to the
time lapsed since the individual's last investigation, (2) currently
required, and (3) not yet submitted to the Defense Security Service for an
update. Also, individuals with security clearances were to be evaluated
according to the classified access level required to do their current jobs
and not according to the highest level of classified access for which they
were eligible. For example, an individual needing only a secret clearance
but holding a top secret clearance was not considered overdue for a
reinvestigation until 10 years, not 5 years, after the last investigation.
The team then calculated its estimate using the counting method. The team
asked the services to determine their reinvestigation backlog using the
established backlog definition. For DOD agencies and contractors, however,
the team used previously developed estimates rather than developing new
backlog counts. The team did not verify the accuracy of these prior
estimates or of the backlog counts reported by the services. After tallying
the results, the team reported in January 2000 that the reinvestigation
backlog totaled 505,786 (see table 1). On February 16, 2000, the Defense
Security Service Director cited this estimate in testimony before the
Subcommittee on National Security, Veterans Affairs, and International
Relations of the House Committee on Government Reform.
Clearance level
DOD component Top secreta Secret and confidential Total Percent
Army 17,367 145,330 162,697 32
Navy and Marine
Corps 23,533 96,665 120,198 24
Air Force 11,407 30,084 41,491 8
Contractors 31,999 134,156 166,155 33
Other 9,975 5,270 15,245 3
Total 94,281 411,505 505,786 100
aIncludes sensitive compartmented information clearances.
Source: Assistant Secretary of Defense (Command, Control, Communications,
and Intelligence).
A key limitation of the team's estimate was the inconsistency with which
individual services arrived at their estimates. Each service used a
different method and a different point in time to determine its backlog.
· The Army asked its commands and units for a backlog count as of September
30, 1999.
· Navy leaders did not want to ask commands and units to count overdue
reinvestigations, stating that this would disrupt mission responsibilities.
Instead, the Navy used a combination of different methods to estimate the
backlog as of September 1999. For example, it (1) counted overdue
reinvestigations of civilian personnel in one major command and, on the
basis of this count, estimated through extrapolation, the Navy's total
civilian personnel backlog; (2) estimated the military personnel backlog by
analyzing military jobs requiring clearances and the years of service of the
individuals occupying those jobs (for example, individuals with over 6 years
of service in jobs requiring a top secret clearance were considered overdue
for a reinvestigation); and (3) used a count of overdue reinvestigations of
civilian and military personnel in the Marine Corps as of September 10,
1999.
· In March 1999, the Air Force had asked its commands and units to count
civilian and military personnel overdue for a reinvestigation. Using this
information, the Air Force then developed an estimate of its backlog as of
April 1999. The Air Force did not perform another count in response to the
process team's request. Instead, it added all reinvestigation requests that
it had submitted between May and December 1999, and subtracted them from its
April 1999 estimate. The Air Force did not verify whether the requests
subtracted from this estimate had been included in the original April 1999
estimate and it did not add individuals that had become overdue for a
reinvestigation from May through December 1999.
Another limitation of the team's estimate was its use of prior estimates of
overdue reinvestigations for DOD agencies and contractor personnel. Because
Defense agencies accounted for a very small proportion of the backlog, the
team did not ask them to count their overdue reinvestigations. Instead, the
team used backlog estimates the agencies had previously developed for the
Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence) in mid-1999. The team also used a prior Defense Security
Service estimate of the contractor reinvestigation backlog, even though
contractor personnel accounted for about one-third of the total backlog.
Defense Security Service officials stated that the contractor backlog
estimate was developed from the Service's database in May 1999. This
estimate was adjusted to approximate the contractor backlog as of September
1999 by subtracting reinvestigation requests submitted to the Defense
Security Service from June 1999 through September 1999. The team used this
adjusted number as part of its estimate of the total DOD backlog.
Finally, the team's estimate used a definition of overdue reinvestigations
that excluded those overdue reinvestigations submitted to but still pending
at the Defense Security Service. Normally, the Defense Security Service does
not open a reinvestigation immediately after it receives a request and
usually requires about 5 to 7 months to complete a reinvestigation. When the
team reported its estimate in January 2000, about 86,000 reinvestigations
were still pending at the Defense Security Service. According to DOD
officials, the vast majority of these reinvestigations were overdue.
In 1999, the Defense Security Service initiated a study to identify the true
size of the backlog and to determine how it should prioritize backlog cases
so that those with the highest security risk could be completed first. The
Defense Security Service contracted with the MITRE Corporation to assist in
this effort, which used statistical sampling.
As a starting point, the Defense Security Service asked the Defense Manpower
Data Center5 to develop a rough estimate of the reinvestigation backlog
using the Defense Clearance and Investigations Index and other DOD databases
of current military, civilian, and contractor personnel. The Center reported
that 954,445 individuals were overdue for reinvestigation as of June 30,
1999. MITRE then requested that the Center draw a random sample of 1,200
cases--400 at the sensitive compartmented information clearance level,6 400
at the top secret level, and 400 at the secret level--to refine the rough
estimate, which was understood to overstate the backlog. Defense Security
Service officials stated that overdue confidential clearances were not
included in this process because the number was relatively small--about
15,000. At MITRE's request, the Defense Security Service surveyed the
sampled cases by asking each individual's security manager whether the
individual (1) currently held an active clearance under the manager's
jurisdiction, (2) currently needed access to classified information at the
clearance level indicated, and (3) had no clearance update request in
process. To be considered a true backlog case, the security manager had to
answer "yes" to all three questions.
When MITRE wrote its report, it had received 617 survey responses
(51 percent of the sample cases).7 Of these, 246 identified true backlog
cases. On the basis of these responses, MITRE estimated that the backlog, as
of June 30, 1999, totaled between 451,757 and 558,552, with a mean estimate
of 505,155, as shown in table 2.
Clearance level Lower limit Mean Upper limit
Sensitive compartmented information 19,635 25,288 30,941
Top secret 36,680 44,375 52,070
Secret 382,954 435,492 488,029
Totala 451,757 505,155 558,552
aTotal lower and upper limits were computed separately and do not sum up.
Source: MITRE.
A key limitation of the MITRE estimate was its low survey response rate.
First, no survey follow-up was performed to increase the response rate.
Second, because responses were fewer than 1,200, the estimate rested upon
the assumption that there were no statistical differences between
respondents and nonrespondents. However, to determine whether this
assumption was true, sampling and follow-up of nonrespondents was required;
but neither was performed. In fact, MITRE stated in its report that the
assumption probably was not true because security managers were more likely
to respond to the survey if an individual still held and needed a security
clearance than if an individual no longer held or needed a clearance. On the
basis of this belief, MITRE stated that its estimate was probably biased on
the high side, somewhat overstating the true size of the backlog.
Another limitation of the MITRE estimate was that, like the process team's
estimate, it did not include all overdue reinvestigations. Specifically, the
estimate excluded overdue confidential reinvestigations and, by definition,
overdue reinvestigations pending at the Defense Security Service. Defense
Security Service officials have estimated that about 15,000 confidential
reinvestigations are overdue. In February 2000, when MITRE issued its
report, about 94,000 reinvestigations were pending at the Defense Security
Service. DOD officials stated that the vast majority of these were overdue.
Several widely divergent backlog estimates have been cited in various DOD
documents and statements in 1998 and 1999. However, these estimates cannot
be compared either with each other or with the more recent estimates by the
process team and MITRE because they included different clearance levels and
were developed using different methods, time periods, and criteria for
determining when an individual is overdue for a reinvestigation. For
example, the Joint Security Commission II8 used a statistical survey and
estimated that about 73,160 top secret and sensitive compartmented
information clearances were overdue for reinvestigation in October 1998. The
Assistant Secretary of Defense (Command, Control, Communications, and
Intelligence) used the counting method and estimated that the backlog
totaled 624,215 for all clearance levels in September 1999. The Defense
Manpower Data Center used existing databases, with no statistical sampling,
to develop three prior rough estimates, which ranged between 611,652 and
992,231. Although these estimates were known to be overstated due to
database problems, they have been occasionally cited, without qualification,
as representing the reinvestigation backlog.
Appendix I summarizes key data related to DOD's two recent and other
reinvestigation backlog estimates.
DOD has taken several steps to deal with the reinvestigation backlog
problem, including setting goals to eliminate the backlog, requiring the
services and Defense agencies to formulate plans to meet the goals, and
expanding DOD's investigative capacity by shifting some Defense Security
Service workload to the Office of Personnel Management. DOD also plans to
implement a new personnel security database with the capability of providing
accurate data on overdue reinvestigations.
In a June 9, 1999, memorandum, the Deputy Secretary of Defense directed the
services and Defense agencies to eliminate the backlog by the end of fiscal
year 2000 by ensuring that (1) all individuals had current clearances in
accordance with national standards or (2) all requests for reinvestigation
were submitted and in process. The memorandum also
· stated that, contrary to established practice, clearances were to be
administratively terminated or downgraded if they were not based upon a
current investigation or were not in process for a reinvestigation by
September 30, 2000;
· directed each service and agency to submit to the Assistant Secretary of
Defense (Command, Control, Communications, and Intelligence) a phased
quarterly plan for eliminating the backlog in fiscal year 2000;
· directed the services and agencies to fund the additional costs of
eliminating the backlog from their existing budgets, acknowledging that the
costs of performing reinvestigations to eliminate the backlog had not been
planned; and
· called for shifting some Defense Security Service workload to the Office
of Personnel Management and to private sector investigative companies,
thereby expanding DOD's investigative capacity.
Beginning in October 1999, DOD shifted all initial investigations and
reinvestigations (except overseas investigations) of its civilian personnel
to the Office of Personnel Management. Although this part of the Deputy
Secretary's memorandum was implemented, analyses showed that the services
and other agencies were not submitting overdue reinvestigation requests at
the rate that was required to eliminate the backlog by September 30, 2000.
During fiscal year 2000, the services and Defense agencies had planned to
submit 505,786 overdue reinvestigation requests (the same number estimated
by the process team) plus 131,000 that were becoming due. Assistant
Secretary of Defense (Command, Control, Communications, and Intelligence)
and Defense Security Service analyses of the first 7 months of fiscal year
2000 showed that the services and agencies submitted only about 28 percent
of the anticipated reinvestigation requests from October 1999 through April
2000. The Defense Security Service estimated that the submitted
reinvestigation requests were only about 34,000 more than the number of
reinvestigations expected to become due during this period. On the basis of
the backlog estimate, this would indicate only a modest drop--about 7
percent--in overdue reinvestigations not submitted for update. To meet the
goal of eliminating the entire backlog by September 30, 2000, the backlog
should have been reduced by over
50 percent by the end of April.
According to officials in the Office of the Assistant Secretary of Defense
(Command, Control, Communications, and Intelligence), the services and
Defense agencies have not been implementing their plans primarily because
they have not budgeted the additional funds needed to cover the costs of the
increased workload and have not shifted funds from other programs.
Recognizing the problem, the Deputy Secretary of Defense issued a memorandum
on March 31, 2000, that superseded the June 9, 1999, memorandum. The new
memorandum
· extended the timeline for eliminating the backlog to March 31, 2002;
· directed that all secret and confidential initial investigations and
reinvestigations of military personnel be transferred to the Office of
Personnel Management to reduce the Defense Security Service's investigative
workload; and
· stated that the Defense Security Service would continue to perform
overseas investigations, top secret initial investigations and
reinvestigations of military personnel, and all investigations and
reinvestigations of contractor personnel.
In a June 22, 2000, memorandum, the DOD Comptroller further discussed DOD's
revised plan to address the backlog. This memorandum
· estimated that an additional $201.6 million was needed to pay for work
transferred to the Office of Personnel Management in fiscal years 2001 and
2002;
· directed the services and other components to (1) allocate funds from
existing resources (as per the Deputy Secretary's June 9, 1999, memorandum)
to pay for investigations performed by both the Defense Security Service and
the Office of Personnel Management during fiscal year 2001 and (2) include
all investigation funding that would be required for fiscal year 2002 in
their budget submissions;
· directed the Assistant Secretary of Defense (Command, Control,
Communications, and Intelligence) to issue implementing guidance for the
revised plan within 60 days; and
· directed each service and component to (1) establish procedures for
monitoring and executing plans to eliminate the backlog and (2) appoint a
senior official to monitor submissions of personnel security investigations.
Neither memorandum issued in 2000 stated that clearances would be canceled
or downgraded if reinvestigations were not current or in process by the new
deadline. Thus, unlike the Deputy Secretary of Defense's initial June 9,
1999, memorandum, they did not provide the same incentive urging security
managers to submit future reinvestigation requests on time.
Officials in the Office of the Assistant Secretary of Defense (Command,
Control, Communications, and Intelligence) told us that they are overseeing
implementation of a new DOD-wide personnel security database system that,
among other things, will have the capability to provide current and accurate
data on overdue reinvestigations. The system, the Joint Personnel
Adjudication System, is intended to consolidate all critical DOD and service
data systems involved in the security clearance process and provide
real-time input and retrieval of clearance-related information by security
managers throughout DOD. According to the officials, local security managers
will be responsible for ensuring that the new data system contains each
individual's current required security access level. Assuming that the data
will be accurate and reliable, the officials stated, the system will be able
to provide current and accurate information on the status of security
clearances, including counts of overdue reinvestigations. With this
capability, DOD should no longer need to expend resources to produce ad-hoc
estimates of the backlog. The officials said, however, they had not yet
developed a framework that specifies how and when the system's periodic
reinvestigation information will be extracted and used to monitor program
performance. The new data system is scheduled to undergo initial operational
testing beginning in September 2000, with full implementation planned by
late spring or summer 2001.
DOD does not have an accurate count of security clearances overdue for
reinvestigation because it (1) does not have an information system capable
of identifying all overdue security clearances, (2) used different means
with methodological limits to estimate the size of the backlog, and (3) used
a definition that excluded a significant portion of the backlog from its
estimates.
DOD needs to know the full extent of its reinvestigation backlog, including
reinvestigations overdue but not yet submitted for reinvestigation and those
in process, to properly manage its reinvestigation program. DOD's planned
Joint Personnel Adjudication System is intended to be capable of providing
DOD managers with more accurate projections of the full extent of the
backlog. However, to date, DOD has not specified how it plans to use the
information in this new personnel security database to help manage this
program or how it will ensure that data in the system is kept current.
Effective use of this database, once tested and validated, could allow DOD
to know the full extent of its backlog and enable it to better plan and
budget the investigative resources needed to effectively manage the program.
Routine reports displaying reinvestigation information would facilitate more
effective management and eliminate DOD's inefficient practice of estimating
the backlog on an ad-hoc basis. However, appropriate incentives, such as the
downgrading or termination of an individual's clearance that is overdue for
reinvestigation, must be in place to ensure that the military services and
Defense agencies keep information in the database current and submit cases
for reinvestigation on time.
To improve the management of DOD's personnel security reinvestigation
program, we recommend that the Secretary of Defense direct the Assistant
Secretary of Defense (Command, Control, Communications, and Intelligence) to
· design routine reports with key data from the Joint Personnel Adjudication
System database to show the full extent of overdue reinvestigations,
including those overdue but not yet submitted for update and those in
process and
· develop appropriate incentives to encourage agency security managers to
keep information in the database current and to submit reinvestigation
requests on time. Changes in existing regulations, policies, and procedures
may be necessary to provide such incentives.
In written comments on a draft of this report, DOD agreed with the contents
of the report and concurred with the recommendations. DOD stated that the
Joint Personnel Adjudication System database will be linked to databases at
the Defense Security Service and the Office of Personnel Management to track
investigations in progress. This system will also be used to provide reports
on many personnel security clearance areas. While we believe that these
actions should help, we believe that it is important that DOD also identify
the specific information related to the backlog that will be provided and
the time frames for the reports to ensure that this problem is routinely
monitored. DOD further stated that those personnel who have not had a
request for their periodic reinvestigation submitted to the Office of
Personnel Management or the Defense Security Service by September 30, 2002,
would have their security clearances downgraded or canceled. This date
corresponds to the planned completion of DOD's most recent effort to
eliminate its reinvestigation backlog. To help minimize the chances of
future reinvestigation backlogs, it is important that DOD use this or other
similar incentives on a continuing basis.
DOD's comments are presented in their entirety in appendix II. DOD also
provided technical comments that we incorporated.
We performed our work at the Office of the Assistant Secretary of Defense
(Command, Control, Communications, and Intelligence); the Defense Security
Service; the Defense Manpower Data Center; and the headquarters of the Army,
the Navy, the Air Force, and the Marine Corps. At each site, we interviewed
cognizant officials and reviewed pertinent regulations and documents. We
also discussed the backlog and related audit work at the Office of the DOD
Inspector General. Because available information indicated that overdue
reinvestigations from other Defense agencies comprised less than 5 percent
of the total backlog, we did not visit any of these agencies.
To determine how DOD estimates the backlog, we identified DOD's recent
backlog estimates and discussed with DOD officials how the estimates were
made. We also documented DOD's definition of the reinvestigation backlog and
discussed the reliability and usefulness of existing personnel security
databases in making backlog estimates.
To assess the soundness of DOD's most recent backlog estimates, we
determined whether the methods used to develop the estimates were
reasonable, were applied consistently, and included all individuals with
overdue reinvestigations. We also discussed methodology details with a MITRE
representative who helped develop the MITRE estimate. Further, we documented
the reasons why many past DOD backlog estimates have varied and are not
directly comparable with each other. We did not verify the accuracy of the
data DOD used to develop the estimates.
To identify DOD's plans for addressing the backlog problem, we interviewed
officials in the Office of the Assistant Secretary of Defense (Command,
Control, Communications, and Intelligence) and the Defense Security Service
and reviewed past and present strategies to eliminate the backlog. We also
discussed with DOD officials their plans for implementing a new personnel
security database system, but we did not review the development and
acquisition process for the new system.
We conducted our review from March through July 2000 in accordance with
generally accepted government auditing standards.
As agreed with your office, unless you publicly announce the contents of
this report earlier, we plan no further distribution until 30 days after its
issue date. At that time, we will send copies to the Honorable William S.
Cohen, Secretary of Defense; the Honorable Louis Caldera, Secretary of the
Army; the Honorable Richard Danzig, Secretary of the Navy; the Honorable F.
Whitten Peters, Secretary of the Air Force; and General James L. Jones,
Commandant of the Marine Corps. We will also make copies available to
appropriate congressional committees and others upon request.
If you or your staff have any questions concerning this report, please call
Christine Fossett at (202) 512-2956 or me at (202) 512-5140. Major
contributors to this report were Gary Phillips, Jim Ellis, and Jack Edwards.
Sincerely yours,
Carol R. Schuster
Associate Director
National Security Preparedness Issues
Estimates of DOD's Periodic Reinvestigation Backlog
Various entities estimated the extent of DOD's periodic reinvestigation
backlog in 1998 and 1999, as shown in the following table. To determine
whether an individual is overdue for a reinvestigation, DOD normally
considers the reinvestigation interval standard for the clearance access
level required to do the job. According to DOD officials, many individuals
are eligible for a higher clearance than required to do the job. Existing
databases always include the individual's eligibility level, but they do not
always include the individual's required access level. The last column in
the table shows which basis was used to determine the number of overdue
investigations.
Basis for
Source of the determining
estimate Estimate Clearance Estimating Backlog"as overdue
backlog
size levelsa method of" date reinvestigations
Recent refined estimates
Process teamb 505,786 TS, S, C Head count Sept./Dec. Access
1999
MITREc 505,155d TS, S StatisticalJune 1999 Access
survey
Prior refined estimates
Assistant
Secretary of
Defense Access, but
(Command, eligibility was
Control, 624,215 TS, S, C Head count Sept. 1999 used for many
Communications, individuals
and
Intelligence)
Joint Security Statistical
Commission II 73,160e TS survey Oct. 1998 Access
Unrefined estimates
Defense Manpower Rough Access, if
Data Center for estimate/ information was
the Defense 992,231 TS, S, C existing June 1999 in the database;
Security Service databases otherwise
eligibility
Defense Manpower Rough Access, if
Data Center for 868,943f estimate/ information was
the Assistant TS, S, C existing Oct. 1998 in the database;
Secretary 611,652g databases otherwise
eligibility
aTop secret (TS), including sensitive compartmented information. Secret (S).
Confidential (C).
bEstimate made by Personnel Security Overarching Integrated Process Team.
cEstimate made by the Defense Security Service and its contractor, the MITRE
Corporation.
dThe estimate was between 451,757 and 558,552 with a mean estimate of
505,155.
eThe estimate was between 64,790 and 81,685 with a mean estimate of 73,160.
fBased on lapsed time since last investigation date.
gBased on lapsed time since the individual's case was adjudicated; that is,
the date the decision was made to grant the clearance.
Comments From the Department of Defense
(702049)
1. A reinvestigation is in process from the time an individual submits a
reinvestigation request until the time the reinvestigation is completed and
a decision is made on the individual's clearance.
2. We recently reviewed DOD's personnel security investigative functions.
See DOD Personnel: Inadequate Personnel Security Investigations Pose
National Security Risks (GAO/NSIAD-00-12, Oct. 27, 1999 ).
3. A more detailed investigation is required for a top secret
reinvestigation.
4. The backlog can include overdue reinvestigations from the following DOD
services and agencies: Army, Navy, Air Force, Marine Corps, Uniformed
Services University of the Health Sciences, National Imagery and Mapping
Agency, Defense Advanced Research Project Agency, Defense Information
Systems Agency, Defense Threat Reduction Agency, Washington Headquarters
Services, National Security Agency, Inspector General, Defense Logistics
Agency, Defense Contract Audit Agency, Defense Finance and Accounting
Service, Defense Security Service, Defense Intelligence Agency, Joint Staff,
and DOD contractors.
5. To support DOD's information requirements, the Center collects and
maintains an archive of automated manpower, personnel, training, and
financial databases.
6. The sensitive compartmented information clearance level is a special top
secret clearance.
7. The Defense Security Service's Backlog of Periodic Reinvestigations:
Statistical Analysis and Risk Prioritization Procedure, the MITRE
Corporation (Feb. 2000). The MITRE study also developed an algorithm to
prioritize reinvestigation requests on the basis of security risk. By
comparing historical data on clearance revocations with information
submitted with each individual's reinvestigation request, the algorithm
predicts the likelihood that the individual's clearance might be revoked.
Defense Security Service officials stated that they plan to begin using the
algorithm during summer 2000 to give priority to those reinvestigations
considered the riskiest.
8. The Joint Security Commission, established by the Secretary of Defense
and the Director of Central Intelligence, was convened twice to review U.S.
security policies and procedures. It issued reports on its work in 1994 and
1999.
*** End of document. ***