• Jack Teixeira and Security Clearances

    May 6, 2023 // 7 Comments »

    Air National Guard leaker Jack Teixeira had one of the highest levels of security clearance. Over five million Americans, more than the population of Costa Rica, Ireland or New Zealand, hold some type of security clearance. Can we trust them? Is Teixeira an exception, or is the process never expected to work 100 percent of the time?

    A security clearance is issued by a part of the U.S. Government (Department of Defense, CIA, the State Department…) and says the holder can be trusted to handle sensitive documents and duties. At the low end this may mean a contractor can enter the Navy Yard without a body search, or at the extreme means a person will assume a completely new identity, live abroad, and conduct clandestine actions on behalf of the U.S.

    Government-wide there are three basic levels of clearance: Confidential, Secret, and Top Secret. There are formal definitions, but the basic idea is that the higher you go up the ladder, the more harm and damage disclosure would create. Added to this three-tiered system are many subcategories, including Sensitive But Unclassified, for well, unclassified things that are still sensitive, such as an applicant’s social security number, Law Enforcement Sensitive and the like. Top Secret is supplemented by Sensitive Compartmented Information (SCI), often used to denote information obtained from intelligence sources. There are also many, many flavors of Special Access Programs (SAP) that require both a very high level clearance and specific permission to access just that single project, such as a clandestine operation against Iran, or the identities of spies in Syria. The military has its own lexicon of classifications.

    The clearance process is largely a variation on a single note: let’s look into what this person has done in his life prior to seeking a clearance, and then try to extrapolate that into what he will do once cleared. But because, like your mutual funds, past performance is no guarantee of future success, the process is inherently flawed.

    Despite the wide variety of clearances available, the process of obtaining one is similar across the board. What changes is less the process of looking into someone’s life than the granularity of the look. Most everyone seeking a clearance begins at the same place, filling out Standard Form 86, Questionnaire for National Security Positions, form SF-86. The SF-86 is mainly a very detailed autobiography, the raw material that fuels the rest of the process. Young people filling out their first SF-86 invariably end up on the phone to mom, gathering old addresses they lived at as kids, birthdays of disconnected relatives, foreign countries visited on family trips and more, a lot more: the SF-86 runs some 129 pages. Some interesting perjury bait is near the end, almost silly questions such as “Have you ever engaged in an act of terrorism?” and a follow-up requiring you to describe, in one line, “The nature and reason for the terror activity.”

    After a hundred pages of names and dates the SF-86 dips into the deal breakers, the questions that weed out quickly those who are unlikely to get very far in the clearance process. Applicants are asked to self-describe financial problems, debts, drug use, gambling, drinking, mental health issues, legal troubles, job firings, and more. Whether out of duty and honor, or more likely a thought process that the agency will find out anyway and lying is an automatic disqualification, most applicants do tell the truth and disqualify themselves.

    Everyone who gets past the SF-86 has some standard checks run on them. Since U.S. Citizenship is the most basic and unwavering requirement for a clearance, every applicant’s claim to being an American is verified. Every applicant then gets a run through whatever databases and electronic records can be found. The goal is to verify quickly as much of the self-provided data and to skim off the low-hanging fruit. A serious arrest record, neck-deep financial problems, and the like will be easily found. Checks are also run through the various intelligence files (a National Agency Check) to make sure while you’re applying for a job at the State Department you are not on some secret list of bad guys over at CIA. For some low-level or short-term clearances, the process can stop here and a decision is made. The time period varies, but usually is a couple of months for a background-only clearance.

    For higher level clearances, including Top Secret, a full spectrum investigation is required. An investigator will visit an applicant’s home town school teachers, his second-to-last-boss, his neighbors, his parents, and almost certainly the local police force and ask questions in person. As part of the clearance process, an applicant will sign the Mother of All Waivers, basically giving the government permission to do all this as intrusively as the government cares to do. This is old fashioned shoe leather police work, knocking on doors, eye balling people who say they knew the applicant, turning the skepticism meter up to 11. The investigator will ask each interviewee to keep quiet about the interview, but typically the applicant will get a hushed phone call or email from some old acquaintance saying the Feds just knocked. Many of the contract investigators at this level are retired FBI or Secret Service people and often will present their old ID to add some gravitas to the procedure. If an applicant lived abroad, the process is tasked out to the nearest U.S. Embassy. All this on-the-street work does not come cheap. A full background investigation can run $15-20,000.

    For many agencies, including the CIA and NSA and likely for a guy like Teixeira, an additional step in the clearance process is the polygraph, the lie detector, the box. The federal government polygraphs about 70,000 people a year in connection with security clearances. What portion of the polygraph process that isn’t shrouded in movie drama is classified, but the basics are simple; even Mythbusters looked into it. The process is based on the belief that when one fibs one’s body involuntarily expresses stress in the form of higher blood pressure, changes in pulse, breathing, and perspiration rate. Those things can be precisely monitored. Did you ever steal anything? No? That’s a lie — see here, your heart rate went up X percent when you answered.

    Some say that the presence of the polygraph machine itself may be mostly for show, and the real nuts and bolts of the process are actually just clever manipulation and interrogation techniques as old as dirt. An awful lot of information obtained via a polygraph has nothing to do with the needles and dials per se, but the applicant’s fear of them and belief that they “work.” Polygraphers are allowed considerable freedom in style, and some get more into role-playing than others. Often the applicant will self-incriminate.

    Up to this point the clearance process has been mostly the aggregation of information. Along the way some applicants might be picked off, but most applicants for a clearance end up in adjudication. And in adjudication lies the core problem in the clearance process: it relies on human judgment.

    The basics of an adjudication look at vulnerabilities, and at past examples of trusts kept or violated.

    Vulnerabilities are easier to determine. People betray their country’s trust for money, sex/compromise, ego or ideology. People with loads of debt or a gambling problem are more susceptible to bribes. People with records of infidelity or a pattern of poor judgment might be lured into sexual encounters that could be used to compromise them. In the bad old days when most LGBT applicants were deeply closeted, this was used as a one-size-fits-all pseudo-reason to deny them employment. Ego is a tougher one to pin down, but persons who lack self-esteem or who want to play at being a “real spy” might be tempted to become “heroes” for the other side. Ideology is a growing issue as more and more hyphenated Americans seek government work and, needing qualified language employees, more and more are recruited by the government. Will a Chinese-American’s loyalty fall to her new home or to the old country where grandma still resides?

    Back in the good old days, when qualification for high level positions required one to be male, pale and Yale, these things were less of concern. Fathers recruited sons, professors noted promising students, and no one thought much about the messy range of people now sought for government work. Need fluent Farsi speakers or a surge of network engineers? You’re going to have to recruit farther afield than the country club. Agencies who used to toss back into the pond pretty much anyone without a pristine background now face unfilled critical positions. So, standards change, always have changed, and will continue to change. Security clearances just work that way.

    If vulnerabilities seem sometimes ambiguous to adjudicate, the next category, trust, is actually much harder. Persons who have kept trusts extended to them, not been fired, not broken laws, paid their bills, saw to their responsibilities, are in the Nice category. Those who didn’t end up over in Naughty. The adjudication part becomes important because very few people are perfect, and very few are really bad. Most everyone falls in the middle, and so agencies must make judgment calls. The goal is to come up with a picture of the person, and then project that picture forward into what they might be like on the job. Like any human-powered process that attempts to predict the future, it is flawed. That’s how Jack Teixeira (Ed Snowden, Chelsea Manning, et al) ended up with a Top Secret security clearance.

     

    Related Articles:




    Copyright © 2020. All rights reserved. The views expressed here are solely those of the author(s) in their private capacity.

    Posted in Military, NSA, Other Ideas

    Fixing the Security Clearance Process

    May 5, 2023 // Comments Off on Fixing the Security Clearance Process

    How do you fix the security clearance process?

    The security clearance process is not a real-time, ongoing endeavor. Instead, someone applies for a government or contractor job that requires a clearance, some sort of background check is done, and a clearance decision is adjudicated. Next case, please. Most clearances are only reviewed every five years and then investigators lean heavily on anything new or changed, and especially on the subject’s performance those five years. Even agencies that use the polygraph employ an abbreviated version of the test when renewing a security clearance. There is no 365/24/7 continuous reevaluation process. Of course records checks are done, a felony arrest properly documented might pop up, and many agencies yearly run standard credit checks and conduct random drug tests. But overall, absent something self-reported or too obvious to ignore, a clearance rides for five years, sometimes literally with no questions asked. How could it be otherwise with over five million active cleared Americans strung across the globe?

    It doesn’t always work out. As happened following the process’ failure with people like Edward Snowden, Chelsea Manning, now with Air National Guardsman Jack Teixeira, much noise will be generated about “doing something” to fix the clearance process. But what?

    Dramatically increasing the number and scope of on-the-street investigations as part of background checks will spiral wildly into crazy expenses and even longer waiting periods to complete clearances. It could bring the hiring process to its knees, and spawn more and more “temporary clearances,” a self-defeating act. This all with no assurance of better results due to both limitations on the whole concept (past behavior in a wholly different environment like high school may not be indicative of future intent under real-world pressures, as in the Teixeira and Manning cases) or simply human judgment errors. If done properly, such changes might even catch a few of the Teixeira’s out there, but to be honest, there are few Teixeira’s out there to begin with and most of them will be sending up obvious danger signals at work for a long time if anyone would pay attention before a clearance review catches up.

    In the interest of never letting a good crisis go to waste, the Biden Administration is now reportedly planning to increase its surveillance of social media and online chatrooms, as if not understanding the internet is a very big place. It is certain that many more in government will call for more aggressive “monitoring” of employees, having them sign away basically all of their civil rights in return for a job. The government will turn its vast intelligence gathering tools further inward and end up pointlessly compiling CIA officers’ credit card receipts from Applebee’s, the web browsing habits of diplomats’ children, and so forth. In truth, a lot of that is probably already going on now anyway (the CIA and other intel agencies have had for years robust counterintelligence operations designed specifically to spy on their own spies.) But you just can’t see into a person’s head, or his heart, via his bank account.

    In addition to a huge waste of money and resources, these measures will inevitably lead to more mistrust and paranoia inside government. Lack of sharing (the CIA believes things it shares with State get leaked, the Army won’t give things away to the Navy, the FBI hoards info so as to not let another part of the Department of Justice get credit for a bust, the NSA doesn’t trust anyone, and so forth) is already an issue among agencies, and even inside of agencies, and helped pave the way for 9/11.

    In addition, handing even more power to security teams will also not work well in the long run. Hyper-scrutiny will no doubt discourage more decent people from seeking government work, unwilling to throw their lives open for a job if they have prospects elsewhere. The Red Scare of the 1950s, and the less-known Lavender Scares, when labeling someone gay inside government would see him fired, show what happens when security holds too many cards. James Jesus Angleton’s paranoid mole hunting at CIA, which ruined many careers, is still a sore point at Langley. No, unleashing the bullies won’t help.

    As a wise man once said, cut through all the lies and there it is, right in front of you. The only answer to the clearance problem is to simply require fewer cleared people inside government.

    This will require the tsunami of document classification to be dammed. In FY2009 alone, 54 million U.S. Government documents were classified. Every one of those required cleared authors and editors, system administrators and database technicians, security personnel, and electronic repair persons. Even the cafeteria personnel who fed them lunch needed some sort of vetting.

    With fewer people to clear because there is less classified material to begin with, always-limited resources can be better focused. Better background checks can be done. Corners need not be cut, and unqualified people would not be issued clearances out of necessity. Processing time would be reduced. Human judgment, always the weak link, could be applied more slowly and more deliberately, with more checks and balances involved.

    More monitoring won’t help and will very likely hurt. In a challenge as inherently flawed as the clearance process, the only way forward is less, not more.

    Related Articles:




    Copyright © 2020. All rights reserved. The views expressed here are solely those of the author(s) in their private capacity.

    Posted in Military, NSA, Other Ideas