| 15 June 2006 The Security Mess I was up too late last night. I intended to be good, but in clicking down the dial I happened on a re-run of the 1985 film “The Falcon and the Snowman.” Coke dealer Daulton Lee was played by actor Sean Penn, who wore a bad wig. His drug habit was what got him the nick-name “Snowman,” sine he appeared to be in the process of putting a good part of Southern California up his nose. Christopher Boyce was played by Timothy Hutton. The Falcon got his nickname from his hobby, which was raising birds of prey. The story was horrifying and funny at the same time. Lee's need to fame and money led him to the Russian embassy in Mexico City, and his friendship with Boyce drew the young man from his job in a contract NSA communication shop into selling the crypto material he was supposed to safeguard. Everyone in the business likes the part where they make margaritas in the secure shredding machines as they boogie to disco in the vault. I always found that the sugary mix clogged the blades. But this is Hollywood, right? I finally staggered off way too late, and may have dreamed of Russians in bad suits and haircuts. I'm glad I am out of the business. Except that I'm not, and no one is who still engages the government in the commercial business. I picked up the paper and saw the mess in conducting government security investigations and granting clearances is deepening, despite laws intended to fix the problem. Efforts to provide quick-fixes to the back-log of investigations may be making things worse, and make it impossible to comply with Federal goals. The 2004 Intelligence Reform and Terrorism Prevention Act requires federal agencies to cut the wait for clearances to a maximum of 120 days for at least 80 percent of applications by the end of 2006. By 2009, the law mandates that clearances be processed in 60 days, with all Top Secret clearance requests to be completed in 120 days. DoD is not going to be in compliance. Not even close. We are already in a sort of de facto moratorium. The process has ground to a halt. The Defense Security Service (DSS) has ceased to update existing clearances and is only processing Secret access for government workers and military personnel. The emergency funds to do that will run out next month, and the backlog of new requests and expiring current investigations is soaring past 300,000. The Office of Personnel Management (OPM) got tagged with the responsibility to manage clearances for everyone last year, when DSS failed. The government's annual requirement is for nearly two million investigations annually, with OPM responsible for processing about1.8 million clearance applications annually. Currently, requests to OPM for a Top Secret clearance or for access to Sensitive Compartmentalized Information can take up to 18 months to process. Who has the money to wait around for more than a year to start work? It might work in the government, but in the commercial world you would be out of business, muy pronto. Suppose you won a contract and the government expected you to start work right away? Where would you find the cleared people? Wouldn't they already be working somewhere else? Truth in advertising: OPM claims that the average time for an initial clearance investigation is closer to 150 days, and with priority handling, the average processing time for a Top Secret clearance is only 53 days. For all other clearance levels with priority handling, the wait is 64 days. That is apples-and-oranges, though, since expedited handling is normally reserved for Government workers and rare for contract personnel. Shortages of cleared workers in the private sector are diving up salaries and increasing overhead costs to perform government work. OPM claims it will comply when the speedier timelines are mandated in 2009. It also claims to have nearly eliminated the backlog it inherited upon taking over background investigations from DSS. That presumes that DSS will be able to take up the load again, and they continue to be a disaster. . A special appropriation enabled them to resume limited work on Secret-level clearances required by nearly all military personnel, but that money will be exhausted next month and they will be out of business again. The incompetence of that branch of the government is balanced by work-arounds elsewhere. Some of the agencies who have cleared workforces handle their own clearance requests. That includes , the National Security Agency, CIA, FBI, Customs and Border Protection, and the Secret Service. They are beyond OPM's authority, and process an additional170,000 clearances annually. Most of those are for Langley and Ft. Meade. NSA employs contract investigators and conducts its stringent investigations for Top Secret access in as little as six months. But they do it their way, and so does CIA. They are special, after all, and their security people have seen The Falcon and the Snowman. One of the thorniest problems identified by the 9/11 Commission was the inability (or rather, unwillingness) of the Intelligence Agencies to share information. Reciprocity of access is essential. Prior to 9/11, secure e-mail originating at CIA received warning flags when sent to the secure NSA system. It was a little like talking on the Hot Line to Moscow. Five years after the attacks, differing standards in investigations could result in diminished access to personnel cleared to differing standards. To deal with the security mess, Congress is seeking to expand the number of agencies with the authority to issue their own clearances. Sen. Barbara Mikulski (D-MD) takes a special interest in NSA, which is located in her state, and would like the National Geospatial-Intelligence Agency (NGA) currently headquartered in Bethesda, MD, to have the same power. NGA's HQ will be moving to Virginia, to a consolidated campus at Ft. Belvoir, under the provisions of the most recent BRAC round. The move could diminish Sen, Mikulski's enthusiasm. Dispersing this authority to a variety of agencies may be expedient, but flies in the face of law. One of the major provisions of intelligence reform was to standardize requirements, procedures and reciprocity between government agencies. To establish ten or more processes and criteria will only exacerbate the problem of information sharing. Despite the protestations of OPM, the process is fundamentally broken. Well-meaning efforts by Congress to add to the number of agencies empowered to grant clearances will only make the confusion worse. A coalition of industry trade groups has called for a ground-zero review of the security process because the current system is bad for business. With all the turmoil in the system, there is a curious silence. No word on that request has been received from the Office of the Director of National Intelligence, who on this issue anyway, appears to be taking a long lunch. I'm pretty sure they are not making margaritas in the shredders, though. That would slow things down. And it would make an awful mess. Copyright 2006 Vic Socotra |