In the Clear

​ONE YEAR AFTER AARON ALEXIS used his security clearance to enter the Washington Navy Yard where he shot and killed 12 fellow workers, the federal government is taking steps to better monitor individuals who have been granted clearances. Starting this fall, the Office of the Director of National Intelligence (ODNI) will begin continuous evaluation of its most sensitive Top Secret clearance population.

The effort is in response to a series of reviews by the Department of Defense (DoD), which exposed weaknesses within the department’s investigation methods for cleared individuals. “The reviews identified troubling gaps in DoD’s ability to detect, prevent, and respond to instances where someone working for us—a government employee, a member of our military, or a contractor—decides to inflict harm on this institution and its people,” explained DoD Secretary Chuck Hagel in a statement.

To address the gaps, the department is taking a series of actions recommended by reviewers, including implementing a continuous evaluation program of personnel with access to DoD facilities or classified information. “While individuals with security clearances undergo periodic investigations, I’m directing the department to establish automated reviews of cleared personnel that will continuously pull information from law enforcement and other relevant databases,” Hagel explained.

The White House has called for ODNI to have initial continuous evaluation capabilities for the most sensitive clearances—Top Secret and Top Secret with access to Sensitive Compartmented Information (SCI)—by September of this year and full implementation by 2016.

DoD, like many other departments, has required only periodic reviews of individuals who hold security clearances, ranging from five to 10 years between each review depending on the level of access. In the meantime, individuals were supposed to self-report any major life milestones—such as getting married—along with any other major events, including getting arrested or seeing a mental health professional.

“As you can imagine, sometimes people don’t report those things either because they forget to, or because they’re hiding information,” says Charles Sowell, a former senior advisor to the director of national intelligence. This creates the opportunity for cleared individuals to withhold information from their supervisors that might have severe consequences for security.

The current system can also create a snapshot profile of an individual that isn’t accurate—it can leave out some of the more subtle changes that take place during a person’s life, such as a shift in ideology. “As we saw in the Alexis and the Snowden and the Manning cases, among many others, this snapshot in time approach isn’t sufficient because there’s stuff that surfaces between the five years that is of concern and should be of concern, but we’re not picking up on it,” explains Sowell, who is now a senior vice president at Salient Federal Solutions, a provider of information analytics to the government.

While DoD and ODNI are stepping up their efforts to implement continuous evaluation, this isn’t the first time the federal government has addressed the idea. An executive order gives agencies the power to review the background “of an individual who has been determined to be eligible for access to classified information or eligible to hold a sensitive position at any time during the period of eligibility.”

With the recent actions of individuals who were cleared for service and then not reexamined, more government agencies are seeing the benefits of continuous evaluation, as it helps give a greater understanding of how an individual evolves.

“The point behind continuous evaluation is that your life didn’t change dramatically at the five year mark—your life changed gradually over time,” Sowell explains. For instance, a cleared employee might have gotten married in year one, taken a trip to the Bahamas in year two, gone to Thailand in year three, and gotten a DUI in year four. Continuous evaluation would show how all of these instances developed over a period of time and alert supervisors to potential risks, instead of lumping them together in one investigation down the road.

The DoD has proven that such a system can work and can alert companies to events that occur in an employee’s life between the periodic reviews. One pilot program the department has implemented in the past is the Automated Continuous Evaluation System (ACES). It is a first-generation system and operates on an “on demand” basis, evaluating up to 100,000 personnel annually, according to the DoD Internal Review of the Washington Navy Yard Shooting.

ACES was developed by researchers from Defense Personnel and Security Research Center in Monterey, California, and defense contractor Northrop Grumman almost a decade ago. It was originally tested by the Army and sampled 3,370 service members, civilian employees, and contractor personnel. Of that sample, ACES identified that 21.7 percent had previously unreported derogatory information that had developed since the last investigation, and 3 percent had “serious derogatory information,” such as financial issues, domestic abuse, and drug abuse, that resulted in a “revocation or suspension of a security clearance,” according to a Suitability and Security Processes Review released by the Office of Management and Budget (OMB) 120 days after the Navy Yard shooting.

Since that initial trial run with the Army, ACES has been piloted with the Department of Homeland Security and the FBI to see how the system works with a larger pool of individuals in subsequent trials. The results were successful, but ACES isn’t perfect.

Sowell evaluated the program when he was at ODNI and says that one of the drawbacks is that it’s a “pull” system. “You have to basically hit the check button on ACES as it stands today to run checks,” he explains. “It’s not automated and it’s not continuous…it’s more of a pull-based system and what DoD and other organizations really want to move to is a push type of notification system where they’re alerted to issues without having to ask.”

The DoD’s internal review has acknowledged the issue and said that with “sufficient funding, the department can begin immediately to evaluate potentially high-risk populations…while the next-generation system is completed.” Helping alleviate the problem is a mandate by OMB requiring that DoD fund the development of ACES in the hopes of leveraging it with future continuous evaluation programs.

With this mindset, DoD has set the goal to expand continuous evaluation to encompass the approximately 2.5 million people employed by the department, according to Marcel Lettre, principal deputy undersecretary of defense for intelligence. There is no target date for full implementation, but OMB issued an outline of initial time frames to help the department and ODNI reach its goal.

After ODNI implements continuous evaluation for the most sensitive clearances by this September, DoD will expand its continuous evaluation pilots to include a sample of 100,000 cleared military, DoD civilian, and contractor personnel by October 2014. It will then be expected to expand its continuous evaluation capabilities to 225,000 personnel by 2015, to 500,000 by the end of 2016, and to 1 million during 2017.
 
The price tag for the 2015 portion of continuous evaluation implementation is approximately $53 million, and OMB will work with the DoD to accommodate the expense within resource constraints, according to the OMB report. Additionally, through fiscal year 2015 budget guidance, OMB required the Departments of Justice, Treasury, and Homeland Security to identify agency funding to prioritize for critical databases that will be essential to enable continuous evaluation.

Along with DoD’s advances with continuous evaluation, ODNI will work with agencies across the executive branch to help develop continuous evaluation solutions for their specific departments, the OMB report said. Details about ODNI’s approach remain vague, but Director of National Intelligence James Clapper told Congress in a hearing earlier this year that a continuous evaluation system would extend “across the government” using various data streams to monitor cleared individuals’ behavior both on and off the job.

However, Sowell says he doesn’t think the federal government will ultimately use a one-size-fits-all approach to continuous evaluation, because each department has a unique population.

“DoD hires a preponderance of its population from folks leaving high school, and the things that you can look at from an 18- to 21-year-old population are very different from the population you might find at the Department of Energy, where you’ve got post-doctoral students and scientists in the nuclear field,” he explains. “The things you’re looking at... could be very different agency to agency, department to department.”

Regardless of the approach that various departments and agencies take, Sowell and Hagel agree that implementing continuous evaluation is a step in the right direction to making government agencies more secure.