The Threat from Within

Background.  Reform legislation adopted in 2004 in the wake of the 9/11 terrorist attacks that restructured the intelligence community included requirements to standardize and better align the background security clearance process across agencies.  But in the years that followed, the consolidation efforts took time, culminating in a 2008 presidential directive to improve the process.

A series of incidents increased the visibility and urgency to act.  Chelsey Manning’s dump of sensitive information to WikiLeaks in 2011, Edward Snowden’s disclosure of highly classified information in May 2013, and the Navy Yard shooting in September 2013 all brought to a head the importance of addressing potential insider threats to protect our nation’s information and provide a safe workplace.

In response to the WikiLeaks incident, President Obama issued an Executive Orderrequiring agencies to create an Insider Threat Program.  But the Navy Yard shooting in 2013 resulted in significantly more action.  President Obama directed a 120-day review of the “suitability and security” processes used to hire and oversee employees and contractors for the federal government to ensure personal safety at federal physical facilities as well as protect our nation’s most sensitive information..

The 120-Day Review’s report recommended creating a full-time program management office to support the Performance Accountability Council (PAC), the development of reform policies and facilitate their implementation across the government.  The reform initiatives supported by this office were ultimately designated by the Administration asone of the 15 cross-agency priority goals in 2014.

Changing Scope and Objectives.  The scope and objectives of the Insider Threat and Security Clearance Reform initiative has evolved over time in response to changing events.  The initial objective of the initiative – long before it was designated a cross-agency priority goal in 2014 -- focused on implementing ongoing efforts to create more secure personal identity verification (PIV) cards and reform the security clearance process. 

The 2015 Office of Personnel Management (OPM) data breach of personnel information of 21.5 million federal employees and contractors from its background investigations and clearance contractor led to a shift in emphasis.  The PAC was tapped to conduct an inter-agency 90 day review of the background investigation process.  The review recommended creating a new organization within OPM dedicated to the conduct of background investigations.  It also recommended relying on the Defense Department to develop and operate the technology backbone for hosting the background investigation process and records.

In late 2016, the cross-agency priority goals for this initiative were revised to reflect these new priorities and other ongoing reform initiatives, to include implementing continuous vetting and establishing a continuous performance improvement model for this mission.

How Is the Initiative Organized?  The 2008 reforms introduced by President Bush focused on streamlining the background clearance review process.  To lead that effort, he created the Suitability and Security Clearance Performance Accountability Council (PAC), comprised of top officials from the Office of Management and Budget (OMB), the Office of Personnel Management (OPM), the Office of the Director of National Intelligence, and the Department of Defense.  Other council members included Energy, State, Justice, Homeland Security, and Treasury.  After the 2014 report to the president, membership was further expanded to other organizations.

The PAC is largely responsible for the alignment and oversight of government-wide security, suitability and credentialing reforms, as well as ensuring forward momentum. In addition, the PAC created an Enterprise Investment Board to oversee the alignment and funding of information technology requirements, and established several shared services to provide targeted enterprise-wide services to agencies. They believe that their efforts have resulted in greater consistency across the executive branch. They also work closely with the Insider Threat Task Force created earlier in 2011, as well as the new National Background Investigations Bureau created in late 2016.

The PAC Program Management Office uses “agile scrum” to manage its operations, which are largely tactical and responsive to current events.  However, it also manages a research and innovation program that is strategically forward-looking.  The responsibilities of the “Security Executive Agent” are vested in the Director of National Intelligence, while the responsibilities of the “Suitability Executive Agent” and the “Credentialing Executive Agent” are vested in the Director of the Office of Personnel Management. The program management staff sees itself as responsible for aligning activities between the PAC, the Executive Agents, the agencies and key stakeholders in order to remove bureaucratic barriers.

Results and Next Steps. Several tangible results from the past decade of reform efforts include enrolling 500,000 federal employees in a continuous evaluation program and reducing the number of people with clearances by 20 percent.

 A number of actions taken in recent months have resulted in an enterprise-wide framework that is designed to ensure sustainability over the next few years. These include:

• Issuing a PAC Strategic Intent document in July 2016, outlining a five-year framework to sustain progress.  This was supplemented in October, with an Enterprise IT strategy to support the plan, an implementation plan in final approval.
• Issuing a new “Security Executive Agent Directive” that requires agencies to report defined events such as bankruptcies and foreign travel of staff.  It also includes requirements on how agencies are to protect this sensitive information.
• Standing-up in October of the National Background Investigations Bureau, housed within OPM, to conduct background investigations.  The bureau is now officially the government-wide service provider for background investigations.  
• Completing a set of electronic business rules for the automated adjudication of favorable Secret and Confidential background investigations, which speeds reviews and saves significant resources.
• Expanding training on insider threats, provided by the National Insider Threat Task Force.

Other initiatives underway include implementing a suite of eight shared services.  In addition, it is developing the capability to collect and share information with HR and insider threat assessments between agencies, and is expanding this to include continuously monitoring changes in the personal statuses of current employees and contractors.

Note:  This is the sixth in a series of blog posts about the status of the 15 Cross-Agency Priority Goals initially established in 2014.

Graphic Credit:  Courtesy of cooldesign via FreeDigitalPhotos.net