Obama Overhauls Security Clearance Process, Creates New Federal Entity for Investigations

The Obama administration will create a new entity to manage the security clearance and suitability investigation process, the Office of Personnel Management announced Friday as part of a series of sweeping changes to overhaul the way individuals working for or with the government are vetted and how their information is protected.

The National Background Investigations Bureau will be housed within OPM and assume all the responsibilities currently held by the Federal Investigative Service. FIS conducts more than 1 million total background investigations annually, accounting for 95 percent of the total investigations governmentwide.

The changes come after the dual concerns over both the screening process itself -- which came to light after Edward Snowden’s document release and Aaron Alexis’ shooting of employees at the Washington Navy Yard -- and the protection of personal data collected during investigations -- which were hacked last year and compromised 21.5 million files containing personal information. The Obama administration and Congress have already taken several steps to shore up the security clearance process, but the changes announced Friday reflect the most dramatic overhaul of vetting and cybersecurity procedures to date.

President Obama will appoint someone to head up the new NBIB, who will report to the OPM director. The Defense Department, however, will take charge of developing and designing the security and operations of the background investigations information technology systems. NBIB will also employ a “dedicated senior privacy official” to oversee the new IT systems. The new entity will be headquartered in Washington, D.C.

Obama will request $95 million in his fiscal 2017 budget to create and implement the systems.

OPM will also boost staff to expedite investigations, the agency’s acting Director Beth Cobert said on a Friday phone call with reporters. It began hiring new investigators in September in “high-demand places around the country,” and expects to bring on 400 total employees by the end of the year.

The Performance Accountability Council, which Obama launched after the 2013 Navy Yard shooting and tapped again to review cybersecurity vulnerabilities after the 2015 hack, will remain in place to monitor NBIB’s performance and recommend changes to governmentwide guidance. The presidentially appointed NBIB head will sit on the council, which will also work with the General Services Administration’s Performance Improvement Council to “develop outcome-based metrics to measure the effectiveness of the vetting process.”

Those metrics will include measures of security, cost, quality of investigations and adjudications, timeliness and customer service.

Michael Daniel, special assistant to the president and the White House’s cybersecurity coordinator, said the new interagency collaboration was a “key change.” The kinds of reforms undertaken in the background investigation process should be taken across government, he added.

OPM will also create a new credentialing executive agent, who will set policies related to who receives clearances. It will also launch an NBIB transition team, tasked with standing up the new office and creating a timeline to match business needs. OPM said the team will ensure continuity of service while migrates various responsibilities to NBIB and Defense.

Federal Chief Information Officer Tony Scott stressed the importance of not disrupting current operations.

"The intent is seamless transition over time,” he said, with “cyber changes brought on in modular fashion.” The new IT systems, he added, will have the capacity to be “adapted over time.”

In making its announcement, the administration noted the steps it has already taken to improve the vetting and data protection processes. It has reduced the number of cleared individuals by 17 percent and mandated that everyone with a security clearance must be reinvestigated every five years. On the IT side, OPM and other agencies have patched “critical vulnerabilities,” boosted the number of scans to detect compromises and expanded authentication measures for those accessing databases.

Rep. Jason Chaffetz, R-Utah, chairman of the House Oversight and Government Reform Committee and a consistent critic of the administration’s response to the OPM hacks, condemned the reforms as insufficient.  

“Simply creating a new government entity doesn’t solve the problem," he said. "The administration needs to undertake meaningful reforms to protect citizens’ most sensitive personal information. Today’s announcement seems aimed only at solving a perception problem rather than tackling the reforms needed to fix a broken security clearance process.”

Charles S. Clark contributed to this report.

Correction: This story has been updated with the correct name of the special assistant to the president and the White House cybersecurity coordinator.