When Government Employees Pose a Threat to Security and Safety

Who can you trust? The tragic Navy Yard shootings in 2013 crystallized a long-simmering problem for federal leaders—how to proactively manage potential threats from the government’s own employees and contractors.

It’s a challenge officials have been grappling with for more than a decade. Legislation adopted in 2004 included requirements to standardize the background security clearance process across agencies. But in the years that followed, the consolidation efforts took time, culminating in a 2008 presidential directive by President George W. Bush to improve the process. A number of incidents since then only increased the visibility and urgency to act: Chelsea Manning’s dump of sensitive information to WikiLeaks in 2011; Edward Snowden’s disclosure of highly classified information in May 2013; and the Navy Yard shooting in September 2013.

In response to the WikiLeaks incident, President Obama issued an executive order requiring agencies to create an Insider Threat Program. But the 2013 Navy Yard shooting spurred significantly more action. Obama directed a 120-day review of the “suitability and security” processes used to hire and oversee employees and contractors for the federal government to ensure personal safety at federal physical facilities as well as protect our nation’s most sensitive information.

The 120-Day Review’s report recommended creating a full-time program management office to support the Performance Accountability Council, the development of reform policies, and their implementation across the government. The reform initiatives supported by this office were ultimately designated by the Obama administration as one of the 15 cross-agency priority goals in 2014.

Changing Objectives  

The initial objective of the Insider Threat and Security Clearance Reform initiative—long before it was designated a cross-agency priority goal in 2014—focused on implementing ongoing efforts to create more secure personal identity verification (PIV) cards and reform the security clearance process.

The 2015 Office of Personnel Management data breach of personal information on 21.5 million federal employees and contractors led to a shift in emphasis. The PAC was tapped to conduct an interagency 90-day review of the background investigation process. The review recommended creating a new organization within OPM dedicated to conducting background investigations. It also recommended relying on the Defense Department to develop and operate the technology backbone for hosting the background investigation process and records.

In late 2016, the cross-agency priority goals for this initiative were revised to reflect these new priorities and other ongoing reform initiatives, to include implementing continuous vetting and establishing a continuous performance improvement model for the mission.

Organization

The 2008 reforms introduced by President Bush focused on streamlining the background clearance review process. To lead that effort, he created the Suitability and Security Clearance Performance Accountability Council (PAC), comprised of top officials from the Office of Management and Budget, OPM, the Office of the Director of National Intelligence, and Defense.  Other council members included the Energy, State, Justice, Homeland Security, and Treasury departments. After the 2014 report to the president, membership was further expanded to other organizations.

The PAC is largely responsible for overseeing governmentwide security, suitability and credentialing reforms, as well as ensuring forward momentum. In addition, the PAC created an Enterprise Investment Board to oversee the alignment and funding of information technology requirements, and established several shared services to provide targeted enterprisewide services to agencies. They believe that their efforts have resulted in greater consistency across the executive branch. They also work closely with the Insider Threat Task Force created earlier in 2011, as well as the new National Background Investigations Bureau created in late 2016.

The PAC Program Management Office uses “agile scrum” to manage its operations, which are largely tactical and responsive to current events.  However, it also manages a research and innovation program that is strategically forward-looking.  The responsibilities of the Security Executive Agent are vested in the Director of National Intelligence, while the responsibilities of the Suitability Executive Agent and the Credentialing Executive Agent are vested in the director of the Office of Personnel Management. The program management staff sees itself as responsible for aligning activities between the PAC, the executive agents, the agencies and key stakeholders in order to remove bureaucratic barriers.

Results and Next Steps

Several tangible results from the past decade of reform efforts include enrolling 500,000 federal employees in a continuous evaluation program and reducing the number of people with clearances by 20 percent.

A number of actions taken in recent months have resulted in an enterprisewide framework that is designed to ensure sustainability over the next few years. These include:

• Issuing a PAC Strategic Intent document in July 2016 outlining a five-year framework to sustain progress. This was supplemented in October, with an Enterprise IT strategy to support the plan, an implementation plan in final approval.
• Issuing a new Security Executive Agent Directive that requires agencies to report events such as bankruptcies and foreign travel of staff. It also includes requirements on how agencies are to protect this sensitive information.
• Standing up the National Background Investigations Bureau, housed within OPM, to conduct background investigations. The bureau is now officially the governmentwide service provider for background investigations.  
• Completing a set of electronic business rules for the automated adjudication of favorable Secret and Confidential background investigations, which speeds reviews and saves significant resources.
• Expanding training on insider threats, provided by the National Insider Threat Task Force.

Other initiatives underway include implementing a suite of eight shared services. In addition, the PAC is developing the capability to collect and share information with HR and insider threat assessments between agencies, and is expanding this to include continuously monitoring changes in the personal statuses of current employees and contractors.

This is the sixth in a series of blog posts about the status of the 15 Cross-Agency Priority Goals initially established in 2014.