John Hamre: Security clearances not secure enough
09/22/2013 12:00 AM
09/20/2013 4:53 PM
The murders by Aaron Alexis at the Navy Yard in Washington, D.C., and the betrayal by National Security Agency leaker Edward Snowden both underscore a problem with our security clearance process.
Fundamentally, the United States has a “perimeter security” system: A government adjudicator guards the gate, deciding who should be allowed through. But once clearance is granted, there is little further substantive assessment of an individual’s behavior or activities.
Clearances are supposed to be updated every five years, but that is not always observed. The process, which grew out of the bitter experiences with spies early in the Cold War, is obsolete.
For example, applicants are still asked to identify every home they have lived in, and U.S. workers try to interview neighbors in each place. There is no differentiation between new college graduates and government workers who have held clearances for decades. Recently, a colleague who is a former deputy secretary of a major Cabinet department submitted his SF-86, as the clearance form is known. It ran 256 pages. He has been cleared nine times yet still has to fill out the same form everyone else submits.
Once you hold a clearance, however, it is generally carried over if you change jobs. Snowden’s peripatetic career is typical. Snowden should have been under ongoing surveillance, not because of his personal behavior but because of the sensitivity of his position. His job was to move massive files to different computer networks in the NSA system. Steady surveillance ought to be a condition of employment.
The case of Alexis is more complicated. He did not hold a sensitive job or a highly privileged clearance. Our system is designed to defeat spies, not crazy people.
But there are potential solutions. Innovative organizations in the U.S. government are pioneering continuous surveillance methods that could have detected Alexis by using many data sources and reporting risky behavior to security supervisors. There were ample signs of a troubled mind, which should have triggered more rigorous supervision and monitoring.
This type of oversight must be carried out through automated techniques. Our paper-based human review process would be overwhelmed quickly. When data suggest a more focused investigation is needed, trained investigators should take over. Privacy concerns must be addressed, but they could be managed in a manner acceptable to our society.
Government employees and contractors understand that they must be held to closer scrutiny precisely because they carry the credential of trustworthiness to deal with America’s secrets.
We mourn the needless death of civil servants. But we should learn and implement lessons that will really solve the clearance problem.