Security clearance reform remains in the news, as both congress and government policy makers debate the steps necessary to improve the security clearance investigation process. In the wake of Edward Snowden and Aaron Alexis, agreement seems to be that more needs to be done to improve the quality of investigations.
One step being seriously considered is continuous monitoring.
What is continuous monitoring?
Continuous Monitoring and Evaluation (CME) is not a new term. The Automated Continuing Evaluation System (ACES) was mentioned by the Department of Homeland Security in 2007, and piloted by the U.S. Army long before today’s security clearance reform debates began. Even at that time officials understood the security risks of a system that requires self-reporting potential issues. Continuous monitoring implies ongoing checks of publicly available records, including criminal records, court records and financial statements. But even withing the ACES program continuous monitoring isn’t really continuous – ACES operates on-demand and there is still a very human element required in evaluating and adjudicating information brought up by the system.
what is a periodic investigation?
Depending upon the level of access required, individuals holding security clearances are subject to a Periodic Reinvestigation (PR) at a minimum of every five years for Top Secret, 10 years for Secret, and 15 years for Confidential. The Facility Security Officer is responsible for reviewing access records to ensure employees are submitted for PRs as required in the Personnel Security Program regulation.
The PR process is subject to human error and budget realities. Faced with budget cuts and sequestration, PRs were suspended for several months last year. An interagency report on the security clearance process released in March found that 22 percent of the TS/SCI population had outdated investigations. The PR process, while intended to be periodic, is more often than not sporadic. And with anywhere from five to 15 years between investigations, a lot can change.
The ‘Enhanced PR’
A proposal by the Intelligence and National Security Alliance calls for an ‘enhanced’ PR. What does that mean? It’s a PR that includes CME. Periodic reinvestigations would still be conducted with the same adjudicative criteria that exists today. But CME would be layered on top of that process, potentially reducing the frequency of PRs, even at the TS level. A critical element for the success of an enhanced PR is the creation of a centralized online database “from which all agencies could access clearance holder information.” That could be good news for efforts to advance security clearance reciprocity, but new technology also means new cost. New processes also require new training for investigators and adjudicators.
CME is at least several years away, given the technological and budget constraints. But perhaps the possibility of continuous monitoring will have an effect on today’s cleared population. Education on which issues require self-reporting (change in marital status, financial issues, foreign travel) may mean more cases of self-reporting those issues in the first place.
