Nearly a quarter of all security clearance holders are now under Continuous Evaluation (CE), a method of online monitoring designed to keep constant tabs on security clearance holders and watch for red-flag issues that may merit a change in eligibility to access classified information.
A recently released report by the Government Accountability Office (GAO) cautions the CE program still has a long way to go, however, particularly in regards to consistent implementation and an accurate evaluation of cost and effectiveness.
“ODNI has not formalized its policy on what continuous evaluation encompasses, determined what the future phases will entail or when they will occur, or developed an implementation plan,” the report summary notes. “According to all seven agencies GAO interviewed, this uncertainty has affected their ability to plan for the program and estimate its costs. Without a continuous evaluation policy and a fully developed plan, full implementation—which has been delayed since 2010—may be further delayed.”
The push for CE expanded significantly following the reviews of the security clearance process prompted by Edward Snowden and Aaron Alexis, but it is not a new proposal. CE was piloted by DoD in various capacities for over a decade. Pilots were being conducted as early as 2001. Efforts to apply CE across the cleared population began as early as 2004.
The 2018 National Defense Authorization Act calls for a plan to transfer Department of Defense security clearance investigations back to the DoD. That plan weighted heavily on the use of CE to replace periodic reinvestigations, reducing the time required to conduct investigations along with the cost. The GAO report calls into question that logic, noting the ODNI has no plans to replace reinvestigations with CE. The report also notes five agencies stated CE programs will increase their workloads and costs, and they cannot afford to conduct both CE and reinvestigations.
All of the agencies interviewed reported uncertainty about the program, and none reported access to any implementation plans or estimated costs. ODNI conducted its own CE pilot in 2016, and is in the process of creating both standards and a system executive branch agencies can use to conduct CE. The DoD is currently building its own CE program, and it’s unclear how that program will conform to ODNI policy. An issue with DoD’s development of CE has been that lack of overarching policy from ODNI. Without it, DoD has been moving forward with its own requirements, which may or may not conform to ODNI policy once it’s established.
The Office of Management and Budget (OMB) Insider Threat and Security Clearance Reform cross-agency priority goal milestones listed an initial policy due date of July 2014. ODNI kicked the can to September 2016, but also missed that timeline. It’s unclear if the new policy goal of October 2017 was met or once again punted.
The Problem with No Policy
The report noted several issues with the implementation of CE:
- In the absence of ODNI policy, DoD is creating its own, which may differ from other executive branch agencies. The report notes reciprocity may be negatively impacted if each agency moves forward with its own implementation plan.
- Unresolved technical and legal issues.
- No estimation of costs, and the current issue of redundant cost as CE and PRs are conducted simultaneously.
- Without a change in policy, DoD expects CE to extend the amount of time it takes and increase the backlog – as CE will result in more flags and more investigative field work on top of PR fieldwork.
- Agencies currently regard CE inconsistently. DoD hopes to replace PRs with CE. The Department of State, Department of Homeland Security, and Department of Justice all believe PRs must remain, as some state and local law enforcement records are not pulled with CE pilots.
The heart of the issue highlighted by the GAO report is a lack of policy guidance. Without it, the efficiency and success of the program is at risk.
“ODNI has not demonstrated the leadership necessary to make continuous evaluation a priority,” the GAO notes. “Accordingly, the program’s implementation has been delayed for almost 7 years.”
It’s clear the DoD is not willing to wait. The only risk of that is if ODNI comes forward with policy that contradicts DoD’s – or refuses to reduce the requirement for PRs. If that is the case, DoD will find itself with a bill for $1.8 billion for the increased cost of implementing just five years of CE.
