Anyone who applied for their security clearance before 2014 already lives with the knowledge that all of their personal, private data is in the hands of the People’s Republic of China. The Chinese hack of the servers at the Office of Personnel Management was a cyber-defense wake-up call. But now there’s a new worry: incompetent or misguided government employees and contractors.
Inside the Postal Service, there are, at this very moment, a few panicked supervisors and at least one very nervous lower-level worker who was responsible for answering Freedom of Information Act (FOIA) requests. Because boy…did someone mess things up; someone released the entire SF-86 of a former intelligence officer. The SF-86, for casual visitors to ClearanceJobs, is the insanely detailed personal history questionnaire that all applicants for a security clearance must complete.
In the hierarchy of mistakes one could make on the job, here’s how releasing this highly sensitive “personally identifiable information” ranks: above throwing up in the punchbowl during a party at the boss’s house – and just slightly below putting classified information on the agency’s public website.
Race to unseat Rep. Brat In virginia
Abigail Spanberger is a former CIA officer who is running for Congress against Republican Rep. Dave Brat in Virginia’s 7th District, which covers a large swath of rural central Virginia and the western suburbs of Richmond. Brat, the economics professor and Tea Party insurgent who unseated then-House Majority Leader Eric Cantor in a stunning 2014 primary upset, now faces a stronger-than-expected challenge from Spanberger.
This race shouldn’t be close, but a variety of factors including some redrawing of the lines to comply with a 2016 court case, have led professional observers to rate the race as a “toss-up.” When the GOP is forced to defend a seat like Brat’s, you can expect some high-profile attention from outside the district.
One of the organizations providing some of that outside attention is the Congressional Leadership Fund (CLF), a “super PAC” described as being affiliated with House Speaker Paul Ryan of Wisconsin. On Tuesday, The New York Times reported that an Associated Press reporter had obtained Spanberger’s entire SF-86 from the CLF. Understandably, alarm bells went off, although some took things to the paranoid extreme.
Spanberger decried the “disgraceful and likely illegal tactics” used to obtain the file, and supporters were making comparisons to the outing of CIA officer Valerie Plame during the Bush administration. Another CIA officer running for Congress, Democrat Elissa Slotkin of Michigan, worried she would be the next intelligence community operative to be “doxxed,” referring to the internet practice of publishing sensitive personal information – particularly of the identity of those who wish to remain anonymous.
Right to Privacy vs. Right to Know
I love to quote Hanlon’s Razor: “never attribute to malice that which is adequately explained by stupidity.” It turns out that this wasn’t a case of doxxing, or a highly placed appointee pushing the release of politically charged documents. It’s a case of bureaucratic malfeasance. Spanberger worked briefly as a postal inspector while she applied for her CIA position. The CLF demonstrated to Capitol Hill newspaper Roll Call that it requested her personnel records from the Postal Service under FOIA. The SF-86 was included in the response.
This release was a dumb move on the Postal Service’s part. Common sense should dictate that the details in an SF-86 are so deeply personal that they ought to be kept private. But the mistaken release is almost understandable. There has been an increased emphasis on transparency and erring in favor of release under FOIA, and there is a legal landmine laid between FOIA and the Privacy Act that is nearly impossible for anyone except a lawyer to navigate safely.
There are eight exemptions to FOIA that allow the government not to release a document. Exemption 3 is “Information that is prohibited from disclosure by another federal law.” Exemption 6 is Information that, if disclosed, “would invade another individual’s personal privacy.” Exemption 7(c) exempts information “compiled for law enforcement purposes” that could “reasonably be expected to constitute an unwarranted invasion of personal privacy.”
Was this a violation of the privacy act?
This calls to mind the Privacy Act of 1974. At its core, the Privacy Act prohibits the government from disclosing “any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.”
But as the Justice Department explains, “the Privacy Act never prohibits a disclosure that the Freedom of Information Act actually requires” [emphasis in the original]. The Freedom of Information Act does not explicitly require the release of this type of information, and it should be fairly clear that release of the information in an SF-86 would constitute an unnecessary invasion of privacy. But there is enough legal uncertainty that it’s fairly easy to see how this mistake happened.
Everyone who works in government, particularly around contracting, has at one point in their career received guidance from their superiors that was a clear misinterpretation of law or regulation. Arguing the point usually makes little difference. One simply prays that no real damage is done, and that when someone finally catches the error, it’s not because of something they did.
That seems to be the case here. I would expect to see someone in the Federal government send a legal advisory sent to agencies stating definitively that SF-86s are not releasable. That’s cold comfort to Abigail Spanberger, who has every right to be furious with the Postal Service.
