Perhaps the most commonly heard, and oft abused, security phrase is: Need to Know. Anyone holding a clearance has been briefed on this term, but few practice it in real life. Why is this a phenomenon in so many places where classified projects are performed?
Spies Find Information They Want
Spies do their best to ferret out the secrets you know. They begin wherever they can begin. A recent case played itself out in a classical barroom setting. A young man was approached, having been identified in conversations as someone who needed money, and desperately. He had no clearance, but he did potentially have access to those who did. The spies had earlier plied a colleague of the young man with tales of woe – that they needed someone with his skills for a lucrative job. The accommodating friend, knowing the young man’s financial status, offered to introduce his friend to the spies. Of course, neither the accommodating friend nor the young man himself had the slightest idea the inquirers were other than they said: businessmen seeking international colleagues. In time, the young man was drawn into the coil of the spies, having been trustingly introduced by the man’s unwitting friend who’d only desired to help.
Casual Conversation Leads to Elicitation
Another case shows how gathering information without a need to know can happen even in casual conversation. This method is called elicitation. An understanding of its dynamics is important to grasp if we want to properly understand the ‘need to know’ phrase.
Imagine two people meet at a conference. A general openness is present because both share the same interest which drew them to the conference in the first place. A study of military hardware, for instance, brings in business and sales personnel from around the world. At such conferences, a cleared person must be especially on guard. The casual acquaintance already has established a general ‘bona fides’ because he has a background in the same subjects as his target. Discussions roll around to general concern about regulations, and who doesn’t worry about those?
“Have these government rules hurt you like they hurt me?” asks our new colleague.
Or perhaps he asks, “I’ve got it on good authority that an overhead of 20% can win this government contract. You just need the cleared people already on board.”
“Our estimates of cost per item would range in the early thirty thousand dollars per copy. No one can touch this.”
Each of these suggestions could lead to a more specific discussion. Each could confirm or deny a person’s acquaintance with a project’s details. Or it could lead to others who do. What’s important to know is that these are not necessarily casual questions, but targeted questions to establish you as a possible source, or as an entrée to others.
“I’m low on the pecking order at my company,” you, our cleared contractor, lament.
“Any of your colleagues here?” your interrogator asks, looking around.
“No, they sent me to get supply contacts for our project at our main plant here in town.”
“Well here, then, pass along my name to your boss, because that’s where I can help. I’m a worker bee in my company too. But you can help me meet the right guys. I’ll certainly return the favor.”
“Same here,” you respond, exchanging cards.
Remarkably, you never hear from him again. Unknown to you, someone in your company, who you don’t know, is contacted by your counterpart from the conference. Your name is used as the point of entry when the person calls. He says to your colleague at the plant, “I met your colleague at the conference. We hit it off right away. He told me to contact you.” He then begins to suggest that you told him a lot more than you ever did, to make sure this person can help him. Oh, and he doesn’t give the same name he gave you. This last trick is so that when the boss calls you to check, you don’t remember ever speaking to someone named that. You suppose he was referred by someone you did speak to.
Case closed? Or only beginning?
Remember the Phrase: Need to Know
So what to do? Remember need to know. As a cleared contractor, you should have a policy that states that any and every contact established at a meeting or conference be recorded. And that record be kept. Often, these records are called ‘trip reports’. They are a type of ‘payment’ for the company sponsored trip you’ve just been on. This way, a record of who you contacted, under what circumstances, and what was discussed will be a matter of record. These reports should be formalized, with specific questions outlined, so that they are easily filled in upon return of one of your employees from a conference. That way, when someone calls up, you have some way of checking the validity of who they are, and what they are interested in. Also, if something clearly seems to be wrong, it is a good place for the investigation to begin, and you can help tremendously in solving the problem.
