In February of 2020, Executive Correspondence issued by the Office of the Director of National Intelligence rolled out the policy framework that allowed Trusted Workforce 2.0 to take off. The first stage of Trusted Workforce was eliminating the clearance backlog. With that accomplished, the focus has moved to continuous vetting (CV). Government and industry leaders both discussed the Trusted Workforce 2.0 effort in a forum today hosted by the Potomac Officers Club.
Defense Counterintelligence and Security Agency Director William Lietzau kicked off the conversation with a sweeping overview of the policy, technology and mission priorities within personnel and industrial security today. He noted that today’s Trusted Workforce 2.0 accomplishments are the culmination of over a decade of conversations between organizations and government entities.
“What they also focused on is ‘what’s a better way to vet people for the 21st century?'” said Lietzau. With the backlog effectively reduced, the conversation today is again shifting, with new focuses on both continuous vetting and strengthening the government’s industrial security program. Continuous vetting is currently rolled out to more than 3/4 of the cleared workforce. As the government seeks to implement the program, it’s focusing on creating the technical framework that will help it move forward with its continuous vetting mission.
“You can’t do that without a pretty robust IT system,” said Lietzau, speaking to the need to create an IT framework that can vet and monitor national security applicants and adjust to the many challenges of the legacy technology DCSA has inherited. Lietzau noted the current IT framework consists of “about 80 systems cobbled together and built in the early 1980s,” And its a system with a scandalous past, being the IT framework that was breached in 2015 resulting in more than 20 million records for security clearance holders and applicants going to adversaries. The new National Background Investigation Service will roll those 80 systems into its umbrella and completely overhaul the technology powering both background investigations and continuous vetting.
Recognizing the issues with NBIS and inheriting that legacy technology is what prompted DCSA to implement the Trusted Workforce 1.25 solution, which was a continuous vetting solution that could be rolled out and offered to government agencies at a cost of $42 per person for the year. It was a stop gap solution that allows for CV while NBIS comes together.
DCSA Priorities
- Full Implementation of the National Background Investigation Service
- Increasing Emphasis on Industrial Security
- Bringing Together the DCSA Culture
Lietzau emphasized that while the personnel security program has rightfully garnered a great deal of interest over the past several years, with DCSA’s combined personnel and industrial security mission, it’s critical to emphasize the risks posed by attacks on the defense industrial base.
“We’re in a great power competition,” said Lietzau. “Al Qaeda wasn’t trying to get on Lockheed Martin’s board of directors. I guarantee our great power competitors are.”
Adversaries are investing significant funds on attacking and compromising the defense industrial base, Lietzau emphasized. The personnel security mission is key because of the risks posed by human elements, but there are also important factors that are unique to industrial security, including considering the specific technologies being targeted, which companies are being targeted, and establishing the right physical and cybersecurity elements.
“Having the two together just makes sense,” said Lietzau, describing DCSA’s combined mission.
Evolving CV as a Part of Trusted Workforce 2.0
“Continuous vetting is evolving,” emphasized Heather Green, director of DCSA’s Vetting Risk Operations Center. She noted that there are a number of data sets that are applicable to CV that may not currently be a part of the Trusted Workforce 1.25 solution which was rolled out, including various agency and third party data sets, third party information, social media or user activity. “There is a whole host of information that is valuable in the end-to-end reporting process.”
The DoD program currently covers more than the three basic categories required, but CV could ultimately include even more. Green noted that DoD is looking at three things when they ‘baseline’ a person in the CV system:
- Is that really the person?
- Was the information previously known?
- Was it self reported/was it already actioned?
DoD is aware of concerns about the possibility of adding bias with the addition of AI into the clearance investigation process. As new systems are developed, they’re exploring how to prevent incorporating human bias into the process. And as the DoD paves the way toward full CV implementation, it will soon begin to edit, reiterate, and improve its processes.
