One of the benefits to a cleared job is the ability to leave your work behind you at the end of the day. If you work in a SCIF, you might even lock the door as you head out the door. But with every transition comes the temptation to take something with you. Unfortunately, some individuals forget that leaving things behind isn’t just good for work-life balance. It’s a critical way for companies to protect both classified and proprietary information.
True or False: If you use your company laptop for personal purposes, you have a right to download your files when you quit.
In a recent case before the Defense Office of Hearings and Appeals, an individual spent 11 years working for a defense contractor. On his last afternoon with that company, he downloaded more than 15,000 files onto a USB drive. The company discovered it, and an adverse information report was filed against the individual. The individual then received a Statement of Reasons based on Guideline K, Handling Protected Information, Guideline M, Misuse of IT Systems, and Guideline E, Personal conduct.
Nothing may have come of the downloads if the company the individual was departing didn’t have the right procedures in place. But with the significant volume of downloads flagged, they realized it wasn’t just personal files the individual collected, but over 8 gigabytes of data including company and proprietary information. The applicant claimed he was trying to retrieve personal data he had kept on his laptop.
When Your Creds Don’t Lie
There were several factors working against the successful retention of a security clearance. The first is the fact that all of the files were downloaded on the last afternoon of the last day in the office. If you know you’re about to leave an employer, you should probably begin the process of removing your birthday photos and resume PDFs ASAP. A data dump on the last day is not a good look. The other key factor was the individual’s role – as a systems engineer and information assurance engineer, he simply should have known better. The third issue – and probably nail in the coffin of a security clearance denial/revocation is the fact that the individual stated the first time he learned about the issue was during the course of the security clearance background investigation interview – when the reality was that his former company confronted him about the issue and asked him to return the USB. They also had him sign a memorandum acknowledging that he had violated the company’s policies.
Personal vs. Professional
The post-COVID remote work environment has only exacerbated the issue. What’s personal, and what’s professional? Where is the line when you’re working on your laptop at 10 PM, checking email, and updating files? When it comes to company equipment – and especially in the cleared environment – it’s worth assuming that anything on your personal laptop falls within the purview of your company. We all trade expediency for security. But in the cleared space, that’s just not a good option. New policies around Controlled Unclassified Information (CUI) mean there are even policies around how companies need to protect proprietary data that isn’t classified. Just because it doesn’t have a classification marker doesn’t mean you don’t need to protect it. And just because it doesn’t have a classification marker doesn’t mean you can walk out the door with it.
False: Even Downloading Personal Files Can Get You In Trouble
If you find yourself leaving a job and with a bunch of personal documents on your computer, it’s time to come clean with your tech team. They are likely willing to work with you to safely remove those files – whether it’s to a thumb drive or cloud space. But this is an instance where permission is needed. Violating storage policies on your way out the door means you might just cost yourself your new job, in addition to burning bridges at your old one.
