For Release on Delivery

Expected at 10:00 a.m.

Wednesday,

September 20, 2000

GAO/T-NSIAD-00-246

DOD PERSONNEL

More Accurate Estimate of

Overdue Security

Clearance Reinvestigations

Is Needed

Statement of Carol R. Schuster, Associate Director

National Security Preparedness Issues

National Security and International Affairs Division

Testimony

Before the Subcommittee on National Security, Veterans

Affairs, and International Relations, Committee on

Government Reform, House of Representatives

United States General Accounting Office

GAO
Page 1 GAO/T-NSIAD-00-246

Mr. Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss our recent evaluation of the

Department of Defense’s (DOD) backlog of overdue personnel security

reinvestigations.1 This evaluation was conducted at the request of the

Subcommittee Chairman, who was concerned about the size of the

backlog. In January 2000, DOD estimated that the backlog had grown to

over 505,000, or about one out of every five individuals with a security

clearance. However, DOD has also reported that it does not know the

actual backlog size because existing personnel security databases cannot

provide an accurate count of overdue reinvestigations.

To lessen the government’s vulnerability to espionage and reduce national

security risks, federal standards require a periodic reinvestigation of

individuals with security clearances. An individual’s security clearance is

outdated if a reinvestigation has not been initiated in the past 5 years for

top secret clearances, 10 years for secret clearances, and 15 years for

confidential clearances. Undertaking reinvestigations on time is

particularly important because DOD regulations permit individuals to

maintain access to classified information regardless of whether and how

long their reinvestigations are overdue.

Today, we will discuss (1) how DOD estimates the backlog, (2) the

soundness of DOD’s backlog estimates, and (3) DOD’s plans to address the

backlog problem. But first, we would like to provide a brief summary of

our testimony.

In the absence of a Department-wide database that can accurately

measure the reinvestigation backlog, DOD estimates the backlog on an adhoc basis. Since 1998, various DOD documents and statements have cited

several widely divergent backlog estimates—ranging from about 452,000

to 992,000. More recently, DOD has attempted to develop formal and more

accurate estimates using two primary methods—manual counts and

statistical sampling. Using the counting method, the military services and

Defense agencies ask security managers to review their personnel and

count those overdue for a reinvestigation. Using the sampling method,

1DOD Personnel: More Actions Needed to Address Backlog of Security Clearance Reinvestigations

(GAO/NSIAD-00-215, Aug. 24, 2000).

Summary
Page 2 GAO/T-NSIAD-00-246

DOD uses statistical analysis to refine rough—and known to be

inaccurate—estimates extracted from existing security databases.

However, the reliability of DOD’s recent formal backlog estimates is

questionable because the estimates had methodological limitations, were 6

or more months old by the time they were reported, and excluded

thousands of overdue reinvestigations. For example, using the counting

method, DOD reported in January 2000 that the backlog totaled about

505,000. However, the military services used inconsistent methods and

different time periods to determine their backlog counts, and DOD did not

verify the accuracy of the counts. Using the sampling method, a DOD

contractor reported in February 2000 that the backlog also totaled about

505,000. However, only half of the individuals sampled responded to the

survey, and the necessary follow-up was not performed to make the

estimate statistically valid. Moreover, both estimates excluded as many as

94,000 overdue reinvestigations that had been submitted for processing

but were not yet completed as of February 2000.

Knowing the accurate size of the backlog is an important step towards

effectively managing and eventually eliminating the backlog. DOD

recognizes this and plans to implement a new personnel security database

in mid-2001 designed to include information that could allow real-time

counts of overdue reinvestigations. However, DOD has not specified how

it plans to use the information in the new database to help manage the

reinvestigation program or ensure that future reinvestigation requests are

submitted when they are due. Our August 2000 report recommended that

DOD design routine reports that show the full extent of the backlog and

that DOD develop incentives to keep reinvestigation information current

and have requests for reinvestigations submitted on time. DOD agrees with

these recommendations and has begun to implement them.

The federal government uses personnel security investigations to

determine whether an individual should be granted access to classified

information. In addition to requiring an initial investigation, federal

standards require periodic reinvestigations of individuals granted access

to classified information. Although such investigations do not guarantee

that individuals will not later engage in espionage activities, they remain a

critical part of identifying those who can be trusted to access and

safeguard classified information. Of the 2.4 million DOD military, civilian,

and contractor employees with personnel security clearances at the end of

fiscal year 1998, 96,000 held confidential clearances, 1.8 million held secret

clearances, and 524,000 held top secret clearances.

Background
Page 3 GAO/T-NSIAD-00-246

The Assistant Secretary of Defense (Command, Control, Communications,

and Intelligence) is responsible for DOD’s personnel security program,

including the periodic reinvestigation program. The Assistant Secretary

oversees the Defense Security Service, which is responsible for

investigations and reinvestigations of DOD’s civilian and military

personnel and contractors. Over 5,000 security managers within the

services and Defense agencies are responsible for ensuring that

individuals submit reinvestigation requests as their updates become due.

DOD Regulation 5200.2-R, Personnel Security Program, states that a

clearance shall not be suspended or downgraded solely because a periodic

reinvestigation has not been conducted precisely within 5 years for top

secret clearances and 10 years for secret clearances. The regulation

requires that DOD agencies, in recognition of mission requirements, be

flexible in administering the reinvestigation requirement. Thus, as a matter

of practice, the services and DOD agencies normally do not suspend or

downgrade individuals’ access to classified information when

reinvestigations are overdue.

Although DOD has historically reported a large backlog of overdue

reinvestigations,2 the size of the backlog has reportedly increased

significantly over the past few years due to several factors. First, new

standards, approved in 1997, increased periodic reinvestigation

requirements by shortening the time interval between reinvestigations for

secret clearances from 15 to 10 years and by establishing a new, 15-year

periodic reinvestigation requirement for confidential clearances. Second,

for 4 years starting in fiscal year 1996, DOD tried to help the Defense

Security Service clear up its backlog of pending investigations by imposing

quotas on the number of reinvestigations the services and Defense

agencies could request. This led to pent-up demand for reinvestigation

requests. Finally, in October 1998, the Defense Security Service began

having significant difficulties implementing a new automated case control

management system. The problems led to reduced productivity and longer

completion times.

2The backlog can include overdue reinvestigations from the following DOD services and agencies:

Army, Navy, Air Force, Marine Corps, Uniformed Services University of the Health Sciences, National

Imagery and Mapping Agency, Defense Advanced Research Project Agency, Defense Information

Systems Agency, Defense Threat Reduction Agency, Washington Headquarters Services, National

Security Agency, Inspector General, Defense Logistics Agency, Defense Contract Audit Agency,

Defense Finance and Accounting Service, Defense Security Service, Defense Intelligence Agency, Joint

Staff, and DOD contractors.
Page 4 GAO/T-NSIAD-00-246

DOD does not have a Department-wide information system to track the

status of security clearances. Without a central database to help it

determine the reinvestigation backlog, DOD has used two primary

methods for ad-hoc estimates of the backlog—manual counts of

individuals with overdue reinvestigations and statistical sampling

techniques to refine rough estimates of overdue reinvestigations from

existing databases. DOD’s primary existing database containing personnel

security information, the Defense Clearance and Investigations Index,

contains about 28 million records of past and current military, civilian, and

contractor personnel who have been the subjects of criminal or security

clearance investigations. Managed by the Defense Security Service, the

index is used to study policy options and to prepare required and ad-hoc

reports on the functioning of the personnel security program. Although the

index was not designed to provide real-time, actual counts of overdue

reinvestigations, it can provide a rough estimate of the backlog. The

problem is that the rough estimate overstates the backlog because the

index includes (1) many individuals no longer employed by DOD, (2) many

individuals eligible for clearances but no longer requiring access to

classified information, and (3) data showing only the highest eligible

classification level of many individuals who currently require access only

at a lower classification level.

DOD’s two most recent backlog estimates—one by a DOD process team

and the other by a contractor, the MITRE Corporation—were developed

independently and used different estimating methods but coincidentally

arrived at similar estimates of about 505,000 overdue reinvestigations. The

process team’s estimate originated in November 1999, when the Deputy

Secretary of Defense formed the team to review the accuracy of the

reinvestigation backlog and develop solutions to manage and eliminate the

backlog. To develop its backlog estimate, the team first defined the

backlog and included only reinvestigations that were (1) overdue

according to the time lapsed since the individual’s last investigation,

(2) currently required, and (3) not yet submitted to the Defense Security

Service for an update. Also, individuals with security clearances were

evaluated according to the classified access level required to do their

current jobs and not according to the highest level of classified access for

which they were eligible. For example, an individual needing only a secret

clearance but holding a top secret clearance was not considered overdue

for a reinvestigation until 10 years, not 5 years, after the last investigation.

The team then calculated its estimate by asking the services to count the

number of individuals overdue for a reinvestigation.

Lack of Database Led

DOD to Use Two

Methods to Estimate

Its Backlog

Reliability of DOD’s

Backlog Estimates Is

Questionable
Page 5 GAO/T-NSIAD-00-246

The team’s estimate contained three key limitations that raise questions

about the reliability of the estimate. First, the team did not review the

methods used or the accuracy of the backlog counts reported by the

services. Second, the services were inconsistent in the way they arrived at

their counts and used different points in time to determine their backlog:

• The Army asked its commands and units for a backlog count as of

September 30, 1999.

• Navy leaders did not want to ask commands and units to count overdue

reinvestigations, stating that this would disrupt mission responsibilities.

Instead, the Navy (1) counted overdue reinvestigations of civilian

personnel in one major command as of September 1999 and, on the basis

of that count, extrapolated an estimate of its total civilian personnel

backlog; (2) estimated its military personnel backlog by analyzing military

jobs requiring clearances and the years of service of the individuals

occupying those jobs (for example, individuals with over 6 years of service

in jobs requiring a top secret clearance were considered overdue for a

reinvestigation); and (3) used a count of overdue reinvestigations of

civilian and military personnel in the Marine Corps as of September 10,

1999.

• Rather than performing another count of its backlog, the Air Force

adjusted an April 1999 backlog estimate to approximate its backlog as of

December 1999. To do this, the Air Force added all reinvestigation

requests that it had submitted between May and December 1999 and

subtracted them from its April 1999 estimate. The Air Force did not verify

whether the requests subtracted from this estimate had been included in

the original April 1999 estimate, and it did not add individuals that had

become overdue for a reinvestigation from May through December 1999.

The third limitation was that, rather than developing new backlog counts,

the team used previously developed estimates of overdue reinvestigations

among DOD agencies and contractors, even though these accounted for

about one-third of the backlog. Finally, the team’s estimate used a

definition of overdue reinvestigations that excluded those overdue

reinvestigations submitted to but still pending at the Defense Security

Service. Normally, the Defense Security Service does not open a

reinvestigation immediately after it receives a request and usually requires

about 5 to 7 months to complete a reinvestigation. When the team reported

its estimate in January 2000, about 86,000 reinvestigations were still

pending at the Defense Security Service; according to DOD officials, the

vast majority of these were overdue.
Page 6 GAO/T-NSIAD-00-246

DOD’s other recent backlog estimate—made by a contractor using

statistical sampling—originated from a 1999 Defense Security Service

study to measure the backlog and determine how the Service should

prioritize backlog cases so that those with the highest security risk could

be completed first.3 As a starting point, the Defense Security Service

obtained a rough, and known to be inaccurate, estimate of the

reinvestigation backlog using existing databases. This estimate indicated

that 954,445 individuals were overdue for reinvestigation as of June 30,

1999. From this estimate, a random sample of 1,200 cases was taken. Each

case was surveyed to determine whether it was a true backlog case—

meaning that the individual held an active clearance, needed access to

classified information at the clearance level indicated, and had no

clearance update request in process. When the contractor wrote its report,

it had received 617 survey responses (51 percent of the sample cases). Of

these, 246 identified true backlog cases.

The contractor’s estimate also included limitations that raise questions

about its reliability. One was the low survey response rate. No survey

follow-up was performed to increase the response rate, and because

responses were fewer than 1,200, the estimate rested on the assumption

that there were no statistical differences between respondents and

nonrespondents. However, to determine whether this assumption was

true, sampling and follow-up of nonrespondents were required; but neither

was performed.

Another key limitation of the contractor’s estimate was that, similarly to

the process team’s estimate, it did not include all overdue reinvestigations.

The estimate excluded overdue confidential reinvestigations, which

number about 15,000, according to Defense Security Service officials. The

estimate also excluded overdue reinvestigations pending at the Defense

Security Service. In February 2000, when the contractor issued its report,

about 94,000 reinvestigations were in process, and DOD officials stated

that the vast majority of these were overdue.

Other widely divergent backlog estimates have been cited in various DOD

documents and statements in 1998 and 1999. However, these estimates

cannot be compared either with each other or with the more recent

estimates by the process team and the contractor because they included

3The contractor’s study developed an algorithm to prioritize reinvestigation requests on the basis of

security risk. By comparing historical data on clearance revocations with information submitted with

each individual’s reinvestigation request, the algorithm predicts the likelihood that the individual’s

clearance might be revoked. Defense Security Service officials stated that they plan to begin using the

algorithm during summer 2000 to give priority to those reinvestigations considered the riskiest.
Page 7 GAO/T-NSIAD-00-246

different clearance levels and were developed using different methods,

time periods, and criteria for determining when an individual is overdue

for a reinvestigation. Appendix I summarizes key data on reinvestigation

backlog estimates by DOD and others.

In a June 9, 1999, memorandum, the Deputy Secretary of Defense directed

the services and Defense agencies to eliminate the backlog by the end of

fiscal year 2000 by ensuring that (1) all individuals had current clearances

in accordance with national standards or (2) all requests for

reinvestigation were submitted and in process. The memorandum also

called for shifting some Defense Security Service workload to the Office of

Personnel Management and to private investigative companies to expand

DOD’s investigative capacity. The memorandum also stated that, contrary

to established practice, clearances were to be administratively terminated

or downgraded if they were not based upon a current investigation or

were not in process for a reinvestigation by September 30, 2000.

Although DOD shifted initial investigations and reinvestigations (except

overseas investigations) of its civilian personnel to the Office of Personnel

Management in 1999, the services and Defense agencies did not submit

overdue reinvestigation requests at the rate required to eliminate the

backlog by September 30, 2000. The services and Defense agencies had

planned to submit 505,786 overdue reinvestigation requests (the same

number estimated by the process team) in fiscal year 2000, plus 131,000

that were becoming due. DOD analyses of the first 7 months of fiscal year

2000 showed that the services and agencies submitted only about

28 percent of the anticipated reinvestigation requests from October 1999

through April 2000. This was only about 34,000 more than the number of

reinvestigations expected to become due during this period, indicating

only a modest drop—about 7 percent—in overdue reinvestigations not

submitted for update. To meet the goal of eliminating the entire backlog by

September 30, 2000, the backlog should have been reduced by over

50 percent (about 250,000) by the end of April.

According to DOD officials, the services and Defense agencies did not

submit more overdue reinvestigations primarily because they had not

budgeted the additional funds needed to cover the costs of the increased

workload and did not shift funds from other programs. Recognizing the

problem, subsequent DOD memorandums issued on March 31, 2000, and

June 22, 2000,

• extended the deadline for eliminating the backlog to March 31, 2002 (now

extended to September 30, 2002);

DOD Is Taking Steps

to Address the

Backlog
Page 8 GAO/T-NSIAD-00-246

• directed that all secret and confidential initial investigations and

reinvestigations of military personnel be transferred to the Office of

Personnel Management to further reduce the Defense Security Service’s

investigative workload;4

• estimated that an additional $201.6 million was needed to pay for work

transferred to the Office of Personnel Management in fiscal years 2001 and

2002; and

• directed the services and other components to (1) allocate funds from

existing resources to pay for investigations performed by both the Defense

Security Service and the Office of Personnel Management during fiscal

year 2001 and (2) include all investigation funding that would be required

for fiscal year 2002 in their budget submissions.

Neither memorandum issued in 2000 stated that clearances would be

cancelled or downgraded if reinvestigations were not current or in process

by the new deadline. Thus, unlike the Deputy Secretary of Defense’s initial

June 9, 1999, memorandum, they did not provide the same incentive urging

security managers to submit future reinvestigation requests on time.

DOD is also implementing a new personnel security database, the Joint

Personnel Adjudication System, to consolidate its security clearance data

systems and provide real-time input and retrieval of clearance-related

information. Assuming that the data will be accurate and reliable, DOD

officials stated, the system will be able to provide accurate information on

the status of security clearances, including counts of overdue

reinvestigations. With this capability, DOD should no longer need to

expend resources to produce ad-hoc estimates of the backlog. The

officials said, however, that they had not yet determined how and when

the system’s periodic reinvestigation information will be extracted and

used to monitor program performance.

To improve the management of DOD’s personnel security reinvestigation

program, we recommended that DOD (1) design routine reports with key

data from the Joint Personnel Adjudication System database to show the

full extent of overdue reinvestigations, including those overdue but not yet

submitted for update and those in process, and (2) develop appropriate

4The Defense Security Service would continue to perform overseas investigations, top secret initial

investigations and reinvestigations of military personnel, and all investigations and reinvestigations of

contractor personnel.

DOD Is Implementing

Our

Recommendations
Page 9 GAO/T-NSIAD-00-246

incentives to encourage agency security managers to keep information in

the database current and to submit reinvestigation requests on time. DOD

agreed with the contents of our report and our recommendations and

stated that it would take steps to implement the recommendations. DOD

stated, for example, that it would require that security clearances be

downgraded or cancelled for those individuals who do not have a current

clearance or who have not had the request for a periodic reinvestigation

submitted to the Office of Personnel Management or the Defense Security

Service by September 30, 2002.

Mr. Chairman and Members of the Subcommittee, this concludes our

formal statement. We will be happy to answer any questions you may have.

For future contacts regarding this testimony, please contact

Carol Schuster at (202) 512-5140. Individuals making key contributions to

this testimony included Christine Fossett, Gary Phillips, and James Ellis.

Contact and

Acknowledgments
Page 10 GAO/T-NSIAD-00-246

Various entities have estimated the extent of the Department of Defense’s

(DOD) periodic reinvestigation backlog, as shown in the following table.

To determine whether an individual is overdue for a reinvestigation, DOD

normally considers the reinvestigation interval standard for the clearance

access level required to do the job. According to DOD officials, many

individuals are eligible for a higher clearance than required to do the job.

Existing databases always include the individual’s eligibility level, but they

do not always include the individual’s required access level. The last

column in the table shows which basis was used to determine the number

of overdue investigations.

Source of the estimate

Estimated

backlog size

Clearance

levelsa

Estimating

method

Backlog “as of”

date

Basis for determining

overdue reinvestigations

Recent refined estimates

Process teamb 505,786 TS, S, C Head count Sept./Dec. 1999 Access

MITREc 505,155d TS, S Statistical

survey

June 1999 Access

Prior refined estimates

Assistant Secretary of

Defense (Command,

Control, Communications,

and Intelligence)

624,215 TS, S, C Head count Sept. 1999 Access, but eligibility was

used for many individuals

Joint Security Commission II 73,160eTS Statistical

survey

Oct. 1998 Access

Unrefined estimates

Defense Manpower Data

Center for the Defense

Security Service

992,231 TS, S, C Rough

estimate/

existing

databases

June 1999 Access, if information was

in the database; otherwise

eligibility

Defense Manpower Data

Center for the Assistant

Secretary

868,943f

611,652g

TS, S, C Rough

estimate/

existing

databases

Oct. 1998 Access, if information was

in the database; otherwise

eligibility

a

Top secret (TS), including sensitive compartmented information. Secret (S). Confidential

(C).

b

Estimate made by Personnel Security Overarching Integrated Process Team.

c

Estimate made by the Defense Security Service and its contractor, the MITRE

Corporation.

d

The estimate was between 451,757 and 558,552 with a mean estimate of 505,155.

e

The estimate was between 64,790 and 81,685 with a mean estimate of 73,160.

f

Based on lapsed time since last investigation date.

Appendix I

Estimates of DOD’s Periodic Reinvestigation

Backlog
Appendix I

Estimates of DOD’s Periodic Reinvestigation

Backlog

Page 11 GAO/T-NSIAD-00-246

g

Based on lapsed time since the individual’s case was adjudicated; that is, the date the

decision was made to grant the clearance.

Source: GAO analysis of data provided by DOD.

(702095)
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs