Personnel Security Clearances: Progress Has Been Made to Improve Timeliness but Continued Oversight Is Needed to Sustain Momentum
Published: 2010-11-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In light of long-standing problems with delays and backlogs, Congress mandated personnel security clearance reforms through the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). These included requirements related to timeliness, reciprocity, and the creation of a single database to house personnel security clearance information. In 2008, Executive Order 13467 established the Performance Accountability Council. GAO was asked to review the extent to which executive branch agencies (1) investigate and adjudicate personnel security clearance applications in a timely manner, (2) honor previously granted security clearances, and (3) share personnel security clearance information in a single, integrated database. GAO reviewed and analyzed Performance Accountability Council timeliness data for fiscal year 2009 and the first three quarters of fiscal year 2010. GAO also examined key clearance reform documents and conducted interviews with executive branch agencies, including members of the Intelligence Community, to discuss the three stated objectives.
section_title: What GAO Found
paragraphs: Significant overall progress has been made to improve the investigation and adjudication of personnel security clearance applications in a timely manner. This is largely attributable to the Department of Defense (DOD), whose clearances comprise a vast majority of governmentwide initial clearances. IRTPA establishes an objective for all agencies to make a determination on at least 90 percent of all applications for a personnel security clearance within an average of 60 days. The majority of clearances are processed in line with the IRTPA 60-day objective. Certain agencies, however, continue to face challenges for meeting timeliness objectives. Out of the 14 agencies included in GAO's review, DOD, the Department of Energy, and the National Geospatial-Intelligence Agency met the IRTPA 60-day timeliness objective in the first three quarters of fiscal year 2010. Timeliness among the other executive branch agencies ranged from 62 to 154 days. IRTPA and the recent Intelligence Authorization Act for Fiscal Year 2010 also require annual reporting on the progress made towards meeting objectives, including a discussion of impediments related to timeliness and quality. While the Performance Accountability Council has taken steps to assist in implementation of reform efforts, it has not reported on the impediments to meeting timeliness objectives for specific agencies not yet achieving this goal. Executive branch agency officials stated that they often honor previously granted personnel security clearances (i.e., grant reciprocity), but the true extent of reciprocity is unknown because governmentwide metrics do not exist. IRTPA generally requires that all personnel security clearance investigations and determinations be accepted by all agencies, with limited exceptions when necessary for national security purposes. Agency officials stated that they grant reciprocity, but some noted that they have taken steps to obtain additional information before granting reciprocity. For example, officials stated that they may request copies of background investigation reports before they will honor a security clearance because information available in databases contain limited, summary level detail. Agency officials also reported that steps must be taken to conduct suitability determinations to ensure an applicant's character is appropriate for the position. The extent to which reciprocity is occurring is unknown because no metrics exist to consistently and comprehensively track reciprocity. Although there are no plans to develop a single, integrated database, steps have been taken to upgrade existing systems and increase information sharing. The Performance Accountability Council has opted to leverage existing systems in lieu of the single, integrated database required by IRTPA. Officials assert that a single database is not a viable option due to concerns related to privacy, security, and data ownership. Therefore, a single search capability of existing databases is being used to address the IRTPA requirement. For example, information from two primary databases can now be accessed from a single entry point, allowing executive branch agencies to share clearance information with one another. The Intelligence Community agencies share information through a separate database.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Performance Accountability Council collaborate with executive agencies to develop a plan to improve timeliness for those agencies not yet achieving the 60-day timeliness objective and metrics to track reciprocity. In commenting on this draft, the Performance Accountability Council concurred with all recommendations.

section_title: Letter
paragraphs: Personnel security clearances allow government and industry personnel to  gain access to classified information that, through unauthorized  disclosure, can in some cases cause exceptionally grave damage to U.S.  national security. The July 2010 and subsequent October 2010 reported  unauthorized leak, of almost 500,000 classified documents posted to the  Internet, related to the ongoing wars in Afghanistan and Iraq highlights the  inherent risks involved when granting an individual a security clearance.  Following the terrorist attacks on September 11, 2001, the nation’s defense  and intelligence needs grew, prompting increased demand for personnel  with security clearances. Accompanying this increase in demand for  clearances have been problems of delays and backlogs in the personnel  security clearance process. In 2005, GAO first designated the Department  of Defense’s (DOD) personnel security clearance program a high-risk area  because of these delays and backlogs. We continued that designation in  our 2007 and 2009 updates to our high-risk list because delays continued  and we found problems with the quality of investigation and adjudication  documentation. For example, in our previous work, we noted that the  average time to complete the fastest 90 percent of initial clearances for  military and DOD civilians was 124 days. We have initiated additional  work to assess DOD’s personnel security clearance program and plan to  issue our next high-risk report in January 2011.
In light of long-standing concerns regarding delays in processing  clearances and other issues, Congress set objectives and established  requirements for improving the clearance process in section 3001 of the  Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA).  IRTPA established objectives for timeliness, requirements for reciprocity  (i.e., an agency’s acceptance of a background investigation or clearance  determination completed by any authorized investigative or adjudicative  agency), and an integrated, secure database to house clearance  information. In 2007, DOD and the Office of the Director of National  Intelligence (ODNI) formed the Joint Security Clearance Process Reform  Team, known as the Joint Reform Team, to improve the security clearance  process governmentwide. In the following year, Executive Order 13467  was issued, establishing a Suitability and Security Clearance Performance  Accountability Council (Performance Accountability Council) that is  responsible for driving the implementation of reform and accountable to  the President for achieving the reform effort’s goals. We have previously  noted that top leadership must be committed to organizational  transformation. To this end, committed executive leadership has worked  to reform the personnel security clearance process by improving  timeliness and developing quality measures.  However, four years after  IRTPA was enacted, the House Permanent Select Committee on  Intelligence, Subcommittee on Intelligence Community Management,  concluded that the federal government’s progress with respect to IRTPA  requirements for reciprocity and a single integrated database had fallen  short of the goals established in IRTPA.
Congressional oversight through hearings held by the Subcommittee on  Intelligence Community Management in February, July, and September  2008, and October 2009, has helped focus attention on the need for  security clearance reform. In addition, the Intelligence Authorization Act  for Fiscal Year 2010 requires reports by the President on the security  clearance process, including information on timeliness and quality. In this  context and building on our body of work examining personnel security  clearance issues, you asked us to examine the ongoing reform effort with  an emphasis on whether the current reform efforts were expediting the  processing of clearances and enhancing reciprocity. Specifically, this  report provides information on the extent to which select executive  branch agencies (1) investigate and adjudicate initial personnel security  clearance applications for civilians, military, and industry personnel in a  timely manner; (2) honor previously granted personnel security clearances  and the challenges, if any, that exist related to reciprocity; and (3) share  personnel clearance information in a single, integrated database.
In conducting this review, we focused our scope on DOD, seven agencies  within the Intelligence Community, and a non-probability sample of six  additional executive branch agencies  that use the Office of Personnel  Management (OPM) to conduct background investigations. The total  sample of executive branch agencies represents 25 different DOD and non- DOD organizations. According to data contained in the Performance  Accountability Council’s 2010 report to Congress on clearances granted in  calendar year 2009, the 14 agencies we selected in our timeliness review  account for approximately 98 percent of initial clearance cases  governmentwide annually. To assess the extent to which executive  branch agencies investigate and adjudicate initial personnel security  clearance applications for civilians, military, and industry personnel in a  timely manner we conducted interviews with relevant officials to discuss  aspects of timeliness, including variations in agency timeliness, progress  made, and challenges faced.  We analyzed the timeliness objectives  specified in IRTPA and the timeliness data contained in the Performance  Accountability Council’s 2010 report to Congress on clearances granted in  calendar year 2009. We obtained and reviewed quarterly data on  executive branch agencies, including Intelligence Community agencies,  provided by the Performance Accountability Council Subcommittee on  Performance Management and Measures, which covered the first through  third quarters of fiscal year 2010. These data were current as of August  2010. We also obtained and reviewed quarterly data for the executive  branch agencies provided by OPM for the same time periods. The  Performance Accountability Council reported agency timeliness data using  two distinct methodologies. First, they calculated IRTPA timeliness by  analyzing investigation and adjudication data separately, calculating the  average timeliness of the fastest 90 percent of investigations and  adjudications based on the fiscal quarter that the phase was reported as  complete, and combining the timeliness data for the averages of  investigations with the averages for adjudications by agency. The second  methodology used by the Performance Accountability Council addressed  only cases that were completed in the specific period. Under this  methodology, the Performance Accountability Council calculated the  “end-to-end” timeliness, which they defined as the time for an individual  case to go through the initiation, investigation, and adjudication phases of  the process. GAO utilized this second methodology to review and analyze  the agency timeliness data that is contained in this report. The  Performance Accountability Council excludes certain cases that could  impact overall timeliness from its analysis. For example, IRTPA  establishes a timeliness objective for the fastest 90 percent of cases, which  allows agencies to exclude the slowest 10 percent of cases from the  reported averages. We interviewed knowledgeable officials about the  accuracy and completeness of the data to determine the reliability of the  data. We determined that these data were sufficiently reliable for our  purposes.
To assess the extent to which executive branch agencies honor previously  granted security clearances and the challenges, if any, that exist related to  reciprocity, we reviewed the requirements specified in IRTPA and  analyzed Executive Orders, Office of Management and Budget (OMB)  memorandums, ODNI documents, and agency guidance related to  reciprocity. We also analyzed existing and planned metrics developed by  the Performance Accountability Council to track the extent to which  reciprocity is honored. We met with security officials and adjudicators  from DOD, the Intelligence Community, and a non-probability sample of  executive branch agencies. We supplemented our analyses with  information obtained from a roundtable discussion that we conducted  with representatives of Intelligence Community agencies to examine the  challenges these agencies face related to information sharing and granting  reciprocity. For the purposes of our report, we define reciprocity as an  agency’s acceptance of a background investigation or clearance  determination completed by another authorized investigative or  adjudicative agency. We excluded from the scope of our work issues  related to access to facilities, detailed employees, or access to classified  information.
To determine the extent to which select executive branch agencies share  personnel clearance information in a single, integrated database, we  conducted interviews with officials from OPM, DOD, and Intelligence  Community agencies and reviewed OPM database enhancement plans that  described recent developments in information sharing.  We selected OPM,  DOD, and agencies within the Intelligence Community because they own  the three main security clearance databases that are used in the security  clearance process. To determine the challenges associated with sharing  clearance information in a single, integrated database, we reviewed the  Joint Reform Team’s Enterprise Information Technology Strategy and  interviewed agency security managers and adjudicators who use the  existing security clearance database systems.
We conducted this performance audit from October 2009 through  November 2010 in accordance with generally accepted government  auditing standards.  Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives.  We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our objectives.  More detailed  information on our scope and methodology is provided in appendix I.
subsections: section_title: Background
paragraphs: Personnel security clearances are required for access to certain national  security information, which may be classified at one of three levels:  confidential, secret, or top secret. A top secret clearance is generally also  required for access to Sensitive Compartmented Information or Special  Access Programs. The level of classification denotes the degree of  protection required for information and the amount of damage that  unauthorized disclosure could reasonably be expected to cause to national  security. Unauthorized disclosure could reasonably be expected to cause  (1) “damage,” in the case of confidential information; (2) “serious  damage,” in the case of secret information; and (3) “exceptionally grave  damage,” in the case of top secret information. To ensure the  trustworthiness and reliability of personnel in positions with access to  classified information, government agencies rely on a multiphased  personnel security clearance process that includes the application  submission phase, investigation phase, and adjudication phase.
The application submission phase. A security officer from an agency  (1) requests an investigation of an individual requiring a clearance; (2)  forwards a personnel security questionnaire (standard form 86) using  OPM’s e-QIP system or a paper copy of the standard form 86 to the  individual to complete; (3) reviews the completed questionnaire; and (4)  sends the questionnaire and supporting documentation, such as  fingerprints, to OPM or the investigation service provider.
The investigation phase. Federal investigative standards and OPM’s  internal guidance are used to conduct and document the investigation of  the applicant. The scope of information gathered in an investigation  depends on the level of clearance needed and whether an investigation for  an initial clearance or reinvestigation for a clearance renewal is being  conducted. For example, the federal standards require that investigators  collect information from national agencies, such as the Federal Bureau of  Investigation, for all initial and renewal clearances. For an investigation  for a confidential or secret clearance, investigators gather much of the  information electronically. For an investigation for a top secret clearance,  investigators gather additional information through more time-consuming  efforts, such as traveling to conduct in-person interviews to corroborate  information about an applicant’s employment and education. After the  investigation is complete, the resulting investigative report is provided to  the agency. According to the Performance Accountability Council’s  Strategic Framework, for the purposes of IRTPA timeliness reporting,  investigative time is the time in days from the receipt date of the  completed personnel security package by the investigative service  provider to the date the final investigative file is forwarded to the  adjudicative facility if sent electronically.
The adjudication phase. Adjudicators from an agency use the  information from the investigative report to determine whether an  applicant is eligible for a security clearance. To make clearance eligibility  decisions, federal requirements specify that adjudicators consider  guidelines in 13 specific areas that elicit information about (1) conduct  that could raise security concerns and (2) factors that could allay those  security concerns and permit granting a clearance. According to the  Performance Accountability Council’s Strategic Framework, for the  purposes of IRTPA timeliness reporting, adjudicative time is the time in  days from the date the final investigative file is forwarded (or received  electronically) to the adjudicative unit to the date of the adjudicative  decision.
Separate from, but related to, security clearances, are suitability  determinations. Executive branch agencies conduct additional suitability  investigations for individuals to ensure that they are suitable for  employment in certain positions. For example, the Department of Justice  conducts additional suitability checks to ensure applicants for jobs with  the Drug Enforcement Agency have not used drugs. In addition, Health  and Human Services conducts additional suitability investigations on  applicants for jobs working with children. Similarly, the Intelligence  Community requires a polygraph evaluation, among other things, to  determine suitability for most positions.
In light of long-standing delays and backlogs in processing security  clearances, Congress set goals and established requirements for improving  the clearance process in the Intelligence Reform and Terrorism Prevention  Act of 2004. In 2005, GAO designated DOD’s personnel security clearance  program as a high risk area. As can be seen in figure 1, a number of steps  have been taken to reform the process, including:   Role of the Office of Management and Budget in security clearance  process. In June 2005, the President issued an executive order as part of  the administration’s efforts to improve the security clearance process and  implement the statutory clearance requirements in IRTPA. This order  tasked the Director of OMB with a variety of functions in order to ensure  that agency processes relating to determining eligibility for access to  classified national security information were appropriately uniform,  centralized, efficient, effective, timely, and reciprocal. These actions  included taking a lead role in preparing a November 2005 plan to improve  the timeliness of personnel security clearance processes governmentwide.
Formation of the Joint Reform Team. The Joint Security Process  Reform Team, also known as the Joint Security and Suitability Reform  Team or Joint Reform Team, formed in June 2007, was established by the  Director of National Intelligence and Under Secretary of Defense for  Intelligence through a memorandum of agreement to execute joint reform  efforts to achieve IRTPA timeliness goals and improve the processes  related to granting security clearances and determining suitability for  government employment. Agencies included in this governmentwide  reform effort are ODNI, DOD, OMB, and OPM. The Joint Reform Team  continues to work on the reform effort under the Performance  Accountability Council by providing progress reports, recommending  research priorities, and overseeing the development and implementation  of an information technology strategy, among other things. Since its  formation, the Joint Reform Team under the Performance Accountability  Council:  (1) Submitted an initial reform plan to the President on April 30, 2008. The  plan proposed a new process for determining clearance eligibility that  departs from the current system in a number of ways, including the use of  a more sophisticated electronic application, a more flexible investigation  process, and the establishment of ongoing evaluation procedures between  formal clearance investigations. The report was updated in December 2008  to include an outline of reform progress and further plans.  (2) Issued an Enterprise Information Technology Strategy to support the  reformed security and suitability process in March 2009. According to the  report, the Joint Reform Team is pursuing an approach that leverages  existing systems and capabilities, where applicable, and developing new  tools where necessary.
Formation of the Performance Accountability Council. Executive  Order 13467 established the leadership structure for security and  suitability reform headed by the Suitability and Security Clearance  Performance Accountability Council as the entity responsible for aligning  security and suitability, holding agencies accountable for implementation,  and overseeing progress toward the reformed vision. This executive  order directed, among other things, that executive branch policies and  procedures be aligned and use consistent standards, to the extent  possible, for investigating and adjudicating whether an individual is (1)  suitable for government employment, (2) fit to be a contract employee, or  (3) eligible for access to classified information. The Performance  Accountability Council is accountable to the President to achieve reform  goals and also oversees newly designated Security and Suitability  Executive Agents. The executive order designated the Director of National  Intelligence as the Security Executive Agent, the Director of OPM as the  Suitability Executive Agent, and the Deputy Director for Management at  OMB as the chair of the council with the authority to designate officials  from additional agencies to serve as members. The council currently  comprises representatives from 11 executive agencies. In May 2010, the  Performance Accountability Council proposed quality measures to address  the different phases of the application process including validating need, e- application, investigation, and adjudication. The measures also include the  responsible organization, population covered, collection method, and  whether it is a current or future measure.
Strategic Framework. The Performance Accountability Council issued a  Strategic Framework in February 2010 to articulate the goals of the  security and suitability process reform. The Strategic Framework sets  forth a mission and strategic goals, performance measures, a  communications strategy, roles and responsibilities, and metrics to  measure the quality of security clearance investigations and adjudications.
section_title: Significant Overall Progress Has Been Made to Improve Timeliness, but Some Executive Agencies Continue to Face Challenges in Meeting Timeliness Objectives
subsections: section_title: Timeliness Varies Across Agencies
paragraphs: The government has reported that significant overall progress has been  made to improve the investigation and adjudication of personnel security  clearance applications in a timely manner. This is largely attributable to  DOD, whose clearances comprise a vast majority of governmentwide  initial clearances. IRTPA required the executive branch to develop a plan  under which, to the extent practical, each authorized adjudicative agency  would be required to make a determination on at least 90 percent of initial  security clearances within an average of 60 days by December 17, 2009.  Within this 60-day period, IRTPA also includes periods of 40 days for  investigations and 20 days for adjudications. As can be seen in figure 2,  according to the Performance Accountability Council’s February 2010  annual report to Congress, during the first quarter of fiscal year 2010, two  agencies—the National Geospatial-Intelligence Agency and the National  Reconnaissance Office—met the timeliness requirement for investigations,  seven agencies—the Departments of Defense, Energy, Health and Human  Services, the Defense Intelligence Agency, the National Security Agency,  the Federal Bureau of Investigation, and the Department of State—met the  timeliness objectives for adjudications, and five agencies—the Department  of Defense, Department of Energy, the National Geospatial-Intelligence  Agency, the National Reconnaissance Office, and the Department of  State—met the 60-day IRTPA timeliness objective. Furthermore, we  found that one of the agencies included in our review—the National  Geospatial-Intelligence Agency—met all of the IRTPA timeliness  objectives for the second and third quarter, while the Defense Intelligence  Agency met all of the IRTPA timeliness objectives in the second quarter  and DOD, which comprises the vast majority of clearances, and the  Federal Bureau of Investigation, met all of the IRTPA timeliness objectives  in the third quarter of fiscal year 2010.
We also found that timeliness varied widely among executive branch  agencies. During the first three quarters of fiscal year 2010, the average for  the fastest 90 percent of cases adjudicated by the 14 agencies included in  our review ranged from 22 to 96 days for investigation timeliness, 2 to 59  days for adjudication timeliness, and 30 to 154 days for IRTPA timeliness.  Agency officials that we spoke with largely attributed the wide variation  between these agencies to variances in the adoption of information  technology. According to OPM officials, timeliness varies for the agencies  that use OPM as the investigative service provider due, in part, to  differences in agency adoption of information technology, such as the e- QIP that speeds up investigation timeliness by providing OPM with more  complete and better quality data earlier in the process. With regard to  adjudication timeliness, five of the agencies we included in our review  have developed electronic delivery, electronic adjudication, or case  management and workflow tools to improve timeliness, while others have  not.
section_title: Agencies Have Made Efforts to Improve Timeliness for Processing Security Clearances
paragraphs: The requirements established by IRTPA have resulted in a  governmentwide focus on improving the timeliness of initial security  clearances through the Performance Accountability Council. In addition,  several of the agency officials with whom we spoke reported that their  agencies prioritize timeliness for security clearances. For example, several  agency officials noted that the passage of IRTPA was an important factor  leading to continued senior level leadership commitment, involvement,  and oversight over timeliness reform through the Performance  Accountability Council. Moreover, IRTPA’s annual reporting requirements  have provided more information about agency timeliness to Congress,  allowing for more oversight and increasing transparency and  accountability. However, IRTPA does not set timeliness requirements for  suitability determinations, Homeland Security Presidential Directive-12  investigations, and security clearance renewals. According to agency  officials we spoke to, their agencies often prioritize initial security  clearances for processing.
Governmentwide efforts to improve the timeliness of personnel security  clearance processing have focused on technology solutions. For example,  the Joint Reform Team and the Performance Accountability Council have  encouraged agencies to utilize information technology solutions, such as  e-QIP, electronic delivery, and electronic adjudication capabilities to  enhance automation. E-QIP facilitates more complete collection of a  subject’s information upfront in the process and reduces errors, which  lowers, on average, the time it takes for investigators to clarify the  information provided. Electronic delivery reduces the adjudicative phase  by eliminating delays in receiving investigative reports related to mail and  courier services, such as the need at certain agencies to irradiate all  incoming mail. Electronic adjudication systems use automation to review  investigative reports for missing information and adjudicate the cases,  under certain conditions, within seconds.  Agency officials indicated that  as agencies have adopted these capabilities, timeliness improved. In  addition, OPM, which performs approximately 94 percent of initial  clearance investigations for the federal government, has also taken steps  to improve timeliness. For example, according to OPM officials, OPM also  made information technology enhancements to improve its processes,  such as enabling electronic delivery.
Aside from these governmentwide efforts, some agency officials stated  that their agencies have taken steps to improve adjudication timeliness.   DOD, for example, developed and implemented an electronic case  management system—the Clearance Adjudication Tracking System— within several of its Central Adjudication Facilities. In 2009, the Army  began electronically adjudicating secret clearances through the Clearance  Adjudication Tracking System, which was a significant factor in improving  the Army’s adjudicative average timeliness. For example, according to the  Performance Accountability Council’s Strategic Framework, the average  of the fastest 90 percent of initial clearance adjudications for the Army fell  from 187 days in the second quarter of fiscal year 2009 to 10 days in the  first quarter of fiscal year 2010. The Department of Energy also took steps  to enhance timeliness. For example, in addition to utilizing electronic  delivery and e-QIP, the Department of Energy developed corrective action  plans, implemented case prioritization procedures, and created a tiered  adjudication structure to clear easier cases quickly while utilizing a  complex case review board to address complex cases in a timely manner.  In addition, the Department of Energy built timeliness performance into  adjudicator evaluations, reduced the number of people involved with  deciding cases, and increased manpower to meet workload requirements.
section_title: Agencies Continue to Face Several Challenges to Meeting Timeliness Objectives
paragraphs: Despite the actions that have been taken to improve timeliness, agency  officials with whom we spoke identified several remaining challenges to  meeting IRTPA’s timeliness objectives. These challenges include agency- specific issues, such as resource constraints and manpower limitations.   For example:    Resource constraints are a limiting factor for several agencies in  implementing certain information technology capabilities, such as  electronic delivery, case management, and workflow tools. For example,  Defense Intelligence Agency officials indicated that they are constrained in  implementing a key information technology that provides electronic  delivery, case management, and workflow tool capabilities. Furthermore,  some agencies, especially those with relatively small clearance caseloads,  find it difficult to justify large investments to develop and implement  information technology systems.
Personnel limitations, such as personnel shortages or increased  workloads, were also identified by several agency officials as an ongoing  challenge. Some agency officials stated that their agencies already have or  expect to experience personnel shortages. For example, officials from the  Department of Homeland Security stated that a lack of resources is the  primary issue for not meeting the timeliness objectives, but the  Department of Homeland Security headquarters is currently backfilling 10  vacant adjudicator positions, which should help to alleviate the problem.   In addition, some agency officials stated that their agency staff is subject  to workload increases, such as periods of increased agency hiring, spikes  in security clearance renewal cases, or additional duties related to  corollary requirements. For example, in 2008, Homeland Security  Presidential Directive-12 directed the implementation of a common  governmentwide identification standard for federal employees and  contractors, under which federal agencies have been required to begin  issuing common identification and access badges for all individuals,  including contractors, who need access to government facilities or  computer networks. These badge requirements, while different from those  required for security clearances, expanded the pool of staff needing  investigations and adjudicative determinations. These issues are  particularly challenging in places where staff already perform clearance  processes as a collateral duty.
We found other challenges to meeting timeliness objectives that were the  result of systemic issues involving interagency and intergovernmental  activities. Agencies are often unable to control certain processes in order  to meet timeliness objectives when they are dependent on information or  action from other governmental entities. For example:    Information-sharing between agencies is an ongoing challenge that can  manifest itself in several ways. First, investigative agencies are not in  direct control of the timeliness and completeness of Federal Bureau of  Investigation, state, and local law enforcement fingerprint and criminal  investigation checks. For example, the results of Federal Bureau of  Investigation criminal investigation checks often are returned with a  classification listed as “No Pertinent,” which indicates that there is no  pertinent information relevant to making a clearance eligibility  determination. Some agency officials with whom we spoke indicated that  this type of response leaves adjudicators with incomplete information due  to the potential that the designation is either the result of a subjective  judgment from an outside party as to what they believe is relevant  information or a placeholder to indicate that more information is  potentially available, but pending or not releasable. Second, officials said  the lack of digitization of records at certain federal, state, and local  agencies can be a challenge to gathering information for timely completion  of investigations and adjudicative decisions. When personnel files, for  example, are not stored, catalogued, and made searchable through  electronic means, agencies are limited by manual checks.  Finally, delays  and incomplete information may occur in obtaining information from  intelligence agencies. For example, some agency officials with whom we  spoke stated that since they do not have direct access to clearance-related  information and databases for agencies in the Intelligence Community,  they rely upon manual requests for information.
Investigation services quality and cost is an ongoing challenge to  meeting timeliness objectives, according to agencies officials. For  example, officials representing the Departments of Homeland Security,  Energy, the Treasury, Justice, and four DOD component agencies that  utilize OPM as their investigative service provider cited challenges related  to deficient investigative reports as a factor that slows agencies’ abilities  to make adjudicative decisions. The quality and completeness of  investigative reports directly affects adjudicator workloads, including  whether additional steps are required before adjudications can be made,  as well as agency costs. For example, some agency officials we spoke with  noted that OPM investigative reports do not include complete copies of  associated police reports and criminal record checks. According to ODNI  and OPM officials, OPM investigators provide a summary of police and  criminal reports and assert that there is no policy requiring inclusion of  copies of the original records. However, ODNI officials also stated that  adjudicators may want or need entire records as critical elements may be  left out. For example, according to Defense Office of Hearings and  Appeals officials, in one case, an investigator’s summary of a police report  incorrectly identified the subject as a thief when the subject was actually  the victim. If the Defense Office of Hearings and Appeals had access to  actual police documents, officials believe the adjudication process would  be more efficient. We noted in our prior work that documentation was  incomplete for most OPM-provided investigative reports based on  independent review of about 3,500 investigative reports. We also noted in  our previous work that incomplete investigative documentation may lead  to increases in the time it takes to complete the clearance process and the  overall costs of the process. Several agency officials stated that in order  to avoid further costs or delays they often choose to perform additional  steps internally to obtain missing information, clarify or explain issues  identified in investigative reports, or gather evidence for issue resolution  or mitigation.
Finally, a significant challenge to meeting timeliness objectives specific to  Intelligence Community agencies involve addressing the requirements that  are unique to these agencies. For example, since most positions in  Intelligence Community agencies require top secret clearances with  Sensitive Compartmented Information access, intelligence agencies rely  almost exclusively on Single Scope Background Investigations that are  required for these types of clearances. These investigations have higher  requirements for the types and numbers of sources of information required  compared to investigations for secret or confidential clearances.  According to agency officials, these higher requirements take longer, on  average, to investigate and adjudicate. In addition, timeliness for  intelligence agencies is often complicated by the unique issues presented  by extensive suitability determination processes and precise conditions of  employment that may include medical exams, psychological evaluations,  drug testing, and polygraph exams. Polygraph exams, for example, may  generate additional leads that require further investigative work.  Moreover, agency officials also stated that scheduling a polygraph with an  individual, especially if they live far from agency offices, may add months  to investigation timelines.
section_title: Performance Accountability Council Has Not Reported on Impediments to Meeting Timeliness Objectives or Plans to Address Impediments
paragraphs: While the Performance Accountability Council, responsible for driving  implementation of the reform effort and ensuring accountability, has taken  steps to assist in implementation of reform efforts, it has not reported on  the impediments to meeting timeliness objectives or plans to address  impediments.  IRTPA’s security clearance reform provision requires  annual reports to the appropriate congressional committees—through  2011—on the progress made during the preceding year toward meeting its  requirements, including timeliness data and a discussion of any  impediments to the smooth and timely functioning of its requirements.   However, in its most recent report to Congress, the Performance  Accountability Council did not provide information on the impediments  agencies face in meeting timeliness objectives or plans to address  impediments. While the Office of the Director of National Intelligence, in  its capacity as Security Executive Agent, has performed a limited number  of oversight audits, according to officials at four agencies we met with, the  Performance Accountability Council has not met with them to identify the  impediments to meeting the timeliness objectives.  The Performance  Accountability Council has focused its efforts on DOD in part due to  DOD’s security clearance program’s designation as one of GAO’s high-risk  areas, as well as the fact that DOD clearances comprise the overwhelming  majority of initial clearance cases that are processed annually.  We found  that due to the relative size of DOD’s clearance program, DOD’s progress  towards meeting IRTPA’s timeliness objectives is a significant factor in  reducing the average time required for initial security clearance processing  for the government as a whole.  Furthermore, Performance Accountability  Council officials stated that they will begin conducting one-on-one  meetings with individual agencies in September 2010 to enhance  communication, assist in implementation planning, and provide a  feedback mechanism for agency stakeholders to communicate information  and needs to the Joint Reform Team.
The Performance Accountability Council is in a position to identify certain  trends and commonalities, such as those challenges related to resource  constraints, manpower limitations, information-sharing, investigation  services quality and cost, and Intelligence Community specific issues.   However, absent complete reporting on the impediments on meeting  timeliness objectives, Congress may not have visibility over agency  compliance and decision makers may not have a complete picture of the  progress made or the impediments to meeting timeliness objectives.  This  potential lack of agency transparency and accountability may impact  continued efforts to improve timeliness and prevent scrutiny over agencies  that are not meeting timeliness objectives.
section_title: Executive Agencies Often Grant Reciprocity, Although Challenges Exist to Measuring and Tracking Reciprocity
subsections: section_title: Executive Agency Officials Reported That They Routinely Honor Another Agency’s Security Clearance, but Additional Steps May Be Taken before Granting Reciprocity
paragraphs: Officials representing executive branch agencies, including those within  the Intelligence Community, stated that they routinely grant reciprocity  (i.e., accept a background investigation or clearance determination  completed by another authorized investigative or adjudicative agency).   IRTPA generally requires that all security clearance investigations and  determinations be accepted by all agencies, with limited exceptions when  necessary for national security purposes. We have reported in the past  that, according to the government’s plan for addressing problems in the  personnel security clearance process, security clearances are not fully  accepted governmentwide. A recent congressional committee report also  suggests that even among the elements of the Intelligence Community,  there are impediments and sometimes lengthy delays in granting  clearances to employees detailed from one agency to another. However,  in October 2008, the ODNI issued guidance on the reciprocity of personnel  security clearances. The guidance requires, except in limited  circumstances, that all Intelligence Community elements “accept all in- scope security clearance or access determinations.” Further, OMB  guidance requires agencies to honor a clearance when: (1) the prior  clearance was not granted on an interim or temporary basis, (2) the prior  clearance investigation is current and in-scope, (3) there is no new  derogatory information, and (4) there are no conditions, deviations,  waivers, or unsatisfied additional requirements (such as polygraphs) if the  individual is being considered for access to highly sensitive programs.  Moreover, officials representing two agencies in our review noted that it is  in their best interest to accept a prior clearance because reciprocity saves  time, money, or manpower.
Although officials agreed that they routinely honor another agency’s  security clearance, we found that some agencies find it necessary to take  additional steps to address limitations with available information. Officials  representing 18 of the 21 organizations we met with to discuss reciprocity  reported that they must address limitations, such as insufficient  information in the databases or variances in the scope of investigations,  before granting reciprocity. For example:    Insufficient information. Although there is no single, integrated  database, security clearance information is shared between OPM, DOD,  and, to some extent, Intelligence Community databases. OPM has taken  steps to ensure certain clearance data necessary for reciprocity is  available to adjudicators. For example, in April 2010, OPM held an  interagency meeting to determine new data fields to include in their  shared database to more fully support reciprocity. However, we found that  the shared information available to adjudicators contains summary-level  detail that may not be complete. As a result, agencies may take steps to  obtain additional information, which creates challenges to immediately  granting reciprocity. For example, to accept a clearance granted by an  intelligence agency, a non-intelligence agency must access information  from the intelligence agencies’ Scattered Castles database. However,  according to officials representing the Department of the Treasury, the  Department of Justice, and the Joint Chiefs of Staff, the Scattered Castles  database does not always provide enough detail to immediately grant  reciprocity. According to these officials, the Scattered Castles summary  screen is not detailed enough or does not include key information, such as  the steps taken to mitigate negative issues. As a result, additional  information, such as copies of the original background investigation, must  be sought directly from intelligence agencies to verify and provide  supporting detail to the information available in Scattered Castles.  Similarly, to accept a clearance granted by a non-intelligence agency, an  intelligence agency must access information from non-intelligence agency  databases. Officials representing Intelligence Community agencies with  whom we spoke noted, for example, that they must contact DOD to  determine if an actual clearance was granted and verify the current status  of the applicant because such detail is not available in DOD’s Joint  Personnel Adjudication System. Similarly, officials representing the  Department of Justice told us that while OPM’s Central Verification  System shows the existence of conditions, deviations, and waivers,  Department of Justice officials follow up as appropriate with the agency  that granted the clearance.
Variances in the scope of investigations. We found that the scope of  background investigations varies by level of clearance, which may lead to  duplicative work. For example, a person with a secret-level clearance may  have had one of several types of background investigations and the scope  of the background investigation may vary depending on the type of  clearance sought. Further, officials from two agencies we spoke with told  us that they typically require a certain type of background investigation  and when a subject’s clearance is based on a different type of  investigation, they may take additional steps to fill in the missing gaps to  ensure the scope is consistent with their expectations. Officials  representing other agencies included in our review told us that when the  subject’s existing background investigation is different from the required  investigation type, the agency will request a new background investigation.   For example, officials at one agency stated that positions of public trust  sometimes have higher suitability information requirements than  information available from confidential/secret background investigations.  Similarly, officials at another agency stated that because there are two  types of investigations for secret/confidential clearances based on whether  the person is military or contractor or government civilian, the agency may  not be able to accept an investigation if it is the wrong one for that  particular position. When an entirely new investigation is performed, we  found that the current system may lead to duplicative work, limiting  reciprocity. In a 2008 report to the President, the Joint Reform Team,  under the Performance Accountability Council, proposed revised  investigative standards to, among other things, reduce the types of initial  investigations from 15 to 3. While originally planned for release in  December 2010, the Performance Accountability Council extended plans  to issue a new version of the revised Federal Investigative Standards to  calendar year 2011.
In addition to addressing limitations with available information, agency  officials identified broader challenges to granting reciprocity. Officials  representing 14 of the 21 agencies included in our review of reciprocity  reported that challenges, such as the need to conduct suitability  determinations or determine whether a prior clearance investigation and  adjudication meets their quality expectations, must be addressed before  granting reciprocity. For example:    Conducting suitability determinations. All federal agencies may be  required to conduct basic suitability determinations to ensure the  applicant’s character or conduct is appropriate for the position in  question, but some agencies take additional actions to determine  suitability before they reciprocate a security clearance. For example, the  Department of Justice must take steps to ensure that applicants for jobs  with the Drug Enforcement Administration have not used drugs, according  to agency officials. Similarly, the Intelligence Community requires a  polygraph evaluation, among other things, to determine suitability for  most positions, according to intelligence officials. We also found that  agencies have varying standards for determining suitability of applicants  before reciprocating a security clearance. For example, Department of  Health and Human Services officials said they will not accept a prior  security clearance until it makes a favorable determination of suitability.
Similarly, the Department of Justice will only accept another agency’s  clearance and hire the applicant on a probationary period pending a  favorable suitability determination. As a result of the variances in  determining suitability, OPM, as the Suitability Executive Agent for all  executive agencies, and the Joint Reform Team have issued guidance in  line with Executive Order 13488, which mandates, to the extent  practicable and with certain exceptions, reciprocal recognition of prior  favorable suitability determinations. For example, OPM issued a  memorandum for the Heads of Executive Departments and Agencies that  explains how to implement the Executive Order.
Determining whether a prior clearance investigation and  adjudication meets standards. Most agency officials we spoke with  stated that since there is no governmentwide standardized training and  certification process for investigators and adjudicators, a subject’s prior  clearance investigation and adjudication may not meet the standards of  the inquiring agency. Although OPM has developed some training, security  clearance investigators and adjudicators are not required to complete a  certain type or number of classes. As a result, the extent to which  investigators and adjudicators receive training varies by agency. For  example, according to ODNI officials, all DOD adjudicators working at  DOD Central Adjudication Facilities must take a basic 2-week adjudicator  course and subsequently the 1-week advanced course after some time on  the job. However, according to officials we spoke with, the Air Force has  an additional requirement for adjudicators to attend a 3-week training  course while the Defense Industrial Security Clearance Office relies on on- the-job training.  Other agencies have different requirements. For example,  the Department of Energy relies on a mandatory annual security refresher.   Consequently, as we have previously reported, agencies are reluctant to be  accountable for investigations and/or adjudications conducted by other  agencies or organizations. To achieve fuller reciprocity, clearance- granting agencies seek to have confidence in the quality of prior  investigations and adjudications. The annual reports to Congress indicate  that the Performance Accountability Council is taking steps to make  investigations and adjudications more consistent across the government  by standardizing the training of investigators and adjudicators. For  example, the reports describe the development of core courses, as well as  a formalized certification for investigators and adjudicators. According to  senior leaders of the reform effort, these steps will facilitate reciprocal  acceptance of clearance decisions governmentwide.
section_title: In the Absence of Consistent Metrics and Reporting Requirements, the Extent to Which Reciprocity Is Granted Is Unknown
paragraphs: Although agency officials have stated that reciprocity is regularly granted,  agencies do not have complete records on the extent to which previously  granted security clearance investigations and adjudications are honored  governmentwide. While the Performance Accountability Council has  identified reciprocity as a governmentwide strategic goal, we found that  agencies do not consistently and comprehensively track when reciprocity  is granted, and lack a standard metric for tracking reciprocity.  For  example, Department of Justice and Department of Energy officials said  they track both when reciprocity is granted and reasons for denying a  previously granted security clearance, while Navy and Department of the  Treasury officials said they only document when reciprocity is granted and  not when reciprocity is denied. The Navy checks a box in its electronic  database, and the Department of Energy and the Department of the  Treasury manually track when reciprocity is honored. In contrast, the  Army and Air Force do not track reciprocity at all, according to agency  officials. Moreover, it is unclear the extent to which agencies that do track  reciprocity are reporting the data to oversight agencies, such as ODNI, or  sharing information on reciprocity with each other.
OPM and the Performance Accountability Council have developed quality  metrics for reciprocity, but the metrics do not measure the extent to which  reciprocity is being granted. We previously reported that developing  metrics for assessing and regularly monitoring all aspects of the clearance  process could add value in current and future reform efforts as well as  supply better information for greater congressional oversight. While the  existing metrics are a positive step, more is needed to comprehensively  capture the extent to which reciprocity is being granted. For example,  OPM created a metric in early 2009 to track reciprocity, but this metric  measures limited information. OPM’s metric measures the number of  investigations requested from OPM that are rejected based on the  existence of a previous investigation and does not track the number of  cases in which reciprocity was or was not successfully honored. The  Performance Accountability Council developed quality metrics, including  metrics to track reciprocity, in response to a March 2010 congressional  inquiry. For example, the Performance Accountability Council proposes as  a metric the average percentage of cases for which prior database checks  are conducted as reported by executive branch agencies. However, this  metric does not account for agencies that checked other databases and  relies on agency self-reporting rather than a systematic method of data  collection. Although the metric helps to create an overall picture of  reciprocity, it does not track which cases were and were not reciprocated.   Similarly, the other metrics included in the Performance Accountability  Council’s proposal, such as the number of duplicate requests for  investigations, percentage of applications submitted electronically,  number of electronic applications submitted by applicant but rejected by  OPM as unacceptable due to missing information or forms, and percentage  of fingerprint submissions determined to be “unclassifiable” by the Federal  Bureau of Investigation, provide useful information, but do not track the  extent to which reciprocity is or is not ultimately honored.
section_title: Although There Are No Plans to Develop a Single, Integrated Database, Steps Have Been Taken to Upgrade Existing Systems and Increase Information Sharing
subsections: section_title: The Executive Branch Has Opted to Leverage Existing Systems in Lieu of a Single, Integrated Database
paragraphs: Tasked with establishing a single, integrated database, the executive  branch has opted to focus on leveraging existing systems rather than  establish a new database. IRTPA required that not later than 12 months  after the date of enactment of the act, the Director of the Office of  Personnel Management and the Director of the Office of Management and  Budget establish and commence operating and maintaining a single,  integrated database of security clearance information. This database was  to house information regarding the granting, denial, or revocation of  security clearances or access pertaining to military, civilian, and  contractor personnel, from all authorized investigative and adjudicative  agencies. Information from this database would be used to validate  whether a person has or had a clearance, potentially including such  information as the type of investigation that was conducted and the date of  the investigation, thereby assisting responsible officials in determining  whether a new investigation is required. However, the Performance  Accountability Council is not pursuing a single, integrated database  according to our analysis of a series of recent reports that the Joint  Reform Team, under the Performance Accountability Council, issued  between 2008 and 2010. For example, according to the Enterprise  Information Technology Strategy, the Performance Accountability Council  has opted to pursue an approach that leverages existing systems and  involves the development of new tools when necessary. According to the  Strategic Framework, which was included with the most recent annual  report to Congress, the reform efforts are focused on leveraging OPM’s  existing system—the Central Verification System—to enable access to  records on investigations and adjudications. Agency officials from both  OPM and ODNI confirmed that there are no plans to create a new single,  integrated database. Instead, the focus will be on using a single search  capability of existing databases as the means by which they intend to  address the IRTPA requirement. According to an OPM official with whom  we spoke, a single database would not provide any additional functionality  over the single-search capability that they are pursuing.
OPM, DOD, and ODNI officials with whom we spoke explained that  establishing, operating, and maintaining a single, integrated database is  not a viable option due to concerns related to privacy, security, and data  ownership. First, DOD and OPM mentioned privacy concerns, which  involve the unintentional disclosure of personal identifying information,  such as name and Social Security number. Second, merging the different  systems into one database raises security concerns. For example,  according to an ODNI official, since the Intelligence Community’s  database is classified and separate from the databases used by non- intelligence agencies, even an aggregation of unclassified information from  its database could lead to unintentional disclosure of personal identifying  information that could compromise security. Moreover, breaches in the  system could also compromise security. For example, some officials  mentioned an enhanced threat from hackers if there were consolidation of  multiple information technology systems. Finally, according to DOD  officials, there are issues related to data ownership and the copying and  transferring of information between systems that are owned by different  agencies. For example, according to OPM officials, OPM can not provide  information from investigations it did not conduct to another agency.  When investigations are conducted by agencies with delegated authority,  the reports are owned and maintained by the investigating agency.  Requests for these investigative records must be referred to the owning  agency.
section_title: Information from Two Primary Databases Can Be Accessed from a Single Entry Point
paragraphs: Although there are no plans to create a new governmentwide database,  non-intelligence agencies in our review are sharing information about  personnel who hold or are seeking security clearances through two main  databases that can be accessed through a single entry point. Two primary  databases are used by non-intelligence agencies to store investigative and  adjudicative information and according to the Performance Accountability  Council, they account for decisions on about 90 percent of all security  clearance holders in the federal government. Data are stored in either  OPM’s Central Verification System or DOD’s Joint Personnel Adjudication  System. The Central Verification System includes security clearance data  for all non-Intelligence Community, non-DOD executive branch agencies.  The Joint Personnel Adjudication System is a repository for security  clearance information on both DOD civilian and military personnel, as well  as determinations of contractor clearance eligibility and access for the  National Industrial Security Program. Data from the two databases can be  searched and obtained from a single entry point in the Central Verification  System.
The Central Verification System was upgraded in spring 2010 and now  provides access to more information than was previously accessible.   Specifically, the upgraded system provides users with a summary of  information on:    Characteristics of clearances reported to the system. This summary  includes information on active, inactive, and denied clearances, as well as  information on whether there is a condition, deviation, or waiver.
Characteristics of investigations reported to the system. This  summary includes information on pending, closed, and discontinued  investigations, as well as requests that were deemed unacceptable due to  inadequate or inaccurate information.
Suitability and fitness. This summary provides information on  adjudication decisions for suitability for federal employees and fitness for  excepted service and contract employee determinations.
Homeland Security Presidential Directive-12 Personal  Identification Verification Credentials. This summary includes  information on the status of credentials issued to the subject indicating  whether the credentials are active, suspended, revoked, administratively  withdrawn, or other.
Polygraph data. This summary includes information on the type of  polygraph conducted, including Counter-Intelligence or Expanded Scope,  but does not include results from examinations.
section_title: Intelligence Community Agencies Share Information through a Separate Database and Are Exploring Alternatives to Expand Information Sharing with Non- intelligence Agencies
paragraphs: According to ODNI officials and Intelligence Community Directive 704, the  Intelligence Community agencies share information with one another  through a separate classified database known as Scattered Castles.   Scattered Castles is a repository for records from all intelligence agencies  by which each agency uploads relevant information from individual  agency databases. All personnel who have access to Sensitive  Compartmented Information are listed in Scattered Castles. This system is  not linked to OPM’s Central Verification System due to concerns about  protecting classified information. According to ODNI officials, the system  has not been linked to non-intelligence databases due to the need to  protect information on covert personnel. However, officials representing  Intelligence Community agencies stated that they do enter some  information from the Joint Personnel Adjudication System into Scattered  Castles.
Although the Intelligence Community maintains a separate database, we  found that most of the non-intelligence agencies included in our review  had some access to Scattered Castles. For example, five non-intelligence,  non-DOD agencies included in our review had some access through a  Sensitive Compartmented Information Facility located in their agency. All  of the military departments, as well as the Joint Chiefs of Staff, also had  some access. Moreover, according to agency officials, DOD adjudicators  with the appropriate clearance and need to know will have access to a  Sensitive Compartmented Information Facility with access to Scattered  Castles when DOD collocates all of its clearance adjudication facilities at  Fort Meade in Maryland as part of the DOD base realignment and closure  process in 2011.
According to Performance Accountability Council officials, the  Performance Accountability Council is participating in an effort to explore  ways to enhance information sharing between the Intelligence Community  agencies and the non-intelligence agencies. A working group has been  established to study alternatives to support a single access point from  which to search clearance information and plans to complete its review in  December 2010.  According to an ODNI official, alternatives currently  being considered include a help desk staffed with employees from the  Intelligence Community who would have access to the Joint Personnel  Adjudication System, Central Verification System, and Scattered Castles  and could, upon request, provide the results of Scattered Castles searches  to non-Intelligence Community agencies.
section_title: Conclusions
paragraphs: Continued personnel security clearance reform relies on strong,  committed executive leadership to sustain the momentum created by the  current reform effort. This type of leadership commitment, in turn, helps  provide oversight and accountability for the improvement processes. Key  to these efforts has been the Performance Accountability Council, which  has provided direction for clearance reform across the federal  government. As a result of the Performance Accountability Council’s  actions, federal agencies have made progress in moving closer to the  objectives and requirements outlined in IRTPA. Under the Performance  Accountability Council’s leadership, timeliness data—particularly at  DOD—have improved, steps have been taken to improve information  sharing, and there has been focus on honoring reciprocity of existing  clearances. However, while agencies are moving closer to meeting the  objectives and requirements of IRTPA, continued oversight and  accountability for personnel security clearance reform is still needed.  Specifically, executive branch agencies that are currently not meeting  timeliness objectives may need help in identifying challenges and  developing plans with appropriate timelines to overcome these obstacles.  The recent activities undertaken by the Performance Accountability  Council to assist the agencies in developing plans to implement the  reformed approach is a step in the right direction. Continued reporting  required by the Intelligence Authorization Act for Fiscal Year 2010 will  also help ensure that momentum gained through the reform efforts will  continue. However, without developing more comprehensive metrics to  track reciprocity, executive branch agencies will not have a complete  picture of the degree to which reciprocity is honored.
section_title: Recommendations for Executive Action
paragraphs: To improve the overall personnel security reform efforts across the federal  government, we recommend that the Deputy Director of Management,  Office of Management and Budget, in the capacity as Chair of the  Performance Accountability Council, take the following actions:    Collaborate with the agencies that are not meeting timeliness objectives to  take the following five actions:  Identify challenges to timeliness;   Develop mitigation strategies to enable each agency to comply with  the IRTPA timeliness objectives;    Set timelines for accomplishing the required actions;    Monitor agency progress; and    Report on these plans and progress in the annual reports to Congress.
Develop comprehensive metrics to track reciprocity and then report the  findings from the expanded tracking to Congress.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of our report to OMB, ODNI, and OPM.  In response to  this draft, we received oral comments from OMB and written comments  from ODNI and OPM. All three agencies concurred with all of our  recommendations.  OMB, ODNI, DOD (through ODNI), and OPM also  provided us with technical comments, which we incorporated in this  report, as appropriate. ODNI and OPM’s written comments are reprinted in  their entirety in appendixes II and III, respectively.
In oral comments, OMB generally concurred with both of our  recommendations directed to OMB’s Deputy Director of Management in  the capacity as Chair of the Performance Accountability Council. OMB  noted the report’s thoroughness and that it highlighted the significant  progress that has been made to improve the timeliness of security  clearance determinations. In response to our recommendations, OMB  described some of the steps that the Performance Accountability Council  was taking to address the recommendations. Regarding our first  recommendation, OMB noted that the Performance Accountability  Council was committed to the timeliness and reciprocity goals of IRTPA  and that it was working with agencies currently not meeting the IRTPA  timeliness goals by taking steps to assist these agencies. Regarding our  second recommendation to develop additional performance measures to  track reciprocity, OMB stated that the Performance Accountability  Council is working to develop these additional metrics.
In written comments, ODNI and OPM both noted the significant overall  progress that has been made in the reform efforts. Specifically, ODNI  noted that DOD, with the majority of clearances, achieved timeliness goals  for adjudications for fiscal year 2010. As we noted in our report, significant  overall progress has been made, largely attributable to DOD because the  department represents a vast majority of the initial clearances.
In agreeing with and providing comments related to our  recommendations, ODNI described a number of ongoing and future  actions related to our recommendations. For example, ODNI stated that it  is working through the Joint Reform Team to assist executive agencies  that are not meeting IRTPA objectives to develop mitigation strategies and  will report these strategies to Congress in its February 2011 IRTPA Annual  Report. Similarly, ODNI stated that it will continue to work with the  Performance Accountability Council’s Performance Management and  Measures subcommittee to develop additional measures for reciprocity,  timeliness, and quality, which will also be included in its annual report to  Congress. We are encouraged to see a continued commitment by  executive leaders of the security clearance reform effort and if  implemented in accordance with our recommendations, the ODNI’s  actions appear to be a positive step in helping sustain the momentum of  security clearance reform.
In addition to agreeing with our recommendations, OPM provided four  specific comments:    First, OPM provided comments on the timeliness data provided by the  Performance Accountability Council that we used to frame agency  compliance with IRTPA timeliness objectives. Specifically, OPM stated in  its written comments that some of the Performance Accountability  Council’s timeliness data for the second and third quarters of fiscal year  2010 varies with the data that OPM collects and reports to the  Performance Accountability Council. We acknowledge that in some  instances there are discrepancies between the timeliness data provided by  OPM and the timeliness data that the Performance Accountability Council  provided to us. In some cases, OPM asserts that timeliness data for  investigations is marginally better than reported by the Performance  Accountability Council and in other instances, is marginally worse.  However, none of the discrepancies reported by OPM affects our findings  as it relates to agency compliance with IRTPA timeliness objectives for the  period reported. Agencies we note in figure 2 continue to either meet or  not meet the IRTPA timeliness goals.  As we note in our methodology, for  the purposes of this report, we ultimately selected and relied on data  provided by the Performance Accountability Council’s Subcommittee on  Performance Management and Measures. The Performance Accountability  Council is responsible for collecting and reporting agency timeliness data  to Congress and providing oversight to agencies regarding the timeliness  of personnel security clearance processes.  The data were provided by the  Performance Accountability Council in August 2010.  We conducted a  series of data reliability interviews with knowledgeable officials with the  Performance Accountability Council’s subcommittee and concluded that  the data provided were sufficiently reliable for our purposes.
Second, OPM also provided comments related to a section of our report on  investigation services quality and cost. Specifically, OPM noted in its  comments that they felt some policies are ambiguous and that there are  customer misperceptions of the sufficiency of OPM investigations.
Further, OPM noted that there is no policy requiring police and criminal  records to be included in its investigative reports. The ODNI provided a  similar technical comment and we made changes, as appropriate, to reflect  this point. However, related to OPM’s comment on agency misperception  of the sufficiency of OPM investigations, we spoke with, and note in our  report, several agencies stated challenges related to deficient investigative  reports provided by OPM. According to these agencies—including DOD,  which constitutes the vast majority of personnel security clearances in the  federal government—the deficiencies in investigative reports slows their  agencies ability to make adjudicative decisions. In fact, as we note in this  report and based on our prior work, documentation was incomplete for  most OPM-provided investigative reports based on independent review of  about 3,500 investigative reports provided to DOD.
Third, OPM suggested modifications to our discussion of quality metrics  on reciprocity. In its comments, OPM noted that some of the metrics may  have been developed prior to the Performance Accountability Council’s  response to a March 2010 congressional inquiry. We disagree with OPM’s  characterization of the accuracy of this section and its suggested  modification for two reasons: 1) the Performance Accountability Council  submitted proposed metrics to congress in May 2010 in response to the  congressional inquiry we already note. Our evidence is derived from this  letter to congress for which the Performance Accountability Council— including OPM—and GAO are signatories; and 2) OMB, in its capacity as  chair of the Performance Accountability Council, stated in its technical  comments that referring to the proposed metrics as originating from the  Performance Accountability Council was appropriate.
Finally, OPM noted in its comments pertaining to data ownership, that  OPM can not provide information from investigations it did not conduct to  another agency it did not own. Instead, OPM noted that requests for these  investigative records must be referred to the owning agency. As a result,  we incorporated changes based on this comment as appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 12 days from the  report date. We will then send copies of this report to the Senate  Appropriations Committee, Senate Committee on Homeland Security and  Governmental Affairs, Senate Select Committee on Intelligence, Senate  Armed Services Committee, House Appropriations Committee, House  Oversight and Government Reform Committee, and House Armed Services  Committee and to members of the Performance Accountability Council,  including the Director of the Office of Management and Budget, Office of  the Director of National Intelligence, Secretary of the Department of  Defense, and the Director of the Office of Personnel Management. In  addition, the report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: In conducting our review of the ongoing efforts to reform the personnel  security clearance process, the scope of work included the Office of  Personnel Management (OPM), the Department of Defense (DOD), and the  Office of the Director of National Intelligence (ODNI) as members of the  Performance Accountability Council. Our review included select members  of the Intelligence Community, including the Under Secretary of Defense  for Intelligence, the Central Intelligence Agency, Defense Intelligence  Agency, Federal Bureau of Investigation, National Geospatial-Intelligence  Agency, National Reconnaissance Office, National Security Agency, and  the Department of State. Our review also included six additional executive  branch agencies, including the Departments of Energy, Health and Human  Services, Homeland Security, Justice, the Treasury, and Veterans Affairs.  These agencies were selected based on the volume of initial personnel  security clearances they process per year for civilians, military, and  industrial personnel, and their use of OPM to conduct background  investigations.
subsections: section_title: Methodology
paragraphs: To assess the overall personnel security clearance reform efforts, as well  as each of our objectives, we obtained relevant documentation and  interviewed key federal officials from the following organizations:    Office of Personnel Management;    The Department of Defense;    The Office of the Under Secretary of Defense for Intelligence,    Department of the Army, Central Clearance Facility,    Department of the Navy Central Adjudication Facility,    Department of the Air Force Central Adjudication Facility,    Defense Industrial Security Clearance Office Central Adjudication Facility,    Defense Office of Hearings and Appeals,    Defense Personnel Security Research Center,    Joint Chiefs of Staff, and    Washington Headquarters Services.
Office of the Director of National Intelligence;    Department of Health and Human Services;    Department of Homeland Security;    Department of the Treasury; and    Department of Veterans Affairs.
We conducted a roundtable discussion with members of the Intelligence  Community, including officials from the Office of the Director of National  Intelligence, the Under Secretary of Defense for Intelligence, the Central  Intelligence Agency, Defense Intelligence Agency, Federal Bureau of  Investigation, National Geospatial-Intelligence Agency, National  Reconnaissance Office, National Security Agency, and the Department of  State to discuss broader challenges the Intelligence Community faces  regarding timeliness, information sharing, and reciprocity.
To assess the extent to which executive branch agencies investigate and  adjudicate initial personnel security clearance applications in a timely  manner, we analyzed the timeliness objectives specified in the Intelligence  Reform and Terrorism Prevention Act of 2004 (IRTPA) and reviewed the  self-reported timeliness data contained in the Performance Accountability  Council’s Security and Suitability Process Reform Strategic Framework  provided by the Performance Accountability Council Subcommittee on  Performance Management and Measures for the first three quarters of  fiscal year 2010. The data provided by the Performance Accountability  Council was provided in August 2010. Further, we obtained and reviewed  timeliness data provided by OPM for agencies that utilize OPM as the  investigative service provider for the first three quarters of fiscal year  2010. While IRTPA sets timeliness objectives for 90 percent of cases, the  Performance Accountability Council excludes certain cases from its  analysis before calculating and reporting on agency timeliness. For  example, OPM officials stated that cases that are returned to OPM for  additional work, such as work to address missing scope items, are  excluded from timeliness data. Due to the additional investigative work  involved with these cases and the additional time required for agencies to  negotiate the terms of the requests, these cases take longer to complete.   Furthermore, the Performance Accountability Council excludes certain  cases involving industrial personnel. DOD’s Defense Industrial Security  Clearance Office adjudicates clearances for industrial personnel. When the  Defense Industrial Security Clearance Office cannot mitigate issues and  has decided that a denial or revocation is warranted, they submit the cases  to the Defense Office of Hearings and Appeals. Timeliness information on  cases pending with Defense Office of Hearings and Appeals is excluded  from DOD’s timeliness data. Moreover, by not including end-to-end  timeliness information on cases that require additional work in the query  for calculating the fastest 90 percent of cases, the Performance  Accountability Council is excluding many of the cases that took the  longest to complete and, therefore, the average for agency timeliness may  be reduced. We assessed the reliability of the data by reviewing the  existing data and interviewing agency officials knowledgeable about how  the data was collected, stored, and reported, as well as the quality  assurance steps that were taken to ensure completeness and accuracy. We  determined these data were sufficiently reliable for purposes of our audit.  Additionally, we supplemented this data reliability analysis with  information obtained through our interviews with executive branch  agencies about their timeliness performance in fiscal year 2010 to date.  These agencies were selected based on the volume of security clearances  processed annually, among other things.
To assess the extent to which executive branch agencies accept previously  granted security clearances and the challenges, if any, that exist related to  reciprocity, we reviewed the requirements specified in IRTPA and  analyzed Executive Orders, OMB memorandums, ODNI policy guidance  and directives, congressional reports, and individual agency guidance  related to reciprocity. We also analyzed existing and planned metrics  developed by the Performance Accountability Council to track the extent  to which reciprocity is honored. We met with security officials, managers,  and adjudicators from DOD, the Intelligence Community, and a non- probability sample of additional executive branch agencies. We  supplemented this analysis with information obtained from a roundtable  discussion that we conducted with representatives of Intelligence  Community agencies to examine the challenges these agencies face as it  relates to granting reciprocity. Because the scope of this engagement is  limited to security clearances, we did not analyze the extent to which  agencies reciprocally accept prior suitability investigations and  adjudications. For the purposes of our report reciprocity is an agency’s  acceptance of a background investigation or clearance determination  completed by another authorized investigative or adjudicative agency. We  excluded from the scope of our work issues related to access to facilities,  detailed employees, or classified information.
To assess the extent to which executive branch agencies share personnel  clearance information in a single, integrated database, we reviewed and  analyzed the Joint Reform Team’s Enterprise Information Technology  Strategy, the Performance Accountability Council’s 2010 Strategic  Framework, and the two most recent Joint Reform Team Security and  Suitability Process Reform reports.
We interviewed knowledgeable officials within OPM, ODNI, and DOD to  determine what, if any, limitations, barriers, or challenges existed in  creating a single, integrated database. In addition, we received  demonstrations of both OPM and DOD’s databases and interviewed  officials to determine how they shared information about personnel who  hold or are seeking security clearances in the absence of a single,  integrated database.
We conducted this performance audit from October 2009 through  November 2010 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our objectives.
section_title: Appendix II: Comments from the Office of the Director of National Intelligence
section_title: Appendix III: Comments from the Office of Personnel Management
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Liz McNally (Assistant Director);  David Moser (Assistant Director); James Ashley; Joseph M. Capuano; Sara  Cradic; Cindy Gilbert; Linda Keefer; James Krustapentus; Greg Marchand;  Richard Powelson; Jillena Roberts; and Amie Steele made key  contributions to this report.
section_title: Related GAO Products
paragraphs: DOD Personnel Security Clearance Reform: Preliminary Observations  on Timeliness and Quality. GAO-11-185T. Washington, D.C.: November  16, 2010.
Privacy: OPM Should Better Monitor Implementation of Privacy-Related  Policies and Procedures for Background Investigations. GAO-10-849.  Washington, D.C.: September 7, 2010.
Personnel Security Clearances: An Outcome-Focused Strategy and  Comprehensive Reporting of Timeliness and Quality Would Provide  Greater Visibility over the Clearance Process. GAO-10-117T. Washington,  D.C.: October 1, 2009.
Personnel Security Clearances: Progress Has Been Made to Reduce  Delays but Further Actions Are Needed to Enhance Quality and Sustain  Reform Efforts. GAO-09-684T. Washington, D.C.: September 15, 2009.
Personnel Security Clearances: An Outcome-Focused Strategy Is Needed  to Guide Implementation of the Reformed Clearance Process. GAO-09-488.  Washington, D.C.: May 19, 2009.
DOD Personnel Clearances: Comprehensive Timeliness Reporting,  Complete Clearance Documentation, and Quality Measures Are Needed  to Further Improve the Clearance Process. GAO-09-400. Washington, D.C.:  May 19, 2009.
High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 22,  2009.
DOD Personnel Clearances: Preliminary Observations about Timeliness  and Quality. GAO-09-261R. Washington, D.C.: December 19, 2008.
Personnel Security Clearances: Preliminary Observations on Joint  Reform Efforts to Improve the Governmentwide Clearance Eligibility  Process. GAO-08-1050T. Washington, D.C.: July 30, 2008.
Personnel Clearances: Questions for the Record Regarding Security  Clearance Reform. GAO-08-965R. Washington, D.C.: July 14, 2008.
Personnel Clearances: Key Factors for Reforming the Security Clearance  Process. GAO-08-776T. Washington, D.C.: May 22, 2008.
Employee Security: Implementation of Identification Cards and DOD’s  Personnel Security Clearance Program Need Improvement. GAO-08-551T.  Washington, D.C.: April 9, 2008.
DOD Personnel Clearances: Questions for the Record Related to the  Quality and Timeliness of Clearances. GAO-08-580R. Washington D.C.:  March 25, 2008.
DOD Personnel Clearances: DOD Faces Multiple Challenges in Its Efforts  to Improve Clearance Processes for Industry Personnel. GAO-08-470T.  Washington, D.C.: February 12, 2008.
Personnel Clearances: Key Factors to Consider in Efforts to Reform  Security Clearance Processes. GAO-08-352T. Washington, D.C.: February  27, 2008.
DOD Personnel Clearances: Improved Annual Reporting Would Enable  More Informed Congressional Oversight. GAO-08-350. Washington, D.C.:  February 13, 2008.
DOD Personnel Clearances: Delays and Inadequate Documentation  Found for Industry Personnel. GAO-07-842T. Washington, D.C.: May 17,  2007.
High Risk Series: An Update. GAO-07-310. Washington, D.C.: January  2007.
DOD Personnel Clearances: Additional OMB Actions Are Needed to  Improve the Security Clearance Process. GAO-06-1070. Washington, D.C.:  September 28, 2006.
DOD Personnel Clearances: Questions and Answers for the Record  Following the Second in a Series of Hearings on Fixing the Security  Clearance Process. GAO-06-693R. Washington, D.C.: June 14, 2006.
DOD Personnel Clearances: New Concerns Slow Processing of Clearances  for Industry Personnel. GAO-06-748T. Washington, D.C.: May 17, 2006.
DOD Personnel Clearances: Funding Challenges and Other Impediments  Slow Clearances for Industry Personnel. GAO-06-747T. Washington, D.C.:  May 17, 2006.
Questions for the Record Related to DOD’s Personnel Security Clearance  Program and the Government Plan for Improving the Clearance Process.  GAO-06-323R. Washington, D.C.: January 17, 2006.
DOD Personnel Clearances: Government Plan Addresses Some Long- standing Problems with DOD’s Program, But Concerns Remain.  GAO-06-233T. Washington, D.C.: November 9, 2005.
DOD Personnel Clearances: Some Progress Has Been Made but Hurdles  Remain to Overcome the Challenges That Led to GAO’s High-Risk  Designation. GAO-05-842T. Washington, D.C.: June 28, 2005.
High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January  2005.