Employee Security: Implementation of Identification Cards and DOD's Personnel Security Clearance Program Need Improvement
Released: 2008-04-09T00:00:00

Letter

Background

In August 2004, the President issued HSPD-12, which directed the Department of Commerce to develop a new standard for secure and reliable forms of ID for federal employees and contractors to enable a common standard across the federal government by February 27, 2005. The directive defines secure and reliable ID as meeting four control objectives. Specifically, the identification credentials must be ● based on sound criteria for verifying an individual employee’s or contractor’s identity; ● strongly resistant to identity fraud, tampering, counterfeiting, and ● able to be rapidly authenticated electronically; and issued only by providers whose reliability has been established by an official accreditation process.

HSPD-12 stipulates that the standard must include criteria that are graduated from “least secure” to “most secure” to ensure flexibility in selecting the appropriate level of security for each application. In addition, the directive directs agencies to implement, to the maximum extent practicable, the standard for IDs issued to federal employees and contractors in order to gain physical access to controlled facilities and logical access to controlled information systems by October 27, 2005.

FIPS 201: Personal Identity Verification of Federal Employees and Contractors

In response to HSPD-12, NIST published FIPS 201, Personal Identity Verification of Federal Employees and Contractors, on February 25, 2005. The standard specifies the technical requirements for PIV systems to issue secure and reliable ID credentials to federal employees and contractors for gaining physical access to federal facilities and logical access to information systems and software applications. Smart cards are a primary component of the envisioned PIV system. The FIPS 201 standard is composed of two parts, PIV-I and PIV-II.

PIV-I sets standards for PIV systems in three areas: (1) identity proofing and registration, (2) card issuance and maintenance, and (3) protection of card applicants’ privacy. There are many steps to the identity proofing and registration process, such as completing a background investigation of the applicant, conducting and adjudicating a fingerprint check prior to credential issuance, and requiring applicants to provide two original forms of identity source documents from an OMB-approved list of documents.

The card issuance and maintenance process should include standardized specifications for printing photographs, names, and other information on PIV cards and for other activities, such as capturing and storing biometric and other data, and issuing, distributing, and managing digital certificates.

Finally, agencies are directed to perform activities to protect the privacy of the applicants, such as assigning an individual to the role of “senior agency official for privacy” to oversee privacy-related matters in the PIV system; providing full disclosure of the intended uses of the PIV card and related privacy implications to the applicants; and using security controls described in NIST guidance to accomplish privacy goals, where applicable.

The second part of the FIPS 201 standard, PIV-II, provides technical specifications for interoperable smart card-based PIV systems. The components and processes in a PIV system, as well as the identity authentication information included on PIV cards, are intended to provide for consistent authentication methods across federal agencies. The PIV-II cards (see example in fig. 1) are intended to be used to access all federal physical and logical environments for which employees are authorized.

The PIV cards contain a range of features—including photographs, cardholder unique identifiers (CHUID), fingerprints, and Public Key Infrastructure (PKI) certificates—to enable enhanced identity authentication at different assurance levels. To use these enhanced capabilities, specific infrastructure needs to be in place. This infrastructure may include biometric (fingerprint) readers, personal ID number (PIN) input devices, and connections to information systems that can process PKI digital certificates and CHUIDs. Once acquired, these various devices need to be integrated with existing agency systems, such as a human resources system. Furthermore, card readers that are compliant with FIPS 201 need to exchange information with existing physical and logical access control systems in order to enable doors and systems to unlock once a cardholder has been successfully authenticated and access has been granted.

FIPS 201 includes specifications for three types of electronic authentication that provide varying levels of security assurance. ● The CHUID or visual inspection, provides some confidence. ● A biometric check without the presence of a security guard or attendant at the access point, offers a high level of assurance of the cardholders’ identity. ● A PKI check, independently or in conjunction with both biometric and visual authentication, offers a very high level of assurance in the identity of the cardholder.

OMB guidance and FIPS 201 direct agencies to use risk-based methods to decide which type of authentication is appropriate in a given circumstance.

In addition to the three authentication methods, PIV cards also support the use of PIN authentication, which may be used in conjunction with one of these capabilities. For example, the PIN can be used to control access to biometric data on the card when conducting a fingerprint check.

Additional NIST, OMB and GSA Guidance

NIST has issued several publications that provide supplemental guidance on various aspects of the FIPS 201 standard. NIST also developed a suite of tests to be used by approved commercial laboratories to validate whether commercial products for the PIV card and the card interface are in conformation with the standard.

In August 2005, OMB issued a memorandum to executive branch agencies with instructions for implementing HSPD-12 and the new standard. The memorandum specifies to whom the directive applies; to what facilities and information systems FIPS 201 applies; and, as outlined in the following text, the schedule that agencies must adhere to when implementing the standard. ● October 27, 2005—For all new employees and contractors, adhere to the identity proofing, registration, card issuance, and maintenance requirements of the first part (PIV-I) of the standard. ● October 27, 2006—Begin issuing cards that comply with the second part (PIV-II) of the standard and implementing the privacy requirements. ● October 27, 2007—Verify and/or complete background investigations for all current employees and contractors who have been with the agency for 15 years or less. Issue PIV cards to these employees and contractors, and require that they begin using their cards by this date. ● October 27, 2008—Complete background investigations for all individuals who have been federal agency employees for more than 15 years. Issue cards to these employees and require them to begin using their cards by this date.

Figure 2 shows a timeline that illustrates when HSPD-12 and additional guidance was issued as well as the major deadlines for implementing HSPD-12.

The General Services Administration (GSA) has also provided implementation guidance and product performance and interoperability testing procedures. In addition, GSA establishe Managed Service Office (MSO) that offers shared service civilian agencies to help reduce the costs of procuring FIPS 201- compliant equipment, software, and services by sharing some of the infrastructure, equipment, and services among participating agencies. According to GSA, the shared service offering—referred to as the USAccess Program—is intended to provide several ser such as producing and issuing the PIV cards. As of October 2007, GSA had 67 agency customers with more than 700,000 government employees and contractors to whom cards would be issued throug shared service providers. In addition, as of December 31, 2007, the MSO had installed over 50 enrollment stations with 15 agencies actively enrolling employees and issuing PIV cards. While there are several services offered by the MSO, it is not intended to provide support for all aspects of HSPD-12 implementation. For example, the MSO does not provide services to help agencies integrate theirphysical and logical access control systems with their PIV systems .

In 2006, GSA’s Office of Governmentwide Policy established the interagency HSPD-12 Architecture Working Group, which is intended to develop interface specifications for HSPD-12 system interoperability across the federal government. As of July 200 7, the group had issued 10 interface specification documents, including a specification for exchanging data between an agency and a shared service provider.

Previously Reported FIPS 201 Implementation Challenges

In February 2006, we reported tha challenges in implementing FIPS 2 time frames and funding uncertainties as well as incomplete implementation guidance. We recommended that OMB monitor agencies’ implementation process and completion of key acti In response to this recommendation, beginning on March 1, 2007, OMB directed agencies to post to their public Web sites quarterly reports on the number of PIV cards they had issued to their employees, contractors, and other individuals. In addition, in Augu 2006, OMB directed each agency to submit an updated implementation plan. t agencies faced several 01, including constrained testing vities.

DOD Personnel Security Clearance Program Has Been Designated as a GAO High-Risk Area

Military servicemembers, federal workers, and industry personnel must obtain security clearances to gain access to classified information. Clearances are categorized into three levels: top secre secret, and confidential. The level of classification denotes t degree of protection required for information and the amount of damage that unauthorized disclosure could reasonably cause tonational security. The degree of expected damage that unauthoriz disclosure could reasonably be expected to cause is “exceptional ly grave damage” for top secret information, “serious damage” for secret information, and “damage” for confidential information.

We designated DOD’s personnel security clearance program a high- risk area in January 2005 and continued that designation in the updated list of high-risk areas that we published in 2007. We identified this program as a high-risk area because of long-standing delays in determining clearance eligibility and other challenges. DOD represents about 80 percent of the security clearances adjudicated by the federal government and problems in the clearance program can negatively affect national security. For example, delays in renewing security clearances for personnel who are already doing classified work can lead to a heightened risk of unauthorized disclosure of classified information. In contrast, delays in providing initial security clearances for previously non-cleared personnel can result in other negative consequences, such as additional costs and delays in completing national security-related contracts, lost opportunity costs, and problems retaining the best qualified personnel.

DOD’s Office of the Under Secretary of Defense for Intelligence has responsibility for determining eligibility for clearances for servicemembers, DOD civilian employees, and industry personnel performing work for DOD and 23 other federal agencies, and employees in the federal legislative branch. That responsibility includes obtaining background investigations, primarily through the Office of Personnel Management (OPM). Within DOD, government employees use the information in OPM- provided investigative reports to determine clearance eligibility of clearance subjects.

Recent significant events affecting the clearance program of DOD and other federal agencies include the passage of the Intelligence Reform and Terrorism Prevention Act of 2004 and the issuance of the June 2005 Executive Order 13381, “Strengthening Processes Relating to Determining Eligibility for Access to Classified National Security Information.” The act included milestones for reducing the time to complete clearances, general specifications for a database on security clearances, and requirements for reciprocity of clearances. Among other things, the executive order established as policy that agency functions relating to determining eligibility for access to classified national security information shall be appropriately uniform, centralized, efficient, effective, timely, and reciprocal and provided that the Director of OMB would ensure the policy's effective implementation.

Limited Progress Had Been Made in Implementing PIV Cards and in Using Their Full Capabilities

Agencies had made limited progress in implementing and using PIV cards. While the eight agencies we reviewed had generally taken steps to complete background checks on most of their employees and contractors and establish basic infrastructure, such as purchasing card readers, none of the agencies met OMB’s goal of issuing PIV cards by October 27, 2007, to all employees and contractor personnel who had been with the agency for 15 years or less. In addition, for the limited number of cards that had been issued, agencies generally had not been using the electronic authentication capabilities on the cards. A key contributing factor for why agencies had made limited progress in adopting the use of PIV cards is that OMB, which is tasked with ensuring that federal agencies implement HSPD-12, focused agencies’ attention on card issuance, rather than on full use of the cards’ capabilities. Until OMB revises its approach to focus on the full use of card capabilities, HSPD-12’s objective of increasing the quality and security of ID and credentialing practices across the federal government may not be fully achieved.

While Agencies Had Generally Completed Background Checks and Established Basic Infrastructure, They Were Not Using the Electronic Authentication Capabilities of PIV Cards to Enhance Security

As we have previously described, by October 27, 2007, OMB had directed federal agencies to issue PIV cards and require PIV card use by all employees and contractor personnel who have been with the agency for 15 years or less. HSPD-12 requires that the cards be used for physical access to federally controlled facilities and logical access to federally controlled information systems. In addition, to issue cards that fully meet the FIPS 201 specification, basic infrastructure—such as ID management systems, enrollment stations, PKI, and card readers—will need to be put in place. OMB also directed that agencies verify and/or complete background investigations by this date for all current employees and contractors who have been with the agency for 15 years or less.

Agencies had taken steps to complete background checks that were directed by OMB, on their employees and contractors and establish basic infrastructure to help enable the use of PIV capabilities. For example, Commerce, Interior, NRC, and USDA had established agreements with GSA’s MSO to use its shared infrastructure, including its PKI, and enrollment stations. Other agencies, including DHS, HUD, Labor, and NASA—which chose not to use GSA’s shared services offering—had acquired and implemented other basic elements of infrastructure, such as ID management systems, enrollment stations, PKI, and card readers.

However, none of the eight agencies had met the October 2007 deadline regarding card issuance. In addition, for the limited number of cards that had been issued, agencies generally had not been using the electronic authentication capabilities on the cards. Instead, for physical access, agencies were using visual inspection of the cards as their primary means to authenticate cardholders. While it may be sufficient in certain circumstances—such as in very small offices with few employees—in most cases, visual inspection will not provide an adequate level of assurance. OMB strongly recommends minimal reliance on visual inspection. Also, seven of the eight agencies we reviewed had not been using the cards for logical access control.

Furthermore, most agencies did not have detailed plans in place to use the various authentication capabilities. For example, as of October 30, 2007, Labor had not yet developed plans for implementing the electronic authentication capabilities on the cards. Similarly, Commerce officials stated that they would not have a strategy or time frame in place for using the electronic authentication capabilities of PIV cards until June 2008.

Table 1 provides details about the progress each of the eight agencies had made as of December 1, 2007.

OMB’s Focus on Near-Term Card Issuance Hindered Progress in Achieving the HSPD-12 Objectives

A key contributing factor to why agencies had made limited progress is that OMB—which is tasked with ensuring that federal agencies implement HSPD-12—had emphasized the issuance of the cards, rather than the full use of the cards’ capabilities. Specifically, OMB’s milestones were not focused on implementation of the electronic authentication capabilities that are available through PIV cards, and had not set acquisition milestones that would coincide with the ability to make use of these capabilities. Furthermore, despite the cost of the cards and associated infrastructure, OMB had not treated the implementation of HSPD-12 as a major new investment and had not ensured that agencies have guidance to ensure consistent and appropriate implementation of electronic authentication capabilities across agencies. Until these issues are addressed, agencies may continue to acquire and issue costly PIV cards without using their advanced capabilities to meet HSPD-12 goals.

While OMB had established milestones for near-term card issuance, it had not established milestones to require agencies to develop detailed plans for making the best use of the electronic authentication capabilities of PIV cards. Consequently, agencies had concentrated their efforts on meeting the card issuance deadlines. For example, several of the agencies we reviewed chose to focus their efforts on meeting the next milestone—that cards be issued to all employees and contractor personnel and be in use by October 27, 2008. Understandably, meeting this milestone was perceived to be more important than making optimal use of the cards’ authentication capabilities, because card issuance is the measure that OMB is monitoring and asking agencies to post on their public Web sites.

The PIV card and the services involved in issuing and maintaining the data on the card, such as the PKI certificates, are costly. For example, PIV cards and related services offered by GSA through its shared service offering cost $82 per card for the first year and $36 per card for each of the remaining 4 years of the card’s life. In contrast, traditional ID cards with limited or no electronic authentication capabilities cost significantly less. Therefore, agencies that do not implement electronic authentication techniques are spending a considerable amount per card for capabilities that they are not able to use. A more economical approach would be to establish detailed plans for implementing the technical infrastructure necessary to use the electronic authentication capabilities on the cards and time the acquisition of PIV cards to coincide with the implementation of this infrastructure.

Without OMB focusing its milestones on the best use of the authentication capabilities available through PIV cards, agencies are likely to continue to implement minimum authentication techniques and not be able to take advantage of advanced authentication capabilities.

Before implementing major new systems, agencies are generally directed to conduct thorough planning to ensure that costs and time frames are well understood and that the new systems meet their needs. OMB establishes budget justification and reporting requirements for all major information technology investments. Specifically, for such investments, agencies are directed to prepare a business case—OMB Exhibit 300—which is supported by a number of planning documents that are essential in justifying decisions regarding how, when, and the extent to which an investment would be implemented.

However, OMB determined that because agencies had ID management systems in place prior to HSPD-12 and that the directive only directed agencies to “standardize” their systems. the implementation effort did not constitute a new investment. According to an OMB senior policy analyst, agencies should be able to fund their HSPD-12 implementations through existing resources and should not need to develop a business case or request additional funding.

While OMB did not direct agencies to develop business cases for HSPD-12 implementation efforts, PIV card systems are likely to represent significant new investments at several agencies. For example, agencies such as Commerce, HUD, and Labor had not implemented PKI technology prior to HSPD-12, but they are now directed to do so. In addition, such agencies’ previous ID cards were used for limited purposes and were not used for logical access. These agencies had no prior need to acquire or maintain card readers for logical access control or to establish connectivity with their ID management systems for logical access control and, consequently, had previously allocated very little money for the operations and maintenance of these systems. For example, according to Labor officials, operations and maintenance costs for its pre-HSPD-12 legacy system totaled approximately $169,000, while its fiscal year 2009 budget request for HSPD-12 implementation is approximately $3 million—17 times more expensive.

While these agencies recognized that they are likely to face substantially greater costs in implementing PIV card systems, they had not always thoroughly assessed all of the expenses they are likely to incur. For example, agency estimates may not have included the cost of implementing advanced authentication capabilities where they are needed. The extent to which agencies need to use such capabilities could significantly impact an agency’s cost for implementation.

While the technical requirements of complying with HSPD-12 dictated that a major new investment be made, generally, agencies had not been directed by OMB to take the necessary steps to thoroughly plan for these investments. For example, six of the eight agencies we reviewed had not developed detailed plans regarding their use of PIV cards for physical and logical access controls. In addition, seven of the eight agencies had not prepared cost-benefit analyses that weighed the costs and benefits of implementing different authentication capabilities. Without treating the implementation of HSPD-12 as a major new investment by requiring agencies to develop detailed plans based on risk-based assessments of agencies’ physical and logical access control needs that support the extent to which electronic authentication capabilities are to be implemented, OMB will continue to limit its ability to ensure that agencies properly plan and implement HSPD-12.

OMB Had Not Provided Guidance for Determining Which PIV Card Authentication Capabilities to Implement for Physical and Logical Access Controls Another factor contributing to agencies’ limited progress is that OMB had not provided guidance to agencies regarding how to determine which electronic authentication capabilities to implement for physical and logical access controls. While the FIPS 201 standard describes three different assurance levels for physical access (some, high, and very high confidence) and associates PIV authentication capabilities with each level, it is difficult for agencies to link these assurance levels with existing building security assurance standards that are used to determine access controls for facilities. The Department of Justice has developed standards for assigning security levels to federal buildings, ranging from level I (typically, a leased space with 10 or fewer employees, such as a military recruiting office) to level V (typically, a building, such as the Pentagon or Central Intelligence Agency headquarters, with a large number of employees and a critical national security mission). While there are also other guidelines that agencies could use to conduct assessments of their buildings, several of the agencies we reviewed use the Justice guidance to conduct risk assessments of their facilities.

Officials from several of the agencies we reviewed indicated that they had not been using the FIPS 201 guidance to determine which PIV authentication capabilities to use for physical access because they had not found the guidance to be complete. Specifically, they were unable to determine which authentication capabilities should be used for the different security levels. The incomplete guidance has contributed to several agencies—including Commerce, DHS, and NRC—not reaching decisions on what authentication capabilities they were going to implement.

More recently, NIST has begun developing guidelines for applying the FIPS 201 confidence levels to physical access control systems. However, this guidance has not yet been completed and was not available to agency officials when we were conducting our review.

Agencies also lacked guidance regarding when to use the enhanced authentication capabilities for logical access control. Similar to physical access control, FIPS 201 describes graduated assurance levels for logical access (some, high, and very high confidence) and associates PIV authentication capabilities with each level. However, as we have previously reported, neither FIPS 201 nor supplemental OMB guidance provides sufficient specificity regarding when and how to apply the standard to information systems. For example, such guidance does not inform agencies how to consider the risk and level of confidence needed when different types of individuals require access to government systems, such as a researcher uploading data through a secure Web site or a contractor accessing government systems from an off-site location.

Until complete guidance is available, agencies will likely continue either to delay in making decisions on their implementations or to make decisions that may need to be modified later.

Efforts Are Under Way to Address the Limited Progress Made in Achieving Interoperability to Enable Cross-Agency Authentication of Cardholders

As defined by OMB, one of the primary goals of HSPD-12 is to enable interoperability across federal agencies. As we have previously reported, prior to HSPD-12, there were wide variations in the quality and security of ID cards used to gain access to federal facilities. To overcome this limitation, HSPD-12 and OMB guidance direct that ID cards have standard features and means for authentication to enable interoperability among agencies.

While steps had been taken to enable future interoperability, progress had been limited in implementing such capabilities in current systems, partly because key procedures and specifications had not yet been developed. As we have previously stated, NIST established conformance testing for the PIV card and interface, and GSA established testing for other PIV products and services to help enable interoperability. In addition, the capability exists for determining the validity and status of a cardholder from another agency via PKI. However, procedures and specifications to enable cross-agency interoperability using the CHUID—which is expected to be more widely used than PKI—had not been established. While PIV cards and FIPS 201-compliant readers may technically be able to read the information encoded on any PIV card—including cards from multiple agencies—this functionality is not adequate to allow one agency to accept another agency’s PIV card, because there is no common interagency framework in place for agencies to electronically exchange status information on PIV credentials. For example, the agency that issued a PIV card could revoke the cardholder’s authorization to access facilities or systems if the card is lost or if there has been a change in the cardholder’s employment status. The agency attempting to process the card would not be able to access this information because a common framework to electronically exchange status information does not exist. The interfaces and protocols that are needed for querying the status of cardholders have not yet been developed.

In addition, procedures and policies had not been established for sharing information on contractor personnel who work at multiple federal agencies. Without such procedures and policies, agencies will issue PIV cards to their contractor staff for access only to their own facilities. Contractors who work at multiple agencies may need to obtain separate PIV cards for each agency.

GSA recognized the need to address these issues and has actions under way to do so. According to GSA, the Federal Identity Credentialing Committee is developing guidance on the issuance and maintenance of PIV cards to the contractor community. GSA is also developing a standard specification that will enable interoperability in the exchange of identity information among agencies. According to GSA officials, they plan to complete and issue guidance by the end of September 2008. Additionally, NIST is planning to issue an update to a special publication that focuses on interfaces for PIV systems. Such guidance should help enable agencies to establish cross-agency interoperability—a primary goal of HSPD-12.

Implementation of GAO Recommendations Should Help Achieve the Objectives of HSPD-12

To help ensure that the objectives of HSPD-12 are achieved, we made several recommendations in our report. First, we recommended that OMB establish realistic milestones for full implementation of the infrastructure needed to best use the electronic authentication capabilities of PIV cards in agencies. In commenting on a draft of our report, OMB stated that its guidance requires agencies to provide milestones for when they intend to leverage the capabilities of PIV credentials. However, in order to ensure consistent governmentwide implementation of HSPD-12, it is important for OMB to establish such milestones across agencies, rather than to allow individual agencies to choose their own milestones.

Next, we recommended that OMB require each agency to develop a risk-based, detailed plan for implementing electronic capabilities. OMB stated that previous guidance required agencies to provide milestones for when they plan to fully leverage the capabilities of PIV credentials for physical and logical access controls. However, agencies were required to provide only the dates they plan to complete major activities, and not detailed, risk-based plans. Until OMB requires agencies to implement such plans, OMB will be limited in its ability to ensure agencies make the best use of their cards’ electronic authentication capabilities.

We also recommended that OMB require agencies to align the acquisition of PIV cards with plans for implementing the cards’ electronic authentication capabilities. In response, OMB stated that HSPD-12 aligns with other information security programs. While OMB’s statement is correct, it would be more economical for agencies to time the acquisition of PIV cards to coincide with the implementation of the technical infrastructure necessary for enabling electronic authentication techniques. This approach has not been encouraged by OMB, which instead measures agencies primarily on how many cards they issue.

Lastly, we recommended that OMB ensure guidance is developed that maps existing physical security guidance to FIPS 201 guidance. OMB stated that NIST is in the process of developing additional guidance to clarify the relationship between facility security levels and PIV authentication levels. In March 2008, NIST released a draft of this guidance to obtain public comments.

Long-standing Challenges Exist in DOD’s Personnel Security Clearance Program

In our previous reports, we have also documented a variety of problems present in DOD’s personnel security clearance program. Some of the problems that we noted in our 2007 high-risk report included delays in processing clearance applications and problems with incomplete investigative and adjudicative reports to determine clearance eligibility. Delays in the clearance process continue to increase costs and risk to national security, such as when new industry employees are not able to begin work promptly and employees with outdated clearances have access to classified documents. Moreover, DOD and the rest of the federal government provide limited information to one another on how they individually ensure the quality of clearance products and procedures. While DOD continues to face challenges in timeliness and quality in the personnel security clearance process, high-level governmentwide attention has been focused on improving the security clearance process.

As we noted in February 2008, delays in the security clearance process continue to increase costs and risk to national security. An August 2007 DOD report to Congress noted that delays in processing personnel security clearances for industry have been reduced, yet that time continues to exceed requirements established by the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA).

The act currently requires that adjudicative agencies make a determination on at least 80 percent of all applications for a security clearance within an average of 120 days after the date of receipt of the application, with 90 days allotted for the investigation and 30 days allotted for the adjudication. However, DOD’s August 2007 report on industry clearances stated that, during the first 6 months of fiscal year 2007, the end-to-end processing of initial top secret clearances took an average of 276 days; renewal of top secret clearances, 335 days; and all secret clearances, 208 days.

We also noted in February 2008, that delays in clearance processes can result in additional costs when new industry employees are not able to begin work promptly and increased risks to national security because previously cleared industry employees are likely to continue working with classified information while the agency determines whether they should still be eligible to hold a clearance. To improve the timeliness of the clearance process, we recommended in September 2006 that OMB establish an interagency working group to identify and implement solutions for investigative and adjudicative information-technology problems that have resulted in clearance delays. In commenting on our recommendation, OMB’s Deputy Director for Management stated that the National Security Council’s Security Clearance Working Group had begun to explore ways to identify and implement improvements to the process.

DOD and the Rest of the Government Provide Limited Information on How to Ensure the Quality of Clearance Products and Procedures As we reported in February 2008, DOD and the rest of the federal government provide limited information to one another on how they individually ensure the quality of clearance products and procedures. For example, DOD’s August 2007 congressionally mandated report on clearances for industry personnel documented improvements in clearance processes but was largely silent regarding quality in clearance processes. While DOD described several changes to the processes and characterized the changes as progress, the department provided little information on (1) any measures of quality used to assess clearance processes or (2) procedures to promote quality during clearance investigation and adjudication processes. Specifically, DOD reported that the Defense Security Service, DOD’s adjudicative community, and OPM are gathering and analyzing measures of quality for the clearance processes that could be used to provide the national security community with a better product. However, the DOD report did not include any of those measures.

In September 2006, we reported that while eliminating delays in clearance processes is an important goal, the government cannot afford to achieve that goal by providing investigative and adjudicative reports that are incomplete in key areas. We additionally reported that the lack of full reciprocity—when one government agency fully accepts a security clearance granted by another government agency—is an outgrowth of agencies’ concerns that other agencies may have granted clearances based on inadequate investigations and adjudications. Without fuller reciprocity of clearances, agencies could continue to require duplicative investigations and adjudications, which result in additional costs to the federal government. In the report we issued in February 2008, we recommended that DOD develop measures of quality for the clearance process and include them in future reports to Congress. Statistics from such measures would help to illustrate how DOD is balancing quality and timeliness requirements in its personnel security clearance program. DOD concurred with that recommendation, indicating it had developed a baseline performance measure of the quality of investigations and adjudications and was developing methods to collect information using this quality measure.

Recent High-Level Governmentwide Attention Has Been Focused On Improving the Security Clearance Process In February 2008, we reported that while DOD continues to face timeliness and quality challenges in the personnel security clearance program, high-level governmentwide attention has been focused on improving the security clearance process. For example, we reported that OMB’s Deputy Director of Management has been responsible for a leadership role in improving the governmentwide processes since June 2005. During that time, OMB has overseen, among other things, the growth of OPM’s investigative workforce and greater use of OPM’s automated clearance-application system. In addition, an August 9, 2007, memorandum from the Deputy Secretary of Defense indicates that DOD’s clearance program is drawing attention at the highest levels of the department. Streamlining security clearance processes is one of the 25 DOD transformation priorities identified in the memorandum.

Another indication of high-level government attention we reported in February 2008 is the formation of an interagency security clearance process reform team in June 2007. Agencies included in the governmentwide effort are OMB, the Office of the Director of National Intelligence, DOD, and OPM. The team’s memorandum of agreement indicates that it seeks to develop, in phases, a reformed DOD and intelligence community security clearance process that allows the granting of high-assurance security clearances in the least time possible and at the lowest reasonable cost. The team’s July 25, 2007, terms of reference indicate that the team plans to deliver “a transformed, modernized, fair, and reciprocal security clearance process that is universally applicable” to DOD, the intelligence community, and other U.S. government agencies.

A further indication of high level government attention is a memorandum issued by the President on February 5, 2008 which called for aggressive efforts to achieve meaningful and lasting reform of the processes to conduct security clearances. In the memorandum, the President acknowledged the work being performed by the interagency security clearance process reform team and directed that the team submit to the President an initial reform proposal not later than April 30, 2008.

In closing, OMB, GSA, and NIST have made significant progress in laying the foundation for implementation of HSPD-12. However, agencies did not meet OMB’s October 2007 milestone for issuing cards and most have made limited progress in using the advanced security capabilities of the cards that have been issued. These agency actions have been largely driven by OMB’s guidance, which has emphasized issuance of cards rather than the full use of the cards’ capabilities. As a result, agencies are acquiring and issuing costly PIV cards without using the advanced capabilities that are critical to achieving the objectives of HSPD-12. Until OMB provides additional leadership by guiding agencies to perform the planning and assessments that will enable them to fully use the advanced capabilities of these cards, agencies will likely continue to make limited progress in using the cards to improve security over federal facilities and systems.

Regarding security clearances, in June 2005, OMB took responsibility for a leadership role for improving the governmentwide personnel security clearance process. The current interagency security clearance process reform team represents a positive step to address past impediments and manage security clearance reform efforts. Although the President has called for a reform proposal to be provided no later than April 30, 2008, much remains to be done before a new system can be implemented.

Mr. Chairman and members of the subcommittee, this concludes our statement. We would be happy to respond to any questions that you or members of the subcommittee may have at this time.

Contacts and Acknowledgements

If you have any questions on matters discussed in this testimony, please contact Linda D. Koontz at (202) 512-6240 or Brenda S. Farrell at (202) 512-3604 or by e-mail at koontzl@gao.gov or farrellb@gao.gov. Other key contributors to this testimony include John de Ferrari (Assistant Director), Neil Doherty, Nancy Glover, James P. Klein, Rebecca Lapaze, Emily Longcore, James MacAulay, David Moser and Shannin O’Neill.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.