Protecting Classified Information: Defense Security Service Should Address Challenges as New Approach Is Piloted
Released: 2018-05-14T00:00:00

Letter

Background

The goal of federal government industrial security is to ensure that contractors’ security programs detect, deter, and counter the threat posed by adversaries seeking classified information. The National Industrial Security Program was established by executive order in 1993 to replace industrial security programs operated separately by various federal agencies and ensure that contractors, among others, were adequately protecting classified information. For the purposes of this report, we will use “contractor” to refer to any party that the program applies to, including contractors, grantees, licensees, certificate holders, and their respective employees.

DSS Responsibilities

DSS is responsible for administering the National Industrial Security Program on behalf of the Department of Defense and, by mutual agreement, 32 other federal departments and agencies. Headquartered in Quantico, Virginia, and with staff in 26 field offices across four regions, DSS provides oversight, advice, and assistance to more than 12,000 U.S. facilities that are cleared for access to classified information under the program. Facilities can range in size and be located anywhere in the United States, and include manufacturing plants, laboratories, and universities. In addition, they can also include contractor personnel who travel to U.S. government sites to access classified information but do not store any classified information at their facility. There are multiple reasons why a contractor may need access to classified government information. For example, a factory may produce parts for a major weapons system using a production process that is classified, or a contractor may have employees who deliver their technical expertise in a classified environment at a military installation.

National Industrial Security Program Operating Manual

As part of the facility clearance process, DSS is responsible for ensuring that cleared contractors safeguard classified information under the program by meeting requirements, which are outlined in the National Industrial Security Program Operating Manual. The Secretary of Defense, in consultation with all affected agencies and with the concurrence of the Secretary of Energy, the Nuclear Regulatory Commission, the Director of National Intelligence, and the Secretary of Homeland Security, issues and maintains the operating manual. The operating manual addresses the contractors’ key responsibilities such as reporting incidents of suspected loss of classified information. The Information Security Oversight Office of the National Archives and Records Administration, an agency separate from the Department of Defense, monitors the National Industrial Security Program and issues implementing directives for agencies. The Information Security Oversight Office also chairs the program’s policy advisory council, which is comprised of government and industry representatives who recommend changes to industrial security policy. The Department of Defense, including DSS, has periodically issued information for contractors in the program, such as industrial security letters, to clarify the operating manual.

The operating manual states that a contractor or prospective contractor is eligible for a facility clearance if it has a need for access to classified information in connection with a legitimate U.S. government contracting requirement. A facility clearance is an administrative determination that, from a national security standpoint, a contractor or prospective contractor is eligible to access classified information at a specified level. A contractor’s employees cannot begin accessing classified information until the facility clearance has been granted, even if that results in delayed performance of a contract.

Facility Clearance Process

According to the operating manual, in order for a contractor or prospective contractor to enter the program, it may be sponsored by an already cleared contractor or the government contracting activity. DSS requires information about the contract, subcontract, or solicitation that necessitates a clearance, such as level of safeguarding required and a brief description of the procurement. Within the government contracting activity, the information may be provided by the contracting office, program office, or security office. DSS begins its facility clearance process once it receives the information and assigns the case to an industrial security representative at a local DSS field office. The industrial security representative serves as the primary point of contact for the sponsored facility during the clearance process and once the contractor is eligible to access classified information. Across DSS field offices and headquarters, multiple people are involved in the facility clearance process, including those who specialize in information systems or others who have experience with analyzing contractors for indicators of foreign influence. See figure 1 for more details about how DSS processes a facility clearance.

As shown in the figure above, DSS also reviews the contractor’s ownership and business structure to assess whether foreign interests indicate a contractor is under foreign influence, which could lead to disclosure of classified information to foreign nationals. Contractors are required to answer questions about whether there is foreign involvement in their ownership, board composition, debt, source of revenues, and any other situations where foreign nationals might be in a position to influence their operations. If DSS determines that there is a risk for foreign influence, the contractor is ineligible for a facility clearance unless, and until, security measures are put in place, such as negotiating a mitigation agreement with DSS. As of June 2017, approximately 630 of the over 12,000 cleared facilities in the program have mitigation agreements in place to address foreign influence.

As part of the facility clearance process, certain personnel, such as the facility security officer, must receive personnel clearances to the level of the facility clearance. In the personnel clearance process, specialists at DSS headquarters grant interim clearances to U.S. citizens based on national security standards and information from background investigations conducted by the Office of Personnel Management, if there is no adverse information of material significance. Before the facility clearance can be granted, a DSS industrial security representative verifies that the key management personnel have received their permanent clearance.

Contractor Responsibilities for Cleared Facilities

After DSS completes the facility clearance process and determines that a contractor is eligible to access classified information and grants the facility security clearance, the cleared contractor officially enters the National Industrial Security Program. Once in the program, contractors establish a security program at cleared facilities or implement security measures required by the Department of Defense security agreement, as well as any elements required by DSS. Depending on the facility, security measures may address a variety of industrial security issues. For example, a contractor may be required to start using visitor logs or badges to track every person with physical access to a facility or establish separate computer systems for the sole purpose of storing classified information. In addition, contractors are required to implement insider threat programs, which are meant to prevent persons with approved access to classified information, such as contractor employees, from causing harm to national security through unauthorized disclosures. The insider threat programs may include activities such as training programs about reporting requirements or monitoring classified information systems.

DSS monitors cleared contractor facilities to determine their compliance with the program’s requirements for protecting classified information by conducting periodic security reviews. DSS determines the frequency of these reviews, although they generally cannot take place more than once in a 12-month period, according to the operating manual. The duration of security reviews and the size of the team conducting them vary by facility. For example, a single industrial security representative can perform a review of a small facility with no classified information stored on site in one day. By comparison, a large facility may require a lengthier review that involves additional DSS officials, such as information system security professionals who review a facility’s information systems if they are needed to store or process classified information. Moreover, counterintelligence officials may also participate and provide threat information about the facility. Security reviews are generally led by staff located in DSS’s 26 field offices across the country. A contractor’s facility clearance may be subject to invalidation or revocation if DSS identifies certain vulnerabilities, among other things. See figure 2 for more information about DSS’s process for monitoring contractor facilities in the program.

In addition to administering the facility clearance process and conducting security reviews at cleared facilities, DSS also collects information from cleared contractors about suspicious contacts, which may involve efforts by an individual to obtain illegal or unauthorized access to classified information, among other things. DSS aggregates this information to identify counterintelligence trends among cleared contractors and refers cases to the relevant agency for further investigation or action.

We last issued reports about the National Industrial Security Program in 2004 and 2005. In 2004, we made eight recommendations for DSS to improve its processes for conducting security reviews, such as taking steps to quickly notify government contracting activities when classified information has been lost or compromised. The Department of Defense agreed with our recommendations. In 2005, we made eight recommendations about DSS’s oversight of contractors under foreign influence. For example, we recommended that DSS collect and analyze data about foreign business transactions in order to improve its oversight of contractors under foreign influence. The Department of Defense partially agreed with our recommendations and subsequently took action to address them. As of April 2018, 13 of 16 of the recommendations have been implemented. For more detail on our prior recommendations, please see appendix II.

DSS Upgraded Capabilities for the National Industrial Security Program but Faces Challenges Monitoring Contractors Streamlined Clearance Processes

Since 2005, when we last reviewed how DSS administered the National Industrial Security Program, it has streamlined its facility clearance process in order to make it more efficient. DSS has also strengthened the process to analyze contractors for foreign influence and the Department of Defense issued a rule to clarify policies and procedures for mitigating foreign influence concerns. Despite upgrading its capabilities, DSS continues to face challenges in monitoring cleared contractors with access to classified information.

In 2004 and 2005, we reported that DSS did not collect and analyze data on contractors operating in the National Industrial Security Program. For example, DSS was not able to analyze data to make informed resource decisions or track key changes that affect contractors operating under foreign influence. In our 2005 report, we recommended that DSS collect and analyze data about foreign business transactions, among other things. As a result, DSS streamlined its facility clearance process by developing two electronic systems for tracking the facility clearance requests and maintaining information on cleared facilities. 1. The Electronic Facility Clearance System is a web-based system that contractors or prospective contractors use to submit their required information, such as key management personnel and other staff who need to be cleared for access as well as business-related items like articles of incorporation, bylaws, and other supporting documentation. 2. The Industrial Security Facilities Database is another web-based system that serves as a repository for information about cleared facilities.

DSS field office and contractor officials we spoke with noted that the web- based systems help them do their job more efficiently. For example, DSS’s industrial security representatives stated that these systems make the facility clearance and monitoring process more efficient because it is easier to track the status of documentation received. Industrial security representatives also track conditions that may require changes to their monitoring process through this database, such as a change in ownership or key management personnel. Industrial security representatives noted that being able to track this information electronically is helpful because the facility clearance and monitoring processes involve numerous officials within DSS, as well as other parties, such as the government contracting activity and the contractor. For example, a government contracting activity can use the database to check whether a facility has been cleared to store classified information onsite before sending materials to them.

In 2017, DSS started the process of modernizing these systems by developing two new systems. DSS officials stated that these two new systems will provide additional automation that can be used in the facility clearance and monitoring processes. The new systems are:

National Industrial Security Program Contracts Classification System. This system collects detailed information about classified contract(s) a facility will support during the initial clearance process as well as throughout the duration of the facility’s clearance, to include the facility’s assets (e.g. technology produced or expertise provided), and enables the government contracting activity to gain visibility into the subcontractors performing work for each classified contract.

National Industrial Security System. This system will be the official repository for data on cleared facilities. DSS officials noted that the system will help identify foreign influence concerns, such as changes in a contractor’s ownership, because they will be more centrally tracked.

Further, in 2017, DSS also issued a manual to reflect an updated process for assessing and authorizing cleared contractors’ information systems that process classified information. DSS changed its process to align with the intelligence community, the Department of Defense, and other federal government agencies’ standards. DSS previously reviewed systems on regular cycles and is shifting to reflect practices in the intelligence community that are based on assessed threats and target the information systems that pose the most significant risk of losing information. DSS information security system professionals told us that this new authorization process is helping them clarify and communicate the nature of security risks to the contractor. The updated process is intended to include the identification of cybersecurity concerns earlier than the prior approach and enables DSS’s information system security professionals to adjust their monitoring to meet emerging cyber threats.

Centralized Support and Strengthened Its Process to Identify Foreign Influence

In response to recommendations we made in 2005, DSS has centralized its support related to identifying and mitigating foreign influence and strengthened its process, including issuing a rule to make the process of mitigation of foreign influence clearer to contractors. Since our last review of the program in 2005, DSS has centralized staff expertise in headquarters to improve the identification and mitigation of foreign influence concerns. Whereas DSS used to rely primarily on field staff to negotiate and oversee individual facilities in their respective regions, it now has staff in headquarters, including specialists in law and other areas, who have an agency-wide view of threats and who understand the portfolio of contractors that may be at risk of foreign influence. DSS officials said that this is important because a contractor may have multiple cleared facilities across several regions. They noted that an agency-wide view helps DSS identify trends across facilities that may be tied to a single contractor. The headquarters staff: negotiate and put in place mitigation agreements that require contractors under foreign influence to acknowledge and mitigate foreign influence risks, including the development of protective measures to reduce the risk of foreign interests gaining access to classified information; identify foreign influence within cleared contractors and provide written analysis to DSS field offices when foreign influence concerns are identified, such as when a foreign contractor acquires a majority or substantial minority position in a U.S. contractor with a cleared facility; and provide subject matter expertise in the areas of business, acquisition, intelligence, and international law to develop a comprehensive understanding of companies, their industries and technologies, as well as the regulatory environments in foreign countries.

DSS officials acknowledged that the establishment of a headquarters division in 2008 focused on analyzing foreign influence and issuing related publications was in response to recommendations we made in 2005. DSS’s field office industrial security representatives said that the written products and specialized foreign influence analysis prepared and disseminated by DSS headquarters has resulted in more timely identification and mitigation of these issues. Examples include:

NISP in the News, an internal weekly publication that provides a summary of business transactions that may result in the need for a mitigation agreement to address foreign influence. Industrial security representatives we spoke with said this publication helps them identify and proactively address issues with their contractors. DSS officials told us the publication is helpful because it can result in more timely identification and initiate the process for negotiating a mitigation agreement, particularly in cases where a foreign company acquires a facility previously owned by a U.S. contractor. Copies of NISP in the News that we reviewed also included information that may affect contractors that are not under a mitigation agreement for foreign influence, such as changes in key management personnel. We previously reported that DSS had challenges identifying these transactions or facility security officers would neglect to report them, which led to delays in putting protective measures in place to prevent unauthorized access to classified information.

Assessments of new contractors that have been sponsored for clearances, which are used to identify and mitigate foreign influence. DSS industrial security representatives stated that this analysis used to be performed in the field but now they can use time previously spent preparing analysis of foreign influence to work with contractors to implement security measures. Further, the assessments help them work more effectively with contractors because they draw upon expertise across different disciplines. For example, 7 of the 13 facility case files we reviewed contained a summary of analysis conducted by specialists in DSS headquarters. The summaries also noted that the specialists reviewed classified and unclassified information on the contractor, including counterintelligence information and other U.S. government information, as applicable.

In April 2014, the Department of Defense issued a rule about policies and procedures for mitigating foreign ownership, control, or influence. This rule was issued in order to ensure maximum uniformity and effectiveness in the Department of Defense implementation of the National Industrial Security Program. The rule detailed specific mitigation approaches for addressing concerns about foreign ownership, control, or influence, which we cover in detail in appendix I. The rule clarified the role of DSS, the government contracting activity, and the contractor during the process when DSS determines that the contractor needs to mitigate potential foreign ownership, control, or influence. The rule also documented policies and procedures regarding how decisions will be made on the appropriate method to mitigate foreign ownership, control, or influence. These include the timing of agency and contractor actions involved in mitigation of foreign ownership, control, or influence and how to proceed in cases where the contractor had not worked out a mitigation agreement with DSS before changed conditions (e.g. indebtedness, ownership, or foreign intelligence threat) occurred, among other things. The rule further stated that DSS, in consultation with the government contracting activity, has discretion to modify or reject the contractor’s outlined action plan to mitigate foreign ownership, control, or influence.

Challenges Remain

Despite upgrading its capabilities, DSS officials indicated that they face resource constraints, such as an inability to manage workloads and complete training necessary to stay informed on current threats and technologies. DSS’s current resource challenges include:

Managing staff workloads. DSS field officials acknowledged that they have historically faced workload challenges. DSS officials said that their limited staff carry heavy workloads and, according to DSS’s most recent biennial report to Congress, were unable to conduct security reviews at about 60 percent of cleared facilities in fiscal year 2016. In addition to their official security reviews, industrial security representatives also conduct informal “advise and assist” efforts when facility officials inquire about a range of security issues, from preparing employees for overseas travel to providing training on reporting suspicious contacts. In fiscal year 2016, industrial security representatives conducted about 22,000 “advise and assist” efforts. DSS officials attribute the heavy workload to the current staffing levels of their field offices and frequent turnover among the industrial security representatives.

DSS officials noted that both hiring and retention are difficult and that these challenges are exacerbated by the fact that it is a relatively small agency with field offices with limited staff. For example, an average field office oversees about 470 facilities and has about 8 industrial security representatives on staff. As a result, if a person leaves, it adds strain to the remaining staff. Most of the contractors’ facility security officers we spoke with noted that DSS field officials have heavy workloads that could affect their ability to respond to threats at cleared facilities. Further, DSS indicated that it has limited resources to analyze, process, and distribute counterintelligence to the cleared facilities. For example, DSS received more than 46,000 reports from cleared contractors about suspicious contacts in fiscal year 2016, which was an almost 18 percent increase over the prior year. In comparison, during the same time period, DSS’s counterintelligence directorate, which analyzes suspicious contact reports, grew by 7 percent. In addition, DSS’s ability to distribute counterintelligence is limited by the geographic distribution of over 12,000 cleared facilities and each facility’s capability to receive or store classified communication.

Developing foreign influence mitigation agreements. Multiple DSS industrial security representatives and contractors’ facility security officers stated that mitigation agreements to address the risk of foreign influence, including supplemental plans, have become more detailed and the process to develop and implement them has required additional time and resources. For example, DSS may require a contractor to develop an electronic communications plan, which must include details about which networks will be protected from access by a foreign parent contractor, including monitoring, maintaining, and establishing separate email servers, as appropriate. DSS reported in its 2015 biennial report to Congress that the average amount of time to approve and implement a foreign influence mitigation plan was 93 days. The length of time to approve and implement a foreign influence mitigation plan more than doubled to 204 days, according to the 2017 biennial report. DSS officials stated that this increase is due, in part, to increased complexity of the agreements and the amount of coordination required between the government contracting activity, DSS, and the contractor. A DSS official also noted that over time, the agency has incorporated more information in its analysis and sometimes needs more time to review all the information that may be relevant.

Attending relevant trainings. DSS officials in three of four regions noted that staffing challenges affect their ability to take training, even though industrial security matters continue to become more sophisticated. Information system security professionals said they face challenges in learning technology that continues to evolve. For example, they cited the multiple software products such as operating systems and configurations of information networks that are used in a facility’s daily operations. In addition, they need to understand other technologies that can pose risks to industrial security, such as devices that are capable of transmitting data, like cellular phones, and therefore might need to be prohibited from areas where classified information is discussed. As a result, the lack of expertise in multiple technologies hampers their ability to identify vulnerabilities that might leave a facility at risk for loss of classified information. We have previously reported that training staff in new skills, such as cybersecurity, remains an ongoing challenge for the federal government. For example, in 2016, we found that chief information officers throughout the government identified difficulties related to recruiting, hiring, and retaining qualified personnel, as well as ensuring they have the appropriate skills and expertise.

DSS Has Not Determined How It Will Collaborate with Stakeholders As It Pilots a New Approach

In 2017, DSS announced its plans to transition to a new approach to monitoring cleared facilities in order to address emerging threats to classified information. DSS faces challenges as it pilots its new approach—DSS in Transition. DSS has taken steps to begin addressing challenges, including scheduling training for its staff, but has not documented how it will collaborate with its stakeholders or identified the resources needed to monitor cleared facilities.

New Approach to Monitoring Cleared Facilities

In 2017, DSS announced that it would begin transitioning to an asset-and- threat-based monitoring approach. DSS has reported that the United States is facing the most significant foreign intelligence threat it has ever encountered and adversaries are attacking cleared facilities at unprecedented rates. In fact, adversaries are varying their methods and adjusting their priorities based on the targeted information they need. The new approach is expected to involve DSS working collaboratively with contractors and government contracting activities to design a customized security plan for each facility based on threats specific to its assets rather than using a standardized worksheet to perform security reviews. DSS officials said that customized security plans will be developed based on assets at the specific facilities. For example, a contractor providing information technology services may need the latest software to thwart cyberattacks while a contractor that engineers weapons systems may need additional secure storage facilities and work areas to ensure an adversary cannot physically extract classified information or technology. As a result, according to agency officials, these customized security plans represent a departure from a “one size fits all” or schedule-driven approach to overseeing contractors’ protection of classified information. According to DSS officials, this new approach, DSS in Transition will use the Department of Defense’s list of critical technologies and programs, along with counterintelligence, to prioritize facilities for security reviews based on their assets and the severity of the threats to them. See table 1 for more information about the monitoring approaches.

After announcing DSS in Transition in 2017, DSS began taking steps to develop its methodology for the new approach, including prioritization of facilities and developing procedures for executing customized security plans. In a January 2018 letter to industry, DSS stated that it plans to pilot the new approach by working with one facility in each of its four regions to develop a customized security plan and use the lessons learned to refine the process. While it is piloting the approach at four facilities, DSS notified contractors not participating in the pilot that DSS would partner with selected facilities to identify and document their critical assets. Industry, including contractors and prospective contractors that are interested in U.S. government contract awards in the future, are awaiting more details on how DSS plans to implement DSS in Transition, including who would be responsible for the costs of additional security requirements, according to a March 2018 statement from the industry spokesperson of the National Industrial Security Program Policy Advisory Committee.

Collaboration Needed with Stakeholders As It Pilots the New Approach

Although DSS began piloting DSS in Transition in January 2018, it has not determined how it will collaborate with government contracting activities, the intelligence community, other federal agencies, and contractors. In particular, DSS has not identified its stakeholders’ roles and responsibilities in terms of who needs to communicate and coordinate with whom and when, which is necessary to successfully implement the new approach. For example, DSS needs to establish agreed-upon criteria for what information a government contracting activity would need to provide to DSS in order to develop a customized security plan for a facility. GAO’s Federal Internal Control Standards establish the need to coordinate with stakeholders and clearly define roles and responsibilities, among other things. In addition, our leading practices for interagency collaboration state that successful collaborative working relationships require organizations to agree on roles and responsibilities and identify the resources necessary to accomplish objectives. For example, GAO found it is unclear how DSS will determine what resources it needs as it has not identified the necessary roles and responsibilities. DSS has taken steps to begin addressing these challenges by establishing an office dedicated to documenting processes and procedures for how DSS in Transition will be implemented, providing a concept of operations, and scheduling training for its staff. However, to monitor cleared facilities, DSS needs information from the various National Industrial Security Program stakeholders, including:

Government contracting activity. DSS officials stated that, under the new approach to monitoring cleared facilities, they will need to better communicate and coordinate with the government contracting activity. For example, in some circumstances, DSS officials will have to collaborate with government contracting activities to determine when a security plan is no longer sufficient as threats and mitigation methods evolve. DSS officials stated that communication and coordination with government contracting activities has been a challenge because industrial security is often considered an added duty on top of their contract management responsibilities. Further, DSS officials indicated that staff turnover at government contracting activities and the lack of clear roles and responsibilities have led to delays in resolving a facility’s vulnerabilities. According to DSS officials, it is difficult to determine whether they have the correct point of contact at the government contracting activity to discuss vulnerabilities at a facility, which, if left unaddressed, can leave classified information at risk for loss. There are no formal agreements about how a case should be elevated and resolved if DSS identifies vulnerabilities and is unable to elicit a response from the government contracting activity about further action, according to DSS officials. In addition, DSS officials stated that they will need to work with the government contracting activity to assess the risk of security vulnerabilities that involve subcontractors working on contracts containing classified information. In the past, a government contracting activity might not know the identities of subcontractors if they were sponsored by a cleared contractor. Given the adversaries’ ability to vary its methods to target information it needs, the government needs to know who—regardless of subcontracting tier—is accessing classified information.

Government intelligence community. We found DSS has not established how it will collaborate with the intelligence community, including formalizing roles and responsibilities for its new approach. A DSS counterintelligence official told us that DSS currently relies on a combination of its own counterintelligence staff and informal coordination with other agencies, such as the Federal Bureau of Investigation. Another DSS official stated that they have worked with the Federal Bureau of Investigation to deliver counterintelligence when a facility does not have the capacity to receive classified information electronically. According to DSS field officials, the current process is handled on a case-by-case basis, depending on the availability of resources. Although DSS’s Counterintelligence Directorate recently became part of the intelligence community and will potentially have greater access to counterintelligence data, it will need to determine how to regularly communicate with the intelligence community to fully understand their products and share current threats and vulnerabilities with certain contractors under DSS in Transition.

Other government agencies. DSS relies on collaborating with other cognizant security agencies to develop a complete picture of the threats to contractors. In addition to the Department of Defense, there are four other federal agencies that have authority to inspect and monitor facilities to ensure the protection of classified information. DSS may only conduct security reviews for facilities performing contracts awarded by these agencies if the Department of Defense is the cognizant security agency for that facility. Contracts where another agency is the cognizant security agency may involve information coveted by adversaries, but DSS industrial security representatives have acknowledged that they may not know why the information is coveted or that it exists. Given the new approach to develop a complete picture of threats to a facility, DSS will need additional information from other cognizant security agencies that it may not have sought in the past. As a result, DSS needs to establish how best to collaborate with other agencies, such as identifying appropriate points of contacts and specific time frames to conduct outreach, to effectively implement DSS’s new approach to monitor contractors.

Cleared contractors. DSS officials said that DSS in Transition will require contractors to identify assets in a greater level of detail than what was previously expected of them. In order to develop a security plan unique to the facility, the contractor’s facility security officers will need to understand these assets and why adversaries would want to target them in order to develop and implement specific security measures. Since DSS officials cannot be onsite every day, they have to rely on the contractor’s facility security officer or other key management personnel at cleared facilities to identify and report potential problems. However, DSS officials noted that convincing facility staff to spend more time on security-related matters may be difficult at facilities where one employee may serve as the contractor’s facility security officer in addition to having other responsibilities. In addition, DSS officials stated that contractors’ security costs are typically not profit-generators and realize that DSS in Transition may require the contractor to expend more time, money, and energy to address vulnerabilities or enact policies to safeguard against adversaries.

DSS recognizes the need to keep industry informed and its implementation plans for DSS in Transition need to address what level of communication and coordination is required. For example, DSS currently uses a rating system to indicate how well a contractor is meeting the requirements of the operating manual as a metric for how it is protecting classified information. As DSS moves toward developing customized security plans that are unique to each facility’s threats and assets, it needs to formalize new approaches to communicate with contractors how well they are protecting classified information.

In addition to piloting DSS in Transition, DSS is reassuming responsibility for conducting background and security investigations for the Department of Defense, which could potentially magnify its workload challenges. DSS previously held these responsibilities but they were transitioned to the Office of Personnel Management in 2005. The National Defense Authorization Act of Fiscal Year 2018 required DSS to reassume this background and security investigations mission by implementing a phased transition by October 1, 2020. This phased transition will overlap with DSS’s piloting of DSS in Transition and may create disruptions as an agency of over 700 employees assumes responsibility for a background and security investigations mission that currently has more than 7,000 employees and contractors. In January 2018, we added personnel security clearances to our high-risk list, a list of federal areas in need of either broad-based transformation or specific reforms to prevent waste, fraud, and abuse. This issue is on the list because we identified: (1) a significant backlog of background investigations; (2) a lack of long-term goals for increasing federal and contractor-provided investigator capacity to address the backlog; and (3) delays in the timely processing of security clearances among other factors. DSS officials have identified potential benefits and challenges with reassuming the background investigations mission, and, in August 2017, the Department of Defense submitted a plan for a 3-year phased transition to assume the background and security investigations mission. In March 2018, we reported that this transition could potentially affect the timely processing of personnel security clearances, the backlog, and other reform initiatives but the effect is unknown at this time.

Conclusions

Given the changing nature of threats to classified information, DSS needs to ensure that classified information is protected from unauthorized access. While DSS has upgraded its capabilities for identifying foreign influence, DSS officials acknowledged that adversaries continue to evolve, and classified information and technologies remain vulnerable to exploitation. In response, in 2017, DSS launched a new approach (DSS in Transition) to change how it oversees contractors with access to classified information. As DSS pilots the new approach, it will need to work with government contracting activities, the intelligence community, other agencies, and cleared contractors to determine their roles and responsibilities in protecting classified information at every facility in the program. Without the necessary information—that is gained through communicating and coordinating with stakeholders—to assess the threats to the nation’s most critical technologies and programs, DSS will be unable to provide appropriate oversight that addresses the most significant threats to industrial security. Also, DSS has not identified the resources necessary, including the number of personnel needed to implement its new approach, which will add pressure to an agency accepting a background and security investigations mission that has significant backlog and timeliness challenges. Until DSS identifies roles and responsibilities and determines how it will collaborate with stakeholders for the pilot, it will be difficult to assess whether the new approach is effective in protecting classified information.

Recommendation for Executive Action

We are making one recommendation to the Director of the Defense Security Service: Determine how it will collaborate with stakeholders as it pilots a new approach to overseeing contractors with cleared facilities (DSS in Transition), including identifying roles and responsibilities and the related resources needed. (Recommendation 1)

Agency Comments and Our Evaluation

We provided a draft of this report for review and comment to DSS.

DSS provided written comments, which are reproduced in appendix III. In its comments, DSS concurred with the recommendation and summarized actions it is taking to pilot its new approach (DSS in Transition). DSS also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, Director of DSS, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Methods for Mitigating Foreign Influence

Since our July 2005 report, the Defense Security Service (DSS) has taken additional steps to address oversight of contractors with foreign influence. In April 2014, the Department of Defense issued a rule that clarified policies for oversight of contractors under foreign ownership, control, or influence. The rule detailed specific mitigation approaches for addressing foreign ownership, control, or influence concerns. The rule provided detail regarding the terms of each of these types of foreign ownership, control, or influence mitigation agreements and the circumstances under which each may be appropriate. The types of mitigation specified in the rule are:

Board Resolution. The board resolution may be used when a foreign entity does not own voting interests sufficient to elect a representative to the company’s governing board.

Security Control Agreement. The security control agreement is a tailored foreign ownership, control, or influence mitigation agreement, often used when a foreign interest does not effectively own or control a company or corporate family but the foreign interest is entitled to representation on the company’s board.

Special Security Agreement. The special security agreement may be used when a company is effectively owned or controlled by a foreign interest. Access to certain proscribed classified information by a company cleared under this agreement may require that the government contracting activity complete a National Interest Determination to determine that the release of proscribed information to the company is consistent with the national security interests of the United States.

Voting Trust Agreement and Proxy Agreement. These foreign ownership, control, or influence mitigation agreements may be used when a foreign interest effectively owns or controls a company or corporate family. Under these agreements, the foreign owner relinquishes most rights associated with ownership of the company to cleared United States citizens approved by the U.S. government.

DSS has clarified the types of supplemental plans that companies must submit to document specific steps that it will take to mitigate foreign influence. Table 2 describes the types of plans and provides examples of how they mitigate foreign influence.

Appendix II: Status of Prior GAO Recommendations Related to the National Industrial Security Program

In 2004 and 2005, GAO issued reports about the National Industrial Security Program and made 16 recommendations. Prior to the start of our review, the Department of Defense, through the Defense Security Service (DSS), implemented two of the recommendations. Below is our assessment of whether DSS addressed the remaining 14 recommendations that had been previously recorded as “closed – not implemented”.

Table 3 provides a summary of those recommendations and the actions that DSS has taken in response to the recommendations. A number of the recommendations we made were aimed at clarifying policies related to contractors under foreign influence that were part of the National Industrial Security Program. The primary evidence to support our conclusions is cited in the last column.

In GAO-04-332, we made eight recommendations that were recorded as closed not implemented prior to the start of this review. Based on information obtained during this review, seven of the recommendations will be closed as implemented. The recommendation that remains closed as not implemented was outside of the scope of the current review.

In GAO-05-681, we made eight recommendations and two of the recommendations were closed as implemented prior to this review. Based on information obtained during this review, four of the remaining six recommendations will be closed as implemented. We were unable to close two of the six recommendations as implemented based on the information provided during this review.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Marie A. Mak, (202) 512-4841 or makm@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Penny Berrier (Assistant Director), Lorraine Ettaro, Gina Flacco, Stephanie Gustafson, John Rastler, Sylvia Schatz, Roxanna Sun, Alyssa Weir, and Jocelyn Yin made key contributions to this report.