Although our high-risk designation covers only DOD’s program, our reports have also documented clearance-related problems affecting other agencies. For example, our October 2007 report on state and local information fusion centers cited two clearance-related challenges: (1) the length of time needed for state and local officials to receive clearances from the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) and (2) the reluctance of some federal agencies—particularly DHS and FBI—to accept clearances issued by other agencies (i.e., clearance reciprocity). Similarly, our April 2007 testimony on maritime security and selected aspects of the Security and Accountability for Every Port Act (SAFE Port Act) identified the challenge of obtaining clearances so that port security stakeholders could share information through area committees or interagency operational centers. The SAFE Port Act includes a specific provision requiring the Secretary of Homeland Security to sponsor and expedite individuals participating in interagency operational centers in gaining or maintaining their security clearances. Our reports have offered findings and recommendations regarding current impediments, and they offer key factors to consider in future reforms. For example, as the interagency security clearance process reform team develops a new governmentwide end-to-end clearance system, this reform effort provides an opportune time to consider factors for evaluating intermediate steps and the final system in order to optimize efficiency and effectiveness. The Director of National Intelligence’s July 25, 2007, memorandum provided the terms of reference for the security clearance process reform team and noted that a future Phase IV would be used to perform and evaluate demonstrations and to finalize the acquisition strategy. In designing a new personnel security clearance system, the Government Performance and Results Act of 1993 (GPRA) may be a useful resource for the team designing the system and the congressional committees overseeing the design and implementation. GPRA provides a framework for strategic performance planning and reporting intended to improve federal program effectiveness and hold agencies accountable for achieving results. Agencies that effectively implement GPRA’s results-oriented framework clearly establish performance goals for which they will be held accountable, measure progress towards those goals, determine strategies and resources to effectively accomplish the goals, use performance information to make the programmatic decisions necessary to improve performance, and formally communicate results in performance reports. Our reports have also identified a number of directly relevant factors, such as those found in our November 2005 testimony that evaluated an earlier governmentwide plan for improving the personnel security clearance process. I will address the need for consideration of four key factors in my testimony: (1) a strong requirements-determination process, (2) quality emphasis in all clearance processes, (3) additional metrics to provide a fuller picture of clearance processes, and (4) long-term funding requirements of security clearance reform. The interagency security clearance process reform team established in July 2007 might want to address whether the numbers and levels of clearances are appropriate since this initial stage in the clearance process can affect workloads and costs in other clearance processes. For instance, the team may want to examine existing policies and practices to see if they need to be updated or otherwise modified. We are not suggesting that the numbers and levels of clearances are or are not appropriate—only that any unnecessary requirements in this initial phase use government resources that can be utilized for other purposes such as building additional quality into other clearance processes or decreasing delays in clearance processing. Figure 1 highlights the fact that the clearance process begins with establishing whether an incumbent’s position requires a clearance, and if so, at what level. The numbers of requests for initial and renewal clearances and the levels of such clearance requests (phase 2 in fig. 1) are two ways to look at outcomes of requirements setting in the clearance process. In our prior work, DOD personnel, investigations contractors, and industry officials told us that the large number of requests for investigations could be attributed to many factors. For example, they ascribed the large number of requests to the heightened security concerns that resulted from the September 11, 2001, terrorist attacks. They also attributed the large number of investigations to an increase in the operations and deployments of military personnel and to the increasingly sensitive technology that military personnel, government employees, and contractors come in contact with as part of their jobs. While having a large number of cleared personnel can give the military services, agencies, and industry a great deal of flexibility when assigning personnel, the investigative and adjudicative workloads that are required to provide the clearances and flexibility further tax a clearance process that already experiences delays in determining clearance eligibility. A change in the level of clearances being requested also increases the investigative and adjudicative workloads. For example, in our February 2004 report on impediments to eliminating clearance backlogs, we found that a growing percentage of all DOD requests for clearances for industry personnel was at the top secret level: 17 percent of those requests were at the top secret level in 1995 but 27 percent were at the top secret level in 2003. This increase of 10 percentage points in the proportion of investigations at the top secret level is important because top secret clearances must be renewed twice as often as secret clearances (i.e., every 5 years versus every 10 years). In August 2006, OPM estimated that approximately 60 total staff hours are needed for each investigation for an initial top secret clearance and 6 total staff hours are needed for the investigation to support a secret or confidential clearance. The doubling of the frequency along with the increased effort to investigate and adjudicate each top secret reinvestigation adds costs and workload for the government. Cost. For fiscal year 2008, OPM’s standard billing rate is $3,711 for an investigation for an initial top secret clearance; $2,509 for an investigation to renew a top secret clearance, and $202 for an investigation for a secret clearance. The cost of getting and maintaining a top secret clearance for 10 years is approximately 30 times greater than the cost of getting and maintaining a secret clearance for the same period. For example, an individual getting a top secret clearance for the first time and keeping the clearance for 10 years would cost the government a total of $6,202 in current year dollars ($3,711 for the initial investigation and $2,509 for the reinvestigation after the first 5 years). In contrast, an individual receiving a secret clearance and maintaining it for 10 years would result in a total cost to the government of $202 ($202 for the initial clearance that is good for 10 years). Time/Workload. The workload is also affected by the scope of coverage in the various types of investigations. Much of the information for a secret clearance is gathered through electronic files. The investigation for a top secret clearance, on the other hand, requires the information needed for the secret clearance as well as data gathered through time-consuming tasks such as interviews with the subject of the investigation request, references in the workplace, and neighbors. Since (1) the average investigative report for a top secret clearance takes about 10 times as many investigative staff hours as the average investigative report for a secret clearance and (2) the top secret clearance must be renewed twice as often as the secret, the investigative workload increases about 20-fold. Additionally, the adjudicative workload increases about 4-fold. In 2007, DOD officials estimated that it took about twice as long to review an investigative report for a top secret clearance, which would need to be done twice as often as the secret clearance. Unless the new system developed by the interagency security clearance process reform team includes a sound requirements process, workload and costs may be higher than necessary. Since the late 1990s, GAO has emphasized a need to build more quality and quality monitoring into clearance processes to achieve positive goals such as promoting greater reciprocity and maximizing the likelihood that individuals who are security risks will be scrutinized more closely. In our November 2005 testimony on the earlier governmentwide plan to improve the clearance process, we noted that the plan devoted little attention to monitoring and improving the quality of the personnel security clearance process, and that limited attention and reporting about quality continue. When OMB issued its February 2007 Report of the Security Clearance Oversight Group Consistent with Title III of the Intelligence Reform and Terrorism Prevention Act of 2004, it documented quality with a single metric. Specifically, it stated that OPM has developed additional internal quality control processes to ensure that the quality of completed investigations continue to meet the national investigative standards. OMB added that, overall, less than 1 percent of all completed investigations are returned to OPM from the adjudicating agencies for quality deficiencies. When OMB issued its February 2008 Report of the Security Clearance Oversight Group, it did not discuss the percentage of completed investigations that are returned to OPM or the development or existence of any other metric measuring the level of quality in security clearance processes or products. As part of our September 2006 report, we examined a different aspect of quality—the completeness of documentation in investigative and adjudicative reports. We found that OPM provided incomplete investigative reports to DOD adjudicators, which the adjudicators then used to determine top secret clearance eligibility. Almost all (47 of 50) of the sampled investigative reports we reviewed were incomplete based on requirements in the federal investigative standards. In addition, DOD adjudicators granted clearance eligibility without requesting additional information for any of the incomplete investigative reports and did not document that they considered some adjudicative guidelines when adverse information was present in some reports. GAO has long reported that it is problematic to equate the quality of investigations with the percentage of investigations that are returned by requesting agencies due to incomplete case files. For example, in October 1999 and again in our November 2005 evaluation of the governmentwide plan, we stated that the number of investigations returned for rework is not by itself a valid indicator of quality because adjudication officials said they were reluctant to return incomplete investigations in anticipation of further delays. We additionally suggested that regardless of whether this metric continues to be used, the government might want to consider adding other indicators of the quality of investigations, such as the number of counterintelligence leads generated from security clearance investigations and forwarded to relevant units. Further, our September 2006 report recommended that OMB’s Deputy Director of Management require OPM and DOD to (1) submit their procedures for eliminating the deficiencies that we identified in their investigative and adjudicative documentation and (2) develop and report metrics on completeness and other measures of quality that will address the effectiveness of the new procedures. We believe that our recommendation still has merit, but the previously cited passage from the February 2007 OMB report does not describe the new procedures or provide statistics for the recommended new quality measures and the 2008 OMB report is silent on quality measures. As we noted in September 2006, the government cannot afford to achieve its timeliness goal by providing investigative and adjudicative reports that are incomplete in key areas required by federal investigative standards and adjudicative guidelines. Incomplete investigations and adjudications undermine the government’s efforts to move toward greater clearance reciprocity. An interagency working group, the Security Clearance Oversight Steering Committee, noted that agencies are reluctant to be accountable for poor quality investigations and/or adjudications conducted by other agencies or organizations. To achieve fuller reciprocity, clearance-granting agencies need to have confidence in the quality of the clearance process. Without full documentation of investigative actions, information obtained, and adjudicative decisions, agencies could continue to require duplicative investigations and adjudications. Earlier, we stated that reciprocity concerns continue to exist, citing FBI and DHS reluctance to accept clearances issued by other agencies when providing information to personnel in fusion centers. Much of the recent quantitative information provided on clearances has dealt with how much time it takes for the end-to-end processing of clearances (and related measures such as the numbers of various types of investigative and adjudicative reports generated); however, there is less quantitative information on other aspects of the clearance process. In our November 2005 testimony, we noted that the earlier government plan to improve the clearance process provided many metrics to monitor the timeliness of clearances governmentwide, but that plan detailed few of the other elements that a comprehensive strategic plan might contain. A similar emphasis on timeliness appears to be emerging for the future governmentwide clearance process. In the Director of National Intelligence’s 500 Day Plan for Integration and Collaboration issued on October 10, 2007, the core initiative to modernize the security clearance process had only one type of metric listed under the heading about how success will be gauged. Specifically, the plan calls for measuring whether “performance of IC agency personnel security programs meet or exceed IRTPA guidelines for clearance case processing times.” While the February 2007 and 2008 OMB reports to Congress contain statistics and other information in addition to timeliness metrics (e.g., use of information technology and reciprocity-related procedures) and the joint team developing the new clearance process may be considering a wider range of metrics than timeliness only, an underlying factor in the emphasis on timeliness is IRTPA. Among other things, IRTPA established specific timeliness guidelines to be phased in over 5 years. The Act also states that, in the initial period which ends in 2009, each authorized adjudicative agency shall make a determination on at least 80 percent of all applications for personnel security clearance within an average of 120 days after the receipt of the application for a security clearance by an authorized investigative agency. The 120-day average period shall include a period of not longer than 90 days to complete the investigative phase of the clearance review and a period of not longer than 30 days to complete the adjudicative phase of the clearance review. Moreover, IRTPA also includes a requirement for a designated agency (currently OMB) to provide information on among other things the timeliness in annual reports through 2011, as OMB did in February 2008. Prior GAO reports as well as inspector general reports identify a wide variety of methods and metrics that program evaluators have used to examine clearance processes and programs. For example our 1999 report on security clearance investigations used multiple methods to examine numerous issues that included: documentation missing from investigative reports; the training of investigators (courses, course content, and number of trainees); investigators’ perceptions about the process; customer perceptions about the investigations; and internal controls to protect against fraud, waste, abuse, and mismanagement. Including these and other types of metrics in regular monitoring of clearance processes could add value in current and future reform efforts as well as supply better information for greater congressional oversight. The joint Security Clearance Process Reform team may also want to consider providing Congress with the long-term funding requirements to implement changes to security clearance processes enabling more informed congressional oversight. In a recent report to Congress, DOD provided funding requirements information that described its immediate needs for its industry personnel security program, but it did not include information about the program’s long-term funding needs. Specifically, DOD’s August 2007 congressionally mandated report on clearances for industry personnel provided less than 2 years of data on funding requirements. In its report, DOD identified its immediate needs by submitting an annualized projected cost of $178.2 million for fiscal year 2007 and a projected funding need of approximately $300 million for fiscal year 2008. However, the report did not include information on (1) the funding requirements for fiscal year 2009 and beyond even though the survey used to develop the funding requirements asked contractors about their clearance needs through 2010 and (2) the tens of millions of dollars that the Defense Security Service Director testified before Congress in May 2007 were necessary to maintain the infrastructure supporting the industry personnel security clearance program. As noted in our February 2008 report, the inclusion of less than 2 future years of budgeting information in the DOD report limits Congress’s ability to carry out its oversight and appropriations functions pertaining to industry personnel security clearances. Without more information on DOD’s longer-term funding requirements for industry personnel security clearances, Congress lacks the visibility it needs to fully assess appropriations requirements. In addition, the long-term funding requirements to implement changes to security clearance processes are also needed to enable the executive branch to compare and prioritize alternative proposals for reforming the clearance processes. As the joint Security Clearance Process Reform team considers changes to the current clearance processes, it may also want to consider ensuring that Congress is provided with the long-term funding requirements necessary to implement any such reforms. We were encouraged when OMB undertook the development of an earlier governmentwide plan for improving the personnel security clearance process and have documented in our prior reports both DOD and governmentwide progress in addressing clearance-related problems. Similarly, the current joint effort to develop a new governmentwide end- to-end security clearance system represents a positive step to address past impediments and manage security clearance reform efforts. Still, much remains to be done before a new system can be designed and implemented. GAO’s experience in evaluating DOD’s and governmentwide clearance plans and programs as well as its experience monitoring large- scale, complex acquisition programs could help Congress in its oversight, insight, and foresight regarding security clearance reform efforts. Madam Chairwoman and Members of the Subcommittee, this concludes my prepared statement. I would be happy to answer any questions you may have at this time. For further information regarding this testimony, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Jack E. Edwards, Acting Director; James P. Klein, Joanne Landesman, Charles Perdue, Karen D. Thornton, and Stephen K. Woods. DOD Personnel Clearances: Improved Annual Reporting Would Enable More Informed Congressional Oversight. GAO-08-350. Washington, D.C.: February 13, 2008. Homeland Security: Federal Efforts Are Helping to Alleviate Some Challenges Encountered by State and Local Information Fusion Centers. GAO-08-35. Washington, D.C.: October 30, 2007. Defense Business Transformation: A Full-time Chief Management Officer with a Term Appointment Is Needed at DOD to Maintain Continuity of Effort and Achieve Sustainable Success. GAO-08-132T. Washington, D.C.: October 16, 2007. DOD Personnel Clearances: Delays and Inadequate Documentation Found For Industry Personnel. GAO-07-842T. Washington, D.C.: May 17, 2007. Maritime Security: Observations on Selected Aspects of the SAFE Port Act. GAO-07-754T. Washington, D.C.: April 26, 2007. High-Risk Series: An Update, GAO-07-310 (Washington, D.C.: January 2007). DOD Personnel Clearances: Additional OMB Actions Are Needed To Improve The Security Clearance Process, GAO-06-1070. Washington, D.C.: September 2006. Managing Sensitive Information: DOD Can More Effectively Reduce the Risk of Classification Errors, GAO-06-706. Washington, D.C.: June 30, 2006. DOD Personnel Clearances: Questions and Answers for the Record Following the Second in a Series of Hearings on Fixing the Security Clearance Process. GAO-06-693R. Washington, D.C.: June 14, 2006. DOD Personnel Clearances: New Concerns Slow Processing of Clearances for Industry Personnel. GAO-06-748T. Washington, D.C.: May 17, 2006. DOD Personnel Clearances: Funding Challenges and Other Impediments Slow Clearances for Industry Personnel. GAO-06-747T. Washington, D.C.: May 17, 2006. Questions for the Record Related to DOD’s Personnel Security Clearance Program and the Government Plan for Improving the Clearance Process. GAO-06-323R. Washington, D.C.: January 17, 2006. DOD Personnel Clearances: Government Plan Addresses Some Long- standing Problems with DOD’s Program, But Concerns Remain. GAO-06- 233T. Washington, D.C.: November 9, 2005. Defense Management: Better Review Needed of Program Protection Issues Associated with Manufacturing Presidential Helicopters. GAO-06-71SU. Washington, D.C.: November 4, 2005. Questions for the Record Related to DOD’s Personnel Security Clearance Program. GAO-05-988R. Washington, D.C.: August 19, 2005. Industrial Security: DOD Cannot Ensure Its Oversight of Contractors under Foreign Influence Is Sufficient. GAO-05-681. Washington, D.C.: July 15, 2005. DOD Personnel Clearances: Some Progress Has Been Made but Hurdles Remain to Overcome the Challenges That Led to GAO’s High-Risk Designation. GAO-05-842T. Washington, D.C.: June 28, 2005. DOD’s High-Risk Areas: Successful Business Transformation Requires Sound Strategic Planning and Sustained Leadership. GAO-05-520T. Washington, D.C.: April 13, 2005. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 2005. Intelligence Reform: Human Capital Considerations Critical to 9/11 Commission’s Proposed Reforms. GAO-04-1084T. Washington, D.C.: September 14, 2004. DOD Personnel Clearances: Additional Steps Can Be Taken to Reduce Backlogs and Delays in Determining Security Clearance Eligibility for Industry Personnel. GAO-04-632. Washington, D.C.: May 26, 2004. DOD Personnel Clearances: Preliminary Observations Related to Backlogs and Delays in Determining Security Clearance Eligibility for Industry Personnel. GAO-04-202T. Washington, D.C.: May 6, 2004. Industrial Security: DOD Cannot Provide Adequate Assurances That Its Oversight Ensures the Protection of Classified Information. GAO-04-332. Washington, D.C.: March 3, 2004. DOD Personnel Clearances: DOD Needs to Overcome Impediments to Eliminating Backlog and Determining Its Size. GAO-04-344. Washington, D.C.: February 9, 2004. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In 2004, Congress passed the Intelligence Reform and Terrorism Prevention Act to reform security clearance processes. Much of GAO's experience in evaluating personnel security clearance processes over the decades has consisted of examining the Department of Defense's (DOD) program, which maintains about 2.5 million clearances on servicemembers, DOD civilian employees, legislative branch employees, and industry personnel working for DOD and 23 other federal agencies. Long-standing delays in processing applications--and other problems in DOD's clearance program--led GAO to designate it a high-risk area in 2005. GAO also has documented clearance-related problems in other agencies. For this hearing, GAO was asked to identify key factors that could be applied in personnel security clearance reform efforts. To identify key factors, GAO drew upon its past reports and institutional knowledge. For those reports, GAO reviewed laws, executive orders, policies, reports, and other documentation related to the security clearance process; examined samples of cases of personnel granted top secret eligibility; compared documentation in those sampled cases against federal standards; and interviewed a range of cognizant government officials. Current and future efforts to reform personnel security clearance processes should consider, among other things, the following four key factors: determining whether clearances are required for positions, incorporating quality control steps throughout the clearance processes, establishing metrics for assessing all aspects of clearance processes, and providing Congress with the long-term funding requirements of security clearance reform. Requesting a clearance for a position in which it will not be needed, or in which a lower- level clearance would be sufficient, will increase both costs and investigative workload unnecessarily. For example, changing the clearance needed for a position from a secret to top secret increases the investigative workload for that position about 20-fold and uses 10 times as many investigative staff hours. Emphasis on quality in clearance processes could promote positive outcomes, including more reciprocity among agencies in accepting each others' clearances. Building quality throughout clearance processes is important, but government agencies have paid little attention to quality, despite GAO's repeated suggestions to place more emphasis on quality. Even though GAO identified the government's primary metric for assessing quality--the percentage of investigative reports returned for insufficiency during the adjudicative phase--as inadequate by itself in 1999, the Office of Management and Budget and the Office of Personnel Management continue to use that metric. Concerns about the quality of investigative and adjudicative work underlie the continued reluctance of agencies to accept clearances issued by other agencies; as a result, government resources are used to conduct duplicative investigations and adjudications. Many efforts to monitor clearance processes emphasize measuring timeliness, but additional metrics could provide a fuller picture of clearance processes. The emphasis on timeliness is due in part to recent legislation that provides specific guidelines regarding the speed with which clearances should be completed and requires annual reporting of that information to Congress. GAO has highlighted a variety of metrics in its reports (e.g., completeness of investigative and adjudicative reports, staff's and customers' perceptions of the processes, and the adequacy of internal controls), all of which could add value in monitoring clearance processes and provide better information to allow improved oversight by Congress and the Executive Branch. Another factor to consider in reform efforts is providing Congress with the long-term funding requirements to implement changes to security clearance processes. DOD's August 2007 congressionally mandated report on industry clearances identified its immediate funding needs but did not include information on the funding requirements for fiscal year 2009 and beyond. The inclusion of less than 2 future years of budgeting data in the DOD report limits Congress's ability to carry out its long-term oversight and appropriations functions pertaining to industry personnel security clearances.