Except for summer employees and some contractors, the scope of DEA background investigations was designed to assess whether individuals met the requirements to receive a “top-secret” clearance. DEA used the results of these background investigations to (1) help determine whether individuals were suitable for employment and (2) provide a basis for granting a security clearance. Employees with top-secret clearances can have access to information classified up to and including the top-secret level. The unauthorized disclosure of classified information can cause irreparable damage to the national interest and loss of human life. Unless otherwise provided by law, the investigation of a person entering or employed by the federal government in the competitive service, or by career appointment in the Senior Executive Service, is the responsibility of OPM. Agencies may request delegated authority from OPM to conduct or contract out investigations of their own employees and applicants. DEA obtained this authority from OPM in the early 1980s. The two agencies executed a Memorandum of Understanding and Agreement, which transferred authority to DEA and set forth the general requirements that DEA must follow. The memorandum has been renewed periodically, but the most recent one expired in September 1998. Nevertheless, OPM and DEA have continued to follow it, according to officials from both agencies. The Memorandum of Understanding and Agreement between OPM and DEA required DEA to follow the background investigation standards used by OPM. These standards held that background investigations, needed to provide employees a top-secret clearance, must meet investigation requirements established by Executive Order 12968, “Access to Classified Information.” This executive order directed the President’s Security Policy Board to develop a common set of investigative standards to be used by executive agencies for determining eligibility for access to classified information. The President approved the standards that the Board developed in March 1997. DEA’s background investigations were part of its personnel security program. DEA’s Office of Security Programs was responsible for operating the program and, in connection with that responsibility, was to provide policy guidance and management of background investigations. This office was responsible for ensuring that appropriate investigations were completed on applicants and employees as well as providing security adjudication services for DEA. As part of these adjudication services, this office used the results of background investigations to determine whether individuals were suitable for employment and whether a security clearance should be granted. In addition to DEA, OPM and DOJ both had responsibility for overseeing the program and DEA’s background investigations. and (2) all positions in the legislative and judicial branches of the federal government and in the government of the District of Columbia made subject to the civil service laws by statute. background investigations that were made for these renewals were referred to as reinvestigations. In fiscal year 1998, an estimated 5,583 background investigations were conducted of DEA applicants and employees. Of that number, about 3,401 were initial background investigations and another 2,182 were reinvestigations. Most of the investigations (about 74 percent) and all of the reinvestigations in 1998 were done by one contractor. However, DEA Special Agents conducted the background investigations of persons who applied for Special Agent positions, which accounted for about 26 percent of all initial background investigations. Based on investigative standards implementing Executive Order 12968, a typical background investigation for a top-secret clearance would include major investigative components such as proof of birth and citizenship for subjects and their immediate family a search of investigative files and other records held by federal agencies, including the FBI and CIA (referred to as a national agency check); financial review, including a credit bureau check; review of state and local law enforcement and court records (referred to as a local agency check); verification of recent education; record checks and personal testimony at places of employment; interviews of references including coworkers, employers, friends, educators, neighbors, and other individuals such as an ex-spouse; and a personal interview with the applicant. To identify and describe the circumstances that led DEA to consider relinquishing its delegated authority to conduct personnel background investigations, we interviewed cognizant officials of DEA, DOJ, and OPM. We obtained and reviewed the Memorandum of Understanding and Agreement between DEA and OPM regarding this authority. We obtained and reviewed all appraisals of DEA’s personnel security program and/or the quality of background investigations done by OPM and DOJ since 1992, when DEA was first appraised by OPM as a separate DOJ component. We did not review individual background investigations or DEA’s personnel security program. We also did not determine whether any employee who received a security clearance based on a deficient background investigation would have been denied clearance if the investigation had been performed according to required standards. We obtained and reviewed an internal DEA assessment of its personnel security program. We also obtained and reviewed relevant correspondence between DEA, DOJ, and OPM related to DEA’s security program and its background investigations. To assess whether OPM acted in an independent and objective manner in choosing to review DEA’s background investigations and security program, we applied three criteria posed in the following questions: What was OPM’s responsibility for reviewing background investigations performed by DEA and/or its contractors? Did the frequency of OPM’s reviews seem reasonable given the state of DEA’s background investigations and program? Was the frequency of OPM’s oversight activities at other agencies with delegated authority similar or dissimilar to the frequency of OPM’s oversight at DEA? For this second objective, we reviewed Executive Order 10450, “Security Requirements for Government Employment,” which among other things specified OPM’s responsibilities for reviewing federal agencies’ personnel security programs. We also identified all agencies, in addition to DEA, that had received delegated authority from OPM to perform background investigations. We compared OPM’s oversight activities—the frequency of reviews and the results—to OPM’s oversight activities at DEA. We requested comments on a draft of this report from the Attorney General of the United States on behalf of DOJ and DEA. We also requested comments from the Director, OPM. OPM’s comments are discussed near the end of this letter and are reprinted in appendix I. DOJ orally provided technical and clarifying comments, which we incorporated into this report. We did our work in Washington, D.C., from May through July 1999 in accordance with generally accepted government auditing standards. As of July 1999, DEA was considering whether to relinquish its personnel- security background investigation authority to OPM. It had been brought to this point by the deficiencies found by OPM over much of the decade and because of an assessment DOJ made in 1997. DOJ initiated discussions with DEA in late 1998 about relinquishing its authority. Partially in response to this initiative, DEA conducted an assessment and concluded that it lacked the expertise and resources to capably perform or oversee all of its background investigations. Through a Memorandum of Understanding and Agreement with OPM, DEA was required to forward all background investigation reports to OPM when they were completed. OPM was required to review samples of reports to determine whether investigative requirements called for by the agreement were met. In addition to reviewing completed investigation reports, OPM was required to assess DEA’s overall personnel security program under which background investigations were conducted. OPM’s reviews of background investigation reports submitted by DEA continually found the investigations deficient. Between 1996 and 1998, OPM reviewed a total of 265 background investigations conducted by DEA and its contractors. OPM found all but one investigation deficient (i. e., all but one failed to fully comply with OPM investigative requirements, which DEA agreed to follow). Some of these background investigations contained a single deficiency while others contained more than one deficiency. There was no readily available tabulation of the deficiencies for all 264 investigations found deficient and the nature of those deficiencies. However, some information was available. The 49 DEA investigative reports that OPM found deficient in 1998 contained 221 deficiencies. Six reports contained one deficiency, and the remaining 43 reports contained multiple deficiencies. The types of deficiencies OPM identified include not determining the nature and extent of contact between a personal source and the subject of the investigation; gaps in coverage of the verification, through personal sources, of all of the subject’s major activities, unemployment, and means of support; lack of or inadequate follow-up of issues admitted during the personal interview or disclosed on the Questionnaire for National Security Positions; failure to search Central Intelligence Agency files related to subject’s foreign-born status or foreign travel; failure to provide information from public sources that was complete, such as bankruptcies, financial matters, and divorce; neglecting to supply verification of subject’s citizenship through Immigration and Naturalization Service searches; and failure to obtain appropriate verification of an individual’s name, date of birth, and place of birth through state and local bureaus of vital statistics. Generally, there is no standard for stating how serious a deficiency might be or what type is the most serious, because the deficiencies generally are errors of omission, such as failing to check a law enforcement record. Ultimately, a deficiency’s seriousness depends on what type of activity might have been found if the appropriate search had been conducted or if a particular investigative technique had been used. Also, a seemingly less serious deficiency may provide an investigative lead that uncovers activity that might compromise the nation’s security interest. OPM returned the reports that it found deficient to DEA for further work and correction. However, in 1998, when OPM followed up on the deficient reports that it identified in 1996 and 1997, OPM generally found that DEA had not corrected the deficiencies. OPM also found that even though the background investigations were deficient, DEA still granted security clearances. In addition to its periodic review of investigations, OPM also reviewed DEA’s overall personnel security program in 1992 and again 6 years later in 1998. OPM found numerous deficiencies in 1992, and it found that DEA still had not corrected most of those deficiencies in 1998. The OPM findings include the following: The reinvestigation program did not effectively identify employees who were subject to routine reinvestigations. At DEA, employees were required to have their security clearances renewed every 5 years. Many employees in “Critical Sensitive/Top-Secret” positions were overdue for reinvestigation. DEA’s Planning and Inspection Manual provisions were insufficient because they did not include pertinent OPM and DOJ regulatory guidelines. The manual, among other deficiencies, failed to incorporate administrative due process guidelines for applicants, employees, and contract employees to appeal the denial or revocation of a security clearance. Physical security safeguards for the storage and protection of investigative files were insufficient. Personnel security adjudicators whose job was to decide who would be granted security clearances needed additional training and oversight. DEA’s Background Investigation Handbook did not include mandatory OPM investigative requirements. DEA did not forward copies of all its completed background investigations to OPM, as required by the conditions of its delegated authority. In addition to OPM reviews, DEA’s security program was subject to compliance reviews by DOJ, which was responsible for the development, supervision, and administration of security programs within the department. In 1997, DOJ audited the DEA program and reported the results to DEA. Based on the results of this review and OPM’s reviews, DOJ initiated discussions with DEA in 1998 on relinquishing its background investigation authority to OPM. DOJ’s audit identified deficiencies that were similar to those that OPM identified in its review of DEA’s security program in 1992. OPM also found the same sort of deficiencies in 1998 after the DOJ audit. The DOJ findings identified issues and deficiencies in (1) periodic reinvestigations; (2) background investigations; (3) due process procedures; (4) resources for monitoring, tracking, and controlling the investigation process; (5) adjudication (process for deciding whether security clearances should be granted); and (6) staff competence. DOJ referred to its findings as critical security issues and deficiencies. In October 1998, the Assistant Attorney General for Administration wrote to the DEA Administrator expressing his belief that DEA’s investigative function should be relinquished to OPM but said as well that he would like to hear the DEA Administrator’s comments. The memorandum was based on the DOJ audit and on the recurring findings of OPM. In that memorandum, DOJ’s Assistant Attorney General also expressed concern with what DOJ saw as DEA’s inability to maintain an effective overall personnel security program. This inability came about, the memorandum stated, because resources were consumed in doing certain functions—checking federal records and performing quality control—that OPM performed when doing background investigations for other agencies. OPM checked the files of various federal agencies, such as the investigative and criminal history files of the FBI, by computer. Unlike OPM, DEA lacked the extensive computer links to federal files and did many file checks manually. Checking federal files were referred to as National Agency Checks in background investigations. In the Spring of 1999, DEA assessed its personnel security program, concentrating on background investigations. This assessment, according to DEA officials, was done in response to the Assistant Attorney General for Administration’s October memorandum, subsequent meetings with DOJ officials, and DEA’s own awareness of the condition of its personnel security program. The assessment covered areas such as the (1) results of reviews performed by OPM and DOJ, (2) requirements of the Memorandum of Understanding and Agreement with OPM, (3) efforts to correct deficiencies with the security program and background investigations, (4) contract with the company that currently did background investigations for DEA, and (5) other management issues related to background investigations. Although its assessment noted efforts to resolve concerns raised by OPM and DOJ, DEA identified several issues that led to the conclusion that it did not have the capability to effectively perform or oversee background investigations. It also concluded that some security clearances were granted based on deficient background investigations. As of July 1999, DEA was considering whether to relinquish its background investigation authority to OPM. Following are some of the issues that the assessment identified, which led to DEA’s conclusion that it had not effectively performed or overseen background investigations. DEA had historically failed to capably perform or oversee its background investigations. DEA found that the majority of people working in its personnel security unit had not been adequately trained regarding the laws, regulations, executive orders, policies, and technical practices central to initiating, and performing and overseeing background investigations, as well as providing personnel security adjudicative services to DEA. DEA had not ensured, as required by the conditions of its delegated authority, that each investigator performing investigations under its delegation had been screened by an investigation that met no less than OPM’s top-secret clearance requirements. DEA did not comply with this requirement for its current contractor because DEA did not have funds to finance such investigations. DEA had not developed or implemented an integrity follow-up program to monitor contract investigators, as required under its delegated authority. DEA concluded that under current circumstances without relief that OPM would provide, it was likely that DEA would remain in violation of the integrity follow-up program requirement. DEA personnel performed National Agency Checks, a requirement of each background investigation. DEA’s costs for performing these checks was associated with DEA’s need to conduct many of these checks manually. In its self-assessment, DEA stated that OPM, however, had sophisticated computer facilities that permitted it to conduct required National Agency Checks through direct-access computer links with all the relevant agencies. DEA concluded that it saw no advantage to duplicate a capability that already existed in OPM. DEA bears ultimate responsibility for ensuring that background investigations performed under its delegation from OPM conform to mandated investigative criteria. DEA had been heavily criticized for its performance in this regard. DEA concluded that OPM has a fully qualified and experienced quality-control staff and that it was not reasonable for DEA to continue to attempt to duplicate this capability. As of July 1999, DEA had not made a final decision on relinquishing its background investigation authority. From what DEA officials told us, it was considering retaining the authority to investigate individuals who apply for DEA Special Agent positions but relinquishing the authority to do all other background investigations, including periodic reinvestigations of Special Agents. In his October 1998 memorandum, the Assistant Attorney General for Administration said that he believed that DEA should relinquish all authority, including the authority to investigate the backgrounds of Special Agent applicants. According to DEA, relinquishing all other background investigation authority would allow DEA to redirect resources into the investigative process for Special Agent applicants. The redirected resources would go into increased training, policy guidance, and oversight. DEA said it believed that it would be unwise to segregate the background investigation from the overall Special Agent applicant selection process by having them conducted by an independent entity not familiar with DEA’s unique requirements for Special Agents. Special Agents did the background investigations of applicants and would continue to do these investigations if that authority was retained, according to DEA. DEA would not be the first agency to relinquish background investigation authority to OPM. According to an OPM official, five agencies have done so: (1) the Federal Emergency Management Agency in 1991, (2) the Department of Commerce in 1994, (3) the National Aeronautics and Space Administration Office of Inspector General in 1994, (5) the U.S. Soldiers and Airmens Home in 1994, and (5) the Department of Education Office of Inspector General in 1998. As previously mentioned, OPM had a sole-source contract with USIS, a firm that OPM was instrumental in creating, to do all background investigations except those done by agencies under delegation agreements. If DEA were to relinquish its background investigation authority to OPM, the contract between OPM and USIS would require OPM to order this investigative work from USIS until the contract expired. Because of the relationship between OPM and USIS, we reviewed whether OPM acted in an objective and independent manner in choosing to review DEA’s background investigation reports and personnel security program. To gauge whether OPM acted objectively and independently, we considered OPM’s responsibilities towards the security program and the program’s background investigations and whether OPM’s treatment of DEA differed from its treatment of other agencies. OPM appeared to have acted in an objective and independent manner. OPM was required to review DEA’s personnel security program and background investigations. This requirement was contained in the Memorandum of Understanding and Agreement between OPM and DEA, which provided that OPM would monitor the agreement as part of its security program appraisal process. In addition, Executive Order 10450, “Security Requirements for Government Employment,” required OPM to make a continuing study of the order’s implementation. The purpose of this continuing study is to determine whether deficiencies exist in security programs that could harm the national interest and weaken national security. As already noted, OPM repeatedly found deficiencies in both the security program and the background investigations, which DEA usually did not correct, and DEA concluded that it could not capably perform or oversee background investigations. Given DEA’s history of noncompliance, we believe that it was reasonable for OPM to do reviews of DEA’s investigations. The frequency with which OPM reviewed DEA’s investigation program appeared to be generally in line with the frequency with which OPM reviewed other agencies. In addition to DEA, three other agencies—the U.S. Marshals Service, the Small Business Administration, and the U.S. Customs Service—possessed authority delegated from OPM to conduct background investigations in fiscal year 1999. OPM reviewed the security program of the U.S. Marshals Service in 1989 and 1999 (in progress as of July 1999), the Customs Service in 1989 and 1994, and the Small Business Administration in 1983 and 1992. In comparison, it reviewed the DEA program in 1992 and followed up in 1998. OPM reviewed a sample of the background investigation reports of the U.S. Marshals Service and the Small Business Administration from July 1996 through April 1999, as it did for DEA. According to an OPM official, OPM did not routinely review the background investigation reports of the U.S. Customs Service because the Memorandum of Understanding and Agreement delegating the investigative authority to Customs did not include this requirement. However, one OPM review of 89 Customs investigations, completed in 1993, found 46 percent to be deficient. OPM was critical in its assessment of other agencies, as it was with DEA. For the aggregate samples of background investigation reports that OPM reviewed from July 1996 through April 1999, the rate of deficiency for the Small Business Administration was 75 percent. It was 93 percent for those from the U.S. Marshals Service. In comparison, the rate of deficiency for background investigation reports from DEA, which DEA and two contractors prepared over several years (1996 to 1999), was 98 percent. OPM computed these percentages by dividing the total number of reports it reviewed into the number it found deficient. Rather than raising a question regarding DEA’s independence and objectivity in choosing to review background investigations performed by DEA and its contractors, the evidence raises the question of why OPM did not act to rescind DEA’s delegated authority. According to OPM, the Administration announced in late 1994 that OPM’s Investigative Unit was to be privatized. The privatization occurred in July 1996. During that period, two private investigative firms sued OPM. According to OPM, these firms believed that OPM was going to take work away from them to support its privatized contractor. The suits were settled when OPM agreed, among other things, that it would not rescind delegations of authority, such as the DEA delegation, except for unsatisfactory performance. Also during this period, a former director of OPM testified before Congress on its privatization plans and emphasized that OPM did not intend to rescind any delegated authorities in order to give new business to the privatized company. According to OPM, the agency has been sensitive to these commitments as well as to the potential perceptions of OPM’s motivation for rescinding any such delegation. We have not evaluated OPM’s explanation of this situation. However, at your request we are separately reviewing related issues concerning OPM’s oversight function regarding background investigations. DEA had a long history of deficiencies in its personnel security program, including background investigations done by both contractor and agency employees that did not meet federal standards. Federal agency security programs are aimed at protecting national security interests and are predicated on thoroughly reviewing the backgrounds of federal job applicants and employees to ensure their suitability for employment and/or access to national security information. Given DEA’s difficulties in ensuring the quality of its personnel background investigations and its conclusion that it is not able to capably perform or oversee background investigations, its consideration of relinquishing its delegated authority is not unreasonable. Nor do OPM’s periodic appraisals of DEA background investigations for adherence to prescribed standards appear unreasonable. OPM has a mandated responsibility to oversee agency security programs, including background investigations, and appeared not to have treated DEA significantly differently, in terms of oversight from other agencies with delegated authority. We received written comments on a draft of this report from the Director of OPM and oral comments on August 17, 1999, from the Director, Audit Liaison Office, DOJ. The OPM Director said that she was pleased that we concluded that OPM was objective and independent in its oversight of the DEA personnel security program. Regarding the report’s statement that the evidence raises a question of why OPM did not rescind DEA’s delegated authority, the Director said that OPM had worked with DEA over several years to help it correct deficiencies that OPM had identified and that several factors mitigated against the rescission of DEA’s authority. In addition to the factors cited on page 13 of this report, OPM said that it continued to work with DEA and DOJ to resolve the continuing personnel security problems and that OPM had let a reasonable amount of time elapse for DOJ, which is responsible for all of the department’s security programs, to take the necessary action. In October 1998, DOJ advised DEA to relinquish its authority. OPM’s complete comments are reprinted in appendix I. The DOJ Audit Liaison Director orally provided technical and clarifying comments, which we incorporated into this report. The Audit Liaison Director said that DOJ had no other comments. We are sending copies of this report to Senators Daniel K. Akaka, Robert C. Byrd, Ben Nighthorse Campbell, Thad Cochran, Susan M. Collins, Byron L. Dorgan, Richard J. Durbin, Judd Gregg, Orrin G. Hatch, Ernest F. Hollings, Patrick J. Leahy, Carl Levin, Joseph I. Lieberman, Charles E. Schumer, Ted Stevens, Fred Thompson, Strom Thurmond, and George V. Voinovich and Representatives Dan Burton, John Conyers, Jr., Elijah Cummings, Jim Kolbe, Steny H. Hoyer, Henry J. Hyde, Bill McCollum, John L. Mica, Patsy T. Mink, David Obey, Harold Rogers, Joe Scarborough, Robert C. Scott, Jose E. Serrano, Henry A. Waxman, and C. W. Bill Young in their capacities as Chair or Ranking Minority Members of Senate and House Committees and Subcommittees. We will also send copies to the Honorable Janet Reno, Attorney General of the United States, Department of Justice; The Honorable Janice R. Lachance, Director, Office of Personnel Management; and Mr. Donnie R. Marshall, Acting Administrator, Drug Enforcement Administration, Department of Justice and other interested parties. We will make copies of this report available to others on request. If you have any questions regarding this report, please contact me or Richard W. Caradine at (202) 512- 8676. Key contributors to this assignment were John Ripper and Anthony Assia. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO provided information on background investigations conducted by the Drug Enforcement Administration (DEA), focusing on: (1) the circumstances that led DEA to consider relinquishing its authority to conduct personnel background investigations; and (2) whether the Office of Personnel Management (OPM) acted in an independent and objective manner in choosing to review DEA and its background investigations. GAO noted that: (1) a series of evaluations in the 1990s critical of DEA's background investigations and personnel security program caused DEA to consider relinquishing its background investigation authority; (2) the findings of OPM's assessments over much of the 1990s, an assessment by the Department of Justice (DOJ) in 1998, and its own assessment in 1999 triggered DEA's consideration of this issue; (3) DEA's relinquishment of investigation authority would be consequential because DEA and its contractor performed an estimated 5,600 background investigations in 1998; (4) during the late 1990s, OPM reviewed a sample of 265 background investigation reports prepared by DEA and its contractors and determined that all but 1 investigation was deficient in meeting the investigative requirements that DEA had agreed to follow; (5) DOJ audited DEA's personnel security program in 1997 and found deficiencies similar to what OPM had found in 1992 and again in 1998; (6) based on the DOJ audit and the recurring finds of OPM, DOJ's Assistant Attorney General for Administration told the DEA Administrator in October 1998 that he believed that DEA should relinquish all of its background investigation authority to OPM; (7) in early 1999, DEA conducted its own examination of the personnel security program, focusing on background investigations, and concluded that DEA was not able to capably perform or oversee background investigations; (8) this lack of capability allowed security clearances to be granted, regardless of whether the related background investigations were adequate; (9) DEA had allowed contract investigators to perform background investigations, even though the investigators had not gone through required background investigations because DEA did not have funds to finance such investigations; (10) as of July 1999, subsequent to its examination of the personnel security program, DEA was considering relinquishing its authority for background investigations to OPM, except for the authority to investigate backgrounds of applicants for DEA Special Agent positions; (11) DEA believed that it would be unwise to separate the background investigation from the overall applicant selection process by having them conducted by an independent entity not familiar with DEA's unique requirements for Special Agents; and (12) OPM appeared to have been objective and independent in choosing to review DEA's personnel security program and background investigations.