As we note in our report, significant overall progress has been made to improve timeliness, largely due to DOD, which comprises the vast majority of clearances. IRTPA established an objective for each authorized adjudicative agency to “make a determination on at least 90 percent of all applications for a personnel security clearance within an average of 60 days from the date of receipt of the completed application by an authorized investigative agency” by December 17, 2009. This means that under the current statutory timeliness objective, the executive branch can exclude the slowest 10 percent and then report on an average of the remaining clearances. IRTPA includes 40 days for investigations and 20 days for adjudications within this 60-day average period. As shown in figure 2, DOD, the Department of Energy, and the National Geospatial- Intelligence Agency met the 60-day timeliness objective in all three quarters of fiscal year 2010. We also found that timeliness varied widely among executive branch agencies. During the first three quarters of fiscal year 2010, the average for the fastest 90 percent of cases adjudicated by the 14 agencies included in our review ranged from 22 to 96 days for investigation timeliness, 2 to 59 days for adjudication timeliness, and 30 to 154 days for combined timeliness. Based on our discussions with agency officials, we identified a number of challenges to agencies meeting IRTPA timeliness objectives, including variances among the agencies in adopting information technology due to resource and personnel limitations, and additional agency-specific requirements that must be met before granting a security clearance. For example, agency officials with whom we spoke explained that there is a variance in agencies’ adoption of the Electronic Questionnaires for Investigations Processing (e-QIP). According to these officials, e-QIP has sped up investigation timeliness for agencies that have adopted this technology because it provides OPM with more complete and better quality data earlier in the process. However, resource constraints are a limiting factor in agencies’ adoption of this type of technology. In addition, agency-specific requirements can affect timeliness. For example, timeliness for the Intelligence Community has varied because of unique issues related to conditions of employment that require polygraphs or psychological evaluations that extend beyond the standard background investigation. The Performance Accountability Council is responsible for driving implementation of the reform effort and ensuring accountability, but has not reported on the impediments to meeting timeliness objectives or plans to address impediments. IRTPA’s security clearance reform provision requires annual reports to the appropriate congressional committees— through 2011—on the progress made during the preceding year toward meeting its requirements, including timeliness data and a discussion of any impediments to the smooth and timely functioning of its requirements. However, in its most recent report to Congress, the Performance Accountability Council did not provide information on the impediments agencies face in meeting timeliness objectives or plans to address impediments. While the Office of the Director of National Intelligence, in its capacity as Security Executive Agent, has performed a limited number of oversight audits, according to officials we met with at four agencies, the Performance Accountability Council has not met with them to identify the impediments to meeting the timeliness objectives. The Performance Accountability Council has focused its efforts on DOD due, in part, to the DOD security clearance program’s designation as one of GAO’s high-risk areas, as well as the fact that DOD clearances comprise the vast majority of clearance cases that are processed annually. We found that because of the relative size of DOD’s clearance program, DOD’s progress toward meeting IRTPA’s timeliness objectives is a significant factor in reducing the average time required for clearance processing for the government as a whole. However, the Performance Accountability Council’s February 2010 annual report to Congress lacked an identification of the impediments other agencies face to meeting timeliness objectives and did not identify mitigation strategies or action plans. Furthermore, the Performance Accountability Council officials stated that they began conducting one-on- one meetings with individual agencies in September 2010 to enhance communication, assist in implementation planning, and provide a feedback mechanism for agency stakeholders to communicate information and needs to the Joint Reform Team. To further improve timeliness across the federal government, we recommended that the Deputy Director of Management, Office of Management and Budget (OMB), in the capacity as Chair of the Performance Accountability council, collaborate with agencies that are not meeting timeliness objectives to take the following actions: (1) identify challenges to timeliness; (2) develop mitigation strategies to enable each agency to comply with the IRTPA timeliness objectives; (3) set timelines for accomplishing the required actions; (4) monitor agency progress; and (5) report on these plans and progress in the annual reports to Congress. OMB concurred with our recommendation, noting through oral comments that the Performance Accountability Council was committed to the timeliness goals of IRTPA and that it was working with agencies currently not meeting the IRTPA timeliness goals by taking steps to assist these agencies. As noted in my statement today, we are strongly encouraged by the progress that the Performance Accountability Council has made over the last few years to reduce overall timeliness. If implemented in accordance with our recommendations, the Performance Accountability Council’s actions to assist the agencies in developing plans to implement the reformed approach appear to be a positive step in helping sustain the momentum of security clearance reform. Agency officials stated that they routinely take steps to honor previously granted security clearances; however, there are no governmentwide metrics to comprehensively track when and why reciprocity is granted or denied. IRTPA generally requires that all security clearance investigations and determinations be accepted by all agencies, with limited exceptions when necessary for national security purposes. Further, ODNI guidance signed in October 2008 amplifies this reciprocity requirement, stating that except in limited circumstances, all Intelligence Community elements are to “accept all in-scope security clearance or access determinations.” Similarly, the OMB issued guidance requiring agencies to reciprocally accept clearances when the prior clearance is current, in-scope, and there is no new derogatory information, among other things. However, agency officials stated that in some cases, they find it necessary to take additional steps to address limitations with available information before granting a reciprocal clearance. For example, although no single, integrated database exists and information currently being shared between agencies may be insufficient, agencies request additional information, such as copies of the original background investigation. Moreover, because of the different types of background investigations required by individual agencies, agencies may perform additional investigative work or request a new background investigation. In addition to addressing limitations with available information, agency officials reported that additional steps must sometimes be taken to conduct suitability determinations or ensure that a prior clearance investigation and adjudication meet their quality expectations before granting reciprocity. All federal agencies conduct basic suitability determinations to ensure that the applicant’s character or conduct is appropriate for the position in question, but some agencies take additional actions to determine the suitability of applicants before they reciprocate a security clearance. For example, the Department of Justice must take steps to ensure that applicants for jobs with the Drug Enforcement Administration have not used drugs, according to agency officials. Similarly, the Intelligence Community requires a polygraph evaluation, among other things, to determine suitability for most positions, according to intelligence officials. Some agencies take steps to ensure that a prior clearance meets their quality expectations. Most agency officials stated that the lack of governmentwide standardized training and certification for investigators and adjudicators is a challenge to immediately reciprocating a security clearance. Without governmentwide standardized training and certification, agencies cannot be certain that a subject’s prior clearance investigation and adjudication meet the quality expectations of the inquiring agency. Consequently, as we have previously reported, agencies are reluctant to be accountable for investigations and/or adjudications conducted by other agencies or organizations. Although OPM has developed some training, security clearance investigators and adjudicators are not required to complete a certain type or number of classes. However, the annual reports to Congress indicate that the Performance Accountability Council is taking steps to make investigations and adjudications more consistent across the government by standardizing the training of investigators and adjudicators. While the Performance Accountability Council has identified reciprocity as a governmentwide strategic goal, there is no clear evidence to show the extent to which reciprocity is granted because agencies lack comprehensive, standardized metrics to track reciprocity. We previously reported that developing metrics for assessing and regularly monitoring all aspects of the clearance process could add value in current and future reform efforts as well as supply better information for greater congressional oversight. However, we found that agencies do not consistently document the additional steps they have taken prior to granting a reciprocal clearance. For example, the Navy keeps electronic documentation, the Department of Energy and the Department of the Treasury keep paper documentation, and the Army and the Air Force do not maintain any documentation on the additional steps taken to accept a previously granted security clearance. Consequently, there is no consistent tracking of the amount of staff time spent on the additional actions that are taken to honor a previously granted security clearance. In addition, agencies do not consistently and comprehensively track the extent to which reciprocity is granted. While OPM has a metric to track reciprocity, this metric captures limited information, such as numbers of requested and rejected investigations, but not the number of cases in which a previously granted security clearance was or was not honored. Similarly, the metrics proposed by the Performance Accountability Council do not track the extent to which reciprocity is or is not ultimately honored. For example, metrics proposed by the Performance Accountability Council, such as the number of duplicate requests for investigations, percentage of applications submitted electronically, number of electronic applications submitted by applicants but rejected by OPM as unacceptable because of missing information or forms, and percentage of fingerprint submissions determined to be “unclassifiable” by the Federal Bureau of Investigation, provide useful information but do not track the extent to which reciprocity is or is not ultimately honored. Without comprehensive, standardized metrics to track reciprocity, and documentation of the process, decision makers lack a complete picture of the extent to which reciprocity is granted and the challenges to honoring previously granted security clearances. To further improve governmentwide reciprocity, we recommended that the Deputy Director of Management, Office of Management and Budget, in the capacity as Chair of the Performance Accountability Council, develop comprehensive metrics to track reciprocity and then report the findings from the expanded tracking to Congress. OMB concurred with our recommendation, stating that the Performance Accountability Council is working to develop these additional metrics. We are encouraged by the Performance Accountability Council’s development of quality metrics, which include some metrics for tracking reciprocity. Although these are positive steps that can contribute to greater visibility over the clearance process, these measures have not yet been fully implemented and we are continuing to examine these efforts as part of our ongoing work. Although there are no plans to develop a single, integrated database as called for in IRTPA, the Performance Accountability Council is focusing on leveraging existing systems and increasing information sharing by developing a single search capability through OPM’s system, the Central Verification System. IRTPA required that no later than 12 months after the date of its enactment, the Director of OPM and the Director of OMB establish and commence operating and maintaining a single, integrated database of security clearance information. This database was to house information regarding the granting, denial, or revocation of security clearances or access pertaining to military, civilian, and contractor personnel, from all authorized investigative and adjudicative agencies. However, the Performance Accountability Council is not pursuing a single, integrated database, according to our analysis of a series of recent reports that the Joint Reform Team issued from 2008 through 2010. For example, according to the Joint Reform Team’s Enterprise Information Technology Strategy, the Performance Accountability Council has opted to pursue an approach that leverages existing systems and involves the development of new tools when necessary. Similarly, according to the most recent annual report to Congress, the reform efforts are focused on leveraging OPM’s existing system—the Central Verification System—to enable access to records on investigations and adjudications. Agency officials from both OPM and ODNI confirmed that there are no plans to create a new single, integrated database and explained that establishing, operating, and maintaining a single, integrated database is not a viable option because of concerns related to privacy, security, and data ownership. Privacy concerns involve the unintentional disclosure of personal identifying information, such as names and Social Security numbers. Merging different systems into one database could result in the unintentional disclosure of personal identifying information that could compromise security. For example, since the Intelligence Community’s database is classified and separate from the databases used by nonintelligence agencies, even an aggregation of unclassified information from its database could lead to unintentional disclosure of personal identifying information that could compromise security. Moreover, breaches in the system could compromise security. For example, some officials mentioned an enhanced threat from hackers if there were consolidation of multiple information technology systems. Although there are no plans to create a new governmentwide database, officials representing nonintelligence executive branch agencies in our review stated that they are sharing information about personnel who hold or are seeking security clearances through two main databases that can be accessed through a single entry point. Two primary databases are used by nonintelligence agencies to store investigative and adjudicative information, and according to the Performance Accountability Council, they account for decisions on about 90 percent of all security clearance holders in the federal government. Data are stored in either OPM’s Central Verification System or DOD’s Joint Personnel Adjudication System. The Central Verification System includes security clearance data for all non- Intelligence Community, non-DOD executive branch agencies. The Joint Personnel Adjudication System is a repository for security clearance information on both DOD civilian and military personnel, as well as determinations of contractor clearance eligibility and access for the National Industrial Security Program. Data from the two databases can be searched and obtained from a single entry point in the Central Verification System. Officials representing Intelligence Community agencies reported that they are sharing information with one another through a separate classified database known as Scattered Castles. Scattered Castles is a repository for records from all intelligence agencies by which each agency uploads relevant information from individual agency databases. All personnel who have access to Sensitive Compartmented Information are listed in Scattered Castles. This system is not linked to OPM’s Central Verification System because of concerns about protecting classified information. According to ODNI officials, the system has not been linked to nonintelligence databases because of the need to protect information on covert personnel. However, officials representing Intelligence Community agencies stated that they do enter some information from DOD’s Joint Personnel Adjudication System into Scattered Castles. Although the Intelligence Community maintains a separate database, most of the nonintelligence agencies included in our review had some access to Scattered Castles and the Intelligence Community is exploring alternatives to expand information sharing with nonintelligence agencies. Nonintelligence agencies may have access to Scattered Castles through a Sensitive Compartmented Information Facility located in their agency. All of the military services, as well as the Joint Chiefs of Staff, also had some access. Moreover, according to agency officials, DOD adjudicators with the appropriate clearance and need to know will have access to a Sensitive Compartmented Information Facility with access to Scattered Castles when DOD colocates all of its clearance adjudication facilities at Fort Meade in Maryland as part of the DOD base realignment and closure process in 2011. According to Performance Accountability Council officials, the Performance Accountability Council is exploring ways to enhance information sharing between the Intelligence Community agencies and the nonintelligence agencies. This working group is studying alternatives to support a single-access point from which to search clearance information and plans to complete its review in December 2010. In summary, Madam Chairwoman, our overall observations of the current reform efforts are that they represent positive steps to improve the clearance process. As we noted in our report, continued personnel security clearance reform relies on strong committed executive leadership to sustain the momentum created by the current reform effort. This type of leadership, in turn, helps provide oversight and accountability for the improvement process. Key to these efforts has been the Performance Accountability Council, which has provided direction for the clearance reform across the federal government. We are encouraged that the Performance Accountability Council’s efforts during the past year have included several actions to improve the process. Timeliness data— particularly at DOD—have improved, there has been focus on honoring reciprocity of existing clearances, and steps have been taken to improve information sharing. However, while agencies are moving closer to meeting the objectives and requirements of IRTPA, continued oversight and accountability for personnel security clearance reform is still needed. Madam Chairwoman, this concludes my prepared statement, and I would be pleased to respond to any questions that you or members of the subcommittee may have at this time. For further information about this statement, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Liz McNally, Assistant Director; James Ashley; Joseph M. Capuano; Sara Cradic; Cindy Gilbert; Linda Keefer; James Krustapentus; Greg Marchand; Richard Powelson; Jillena Roberts; and Amie Steele. DOD Personnel Clearances: Preliminary Observations on DOD’s Progress on Addressing Timeliness and Quality Issues. GAO-11- 185T. Washington, D.C.: November 16, 2010. Privacy: OPM Should Better Monitor Implementation of Privacy- Related Policies and Procedures for Background Investigations. GAO-10-849. Washington, D.C.: September 7, 2010. Personnel Security Clearances: An Outcome-Focused Strategy and Comprehensive Reporting of Timeliness and Quality Would Provide Greater Visibility over the Clearance Process. GAO-10- 117T. Washington, D.C.: October 1, 2009. Personnel Security Clearances: Progress Has Been Made to Reduce Delays but Further Actions Are Needed to Enhance Quality and Sustain Reform Efforts. GAO-09-684T. Washington, D.C.: September 15, 2009. Personnel Security Clearances: An Outcome-Focused Strategy Is Needed to Guide Implementation of the Reformed Clearance Process. GAO-09-488. Washington, D.C.: May 19, 2009. DOD Personnel Clearances: Comprehensive Timeliness Reporting, Complete Clearance Documentation, and Quality Measures Are Needed to Further Improve the Clearance Process. GAO-09-400. Washington, D.C.: May 19, 2009. High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 2009. DOD Personnel Clearances: Preliminary Observations about Timeliness and Quality. GAO-09-261R. Washington, D.C.: December 19, 2008. Personnel Security Clearances: Preliminary Observations on Joint Reform Efforts to Improve the Governmentwide Clearance Eligibility Process. GAO-08-1050T. Washington, D.C.: July 30, 2008. Personnel Clearances: Questions for the Record Regarding Security Clearance Reform. GAO-08-965R. Washington, D.C.: July 14, 2008. Personnel Clearances: Key Factors for Reforming the Security Clearance Process. GAO-08-776T. Washington, D.C.: May 22, 2008. Employee Security: Implementation of Identification Cards and DOD’s Personnel Security Clearance Program Need Improvement. GAO-08-551T. Washington, D.C.: April 9, 2008. DOD Personnel Clearances: Questions for the Record Related to the Quality and Timeliness of Clearances. GAO-08-580R. Washington, D.C.: March 25, 2008. DOD Personnel Clearances: DOD Faces Multiple Challenges in Its Efforts to Improve Clearance Processes for Industry Personnel. GAO-08-470T. Washington, D.C.: February 12, 2008. Personnel Clearances: Key Factors to Consider in Efforts to Reform Security Clearance Processes. GAO-08-352T. Washington, D.C.: February 27, 2008. DOD Personnel Clearances: Improved Annual Reporting Would Enable More Informed Congressional Oversight. GAO-08-350. Washington, D.C.: February 13, 2008. DOD Personnel Clearances: Delays and Inadequate Documentation Found for Industry Personnel. GAO-07-842T. Washington, D.C.: May 17, 2007. High-risk Series: An Update. GAO-07-310. Washington, D.C.: January 2007. DOD Personnel Clearances: Additional OMB Actions Are Needed to Improve the Security Clearance Process. GAO-06-1070. Washington, D.C.: September 28, 2006. DOD Personnel Clearances: Questions and Answers for the Record Following the Second in a Series of Hearings on Fixing the Security Clearance Process. GAO-06-693R. Washington, D.C.: June 14, 2006. DOD Personnel Clearances: New Concerns Slow Processing of Clearances for Industry Personnel. GAO-06-748T. Washington, D.C.: May 17, 2006. DOD Personnel Clearances: Funding Challenges and Other Impediments Slow Clearances for Industry Personnel. GAO-06- 747T. Washington, D.C.: May 17, 2006. Questions for the Record Related to DOD’s Personnel Security Clearance Program and the Government Plan for Improving the Clearance Process. GAO-06-323R. Washington, D.C.: January 17, 2006. DOD Personnel Clearances: Government Plan Addresses Some Longstanding Problems with DOD’s Program, But Concerns Remain. GAO-06-233T. Washington, D.C.: November 9, 2005. DOD Personnel Clearances: Some Progress Has Been Made but Hurdles Remain to Overcome the Challenges That Led to GAO’s High-Risk Designation. GAO-05-842T. Washington, D.C.: June 28, 2005. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 2005. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony discusses our key findings and recommendations in our report that we are releasing today on some aspects of personnel security clearance reforms. We conducted our review in response to a congressional request. This is the fourth in a series of hearings, in which Congress has asked GAO to testify; and this Subcommittee's continued oversight has helped focus attention on the need for personnel security reform. Personnel security clearances allow government and industry personnel to gain access to classified information that, through unauthorized disclosure, can in some cases cause exceptionally grave damage to U.S. national security. The July 2010 and subsequent October 2010 recent unauthorized leak of almost 500,000 classified documents posted to the Internet related to the ongoing wars in Afghanistan and Iraq provides a cogent example of the inherent risks involved when granting an individual a security clearance. To ameliorate these risks, government agencies rely on a multiphased personnel security clearance process. However, with the increase in demand over the past decade for personnel with security clearances, we and others have identified problems with the security clearance process with respect to delays and incomplete documentation. As a result, we have designated the Department of Defense's (DOD) clearance program--which represents a vast majority of the initial security clearances adjudicated by the federal government--as a high-risk area since 2005. In light of longstanding concerns regarding delays in processing clearances and other issues, Congress set objectives and established requirements for improving the clearance process in section 3001 of the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). IRTPA established objectives for timeliness, requirements for reciprocity--an agency's acceptance of a background investigation or clearance determination completed by any authorized investigative or adjudicative agency--and an integrated, secure database to house clearance information. In 2007, DOD and the Office of the Director of National Intelligence (ODNI) formed the Joint Security Clearance Process Reform Team, known as the Joint Reform Team, to transform the security clearance process governmentwide. In the following year, Executive Order 13467 was issued, establishing a Suitability and Security Clearance Performance Accountability Council (Performance Accountability Council) that is responsible for driving the implementation of reform and is accountable to the President for achieving the reform effort's goals. This governance structure was put in place, in part, to sustain the momentum of clearance reforms. We have previously noted that top leadership must be committed to organizational transformation. To this end, committed executive leadership has worked to reform the personnel security clearance process by improving timeliness and developing quality measures. Congressional oversight through hearings held by this subcommittee in February, July and September 2008, and in October 2009 has helped focus attention on the need for security clearance reform. In addition, the recently passed Intelligence Authorization Act for Fiscal Year 2010 requires reports by the President on the security clearance process, including information on timeliness and quality. This statement highlights the key findings and recommendations from the report we are issuing today. Specifically, it will focus on the extent to which select executive branch agencies (1) investigate and adjudicate initial personnel security clearance applications for civilian, military, and industry personnel in a timely manner; (2) honor previously granted personnel security clearances and the challenges, if any, that exist related to reciprocity; and (3) share personnel clearance information in a single, integrated database. (1) Significant overall progress has been made to improve timeliness, largely due to DOD, which comprises the vast majority of clearances. IRTPA established an objective for each authorized adjudicative agency to "make a determination on at least 90 percent of all applications for a personnel security clearance within an average of 60 days from the date of receipt of the completed application by an authorized investigative agency" by December 17, 2009. This means that under the current statutory timeliness objective, the executive branch can exclude the slowest 10 percent and then report on an average of the remaining clearances. IRTPA includes 40 days for investigations and 20 days for adjudications within this 60-day average period. As shown in figure 2, DOD, the Department of Energy, and the National Geospatial-Intelligence Agency met the 60-day timeliness objective in all three quarters of fiscal year 2010. (2) Agency officials stated that they routinely take steps to honor previously granted security clearances; however, there are no governmentwide metrics to comprehensively track when and why reciprocity is granted or denied. IRTPA generally requires that all security clearance investigations and determinations be accepted by all agencies, with limited exceptions when necessary for national security purposes. Further, ODNI guidance signed in October 2008 amplifies this reciprocity requirement, stating that except in limited circumstances, all Intelligence Community elements are to "accept all in-scope security clearance or access determinations." Similarly, the OMB issued guidance requiring agencies to reciprocally accept clearances when the prior clearance is current, in-scope, and there is no new derogatory information, among other things. However, agency officials stated that in some cases, they find it necessary to take additional steps to address limitations with available information before granting a reciprocal clearance. Moreover, because of the different types of background investigations required by individual agencies, agencies may perform additional investigative work or request a new background investigation. (3) Although there are no plans to develop a single, integrated database as called for in IRTPA, the Performance Accountability Council is focusing on leveraging existing systems and increasing information sharing by developing a single search capability through OPM's system, the Central Verification System. IRTPA required that no later than 12 months after the date of its enactment, the Director of OPM and the Director of OMB establish and commence operating and maintaining a single, integrated database of security clearance information. This database was to house information regarding the granting, denial, or revocation of security clearances or access pertaining to military, civilian, and contractor personnel, from all authorized investigative and adjudicative agencies. However, the Performance Accountability Council is not pursuing a single, integrated database, according to our analysis of a series of recent reports that the Joint Reform Team issued from 2008 through 2010. Similarly, according to the most recent annual report to Congress, the reform efforts are focused on leveraging OPM's existing system--the Central Verification System--to enable access to records on investigations and adjudications. Agency officials from both OPM and ODNI confirmed that there are no plans to create a new single, integrated database and explained that establishing, operating, and maintaining a single, integrated database is not a viable option because of concerns related to privacy, security, and data ownership. Privacy concerns involve the unintentional disclosure of personal identifying information, such as names and Social Security numbers. Merging different systems into one database could result in the unintentional disclosure of personal identifying information that could compromise security.