DOD Personnel Clearances

Unauthorized disclosure of classified information can cause up to exceptionally grave damage to national security. The Department of Defense (DOD) is responsible for about 2 million personnel with clearances that allow them access to classified information. While most of these clearances are for servicemembers and DOD's employees and contractors, DOD is also responsible for contractors' clearances for more than 20 other agencies, as well as for congressional staff. Due to long-standing problems with DOD's clearance program, GAO designated it a high-risk area in January 2005. In February 2005, when DOD transferred its personnel security investigative functions to the Office of Personnel Management (OPM), the average wait for a top secret clearance governmentwide was over 1 year. In June 2005, Executive Order 13381 gave the Office of Management and Budget (OMB) authority to retain or assign to any executive agency any process relating to determinations of eligibility for access to classified information. OPM is assisting OMB with the development of the plan. GAO was asked to assess the government plan. This testimony will provide GAO's preliminary review of how well the government plan (1) adheres to the standards of comprehensive strategic planning and (2) addresses the timeliness and quality of the security clearance process. Finally, GAO will discuss the actions required to remove DOD's program from GAO's high-risk list.

We are encouraged by the level of commitment demonstrated by OMB in overseeing the preparation of the government plan for addressing problems in the personnel security clearance process. The plan represents an important step toward addressing some long-standing concerns GAO has raised in this area. It includes some elements that a comprehensive strategic plan should contain, such as metrics that will be used to monitor the timeliness of the security clearance process governmentwide. However, the plan provides few details on other features that GAO looks for in a comprehensive strategic plan. For example, in some cases, the plan does not provide details on discrete actions the government would take or their projected completion dates. In addition, the plan does not always include details on the resources required to accomplish the plan's objectives. Finally, the plan does not describe potential risks or mitigation plans to address potential risks. Although the government plan establishes metrics to address the timeliness of the security clearance process, they focus on some phases of the process more than others. Specifically, the plan identifies a wide variety of metrics for monitoring the timeliness of security clearance investigations, but it does little to address timeliness in the adjudication phase of the process. The government plan also provides quarterly goals for different types of investigations. However, the plan does not identify baseline measures or interim goals for average adjudication processing time. Although it explicitly acknowledges that agencies have concerns about the quality of investigations and adjudications, the government plan devotes little attention to monitoring and improving the quality of the personnel security clearance process. The plan's primary metric for measuring the quality of investigations--the percentage of investigations returned by requesting agencies due to incomplete case files--is not, by itself, a valid indicator of the quality of investigative work. Other or additional statistics, such as the number of counterintelligence leads generated from security clearance investigations, may be needed. The government plan did not identify a metric for assessing the quality of adjudications, although GAO and other agencies have identified actions that would facilitate monitoring and improvement of the quality of this portion of the personnel security clearance process. DOD must correct previously identified problems before its personnel security clearance program can be removed from the high-risk list. Before removing DOD's personnel security clearance program from the high-risk list, GAO will examine whether OMB, OPM, and DOD have satisfied certain criteria, including the establishment of leadership support, sufficient resources to resolve the risk, and a corrective action plan. GAO's criteria also include the presence of a program to monitor and independently validate the effectiveness and sustainability of any corrective actions and the agency's ability to demonstrate the implementation of corrective measures.