Statement of David J. Berteau President & CEO Professional Services Council “Security Clearance Reform” Select Committee on Intelligence United States Senate March 7, 2018 Statement of David J. Berteau, President & CEO, Professional Services Council, before the Senate Select Committee on Intelligence March 7, 2018 Introduction Chairman Burr, Vice Chairman Warner, and Members of the Committee, thank you for the invitation to testify on behalf of the Professional Services Council’s (PSC) nearly 400 member companies and their hundreds of thousands of employees across the nation. 1 PSC is the voice of the government technology and services industry, supporting the full range and diversity of government missions and functions across all agencies. I appreciate the opportunity to discuss with you the current status of the personnel security clearance process, the impact of the current situation on industry, and the prospects for reform. These are issues of great significance for our member companies and their employees, as well as for the success of government missions and support functions. Today, I will describe some of the opportunities and challenges for Congress and federal agencies and offer some recommendations to improve the process and reduce the negative impacts on contractors and our government partners. I believe there is much this committee can do in legislation and oversight that will lead to practical and productive improvements. Contractors Provide Significant Value to the Government The contractor community plays a vital role in assisting the government in providing services to the American people. Contractor contributions are necessary to maintaining government operations. Many of the capabilities that contractors provide do not exist, or are insufficiently available, within the government, and contractors can quickly expand or adjust capacity to meet changing mission needs. Contractors draw from a strong, diversified national interest business base to support current and emerging requirements for every agency of the government. To meet these demands, however, contractors need to be able to hire, retain, assign, and transfer qualified, skilled employees to the missions and functions with greatest need. Like the federal employees they work aside, contractors come to work every day to do a 1 For over 45 years, PSC has been the leading national trade association of the government technology and professional services industry. PSC’s member companies represent small, medium, and large businesses that provide federal agencies with services of all kinds, including information technology, engineering, logistics, facilities management, operations and maintenance, consulting, international development, scientific, social, environmental services, and more. Together, the association’s members employ hundreds of thousands of Americans in all 50 states. See www.pscouncil.org. job that is vital to the government’s ability to achieve their missions. Both federal workers and contractors deserve a better system for background investigations and clearances. Scope of the Problem The Government Accountability Office (GAO) agrees on the need for a better system. On January 25, 2018, GAO added the government-wide personnel security clearance process to its High Risk List of federal areas in need of either broad-based transformation or specific reforms to prevent waste, fraud, abuse, and mismanagement. Prior GAO studies highlight not only the extent on the problem but also how the backlog and wait times have increased within the past year alone. According to OMB, at the end of FY17, the backlog covered 708,000 individuals. There are now over 700,000 military, civilian, and contractor personnel who remain in limbo awaiting a clearance to perform mission-critical work. In FY16, the backlog was 573,000. In FY17, the average number of days to complete the fastest 90 percent of initial Secret clearances was 134 days, up from 108 days in FY16. In FY17, the average number of days to complete the fastest 90 percent of Top Secret clearances was 331 days, up from 220 days in FY16. The backlog and wait times are unacceptable and growing. PSC and the industry agree with GAO on the need for action now. Industry Impact The impacts of the security clearance process, the backlog of cases and the wait times associated with obtaining a clearance affect both government and industry. As other witnesses today have described, we can and have quantified these impacts on the contractor community. The government has not, to my knowledge, quantified the impact on the government workforce and government missions, but we know that it is real. I urge the committee to ask the leaders of the Department of Defense (DoD), and other national security agencies about these consequences. Only when they recognize the need to reduce negative impacts will they make improvements a sufficiently high priority. From our industry’s perspective, one of the biggest impacts is on our workforce. Recruitment and retention remain significant challenges. Contractors are often unable to fill positions requiring clearances, even when the positions are funded under existing contracts. Essential work goes unperformed, and contractors can even be penalized for contractual non-performance by the very agencies that are holding up the clearances. Some agencies have even enforced liquidated government damages on contractors who have missed staffing deadlines due to delayed processing of contract employees’ clearances. Neither government nor industry partners can recruit for critical national security missions or compete to hire the best and brightest when those individuals have to wait months or even years before being able to work. False Dichotomies of Security Clearance Reform There are two false dichotomies that may be raised when security clearance reform is discussed. The first dichotomy is that a faster process means we are less secure, that applicants receive less scrutiny, and that risks are heightened. This is simply untrue. Process improvements can speed up the timelines of clearance approvals without cutting corners and because they can provide continuous monitoring of cleared personnel, can actually make us more secure, not less. The second dichotomy is that a better system costs more. This is also untrue. Over time, a more efficient system will be more cost effective to operate and would also reduce money wasted when the government cannot meet mission needs as a result of the backlog. Recommendations The recommendations below include concrete actions that Congress can take and also includes steps for the executive branch to address deficiencies and risks, reduce the backlog and speed up processing times, and carry out effective oversight of initiatives at federal agencies. Most broadly, PSC recommends adopting and implementing what we call the “four ones.” These principles can and should apply both to the government and to contractors. The federal government has made progress, but greater and more rapid results are necessary. These principles are: • • • • One application; One investigation; One adjudication; One clearance. Adopting policies that will implement the “Four Ones” will provide remedial actions that touch on all aspects of this issue—including and especially—reciprocal recognition for existing clearance holders. Adopt a Whole of Government Approach The security clearance process is a government-wide problem that requires a government-wide solution. No one agency can fix this, and cabinet- level leadership and White House engagement are crucial. This committee can help by focusing continuously on their roles. Require Up-to-Date, Publicly Available Data Unfortunately, as the problem has worsened, the government has made information less available. This helps no one. Congress should legislate requirements for all relevant agencies to provide timely, accurate, publicly available, and up-to-date data on the size and scope of the backlog and the wait times for individuals seeking a security clearance. Without knowing the extent of the backlog or the causes, actions to reduce the number of individuals awaiting security clearances and implementation metrics risk being either insufficient or mistargeted. From my experience as an Assistant Secretary of Defense, I know that I paid greater attention to the responsibilities on which I was reporting regularly to Congress and the public. On June 15, 2017, the Office of Management and Budget issued memorandum M-17-26 “Reducing Burden for Federal Agencies by Rescinding and Modifying OMB Memoranda,”2 removing outdated and unnecessary regulatory and administrative burdens on federal agencies, on government contractors, and on taxpayers. PSC supported the elimination or modification of many of these OMB burdens, but some removals were counterproductive. Under the June 15 OMB Memo, agencies are to discontinue reporting on all previously covered priority goals for the remainder of fiscal year 2017, even when those goals align with the Administration’s current priorities, as confirmed to PSC by OMB’s Resource Management team. In a June 22, 2017 letter to Director Mulvaney, 3 we detailed our concerns about OMB’s elimination of reporting requirements under the GPRA Modernization Act, under which agencies provide quarterly progress reports via performance.gov with respect to both individual agency and cross-agency priority goals. These quarterly reports have provided PSC and our member companies with valuable insight into agency activities, including successes and remaining challenges. In the case of the cross-agency goal for security clearance, the quarterly reports have provided critical information on addressing key administration, congressional, and industry interests. 2 Executive Office of the President, Office of Management and Budget. Reducing Burden for Federal Agencies by Rescinding and Modifying OMB Memoranda (M-17-26). Issued on June 25, 2017. Text from: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/M-17-26.pdf 3 Professional Services Council (PSC) letter to Office of Management and Budget Director Mick Mulvaney. June 22, 2017. Text from: http://www.pscouncil.org/Downloads/documents/PSC%20Letter%20on%20OMB%20Memos%206.22.17.pdf Section 925 of the FY18 National Defense Authorization Act (NDAA) does include many reporting requirements on the size and scope of the backlog. Yet—unlike previous government reporting—under current practice, this information will be seen only by the congressional committees of jurisdiction—leaving the heavily-impacted contractor community in the dark, along with many of their government customers, as well as state and local officials. PSC believes the best way to fix this is to expand statutory reporting requirements and to make the information public. Speed up Vetting and Clearance Process The vetting and clearance process can be accelerated while maintaining system integrity and without cutting corners. Let’s look at how it is now. Currently, to verify an applicant’s educational background, an investigator must draft, print and hard mail a letter to the college or university citied. The investigator then waits for the college or university to respond—again via hard mail—with a verification of the applicant’s information. Once the verification letter is received, the investigator scans it into their system and adds it to the applicant’s file. This example highlights the outdated, cumbersome, and lengthy process now used to simply confirm that an applicant attended the college they claim to have attended. There are much faster and more reliable ways to do this. Much of the backlog problem comes from using an antiquated, time-consuming background investigations process. Investigators ask basically the same questions they did 40 years ago, often going door-to-door and relying on face-to-face meetings with neighbors and friends. The government still relies too much on paper records and closed systems for collecting and sharing information. Investigators are often required to take notes on paper, then type those notes into an antiquated computer system. They are not even allowed to use a computer or electronic tablet. The amount of manual effort required in the investigation process for a majority of personnel can be dramatically and significantly reduced though the use of technology that automatically pulls in previously verified information and other publicly available information. Provide the Necessary Resources for Federal Agencies OPM’s NBIB operates under a revolving fund, which is replenished by the transferring funds appropriated to each of the 20-plus agencies that use NBIB. There is often no specifically identified request or justification for those funds in the President’s budget, making it unclear for Congress to be sure adequate funding is provided. This makes it more important that Congress provide the agencies conducting the investigations and the adjudications the necessary resources. Right now, there are too few well-trained people processing clearances and too little money to meet the demand. As a result, PSC member companies regularly report that cases are delayed further by lost forms, communication disconnects, failure by agencies to process responses, and inadequate tracking of cases or reporting of their status. The entire system across the federal government needs a workforce that is trained and appropriately sized with the necessary funding for investigations and adjudications, as well as the authorities to prioritize and allocate resources based on risk. They also need a strategic implementation plan that will improve overall performance through predetermined metrics and milestones with strong accountability mechanisms. For the FY18 and FY19 appropriations bills, Congress should account for and support full funding for all of the relevant components. Conduct Aggressive Oversight of the Sec. 925 Transfer Section 925 of the FY18 NDAA requires DoD to conduct its own background and security investigations by transferring certain clearances from the National Background Investigations Bureau (NBIB). This will require the Committee to participate with the other committees of jurisdiction in regular, detailed oversight of the three-year process to transfer authority. The timeline is demanding, and detailed plans are not yet available, at least to us, which we see as increasing risk. Congress can and should ensure that DoD stays on track, while funding and processing the remaining clearance requests at NBIB must remain a priority. We also recommend that, as Senators, you should also raise these issues with every nominee and every witness in the affected agencies. Prioritize Continuous Evaluations Congress should require that agencies prioritize continuous evaluations, both as a timely response to insider threats and to reduce the burden of periodic reinvestigations. This is where process improvements offer the greatest payoff. PSC strongly supports the continuous evaluations (CE) approach and urges Congress— through regular reports and oversight—to incentivize and reward government-wide moves toward more robust CE. The current process of reevaluations is based on the calendar, not on risk or need. To be successful, CE must be part of the personnel system as well as security clearance, suitability, and credentialing procedures. Moving to CE will significantly reduce current and future backlogs by removing periodic revaluations from the queue. Moving from a timeline-based process to continuous monitoring will also increase security and reduce insider threats in a timely manner. The Departments of Homeland Security and Defense are currently operating CE pilot programs that monitor available databases for information on security clearance holders. Although the results of these pilots have not been made public, we believe they show that the technologies and processes already exist and are in use by federal government agencies—making it practical to expand CE government-wide. Implement True Reciprocity among Federal Agencies Perhaps the problem that should be easiest to fix, is the delay in granting reciprocal recognition of clearances to contractors and government personnel who move from agency to agency (or even in some cases from contract to contract within the same agency.) At the government-wide level, the NBIB, established on October 1, 2016, is currently the primary provider of background investigations (BIs), including processing of electronic questionnaires, conducting national agency record checks, and maintaining a central clearance repository. In most cases, the NBIB processes the forms, schedules and conducts BIs, and delivers results to the agencies to adjudicate employee suitability, contractor fitness, and, when needed, a security clearance determination. Agencies can and do impose unique requirements on personnel who have already been granted a clearance by another federal agency, delaying and sometimes denying the transfer of a clearance. Existing regulations already provide guidance for implementing reciprocal recognition. These include language in the January 17, 2017, executive order to modernize the executive branch-wide governance structure and processes for security clearances, suitability and fitness for employment and credentialing, and the Director of National Intelligence’s (DNI) Strategy and Schedule for Security Clearances Reciprocity. Legislatively, Congress should task the head of each federal Department and the Director of the Office of the Director of National Intelligence to account for, and then justify, each distinct exception among components within their jurisdiction. PSC understands that reciprocity is culturally hard, but implementation would be easy to implement with big payoff. Reciprocity is another area where data are lacking—we do not know the extent of the problem, its contribution to the backlog and wait time estimates, and the reasoning behind why certain adjudications may take one day, one month, longer or never granted at all. Executive Order 13764 states: “Any additional requirements approved by the appropriate Executive Agent shall be limited to those that are necessary to address significant needs unique to the agency involved, to protect national security, or to satisfy a requirement imposed by law.”4 PSC agrees with the criteria but urges the committee to better define when the situations occur. Currently, there is no central tracking of compliance with existing regulations or documentation on the justification for exceptions to reciprocity guidelines and the frequency of their use. 4 Federal Register. Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters (Executive Order 13764). Issued on January 17, 2017. Text from: https://www.gpo.gov/fdsys/pkg/FR-2017-01-23/pdf/2017-01623.pdf For example, at a Professional Services Council event, the Department of Justice (DOJ) alone cited at least five different required sets of background information, with each of those DOJ agencies failing to recognize the validity of similar investigations from any of the others, even within the same department. There is a related problem under which personnel with active clearances are delayed for months or even a year or more when being considered for a separate determination of suitability or fitness for a position. Fixing that may also require Congress to act. These actions would focus attention on risk to the government rather than on rote application of rules. Further, they may lead to efficiencies in the process and synchronization of requirements Department-wide or Intelligence Community-wide. Conclusion As you will hear from the second panel today, NBIB has plans for process changes that offer hope for improvement. DoD, implementing Sec. 925, is working on similar plans. Nevertheless, the failures and shortcomings of the current personnel security process impact uniformed personnel, civilian employees, and contractors across the country—in every state and congressional district—and weaken our national security. The backlog and wait times add risk to government missions, contract performance, and the ability to recruit and hire. Security clearance processes need to be better and faster. PSC applauds the committee for holding this hearing and for emphasizing the need to improve the security clearance systems. Yet one hearing is simply not enough to address the scope and scale of this problem. These issues have arisen time and again. While the recommendations above can help address the problems, only Congress, through sustained oversight, can produce agency implementation of these reforms. On behalf of PSC and our members, I thank you for your time and consideration of these matters. As always, PSC is available at your convenience to address any questions or concerns you have, now and in the future.