Statement of Kevin Phillips, CEO ManTech Inc. Hearing on Security Reform Senate Select Committee on Intelligence 7 March 2018 Introduction Mr. Chairman, Vice Chairman, and Members of the Committee. I am honored to present to you our industry and association partners’ views on security clearance reform. I want to express appreciation for the Committee’s leadership on this issue which recently led GAO to elevate this issue to its “High Risk” list. We also appreciate the very helpful legislation in Section 603 of your FY 2018 Intelligence Authorization bill. I speak today not only for my company, ManTech, but am also reflecting the input of a group of 15 major professional services companies and six industry associations who support national and homeland security with whom I coordinated my testimony. I would like to address five areas: 1) Industry experience with the clearance backlog 2) The impact of the backlog on national security 3) Goals for reform 4) Views on government progress 5) Recommendations Industry Experience with the Clearance Backlog Since 2014, the time required for receiving security clearances has more than doubled. To put it in perspective, consider how much time this process consumed in 2017, the most recent year for which we in industry have data: In 2017, the average time to complete initial TS/SCI clearances was 400 days – with timelines ranging from 325 days to as many as 598 days. The average timeline for adjudicating a SECRET clearance was 231 days. Cross‐over clearances (when a contractor moves from providing services at one agency to another) averaged 21 days and varied widely by agency – an average range of 12 days for the Intelligence Community to up to 97 days for the Department of Homeland Security. While three weeks might not appear excessive to process cross‐over clearances, any delay disrupts industry’s support for the government mission. The problem is the process itself. As a point of reference, consider that 23 different agencies within the Federal Government possess delegated authority from the DNI to perform either background investigations or adjudications. 1 This increases the complexity and variation of practices for cross‐over clearances and background investigation processing. In addition to performing clearance determinations, many agencies apply additional, sometimes unique hiring standards referred to as “suitability” or “fitness.” In the services support industry we know from experience that agency‐specific “suitability” or “fitness” requirements sometimes delay approval of cross‐over clearances and create additional requirements in the contractor’s security clearance process. (“Suitability” standards apply to federal employees and “fitness” standards apply to contractors.) Yet agencies do not typically reveal to industry the specific standards associated with suitability or fitness that they apply. As the Suitability Executive Agent, OPM has responsibility for suitability, fitness policy and standards across the government. As the Security Executive Agent, the DNI has responsibility for policy and standards for security background investigations. Having two entities share policy‐making responsibilities for trust functions across various government agencies adds to complexity and delays in agency execution. The Impact of the Backlog on National Security We believe that the current backlog of over 700,000 clearance cases constitutes a major national security issue — it is not a “back‐office” administrative function. The slow pace of the security clearance process prevents us from recruiting and hiring the talented individuals critical to national security. Specific areas impacted include weapon systems, space missions and operations, cyber network operations and cyber security, cloud computing, data science and analytics, and hardware manufacturing. Nationwide, technology professionals are in high demand. They will not wait for a year or longer to obtain a clearance to begin the meaningful work which contributes to the innovations demanded by national security priorities. This problem threatens the nation’s ability to achieve a top objective in the Pentagon’s recently‐released National Defense Strategy: “Establishing an unmatched twenty‐first century National Security Innovation Base that effectively supports Department operations and sustains security and solvency.” It also constrains our nation’s ability to lead in research, technology, invention, and innovation — integral components of the second Pillar of the President’s National Security Strategy. The backlog impacts mission, efficiency and jobs. As a result of the security clearance delays from 2014‐2017, we estimate that approximately 10,000 contract positions critical to the Intelligence Community remained unfilled. The inability of the government and industry to hire private sector talent has negatively affected the government’s ability to perform critical national security missions. These unfilled positions also represented roughly $1.8 billion of lost services contract support for critical missions out of the $71 billion annual intelligence budget— a direct result of the lack of cleared talent. Additionally, we estimate that due to the increased investigation backlog the vast majority of industry’s recruiting efforts for intelligence community positions in 2017 focused on personnel who already held a clearance. This means that Government and industry effort was directed toward reciprocity requests and periodic 2 reinvestigation submissions. The time and effort spent on lengthy reinvestigations significantly undercuts the ability to hire the new contractor talent necessary to support missions, such as cybersecurity and the introduction of new technologies and innovation. Moreover, the increasing gap between cleared contractor talent and mission needs drives up demand, and subsequently increases contractor salaries, thus increasing the cost the Government pays for classified services. For all these reasons, reducing the 700,000 security clearance backlog is our industry’s number one issue and is why we are working with the Federal Government to resolve this challenging problem. Goals for Reform We offer three simple but not easily achievable goals for government security clearance reform. They are that the: 1) Government should immediately implement an effective course of action to substantially reduce the backlog of security clearances to a healthier and more sustainable level (similar to those in 2014) in the next two years, and ultimately to the much lower levels implied by the ambitious timeline goals in IRTPA. Achieving these goals will allow us to more rapidly hire and retain the required, trusted workforce; 2) Government should reform clearance standards and cross‐agency reciprocity practices which will substantially reduce the time to clear a contractor moving from one agency or job to another, thus improving the ability to place cleared talent on critical contracts; 3) Government and Industry should make available information to each other in a timely manner to improve our collective ability to detect and deter insider threats that may compromise classified information. Views on Government Progress To help advance these goals, our industry partners actively interact with our government customers at all levels, and (at their invitation) with the senior members of the interagency Performance Accountability Council (PAC) chaired by OMB. In addition to the OMB, PAC Principals include senior executives from the OPM, ODNI, and DoD. Federal officials recognize the need to reduce the current clearance backlog and are working toward changes that will improve the process in the long term. We applaud the efforts by PAC Principals, NBIB, and DSS to implement business process improvements in tandem with investment plans for new IT systems. We believe that Congressional oversight can help keep this progress on track. We are also encouraged by preliminary government consideration of an information sharing program with Industry, as well as by the Government’s intention to treat 3 contractors moving from one agency to another on par with government employees. Finally, we also believe that DoD’s continuous evaluation (CE) pilot is an important step toward primary reliance on CE. Recommendations Despite significant movement, there is still much that needs to be done particularly while we await the arrival and impact of new IT systems and more uniform processes and standards. Because these delays impact our ability to meet our customers’ mission requirements now, we offer five near‐term recommendations for your consideration, as well as two additional suggestions for long‐term reform. 1) Funding: We urge Congress to invest near‐term resources to increase the Government’s capacity to investigate and adjudicate cases. In our experience, over the last few years our government customers’ field investigative teams have not been able to meet the needed case load due to funding constraints. Therefore, we seek Congressional support for additional funding in Fiscal Year 2018 and 2019 to reduce the current 700,000 case load. We recommend that agencies present budgets in a clear and transparent fashion that will permit Congress to track whether funds authorized and appropriated for security clearance processing get reprogrammed “below threshold” for other purposes in the year of execution. Additionally, given the sheer volume of background cases involved, as DoD assumes responsibility for its own clearance investigations, we believe it will require strong program management to implement and coordinate the transformation. Talented people are critical for the development, sustainment, and enhancement of major ship, plane, satellite, armored, IT, and mission systems. Indeed, in the cyber domain top trained people are our ships, planes, and satellites. Until new systems, standards, and automation improve the speed and accuracy of clearance processing, increased funding for investigations and adjudications will remain critical to reduce and reverse the increasing backlog. It is also paramount to ensure the continuity and productivity of the current investigative workforce in order to reduce the backlog. 2) Prioritization and Continuous Evaluation: Irrespective of funding levels, we recommend that the agencies prioritize the backlog to devote resources to those cases having the greatest mission need ‐‐ regardless of whether such cases originate from the Government or from industry. The current “First in, First out” efforts to complete cases, versus mission impact or insider threat risk, reduce the ability to apply investigative resources toward cases with higher security risk as well as cases of greater mission need. This approach may mean suspending time‐based periodic reinvestigations for lower tiered clearance level cases in favor of reliance on CE ‐‐ an action this Committee’s own FY 2018 Intelligence Authorization bill suggests. We strongly support a shift to CE as the primary means for verifying trustworthiness as part of the risk assessment for continued access to information. 3) Reciprocity and Portability: First, a uniformly applied set of standards and procedures is needed across the entire Government to guide “suitability” and “fitness” determinations 4 that currently slow many cross‐over clearances. These standards should be made public and require the Suitability Executive Agent to approve the special needs of individual agencies in advance. With these standards in place, agencies could then immediately grant provisional cross‐over access for individuals who possess the same or higher level clearance required by the new position. This would be the norm, not the exception — such moves across agencies could then be implemented by notification as opposed to formal approval. Second, the Government should enforce the good, existing reciprocity policies — the DNI, as the Security Executive Agent, and Congress can hold agencies accountable for complying with these policies. Third, we support a paradigm shift to make clearances “portable” for contractors based on personal trustworthiness, and not the particular contract on which they happen to work. These reforms should reduce typical cross‐over times from weeks or months to days, or even hours. These policy actions are extremely important because they would help reduce the clearance backlog and re‐direct investigative resources toward higher risk and higher mission needs, thus bringing critical new talent within the cleared workforce. The improvements we seek in this area should not require additional resources, only process improvements. 4) Information Sharing: We understand the ODNI has developed a plan for a government information‐sharing program that this Committee urged in its FY 2018 Intelligence Authorization bill. This program would make available personnel security information (stored in a central repository) among Government and Industry, and even between companies for employees who have applied to positions requiring security clearances. We urge establishing such a program as soon as possible. This would enable all of the public and private sector to identify and respond appropriately to insider threat security warnings. 5) Reinstituted IRTPA Timelines: We strongly support the GAO recommendation to construct a government‐wide plan, including milestones, to meet timeliness objectives for the completion of security clearance investigations and adjudications. Such timelines would cover the entire clearance lifecycle, and would enable the Executive Branch to drive towards near, mid, and long‐term objectives. It would also permit Congress to hold the Executive Branch accountable to quantifiable performance metrics. This approach worked in the last decade to help reduce an exploding case backlog. As GAO noted, the expiration of IRTPA reporting timelines in 2011 makes it difficult to evaluate and identify where and why delays exist, or to direct corrections where necessary. In the long term, we need to radically simplify the clearance process by creating one set of uniform, simplified, and transparent standards to determine who is trustworthy. These standards would effectively streamline the numerous independent categories of “suitability,” “fitness,” and “security,” and eliminate disparate individual agency practices. Such a construct would require much stronger coordination and streamlining of standards within the multitude of government authorities and may benefit from one single trust authority. In addition, we recommend that the government leverage and exploit new, ever‐advancing digital technologies, including social media analytics, to create a modern, all‐digital and 5 electronic security clearance process. This will drastically reduce costs and cycle times, while achieving improved security standards and outcomes. Such a process would utilize the exponentially growing, publicly‐available, digital profile that we all generate, thereby providing investigators real, direct information about behaviors bearing on trust. Although this is a vision for long‐term transformation, we need to begin moving toward it now. Conclusion On behalf of our industry and association partners we appreciate this opportunity to present our experience and recommendations on the security clearance backlog and those issues affecting it. We are acutely aware of the enormous harm that can result from intentional or unintentional compromises of highly‐classified information by employees unworthy of the Government’s sacred trust. The Administration and the Congress correctly focus on these dangers. We do as well. In no way do we suggest weakening rigorous personnel vetting to improve processing speed. This said, slow security is not good security. The critical need for an improved security clearance process further highlights the need to protect and monitor our classified environments. We must weigh the risks of security compromise from untrustworthy personnel within our networks against the risk of compromises to our networks from attackers outside of them. We weaken the collective defense of our cyber domain if we cannot bring top talent into this fight. Our inability to vet talent, new or existing, in a timely manner within a fully funded security clearance process impacts our efforts and effectiveness. Industry strongly believes that the focus of Congress, and of this committee in particular, will be key in determining the Government’s ability to reduce the backlog to normal, healthy levels, and to do so in a way that makes our nation’s security stronger through a faster, more effective security clearance process. 6 The following Companies and Associations have reviewed and agree to this testimony: Industry Associations ManTech International Corporation Aerospace Industries Association (AIA) Amazon Intelligence & National Security Alliance (INSA) BDO Industrial Security Working Group (ISWG) Booz Allen Hamilton CACI CSRA National Defense Industrial Association (NDIA) Northern Virginia Technology Council (NVTC) DXC Professional Services Council (PSC) Engility Leidos Microsoft PAE SAIC Salient CRGT Telos Vencore 7