Whether you consider Edward Snowden a hero or a traitor, lots of people are wondering how he ever got security clearance to handle top-secret information at the NSA. According to the Government Accountability Office (GAO), it was disturbingly easy.
On June 20, the GAO reported to a ongressional committee stating that, "Executive branch agency efforts to improve the personnel security process have emphasized timeliness but not quality."
In its investigation, the GAO focused on top secret security clearance background checks conducted by the U.S. Office of Personnel Management (OPM) - the fed's human resources department - and the Department of Defense (DOD). In both cases, the results were disturbingly less than sparkling.
"In May 2009, GAO reported that with respect to initial top secret clearances adjudicated in July 2008, documentation was incomplete for most of OPM investigative reports," stated the report. "GAO independently estimated that 87 percent of about 3,500 investigative reports that DOD adjudicators used to make clearance decisions were missing required documentation."
At that time, the GAO recommended that the OPM's Federal Investigative Services be directed to keep track of how often its security background checks complied with federal investigative standards, "in order to improve the completeness--that is, quality--of future investigation documentation."
While the OPM agreed at the time, none of the recommendations had been implemented as of March 2013, according to the GAO.
Security Suffers a Lack of Guidance
In July 2012, the GAO told Congress that the Director of National Intelligence (DNI) retired Lt. Gen. James R. Clapper, had failed to provide the federal agencies with "clearly defined policies and procedures to consistently determine if a civilian position requires a security clearance," without which, "executive branch agencies will continue to risk making security clearance determinations that are inconsistent or at improper levels."
The Director of National Intelligence is appointed by the president with the approval of the Senate and serves as the principal adviser to the president, the National Security Council, and the Homeland Security Council on national security-related intelligence issues.
Too Many Know Too Much
When it comes to keeping a secret, the fewer people who know it, the better the secret is kept. However, the GAO found that not only have officials at the DOD and Department of Homeland Security been granting security clearances to people who did not really need it, they did not even know how many security clearances they were issuing.
"Executive Order 12968 says that, subject to certain exceptions, eligibility for access to classified information shall only be requested and granted on the basis of a demonstrated, foreseeable need for access, and the number of employees that each agency determines is eligible for access to classified information shall be kept to the minimum required," wrote the GAO.
The GAO found that while DOD and Homeland Security officials were aware of the need to keep the number of security clearances to a minimum, they failed to audit how many people were given security clearance, why they needed it, and exactly what information they had access to.
In addition, GAO found that in many cases, DOD and Homeland Security officials were failing to cut off employee's access to secret information after the employee had been terminated or not longer needed access to the information.
What the GAO Recommended
The GAO recommended that everybody involved, including the Director of National Intelligence, the Director of Office of Personnel Management and any other federal agencies that issue security clearances develop and actually enforce policies and procedures for deciding exactly which federal civilian positions need access to secret information.
In addition, the GAO recommended the agencies periodically review and revise or validate the security clearance designation of all federal civilian positions
The Director of National Intelligence agreed with the GAO's recommendations and identified actions to implement them.