Social Media Monitoring in the Security Clearance Process

Social media monitoring used to be the elephant in the room when it came to the continuous vetting of employees working for the federal government. Security Executive Agent Directive 5 was signed in May 2016, paving the way for cyber vetting of cleared professionals. The policy came as the government was looking to advance its efforts to prevent insider threats following the 2013 “year of the insider,” when Aaron Alexis killed 12 people in a mass shooting at the Washington Navy Yard, and Edward Snowden conducted a massive data breach, revealing thousands of highly classified government documents. 

Addressing insider threats became paramount, and the government considered how its security vetting process could help identify red flags before they became security risks. Enter SEAD 5 and cyber vetting: another tool in the government’s insider threat arsenal.

The policy was just that – a policy, not a procedure. In the years since, many security clearance applicants have been left wondering what – if anything – the government is considering in an online search of security clearance applicants. SEAD 5 created a framework for federal agencies to use as they implemented their own social media monitoring programs. And in many agencies the policy still hasn’t extended beyond pilots and possibilities.

“There is one time, one case, where we found it as a part of the adjudicative process where security officials on their own motion issued a denial of a clearance on the basis of social media monitoring,” said Sean Bigley, a security clearance attorney with the law firm Bigley Ranish.

That’s not to say social media couldn’t come up in the course of a background investigation, but in cases thus far, the social media aspect has generally been surfaced by human means versus mass monitoring – social posts get reported, and then disseminated to leadership, for instance. 

What Could the Government Consider as a Part of the Cyber Vetting Process?

As those enrolled in the government’s continuous vetting program (which is 100% of all security clearance holders today) know – you shouldn’t expect a postcard from the government notifying you that you’ve been enrolled. With the same possibility around social media monitoring (while the government may not be widely doing it, individual agencies are, and more could in the future), what should security clearance holders be aware of?

First, it’s worth noting that the government’s definition of social media is broad – the cyber vetting possibilities may not be endless, but as the government considers the topic the term “publicly available information” is a better way to consider the websites that may be looked at, including:

• Social networks (Facebook, LinkedIn)
• Microblogging websites (Twitter)
• Blogging and Forums (WordPress, Tumbler)
• Picture and Video Sharing (Flickr and YouTube)
• Music Sharing (Spotify)
• Online Commerce Websites (eBay)
• Dating websites (Match.com)
• Geosocial network websites (TripAdvisor)
• News and media websites where people can comment

Security clearance holders should know that comments made publicly can be used against them in the security clearance process. The best step to take to ensure information doesn’t come back to bite is to keep your accounts locked down and private. The policy is clear that clearance holders will not be asked to share information like passwords. If you keep your accounts appropriately protected, you help keep your personal identity – and clearance eligibility – safe. 

“The takeaway that I have from a legal perspective for that is to make yourself private,” advises Bigley. “That’s not to say everyone who makes their account private is trying to hide something, but if you don’t want the government prying on certain aspects of your private life -- I think that is understandable for most of us.”