DOD personnel now subject to 'continuous vetting'

All defense and military personnel are now a part of an automated "continuous vetting" program that will flag concerning behavior or circumstances as part of the security clearance process. But expansion of the program still hinges on the development of a "fragile" IT system, according to defense officials.

William Lietzau, the director of the Defense Counterintelligence and Security Agency, said approximately 4 million defense personnel, including military, civilians and contractors, are subject to the continuous vetting program, which is part of the agency's Trusted Workforce 2.0 initiative and security clearance process.

"This step removes the requirement for periodic re-investigations by applying a risk managed approach with select automated records checks," with some parts of vetting requiring human analysts, such as sorting out false hits and "triaging" the system where needed, Lietzau told reporters Oct. 5, adding that it would eventually "fully replace periodic reinvestigations."

The partially automated process relies on numerous data sets to provide ongoing alerts. DCSA looks at several data sources, which it expects to grow and potentially include social media activity and extremist behavior links, that are broken up into categories: criminal checks, suspicious financial transactions, foreign travel records, terrorism and counterterrorism databases, public records and credit bureau reports. Those categories are in addition to specific eligibility requirements laid out by the requesting agency or department.

But while the categories for the data used in the continuous vetting process are "fairly permanent," DCSA is looking to expand the types of data sources it uses, including social media activity, Lietzau said.

"We're always looking for better data sources to give us a bigger picture. And then we're always looking for better analytical approaches, and leveraging IT systems to be able to get from a point of an alert to 'is this something actionable that we should be doing something about'," Lietzau said.

Lietzau called it an "evolving system" that will have an "increasing array of data sources and categories" that puts DCSA a quarter of the way towards its ultimate goal to have all clearances ingested into Trusted Workforce 2.0 by the end of 2023.

DCSA is also working through multiple pilot programs to evaluate the potential value of social media in the continuous vetting process.

"We're still, right now, analyzing how much value we think there is," Lietzau said, adding that questions surrounding civil liberties and privacy would "be dealt with over time as we kind of incrementally move forward in this."

Lietzau said continuous vetting could eventually broaden to include federal government workers with suitability clearances, but the IT capabilities have to match the need: "To do that kind of growth, I also need to be, at the same time, building the IT architecture that can support it."

That includes learning from the Office of Personnel Management hack in 2015 that exposed federal employees' personal information that was stored in a system born in the 1980s that is now owned by DCSA and being slowly replaced as the agency rolls out National Background Investigation Services.

"That NBIS computer system...it's the one that's ingesting 10,000 investigation requests of some sort every day, but it's fragile," Lietzau said. "And we're replacing that at the same time, and we're replacing it, partly because when that data breach occurred, PPI went out the door. And so you can rest assured that the most secure, unclassified system that we can put in place that is accessible by -- right now we have 120 government agencies that are customers and maybe 10,000 companies in industry-- that system is as secure as you can make it to protect against leakage of PPI."

In addition to defense and national security personnel, 28 federal agencies are using the continuous vetting program with two more enrolled, including the Federal Aviation Administration, General Services Administration, and Health and Human Services, Lietzau said.