DOD launches 'continuous vetting'
In a partially automated process, continuous vetting checks a variety of data sources and flags employees’ concerning behavior or circumstances as part of the security clearance process.
The Defense Department will now conduct automated "continuous vetting" of defense and military personnel as part of its Trusted Workforce 2.0 initiative to modernize the security clearance process. The continuous vetting is designed to flag concerning behavior or circumstances as part of the security clearance process. Expansion of the program, however, hinges on the development of a "fragile" IT system, according to defense officials.
Continuous vetting “removes the requirement for periodic reinvestigations by applying a risk-managed approach with select automated records checks," William Lietzau, the director of the Defense Counterintelligence and Security Agency (DCSA), told reporters Oct. 5. Some parts of vetting require human analysts to sort out false hits and "triaging" the system where needed, he said, adding that it would eventually "fully replace periodic reinvestigations."
To provide ongoing alerts, the partially automated process relies on numerous datasets, which DCSA expects to expand and potentially include social media activity and extremist behavior links. The reviews are broken up into categories: criminal checks, suspicious financial transactions, foreign travel records, terrorism and counterterrorism databases, public records and credit bureau reports. Those categories are in addition to specific eligibility requirements laid out by the requesting agency or department.
Lietzau called continuous vetting an "evolving system" that will have an "increasing array of data sources and categories.” DCSA is a quarter of the way toward its ultimate goal to have all clearances ingested into Trusted Workforce 2.0 by the end of 2023.
But while the categories for the data used in the continuous vetting process are "fairly permanent," DCSA is looking to expand the types of data sources it uses, including social media activity, Lietzau said.
"We're always looking for better data sources to give us a bigger picture. And then we're always looking for better analytical approaches, and leveraging IT systems to be able to get from a point of an alert to 'is this something actionable that we should be doing something about'," he said.
DCSA is also working through multiple pilot programs to evaluate the potential value of social media in the continuous vetting process.
"We're still, right now, analyzing how much value we think there is," Lietzau said, adding that questions surrounding civil liberties and privacy would "be dealt with over time as we incrementally move forward in this."
Lietzau said continuous vetting could eventually broaden to include federal government workers with suitability clearances, but the IT capabilities must match the need: "To do that kind of growth, I also need to be, at the same time, building the IT architecture that can support it," he said.
DCSA has taken over the Office of Personnel Management’s legacy system, which was hacked in 2015 and exposed federal employees' protected personal information. That system is being slowly replaced as the agency rolls out National Background Investigation Services.
"That NBIS computer system ... it's the one that's ingesting 10,000 investigation requests of some sort every day, but it's fragile," Lietzau said. "And we're replacing that at the same time, and we're replacing it, partly because when that data breach occurred, PPI went out the door. And so you can rest assured that the most secure, unclassified system that we can put in place that is accessible by -- right now we have 120 government agencies that are customers and maybe 10,000 companies in industry-- that system is as secure as you can make it to protect against leakage of PPI."
In addition to defense and national security personnel, 28 federal agencies are using the continuous vetting program, including the Federal Aviation Administration, General Services Administration, and Health and Human Services, Lietzau said.
This article was first posted to FCW.