118 Days, On Average, To Get Clearance (WSJ)

The Wall Street Journal reported last Friday (Thanks, Victoria!) that the average time it took to get a clearance had increased from 106 days last year to 118 days this year but that plans were in the making to shave 44 days from the process by the end of next year. The article also indicated that Pentagon employees receive their clearances in and average of 104 days while outside contractors take 151 days to complete.

DNI Mike McConnell has been complaining about the delays in processing security clearances since before he was the DNI and began his tenure as DNI with calls for reform in the process. In fact, modernizing the security clearance process is a core initiative of the DNI's 500 Day Plan. The Intelligence Reform and Terrorism Prevention Act of 2004 (which the 500 Day Plan adopts as its metric) calls for the community to have 80% of its clearances complete within 120 days. The DNI has to be concerned that the trend is moving in the wrong direction and that there are still substantial, identifiable groups where the time frame is well outside the 120 day window (For a recent GAO report on progress in security clearance reform, click here).

Nada Nadim Prouty: Inevitable

There has been a good bit of coverage in the press about the case of Nada Nadim Prouty and her ability to slink past both the CIA and the FBI counterintelligence efforts over the last eight years. There is still an ongoing discussion as to how much damage Prouty has actually done but there seems to be a growing belief in the op-ed pages that such a mistake is the result of incompetence.

Whether there was incompetence involved or not, such cases are increasingly inevitable. They are a mathematical function of the size of the intelligence community and the impossibility of a perfectly efficient clearance system.

Consider the numbers: There are approximately 100,000 people in the intelligence community. Out of this 100,000, how many are spies? It has to be more than 0 but it is likely less than 1000 (which is only 1% of the population of the intelligence community, BTW...). It can't be 1000. If it is 1000 or more, I think we can all agree that we are sunk anyway.

Let's say it is 100. That is not only a nice round number but also means that just one in 1000 people you might meet in the halls of the CIA, DIA or NSA is a spy. If you look at the number of spies caught over the last few years and compare it to the size of the community (roughly), the number 100 actually starts to make a lot of sense. Its not a perfect number by any means but it is a good place to start.

What then, is our ability to catch spies? Well, no one knows that but lets say it is 99%. In other words, every year we catch 99% of the spies in the intel community. Now 99% is probably way too high. I don't think anyone thinks we are doing that well catching spies. Let's give people the benefit of the doubt, though.

If we are catching 99% of the spies each year and we have 100 spies in the community then, at the end of the year, we will catch 99 and one will slip through the net. It is mathematically inevitable.

There are two additional consequences to this line of reasoning. First, it pretty much proves that either we don't have a system that is capable of catching 99% of the spies every year or we have a lot more than 100 spies in the system. Prouty worked in the community for 8 years and to be that lucky in the face of a system that capable of catching spies each year is stretching reality. If you jump the number of spies up to 1000 (still only 1% of the workforce) then you are looking at 10 spies getting away each year and the odds that Ms. Prouty could go about her business unmolested by the CI types for eight years goes up as well. Since we already decided that the total number of spies in the community couldn't realistically be 1000 spies (that's nearly 63 spies in each of the intel community's 16 agencies), it pretty much has to be that the spy catching ability is less than 99%. Far less. Which means that there are likely lots of spies (say 100?) running around. It is, as noted, a mathematical consequence of a large community and a less than perfect system for catching spies.

The second consequence is a result of what scientists call false positives. Virtually all testing systems generate some level of false positives -- where, in this case, the system says someone is a spy but, in reality, they aren't. What if only 1% of the cases within our hypothetically 99% accurate system are false positives ? Out of 100,000 people, that is still 1000 people. 1000 people currently employed by the intel community that are accused of being a spy when, in fact, they are not. They would falsely lose their clearance and their job and may even face jail time.

It is very difficult to imagine that the false positive rate is only 1%. That rivals the rates in systems much more amenable to verification than a system that involves humans. It is also hard to believe that the intelligence community fires or imprisons 1000 people a year for being spies. First, I think we would have heard about it and, second, imagine the morale problems such dismissals would cause.

Which means the system is lying to itself.

With 100,000 people in the community, false positive rates at anything higher than 1% would cause thousands to come under suspicion. These thousands of cases would have to be resolved, mostly by dismissal of the case, otherwise the morale and effectiveness of the intel community would come under serious attack. There is no way out. Either dismiss lots of people as an inevitable result of a nearly but not quite perfect system or dismiss lots of cases in order to preserve the morale and effectiveness of the community.

The real negative impact of this case may not be in the information Prouty may or may not have stolen and passed to Hezbollah but in the chilling effect it will have on diversity hiring. The DNI has recently stated in his 500 day plan that one of the major goals is to "Improve Recruiting, Hiring and Retention of Heritage Americans (1st and 2nd Generation Americans)". The intent behind this goal is to "employ, develop, and retain a dynamic, agile workforce that reflects diversity in its broadest context — cultural background, language capability, ethnicity, race, gender, and expertise." How much more difficult will it be for Arab-Americans, for example, to get a clearance as a result of this case? How many Arab-Americans will willingly go through the clearance system (background checks, polygraph, etc.) as a result of this case? How will this impact other ethnicities and their perception of the intelligence community? How will this impact the security clearance process in general? The realistic answers to these questions do not look promising if one is concerned about meeting the goals of the 500 day plan.