Oct. 5, 2021
William K. Lietzau, Director, Defense Counterintelligence and Security Agency
STAFF: Good afternoon, everyone. Welcome to today's
roundtable. We're going to have Director Bill Lietzau from DCSA to give a
brief statement here about our continuous vetting announcement that you
all should have a news release about. After that, we're going to take
questions.
So I would ask you to please just raise your hand if you have a
question for us. We have a number of folks participating with us on
Zoom, as well, so we'll include them. And when you do get called on,
please just identify yourself by name and outlet so that Director
Lietzau knows who he's talking to. And we'll answer as many questions as
we can.
The roundtable is scheduled to last for a half hour today and it is
all on the record. So with that and no further ado, Director Lietzau.
DCSA DIRECTOR WILLIAM K. LIETZAU: Thanks, Chris, and thank you all
for being here and helping me communicate this, I think, important and
good news to your audiences and the American public. I'm going to read
my opening remarks, which is a little bit different for me, but in the
interest of time and to leave as much time as we can for questions.
I'm just happy -- I was told there's only one person in here, so I'm
happy there's more -- (Laughter) to hear this news cause I do think it's
a good news story. I -- as you just heard, my name's William K.
Lietzau. I'm Director of the Defense Counterintelligence and Security
Agency. For those of you who aren't tracking it, DCSA was established
two years ago, almost exactly, with the merger of the legacy Defense
Security Service, with the DOD Consolidated Adjudication Facility and
the National Background Investigation Bureau from the Office of
Personnel Management.
We are the largest dedicated security organization in the U.S.
government and we provide some of the most critical functions in
national security, including delivering a trusted workforce, protecting
America's industry, critical technology and supply chains, and providing
enterprise-wide security education, training and certification.
Now, that's why we refer to ourselves as America's gatekeeper. Even
though I said I was going to read my opening remarks, I will just go off
a little bit with a note of pride that the gatekeeper function, the
employees in DCSA, that function is not thought to be a particularly
glamorous one but it's clearly an important one, and DCSA's team has
been hitting it out of the park since the merger. I realize I just mixed
metaphors, with the gatekeeper and baseball, but all right, I'll go
back to the written remarks.
Well before DCSA's stand up in 2019, U.S. policymakers worked to
design a reformed personnel vetting policy based on a single secure
vetting system for the country. The central component to that system is
the continuous vetting of individuals in positions of trust who require a
security clearance. That policy, called Trusted Workforce 2.0, is the
culmination of a whole of government personnel reform effort that is
overhauling the vetting process.
This includes replacing periodic reinvestigations every five to 10
years with a continuous vetting program, ensuring a trusted workforce in
real time through automated records checks and interagency information
sharing.
DCSA has been charged with implementing this continuous vetting
policy by building and designing the processes and secure information
technology needed to deliver it. Today, I can announce that DCSA has
reached full enrollment of the DOD national security population into a
continuous vetting program. This includes uniformed service members,
civilians and defense contractors from industry.
This is a significant step in the effort to enhance the
trustworthiness of our federal workforce and ensure we have even greater
confidence in the individuals we trust to protect our national
security. To get this done, DCSA designed a program to enroll DOD
personnel into an initial version of the continuous vetting system,
offering continuous record checks of the most high value data sources.
DCSA has offered this service outside of DOD, as well, and today, we
have 30 agencies enrolled, outside of DOD.
Continuous record checks means that issues of risk and concerns
regarding an individual's trustworthiness, that it may have taken years
to discover previously, can now be identified and addressed in real
time.
This step removes the requirement for periodic reinvestigations by
applying a risk-managed approach with select automated records checks.
But what we're announcing today is only one step in the direction of
full Trusted Workforce 2.0 implementation, which will include more data
categories and more sources of information, and as a result, also an
increased IT capability to assist with the substantial triaging and
analytical work that you can imagine would be necessary for the many
checks.
Ultimately, in the full Trusted Workforce 2.0 framework, CV,
Continuous Vetting, will fully replace periodic reinvestigations with
real time, continuous vetting. So what does all this mean as a practical
matter? I'd like to share two examples with you.
In one instance just two months ago our team received a CV alert that
generated from a criminal data check. The alert identified a fugitive
arrest warrant for attempted murder, felonious assault and other charges
related to an incident which had occurred only a day before we received
the CV alert.
We validated the alert and immediately shared the information with
relevant security, insider threat and law enforcement points of contact.
Coordination of this alert and cooperation with service -- between
service component and law enforcement authorities resulted in
apprehending the subject. The key is that the alert information,
developed through the DCSA Continuous Vetting system, was received and
validated five and a half years before the subject's next periodic
reinvestigation.
In the second case, an alert was generated from terrorism checks on
January in January of 2021, just three days after the subject was
enrolled in Continuous Vetting. This alert identified that the subject
was under active investigation by another government agency for
potential terrorism activities, including planned targeting of United
States facilities and ties to known or suspected terrorists.
DCSA validated the alert and immediately shared the with the
subject's insider threat and counterintelligence points of contact the
existence of the alert. Further, DCSA efforts ultimately resulted in the
arrest of the subject, who is now pending prosecution. Again, the alert
information developed through the DCSA CV program was received and
validated eight years before the subject's next scheduled periodic
reinvestigation.
So the bottom line is that continuous vetting is working. It was a
good policy to put in place. It's been implemented in its initial stages
in a way that is making a difference and it's helping DCSA deliver a
trusted workforce.
So with that, again, I thank you for being here. DCSA is proud of the
work we're doing to deliver the trusted workforce the country demands
and deserves. And I'm happy to take your questions.
Ma'am? I'm I supposed to pick people?
STAFF: You can certainly do that, sir.
Q: Caitlin Doornbos with Stars and Stripes. I'm wondering if you can
talk a little bit more about the risk factors in the records that you're
(inaudible) that are being continually analyzed.
MR. LIETZAU: So we look at data sources. And it is an evolving
system. So this is kind of an initial stage. We're calling it Trusted
Workforce 1.25. We have plans to get to 1.5 and 2.0. And what you have
is an increasing array of data sources and categories.
The categories include criminal checks, suspicious financial
transactions, travel records in foreign travel records, different
terrorism and counterterrorism databases, public records, credit bureau
reports, and then eligibility requirements that are associated with the
agency or department that the person was in.
So those are the categories and then there's a number of different
data sources. And the categories are fairly permanent in policy but
we're always looking for better data sources to give us a bigger picture
and then we're always looking for better analytical approaches and
leveraging IT systems to be able to get from a point of an alert to is
this something actionable that we should be doing something about? And
that process, obviously is significant.
If I think of this agency generally, if we go to investigations --
let's back up for a minute from Continuous Vetting which is the new
development -- in investigations alone, DCSA ingests about 10,000
investigation requests per working day. So this something that's done at
scale. This isn't individuals who we're seeing with something in the
back window that gave some concern. So we have to be able to do this at
scale.
That is a difficult enough process. But if you imagine, then, taking
3.6 million to 4.1 million people, depending DOD versus the whole of the
U.S. government that DCSA is cognizant over. And then looking at
regular, automated, sometimes daily data checks as the data comes in and
you have to identify is it the right person. Is that the person that we
have in our databases or is that a different Jeff Smith? And is that
new piece of information something we've already looked at before or
adjudicated before?
So when you think about the scale of that -- go back to my earlier
comment about 10,000 investigations a day, that's for things that we've
already identified need to be investigated. Now, we're talking automated
checks. It's a large amount of data. And so we have to build the IT
systems and processes to be able to handle that data.
Yes, ma'am?
Q: A couple of follow-ups on that -- Tara Copp with Defense One. So
you're going to have what sounds like an enormous data collection task
of this regular pulling of the population from all these different
databases. Are you going to be doing hiring? How are you going to have
the infrastructure to be able to process all of this?
And then secondly, you mentioned that -- in one of the examples the
individual was flagged by your system in January 2021 because of a
wanted arrest or wanted -- you know, suspicion of -- of whatever he's
doing. Was this person involved in the Capitol -- the attack on the
Capitol on January 6th and is that why they popped?
MR. LIETZAU: Okay, so going to your second question first because it's in my brain. No, it was -- it was a different case.
But for instance, if somebody were to be arrested as part of the
Capitol -- that is something that would hit Continuous Vetting. In fact,
in the industrial security side of the house I'm the one who signs off
on removing someone's eligibility in instances like that. And so that
certainly can and I believe did come up back in January.
With respect to the processing of all this data, you're absolutely
right. And that was my little inject of a pride point for the DCSA labor
force. These are dedicated, patriotic Americans that are working at
DCSA. They're never going to have a TV show about them, but they are
very much interested in having a trusted workforce for the U.S.
government.
And so, while this organization was coming together and merging to
become what's now DCSA, and we're in a pretty significant transformation
process, we're also looking at what processes make sense to be able to
check all these categories.
And I can tell you right now, for a subset of the categories which
have the least chaff, if you will -- the least, you know, false hits and
things like that. That subset, we can do manually using trained
personnel and with analytical capabilities. And they are are using a
triaging system where they can go through that small number of hits and
work through the cases.
But, of course, they can't do that with a pretty substantial database
with some -- some IT tools that allow them to do an initial screening.
What we're trying to build though ultimately is not so much a workforce
hiring, which we are in the process of doing. We've built up the
continuous vetting workforce. It's in place. Every time I visit, there
are more people there than there were the last time I visited.
But but besides building up that workforce, what we're doing is we're
building something called the National Background Investigation
Service, NBIS, a IT system which was designed to replace the OPM legacy
IT system that was hacked. Besides replacing that system, we're building
it to be able to cut back on the workload of those people doing the
triage and the analytical work so that the computer-aided capabilities
will help us be able to reduce the workforce. If we did all of this with
simply a manual workforce, the cost would be astronomical. So we have
to be comparing IT systems.
Q: Just one quick follow-up, if I may. You said that, you know, it
sounds like this workforce is going to continue growing. Do you
anticipate that the number of databases that you tap will also grow? Do
you see your agency ever having a role in looking at social media for
potentially like extremists views or behavior as part of the overall
vetting?
MR. LIETZAU: Yes and yes. We will clearly be continuing to grow in
these areas. I do see more data sources coming online. I know which ones
we're bringing online now, but there is no doubt there might be others
that come up. And we already have several pilot programs we're working
on to look at the value of social media and how you can look at it,
whether it's an event-driven look at social media, whether it's a
regular continuous look at some social media, or whether it's a one time
when their investigated look at social media. There is different ways
you could use some of the social media search capabilities that are out
there. We are still right now analyzing how much value we think there is
in that.
Ma'am.
Q: Sylvie Lanteaume, AFP. You spoke about CV alerts. How does it work
exactly? Can you give us an example why you are alerted, what happens?
And also how do you reconcile this vetting with the freedom of
expression of people who work for the government?
MR. LIETZAU: Yes, that's a great set of complicated questions that we
could talk about for a long time. But I will give you the kind of
summary answer. Essentially how it happens is we ingest someone into our
continuous vetting system where we put in ttheir personal data so we
know who we're looking at, you know, various criteria so that a computer
can hopefully identify that this is the Jeff Smith that got the DUI
last night is not the Jeff Smith who we don't care about, or vice
versa.
So we have them ingested in a system. And then they're ingested into
data sources that automatically report to our team on a -- depends on
the type of data source how frequently -- for instance, a credit report
might be every six months, whereas a specific suspicious financial
transaction might be more frequently, criminal check might be whenever
it happens and so that sends to our team in Continuous Vetting the fact
that this happened.
That team then takes it with whatever other analytic capabilities
we've built into the IT system yet -- and that's changing hopefully on a
regular basis, we're improving it -- and they use that to then look at
the person's previous records and say "have we dealt with this before?"
We send it to the unit where they're from. They look at it and see if
they've dealt with it before and then determine if more investigative
action needs to take place to address it. So it becomes manual and we're
trying to automate it as much as we can, but, you know, the initial
stages are fairly manual, then it gets more automated.
With respect to freedom of expression, you're kind of delving into,
like, a social media category a little bit. And I think in that regard, I
kind of push that question off onto the policymakers. We are the
implementors of those policies.
We are looking at where we can use social media to identify problems
but we have adjudicative guidelines that our adjudication team uses when
they're determining if somebody should keep their clearance or not have
their clearance. And so those are the guidelines that drive us, not any
particular comment made or political speech. Those issues aren't really
at the forefront for us yet because we're looking at the kinds of
categories I mentioned to determine if there's a risk for that person to
continue to hold a clearance.
So I think those questions you're asking -- freedom of speech --
those are absolutely appropriate questions and privacy questions, as
well, that are all going to be dealt with over time as we kind of
incrementally move forward in this.
Sir?
Q: Yes, thanks. Sort of following up -- my name is Tom Squiteri, I'm
with Talk Media News. You said a couple of things before and I want to
repeat them, to make sure I heard them clearly.
At one point, you said something like "we get about 10,000 requests
per day," and then a couple minutes later, you said "areas that we have
identified." To -- to me, I'm a little confused -- are you -- you – do
you have in your database now, everybody from DOD? This is -- these are
the -- this is my question -- how -- are you -- do you wait until an
agency requests "could you check on Jeff Smith for us?" to do that, or
is this continuously vetting of DOD people -- "no, no, no, that's OK,
we'll get a look at the E-Ring today and vet those people?"
MR. LIETZAU: Yeah.
Q: That's -- in other words, do you start -- are you proactive in
your own or you're reactive or both? Does that -- does that make sense?
MR. LIETZAU: Yeah, it absolutely does, and I realize I probably
caused that question a little bit. They're a little bit different
issues. My 10,000 comment is just cause it's a nice, even number that
I've been able to remember, and that's the number ...
Q: (Inaudible)…that number for my boss, just for my next raise.
(LAUGHTER)
MR. LIETZAU: It -- it -- that is investing -- that's -- that would
exist apart from continuous vetting. Those investigations that come in
every day are everything from "this person needs a top secret clearance
to be able to do the work that they need to do in the Pentagon" ...
Q: OK.
MR. LIETZAU: ... to "we have a childcare worker on the southern border and we need to do a quick check on their background."
Q: ... that would be -- in other words, like Tara's example, that the
January -- that was a specific request to look at this individual? That
would be that kind of thing?
MR. LIETZAU: Yeah, but it wasn't based on an event. It's usually
based on they're going to join the workforce. So your first time coming
in the workforce, you get that kind of investigation. Then, I have a
pool of somewhere 12 to 15 million that have suitability clearances and
probably about four million who have national security clearances, like
at secret or top secret.
Within that pool, that's the pool that, right now, we are doing
Continuous Vetting on. And so that is automatic. So the policy is such
that if you're the Army, you can't say to DCSA "hey, we want to do an
initial investigation of these, you know, 100 recruits to see if they're
good soldiers and should we bring them in as recruits and give them a
secret eligibility so they can be in the Army."
Once they tell us "here's the 100 people, we want to recruit them,
put them in the Army, do a background," that's one of the 10,000. We do
an investigation. Once we do that investigation, even now, as we're
doing it, we're ingesting them into Continuous Vetting.
So in the past, 15 years ago, that person might get a secret
clearance eligibility assigned to them, and 10 years later, we'll
reinvestigate to see if they still should have it. Today, we're doing
that same investigation but then we're going to kick off Continuous
Vetting.
Q: OK, so that -- that does answer it. And then the -- the -- if I
may, just to follow up a little bit on that -- so I got that, you get --
you get them. And once you're in the pool, you're doing the Continuous
Vetting of them. How often would that happen then without any kind of
triggering incident? So look at me, let's say, or, you know -- how often
would I be vetted or anybody who was in that pool?
MR. LIETZAU: All -- all the time.
Q: All -- all -- well ...
MR. LIETZAU: So it's -- so it's automated and it depends on the check
that it -- so that's where your credit might get checked every six
months, but if you've got a DUI, we're going to find out the next day.
Q: So a DUI would come in and -- and trigger or flip -- it -- send
out a red flag and you'd say "oh, let's look at Jeff Smith, he got a
DUI?"
MR. LIETZAU: Exactly.
Q: OK, thank you very much. I appreciate your patience on ...
MR. LIETZAU: Sure -- sure.
And I know you've been (waiting ?).
Q: Meghann Myers, Military Times. So how does this work in with DOD's
efforts to monitor extremist behavior, extremist ties? And you
mentioned this a little bit but what kind of security clearances and job
descriptions, job levels would be covered under this? Because clearly
it's not every single person who works in the building or every single
person who's in uniform necessarily, it would be different levels for
different clearance requirements.
MR. LIETZAU: Yeah, so it's a -- so the monitoring extremism ties,
it's -- it's directly related. We're -- we obviously are in our
adjudicative standards and have, for years, been looking at extremist
behavior of different sorts. And so clearly, the efforts at finding
extremist behaviors are very much related to Continuous Vetting.
There's other programs -- I just came here from down the road at our
-- what we call our DITMAC, Defense Insider Threat -- help me out.
(LAUGHTER)
... Management Center, DITMAC, D-I-T-M-A-C. That's the insider threat
hub that collects from 43 other DOD insider threat facilities,
specifically looking for maybe a more event-driven look at potential
extremist behavior. So Continuous Vetting is unquestionably a benefit
for identifying potential movement in the direction of extremist
behavior.
In terms of how many people, right now, we're looking at the -- the
DOD people -- well, it's more than DOD. I said it's gone outside. The
way the policy in the U.S. government works, you're not required to use
DCSA, there are other providers, but we're the 95 percent solution. So
all of DOD's people with national security clearances, which does
include everyone in uniform, are in our Continuous Vetting program, and
then other agencies -- like I said, as of yesterday it was 27, today
it's 28 plus two more are enrolled but haven't actually enrolled any
people yet. So this is growing every day as people say, oh this thing's
successful.
We're going to enroll our agency as well. I think our biggest -- I
think the FAA is the largest, we have the VA that's also enrolled, GSA,
HHS, several other agencies have joined us. So that number will grow,
but DOD has the lion’s share of people who have national security
clearances.
Now, eventually this should go to the broader set of government
workers that have suitability clearances and hopefully we will -- we
will learn as we go. But again, to do that kind of growth I also need to
be at the same time building the IT architecture that can support it.
And so, it's a question of managing this growth.
Q: (inaudible) on just -- on Meghann’s question, so with the
databases you've got -- now you've got -- you said about seven, how are
you flagging an extremist now? Or is that there's something lacking and
that's why it needs to be expanded?
And then just secondly, what are the issues that I didn't get use,
just DoD’s policy on PPI and how are you going to safeguard all of this
through this massive database and (inaudible) expansion?
MR. LIETZAU: Ok, that is not a quick question.
Q: I know, sorry.
MR. LIETZAU: That's (inaudible). But in fact we -- so first of all
it's not seven databases. It's seven categories of data and the
databases are often not our databases. We're going out to various
agencies, some we pay for, some we are from the U.S. government and
they're free. Some are from the U.S. government and people are thinking
that we can charge for this. And I deal with those things all the time.
Don't quote on that, maybe we charge for this part.
So it is a number of data sources. But then -- I wrote down what you
said -- oh, in terms of flagging extremists, what we're still using is
we're flagging anything that hits one of the adjudicated guidelines and I
probably should have them here for you and I could find them, but I
don't have them at my fingertips.
But these are the adjudicated guidelines and would include tendency
toward anti-American activities or terrorist activities or extremist
behaviors. That's part of the essence of what we've been doing for
years. So in that regard it's not new. It's not like we said, oh, we
didn't care about extremists before let's start looking at extremists.
What we're doing is recognizing that that is a particular area of threat
today.
And so, there's a little bit more focused attention to it. But
there's no particular database that's an extremist category database.
There's all of them that give us indicators that someone could -- and
that's, in fact, the group that I just left, the Insider Threat
Management Team, where you have behavioral scientists and things like
that looking at what are the indicators that somebody may be heading in a
wrong direction.
PPI is something we're very focused on all the time. So you can
imagine what was the big -- I said we're going to build this NBIS
program which is going to assist the continuous vetting team in triaging
and analyzing lots of data.
Well, remember that NBIS computer system that's going to do that was
originally put in place to replace the 1987 system that OPM has that was
breached. That -- I now own that system. It is up and running. It's the
one that's ingesting 10,000 investigation requests of some sort every
day. But it's fragile and we're replacing that at the same time.
And we're replacing it partly because when that data breach occurred,
PPI went out the door and so you can rest assured that the most secure
unclassified system that we can put in place that is accessible by right
now we have 120 government agencies that are our customers and maybe
10,000 companies in industry, that system is as secure as you can make
it to protect against leakage of PPI.
STAFF: Sir, we do have time for one more question. Before we take one
from the floor and apologies, we should check with the control room and
see if anyone's calling in through Zoom that's connecting might have a
question for us. And we'll do that now.
MR. LIETZAU: I forgot about the Zoom part.
STAFF: (inaudible).
Q: Hi.
STAFF: Go right ahead with your question.
Q: Yes, great. I’m Pat Tucker from Defense One, can you talk a little
bit about the third party contractors that you are -- might be using or
plan to use in the future to help you with this process?
MR. LIETZAU: I can. We use a number of contractors and they have
different roles. We use contractors to help us and ultimately we look
for things that are inherently governmental functions or done by
government employees. And then on some other things we can contract it
out.
For example, adjudicating whether somebody should keep their
clearance or get a clearance or whatever, that's an inherently
governmental function. But some of the background checks that might have
to be done in an initial investigation can sometimes be done by
contractors. And there's a split.
Again, there's also contractors who help us do some analytic work but
not make decisions when they're collecting the CT hits, we have
contractors who are -- who are collecting data and assisting us in kind
of filtering through it.
And then we're also using contractors to help us build the IT systems
to put in place. And again, we're doing it so carefully for PPI
reasons, so that no one contractor has the code or the capability to
later kind of breach the system or get at those things. So that's how
we're using. We're using contractors in numerous capacities.
Q: Well, are the contractors able to make recommendations for
adjudication? Or are they able to like make briefs that have bullet
points saying like this is the areas of concern that we detect in and
then that passes to adjudication, but there's already a series of bullet
points that might influence decision making or something like that?
MR. LIETZAU: There would be certainly nothing to stop a contractor
from doing that and the dynamic on the team is such that that -- there's
no one who's got to worry that, oh my goodness I see something of
concern and I can't get the word out. But on the other hand the process
is set up so that that's going to happen on its own anyway.
The government employees there are doing the analytical work then
determining what additional investigative work might be needed before an
adjudication can take place. Or do we need to take immediate action and
maybe pull somebody's access to classified material or their
eligibility. And at this stage that's the primary thing that we're
looking at, is access to classified material.
And then it eventually gets to an adjudicator. So along that route
there's plenty of opportunity for any contractor to raise any concerns
they see, though they're probably not in a position where they're
looking at the holistic picture the way an adjudicator would.
STAFF: And with that we're going to have to conclude today's roundtable.
MR. LIETZAU: I feel bad because this lady had her hand up the whole
time. I feel like I've hit all the hands if I can give her a chance.
STAFF: Sir, it's your round table. Absolutely.
MR. LIETZAU: I tried to hit all the hands that were up and I know you had yours up ma'am.
Q: (inaudible) AWPS News. Thank you for taking my question. So big
database and the public that hears about this, I can hear already some
of the worry that people might express. Are you going to ever, at some
point, collect biometric data and archive that? Are there plans for
that?
MR. LIETZAU: No, that's a great question. Thanks for ending me on a
very controversial topic, sort of like going into PII. But no, I think
-- well to some degree we already do. To some, for instance,
fingerprints are part of a clearance process and we're building into the
IT systems with a view toward the future, the ability to collect
biometric data.
But all of the concerns that you can imagine are ones that we work
through and policy people are working through. And this is where I
happily step back and say we're the ones who implement. The benefit is
we're the ones who actually bring across the finish line a more trusted
workforce but a lot of the difficult policy questions are which my
metric data is appropriate to have in a database is something that I'm
usually differing to other folks in this building and outside this
building for.
But what I can assure you is that we're putting in place the
protections so that what happened back in 2015 or so with the loss of
data and it doesn't happen today that we do keep as trusted a workforce
as we can possibly have for the United States government.
And that we ensure that trusted workforce is trusted in as a
responsible manner as we can. So we will -- we will not be allowing data
to leak, not while I'm here.
Q: Thank you.
MR. LIETZAU: With that, thank you.
STAFF: Thank you all very much. If you have any follow-up questions,
feel free to contact myself, Chris Bentley, or your rep as well.
Posts
