Security Executive Blog

This past December 17th, the Justice Department announced the guilty plea of a former FBI Contractor (http://baltimore.fbi.gov/dojpressrel/pressrel09/ba121709.htm) The contractor held a TOP SECRET security clearance. He knowingly released SECRET information that was published on a blog. Anyone with access to the web was able to access classified information on intelligence communication procedures. The unauthorized release of SECRET information can cause grave damage to the US national security. Those with security clearances should be taught to understand the importance of protecting it. This incident helps stress the need for exceptional security training, protection and oversight. Security specialists in the government and Facility Security Officers (FSO) for cleared contractors are responsible for implementing and directing security programs to protect classified information. This includes ensuring cleared employees understand their roles in protecting classified information. ...

Putting first things first. That has been a motto for many after reading books such as Franklin Covey's 7 Habits of Highly Effective People or Reverend Rick Warren's The Purpose Driven Life. Those and several similar motivational publications stress that everyone has the same amount of time in a day. What we do during that time helps us either make or goals or fail before we even get started. As leaders, FSOs can help security employees understand how to create incredible security programs. Focusing on training, interaction with other cleared employees, self-improvement and institutional education should be part of professional development. FSOs who write security evaluations for direct reports have an excellent opportunity to help them establish goals to become better at their jobs, more impactful in their careers and hopefully, groomed to become FSO's themselves. Challenging employees and team members to achieve personal and professional goals breeds success. The ISP Cert...

Classified information can arrive to a cleared contractor in many different ways. Whether delivered via courier, mail carrier, overnight carrier, classified electronic means, and etc. the FSO should have a process in place to control and protect classified information from reception to dissemination or destruction. The FSO should establish procedures for the proper reception of classified material. The receiver of classified material plays a critical role in both safeguarding classified material as well as identifies security violations that the sender may have committed. FSOs can control the introduction and dissemination of classified information with a centralized document control system. The NISPOM requires that a cleared contractor have an information management system in place to control classified information. This can be accomplished with a centralized system to facilitate the proper introduction and control of classified information entering the facility. This system r...

How to Wrap Classified Packages By: Jeffrey W. Bennett, ISP The National Industrial Security Program charges cleared contractors with protecting classified information. This protection extends through all phases of contracts and throughout the duration of the classification. Protection also includes the reception, storage, dissemination, and destruction of the information. Dissemination is a critical part of protecting classified information as the classified information leaves the control of the cleared organization. Whether couriered, mailed, or otherwise delivered, it is removed from a cleared facility and must be prepared in a way to protect the information from unauthorized disclosure. Prior to sending out classified information the FSO should ensure that it is double wrapped with opaque paper to preclude casual observation of the classification markings and contents. The inner wrapper is marked with the proper classification, provided an address with sender and address...

Just five short years ago several changes came out almost simultaneously. The changes challenged the thinking of many security specialists because the ideas were so new. The proactive employees put plans into place that made the changes easier to implement within their organizations. The others found themselves implementing the changes at the last minute. I cannot imagine working without the Joint Personnel Adjudication System (JPAS). However, when it first came out the protest was pretty loud. One of the many objections identified using JPAS to submit visit authorization requests instead faxing personal identifiable information to a hosting cleared facility. I heard one FSO comment that “need to know” could not be properly controlled by such an impersonal system. Though unfounded, such objections still needed to be met. T o prepare industry for the new process, Defense Security Services and professional organizations such as NCMS (Society of Industrial Security Professionals)...

According to E.O. 12869, no one can have access to classified information unless they have been determined eligible for a security clearance and have “need to know”. Access is a determination made by an expert based on the results of a proper investigation. This eligibility is easy to determine after the U.S. Government provides the notification of a granted security clearance or upon validation of an approved cognizant security agency database. When an employee is granted a CONFIDENTIAL, SECRET or TOP SECRET clearance they are eligible for access to classified information at the level of clearance and below. However, the rest of the story concerns “need-to-know”. Need to know is a determination made by the possessor of classified information. This cleared employee not only has to determine that recipients of the information have the proper clearance, but that the cleared person is authorized to perform classified work based on a true government requirement. Just as security c...

Identification is a critical part of our business. Those who possess classified information cannot just disclose it to anyone who asks; verification is necessary to ensure that those who are authorized to receive such information are who they say they are. Sometimes identification is made visually through recognition of a friend, colleague or co-worker. More often than not the visual recognition is backed up with technology. Many contractor and government organizations and agencies have internal identification systems using software and hardware designed to recognize biological and electronic information. There are many configurations of card reading technology. Some use picture badges unique to organizations coupled with small chips providing a code for entry into access controlled areas. At any given time you can identify such employees by the card dangling at the end of a lanyard. Perhaps even some are laden with multiple cards pushing the lanyard’s published tensile st...