Case No. VSO-0435, 28 DOE ¶ 82,804 (H.O. Mann June 15, 2001)
For full history of this case, and links to other cases, click here.
* The original of this document contains information which is subject to withholding from disclosure under 5 U.S.C. 552. Such material has been deleted from this copy and replaced with XXXXXXXs.
June 15, 2001
DEPARTMENT OF ENERGY
OFFICE OF HEARINGS AND APPEALS
Hearing Officer's Opinion
Name of Case: Personnel Security Hearing
Date of Filing: February 21, 2001
Case Number: VSO-0435
This Opinion concerns the eligibility of XXXXX (hereinafter referred to as "the individual") to hold an access authorization (also called a security clearance). The local DOE security office determined that information in its possession created substantial doubt about the individual's continued eligibility for an access authorization under the Department of Energy (DOE) regulations set forth at 10 CFR Part 710, Subpart A, entitled "Criteria and Procedures for Determining Eligibility for Access to Classified Matter or Special Nuclear Material." As explained below, I recommend against restoring the individuals access authorization.
Background
The individual is employed at a DOE facility where his work requires him to have an access authorization. The local DOE security office issued a Notification Letter to the individual on January 10, 2001. The Notification Letter alleges under 10 CFR § 710.8(l) that the individual has engaged in unusual conduct or is subject to circumstances which tend to show that he is not honest, reliable, or trustworthy, or which furnishes reason to believe that he may be subject to pressure, coercion, exploitation, or duress which may cause him to act contrary to the best interest of the national security.
The security concerns in the Notification Letter are based on the following factual allegations: In 1989, the individual was arrested and charged with assault, and with making a false report to the police, after attempting to duplicate government keys. In 1997, the individual was given a reprimand for misuse of a government computer after an audit of his government computer disclosed numerous files of a personal nature, data and files not related to his job duties, and unauthorized software. Also in 1997, the individual was given a 35-day suspension without pay for unauthorized use of a government vehicle and failure to fully disclose the details of an accident, specifically, the presence of a passenger in the vehicle. In two 1999 personnel security interviews with another government agency, the individual stated that during the past 20 years he had a number of extramarital affairs (one night stands), an affair for several months with an old high school girlfriend, and from early 1997 to March 1999, the individual became sexually involved with a female coworker. Since the end of his relationship with the female coworker, the individual had three one night stands. The individual stated that his wife was aware of the affairs with his old girlfriend and coworker, but not aware of his one night stands. In addition, the Notification Letter cited an incident/infraction report that DOE received on November 2, 2000, which charged the individual with misuse and abuse of government computer resources, waste of time during DOE duty hours, failure to report personal foreign travel, and disregard for security.
Because of these security concerns, the case was referred for administrative review. The individual filed a request for a hearing on the concerns in the Notification Letter. DOE transmitted the individual's hearing request to the Office of Hearings and Appeals (OHA), and the OHA Director appointed me as Hearing Officer in this case.
At the hearing that I convened, the DOE Counsel called two witnesses: a DOE personnel security specialist, and the local DOE facility security officer. The individual, who was not represented by counsel, testified on his own behalf, and called four other witnesses: a coworker, a supervisor, a contractor who works for the DOE facility security office, and the individuals wife. The DOE submitted a number of written exhibits prior to the hearing, and the individual submitted one written exhibit at the hearing.
Standard of Review
The applicable DOE regulations state that "[t]he decision as to access authorization is a comprehensive, common-sense judgment, made after consideration of all the relevant information, favorable or unfavorable, as to whether the granting of access authorization would not endanger the common defense and security and would be clearly consistent with the national interest." 10 CFR § 710.7(a). In resolving questions about the individuals eligibility for access authorization, I must consider the relevant factors and circumstances connected with the individuals conduct. These factors are set out in § 710.7(c):
the nature, extent, and seriousness of the conduct, to include knowledgeable participation; the frequency and recency of the conduct; the voluntariness of participation; the age and maturity of the individual at the time of the conduct; the absence or presence of rehabilitation or reformation and other pertinent behavioral changes; the motivation for the conduct; the potential for pressure, coercion, exploitation, or duress; and the likelihood of continuation or recurrence.A DOE administrative review proceeding under 10 CFR Part 710 is authorized when the existence of derogatory information leaves unresolved questions about an individuals eligibility for access authorization. A hearing is for the purpose of affording the individual an opportunity of supporting his eligibility for access authorization. 10 CFR § 710.21(b)(6). Once DOE has presented derogatory information affecting an individuals eligibility for access authorization, the individual must come forward with evidence to convince the DOE that restoring his or her access authorization would not endanger the common defense and security and would be clearly consistent with the national interest." 10 CFR § 710.7(a). See, e.g., Personnel Security Hearing (Case No. VSO-0013), 24 DOE ¶ 82,752 at 85,511 (1995), and cases cited therein. For the reasons discussed below, I do not recommend restoring this individuals access authorization.
Findings of Fact
The individual admits the allegations in the Notification Letter. During the hearing, the individual attempted to present evidence to mitigate the security concerns in the Notification Letter, and this opinion will focus primarily on whether the individual met his burden of showing that restoring his access authorization is warranted under 10 CFR Part 710. I will begin with a description of the events that gave rise to the security concerns to provide a context in which to consider the evidence of mitigation.
The record indicates the first incident of concern happened in 1989, shortly before the individual began working at the DOE facility. The individual was attempting to have some government keys duplicated at a local auto parts store. According to the Police Report, the keys had it is illegal to duplicate this key written on them. DOE Exhibit 1 at Tab 3. When the clerk would not return the keys to the individual, the individual tried to grab them out of the clerks hand, and when he failed to dislodge them from the clerks grasp, the individual fled the store. The clerk was not injured in the struggle for the keys. The clerk and the store manager copied the license plate number on the individuals vehicle when he left the scene. The police also lifted the individuals fingerprints from the glass door. When the police first questioned him about the incident in the store, the individual denied being there, and filed a false report claiming that his vehicle had been stolen. However, after the store manager identified him, the individual admitted his guilt. In his statement to the police at the time, the individual said that he was preparing to move his personal and professional belongings, and had been experiencing frustration gaining access to the office they used for storage. According to the individual, this frustration led him to make duplicate copies of the keys. Id. at 8. When the clerk would not return the keys, the individual panicked. The individual added that I did not have any criminal activity in mind when I did this and I am deeply ashamed of what I did. Id. Following a Personnel Security Interview (PSI) with the individual in 1990, the DOE considered the security concerns resolved. March 30, 1990 U.S. DOE Case Evaluation, DOE Exhibit 1 at Tab 1;1990 PSI Transcript, DOE Exhibit 1 at Tab 4; May 11, 1990 Memorandum, DOE Exhibit 1 at Tab 2.
The next incident happened in 1996, when the individual took a government vehicle from the DOE facility to meet a female friend in town for lunch. After lunch, the individual was involved in a minor fender-bender with another motorist while leaving the restaurant parking lot. The individual reported the accident to the DOE facility. However, the individual submitted a false written report, indicating 0 for the number of passengers in the government vehicle, when in fact his female friend was riding with him at the time. DOE Exhibit 2 at Tab 3. In addition, the individual gave a written statement detailing his activities on the day of the accident that also failed to mention the presence of the woman in the vehicle. DOE Exhibit 4 at Tab 2. However, the DOE received information from an independent source indicating that there was a passenger in the vehicle with the individual. One day after the individual gave that detailed written statement, a DOE security specialist interviewed the individual about the accident. The individual eventually admitted that the woman was a passenger in the vehicle when the accident occurred. Transcript of December 6, 1996 PSI, DOE Exhibit 2 at Tab 4. Ten days later, a second DOE security specialist conducted a follow- up interview with the individual about the incident. Transcript of December 16, 1996 PSI, DOE Exhibit 2 at Tab 5. In this interview, the individual admitted that he had not reported the presence of the woman at first because he did not want his wife to know she was there, and that he had attempted to dissuade the other driver from calling the police and her insurance company. Id. at 8- 11. However, the individual maintained that he would tell his wife if necessary, and denied he was susceptible to blackmail over the incident. Id. at 9. The individual was eventually disciplined by his employer with a 35-day suspension without pay for unauthorized use of a government vehicle and failure to fully disclose the details of the accident. The local DOE security office determined that a new background investigation, commonly known as a reinvestigation, should be done on the individual.
In 1997, the individual had the first of what proved to be a series of so-called cyber-security incidents involving the unauthorized use of his government computer for non-DOE business. This occurred when an audit of the individuals government computer disclosed numerous personal files, including e-mail letters from his son, files regarding his service as military Reservist, letters to an insurance company regarding hospital visits, personal e-mail to the individual from a co-worker, and vacation plan arrangement documents. In addition, the audit found programs without the proper license information. April 16, 1997 Incident Report, DOE Exhibit 9 at Tab 3, at 25. A computer systems security officer directed the individual to produce licenses for those programs, and to remove programs that he did not use for DOE business. In addition, the individuals supervisor sent him an official letter of reprimand. Id. at 26; Hearing Transcript (hereinafter cited as Tr.) at 47-48.
In 1997, after the reinvestigation failed to turn up any new derogatory information, the DOE security office noted that the individual continues to use bad judgment regarding misuse and misconduct, but considered the security concerns raised by the 1996 accident report incident and the 1997 cyber- security incident resolved. October 16, 1997 U.S. DOE Case Evaluation, DOE Exhibit 3 at Tab 1.
The computer security office at the DOE facility performed follow-up audits of the individuals office computer in July 1997, and in October 1998. DOE Exhibit 9 at Tab 3 at 16-20. The July 1997 audit was clean, but the 1998 audit found that the individual was again using his office computer for non-DOE purposes. The individuals system had a copy of his daughters resume and information regarding his service in the Reserves, and the individual had activated a power-on password. Once again, the facility security office cited the individual for a computer security incident. He was instructed to remove the power-on password and to delete the personal files. The security officials speculated that the individual had activated the power-on password to prevent an unannounced audit of his system. Id. at 16. They reminded the individual that his office computer was only to be used for DOE-related work. The individuals supervisor counseled him regarding the proper use of government computer equipment, but permitted the individual to keep the power-on password since [the individual] has always been cooperative with computer security personnel in the conduct of system audits. Id. at 18.
After a May 1999 follow-up audit of his system uncovered numerous files unrelated to DOE business, the individual was cited for a third computer security incident. Many of the personal files found in the audit were jokes, some involved his service in the Reserves, and others pertained to non- business travel. Id. at 21-24. The individuals supervisor gave him a verbal reprimand for the third cyber-security incident. Tr. at 49. In December 1999, the individual signed a required annual code of conduct statement for computer users indicating, among other things, that he understood the cyber-security policies, and he would use [facility] computer resources for official DOE business only unless I have been given written authorization by my manager. DOE Exhibit 8 at Tab 3 at 2-3.
Nevertheless, in August 2000, the facilitys net sensing software picked up something on the individuals system, and a scan of his files revealed an exchange of personal e-mails with a woman who worked out of another DOE facility, family e-mails, internet auction bids, searches for auto parts, evidence of church business, information about the Reserves, daily jokes, and travel information about airlines the DOE does not typically use. Tr. at 49-50. The audit also disclosed that the individual had taken personal foreign trips and failed to report them to the facilitys counterintelligence office as required. DOE Exhibit 9 at Tab 3 at 2-3. Yet again, the individual was cited for a computer security infraction, the fourth such incident in four years. Id. at 1. The facility computer security office terminated the individuals internet access and his ability to send and receive off-site e-mail.
The final issue of concern in the Notification Letter is the individuals admission, first to a security interviewer for another government agency, and then to DOE security in a November 2000 PSI, that he had engaged in a number of extramarital affairs. The individual characterized one of these liaisons as serious, and the others as casual. The individual indicated that his wife knows about his marital infidelity, but that it is not widely known among his friends and acquaintances. The serious affair and some of the one night stands occurred while the individual was separated from his wife, but they are now back to living together. November 2000 PSI Transcript, DOE Exhibit 4 at Tab 4, at 25-55.
Evidence Presented by the Local DOE Security Office
The DOE security specialist who testified at the hearing explained that security is concerned about the individuals pattern of behavior. She noted that the criminal charges stemming from the 1989 key duplication incident, the false accident report incident in 1996, and the first computer misuse incident in 1997 all raised security concerns about the individuals honesty, trustworthiness and reliability, but DOE security considered each of these concerns resolved at one time. Tr. at 20-33. The specialist testified that even though the individual may no longer be susceptible to blackmail over his extramarital affairs now that his wife knows, there was still a lingering security concern since he once tried to cover them up. But according to the security specialist, the DOEs main concern is the individuals pattern of behavior, namely, his continued involvement in disciplinary actions, and his disregard of government policy. Id. at 34. She concluded that we have a well- documented history of using poor judgment. And hes always had a way out. Hes always gotten out of it somehow, untilI guess until the cyber-security issues really surfaced. So its a behavior pattern. Id. at 35.
The DOE facility security officer acknowledged that computer security standards are especially strict at this facility, and testified that they have a zero tolerance for individuals using the government computer for non-DOE business. Tr. at 45. He pointed out that other DOE facilities which effectively permit employees to surf the internet, check the news do not have the same level of sensitive information on their unclassified computer networks. This witness recognized that there was a difference between sending and receiving e-mail, and while an individual is held accountable for what he sends, he cant be held one-hundred percent accountable for all of the things he receives. Id. at 46. The security officer stated that personal use, when discovered at this facility, is treated as a computer security incident, and they basically do a remedial education each and every time without exception, that we have a computer security incident. Tr. at 52-53. Finally, he denied the individual had been singled out for harsh treatment, stating
No, in fact, given the history of this, and the repeated attempts to train [the individual], to give him all of the information that we can, I think weve done probably just the opposite, in that we haveover numerous instances, we have worked with [the individual] to make sure that he understood the requirements, to make sure that there wasnt any doubt in his mind about what he should be doing and should not be doing continually.Tr. at 55-56. In view of the uncontested facts set forth above, I find ample justification for the security concerns raised under Criterion L, as the individuals behavior pattern tends to show that he is not honest, reliable and trustworthy, and that he might be subject to coercion.
Mitigating Evidence Presented by the Individual
1. The Individuals Co-worker
At the hearing, the individual presented testimony from a co-worker with whom he has carpooled to work for many years. The co-worker remembered the 1996 incident when the individual had the accident with a government vehicle he took into town to meet the woman for lunch. According to the co-worker, before the individuals accident, it was not unusual for employees at the DOE facility to take government vehicles off-site for lunch, and that the individual was the first person who was punished for doing it. Tr. at 69-70. In addition, the co-worker said he had sent and received personal e-mails at work, and that he would question the honesty of anybody that would tell you they havent done it at all. Id. The co-worker introduced into evidence copies of jokes he had received by e-mail from another DOE facility. Individual Exhibit 1. However, he also indicated that while this kind of e-mail was not unusual up until 1998, it was becoming more and more well known by people that you shouldnt be doing these things. Id. at 71. He generally praised the individual for his professional competence and for his long service to the government.
On cross-examination by the DOE Counsel, the co-worker said that we was aware of the prohibition against using his government computer for personal business, but pointed out that the rules had changed, and that previously he had been permitted to use his government computer while working on his masters degree. The co-worker told the DOE Counsel that if he received a security infraction report for misusing his government computer, he would discontinue the use that was found to be an infraction, and there wouldnt have been a second time. Id. at 76. Although the co- worker conceded that the individual has made some mistakes that he readily admits to, he still thought the individual was a reliable person. Id. at 79.
2. The Individual
The individual admitted that he had made a mistake when the 1989 key duplication incident led to his arrest, but explained that it happened at a very busy time, and he took a shortcut that he should not have taken. He testified that he had no criminal intent at the time, that the local court dropped the charges, and he performed community service to make amends. The individual maintained that this concern was and should be considered mitigated. Id. at 82-83. With regard to the 1996 accident with the government car, the individual pointed out that once he was placed under oath (in the two December 1996 PSIs), he provided complete information, and DOE security considered the concern over that incident to be mitigated. Id. at 84.
The individual noted that he has had marital problems, but urged that DOE separate his personal struggles with his marriage from any threats of susceptibility to coercion that might accompany those difficulties. He pointed out that his wife knows about his infidelity, and that her testimony later in the hearing would corroborate his assertion that he was not susceptible to coercion. The individual also contended that the security interview with the other government agency had not been transcribed by a certified court reporter, that some of the terms he used had been misconstrued, and that he had not had sexual relations with as many women as it may have appeared from that interview. He added that he and his wife were living together again and working on their marriage. For these reasons, the individual asserted that the concerns about susceptibility to coercion should be completely mitigated. Id. at 84-87.
The individual conceded that he had misused his office computer, and stated that he hoped to mitigate that. Id. at 87. In general, the individual attempted to minimize the seriousness of these cyber-security incidents, pointing out that he supplied licenses for the unauthorized software in response to the 1997 audit, and tried to clean most of the personal files from his hard drive and from the network drive when these items were discovered in subsequent audits. The individual claimed that he had been led to believe that e-mail was like conversations youve had, phone calls youve had, and admitted he didnt make any attempt to restrict that. Id. at 88-89. He conceded that he had taken the prior disciplinary counseling by his supervisors a little too lightly, and stated that he is now fully aware of the implications of cyber-security and implications of my improper use. Finally, the individual said that he was ready to submit to disciplinary action for the most recent computer incident, and that he believed that the concern can be put to bed completely. Id. at 90- 91.
3. The Individuals Wife
The individuals wife testified that she was aware of her husbands past infidelity and the other incidents involving the keys, the vehicle accident and the computer infractions, and that she believed he was a patriotic individual who could never be coerced into compromising national security. She indicated they were living together again and working on their marriage. She also testified that the individual had never revealed any classified information to her or to any other family member. Tr. at 104-107.
4. The Individuals Supervisor
The individuals supervisor testified that he regards the most recent cyber-security incident more as an instance of insubordination by the individual, rather than a computer abuse problem, since he has reprimanded him for similar infractions in the past. Tr. at 139-140. The supervisor said that he is planning to take stronger disciplinary action against the individual, such as a lengthy suspension without pay, if the individuals clearance is restored. Id. at 144. However, the supervisor pointed out that the computer security standards at this facility were and had always been stricter than at other DOE facilities, and had recently been tightened up even though some managers at the site had recommended loosening them. The supervisor expressed his personal view that it was not that bad if once employees got the job done, they then used their unclassified government computers on their personal time. Id. at 140.
Analysis
For the reasons explained below, I find that the individual has not presented information sufficient to resolve the concerns in the Notification Letter. Thus, I recommend against restoring the individuals access authorization at this time.
This case is troubling because it involves a series of minor transgressions by an individual whose entire career has been devoted to serving his country. Nearly all of these incidents involved minor run-ins with authority, and none of them, standing alone, would be enough to warrant revoking the individuals access authorization. Indeed, the local DOE security office decided to continue the individuals clearance in 1997 after three incidents in a period of eight years. But now, the individual has had at least seven incidents over the past 12 years, including a series of four cyber- security infractions in as many years. Regardless of how strict the code of conduct for computer users is at the individuals DOE facility, and how unreasonable those cyber-security standards might have appeared to the individual, once he was told he should not use his system for personal, non- DOE business, he should have learned his lesson and stopped doing it. It is worth noting that the individual is a highly educated person who cannot ascribe his apparent inability to understand what was required of him to ignorance or a lack of intellect.
At a certain point, all of those minor incidents can no longer be viewed in isolation, and they coalesce into a pattern of behavior that raises security concerns about the individuals judgment, and his honesty, reliability and trustworthiness under 10 CFR § 710.8 (l). The testimony presented by the individual fails to address the overall pattern, but focuses instead on minimizing the relative seriousness of each separate incident. He should have realized by virtue of his repeated infractions, he had forfeited any entitlement to the leniency afforded other employees who occasionally violate these same rules. After all is said and done, the individual has no explanation for his repeated flouting of the cyber-security standards at the DOE facility, and the other incidents when he did not follow the rules. Although I cannot go inside his head and discern his motivation for acting in this manner, there have been too many instances when the individual has pushed the limits of rules that inconvenience him, or tried first to evade detection when he has broken a rule, and only confessed after he has been caught. Finally, the fact that the individual is willing to submit to disciplinary action does not remove the legitimate security concerns.
I do find, however, that the individual has mitigated the concern that his marital infidelity would make him susceptible to coercion. The individual testified that his wife knew about his infidelity, and her testimony corroborated his statements.
OHA has issued many personnel security opinions that considered patterns of behavior that gave rise to concerns under Criterion L. Most of those cases involved more serious matters than those in this case, and OHA recommended that the individuals clearance not be restored. For example, in Personnel Security Hearing (OHA Case No. VSO-0114), 26 DOE ¶ 82,770 (March 5, 1997), affirmed, 26 DOE ¶ 83,011 (OHA June 16, 1997), affirmed (OSA August 5, 1997), the individual had engaged in marital infidelity, lying to his wife about drinking, lying to DOE about past drug use, and had been diagnosed with narcissistic personality disorder. In Personnel Security Hearing (OHA Case No. VSO-0132), 26 DOE ¶ 82,780 (June 10, 1997), affirmed, 26 DOE ¶ 83,019 (OHA October 7, 1997), affirmed (OSA January 7, 1998), the individual had engaged in a pattern of financial irresponsibility, written bad checks, and had failed to show reformation by establishing a new pattern of responsible financial behavior. Personnel Security Hearing (OHA Case No. VSO- 0327), 27 DOE ¶ 82,844 (April 20, 2000), affirmed, 28 DOE ¶ 83,005 (OHA June 13, 2000), affirmed (OSA August 4, 2000) found that an individual who had made repeated false statements about having a Ph.D. degree engaged in a pattern of behavior that raised concerns about his honesty. On the other side of the spectrum, there are cases in which an individual who had engaged in questionable behavior in the past has reformed his or her conduct, and led a blameless life for many years. In those cases, OHA has recommended restoring or granting the individuals clearance. See, e.g., Personnel Security Hearing, Case No. VSO-0410, 28 DOE ¶ 82,786 (January 23, 2001), affirmed (OSA March 21, 2001) (eight years without getting in trouble), and Personnel Security Hearing, Case No. VSO-0319, 27 DOE ¶ 82,851 (June 14, 2000), affirmed (OSA July 18, 2000) (nine years without getting in trouble). In the present case, while the individuals misdeeds were relatively minor, it is still too soon, less than one year after the latest cyber-security infraction, to conclude that the individual has established a new pattern of following rules he finds personally inconvenient or unreasonable.
Gauging the individuals conduct by the factors set forth in 10 CFR § 710.7(c), I find his infractions, although relatively petty, were part of a pattern of behavior that has continued since his 1989 arrest. I find that his participation in these events was knowledgeable and voluntary, and the conduct took place when he was a mature adult. The concern that once existed about the individuals susceptibility to blackmail was resolved when he told his wife about his marital infidelity. But I am not persuaded that the individual has shown sufficient evidence of reformation or rehabilitation in the short time since the last cyber-security incidents. I find it significant that while the individual tried to minimize the seriousness of his cyber-security incidents, he failed to dispel the impression that he ignored the rules because he thought they were unreasonable. Admittedly, the individuals misdeeds are not especially grave, but it is too early for me to say that the conduct is unlikely to recur in the future.
Conclusion
After weighing and balancing all the evidence in the record, I find that the individual has not resolved all the security concerns raised under 10 CFR § 710.8(l). I do find that he has resolved the concern that he might be susceptible to blackmail for hiding his marital infidelity from his wife. However, I cannot conclude that the individual has mitigated the concern raised by his repeated involvement in legal and disciplinary incidents, especially the continuing pattern of cyber-security incidents. The individual has not yet convinced me that he has reformed his behavior.
For the reasons explained in this Opinion, I find that the individual has failed to show that restoring his access authorization would not endanger the common defense and security and would be clearly consistent with the national interest. Accordingly, I recommend against restoring the individual's access authorization at this time.
The regulations set forth at 10 CFR § 710.28(a) provide that the Office of Security Affairs or the individual may file a request for review of this Hearing Officer's Opinion within 30 calendar days of receipt of the Opinion. Any such request must be filed with the Director, Office of Hearings and Appeals, 1000 Independence Ave., S.W., Washington, D.C. 20585-0107, and served on the party. If either party elects to seek review of the Opinion, that party must file a statement identifying the issues on which it wishes the OHA Director to focus. This statement must be filed within 15 calendar days after the party files its request for review. The party seeking review must serve a copy of its statement on the other party, who may file a response within 20 days of receipt of the statement. 10 CFR § 710.28(b). The address to which submissions must be sent for purposes of serving them on the Office of Security Affairs is as follows:
Director
Office of Safeguards and Security, SO-21
Office of Security Affairs
U.S. Department of Energy
19901 Germantown Road
Germantown, MD 20874
Thomas O. Mann
Hearing Officer
Office of Hearings and Appeals
Date: June 15, 2001