Handling Protected Information                                     Printer Friendly


Handling Protected Information

Relevance to Security

Deliberate or negligent failure to comply with rules and regulations for protecting classified information, or for protecting other sensitive information (such as For Official Use Only, proprietary, export-controlled, or privacy information), raises doubt about an individual's trustworthiness, judgment, reliability, or willingness and ability to safeguard such information, and is a serious security concern.

Potentially Disqualifying Conditions

Extract from the Guideline

(a) deliberate or negligent disclosure of classified or other protected information to unauthorized persons, including but not limited to personal or business contacts, to the media, or to persons present at seminars, meetings, or conferences;

(b) collecting or storing classified or other protected information at home or in any other unauthorized location;

(c) loading, drafting, editing, modifying, storing, transmitting, or otherwise handling classified reports, data, or other information on any unapproved equipment including but not limited to any typewriter, word processor, or computer hardware, software, drive, system, gameboard, handheld, “palm” or pocket device or other adjunct equipment;

(d) inappropriate efforts to obtain or view classified
or other protected information outside one's need to know;

(e) copying classified or other protected information in a manner designed to conceal or remove classification or other document control markings;

(f) viewing or downloading information from a secure system when the information is beyond the
individual's need-to-know;

(g) any failure to comply with rules for the protection of classified or other sensitive information;

(h) negligence or lax security habits that persist
despite counseling by management.

(i) failure to comply with rules or regulations that
results in damage to the National Security, regardless of whether it was deliberate or negligent.

____________

There are three general types of potentially disqualifying behaviors, each of which is discussed below:

If it is a close call whether any specific behavior or pattern of behavior warrants adverse adjudicative action, the adjudicator should make a whole-person judgment based on everything else that is known about the individual’s reliability, trustworthiness, loyalty, and attitude toward compliance with rules and regulations.

Deliberate Violation

Any deliberate violation of security rules or regulations is a significant concern, as it may indicate indifference toward national security or a general inability or unwillingness to abide by the security regulations.

Storing classified or other protected information at home is one of the most serious offenses, as it often indicates intent to misuse this information in some way in the future. This is listed below as one of the behaviors that may indicate current or potential future espionage. Many well-known spies were found, at the time of their arrest, to have large quantities of classified documents at their residences. CIA spy Aldrich Ames had 144 classified documents at his home, while Edward Moore had 10 boxes of CIA documents at home. Of various Navy spies, Jonathan Pollard had a suitcase full of classified materials, Michael Walker had 15 pounds of classified material, and Samuel Morison had portions of two Navy documents marked Secret.2 Any report that an individual is maintaining classified information at any unauthorized location should trigger referral to the appropriate counterintelligence office.

Taking classified papers home just to work on them during the evening or weekend is also a serious offense even if the papers are returned to work the following day. This may indicate a degree of self-centeredness or feeling that one is above the rules that could lead to undesirable behavior in other types of situations. Sensitive but unclassified information usually may be taken home as long as it is appropriately protected.

Any deliberate revelation of classified or other protected information to any unauthorized person is a particularly egregious offense. Examples of this include:

Naval Intelligence analyst Jonathan Jay Pollard passed several classified political and economic analyses to three different friends whom he felt could use the information in their business. Although Pollard hoped to get some benefit in return, his principal motive was simply to impress his friends with his knowledge and the importance of his work. Willingness to sacrifice security for minor personal gain indicates a degree of narcissism that is a serious concern. This attitude can be dangerous and may portend future problems. In Pollard's case, for example, his need to feel important and to have others validate that importance subsequently led him to volunteer his services to Israeli Intelligence. He is now serving a life term in prison.1 For additional information, see Behavior Patterns and Personality Characteristics Associated with Espionage in the Psychological Conditions module.

Another type of deliberate offense is the sale of proprietary information to a competitor. In one case, for example, it was learned that an engineer being processed for a Secret clearance had probably sold trade secrets belonging to a previous employer. When the subject left this employer, designs of a new product under development for the Defense Department were found on his computer. This was information that the subject had no need to have. Two of the subject's friends had earlier left the company to start a new company that was bidding on the same Defense Department project. Subsequent investigation developed evidence that the subject had been paid for the design information. An individual who has sold proprietary information probably cannot be trusted to protect classified information. 3

For other examples of deliberate violations, see Case Examples.

Pattern of Negligence or Carelessness

A pattern of routine security violations due to negligence, carelessness, inattention, or a cynical attitude toward security discipline is potentially disqualifying regardless of whether or not information was actually compromised.

In order for the adjudicator to determine if there is negligence to a degree that warrants adverse adjudicative action, the investigator must obtain and provide to the adjudicator considerable background information. This may require interviews of additional sources, such as supervisors, coworkers, the security officer who investigated the violation, or the individual discovering or reporting the violation. If there is a potential issue, the information that should be available to the adjudicator include:

Some violations demonstrate obvious failure to exercise due care. This includes any security offenses that occur as a result of intoxication. For example: CIA operations officer Aldrich Ames, who was arrested for espionage in 1994, had a reputation for drinking too much. Ames became seriously inebriated while playing in a CIA-FBI softball game. He had to be driven home that night. He left behind at the field a jacket with his CIA badge, a wallet that included alias documentation, and cryptic notes on a classified meeting he attended prior to coming to the softball game. On another occasion, at a meeting at CIA Headquarters with foreign officials, Ames was so intoxicated after lunch that he made inappropriate remarks about CIA operations and then passed out at the table. 4

The Ames case is an extreme example. More typical examples of negligence or carelessness are discussed below under Case Examples.

Potential Counterintelligence Indicators

The following behaviors are serious security violations and could also be indicators that an individual may be engaged in the collection or transmission of protected information to unauthorized recipients. Any report of such indicators should be reviewed to determine if further investigation is needed. For more information, see Potential CI Risk Indicators in the Counterintelligence module.

Mitigating Conditions

Extract from the Guideline

(a) so much time has elapsed since the behavior, or it has happened so infrequently or under such unusual circumstances, that it is unlikely to recur and does not cast doubt on the individual's current reliability, trustworthiness, or good judgment;

(b) the individual responded favorably to counseling or remedial security training and now demonstrates a positive attitude toward the discharge of security responsibilities;

(c) the security violations were due to improper or inadequate training.

____________

Even careful, conscientious employees occasionally fail to lock a safe or secure a classified document. Infrequent accidental violations are not an adjudicative issue. Similarly, unintended violations attributable to inadequate training or inexperience are not an adjudicative issue.

For individuals with multiple routine violations, attitude is important, as a positive attitude toward security may mitigate the violations. If an individual is responsible for processing a large volume of classified information, an above-average number of administrative violations may not be abnormal. On the other hand, if the individual disparages the importance of security regulations, this exacerbates the violation. Cynicism about security may be the first step on a path toward conscious disregard for security regulations.

If the subject claims that he or she was unaware of the required security procedure due to lack of appropriate training, this may be a mitigating factor. However, the investigation must verify this claim by interviewing personnel who are knowledgeable about the security briefings and training the subject has received.

Deliberate violations can seldom be mitigated, but there are exceptions. For example, movement of naval ships is sometimes classified. Disclosure of a forthcoming ship movement to a spouse or other immediate family member can be a security compromise. It may be mitigated if it is an isolated and infrequent occurrence and there are no other significant security problems.

Reference Materials

Case Examples

The following examples of actual cases of security violations are intended to help adjudicators and investigators distinguish nonissue from issue cases. If the violation was accidental and not part of a pattern of carelessness or negligence, it is a nonissue and reporting requirements are minimal. If it was deliberate or part of a pattern of carelessness or negligence, it is a potential issue and there are some details that adjudicators need to know before making a decision.

Issue Cases

Example 1: A coworker reported observing the subject take a package of appropriately wrapped and marked classified material out of the building at the end of the workday on Friday. Although the package was appropriately wrapped and the subject had a courier pass to carry such material to a neighboring building, which was not unusual, it did seem suspicious at that time on a Friday, especially since the subject got into a car with his wife.

Interpretation: This is a counterintelligence lead that should be passed to the appropriate CI office. The above is a true story from the Jonathon Pollard case. This report triggered an investigation leading to the arrest of Pollard as an Israeli spy. Any unauthorized removal of classified information is a serious counterintelligence concern. Investigation quickly showed that Pollard was requesting a large number of Top Secret documents for which he had no need-to-know. He was requesting so many, in fact, that his requests were becoming a burden on the clerk who had to log them in. 1

Example 2: Coworkers observed the subject monitoring and copying information on a sensitive communications line without authorization, saw classified papers in subject’s personal locker, and knew the subject took classified materials home but believed he was doing it only to keep his work current.

Interpretation: This is a counterintelligence lead that should be passed to the appropriate CI office, as these observations are all serious counterintelligence indicators. Actually, this subject was Jerry Whitworth, subsequently arrested for espionage as part of the infamous John Walker spy ring. Unfortunately, his coworkers never reported these observations until after Whitworth’s arrest. Failure to report such observations was also a significant violation of security regulations. 5

Example 3: During a routine investigative interview, a coworker reported that the subject took a classified photograph with him when departing an overseas assignment. The subject used "whiteout" on the classification markings and then took the photograph to a civilian frame shop for framing. He intended to give it to another Marine as a souvenir. When questioned about it during the subject interview, the subject admitted this violation. The command from which the photograph was obtained confirmed that it was still classified.

Interpretation: Some form of counseling, reprimand, or warning is appropriate. The nature of this deliberate violation suggests that the subject might have engaged in other immature and irresponsible behavior that falls under one or more of the other guidelines. If so, this person's eligibility for continued access to classified information should also be adjudicated under the Personal Conduct guideline.

Example 4: Subject’s job is the processing and routing of classified information. Nine months ago, subject left a group of 47 classified documents unattended in the reproduction room. Subject was suspended from work for two days as a result. Within the past three months, subject mailed classified material incorrectly six times, received and processed classified mail incorrectly once, and left classified material unattended once.

Interpretation: Due to the nature of subject’s job, the subject has far more opportunity for security lapses than the average employee, but this number of violations shows a clear pattern of routine security violations due to inattention, carelessness, or a cynical attitude toward security. Since discipline was ineffective, it appears that the subject is not the right person for this type of job. Whether that means transfer to a different position or revocation of clearance depends upon the circumstances.

Example 5: A research scientist working on an important project wanted to review some of her research notes over the weekend. She said she would have worked in her lab over the weekend, but it was being painted.  So she took the papers home even though she did not have permission to do so and knew it was against regulations. She explained that either she or her husband was in the house that whole weekend, and that the papers were carefully locked in her desk drawer when she was not working on them.

Interpretation: This is a noteworthy violation because it was deliberate, but additional information is needed in order to determine the appropriate adjudicative action. Did subject take the initiative in reporting it to her supervisor or to the investigator? How often has she done this sort of thing? What is her attitude toward security? Is there any indication of an arrogant, I'm above-the-rules attitude?

Close Call

Example 6: Subject was cited for three security violations about one year apart. Each violation was quickly discovered by a cleared guard. The most recent violation was two years ago. In each case subject neglected to engage the lock to properly secure the container. Subject attributes the violations to carelessness on her part, and says she now pays closer attention when securing her container. There is no other adverse information.

Interpretation: Three violations over three years might be enough to be called a pattern of carelessness, but it depends on the circumstances. In this case, the subject claims to have learned from the experience and this is supported by the fact that there have been no violations in the last two years. Unless there is some other basis for concern about this subject, no adjudicative action is warranted other than counseling by a security manager.

Example 7: On two or three occasions the subject inadvertently included some personal notes on classified information with unclassified papers that he took home with him. He secured the notes at home and returned them to work the next day. They were his own notes and were not stamped with the appropriate level of classification, "Secret." Subject did not report the incidents at the time they happened.

Interpretation: Although accidental and self-reported, there is a pattern of carelessness that is of some concern. Since the notes were in the subject's personal custody, there is little chance of compromise. Some counseling by a security manager would be in order.

NonIssue Cases

Example 8: Subject had a security incident in which he “forgot to spin the lock” when he left the office. There were two locks on the door, one manual and one automatic. He forgot the manual one. This was written up as a security violation.

Interpretation: An occasional accidental violation like this is not a security concern.

Example 9: Subject personally took a CD-ROM with Secret material, appropriately wrapped in an envelope, from one office to another office of the same company located in a nearby town. When he wanted to check the material into the other office, he learned that it should have been checked out of his own office prior to taking it out. Subject explained he did not realize that he had to sign out the information as he was just transporting it from one office to another. He misunderstood the required procedures and was given a verbal reprimand.

Interpretation: There is no serious security issue here, as this was a single incident due to a misunderstanding, and appropriate action has already been taken.

Example 10: A records check identified an unfavorable report due to a security investigation. Subject was accused of using classified materials in an unclassified report. During investigation, the subject proved that the information was available from the Congressional Quarterly and other unclassified library sources, so the investigation was closed as unfounded.

Interpretation: There is no security issue here.

Example 11: Subject reported being approached by two Chinese women during a street celebration in New York City. After one of them asked if he worked on a nuclear carrier, he told them to go away. Subject did not report the incident at the time.

Interpretation: This is not a security issue as subject did nothing wrong, there was no continuing relationship with the Chinese women and no way to identify them. If the subject could identify the Chinese women, or, for example, their place of work, the information should be reported to the appropriate CI office.

Footnotes

1. Blitzer, W. (1989). Territory of lies: The rise, fall, and betrayal of Jonathan Jay Pollard. New York: Harper & Row.

2. Defense Personnel Security Research Center. (2004). Espionage cases: 1975 - 2004. Monterey, CA: Author.

3. Kramer, L.S., Jung, C.G., Gonzalez, J.L., & Richmond, D.A. (2006). Behaviors and characteristics exhibited by DoD security clearance applicants of counterintelligence concern (Draft). Monterey, CA: Defense Personnel Security Research Center.

4. U.S. Senate Select Committee on Intelligence. (1994). An assessment of the Aldrich H. Ames espionage case and its implications for U.S. intelligence. Washington, DC: Author.

5. Declassified extracts from post-arrest Naval Investigative Service investigation of Jerry Whitworth.