The trusted insider threat

1.1 On 2 September 2014, the Attorney-General announced changes to the Australian Government’s protective security policy to address the threat posed by trusted insiders, stating:

The trusted insider can access—on an unprecedented scale today—massive amounts of sensitive information through our networked computers and copy and transfer it with ease. That is why the two largest breaches of Western intelligence information have occurred only recently.²

1.2 The two breaches referred to in the speech were the large-scale leaks of classified information by Edward Snowden in June 2013 and Bradley (now Chelsea) Manning in July 2013; individuals who had been engaged in positions of trust within the United States Government and held security clearances. The Attorney-General noted that these breaches had undermined international efforts to combat terrorism and organised crime, had a detrimental impact on Australia’s diplomatic relations, and potentially led to the loss of lives, highlighting the importance of taking action to mitigate insider threats.

The Protective Security Policy Framework

1.3 The Australian Government’s Protective Security Policy Framework (PSPF) outlines a suite of requirements, controls and recommendations to assist Commonwealth entities to protect their people, information and assets. Personnel security—one of the four components of the PSPF³—aims to provide a level of assurance as to the eligibility and suitability of individuals accessing Australian Government resources. Key personnel security measures include:

• Employment screening—checks, usually undertaken prior to commencement, to establish an individual’s identity and assess their suitability to access government resources;
• Security vetting—checks undertaken to assess the suitability of an individual to hold a security clearance allowing access to classified information;
• Managing ongoing suitability—ensuring individuals with access to government resources continue to meet suitability standards and comply with security measures such as the Contact Reporting Scheme; and
• Separation actions—ensuring individuals’ access to resources is withdrawn upon separation and they are aware of their ongoing obligations to protect information.

1.4 The policy changes announced by the Attorney-General in September 2014 were primarily revisions to the PSPF personnel security requirements to promote greater information sharing between entities about personnel security risk, and encourage entities to more actively monitor and manage the ongoing suitability of their personnel. The rationale for these changes was the recognition that several recent malicious insider incidents could have been prevented through more effective information sharing or more active monitoring of personnel demonstrating behaviours of concern.

The Australian Government Security Vetting Agency (AGSVA)

1.5 The Australian Government Security Vetting Agency (AGSVA) was established within the Department of Defence (Defence) from 1 October 2010 to centrally administer security clearances for most Australian Government entities.⁴ Centralised vetting was expected to result in: a single security clearance for each employee or contractor, recognised across government entities; greater consistency in vetting practice; more efficient vetting processes; and cost savings of $5.3 million per year.

1.6 AGSVA is a branch within the Defence Security and Vetting Service Division. As at July 2017, AGSVA had a staffing profile of 270 full-time equivalent positions, with most staff based in Canberra, Brisbane and Adelaide, and a smaller number of vetting staff based in regional offices across Australia. AGSVA also relies on an external workforce of more than 350 contractors through its Industry Vetting Panel and other contracting arrangements. In 2016–17 AGSVA had an operating budget of $50 million.

1.7 As at September 2017, AGSVA had 443,172 active security clearances recorded in its Personnel Security Assessment Management System (PSAMS2) database, of which 295,103 were at current clearance levels (see Table 1.1) and 148,069 were at previous clearance levels that were in use until 2010 (see Table 1.2).

Table 1.1: Active security clearances, current clearance levels, as at September 2017

Source: AGD, Australian Government Personnel Security Protocol, version 2.1, Canberra, April 2015, pp. 16–17, and ANAO analysis of AGSVA clearance data.

Table 1.2: Active security clearances, previous clearance levels, as at September 2017

Note a: Restricted and Entry level clearances were entity specific levels and not recognised as whole-of-government clearance levels.

Source: ANAO analysis of AGSVA clearance data.

1.8 AGSVA processes a large number of clearance applications each year. Over the past six financial years, AGSVA has made an average of 39,000 vetting decisions each year, with a majority (83 per cent) of decisions at the Baseline and NV1 clearance levels (see Figure 1.1).

Figure 1.1: Security vetting decisions^a by clearance level, 2011–12 to 2016–17

Note a: The ANAO has defined vetting decision as initial and upgrade cases granted or denied and revalidation cases continued or revoked; excludes reviews for cause, cancellations and other administrative outcomes.

Source: ANAO analysis of AGSVA’s reported vetting statistics, 2011–12 to 2016–17.

1.9 AGSVA groups clearance sponsors into three categories: Defence; Defence industry service providers; and other entities.⁵ The proportion of all security vetting cases finalised in 2016–17 was broadly equivalent across these sponsor types, ranging from 30 per cent for Defence industry service providers to 38 per cent for Defence (see Figure 1.2). However, proportions varied markedly by clearance level: 45 per cent of Baseline clearances finalised in 2016–17 were for other entities; whereas 87 per cent of PV clearances were for Defence.

Figure 1.2: Percentage of vetting decisions^a by sponsor type, 2016–17

Note a: Includes initial and upgrade cases granted or denied and revalidation cases continued or revoked; excludes reviews for cause, cancellations and other administrative outcomes.

Source: ANAO analysis of AGSVA clearance data.

1.10 The services AGSVA delivers, and the responsibilities of clearance holders and the entities that sponsor clearances, are defined in a Service Level Charter. AGSVA is oversighted by a Governance Board, comprised of senior representatives from selected sponsoring entities, which considers issues relating to the governance of the Charter. AGSVA also maintains formal agreements with relevant partner agencies, such as the Australian Security Intelligence Organisation (ASIO), which undertakes security assessments for all NV1, NV2 and PV level clearances and Baseline clearances on request.

Entity responsibilities for personnel security

1.11 Under the PSPF, primary responsibility for protective security rests with portfolio ministers and agency heads. While AGSVA provides security vetting services to government entities, agency heads are ultimately responsible for managing the security risks posed by their personnel. The PSPF’s ‘Protective security principles’ include the principle that:

Agency Heads are to ensure that employees and contractors entrusted with their entity’s information and assets, or who enter their entity’s premises:

• are eligible to have access
• have had their identity established
• are suitable to have access, and
• are willing to comply with the Government’s policies, standards, protocols and guidelines that safeguard that entity’s resources (people, information and assets) from harm.⁶

1.12 To meet the intent of this principle, entities must comply with a series of 36 mandatory requirements (the fourteen requirements most relevant to personnel security are outlined at Appendix 2). In addition, entities must adopt mandatory controls, and should adopt better practice recommendations, as outlined in a suite of PSPF personnel security policy documents. At the time of conducting this audit, these documents were:

• ‘Australian Government Personnel Security Core Policy’ (web page, updated June 2016)⁷;
• Australian Government Personnel Security Protocol (April 2015);
• Personnel security guidelines—Agency personnel security responsibilities (April 2015);
• Personnel security guidelines—Vetting practices (June 2016);
• Identifying and managing people of security concern—Integrating security, integrity, fraud control and human resources (January 2015); and
• Managing the insider threat to your business—A personnel security handbook (March 2016).

Current PSPF reforms

1.13 During 2016, AGD led a whole-of-government review of the PSPF in response to the Independent Review of Whole-of-Government Internal Regulation (August 2015) (Belcher Review). Recommendations from the Belcher Review relating to security vetting are outlined in Box 1. Recommendation 21.7 reinforced the need for greater information sharing between AGSVA and entities, which (as noted in paragraph 1.4 above) was one of the intended outcomes of the changes to the PSPF announced in September 2014.

1.14 In October 2016, the Government agreed to a suite of measures to strengthen personnel security to mitigate insider threats, to be implemented between 2016–17 and 2018–19, including: developing a framework for assessing ongoing suitability; streamlining and strengthening the vetting process through better use of existing government data holdings; and authorising entities that can meet the required standard to issue Baseline clearances to their own personnel (addressing Recommendation 21.5 of the Belcher Review).

1.15 At the time of conducting this audit, AGD was working with Defence and other relevant entities to implement reforms to the PSPF stemming from its review, with a target date of 1 July 2018 for changes to the PSPF to come into effect.

Source: Barbara Belcher, Independent Review of Whole-of-Government Internal Regulation—Report to the Secretaries Committee on Transformation, volume 1, Canberra, August 2015, p. 40.

Previous ANAO report

1.16 The ANAO previously reviewed the performance of AGSVA in ANAO Audit Report No.45 of 2014–15 Central Administration of Security Vetting, tabled in Parliament in June 2015. The ANAO concluded that the performance of centralised vetting had been mixed and expectations of improved efficiency and cost-effectiveness had not been realised. The ANAO found AGSVA had consistently failed to meet its clearance processing benchmark timeframes, had accumulated a backlog of over 13,000 clearances overdue for revalidation, and had inadequacies with its quality assurance processes, information systems and performance framework. The audit report recommended that Defence:

• implement a targeted audit program to assess Industry Vetting Panel contractors’ operations;
• introduce a program of internal peer review supplemented by periodic independent quality assurance of delegate decisions; and
• develop a clear pathway to achieve agreed timeframes for processing and revalidating security clearances.⁸

1.17 In addition, the audit outlined a number of suggestions to improve the effectiveness of AGSVA’s operations, including that AGSVA:

• investigate the underlying causes of increasing numbers of clearance subjects cancelling clearances during the vetting process (which peaked at 34 per cent in 2015–16);
• strengthen its controls for managing sensitive personal information captured as part of the vetting process (including details of personnel medical and criminal records);
• improve the quality of its performance measurement and reporting; and
• consider how best to provide feedback to client entities on security concerns identified during vetting, to facilitate those entities’ monitoring of affected personnel.

Rationale for undertaking the audit

1.18 The ANAO chose to undertake this audit because effective personnel security arrangements underpin the protection of the Australian Government’s people, information and assets, and the previous audit had identified deficiencies in AGSVA’s performance. In addition, the 2014 personnel security reforms occurred after fieldwork for the previous audit had been completed, so there was an opportunity to review the implementation of these reforms by AGSVA and other government entities.

Audit approach

Audit objective, criteria and scope

1.19 The objective of the audit was to assess the effectiveness of the Australian Government’s personnel security arrangements for mitigating insider threats.

1.20 To form a conclusion on the audit objective, the ANAO adopted the following high-level criteria:

• Does AGSVA provide efficient and effective security vetting services?
• Are selected entities complying with personnel security requirements?

1.21 The audit involved following up on recommendations and suggestions from the ANAO’s previous performance audit of AGSVA (ANAO Audit Report No.45 of 2014–15). It also examined selected entities’ compliance with PSPF personnel security requirements, with a focus on measures undertaken to mitigate insider threats and communication between AGSVA and client entities on personnel security matters. The assessment of AGSVA focussed on progress since the previous performance audit was tabled in Parliament in June 2015. The assessment of selected entities focussed on compliance during 2015–16 and 2016–17.

1.22 Examination of vetting practices within intelligence and law enforcement agencies exempt from using AGSVA’s vetting services was out of scope. In addition, the audit did not consider in detail the PSPF reforms being developed by AGD for implementation in 2018. However, where relevant to audit findings, reference has been made within this report to current implementation progress.

Characteristics of selected entities

1.23 In conducting the audit, the ANAO examined the performance of five selected entities in complying with PSPF personnel security requirements: AGD; Australian Radiation Protection and Nuclear Safety Agency (ARPANSA); Australian Securities and Investments Commission (ASIC); Department of Home Affairs (Home Affairs)⁹; and Digital Transformation Agency (DTA). These entities were selected to provide coverage of a variety of entity functions, locations and sizes.

Table 1.3: Characteristics of selected entities, as at 30 June 2017

Note a: Function descriptions as per Australian Public Service Commission classifications.

Source: Australian Public Service Commission (APSC), Australian Public Service Statistical Bulletin 2016–17, September 2017, data tables, Excel workbook, available from: <http://www.apsc.gov.au/about-the-apsc/parliamentary/aps-statistical-bulletin/statisticalbulletin 16-17> [accessed 17 October 2017].

Audit methodology

1.24 The major audit tasks included:

• extracting and analysing data from AGSVA’s security vetting system, entity human resources information management systems and other relevant databases;
• reviewing entity documentation such as policies, plans, reviews, briefs, procedures, performance reporting, assurance reports, registers and risk assessments; and
• interviewing staff within AGSVA and Defence, in security, human resources and information technology roles within selected entities, and from other relevant entities such as the Australian Security Intelligence Organisation.

1.25 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $494,000.

1.26 Team members for this audit were Daniel Whyte, Benjamin Siddans, Alice Bloomfield and Deborah Jackson.

Do AGSVA’s security clearances provide sufficient assurance about personnel security risks?

2.1 The purpose of a security clearance is to provide a level of assurance to entities that an individual (the clearance holder) is suitable to access security classified information.¹⁰ Standards for security vetting are specified by the Attorney-General’s Department (AGD) in the Protective Security Policy Framework (PSPF) policy document: Personnel security guidelines—vetting practices (the vetting guidelines).¹¹ The vetting guidelines specify the minimum personnel security checks required for Baseline, NV1, NV2 and PV clearances, and outline adjudicative guidelines for vetting officers and delegates for assessing common risk factor areas that may impact on an individual’s suitability to hold a clearance (see Table 2.1 for an overview of factor areas, potential security concerns and mitigating factors).

Table 2.1: Risk factor areas for assessing suitability to hold a security clearance

Source: AGD, Personnel security guidelines—vetting practices, version 1.3, June 2016, section 5.2.

2.2 The vetting guidelines do not specify graduated risk tolerance thresholds for different clearance levels; rather, they outline potentially disqualifying security concerns and mitigating factors that apply to all levels. Higher clearance levels represent increasing levels of assurance that clearance subjects are suitable, based on longer assessment periods (from five years for Baseline to 10 years or from 16 years of age, whichever is greater, for PV) and more rigorous and intrusive testing (see Appendix 3 for the checks required for each clearance level).

2.3 Since AGSVA conducts security vetting services for more than 150 Australian Government entities (as well as state and territory entities), it is not required to provide clearances tailored to specific entity risks. For example, a law enforcement entity may have a lower tolerance for criminal associations or drug usage than other entities, but AGSVA does not consider this distinction when deciding whether to grant or deny a clearance. A clearance granted by AGSVA, which is transferable between entities, provides generic assurance that a clearance holder is suitable to access classified material, with entities expected to undertake employment screening to address entity-specific risks (discussed in Chapter 3).

AGSVA’s vetting decisions

2.4 A security vetting assessment (or clearance case) can result in several possible outcomes:

• grant—grant of a new clearance, or continuation or upgrade of an existing clearance;
• deny and grant lower level—denial of the requested clearance level and grant or continuation of a lower clearance level;
• deny—denial of a new clearance, or revocation of an existing clearance;
• cancel—cancellation of a clearance request (for example, if the clearance subject ceases employment); or
• other—other administrative outcomes such as rejecting an incomplete clearance case or downgrading a clearance level due to a change in an entity’s requirements.

2.5 The ANAO examined the outcomes of clearance cases completed in 2015–16 and 2016–17 (see Table 2.2). Excluding administrative outcomes (cancel and other), 99.88 per cent of vetting decisions were to grant, 0.06 per cent were to deny and grant a lower level, and 0.06 per cent were to deny a clearance.¹²

Table 2.2: Clearance case outcomes by clearance level, 2015–16 to 2016–17^a

Note a: Includes initial, upgrade and revalidation cases; excludes reviews for cause.

Source: ANAO analysis of AGSVA clearance data.

2.6 In addition to clearance cases, AGSVA conducts a small number of reviews for cause, which involve reassessing the suitability of an existing clearance holder due to an identified security concern.¹³ AGSVA completed 46 reviews for cause during 2015–16 and 2016–17, resulting in an additional 22 grant, eight deny and grant lower level, and 16 deny decisions (not included in the results in Table 2.2).

Management of identified security concerns

2.7 Personnel security risk is a spectrum in which many clearance subjects demonstrate some behaviours or qualities of concern, and judgement is required to determine if the risk is acceptable. The vetting guidelines provide high level statements about potential security concerns and mitigating factors, so vetting decisions are heavily reliant on the professional judgement of vetting officers and delegates.¹⁴

2.8 Vetting officers frequently identify potential security concerns during their assessment of a clearance subject, with approximately 43 per cent of all vetting assessments undertaken during 2015–16 and 2016–17 identifying concerns against one or more of the seven factor areas (see Table 2.1 above for descriptions of these factor areas). For clearances granted over this period, the extent to which concerns were identified varied by clearance level (as shown in Table 2.3 below). Since higher clearance levels involve more rigorous checks and cover a longer period of a clearance subject’s life, the rigour of the process may contribute to the identification of more security risk factors (both by increasing the chance a concern will be detected and by discouraging clearance subjects from concealing information from the vetting officer).

2.9 To arrive at a vetting decision, AGSVA vetting officers and delegates consider the identified security concerns and mitigating factors and assess the level of residual risk associated with a clearance subject. In broad terms, AGSVA has four options for managing residual risks:

• avoid the risk, by denying the subject a clearance;
• reduce the risk, by modifying controls or implementing further controls, such as granting a clearance with maintenance requirements or granting a lower level clearance;
• share the risk, by granting a clearance and sharing information about identified security concerns and mitigating factors with a sponsoring entity’s security office; or
• accept the risk, on behalf of a sponsoring entity, by granting a clearance without sharing risk information or implementing clearance maintenance requirements.¹⁵

2.10 Out of the 89,379 vetting decisions made by AGSVA during 2015–16 and 2016–17 (excluding reviews for cause):

• 53 (0.06 per cent) involved avoiding risk through denying a clearance;
• 55 (0.06 per cent) involved reducing risk through denying the requested level and granting a lower level; and
• two (0.002 per cent) involved reducing risk through granting a clearance with maintenance requirements.

2.11 As discussed later in this chapter (paragraphs 2.30–2.46, pages 34–37), AGSVA does not share risk information with sponsoring entities outside of Defence due to its interpretation of privacy requirements. In the overwhelming majority of cases, AGSVA’s approach to managing personnel security risks identified through its vetting process was to accept residual risks on behalf of sponsoring entities.

2.12 AGSVA advised the ANAO that reasons for its relatively low denial rate include:

• rigorous recruitment processes conducted by public sector entities and the Australian Defence Force, which can include pre-employment checks (such as psychological and organisational suitability assessments for Defence intelligence agencies) that exclude personnel on the basis of identified security concerns (discussed in Chapter 3)¹⁶;
• clearance subjects not complying with the vetting process to avoid security concerns being identified, leading to the cancellation of the clearance; and
• the procedural fairness process, which involves providing an individual who AGSVA is proposing to deny a clearance with an opportunity to respond to identified security concerns, uncovering additional mitigating factors that lead to a grant decision.

2.13 AGSVA’s denial rate is also a reflection of its risk appetite—that is, the thresholds it employs for denying a clearance at different clearance levels reflect the levels of residual risk it determines are acceptable. In 2017, AGSVA commenced work to document and standardise its risk tolerance thresholds through the development of a vetting decision risk model, based on work undertaken by AGSVA’s psychologists on a structured professional judgement instrument for assessing psychological risk factors. AGSVA informed the ANAO that it plans to start using the risk model in 2018 and subsequently integrate it into its new ICT system, which it anticipates will be fully operational in 2023.

2.14 While development of this model should help AGSVA to codify its risk appetite and aid consistent decision making, there is also scope for AGSVA to make greater use of other risk treatment options that involve collaborating with sponsoring entities to manage personnel security risks.

Resolving doubt in favour of national interest

2.15 The vetting guidelines state, ‘Any doubt concerning the clearance subject’s suitability must be resolved in favour of the national interest’.¹⁷ However, an internal review of AGSVA, finalised in March 2016, found: ‘The clearance process is over-weighted towards protecting risk to AGSVA through incorrect denial compared with risk to national security’.¹⁸ This finding was based on the observation that, until October 2017, AGSVA’s vetting processes required any case that an initial delegate decided should be a denial to pass through two additional stages of consideration (see Figure 2.1 below).

Figure 2.1: Denial decision pathway

 

 

Source: ANAO analysis of AGSVA procedural documentation.

2.16 First, a potential denial case progressed to the complex vetting team, where another vetting officer reassessed the case. If the complex vetting officer agreed it should be a denial, it proceeded to procedural fairness, providing the clearance subject with an opportunity to respond to any identified security concerns. After receiving a procedural fairness response, and further consideration by a complex vetting officer and delegate, a final decision to deny or downgrade a clearance was made by the Assistant Secretary Vetting.¹⁹

2.17 These additional consideration stages greatly increased the time taken to finalise complex vetting decisions (as shown in Table 2.4). Further, at each additional round of consideration a delegate may grant a clearance, increasing the likelihood that an initial deny decision would be overturned. Of the 431 complex cases completed during 2015–16 and 2016–17, 23 per cent were cancelled prior to a final vetting decision, 53 per cent resulted in a grant, 12 per cent in a denial and grant of a lower level clearance, and 12 per cent in a denial.

Table 2.4: Case durations for complex and non-complex cases, 2015–16 to 2016–17

Source: ANAO analysis of AGSVA clearance data.

2.18 AGSVA abolished its complex vetting team in October 2017, based on a recommendation of the March 2016 internal review. Going forward, cases subject to a denial decision will proceed directly to the procedural fairness stage.

Use of clearance maintenance requirements

2.19 The extent to which AGSVA can provide assurance to sponsoring entities regarding personnel security risks is limited by the binary nature of AGSVA’s vetting decisions, which generally avoid risk by denying a clearance or accept risk on behalf of a sponsoring entity by granting a clearance.

2.20 The vetting guidelines state that clearances may be granted subject to clearance maintenance requirements (or aftercare), which are specific requirements that a clearance holder must comply with to retain their clearance (such as random drug testing, ongoing treatment for identified mental health issues, or regular reporting).²⁰ Under the PSPF guidelines, AGSVA is responsible for identifying maintenance requirements and consulting with sponsoring entities and clearance subjects to gain their agreement to any requirements applied. Once implemented, the sponsoring entity and clearance subject are responsible for managing compliance with maintenance requirements and reporting on compliance to AGSVA.²¹

2.21 In 2015–16 and 2016–17, 280 of the 431 complex cases resulted in the grant of a clearance (230 at the requested level, and 50 at a lower level). In all of these cases, the original vetting officer and delegate determined that the clearance should be denied—indicating there was a degree of doubt regarding the level of residual risk. As noted in paragraph 2.10, AGSVA only applied clearance maintenance requirements on two occasions over that period; in both cases for clearances sponsored by Defence. Case study 1 provides an example of a complex vetting case AGSVA completed for an external entity where clearance maintenance requirements were not imposed but could have been considered. This case study also shows that AGSVA’s risk tolerance decisions do not take into account entity employment suitability considerations.

2.22 AGSVA informed the ANAO that AGD leads Commonwealth protective security policy and is responsible for setting policy parameters for when and how clearance maintenance requirements should be used and where accountabilities for their implementation lies. As noted in paragraph 2.20 above, PSPF policy documents currently articulate these parameters at a high level. AGD advised the ANAO that, under the proposed 2018 revisions to the PSPF, clearance maintenance conditions will continue to be a shared responsibility of AGSVA, the sponsoring entity and clearance subject.

2.23 Greater use of clearance maintenance requirements would increase the level of assurance provided by AGSVA’s security clearances by enabling collaboration between AGSVA and sponsoring entities about managing residual personnel security risks. As part of its current project to develop a vetting decision risk model, AGSVA should establish operational guidelines for appropriate, risk-based use of clearance maintenance conditions. AGD could assist AGSVA in operationalising this aspect of security vetting policy, by providing input to the development of these guidelines.

Cancellation of clearances

2.26 ANAO Audit Report No.45 of 2014–15 suggested that a greater understanding of the reasons for cancellations would assist AGSVA in identifying opportunities for efficiency.²² Table 2.2 above shows that approximately 28 per cent of clearance cases completed during 2015–16 and 2016–17 ended in cancellation.

2.27 The March 2016 internal review of AGSVA speculated that clearances cancelled during the assessment process may be the result of a deterrent effect, stating:

While no data on the reasons for people cancelling their applications is collected, some of the applicants who cancel out of the process could be doing so because they have found another position while they were waiting for a clearance. For other applicants, the self-cancellation rate could indicate inappropriate applicants dropping out of the system.

2.28 AGSVA’s internal analysis of clearance cases cancelled during 2016–17 indicates that 55.6 per cent of cancellations were due to the clearance subject failing to submit a vetting pack or to comply with a request for further information. AGSVA informed the ANAO that some unsuitable individuals may withdraw from the process when they understand the nature of the information being collected.

2.29 As noted in paragraph 2.16 above, around 23 per cent of complex cases were cancelled prior to a final vetting decision, which is lower than the overall cancellation rate. In addition, cancelled complex cases represented only 0.3 per cent of all clearance cancellations. Analysis by the ANAO identified that the majority of cancellations occur prior to AGSVA completing its initial vetting assessment, as shown in Table 2.5. Consequently, there is no clear evidence that clearance subjects cancel their application after becoming aware of a potentially adverse vetting assessment.

Table 2.5: Stages at which cancellations occur, 2015–16 to 2016–17

Source: ANAO analysis of AGSVA clearance data.

Does AGSVA share relevant information with client entities?

2.30 As noted in paragraph 1.4, PSPF policy reforms announced by the Attorney-General in September 2014 were designed to promote greater information sharing and collaboration on personnel risk management between AGSVA and entities. AGD’s revised personnel security policy documents, released in September and November 2014, outlined the following mandatory controls:

Vetting agencies are to advise sponsoring agencies of any information provided as part of the vetting process or ongoing clearance maintenance that may impact on a person’s suitability to access Australian Government resources or where risk mitigation measures are required.²³

Vetting agencies are to obtain written informed consent from all clearances subjects to share information with other agencies for the purposes of assessing their ongoing suitability.²⁴

2.31 AGD included a sample informed consent form and privacy notice as an annex to the vetting guidelines, which vetting agencies could use to obtain clearances subjects’ written informed consent to share personal information, including sensitive information, with sponsoring entities.²⁵ AGD obtained advice that appropriate informed consent would allow AGSVA to share such information with entities under the Privacy Act 1988 (Privacy Act).

2.32 ANAO Audit Report No.45 of 2014–15 noted entities’ concerns about AGSVA’s level of communication regarding personnel security risks. The audit included a suggestion that AGSVA consider how best to provide feedback to entities on specific security concerns identified during vetting.²⁶

2.33 In addition, the Belcher Review recommended that AGSVA provide entities with greater visibility of information on clearance holders to enable them to proactively manage security risks (see Recommendation 21.7 in Box 1 on page 21). The review noted that the Canadian Government’s centralised security vetting model allows entities to make the decision on whether or not to grant a clearance based on recommendations from a centralised vetting provider, and information on personnel security risks is provided to entities.²⁷

Revisions to AGSVA’s consent form

2.34 AGSVA commenced work on developing a revised informed consent form for its security clearance application pack in late 2014. In February 2017, after a protracted internal debate about the content of the form and subsequent delays in incorporating it into its clearance pack, AGSVA commenced using a revised form, ‘SVA 021: Security Clearance Informed Consent and Official Secrecy Acknowledgement’. In informing entity security advisors of the change, AGSVA stated the revisions to the form allowed it to meet the PSPF mandatory control to obtain informed consent from personnel.

2.35 Unlike the sample informed consent form and privacy notice included in the vetting guidelines, AGSVA’s form did not explicitly state that it would share sensitive personal information with sponsoring entities for the purpose of assessing their ongoing suitability. Earlier drafts of the form included an explicit statement that AGSVA would share personal information with entities, but the final version of the SVA 021 form did not.

2.36 After publishing its revised form in February 2017, AGSVA came to the view that the form does not provide fully informed consent to share sensitive personal information with entities. As at February 2018, AGSVA had not initiated a project to update the SVA 021 consent form. More than three years after the PSPF was revised to require AGSVA to gain informed consent from clearance subjects, AGSVA has not met the intent of this reform and is non-compliant with the PSPF mandatory control.

Current information sharing arrangements

2.38 As noted in paragraph 2.5, 99.88 per cent of vetting decisions made by AGSVA resulted in the grant of a clearance. The only information that is routinely shared with entities is that a clearance has been granted at a particular level. Information on potential security concerns and associated mitigating factors identified through the vetting process is not shared with entities.²⁸

2.39 In recent years, AGSVA has used a mechanism called ‘risk advisory notices’ (RANs) to share limited risk information with entities in the following situations:

• Provisional access requests—where entities seek to provide individuals with provisional access to classified material prior to clearance being granted, AGSVA can undertake a preliminary review and provide a RAN outlining any generic factor areas in which potential security concerns have been identified (for example, ‘Alcohol and drug usage’);
• Direct request—occasionally entities have requested advice to support an organisational suitability assessment, and AGSVA has made a case-by-case decision on whether to provide a RAN;
• Change of circumstances—when a change of circumstances form submitted by an entity or clearance subject has initiated a review of their clearance, AGSVA has occasionally provided a RAN to the sponsoring entity (although in such cases AGSVA noted that the entity is usually already aware of the issue).

2.40 The ANAO examined AGSVA’s records of requests to share information from personal security files received during 2015–16 and 2016–17 for any requests received from sponsoring entities.²⁹ In four instances, each involving Home Affairs, AGSVA released information on the basis of informed consent that the entity had obtained from the clearance subject. In one other instance, involving a different entity, information was not released.

2.41 Over that same period, AGSVA granted 89,271 clearances, 38,925 of which involved identified potential security concerns that were accepted by AGSVA on the basis of mitigating factors. Case study 1 (page 31) provides an example in which AGSVA accepted personnel security risks on behalf of a sponsoring entity without communicating the nature of the risks to the entity.

2.42 In August 2017, AGSVA advised its whole-of-government oversight forum that:

[RANs] may be seen as pre-empting the assessment process and may result in sanctions that significantly disadvantage the clearance subject and/or expose either AGSVA or the sponsoring agency to appeal or litigation… Additional work and legal advice is required to fully understand the legal and policy constraints of RANs.

2.43 In October 2016, AGD and Defence gave a joint undertaking to Government that AGD would identify solutions to allow AGSVA to share information with entities in 2016–17 and AGSVA would implement information sharing within the vetting process in 2017–18.

2.44 Planning documents for Defence’s ‘ICT2270 Vetting Transformation’ project (discussed in the next section) indicate it intends to integrate the capability to share risk information with external entities within this new system. The new ICT system is not expected to be fully operational until 2023.

2.45 When AGSVA updates its informed consent form, in line with Recommendation no.2 (paragraph 2.37), at the same time it should revise its business processes to enable it to routinely provide sponsoring entities with risk information about clearance subjects, during the vetting process (for provisional access requests), at the point of granting a clearance, and when an entity sponsors an existing clearance. This will allow entities to consider, in light of their individual risk tolerances, whether identified security concerns warrant further treatments (such as requiring individuals to provide regular updates to the security office on matters of concern).³⁰

2.46 As AGD is responsible for security vetting policy and Defence is responsible for whole-of-government vetting operations, they should work together to develop operational policies and guidelines that specify:

• what level of risk information should be shared and in what form;
• who within entities it should be shared with (for example, an entity’s security advisor or security executive); and
• any caveats or restrictions that should be placed on entities’ use of risk information.

Does AGSVA have appropriate systems to support its vetting services?

2.50 AGSVA’s vetting services are supported by the eVetting system³¹, which from an end-user perspective consists of three primary components:

1. the Personnel Security Assessment Management System (PSAMS2)—which acts as a vetting case management system;
2. ePack 2—which allows clearance subjects to complete and submit security vetting packs through an online portal; and
3. Security Officer Dashboard—an online dashboard that allows security officers in entities to look up limited information about clearance subjects.

2.51 ANAO Audit Report No.45 of 2014–15 identified shortcomings in AGSVA’s ICT systems relating to the security of clearance records, data quality and the ability of the systems to support AGSVA’s business processes.

Security of clearance records

2.52 At the time of the ANAO’s previous audit, Defence had conducted two reviews of AGSVA’s information security.³² The reviews had identified that Defence was not compliant with all of the requirements of the Australian Government Information Security Manual and found deficiencies in the controls framework surrounding AGSVA’s clearance records which could lead to unauthorised access and loss of information.³³

2.53 The ANAO conducted further work in this area. In accordance with section 37(1)(a) of the Auditor-General Act 1997 (Cth) (the Act), the Auditor-General determined to omit particular information relating to this matter, including an additional recommendation to Defence, from this public report. The reason for this is that the Auditor-General is of the view that such information would be contrary to the public interest in that it would prejudice the security, defence or international relations of the Commonwealth, as per section 37(2)(a) of the Act.

2.54 In accordance with section 37(5)(b) of the Act, a report including the omitted information and additional recommendation has been prepared and a copy provided to the Prime Minister, the Attorney-General, the Minister for Defence, the Minister for Finance and the Minister for Home Affairs.

Data quality

2.55 The ANAO’s previous audit of AGSVA identified data quality issues with clearance records held in the eVetting system, such as the presence of duplicate records and date-related anomalies.³⁴ Anomalies of this nature continue to be present within the eVetting system.³⁵

2.56 AGSVA is heavily reliant on manual review by staff to detect data quality issues in new clearance requests submitted by sponsoring entities, such as incorrect dates of birth, duplicate records and missing information. AGSVA does not require clearance holders to verify their personal information, and relies on change of circumstances reports from clearance holders and sponsoring entities to ensure its biographical records are up to date (discussed in more detail in Chapter 3).

2.57 The ANAO did not systematically verify the quality of AGSVA’s clearance data holdings, but was able to identify obvious errors and discrepancies in the biographical data of clearance holders. Examples of these issues are shown in Table 2.6.

Table 2.6: PSAMS2 data quality issues

Note a: The ANAO considered a clearance subject record to be a probable duplicate if first name, family name, year of birth, birth location and primary sponsoring entity were identical to at least one another record.

Source: ANAO analysis of AGSVA clearance data.

2.58 AGSVA should take a more proactive approach to identifying, preventing and resolving anomalous data. In late 2017, AGSVA commenced a pilot project with a single sponsoring entity to validate clearance subject data, with an aim of initiating a project in 2018 to further validate clearance holdings in advance of transferring information to its new ICT system.

Supporting AGSVA’s business processes

2.59 AGSVA’s current case management system, PSAMS2, supports vetting officers to manage clearances by providing workflow guidance. It automatically generates tasks (such as reviewing a file, undertaking an external check, or making an assessment decision) for completion by AGSVA vetting officers and delegates. However, it does not enforce completion of all tasks, even when such tasks are required to issue a clearance. As at September 2017, the ANAO identified three cases relating to PV clearances from 2015–16 and 2016–17 that had progressed to a vetting decision without an ASIO check being completed. After the ANAO advised AGSVA of this, AGSVA informed the ANAO that it would develop a custom report for its database to identify any cases where this may have occurred.

2.60 Limitations in PSAMS2 also reduce AGSVA’s ability to measure its performance. The system records the date at which major milestones have been completed, allowing for broad measurement of timeliness, but identification of bottlenecks and inefficiencies could be improved with more granular information about when subtasks are completed. Similarly, the system only permits one case type (or system task) to be active on a clearance holder’s record at one time, which reduces AGSVA’s ability to quantify and analyse its work processes. For example, if a clearance upgrade case is in progress and AGSVA receives a change of circumstances report, the change of circumstances case will not be separately recorded.

2.61 A significant portion of AGSVA’s vetting services are undertaken by contractors on its Industry Vetting Panel. Due to concerns about system stability, AGSVA has not been able to provide its contractors with access to PSAMS2, which means clearance records are communicated via both mail and email. As a result, contractors accumulate a considerable volume of hard-copy and electronic information, over which AGSVA has limited oversight. In addition, potentially sensitive information is communicated outside of Defence’s secure ICT environment. AGSVA’s Industry Vetting Panel deed requires contractors to comply with Defence’s information security policies, but AGSVA’s internal quality assurance reviews of contractors (discussed later in the chapter) have identified that these requirements were frequently not adhered to.

ICT2270 Vetting Transformation project

2.62 Defence is aware that the eVetting system does not meet AGSVA’s needs, and has a commenced an ‘ICT2270 Vetting Transformation’ project to develop a replacement system. The project is currently in the initial scoping and approval stages. Project documentation indicates Defence seeks to establish a system that:

• provides sponsoring entities with information on identified risk factors associated with individual clearance holders;
• increases automation of clearance decision-making and data collection (including across other government holdings, and online social-media information); and
• supports continuous assessment of security risk.

2.63 In September 2017, in a brief to the incoming Secretary of Defence, AGSVA indicated that ‘delivery of an initial operating capability’ was envisaged in ‘late 2020’. A subsequent paper to its Governance Board in December 2017 indicated that, while initial capability was still expected to be delivered in 2020, the system would not be fully operational until 2023.

Does AGSVA have a clear pathway to achieving its benchmark clearance timeframes?

2.64 ANAO Audit Report No.45 of 2014–15 highlighted AGSVA’s longstanding inability to meet agreed performance targets for processing security clearances and to address its mounting backlog of clearances due for revalidation. The report discussed the need for Defence to ‘develop a pathway—including agreed strategies, targeted resources and a timetable—to improve its performance against benchmark timeframes, and address the revalidation backlog at a time of heighted focus on the threat posed by trusted insiders’.³⁶

Management of AGSVA’s vetting caseload

2.65 AGSVA’s processes for managing its vetting caseload are inefficient. As discussed in paragraphs 2.59 to 2.61, AGSVA’s business systems do not adequately support its needs, and the functionality and information required to effectively manage its caseload is not always available. Internal reviews of AGSVA have also identified shortcomings in business processes that contribute to inefficient caseload management, including:

• the clearance pack being transferred to and from paper to digital documents three to five times during the vetting process, with corresponding manual copying or data entry of the entire clearance pack into PSAMS2³⁷;
• clearance applications being re-checked and re-vetted multiple times, particularly where cases are recommended for denial; and
• applications following the same process regardless of risk and vetting resources not being allocated based on risk.

2.66 In mid-2017, AGSVA initiated an organisational renewal project, which has involved implementing preliminary measures to address these inefficiencies, including:

• developing a new cost model for determining the price of security clearances charged to sponsoring agencies (to be implemented from early 2018);
• abolishing the complex vetting unit and redesigning the vetting process to allow vetting officers to undertake procedural fairness without the need to re-vet cases (implemented from October 2017); and
• undertaking a pilot program, from March to August 2017, to create unified vetting teams, allowing resources to be allocated more efficiently (previously PV clearances were managed by a separate teams to Baseline, NV1 and NV2 clearances).

2.67 While these are positive developments, AGSVA plans to realise other business process improvements through its new ICT system, which is not expected to be fully operational until 2023.

Revisions to AGSVA’s benchmark clearance timeframes

2.68 AGSVA’s original benchmark clearance timeframes were outlined in its 2010 Charter and remained unchanged in successive Service Level Charters until the end of 2016–17. In June 2017, AGSVA gained agreement from its Governance Board to revised timeframes and key performance indicators for 2017–18, to be reviewed annually going forward. The original and revised benchmark timeframes and performance reviewed targets are in Table 2.7.

Table 2.7: AGSVA’s benchmark clearance timeframes and targets, original and revised

Note a: AGSVA defines ‘routine cases’ as excluding cancellations.

Source: AGSVA Service Level Charters.

2.69 Since 2010–11, AGSVA’s average processing times for Baseline, NV1 and NV2 clearances have fluctuated at around the original benchmark timeframes (see Figure 2.2), with its best performance in 2010–11—its first year of operation. AGSVA’s average processing time for PV clearances has increased steadily, reaching a peak of 17.6 months in 2016–17. As at September 2017, AGSVA was on track to achieve its revised 2017–18 performance target for Baseline, NV1 and NV2 clearances, but not PV clearances.

Figure 2.2: Average processing time for clearance cases by level, 2010–11 to 2016–17

Source: ANAO analysis of AGSVA’s reported vetting statistics, 2010–11 to 2016–17

2.70 As a smaller number of clearances take far longer than benchmark timeframes to process, AGSVA’s revised indicator (average processing time) is not the most appropriate indicator for clearance timeframes (see Appendix 4 for graphical representations of AGSVA’s clearance timeframes in 2016–17, which show skewed distributions).³⁸ Although AGSVA did not achieve its original 95 per cent performance target, AGSVA’s original indicator (percentage of clearance cases completed within benchmark timeframes) is more appropriate. Examining AGSVA’s performance using this indicator shows its performance improved during 2016–17 for Baseline, NV1 and NV2 clearances, reaching around 80 per cent for each clearance level. Rather than using average processing time as its performance indicator, AGSVA should seek agreement from its Governance Board to an appropriate percentile target for completion of clearance cases within benchmark timeframes.

Figure 2.3: AGSVA performance against benchmark timeframes, 2013–14 to 2016–17^a

Note a: AGSVA did not report results against this indicator for 2010–11 to 2012–13.

Source: ANAO analysis of AGSVA reported vetting statistics, 2013–14 to 2016–17.

Positive Vetting remediation

2.71 AGSVA commenced a remediation program for PV clearances in early 2016 due to a mounting backlog of revalidation cases and escalating delays in processing clearances. In a February 2016 brief to the Secretary of Defence, AGSVA noted that the PV backlog was ‘at crisis point’ and it was working with AGD, the Department of the Prime Minister and Cabinet and ASIO to agree and implement remediation actions. In the same brief, AGSVA forecast that it would eliminate its backlog and achieve benchmark clearance timeframes for PV clearances by 2020–21 (see Table 2.8).

Table 2.8: AGSVA’s forecast PV backlog and processing times, 2015–16 to 2020–21

Source: AGSVA brief to Secretary of Defence, February 2016.

2.72 Measures introduced as part of the PV remediation program have included:

• increasing the revalidation period for PV and NV2 security clearances from five to seven years (to provide a two year respite from revalidations);
• decreasing the checkable background period for PV clearances from whole-of-life to 10 years or from 16 years of age, whichever is greater (to reduce vetting effort);
• cooperating with ASIO to reduce the caseload of PV referrals awaiting ASIO security assessment, which totalled around 1100 cases by September 2017;
• increasing vetting resources by adding more PV vetting officers and increasing the pool of contracted psychologists; and
• business process re-engineering aimed at improving prioritisation, allocation and integrated team approaches.

2.73 The 2017 Independent Intelligence Review conducted by the Department of the Prime Minister and Cabinet noted the impact AGSVA’s processing times for PV clearances were having on the intelligence community workforce. It recommended the situation be reviewed again in early 2018, to allow time for the remediation program to have effect, and that alternative options, such as shifting responsibility for PV clearances to ASIO or allowing non-exempt intelligence agencies³⁹ to conduct their own PV clearances, should be considered if processing times still exceeded six months.⁴⁰

2.74 In September 2017, AGSVA reported to its Governance Board that:

For PV revalidations, the backlog and processing times will likely remain high for another two years. AGSVA is expediting priority revalidations and is actively risk managing delays in revalidations through the annual security appraisal process for all existing PV holders.

2.75 AGSVA’s actual backlog size and average processing times for PV clearances over the period 2015–16 to 2017–18 (see Table 2.9) have not declined in line with its February 2016 forecasts (outlined in Table 2.8 above). Partly this has been due to an increasing backlog of clearances awaiting an ASIO security assessment, as ASIO’s capacity to complete assessments has not kept pace with AGSVA’s increased PV vetting throughput.

Table 2.9: AGSVA’s actual PV backlog and processing times, 2015–16 to 2017–18

Source: AGSVA reporting to AGSVA Governance Board

2.76 AGSVA has acknowledged that it will not reduce its PV processing times to under six months by early 2018.

Does AGSVA have comprehensive quality assurance programs for its contractors and internal vetting decisions?

2.77 ANAO Audit Report No.45 of 2014–15 made two recommendations relating to quality assurance, recommending that Defence:

• implement a targeted audit program to assess Industry Vetting Panel contractors’ operations⁴¹; and
• introduce a program of internal peer review supplemented by periodic independent quality assurance of delegate decisions.⁴²

2.78 AGSVA’s quality management system, which comprises its vetting policies and procedures, an internal quality audit program and quarterly management reviews, was granted International Standards Organization (ISO) 9001:2008 accreditation in April 2014. It gained reaccreditation under ISO 9001:2015 in May 2017.

2.79 In February 2016, AGSVA commenced a targeted audit program of all current Industry Vetting Panel contractors, which was undertaken in tranches as part of its 2015–16 and 2016–17 internal quality audit program. The audits found contractors were generally conforming in the areas of: staffing, training and professional development; quality control, assurance, monitoring and measuring; and feedback handling, warranty returns and remedial action. However, the audits identified consistent areas of contractor non-conformance and recommended corrective actions to address:

• the use of superseded or obsolete procedural documents;
• uncontrolled records management practices that were non-compliant with information security requirements; and
• failure to undertake security awareness training and maintain local security policies and procedures.

2.80 Also in February 2016, AGSVA established an internal peer review program, involving the review by vetting supervisors of a random selection of ‘grant’ decisions for each clearance level (42 for Baseline, 42 for NV1, 21 for NV2 and 10 for PV) every six months. As at November 2017, three peer review rounds had been completed for the Baseline, NV1 and NV2 clearance levels, with the majority of cases being assessed as compliant. For all cases that were assessed as non-compliant, the reviewer determined that the compliance issue had no bearing on the vetting decision. One PV round of peer review has been completed (in July-August 2017), with all cases being assessed as compliant.

2.81 AGSVA wrote to ASIO and the Department of Foreign Affairs and Trade (two authorised vetting agencies) in September 2015, and held subsequent meetings with these entities, gaining in-principle agreement to undertake six-monthly external peer review of a selection of NV1, NV2 and PV ‘grant’ decisions. However, AGSVA was not able to provide evidence that this external peer review program had been implemented. AGSVA should establish an independent quality assurance process for vetting delegates’ decisions, in line with the ANAO’s recommendation in the previous audit.

Do entities have appropriate risk-based policies, plans and procedures for personnel security?

3.1 Under the governance requirements of the PSPF, entities must:

• prepare a protective security plan, updated at least every two years (GOV-4);
• develop a set of protective security policies and procedures (GOV-5); and
• adopt a risk management approach to protective security (GOV-6).⁴⁴

3.2 AGD, ARPANSA, ASIC and Home Affairs were able to produce cleared documentation regarding these requirements. DTA, which was established as a non-corporate Commonwealth entity in July 2015, had not finalised a protective security plan, policies or a risk assessment. Table 3.1 shows a summary of entity performance against the PSPF requirements and recommended practices, with a focus on whether entities are effectively planning, developing policies and procedures and undertaking risk assessment for personnel security.

Table 3.1: Entity security plans, policies, procedures and risk assessments

 

 

Source: ANAO analysis of entity documentation based on criteria outlined at Appendix 5.

3.3 AGD, ARPANSA, ASIC and Home Affairs had completed a protective security plan to manage their security risks. Three entities, AGD, ARPANSA and Home Affairs, had not updated or revised their plans at least every two years as required.⁴⁵ The quality of plans varied between agencies, with some entities’ plans containing few measures or actions relating to personnel security. Where measures or actions had been identified, detail was often lacking with regard to responsibility for implementation, intended outcomes or performance indicators. DTA has a draft security plan, which it expected to finalise in the second half of 2017–18.

3.4 All entities had some level of personnel security policies and procedures in place and accessible on their intranet sites. In many cases, policies and procedures had not been kept up-to-date or updated to reflect recent changes to the PSPF. Home Affairs had the most comprehensive suite of policies, procedures and instructions for personnel security. While DTA had limited procedural documentation on its intranet, it did not have any formal protective security policies; it had developed draft protocols for physical and information security, but not for personnel security.

3.5 Selected entities had generally identified trusted insiders as a key threat, but their protective security risk assessments focussed on physical and information security. ARPANSA, ASIC and Home Affairs had undertaken protective security risk assessments within the past two years, which considered personnel security. AGD’s most recent risk assessment, finalised in June 2015, did not consider personnel security. DTA advised that it had conducted an initial security risk assessment in 2015, but could not provide evidence. ARPANSA was the only entity that had recently conducted a personnel security risk assessment.

3.11 The 2016 Belcher Review recommended revisions to PSPF governance requirements ‘to streamline requirements and remove duplication with other requirements imposed on entities’ and ‘improve communication and support to entities to implement the PSPF, in particular to assist entities adopt a sound risk-based approach’.⁴⁶ At the time of conducting this audit, AGD was making revisions to the PSPF in light of these recommendations, with a target date for changes to the PSPF to come into effect on 1 July 2018.

3.12 Selected entities were slow to adopt changes to the PSPF requirements within their plans, policies and procedures. This suggests entities could benefit from simpler and more streamlined policy requirements and greater support from AGD as policy owner. Potential support could include provision of templates for components such as security plans and risk assessments, and dissemination of better practice examples.

Do entities assess the eligibility and suitability of personnel to access government resources?

3.13 Under the personnel security requirements of the PSPF, entities must:

• ensure the eligibility and suitability of their personnel to access Australian Government resources, through conducting effective employment screening (PERSEC-1);
• identify, record and review positions that require a security clearance (PERSEC-2); and
• ensure personnel accessing classified resources have a security clearance from AGSVA⁴⁷ at an appropriate level (PERSEC-4 and PERSEC-6).⁴⁸

Employment screening

3.14 The purpose of employment screening is to provide entities with assurance that their personnel are eligible and suitable to be granted access to Australian Government resources. Employment screening generally occurs prior to engagement and involves confirming an individual’s identity, checking their integrity and reliability, and obtaining signed declarations (such as a confidentiality and non-disclosure agreement or ‘official secrets’ declaration).

3.15 Based on entity practices, prospective employees or contractors undergoing employment screening are:

1. granted employment;
2. granted employment subject to aftercare arrangements (such as periodic reporting relating to suitability concerns, or restrictions on duties or access); or
3. denied employment due to identified eligibility or suitability concerns.

3.16 The PSPF guidelines Agency personnel security responsibilities recommend entities assess the integrity and reliability of personnel by considering character traits and behaviours such as honesty, maturity, trustworthiness, loyalty, tolerance and resilience. Entities should also determine if personnel may be vulnerable to improper influence, by assessing potential conflicts of interest and membership of relevant issue motivated groups.

3.17 Statistics on employment screening processes undertaken by each entity during 2015–16 and 2016–17 and the outcomes of those screening process are in Table 3.2 (with the exception of DTA, which could only provide statistics from April 2017, due to inadequate records).

Table 3.2: Entity employment screening statistics, 2015–16 and 2016–17

Source: AGD, ARPANSA, ASIC and Home Affairs.

3.18 Only the three larger entities, AGD, ASIC and Home Affairs, had denied individuals access due to suitability concerns and used aftercare arrangements over this period. While these entities’ denial rates were low (less than one per cent), they were higher than AGSVA’s denial rates for Baseline clearances over the same period (0.01 per cent in 2015–16 and 0.04 per cent in 2016–17). In addition, these larger entities have shown a willingness to use aftercare arrangements in circumstances where they determined that suitability concerns could be mitigated. In contrast, AGSVA did not impose clearance maintenance requirements (or aftercare) for any of the 38,713 Baseline clearances it granted during 2015–16 and 2016–17 (see Chapter 2 for further discussion of AGSVA’s clearance denial rate and use of aftercare).

3.19 The ANAO assessed the extent to which: employment screening practices within selected entities complied with mandatory controls and recommended practices outlined in PSPF policy documents (see Table 3.3); and involved recommended screening checks (see Table 3.4).

Table 3.3: Entity employment screening practices^a

Note a: Practices in bold print are mandatory controls.

Note b: AGD used two screening packs over this period; each pack contained one declaration but not the other.

Source: ANAO analysis of entity documentation.

3.20 DTA was not fully compliant with the PSPF mandatory control (associated with PERSEC-1) that ‘Agencies are to record the results of the employment screening for successful applicants and any additional agency specific screening relating to each person’.⁴⁹ DTA should establish procedures for recording the results of its employment screening.

3.21 AGD, ARPANSA and DTA had not updated the consent forms in their employment screening packs to obtain informed consent from individuals to share personal information with other entities, including AGSVA (this relates to the PERSEC-8 requirement to share relevant information with AGSVA, discussed later in this chapter).

Table 3.4: Entity employment screening checks^a

Note a: ARPANSA and Home Affairs advised that, while these checks are not conducted as part of its employment screening process, they form a component of its standard recruitment process.

Source: ANAO analysis of entity documentation.

3.22 All entities met the minimum requirement to undertake an identity check. At the time of assessment, only ASIC conducted all of the checks recommended under Australian Standard 4811–2006: Employment Screening. ASIC and Home Affairs undertook additional checks, such as digital footprint and company directorship checks, due to their individual risk profiles.⁵⁰

3.23 In October 2016, in response to the Belcher Review recommendation to reduce duplication between employment screening and Baseline clearances, the Government agreed that entities that conduct employment screening to an equivalent standard could be accredited to issue Baseline clearances to their personnel. AGD is developing an accreditation process, which is expected to come into effect from mid-2018.

Identifying and recording clearance requirements

3.24 Under the PSPF, entities are required to maintain a register of positions requiring security clearances and assess clearance requirements before advertising a position, including recording a reason and reassessment date for the requirement. The ANAO examined whether selected entities met these requirements (see Table 3.5).

Table 3.5: Entity methods of identifying and recording clearance requirements

Note a: Practices in bold print are mandatory controls.

Note b: Home Affairs records the reasons for PV clearance requirements.

Source: ANAO analysis of entity documentation.

3.25 Four entities had a minimum security clearance requirement for all personnel. This was generally due to the entities’ ICT networks being rated at a ‘Protected’ level, which means personnel accessing their networks would have access to material at this classification level.

3.26 DTA was non-compliant with the PSPF mandatory control (associated with PERSEC-3) that ‘Agencies are to maintain a register of positions that require a clearance’.⁵¹ In its 2016–17 PSPF compliance report, DTA noted that it was developing a register for endorsement by its Chief Executive Officer. Other entities maintained registers of security clearance requirements.

3.27 AGD, ARPANSA, ASIC and Home Affairs required managers to specify clearance requirements on their recruitment forms, but they did not record a reason and reassessment date for clearance requirements. DTA did not have a recruitment form (approval to recruit was managed through an email exchange) and its internal procedures did not include an instruction for hiring managers to identify clearance requirements as part of the approval process.

Ensuring personnel accessing classified resources have security clearances

3.28 The ANAO obtained personnel records from selected entities’ human resources management information systems and analysed whether personnel engaged in positions that required security clearances, as at 11 September 2017, had active clearances with AGSVA. As entities and AGSVA did not consistently use a common identifier across their datasets, the ANAO developed a methodology to match entity personnel to an associated AGSVA clearance using basic biographical data (see Appendix 6 for an explanation of the methodology and its limitations).

3.29 ARPANSA operates an ‘Unclassified’ network, so not all of its personnel require a security clearance. The ANAO’s examination of ARPANSA’s records established that all ARPANSA personnel who required a clearance, as at 11 September 2017, had corresponding active clearance records in AGSVA’s database.

3.30 As noted in Table 3.5 above, AGD, ASIC, Home Affairs and DTA have minimum security clearance requirements for all personnel. Currently engaged personnel within these entities should have an active clearance recorded in AGSVA’s database. The results of the ANAO’s matching analysis for these entities are outlined in Table 3.6.

Table 3.6: ANAO matching of entity personnel records with AGSVA clearance records, as at 11 September 2017

Note a: See Appendix 6 for an explanation of the matching confidence levels.

Note b: ‘No match’ indicates that the ANAO could not identify a matching AGSVA clearance record.

Source: ANAO analysis of entity personnel records and AGSVA clearance data.

3.31 Entities advised the ANAO of explanations for these discrepancies in the matching of clearance records including:

• entities failing to promptly sponsor or re-sponsor a clearance when cleared personnel transferred between entities (meaning the clearance became inactive);
• personnel recorded on the human resources management information system who did not require a clearance or had an active clearance with an exempt agency;
• personnel having been granted clearances prior to the establishment of AGSVA that were still within their revalidation period but had not uploaded to AGSVA’s database;
• personnel not complying with AGSVA’s revalidation process and having their clearances cancelled without informing the security office;
• personnel not advising AGSVA of name changes (for example, due to marriage);
• entities’ personnel records were inaccurate (for example, an individual’s name or date of birth incorrectly recorded); and
• in one case, an employee was on long-term leave when an entity’s minimum clearance requirement changed and the need for a clearance was not identified on their return.

3.32 In the case of ASIC, its security office had formed an incorrect view that its internal employment screening process was sufficient to allow access to ‘Protected’ material. Of the 525 ASIC personnel in the ‘no match’ category, 464 were recorded in ASIC’s personnel database as having only undergone ASIC’s pre-employment screening. In August 2017, in its 2016–17 PSPF compliance report, ASIC advised its minister that:

The ASIC PeopleSoft database indicates 1527 ASIC employees and contractors hold a National Security Clearance of Baseline, Highly Protected, [NV1] or [NV2]. An additional 1008 ASIC employees and or contractors are shown as only holding an ASIC Pre-engagement Assessment … ASIC appears to have not previously submitted requests to the AGSVA for the granting of temporary or provisional access to classified information… Consequently, a limited number of ASIC employees or contractor may have access to the SharePoint document management system and documents classified as PROTECTED or have the opportunity to oversight printed material classified at PROTECTED or above.

3.33 ASIC now provides applicants with a letter advising that its assessment only allows access to unclassified information.

3.34 For AGD, Home Affairs and DTA, many personnel identified in the ‘no match’ category either held active security clearances (which could not be matched due to typographical errors with biographical data) or had previously held clearances that could be reinstated. Nevertheless, for each of these entities the ANAO’s analysis identified a small number of current personnel who required a security clearance but did not hold one.

3.35 AGD, ASIC, Home Affairs and DTA were consequently partially compliant with the PERSEC-4 requirement to ensure all personnel accessing classified resources have a security clearance at an appropriate level. ASIC was also partially compliant with the PERSEC-6 requirement to use AGSVA to conduct vetting, as in certain cases it had been providing permission to access classified material on the basis of its own internal employment screening.⁵²

3.36 The four partially compliant entities did not have adequate controls and quality assurance mechanisms for ensuring their personnel have appropriate clearances. At a minimum, entities should record clearance levels, revalidation dates and clearance subject identifiers for all personnel with an active security clearance, and regularly reconcile these records with AGSVA’s records of the clearances they actively sponsor.

Are entities identifying and appropriately mitigating business impacts resulting from security clearance requirements?

3.42 As discussed in Chapter 2, it can take several months (and in some cases years) for AGSVA to process a security clearance, depending on the level of clearance and complexity of the case. These timeframes can have a significant impact on entities’ business activities, due to potential delays in onboarding personnel.⁵³

3.43 Under the PSPF, there are two mechanisms that entities can use to mitigate business impacts resulting from clearance requirements:

• temporary access—which allows entities to provide personnel with access to classified material on a short-term (up to three months, prior to applying for a clearance) or provisional (for the duration of the clearance process) basis; and
• eligibility waivers—which allow entities to waive citizenship and checkable background requirements for security clearances where there is an exceptional business case.

3.44 For all temporary access and eligibility waivers, entities are required to conduct detailed risk assessments, gain approval from the accountable authority (or a delegate) and consult AGSVA.⁵⁴ Eligibility waivers must be reassessed annually. The ANAO examined whether selected entities met temporary access and eligibility waiver requirements; the results of this testing are in Table 3.7 and Table 3.8.

Table 3.7: Selected entities’ use of temporary access^a

Note a: Practices in bold print are mandatory controls.

Source: ANAO analysis of entity and AGSVA documentation.

3.45 Two entities, AGD and Home Affairs, that made regular use of temporary access during 2016–17 maintained registers of temporary access granted, had procedures in place to conduct risk assessments and consulted AGSVA on any potential security concerns. AGD and Home Affairs had delegation instruments in place and gained delegate approval for temporary access.

Table 3.8: Selected entities’ use of eligibility waivers^a

Note a: Practices in bold print are mandatory controls.

Note b: ASIC reported in 2016–17 that it had engaged 120 non-citizens without a security clearance or eligibility waiver in place.

Note c: DTA did not maintain adequate records of its eligibility waivers.

Source: ANAO analysis of entity and AGSVA documentation.

3.46 All entities had engaged personnel with security clearances subject to eligibility waivers during 2015–16 and 2016–17. However, Home Affairs was the only entity that was fully compliant with PSPF mandatory controls relating to eligibility waivers (associated with PERSEC-5).

• AGD, ARPANSA, ASIC and DTA could not provide evidence that they were compliant with of the mandatory control that ‘Agencies are to reassess eligibility waivers yearly’.⁵⁵
• Managers in DTA had approved eligibility waivers without a delegation from the accountable authority.
• ASIC advised in its 2016–17 PSPF compliance report that it had issued 120 ‘internal citizenship waivers’ to non-Australian citizens, some of whom had been given access to its ‘Protected’ network without an appropriate security clearance.

Do entities manage the ongoing suitability of personnel to access government resources?

3.51 Under the personnel security requirements of the PSPF, entities must establish and implement policies and procedures to assess and manage the ongoing employment suitability of their personnel (PERSEC-2) and for security clearance maintenance (PERSEC-7). Key measures identified in PSPF policy documents relating to these requirements include:

• provision of security awareness training to personnel;
• undertaking periodic suitability checks, based on entity-specific risk factors⁵⁶;
• requiring clearance holders to report changes in personal circumstances to the entity security office and AGSVA;
• requiring personnel to report suspicious, on-going, unusual or persistent contacts with foreign officials and other foreign nationals to the entity security office;
• conducting an annual ‘health check’ process for clearance holders and their managers.

Table 3.9: Entity arrangements for ongoing suitability and clearance maintenance^a

Note a: Practices in bold print are mandatory controls.

Source: ANAO analysis of entity documentation.

3.52 AGD, ARPANSA, ASIC and Home Affairs had developed security awareness eLearning packages, which were mandatory for all personnel and included adequate coverage of personnel security requirements. Home Affairs was the only entity that had implemented periodic suitability checks of its personnel based on its risk profile.

3.53 DTA was non-compliant with the PERSEC-2 requirement to implement ongoing suitability policies and procedures. At the time of conducting this audit, DTA had not established a security awareness training program; its security training consisted of an informal discussion with commencing personnel as part of their induction into the entity. DTA was also non-compliant with the PERSEC-7 requirement to establish and implement policies and procedures for security clearance maintenance. In implementing Recommendation no.5 (paragraph 3.9), DTA should address these areas of non-compliance.

3.54 The other four entities had policies and procedures on change of circumstances and contact reporting, which were available to their personnel on their intranet sites. However, all five entities were non-compliant with the annual health check requirement, outlined in the following PSPF mandatory control (associated with PERSEC-7):

Agencies are to annually require:

• clearance holders to confirm they have reported to their agency security section:
  • all changes of circumstances; and
  • any suspicious, on-going, unusual or persistent contacts;
• clearance holders to complete any required security awareness training; and
• managers responsible for personnel to confirm they have reported any concerns about the clearance holders.⁵⁷

Do entities share relevant information with AGSVA?

3.60 Under the personnel security requirements of the PSPF, entities and vetting agencies must share information that may impact on an individual’s ongoing suitability to hold a clearance (PERSEC-8) and entities must have policies and procedures to notify vetting agencies of clearance holder staff separations and any resulting security concerns (PERSEC-9).

Sharing information on ongoing suitability

3.61 Entity security offices are required to report any information on clearance holders of potential interest to AGSVA (such as travel to countries of concern, disciplinary actions, security breaches or concerns identified through screening). To support entity-initiated disclosure, the PSPF includes a mandatory control (associated with PERSEC-8) that:

Agencies are to obtain written consent from all clearance subjects (existing and potential) to share information with other agencies for the purposes of assessing their initial and ongoing suitability to access Australian Government resources.⁵⁸

3.62 As noted in paragraph 3.21, AGD, ARPANSA and DTA had not updated their employment screening consent forms to explicitly obtain informed consent to share personal information, including sensitive information, with other entities such as AGSVA. These entities were non-compliant with the mandatory control.

Advising AGSVA of clearance holder separations

3.63 Analysis of AGSVA’s clearance records and entity personnel records indicates that the number of active clearances sponsored by entities exceeds entities’ staffing profiles (see Table 3.10 below). While there are various factors that may contribute to this variance (such as entities sponsoring clearances for other parties, or data quality issues with entity personnel records), the large disparities suggest entities are not promptly notifying AGSVA of all personnel separations. This reduces the assurance available to these entities that their personnel are properly cleared. It also reduces the assurance available to AGSVA that its clearance records are complete and accurate.⁵⁹

Table 3.10: Comparison of entity personnel and clearance holder profiles, as at 11 September 2017

Note a: Includes all personnel types (non-ongoing staff, contractors and secondments); except for DTA who could not provide sufficient biographical data for contractors.

Source: ANAO analysis of entity personnel records and AGSVA clearance data.

3.64 AGD, ARPANSA, ASIC and Home Affairs had separation policies and procedures in place that included notifying the security office of separations and required separating personnel to complete a ‘Declaration of Secrecy on Cessation of Duties’ form. In late 2017, AGD automated these processes within its human resources management information system; whereas ARPANSA, ASIC and Home Affairs relied on separating personnel completing a cessation checklist. At the time of assessment, DTA did not have any formal separation policies and procedures in place, and was non-compliant with the PERSEC-9 mandatory requirement.

3.65 Despite four entities having procedures in place, the ANAO found 3917 personnel who had separated from selected entities during 2015–16 and 2016–17 and still had active clearances sponsored by those entities as at 11 September 2017 (see Table 3.11).

Table 3.11: Separated personnel from 2015–16 and 2016–17 with clearances still actively sponsored by selected entities as at 11 September 2017

Source: ANAO analysis of entity personnel records and AGSVA clearance data.

3.66 Entities informed the ANAO that for some of these individuals, they had taken steps to inform AGSVA of their separation, but not those required by AGSVA and, as a result, their sponsorship had not been withdrawn.⁶⁰ However, in all cases, there were individuals sponsored by entities that should have had their sponsorship withdrawn. All entities were thus partially compliant with the PSPF mandatory control (associated with PERSEC-9) that: ‘Agencies are to advise the vetting agency of separation of personnel’.⁶¹ This finding highlights weaknesses in entity assurance mechanisms relating to their clearance holder records.

3.67 While AGSVA has a role to play in ensuring that clearance holder records are accurate, entities have greater visibility as to which of their personnel are presently engaged and require a clearance. Entities implementing the quality assurance mechanisms outlined in Recommendation no.6 (paragraph 3.37) should help to address this issue.

Do entities effectively monitor and report on compliance with personnel security requirements?

3.68 The PSPF requires entities to complete an annual security assessment to determine their compliance with the mandatory requirements of the PSPF, and to report any non-compliance to their relevant portfolio minister, AGD and the Auditor-General by 31 August each year (GOV-7).⁶² The ANAO examined entity 2016–17 compliance reports and compared reported levels of compliance for PSPF personnel security requirements with the findings of this audit. The results of this analysis are at Table 3.12.

3.69 The ANAO employed the following assessment criteria:

• where entities met the mandatory requirement and all associated mandatory controls, they were rated as ‘fully compliant’;
• where entities were non-compliant with an associated mandatory control or the ANAO identified limited instances of non-compliance with mandatory requirements (indicating weaknesses in entity assurance mechanisms), they were rated as ‘partially compliant’; and
• where entities had not implemented measures to comply with a mandatory requirement, they were rated as ‘non-compliant’.⁶³

3.70 All entities informed the ANAO that they have taken, or are planning to take, actions to address areas of partial compliance or non-compliance identified through this audit.

3.71 As part of its current reforms to the PSPF, AGD is planning to move away from a compliance reporting model and instead require entities to report on their protective security maturity, with the aim of shifting the reporting focus to security outcomes and providing a more nuanced approach to assessing security matters. In designing the new model, AGD should ensure that meeting mandatory requirements of the framework remains a core expectation. It should also consider developing assurance mechanisms that minimise entities’ incentives to present an overly favourable interpretation of their maturity levels.

Table 3.12: Entity self-reported^a compliance ratings for personnel security and ANAO ratings of entity compliance, 2016–17

 

 

Note a: While in some cases entities reported ‘partial’ compliance, entity ratings in this table have been adjusted to conform to AGD’s classification options.

Source: Entity PSPF compliance reporting to their portfolio ministers and ANAO analysis of entity compliance.

Appendix 1 Entity responses

Attorney-General’s Department

 

 

 

 

 

 

Australian Radiation Protection and Nuclear Safety Authority

 

 

 

 

Australian Securities and Investments Commission

 

 

Australian Security Intelligence Organisation

 

 

 

 

Department of Defence

 

 

 

 

Department of Home Affairs

 

 

Digital Transformation Agency

 

 

Appendix 2 PSPF requirements related to personnel security

Source: AGD, ‘Mandatory requirements’, PSPF web page, available from: <https://www.protectivesecurity.gov.au/ overarching-guidance/Pages/Mandatory-requirements.aspx> [accessed 10 August 2017].

Appendix 3 Minimum personnel security checks and requirements for initial clearances

 

 

Source: AGD, Personnel security guidelines—vetting practices, version 1.3, June 2016, p. 20.

Appendix 4 AGSVA’s clearance timeframes

Figure A.1: Distribution of Baseline clearance timeframes, 2016–17

 

 

Source: ANAO analysis of AGSVA clearance data.

Figure A.2: Distribution of NV1 clearance timeframes, 2016–17

 

 

Source: ANAO analysis of AGSVA clearance data.

Figure A.3: Distribution of NV2 clearance timeframes, 2016–17

 

 

Source: ANAO analysis of AGSVA clearance data.

Figure A.4: Distribution of PV clearance timeframes, 2016–17

 

 

Source: ANAO analysis of AGSVA clearance data.

Appendix 5 Assessment criteria for personnel security governance

1. For the qualitative assessment in Table 3.1 of the report, entities were assessed against the criteria and considerations outlined in Table A.1. These criteria and considerations were developed based on mandatory controls (in bold in Table A.1) and recommended actions outlined in PSPF policy documents, with a focus on governance components of the PSPF that intersect with personnel security.

Table A.1: Criteria and considerations for assessing entity security plans, policies, procedures and risk assessments

Note a: Considerations in bold print are mandatory controls.

Source: ANAO.

Appendix 6 Methodology for matching AGSVA clearance holder data and entity personnel data

1. Entities and AGSVA do not consistently use a common identifier that could be used to match entity staff with their AGSVA clearance file. AGSVA makes use of a Clearance Subject Identifier (CSID), which is not consistently recorded by entities. Entities typically use AGS numbers to identify staff (which is not consistently recorded by AGSVA) and other identifiers for external personnel (such as contractors).

2. In order to determine the extent to which entity personnel held clearances with AGSVA, the ANAO developed a methodology to reconcile entities personnel records with AGSVA’s clearance records, using the basic biographical data shared between the two. Due to data inconsistencies, potential matches are assigned a confidence on the basis shown in Table A.2 below.

Table A.2: ANAO methodology for matching entity staff to AGSVA clearances

Source: ANAO.