OMB Approves FBI ICR for Emergency Background Check

Tuesday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the Justice Department’s information collection request (ICR) for an FBI form for an emergency background check for immediate and limited access to classified material. The new form will be used to conduct a limited background investigation when the FBI determines that there is an immediate need to provide an individual in the private sector with access to classified national defense information.

Information Collection Request

The initial 60-day ICR notice published in April indicated that this would be an emergency ICR request with a requested approval date of May 15^th. Apparently, something changed and the emergency nature of the ICR was not evident when the 30-day ICR notice was published in July.

The FBI opted for this new form because the standard form used for background investigation requests (the now infamous SF 86) takes too long to complete and the resulting investigation takes at least 120 days to complete. The FBI estimates that it will only take 5 minutes to complete the new form.

There is nothing in any of the documentation associated with this ICR that mentions how long it will take the FBI to complete the background checks associated with the ICR. There is nothing unusual about that since this process is all about the burden placed on the public by the information collection process.

Burden Discrepancy

There are some burden discrepancies in the submission process. The table below summarizes the burden estimates in the various documents involved. The ’60-day’ and ’30-day’ refer to the ICR notices published in the Federal Register. ‘Statement refers to the Supporting Statement [.DOC download] provided to OIRA. ‘Approved’ refers to the burden published in yesterday’s announcement.

	60-day	30-day	Statement	Approved
Responses	500		1000	500
Time (min)	10		5
Burden (hrs)	83	83	23	23

By my calculations the Statement burden should have been 83 hours (1000 x 5 / 60 = 83.3) and the Approved burden should have been 42 hours (500 x 5 / 60 = 41.7). For 23 hrs to have been the correct burden it would have only been for 276 responses (@ 5 min/response) or for a response time of either 1.4 minutes (@ 1000 responses) or 2.8 minutes (@ 500 responses).

Commentary

As cybersecurity information sharing becomes more widespread from the government to the private sector the issue of security clearances for private sector individuals will become more and more important. This ICR was just for information sharing by the FBI. As more agencies begin to face the need to push classified information to the private sector about attack vulnerabilities they are also going to be faced with the same problem that caused the FBI to initiate this ICR; the current background check process is just too cumbersome and time consuming for a fast moving cybersecurity situation.

It might have been better if this ICR had been written for all agencies to use the FBI form. It would seem to me that the FBI would be the agency to actually do the quick background checks needed for this type of clearance process. This would, however, cause something of a bureaucratic problem for the agency; how to estimate the number of expected responses across the government.

Unfortunately §4.2(b) of Executive Order 13526 provides each agency with the authority to determine how to provide emergency access to classified information. While certainly (and legitimately) expediting the emergency access process, it means that each agency will end up coming up with their own version of FB 1116 which will necessitate its own ICR submission and review process.

A little more thoughtful process could have been designed where each agency could establish their own procedure that included some minimal requirements for documentation including the collection and reporting of information similar to what we see in FB 1116.