Tuesday the OMB’s Office of Information and Regulatory
Affairs (OIRA) announced
that it had approved the Justice Department’s information collection request
(ICR) for an FBI form for an emergency background check for immediate and
limited access to classified material. The new
form will be used to conduct a limited background investigation when the
FBI determines that there is an immediate need to provide an individual in the
private sector with access to classified national defense information.
Information Collection
Request
The initial 60-day ICR
notice published in April indicated that this would be an emergency ICR
request with a requested approval date of May 15th. Apparently,
something changed and the emergency nature of the ICR was not evident when the 30-day ICR
notice was published in July.
The FBI opted for this new form because the standard form
used for background investigation requests (the now infamous SF 86) takes too
long to complete and the resulting investigation takes at least 120 days to
complete. The FBI estimates that it will only take 5 minutes to complete the
new form.
There is nothing in any of the documentation associated with
this ICR that mentions how long it will take the FBI to complete the background
checks associated with the ICR. There is nothing unusual about that since this
process is all about the burden placed on the public by the information
collection process.
Burden Discrepancy
There are some burden discrepancies in the submission process.
The table below summarizes the burden estimates in the various documents
involved. The ’60-day’ and ’30-day’ refer to the ICR notices published in the
Federal Register. ‘Statement refers to the Supporting
Statement [.DOC download] provided to OIRA. ‘Approved’ refers to the burden
published in yesterday’s announcement.
|
|
60-day
|
30-day
|
Statement
|
Approved
|
|
Responses
|
500
|
|
1000
|
500
|
|
Time (min)
|
10
|
|
5
|
|
|
Burden (hrs)
|
83
|
83
|
23
|
23
|
By my calculations the Statement burden should have been 83
hours (1000 x 5 / 60 = 83.3) and the Approved burden should have been 42 hours
(500 x 5 / 60 = 41.7). For 23 hrs to have been the correct burden it would have
only been for 276 responses (@ 5 min/response) or for a response time of either
1.4 minutes (@ 1000 responses) or 2.8 minutes (@ 500 responses).
Commentary
As cybersecurity information sharing becomes more widespread
from the government to the private sector the issue of security clearances for
private sector individuals will become more and more important. This ICR was just
for information sharing by the FBI. As more agencies begin to face the need to
push classified information to the private sector about attack vulnerabilities
they are also going to be faced with the same problem that caused the FBI to
initiate this ICR; the current background check process is just too cumbersome
and time consuming for a fast moving cybersecurity situation.
It might have been better if this ICR had been written for
all agencies to use the FBI form. It would seem to me that the FBI would be the
agency to actually do the quick background checks needed for this type of
clearance process. This would, however, cause something of a bureaucratic
problem for the agency; how to estimate the number of expected responses across
the government.
Unfortunately §4.2(b)
of Executive
Order 13526 provides each agency with the authority to determine how to
provide emergency access to classified information. While certainly (and
legitimately) expediting the emergency access process, it means that each
agency will end up coming up with their own version of FB 1116 which will
necessitate its own ICR submission and review process.
A little more thoughtful process could have been designed
where each agency could establish their own procedure that included some
minimal requirements for documentation including the collection and reporting
of information similar to what we see in FB 1116.
Posts
