Security clearance

Government classified information is governed by the Treasury Board Standard on Security Screening, the Security of Information Act and Privacy Act. Only those that are deemed to be loyal and reliable, and have been cleared are allowed to access sensitive information. The policy was most recently revised on 20 October 2014.[2]

Checks include basic demographic and fingerprint based criminal record checks for all levels, and, depending on an individual appointment's requirements, credit checks, loyalty, and field checks might be conducted by the RCMP and/or CSIS.

Clearance is granted, depending on types of appointment, by individual Federal government departments or agencies or by private company security officers. Those who have contracts with Public Works and Government Services Canada are bound by the Industrial Security Program, a sub-set of the GSP.

To access designated information, one must have at least standard reliability status (see Hierarchy below). Reliability checks and assessments are conditions of employment under the Public Service Employment Act, and, thus, all Government of Canada employees have at least reliability status screening completed prior to their appointment.[3] However, Government employees by Order-in-council are not subjected to this policy.[4]

Clearances at the reliability status and secret levels are valid for 10 years, whereas top secret is valid for 5 years. However, departments are free to request their employees to undergo security screening any time for cause.[5] Because security clearances are granted by individual departments instead of one central government agency, clearances are inactivated at the end of appointment or when an individual transfers out of the department. The individual concerned can then apply to reactivate and transfer the security clearance to his/her new position.[3]

Three levels of personnel screening exist, with two sub-screening categories:[5][6]

Standard screenings are completed for individuals without law enforcement, security and intelligence functions with the government, whereas Enhanced screenings are for individuals with law enforcement, security and intelligence functions, or access to those data or facilities.

Individuals who need to have RS because of their job or access to federal government assets will be required to sign the Personnel Screening, Consent and Authorization Form (TBS/SCT 330-23e).

• Reliability Status, Standard (RS)
  • Reliability checks are done by verifying personal data, criminal records check, credit check, educational, and professional qualifications, data on previous employment and references.
  • This level of clearance will grant the right to access designated documents with markings of Protected A & B information/assets on a need-to-know basis. It is mandatory for individuals when the duties or tasks of a position or contract necessitate access to protected information and assets, regardless of the duration of an assignment.
• Reliability Status, Enhanced (ERS)
  • In addition to the Reliability Status, Standard checks, open-source checks, and security questionnaire or interview are required.
  • This level of clearance will grant the right to access designated documents with markings of Protected A, B & C information/assets on a need-to-know basis.

Individuals who require access to more sensitive information (or access to sensitive federal government sites and/or assets) because of their job will be required to sign the Security Clearance Form (TBS/SCT 330-60e). There are two levels of clearance:

• Secret
  • Secret clearance is only granted after a reliability status is cleared, with a positive CSIS security assessment.
  • This level of clearance will grant the right to access designated and classified information up to Secret level on a need-to-know basis. Department Heads have the discretion to allow for an individual to access Top Secret-level information without higher-level clearance on a case-to-case basis.
  • Only those with a Secret clearance, with enhanced screening have access to Protected C information.
• Top Secret
  • In addition to the checks at the Secret level, foreign travels, assets, and character references must be given. Field check will also be conducted prior to granting the clearance.
  • This level of clearance will grant the right to access all designated and classified information on a need-to-know basis.
• Top Secret Special Access
  • In addition to the checks at the Top Secret level, 20 years of past history are investigated in person by CSIS.[7]
  • This level of clearance will grant the right to access all designated and classified information on a need-to-know basis, primarily for intelligence roles[8] in the Communications Security Establishment,[9] Canadian Armed Forces,[10] and certain senior government officials.[11]

Two additional categories called "Site Access Status" and "Site Access Clearance" exist not for access to information purposes but for those that require physical access to sites or facilities designated by CSIS as areas "reasonably be expected to be targeted by those who engage in activities constituting threats to the security of Canada". Designated areas include Government Houses, official residences of government officials, Parliament, nuclear facilities, airport restricted areas, maritime ports, and any large-scale events that are sponsored by the federal government (e.g., 2010 Winter Olympics).[12]

Where reliability is the primary concern, a site access status screening (similar to a reliability status, standard screening) is conducted; where loyalty to Canada is the primary concern, a site access clearance (similar to a Secret clearance screening) is required. They are both valid for 10 years.

Prior to granting access to information, an individual who has been cleared must sign a Security Screening Certificate and Briefing Form (TBS/SCT 330–47), indicating their willingness to be bound by several Acts of Parliament during and after their appointment finishes. Anyone who has been given a security clearance and releases designated/classified information without legal authority is in breach of trust under section 18(2) of the Security of Information Act with a punishment up to 2 years in jail. Those who have access to Special Operational Information are held to a higher standard. The release of such information is punishable by law, under section 17(2) of the Security of Information Act, liable to imprisonment for life.[13]

Section 750(3) of the Criminal Code, states that no person convicted of an offence under section 121 (frauds on the Government), section 124 (selling or purchasing office), section 380 (Fraud - if directed against His Majesty) or section 418 (selling defective stores to His Majesty), has, after that conviction, the capacity to contract with His Majesty or to receive any benefits under a contract between His Majesty and any other person or to hold office under His Majesty unless a pardon has been granted. (This effectively prohibits granting of a Reliability Status to any such individual.)[14]

National Security Clearances are a hierarchy of levels, depending on the classification of materials that can be accessed—Baseline Personnel Security Standard (BPSS), Counter-Terrorist Check (CTC), Enhanced Baseline Standard (EBS), Security Check (SC), enhanced Security Check (eSC), Developed Vetting (DV), enhanced Developed Vetting (eDV), and STRAP.

The BPSS is the entry-level National Security Clearance, and both CTC and EBS are effectively enhancements to the BPSS, with CTC relating to checking for susceptibility to extremist persuasion, and EBS relating to checking for susceptibility to espionage persuasion, the latter being needed for supervised access to SECRET material. The SC again is focused on susceptibility to espionage persuasion, and is required for an individual to have long-term unsupervised access to SECRET material and occasional access to TOP SECRET (TS) material, whilst for regular access to TS the DV, eDV is required. Occasionally STRAP is required with DV.

Those with National Security Clearance are commonly required to sign a statement to the effect that they agree to abide by the restrictions of the Official Secrets Act (OSA). This is popularly referred to as "signing the Official Secrets Act". Signing this has no effect on which actions are legal, as the act is a law, not a contract, and individuals are bound by it whether or not they have signed it. Signing it is intended more as a reminder to the person that they are under such obligations. To this end, it is common to sign this statement both before and after a period of employment that involves access to secrets.

After the United States entered into World War II, Britain changed its security classifications to match those of the U.S.. Previously, classifications had included the top classification "Most Secret", but it soon became apparent that the United States did not fully understand the UK's classifications, and classified information appeared in the U.S.'s press. This spearheaded the uniformity in classification between the United Kingdom and the United States. The terminology and levels of British security classifications have also changed from Positive Vetting and Enhanced Positive Vetting to SC, eSC, DV, eDV and STRAP.

In addition to National Security Clearances, other types of roles and organisations stipulate a need for clearances, including:

• Vulnerable Group Access (including children), as operated by the Disclosure and Barring Service (DBS), replacing former Criminal Records Bureau (CRB) and Independent Safeguarding Authority (ISA) checks
• Law Enforcement, with a hierarchy of Police Personnel Vetting (PPV) and Non-Police Personnel Vetting (NPPV) levels.

For people that require a security clearance to get access to classified information, an in-depth background investigation is conducted primarily by the Defense Counterintelligence and Security Agency, and the recipient signs a nondisclosure agreement.[16][17][18]

As of 2017, certain government officials (but not their staff) are granted access to classified information needed to do their jobs without a background check: members of the U.S. Senate and House of Representatives for committee work, federal judges and state supreme court judges for adjudicating cases, and state governors. Attorneys representing clients in cases with classified materials require a background check, but there is a reduced-scrutiny procedure for time-sensitive access.[19] This ex officio access can be revoked.[20]

Pending a full security clearance an applicant may be granted a temporary security clearance of indefinite duration, which gives the applicant access to classified information while the original application is being vetted.[21][22]

Access to any particular piece of information requires "need-to-know."[23] In some cases, this requirement is only nominal, as some classified information is widely published on secure networks. In other cases, there is a formal need-to-know determination. In addition to such a determination, Special Access Programs and Sensitive Compartmented Information may require additional investigation and adjudication of the prospective clearance holder.

As of 2020, the cost of obtaining a Top Secret clearance is $5,596 while a Secret is $433.[24] These costs are paid for by revolving government funds and not by contractor companies.[25][26][27]

The authority for classifying information and granting security clearances to access that information is found in executive orders (EOs) and US Federal law. The United States' National Security Information (NSI) has been classified under Executive Order 13526,[28] but since 10 January 2017 the rules were modified by James Clapper as Security Executive Agent Directive 4[29] in the closing days of the Obama administration.[30] Information may be classified under this Order if a classification authority determines its unauthorized release could cause damage to the national defense or foreign relations of the United States. Information concerning nuclear weapons and fissile material may be classified under the Atomic Energy Act of 1954 (AEA). These clearances are only granted by the US Department of Energy. The clearance process for access to NSI or AEA information is substantially aligned. Under Executive Order 12968,[31] the investigative and adjudicative guidelines for NSI and AEA clearances are identical. This enables reciprocity between NSI and AEA clearances, although some exceptions exist.

The United States' Executive Order 12968's standards are binding on all of the United States government agencies that handle classified information, but it allows certain agency heads to establish Special Access Programs (SAPs) with additional, but not duplicative, investigative and adjudicative requirements. The Intelligence Community's Sensitive Compartmented Information (SCI) control systems are a family of SAPs, and SCI eligibility must be granted prior to accessing any particular control system or compartment (which may require additional investigation or adjudication). SCI eligibility policy is described in Intelligence Community Directive 704 [32] and its implementing policy guidance Within the Intelligence Community, the access to SCI information is far more common than "Collateral Top Secret information," and therefore operatives will routinely include SCI in a TS product, just to ensure they do not have to meet the "cradle-to-grave" accountability requirements of Collateral TS information. Any additional clearance measures used by SAPs must be approved by the Office of Management and Budget, which has generally limited such measures to polygraphs, exclusion of persons with non-US immediate family members, requiring more frequent reinvestigations, and requiring annual updates to security questionnaires.[33]

A security clearance is granted to an individual and generally recognizes a maximum level of clearance. Exceptions include levels above compartmentalized access or when an individual is cleared for a certain type of data. The President of the United States will be given access to any government or military information that they request, even if they would not otherwise be able to normally obtain a security clearance were they not the President. Having obtained a certain level security clearance does not mean that one automatically has access to or is given access to information cleared for that clearance level in the absence of a demonstrated "need to know".[34] The need-to-know determination is made by a disclosure officer, who may work in the office of origin of the information. The specified need to know must be germane to the prospective user's mission, or of necessity for the integrity of a specified security apparatus.

Controlled Unclassified does not represent a clearance designation, but rather a clearance level at which information distribution is controlled. Controlled Unclassified designates information that may be illegal to distribute. This information is available when needed by government employees, such as United States Department of Defense (DoD) employees, but the designation signifies that the information should not be redistributed to users not designated to use it on an operational basis. For example, the organization and processes of an information-technology system may be designated Controlled Unclassified to users for whom the operational details of the system are non-critical.

Despite common misconception, this designation is not a security clearance, and is not the same as the confidential designation. Certain positions which require access to sensitive information, but not information which is classified, must obtain this designation through a background check. In the US, Public Trust Positions can either be moderate-risk or high-risk.[35][36]

This is hierarchically the first security clearance to get, typically requiring a few weeks to a few months of investigation. A Confidential clearance requires a NACLC investigation which dates back 7 years on the subject's record and must be renewed (with another investigation) every 15 years.

A Secret clearance, also known as Collateral Secret or Ordinary Secret, requires a few months to a year to investigate, depending on the individual's background. Some instances wherein individuals would take longer than normal to be investigated are many past residences, having residences in foreign countries, having relatives outside the United States, or significant ties with non-US citizens. Unpaid bills as well as criminal charges will more than likely disqualify an applicant for approval. However, a bankruptcy will be evaluated on a case-by-case basis and is not an automatic disqualifier. Poor financial history is the number-one cause of rejection, and foreign activities and criminal record are also common causes for disqualification. A Secret clearance requires a NACLC, and a Credit investigation; it must also be re-investigated every 10 years.[37] Investigative requirements for DoD clearances, which apply to most civilian contractor situations, are contained in the Personnel Security Program issuance known as DoD Regulation 5200.2-R, at part C3.4.2.

Top Secret is a more stringent clearance. A Top Secret, or "TS", clearance, is often given as the result of a Single Scope Background Investigation, or SSBI. Top Secret clearances, in general, afford one access to data that affects national security, counterterrorism/counterintelligence, or other highly sensitive data. There are far fewer individuals with TS clearances than Secret clearances.[38] A TS clearance can take as few as 3 to 6 months to obtain, but often it takes 6 to 18 months. In most instances, an individual with Top Secret clearance undergoes an SSBI Period Reinvestigation (SSBI-PR) every five years.[39][37]

As with TS clearances, Sensitive Compartmented Information (SCI) clearances are assigned only after one has been through the rigors of a Single Scope Background Investigation and a special adjudication process for evaluating the investigation. SCI access, however, is assigned only in "compartments". These compartments are necessarily separated from each other with respect to organization, so that an individual with access to one compartment will not necessarily have access to another. Each compartment may include its own additional special requirements and clearance process. An individual may be granted access to, or read into, a compartment for any period of time.

Top secret clearance might be required to access:

• Communications intelligence, a subset of SIGINT
• Design or stockpile information about nuclear weapons
• Nuclear targeting

Such compartmentalized clearances may be expressed as "John has a TS/SCI", whereby all clearance descriptors are spelled out verbally. For example, the US National Security Agency once used specialized terms such as "Umbra",[40][41][42] This classification is reported to be a compartment within the "Special Intelligence" compartment of SCI.[43] The various NSA compartments have been simplified; all but the most sensitive compartments are marked "CCO", meaning "handle through COMINT channels only".

The US Department of Defense establishes, separately from intelligence compartments, special access programs (SAP) when the vulnerability of specific information is considered exceptional and the normal criteria for determining eligibility for access applicable to information classified at the same level are not deemed sufficient to protect the information from unauthorized disclosure. The number of people cleared for access to such programs is typically kept low. Information about stealth technology, for example, often requires such access.

Area-specific clearances include:

• L clearance (Department of Energy)
• Q clearance (Department of Energy)
• Yankee White (working with the President and Vice President)

There are two different types of jobs that require clearance: public trust and low-risk positions, which require a Standard Form 85 application, and a positions with access to classified information, which require a Standard Form 86 application.[44]

Anyone with access to classified data requires a clearance at or higher than the level at which the data is classified. For this reason, security clearances are required for a wide range of jobs, from senior management to janitorial. According to a 2013 Washington Post article, over 1.5 million Americans had top-secret clearances; almost one-third of them worked for private companies, rather than for the U.S. government.[45][46]

Jobs that require a security clearance can be found either as positions working directly for the federal government or as authorized federal contractors. Over time, more clearance jobs are being outsourced to contractors.[47] Due to an overall shortage in security-cleared candidates and a long time frame to obtain the credentials for an uncleared worker, those with clearance are often paid more than their non-cleared equivalent counterparts.[48][49][50] According to one 2010 estimate, "people with security clearances are in the top 10 percent of wage earners in the country".[51]

The vetting process for a security clearance is usually undertaken only when someone is hired or transferred into a position that requires access to classified information. The Defense Counterintelligence and Security Agency is the primary security agency [52] that conducts background investigations for the Federal Government, conducting 95% of all background investigations for over 100 agencies and conducting approximately 2 million background investigations each year.

The employee is typically fingerprinted and asked to provide information about themselves. This becomes a starting point for an investigation into the candidate's suitability. The process has been streamlined and now requires the person who needs clearance to input the information online using E-qip; five days are allowed for data input. Having the older paper form can be helpful for collecting and organizing the information in advance. The information on an investigation and its status is stored in either JPAS or Scattered Castles.

Investigative work is usually at least one of the following types:

• National Agency Check with Local Agency Check and Credit Check (NACLC). An NACLC is required for a Secret, L, and CONFIDENTIAL access. (See: Background check)
• Single Scope Background Investigation (SSBI). An SSBI is required for Top Secret, Q, and SCI access, and involves agents contacting employers, coworkers and other individuals. Standard elements include checks of employment; education; organization affiliations; local agencies; where the subject has lived, worked, or gone to school; and interviews with persons who know the individual. The investigation may include an NACLC on the candidate's spouse or cohabitant and any immediate family members who are U.S. citizens other than by birth or who are not U.S. citizens.
• Polygraph. Some agencies may require polygraph examinations. The most common examinations are Counter Intelligence (CI) and Full-Scope (Lifestyle) polygraphs. While a positive SSBI is sufficient for access to SCI-level information, polygraphs are routinely administered for "staff-like" access to particular agencies.

If issues of concern surface during any phase of security processing, coverage is expanded to resolve those issues. At lower levels, interim clearances may be issued to individuals who are presently under investigation, but who have passed some preliminary, automatic process. Such automatic processes include things such as credit checks, felony checks, and so on. An interim clearance may be denied (although the final clearance may still be granted) for having a large amount of debt,[53] having a foreign spouse, for having admitted to seeing a doctor for a mental health condition, or for having admitted to other items of security concern (such as a criminal record or a history of drug use.). When security concerns arise for an individual, which could bar them from holding a security clearance, adjudicators may also look at the Whole-Person Concept as a source of potential mitigation so that the person may still be granted a security clearance.[54]

The high-level clearance process can be lengthy, sometimes taking a year or more. In recent years, there has been an increased backlog of cases which has been attributed to the economic climate. The long time needed for new appointees to be cleared has been cited as hindering the presidential transition process.

In the US, once the clearance is granted, the candidate is briefed on "the proper safeguarding of classified information and on the criminal, civil, and administrative sanctions that may be imposed on an individual who fails to protect classified information from unauthorized disclosure." They are also required to sign an approved non-disclosure agreement (e.g., form SF-312). High-level clearances are reviewed periodically and any "adverse information" reports received at any time can trigger a review. When a cleared person leaves their job, they are often "debriefed"—reminded of their ongoing obligations to protect the information they were allowed to see, and the possible consequences should they fail to uphold those obligations. According to NISPOM Chapter 3, newly cleared employees are required to receive an initial security briefing before having access to classified information. This training helps them understand the threat, risks to classified information, how to protect the classified information, security procedures and duties as they apply to their job. This training is followed up by refresher training that reinforces the initial security briefing.

Dual citizenship is associated with two categories of security concerns: foreign influence and foreign preference. Dual citizenship in itself is not the major problem in obtaining or retaining security clearance in the United States. If a security clearance applicant's dual citizenship is "based solely on parents' citizenship or birth in a foreign country", that can be a mitigating condition.[55] However, exercising (taking advantage of the entitlements of) a non-U.S. citizenship can cause problems. For example, possession and/or use of a foreign passport is a condition disqualifying from security clearance and "is not mitigated by reasons of personal convenience, safety, requirements of foreign law, or the identity of the foreign country" as is explicitly clarified in a Department of Defense policy memorandum which defines a guideline requiring that "any clearance be denied or revoked unless the applicant surrenders the foreign passport or obtains official permission for its use from the appropriate agency of the United States Government".[56] This guideline has been followed in administrative rulings by the Department of Defense (DoD) Defense Office of Hearings and Appeals (DOHA) office of Industrial Security Clearance Review (ISCR), which decides cases involving security clearances for Contractor personnel doing classified work for all DoD components. In one such case, an administrative judge ruled that it is not clearly consistent with U.S. national interest to grant a request for a security clearance to an applicant who was a dual national of the United States and Ireland.[57] DOHA can rule on issues involving the granting of security clearances.[58]

• Standard on Security Screening

German language official files

• UK MOD's Defence Vetting Agency

• (DoD) Factors Used for Determining Security Clearance Approval/Disapproval Archived 2 December 2006 at the Wayback Machine
• Defense Office of Hearings and Appeals decisions
• Security Clearance FAQs Archived 29 March 2004 at the Wayback Machine
• How to get clearance
• DoD Intelligence & Security Documents, directives and Instructions
• DoD Security Clearances and Contracts Guidebook-What You Need to Know About Your Need to Know
• Federal Suitability Security Clearance Chart
• Defense Office of Hearings and Appeals (DOHA) Experiencing Immense Backlog of Cases, Highlighting Need for Thorough and Effective Preparation of Clearance Applications

• United Nations Department of Safety and Security

• Vetting and the Security Sector, published by DCAF