Social Media Monitoring in the Security Clearance Process
By Lindy Kyzer
6:00 AM ET
https://www.govexec.com/workforce/2022/12/social-media-monitoring-security-clearance-process/381024/
Social media monitoring used to be the elephant in the room when it came
to the continuous vetting of employees working for the federal
government. Security Executive Agent Directive 5 was signed in May 2016,
paving the way for cyber vetting of cleared professionals. The policy
came as the government was looking to advance its efforts to prevent
insider threats following the 2013 “year of the insider,”
when Aaron Alexis killed 12 people in a mass shooting at the
Washington Navy Yard, and Edward Snowden conducted a massive data
breach, revealing thousands of highly classified government documents.
Addressing insider threats became paramount, and the government
considered how its security vetting process could help identify red
flags before they became security risks. Enter SEAD 5 and cyber
vetting: another tool in the government’s insider threat arsenal.
The policy was just that – a policy, not a procedure. In the years
since, many security clearance applicants have been left wondering what
– if anything – the government is considering in an online search of
security clearance applicants. SEAD 5 created a framework for federal
agencies to use as they implemented their own social media monitoring
programs. And in many agencies the policy still hasn’t extended beyond
pilots and possibilities.
“There is one time, one case, where we found it as a part of the
adjudicative process where security officials on their own motion issued
a denial of a clearance on the basis of social media monitoring,”
said Sean Bigley, a security clearance attorney with the law firm Bigley
Ranish.
That’s not to say social media couldn’t come up in the course of a
background investigation, but in cases thus far, the social media aspect
has generally been surfaced by human means versus mass monitoring –
social posts get reported, and then disseminated to leadership, for
instance.
What Could the Government Consider as a Part of the Cyber Vetting
Process?
As those enrolled in the government’s continuous vetting program
(which is 100% of all security clearance holders today) know – you
shouldn’t expect a postcard from the government notifying you that
you’ve been enrolled. With the same possibility around social media
monitoring (while the government may not be widely doing it, individual
agencies are, and more could in the future), what should security
clearance holders be aware of?
First, it’s worth noting that the government’s definition of social
media is broad – the cyber vetting possibilities may not be endless,
but as the government considers the topic the term “publicly available
information” is a better way to consider the websites that may be
looked at, including:
- Social networks (Facebook, LinkedIn)
- Microblogging websites (Twitter)
- Blogging and Forums (WordPress, Tumbler)
- Picture and Video Sharing (Flickr and YouTube)
- Music Sharing (Spotify)
- Online Commerce Websites (eBay)
- Dating websites (Match.com)
- Geosocial network websites (TripAdvisor)
- News and media websites where people can comment
Security clearance holders should know that comments made publicly can
be used against them in the security clearance process. The best step to
take to ensure information doesn’t come back to bite is to keep your
accounts locked down and private. The policy is clear that clearance
holders will not be asked to share information like passwords. If you
keep your accounts appropriately protected, you help keep your personal
identity – and clearance eligibility – safe.
“The takeaway that I have from a legal perspective for that is
to make yourself private,” advises Bigley. “That’s not to say
everyone who makes their account private is trying to hide something,
but if you don’t want the government prying on certain aspects of your
private life -- I think that is understandable for most of us.”
--
Iw mailing list
[email protected]
http://sticklist.org/mailman/listinfo/iw_sticklist.org
