Inspection of the FBI's Security Risk Assessment Program
for Individuals Requesting Access to Biological Agents and Toxins
E&I Report No. I-2005-003
Office of the Inspector General
BRAG had a large number of pending SRA applications in late 2003, but reduced the number significantly during the first six months of 2004.10 In November 2003, BRAG had 3,855 pending SRA applications, which included a backlog of 628 SRA applications that had been pending for more than 45 days.11 BRAG’s large caseload of pending SRA applications was caused by processing issues that were resolved between November 2003 and June 2004. By June 2004, BRAG had reduced its number of pending SRA applications from 3,855 to 401 and eliminated its SRA application backlog. Since June 2004, BRAG has maintained a stable monthly caseload of approximately 339 pending SRA applications, which it is processing routinely in 45 days or less.12
The interim federal regulations CDC and APHIS issued in December 2002 to implement the Bioterrorism Act established a six-month phase-in period to allow laboratories and individuals time to achieve full compliance with the new regulations for possessing, using, and transferring select agents and toxins, including obtaining SRAs. The phase-in period was designed to minimize the disruption that the regulations might cause for research and educational projects involving select agents and toxins that were under way.
The phase-in period for processing SRA applications ran from April 11, 2003, to November 12, 2003. All SRA applications were due to BRAG on April 11, 2003, and BRAG started processing SRA applications on April 14, 2003. The regulations gave laboratories and individuals until November 12, 2003, to achieve full compliance with the law, including obtaining SRAs for all of their employees who needed access. After November 12, 2003, individuals not in full compliance with the SRA requirements would not be eligible for access to special agents and toxins until they met the requirements.
BRAG officials said that during the six-month phase-in period, they:
Because of these problems BRAG accrued a large number of SRA cases for which it could not make final determinations of eligibility. As discussed below, these problems were addressed either by BRAG or through the joint actions of BRAG, CDC, APHIS, and the officials and individuals applying for access to select agents and toxins.
BRAG Received Only 11 Percent of All Applications by the April 11, 2003, Deadline. Although the regulations required that all applications were due to BRAG by April 11, 2003, BRAG received 89 percent of the applications after that date. As shown in Table 1, on April 11 BRAG had received only 1,108 (11 percent) of the 9,720 applications that it would eventually receive by the November 12, 2003, regulatory deadline for completing all SRAs.
Source: Bioterrorism Workload Statistics - Internal, BRAG.
BRAG Received Several Thousand Incomplete SRA Applications. During the six-month phase-in period, BRAG received a large number of SRA applications for which it could not make a final eligibility determination because of missing data or illegible fingerprint cards. A complete SRA application package includes: 1) a completed FBI Form FD-961 that contains basic information, such as name and address; and 2) two legible fingerprint cards. As stated previously, BRAG received 9,720 SRA applications during the phase-in period, between April 11 and November 12, 2003. A total of 3,948 (41 percent) of those applications were missing data such as an FBI Form FD 961 or the required two fingerprint cards. Sometimes an application included an FBI Form FD-961 that was missing information or the prints on the fingerprint cards were not legible. In these cases, BRAG officials said that they could not complete the SRAs until they received the missing data, which sometimes took months.
The volume of incomplete applications received during the phase-in period also made it appear that BRAG had a large backlog of SRA cases and that it was not processing SRA applications in a timely manner. In fact, BRAG employees could not begin to conduct an SRA until the applicant submitted complete information. BRAG officials said that they sent thousands of letters to laboratory officials requesting the missing information prior to the November 12, 2003, deadline, but did not receive all of the data in time to complete the SRAs by the deadline.
BRAG Processing Capacity Was Significantly Reduced by a Change in Staffing. In April 2003, the FBI temporarily assigned employees to start SRAs while it began selecting a permanent staff for BRAG. However, BRAG’s ability to meet the regulatory deadline of November 12, 2003, was significantly hampered by a staffing change that occurred at the end of October 2003.
Before October 31, 2003, the FBI had staffed BRAG with 18 temporary personnel security specialists from the CJIS Division’s National Instant Criminal Background Check System. On October 31, 2003, the FBI replaced BRAG’s temporary staff with a permanent staff of nine employees that included one unit manager, one supervisor, and seven personnel security specialists. As a result of the staffing change, BRAG’s capability for conducting SRAs dropped from approximately 1,200 to 500 per month just prior to BRAG’s November 12, 2003, deadline for completing all SRAs. The drop in capacity resulted from the reduction in the number of staff as well as the transition from an experienced to an inexperienced staff that required training.
BRAG’s Need to Obtain Pertinent Information from External Sources Increased Processing Times. BRAG officials said that they had trouble obtaining some of the information they needed to determine the access eligibility of individuals with criminal histories and mental health issues. According to BRAG, it can take from two weeks to six months to obtain all the information it needs to make a determination of eligibility for access on one SRA application. BRAG’s processing times can be significantly affected by: 1) the availability of automated state and local criminal history records, 2) difficulty obtaining mental health histories, and 3) BRAG’s reliance on other agencies to conduct certain database searches.
For example, BRAG often needs to acquire copies of court records of dispositions in criminal cases to make its eligibility determinations. BRAG also must verify references to state and local court records, many of which are not automated and, therefore, only accessible through manual research.13 Consequently, BRAG has to obtain copies of court documents and this process can extend the time it takes to conduct an SRA by several months.
In addition, processing times can increase when BRAG has to obtain mental health histories. SRA applicants indicate on Form FD-961 whether they have ever been adjudicated as a mental defective or committed to a mental institution. If an applicant answers "yes," BRAG employees must conduct research to determine whether the individual was voluntarily or involuntarily committed to a mental institution. According to BRAG officials, this research is time consuming, and some institutions are reluctant to share this information.
BRAG also depends on other agencies to complete portions of the SRA database searches. To obtain visa information on alien resident and work status, BRAG downloads applicant information from its Bioterrorism Database and supplies it to the Department of Homeland Security’s Immigration and Customs Enforcement agency. BRAG also provides applicant information to the FBI’s Foreign Terrorist Tracking Task Force to determine whether the applicant is a known terrorist. At times, these agencies are not able to search their databases based on the information BRAG provides. When that happens, BRAG must contact the applicant directly to request additional information, such as birth certificates or alien registration numbers. BRAG employees said complexities such as these can add weeks or months to the SRA application processing time.
Chart 2 shows that BRAG accrued a large caseload of SRA applications during the phase-in period, with pending applications peaking in August 2003 at 5,809. BRAG had reduced its caseload to 3,855 by November 12, 2003.
BRAG employees said that they kept CDC and APHIS officials fully informed of their processing issues and the need for CDC and APHIS to encourage laboratory owners and responsible officials to submit the data missing from SRA applications before the deadline. BRAG officials said they also informed CDC and APHIS that – because of BRAG’s heavy caseload and processing times that averaged 45 days – even if all missing SRA application data were submitted immediately, the outstanding applications could not be processed by the November 12, 2003, deadline. On November 3, 2003, CDC and APHIS amended federal regulations, in part, to provide more time for BRAG to complete the pending SRA applications that it accrued during the phase-in period.
CDC and APHIS Amended Interim Final Rules to Allow Grants of Provisional Access. On November 3, 2003, CDC and APHIS officials amended the interim final rules on select agents and toxins. The amendments allowed CDC and APHIS to provide provisional grants of access to individuals who had submitted complete application packages to BRAG and met all other federal requirements by November 12, 2003, but who had not yet obtained an SRA. The amendments did not extend the deadline for complying with SRA requirements, but they did allow for the continued operation of laboratory facilities vital to the public interest. At the same time, the amendments emphasized the need for applicants to provide missing application data. The amendments also gave BRAG more time to finalize individual SRAs for individuals who had submitted all of the required information by the deadline.
As of the November 12, 2003, deadline, BRAG had received 9,720 individual applications. Of those, 61 percent (5,865) had been finalized by the issuance of an eligibility determination (5,265) or by the cancellation of an SRA request by an applicant or responsible official (600). This left 3,855 pending applications. Of that number, BRAG had received 2,947 applications that included all necessary data and 908 applications that were missing data or legible fingerprint cards. Because the 908 individuals with incomplete applications had missed the deadline for submitting all required information, they were not eligible for access and, by regulation, could not work with select agents and toxins.
On November 13, 2003, BRAG reported that it expected to be able to complete 500 SRAs each month and therefore would process the remaining 3,855 pending applications in seven months, or by June 2004. Chart 3 shows the progress that BRAG made in reducing the number of pending applications. BRAG reduced the number of pending SRA applications to 401 as of June 2004 and has since maintained a relatively stable average monthly caseload of 339 pending SRA applications.
BRAG Significantly Reduced Its Pending Caseload. Table 2 shows that BRAG had received a total of 13,287 SRA applications and conducted 12,982 SRAs as of December 2004. From November 12, 2003, to December 31, 2004, BRAG reduced its pending SRA application caseload from 3,855 to 305 SRA applications and its incomplete SRA applications from 908 to 40.
Our review found that BRAG has effective management controls that have resulted in the timely identification and correction of several program vulnerabilities. BRAG monitors its processing capabilities and productivity using its Bioterrorism Database. In addition, BRAG has established an appeals process that, so far, has resulted in BRAG overturning 6 of its 20 "restricted persons" designations. The CJIS Division participates in an interagency working group, which includes HHS, USDA, the Department of Defense (DOD), Customs and Border Protection, and other organizations, to resolve interagency issues affecting the SRA Program. Since the Bioterrorism Act was implemented, the SRA process has provided a reasonably quick minimum standard (usually 45 days or less) for security checks on all persons seeking access to select agents.
Since its creation in April 2003, BRAG has:
As discussed below, BRAG’s accomplishments are, in part, a product of strong management controls that have led to the early identification and timely correction of program vulnerabilities.
BRAG Closely Monitors the SRA Process and Caseload. BRAG monitors its processing capabilities in an effort to maintain a high level of employee productivity. Among other control measures, BRAG has instituted several productivity measures and goals, and routinely monitors its progress toward meeting those goals. For example, BRAG established a 45-day goal for finalizing SRA applications, and supervisors closely monitor the time that individual requests remain in the database before a final eligibility determination is made.
While BRAG still occasionally receives SRA applications that are missing required information or contain illegible fingerprint cards, those applications are now clearly identified in the Bioterrorism Database. Consequently, those applications no longer appear as part of the backlog of cases pending more than 45 days as they did during the phase-in period.
BRAG has also improved the SRA process by revising the instructions on the FBI’s Form FD-961. Since August 25, 2004, the instructions on Form FD 961 instruct applicants to send their applications directly to the CJIS Division instead of to CDC or APHIS as previously instructed. BRAG reported that this revision has helped to reduce processing times.
Of the total 12,982 SRAs it completed by December 2004, BRAG:
As shown in Table 3, most ineligible applicants had been designated "restricted persons" because of felony convictions (54) or an illegal or unlawful alien status (7). Some of the 72 designations were based on more than one criterion. Twenty of the 72 appealed BRAG’s eligibility restrictions.
BRAG Established an Appeals Process. BRAG established an appeals process that, as of January 2005, had addressed 20 appeals of individual "restricted person" designations. BRAG sustained 14 of the 20 appeals and overturned 6 to grant the appellant eligibility for "unrestricted" access. BRAG does not limit the number of times that an individual can appeal a restriction. In at least one case, BRAG overturned a restriction that it had previously sustained on appeal.
SRA applicants with past felony convictions can successfully appeal a "restricted" designation by getting the appropriate state or local government to expunge their criminal record from local, state, and national databases and other data repositories. Generally, the burden of proof in an appeal rests with the appellant.
If CDC or APHIS officials disagree with a BRAG employee’s eligibility determination, they also can initiate an appeal. This provision of the appeals process, which has never been used, would work for an agency as it does for an individual applicant – the burden of proof would rest with the agency appealing BRAG’s determination.
The CJIS Division Resolves Interagency Issues Through the Select Biological Agents and Toxins Working Group. The CJIS Division routinely participates in a working group that includes representatives from CDC, APHIS, DOD, Customs and Border Protection, and other organizations to resolve interagency issues. This group, called the Select Biological Agents and Toxins Working Group (Working Group), was established by the Bioterrorism Act to consider policy issues and render policy decisions related to security, regulations, and preparing for and preventing bioterrorism and other public health emergencies.
For example, the Working Group considered a request made by the Deputy Under Secretary of Defense for Counterintelligence and Security to the CJIS Division seeking to exempt DOD military and civilian personnel and contractors from SRA requirements. In October 2003, the Deputy Under Secretary wrote to the CJIS Division of her concern that 400 DOD employees would not be able to obtain an SRA by the regulatory deadline. She stated that the SRA process was similar enough to background investigations DOD conducted before granting access to classified information that the SRAs were redundant for individuals already possessing security clearances. Therefore, she wrote, "we take the position that those 400 individuals should be exempt from the risk assessment requirement by virtue of their having been granted security clearances based on favorably adjudicated background investigations."
The CJIS Division, as part of the Working Group, denied DOD’s request for exemptions, citing a legal determination that the Bioterrorism Act does not allow such exemptions even for individuals with security clearances.
Because of the issues DOD raised at the Working Group and other concerns expressed during our inspection regarding the possible redundancy of SRA background investigations for individuals with security clearances, we compared the scope of the SRA background investigation with that of other types of background investigations. We found that the SRA background investigation includes searches of databases that are not searched routinely during other types of background investigations, including those conducted for national security clearances. We also found that the SRA process provides a clear standard for conducting background investigations to determine eligibility for access to select agents and toxins.
The Bioterrorism Act allows for several exemptions from the SRA requirements. For example, if a laboratory is owned by a local, state, or federal agency, the head of the agency that "owns" the facility is exempt from the requirement of obtaining an SRA (42 C.F.R. 73.8(a)). Also, an owner of an accredited academic institution is not required to obtain an SRA. However, all responsible officials, alternate responsible officials, and individuals with access to select agents and toxins are required to obtain an SRA, regardless of whether they work for a government agency or an accredited academic institution. In addition, the Bioterrorism Act does not exempt federal employees who have a national security clearance from obtaining an SRA.
While the types of background investigations conducted to determine eligibility for access to Top Secret national security information and for a public trust position in the federal government include reviews of some of the same information sources as an SRA, there are differences. All three types of investigations include, for instance, a national agency check, which consists of a review of the:
The Minimum Background Investigation (MBI) required for a public trust position includes a national agency check, plus written inquiries and credit record searches, a face-to-face personal interview between the investigator and the subject, and telephone inquiries to selected employers. The Single Scope Background Investigation (SSBI) required for access to Top Secret information is a governmentwide investigation that covers the past seven years of an individual’s activities. It includes verification of citizenship and date and place of birth, as well as national records checks on the individual’s spouse or cohabitant, and interviews with selected references and former spouses.
In contrast, BRAG employees conducting an SRA search databases that contain information to determine whether the applicant meets any 1 of the 11 criteria that would result in a restriction from access to select agents and toxins. Not all of these databases are searched routinely as part of an MBI or SSBI. For example, BRAG routinely searches the Foreign Terrorist Tracking Task Force database for information to determine whether an applicant is a known terrorist or has associated with known terrorists. This database is not searched as part of an MBI or SSBI. BRAG also searches the Immigration and Customs Enforcement database for information on whether an applicant has been determined to be an illegal or unlawful alien.
Table 4 on the next page lists other databases routinely searched for SRA investigations – but not for MBI or SSBI investigations – such as the FBI Indices via the Automated Case Support system, which contains FBI Headquarters’ classified databases; the Department of Veterans Affairs’ database for mental health information; and the Department of State’s Terrorist Watch List and Consular Consolidated Database Indices. According to BRAG officials, BRAG is continuing to refine the SRA process and expand its electronic searches as new databases emerge, especially those that containing counterterrorism information.
Before passage of the Bioterrorism Act, less than half the nation’s laboratories conducted background checks on employees with access to select agents and toxins, and the practice of conducting background checks varied greatly among the different types of laboratories. For instance, while approximately 80 percent of the laboratories owned by research institutes and commercial facilities conducted background checks on their employees with access to select agents and toxins, less than 20 percent of state and university laboratories conducted such checks.
When background investigations were conducted by laboratories, they usually included a basic criminal background check, but not all of the other elements of an SRA background investigation. Since the Bioterrorism Act was implemented, the SRA process has provided a reasonably quick minimum standard (usually 45 days or less) for security checks on all persons seeking access to select agents. The SRA process also contributes to the creation of a database that contains the names of all persons who are using or have used select agents, which agents they have used, and where they are working.