Stan Soloway


The e-QIP shutdown: Another big headache

Even as the administration works to address the two OPM data breaches affecting upwards of 18 million current and former federal, contractor and military personnel, we now face the potentially broad implications of the measures OPM has taken to hold off another breach. Namely, the suspension of the e-QIP system.

Due to the breadth of the initial breaches, OPM and OMB are correctly focused on conducting the requisite forensic analyses and providing affected individuals with credit monitoring and insurance to help limit any damage they might experience. Unfortunately, we are still awaiting information from OPM as to who was actually impacted and who, beyond the initial 4 million who were identified, will be given mitigation support by the government.

However, the shutdown of e-QIP, a critical web-based tool that is central to the clearance process, may actually have more immediate and far reaching impacts on both agencies and contractors.

The e-QIP suspension is not driven by an actual breach but instead by the discovery of a vulnerability that OPM has said could lead to a breach. In this case, the issue is therefore NOT what support the government is going to provide to individuals but, rather, how the government can and will mitigate the impacts of an effective shutdown of the security clearance process.

After all, government agencies and contractors could face significant challenges and disruptions as they try to meet their mission and contract requirements while the process is in stasis.

Although there is talk that the government might make liberal use of authorities to grant temporary clearances while the e-QIP situation is addressed, that too comes with its own set of limitations. Only a few federal entities currently have the authority to grant clearances, so expanding that universe will require specific action.

Additionally, given recent history, it is unclear how many government officials are going to be willing to be “the one” who grants a temporary clearance out of fear that the cleared individual might not have otherwise qualified. After all, Washington is known for its short memory and tendency to bayonet the wounded.

For companies, the question becomes what they can do on either the earlier breach or the e-QIP suspension. For the former, some companies have decided to not wait for the government and are already providing employees with credit monitoring and insurance. But since we don’t yet know who was impacted, that approach, generous as it is, only goes so far.

Moreover, it is fair to ask whether the companies should have to foot that bill to begin with, since on the surface, it certainly appears that the government is the principally responsible party.

With regard to e-QIP, the options are fewer. These are relatively uncharted waters. The number one priority is to identify cases in which the suspension could impact a company’s ability to perform under a contract and to immediately notify and consult with the cognizant contracting officials. This is particularly true for fixed price or time-definite contracts, since some kind of modification to the contract may eventually be needed and it’s always best to get everyone on the same page at the earliest possible time.

Both the breach and the e-QIP suspension are big deals. But they are not cataclysmic. Forensic analyses will help identify the causes and, where appropriate, the culprits.

Appropriate support can and must be given quickly to those impacted so any effects can be minimized. Beyond that it is essential that in the analyses now being done, we carefully separate things that fall clearly into the “what were you thinking (or not)?” box and those that reflect the continually evolving nature of the cyber threat and were thus less likely to be anticipated.

In other words, our collective job is to respond appropriately and translate the lessons we learn into actions that will help prevent additional similar events.

And little of that can begin until OPM and OMB clarify the full scope of the intrusion, exfiltration of information, and how and where the government will lead the way.

Reader Comments

Tue, Jul 14, 2015

Mike McConnell, former DNI, DIRNSA, and BoozeAllen vice chair used to say quite often that for all but top clearances, it would be enough for someone to have a drivers license, no criminal record, and a credit report without something damning on it. In other words, the whole SF86 drill and field background investigations were not needed. He also was well aware that most espionage that succeeded against the US was done by USG civilian employees and military members who had high clearances. His views should be considered once again. For top clearances, i.e., the ones that require one or both poly's, his view was that level of rigor and examination of background details were necessary--but processed more efficiently and smartly than today's lumbering bureaucrats and contractors do it. Just say'in.

Mon, Jul 6, 2015 Mel Ostrow

Well argued, Stan, but with one short proviso: OPM has been hamstrung for years by the quality of its Contractor Support. The multifaceted decline and demise of USIS is a Red Flag signaling what happens when parties of questionable trustworthiness as compliant and skilled managers of an industrial-scale process are left to their own devices. Yes, the government is the ultimate responsible party and did a lousy job of selecting and overseeing performance. Yes, the government did little to preclude the USIS hacking event or clean up after it. Yes the government neglected to look into performance and see that the company was not fully performing checks in line with contract requirements. But the company was the purported leader in its field. Its method of ownership and the quality of stewardship of its P.E. owners cannot be allowed to go unexamined--after the thoroughly incapable and unaccountable political appointees and senior careerists are dealt with through discipline and prosecution, as necessary. Ms. Archuleta's performance in front of Congress in the last two hearings was a travesty and a big blot on the notion of a thinking, capable civil service, supported by responsible contractors.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above.

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here

Washington Technology Daily

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.


contracts DB