The e-QIP shutdown: Another big headache
OPM's decision to shutdown the e-QIP tool central to the clearance process has broad implications for government and industry that won't be resolved until OPM and OMB can clarify the full scope of the problem.
Even as the administration works to address the two OPM data breaches affecting upwards of 18 million current and former federal, contractor and military personnel, we now face the potentially broad implications of the measures OPM has taken to hold off another breach. Namely, the suspension of the e-QIP system.
Due to the breadth of the initial breaches, OPM and OMB are correctly focused on conducting the requisite forensic analyses and providing affected individuals with credit monitoring and insurance to help limit any damage they might experience. Unfortunately, we are still awaiting information from OPM as to who was actually impacted and who, beyond the initial 4 million who were identified, will be given mitigation support by the government.
However, the shutdown of e-QIP, a critical web-based tool that is central to the clearance process, may actually have more immediate and far reaching impacts on both agencies and contractors.
The e-QIP suspension is not driven by an actual breach but instead by the discovery of a vulnerability that OPM has said could lead to a breach. In this case, the issue is therefore NOT what support the government is going to provide to individuals but, rather, how the government can and will mitigate the impacts of an effective shutdown of the security clearance process.
After all, government agencies and contractors could face significant challenges and disruptions as they try to meet their mission and contract requirements while the process is in stasis.
Although there is talk that the government might make liberal use of authorities to grant temporary clearances while the e-QIP situation is addressed, that too comes with its own set of limitations. Only a few federal entities currently have the authority to grant clearances, so expanding that universe will require specific action.
Additionally, given recent history, it is unclear how many government officials are going to be willing to be “the one” who grants a temporary clearance out of fear that the cleared individual might not have otherwise qualified. After all, Washington is known for its short memory and tendency to bayonet the wounded.
For companies, the question becomes what they can do on either the earlier breach or the e-QIP suspension. For the former, some companies have decided to not wait for the government and are already providing employees with credit monitoring and insurance. But since we don’t yet know who was impacted, that approach, generous as it is, only goes so far.
Moreover, it is fair to ask whether the companies should have to foot that bill to begin with, since on the surface, it certainly appears that the government is the principally responsible party.
With regard to e-QIP, the options are fewer. These are relatively uncharted waters. The number one priority is to identify cases in which the suspension could impact a company’s ability to perform under a contract and to immediately notify and consult with the cognizant contracting officials. This is particularly true for fixed price or time-definite contracts, since some kind of modification to the contract may eventually be needed and it’s always best to get everyone on the same page at the earliest possible time.
Both the breach and the e-QIP suspension are big deals. But they are not cataclysmic. Forensic analyses will help identify the causes and, where appropriate, the culprits.
Appropriate support can and must be given quickly to those impacted so any effects can be minimized. Beyond that it is essential that in the analyses now being done, we carefully separate things that fall clearly into the “what were you thinking (or not)?” box and those that reflect the continually evolving nature of the cyber threat and were thus less likely to be anticipated.
In other words, our collective job is to respond appropriately and translate the lessons we learn into actions that will help prevent additional similar events.
And little of that can begin until OPM and OMB clarify the full scope of the intrusion, exfiltration of information, and how and where the government will lead the way.