Tech Firms Seek Washington’s Prized Asset: Top-Secret Clearances

https://www.bloomberg.com/news/articles/2017-10-23/tech-firms-seek-washington-s-prized-asset-top-secret-clearances

by SREinSF • 9 years ago

48 44 9 years ago

walshemj2• 9 years ago

Article is wrong if you had clearance you don't get to transfer it if you move to a civilian job is my understanding.

So is there an equivalent to List X companies in the USA who are allowed put staff through clearance.

And for TS clearance I doubt that any dual national other than those because of birth circumstances will be getting clearance any time soon which sucks for SV company employees who are immigrants

riot5044• 9 years ago

Why would the US give a Top Secret clearance to an immigrant?

edit - You can't immigrate to a country then expect to receive a Top Secret clearance regardless if it is the US or any other country. I don't suspect Russia will give me a clearance if I were to immigrate and find employment at a tech company. There would be a major national security incident waiting to happen.

Mz5• 9 years ago

https://www.state.gov/m/ds/clearances/c10977.htm#2

2. Do you have to be a U.S. citizen to receive a security clearance from the State Department?

As outlined in Executive Order 12968, Access to Classified Information, eligibility for access to classified information may only be granted to employees who are United States citizens. However, an exception is allowed in specific situations wherein there are compelling reasons for limited access to be granted to an immigrant alien or foreign national employee who possess a special expertise that is needed for specific programs, projects, contracts, licenses, certificates, or grants.

ajdlinux• 9 years ago

As an Australian who lives in our national capital, I can assure you that our friendly local FVEY agency will happily employ Australian citizens at a Top Secret Positive Vetting level who are naturalised immigrants or dual citizens (a huge chunk of this country are dual British citizens, in particular). I get the impression that it makes your life a bit more difficult, but it's definitely achievable.

bandrami• 9 years ago

I know literally hundreds of immigrants (meaning naturalized citizens) with TS/SCI clearance. Did you mean to say "non-citizen"?

notfromhere2• 9 years ago

If you're a naturalized citizen, you can get a clearance. Just be prepared to have a lot of rocks turned over

CalChris2• 9 years ago

You are mistaken. Security clearances go with the person and not the job. Indeed, there’s an entire industry available to people with the correct clearance. Yeah, there's paperwork to do when you move to a new job.

https://www.state.gov/m/ds/clearances/c10977.htm#9

https://www.clearancejobs.com/

For example, Edward Snowden had a clearance and worked for a private company, Booz Allen after first working for the NSA as a security guard then the CIA.

walshemj2• 9 years ago

That not how I read it you can transfer it to another federal job and a restricted set of civilian jobs It requires:

"an industrial or commercial contractor, licensee, certificate holder, or grantee of an agency, including all subcontractors; a personal services contractor; or any other category of person who acts for or on behalf of an agency as determined by the appropriate agency head."

itronitron• 9 years ago

Security clearance does not stay with the person once they leave the job unless their new employer is (or is sponsored by) the same granting agency (i.e. DOD or DOE) and even then there is paperwork involved to set up the transfer.

username223• 9 years ago

Indeed, there’s an entire industry available to people with the correct clearance.

Indeed, one of my biggest career mistakes was not taking a job that would have included a Q clearance back before 9/11, when they were handed out much more quickly and freely.

eradicatethots2• 9 years ago

The first link you have makes it sound like clearance does not transfer, unless I’m reading it wrong

gervase• 9 years ago

My understanding is that they actually exclude ALL dual nationals, even those whose citizenships were the result of birth circumstances, unless you are willing to formally renounce your second citizenship.

113245• 9 years ago

Not true, you can hold a clearance and stay a dual citizen.

notfromhere2• 9 years ago

Depends on what country. If you're a dual citizen with China/Russia/hostile power, you'll probably be forced to renounce or be denied a clearance. Folks from allied countries (NATO) often don't have to renounce it; I believe they ask if you'd be willing to, but you don't have to do it unless they ask

clearthrowaway• 9 years ago

Ok, a bunch of confusion in this thread...

A clearance is held by a specific agency. Say I work for contractor company C, on a contract with three-letter agency TLA. TLA grants me a clearance at whatever level, and they keep track of it. If I switch jobs to another position that requires a clearance -- maybe I go to company D, maybe I stay at C but on a contract for four-letter agency FLA [1] -- then TLA can transfer the clearance to the new agency FLA, and now FLA is the holder. Depending on the specifics of TLA and FLA, this can be "quick" (in government time), or in the worst cases it will take just as long as getting a clearance from scratch.

If I go to company D, but the new position does not require a clearance, then it becomes inactive. I can say I previously had a clearance, and if not much time has passed then getting it reactivated (if I go to a third job that needs it again) may be a relatively quick process. But if I am not at a job that is keeping it active, then I have no right to access classified data or anything.

In other words, if Facebook is hiring cleared people, they have to be working with a government agency that is holding the clearances.

On the other topic: obviously you have to be a US citizen. Immigrants/naturalized citizens are fine; I've known many cleared immigrants. Dual-citizenship I'm not sure about, you might have to renounce your old citizenship.

[1] This is an NGA joke. NGA: because the intelligence is silent. https://en.wikipedia.org/wiki/National_Geospatial-Intelligen...

nimbius• 9 years ago

This article makes the asinine inference that hiring a ts worker somehow magically grants you access to ts data. Sf86 makes it perfectly clear: you can be tried for treason up to and including capital punishment for leaking state secrets at the ts level. The information is on a need to know basis and requires the company be certified by disa, NSA, and cleared to have a compartmentalized government facility that includes an FSO and yearly dod inspections. The government also chooses you for classified work and sensitive data. Not the other way around.

metaphor5• 9 years ago

The average annual salary for a systems engineer working for the U.S. government with a security clearance is about $119,000...

In other words, the average USG systems engineer is roughly a GS-14 Step 6 based on 2017 Rest-of-US locality...GTFO with this garbage.

trdtaylor1• 9 years ago

Most with that high of clearance are working in the DC area, one of the highest locality pay in the country

metaphor5• 9 years ago

For USG systems engineers, clearance level has zero impact on compensation; you either have it or you don't.

Most with that high of clearance are working in the DC area...

For a systems engineer based on 2017 DC locality, that's lead-/supervisory-level GS-14 Step 3, or working-level GS-13 at the tail end of a long career in government...hardly an average.

angry_octet4• 9 years ago

It does seem high. I don't know where they get this info, because these are all contractors, so the only info the govt has is how much it pays the labor hire company (e.g. Booz). There are no govt public service employees on a special 'cyber' pay grade. But a special IT stream would make sense - like doctors and lawyers. Otherwise the skills haemorrhage will continue.

mcguire• 9 years ago

Note that many of the systems engineers are not working directly for the government.

metaphor5• 9 years ago

To be sure, the article states, working for the U.S. government, not working for a private company contracted by the U.S. government.

If the latter, then US$120k as a mean sounds about right, anecdotally based on friends who work in that part of industry.

jlgaddis• 9 years ago

The article uses the Russia election situation as an example, but one doesn't need a clearance -- or any classified information, for that matter -- in order to prevent a large number of these recent "hacks" or, at the least, make the attackers work much harder to be successful.

When companies can't even be bothered to install security updates on public-facing applications or web sites (cf. Equifax), is anyone really surprised that they're being broken into and having all their private data stolen?

In my experience, these public/private information sharing "partnerships" are heavily weighted in the government's favor. That is, the private companies share their detailed, specific data with the government but the information that the government shares with the private companies is laughable. When I was on the "receiving end", it was typically bulletins and notifications that were vague and lacked enough detail to actually be useful or actionable (and even those were limited with regard to distribution).

It's been a few years since I was involved with that stuff so perhaps things have changed. I would be really surprised if they have, though.

In addition, it seems to me that this is a good way for the government to get these tech companies to "go along with" some of their "requests". Oh, you have some private data that the government would like to have access to but you don't want to turn it over? Or, the government has a "black box" they want you to install in your network but you don't want to? Boy, it sure would be a shame if your employees' security clearances got denied, wouldn't it?

nataz3• 9 years ago

In order to conduct an appropriate vulnerability assessment, you need to be able to classify your adversaries capabilities and motivations. That's hard to do with out some kind of privileged information. Only then can you get down to the stuff that most people think of when they talk about "security" - e.g. the risk mitigation and countermeasures.

Edit - added text

To continue the point, the Russia example is important. Individual commercial ventures are not set up to handle state level attacks. Any company that thinks they are is going to be in for a rude awakening.

Worse, companies like Google and Facebook are going to be vulnerable by their very design and function.

Sure, the credit bureau hacks are bad, but truthfully that's only the tip of the iceberg as far as consequences.

I'm not discounting your point that you may have found government cooperation unhelpful, but I will say if you are one of these large companies that could be the target of a state level actor, you are going to want a state level actor on your side. And in the US that means you are going to have to have employees with access, which means you are going to need to have a government sponsor for clearances.

throwaway225• 9 years ago

For those in this thread that are confused what the tech companies could be looking for with these cleared people, let me give you an example. I used to work for a company that ran DNS services for public utilities i.e. "critical infrastructure". Every week we would get a classified list of "bad" domains (usually domains that malware would phone home to) from a 3 letter agency and we would notify the utilities if we saw any DNS requests for those domains from any of their computers. Only cleared personnel were allowed to see the list or touch any of the computers that saw the list in any way.

A tech company that wanted to work with a 3 letter agency to see such a list in order to protect their own infrastructure would need cleared personnel and a SCIF (the windowless air-gapped rooms that cleared people work from) to even talk to the agency about a list.

_vdpp• 9 years ago

I think the article created a lot of the confusion. Having access to cleared people is important to companies primarily for winning lucrative government contracts. For example, if a 3 letter agency wants to implement a cloud service on an air-gapped intranet, or award a contract to implement social-media algorithms to suss out terrorist networks, they'll look to companies with that sort of expertise. But if those companies don't have a corps of cleared employees, they're out of the running. Having said that, having trustworthy employees (which a clearance implies, but does not guarantee) might be valuable to companies not dealing with classified information, but the article left out the real reason that companies are heavily invested in recruiting people with clearances.

Tech Firms Seek Washington’s Prized Asset: Top-Secret Clearances

Related Stories