Do cleaners really need security clearances?

Analysts, investigators, anything with intelligence in the title – these are all jobs for which candidates might expect to fill out lengthy forms about themselves and their pasts. But does this story about cleaners at a major regulator help explain why the security-clearance system is so strained?

It starts with a reported spike in the number of non-citizens and those without fully checked backgrounds granted clearances. The agencies involved explained this by blaming mostly reporting errors.

A recent government report showed just one agency was responsible for most of the increase in clearances given to non-Australians in 2016-17. A different agency was responsible for most of an even-larger increase in the number of clearances given to people whose pasts (going back at least 12 months) could not be verified by vetting.

The agencies weren't named in the report, nor would the Attorney-General's Department name them when The Canberra Times asked. However, an answer to a Senate estimates question revealed the latter agency was the Defence Department.

Defence mistakenly reported the total number of its employees who had been granted waivers in order to get a security clearance, instead of the number of waivers granted that year. So that explained that sudden increase.

The other agency, which was responsible for the high number of non-citizens granted clearances, was the Australian Securities and Investments Commission.

ASIC had also reported its total number of waivers, instead of new waivers granted that year. So, again, there was not a significant increase over one year.

Asked why the agency had a high number of non-Australian employees with clearances, ASIC gave two reasons: IT specialists and cleaners.

In IT, international specialist expertise was needed and 11 new specialists were recruited that year who required waivers for their clearances to be approved.

"A number of complex IT projects were under way that required unique skills sets. Almost all applications used by ASIC are propriety products developed in the international space and require personnel with lengthy experience in their operation," an ASIC spokeswoman said.

The other explanation, covering most non-citizens given security clearances, was that they were cleaners.

"ASIC granted waivers to a number of cleaners, maintenance people, et cetera [who] did not have access to our systems or classified information. That approach has since been reviewed and changed," she said.

ASIC confirmed it had 120 eligibility waivers in place for non-Australian citizens in 2016-17, with only 17 of those relating to staff. The other 103 related to contractors and other contingent workers.

"It should be noted that many of the waiver holders did not have access to the ASIC IT network or external agency information as such did not require a security clearance," the spokeswoman said.

It may seem unreasonable that cleaners and maintenance contractors need clearances provided by the Australian Government Security Vetting Agency. But, in recent years, the number of clearances processed by the agency has increased markedly, with many agencies requiring more and more people to have their backgrounds checked.

Since reporting the information to the Attorney-General's Department, ASIC was one of several agencies subject to an Auditor-General's investigation of how it managed its security clearances. While that report found ASIC had plans, policies and procedures in place for personnel security, it also found it didn't have adequate controls and quality-assurance mechanisms for ensuring personnel have appropriate clearances.

It also found ASIC hadn't properly complied with the protective security policy framework on eligibility waivers, and the regulator agreed to several audit recommendations, including to update its policies. It wasn't the only agency to receive such criticisms.

Cleaners and maintenance staff who don't need to access IT systems no longer require security clearances, but the ASIC spokeswoman said "they do, however, undergo probity checks commensurate to the type of access they require".

So, should cleaners and maintenance staff in government agencies have security clearances? ASIC once thought so, but now does not.

Perhaps this is the start of turning the demand around the other way on security clearances, with agencies considering just what are the necessary steps to make sure staff are properly vetted before stepping foot in the building.