Alarm as top-level security vetting is outsourced to private contractors
Advertisement

Alarm as top-level security vetting is outsourced to private contractors

Highly sensitive personal information used in the security vetting of top government officials is being transported by commercial couriers and held by private contractors with patchy cyber security, sparking concerns about the risks of large-scale outsourcing of a system intended to safeguard national secrets.

The Australian Government Security Vetting Agency's processing of security clearances for officials has for years been plagued by delays, with the agency groaning under the weight of increased demand and a backlog of cases. The average wait time for the highest clearance level, known as "positive vetting", is sitting at almost 15 months.

In its efforts to slash the delays, the agency has enlisted 22 contractors who are now processing 85 per cent of assessments, according to evidence heard by a parliamentary committee in Canberra. At least 14 of the contractors are conducting positive vetting clearances, required by department secretaries, senior military officers, agency heads and other key officials who access top secret intelligence.

The Department of Defence headquarters in Canberra.

The Department of Defence headquarters in Canberra.Credit:Andrew Taylor

Security clearances are used to ensure officials can be trusted with classified information and are not vulnerable to blackmail and coercion by foreign intelligence agencies or criminal organisations. As part of the exhaustive positive vetting process, individuals must provide highly-detailed employment, financial, sexual, medical, psychological, family, drug and alcohol histories stretching back years.

Advertisement

Under questioning from Labor MPs Gai Brodtmann and Julian Hill in a hearing of the public accounts and audit committee in August, government officials detailed how the ballooning reliance on external contractors meant sensitive personal material was leaving the Department of Defence's secure internal system and being emailed or transported by courier services, including Australia Post. Hard copy documents have "occasionally" been sent to the wrong address.

"The issue around the movement of personal security files via courier is not optimal, but it's the process we have," said Daniel Fortune, the top official overseeing the vetting agency, which sits within Defence.

He noted there had been incidents that triggered "concerns around misaddressed documentation" but said they were rapidly dealt with and involved no breaches of sensitive or secure information.

Over the course of their work, the contractors accumulate sensitive material on their subjects and internal reviews have found they are frequently failing to properly secure the information.

Mr Fortune defended the agency's "robust" oversight of the contractors and efforts to ensure they were securing the information but conceded the challenges were motivating the development of a new IT system scheduled to be fully operational by 2023.

He said 80 staff from the panel of private contractors are now involved in vetting, on top of the 50 vetting officers employed by the agency. The private contractors completed 1600 positive vetting clearances in 2017-18, up from 150 three years ago. The agency wants the contractors to increase to 2000 in the coming years.

Mr Hill said he was worried by the "radical privatisation" of security clearances and called for the government to properly assess the risks and costs.

“Excessive privatisation due to arbitrary staffing caps is a false economy and increases risks enormously," he said.

“Sensitive personal information of Australia’s most-senior public servants – including sexual behaviour, financial, medical, drug and alcohol issues – is being whizzed around on motorcycle couriers. For all we know, they may be using Deliveroo."

One former intelligence official said they were worried about the contractors' quality control and suggested the current process was driven by a desperate push to plough through clearances rather than achieving proper national security outcomes.

"The whole thing is a little troubling," the person told Fairfax Media.

"The thought of positive vetting being outsourced is stunning to me," another former national security official said, questioning if standards had been lowered too much. "It sounds to me like it's not being taken seriously by government."

Labor has previously criticised the government's staffing cap and growing reliance on contractors across the public service.

The parliamentary committee is examining the findings of a report from the Australian National Audit Office, released earlier this year, that found the vetting agency was unable to "effectively mitigate the government's exposure to insider threats".

While the vetting agency processes clearances for most government entities, five do their own. These are intelligence agencies ASIO and ASIS, peak intelligence analysis agency the Office of National Assessments, the Department of Foreign Affairs and Trade and the Australian Federal Police. About 10,000 people hold active positive vetting clearances. Including the lower clearance levels, there are almost more than 440,000 active clearances.