BRAG ELIMINATED EARLY BACKLOG OF SRAS
BRAG had a large number of pending SRA applications in late 2003, but reduced the number significantly during the first six months of 2004.10 In November 2003, BRAG had 3,855 pending SRA applications, which included a backlog of 628 SRA applications that had been pending for more than 45 days.11 BRAG’s large caseload of pending SRA applications was caused by processing issues that were resolved between November 2003 and June 2004. By June 2004, BRAG had reduced its number of pending SRA applications from 3,855 to 401 and eliminated its SRA application backlog. Since June 2004, BRAG has maintained a stable monthly caseload of approximately 339 pending SRA applications, which it is processing routinely in 45 days or less.12
BRAG Encountered Processing Problems During Phase-In Period
The interim federal regulations CDC and APHIS issued in December 2002 to implement the Bioterrorism Act established a six-month phase-in period to allow laboratories and individuals time to achieve full compliance with the new regulations for possessing, using, and transferring select agents and toxins, including obtaining SRAs. The phase-in period was designed to minimize the disruption that the regulations might cause for research and educational projects involving select agents and toxins that were under way.
The phase-in period for processing SRA applications ran from April 11, 2003, to November 12, 2003. All SRA applications were due to BRAG on April 11, 2003, and BRAG started processing SRA applications on April 14, 2003. The regulations gave laboratories and individuals until November 12, 2003, to achieve full compliance with the law, including obtaining SRAs for all of their employees who needed access. After November 12, 2003, individuals not in full compliance with the SRA requirements would not be eligible for access to special agents and toxins until they met the requirements.
BRAG officials said that during the six-month phase-in period, they:
- Received only 11 percent of all SRA applications by the April 11, 2003, SRA submission deadline;
- Received a total of 3,948 SRA applications from CDC and APHIS with missing or unusable data;
- Experienced a staffing change from 18 to 9 personnel that reduced BRAG’s capacity for conducting SRAs from 1,200 to 500 each month just prior to the regulatory deadline for completing all SRAs; and
- Experienced problems obtaining some of the information needed to determine the eligibility of individuals with criminal histories and mental health issues.
Because of these problems BRAG accrued a large number of SRA cases for which it could not make final determinations of eligibility. As discussed below, these problems were addressed either by BRAG or through the joint actions of BRAG, CDC, APHIS, and the officials and individuals applying for access to select agents and toxins.
BRAG Received Only 11 Percent of All Applications by the April 11, 2003, Deadline. Although the regulations required that all applications were due to BRAG by April 11, 2003, BRAG received 89 percent of the applications after that date. As shown in Table 1, on April 11 BRAG had received only 1,108 (11 percent) of the 9,720 applications that it would eventually receive by the November 12, 2003, regulatory deadline for completing all SRAs.
| Table 1: Number of SRA Applications Received by Month During the 2003 Phase-In Period |
|
|---|---|
| April 11 | 1,108 |
| May 31 | 1,601 |
| June 30 | 2,285 |
| July 31 | 1,790 |
| August 31 | 703 |
| September 30 | 645 |
| October 31 | 727 |
| November 12 | 861 |
| Total | 9,720 |
Source: Bioterrorism Workload Statistics - Internal, BRAG.
BRAG Received Several Thousand Incomplete SRA Applications. During the six-month phase-in period, BRAG received a large number of SRA applications for which it could not make a final eligibility determination because of missing data or illegible fingerprint cards. A complete SRA application package includes: 1) a completed FBI Form FD-961 that contains basic information, such as name and address; and 2) two legible fingerprint cards. As stated previously, BRAG received 9,720 SRA applications during the phase-in period, between April 11 and November 12, 2003. A total of 3,948 (41 percent) of those applications were missing data such as an FBI Form FD 961 or the required two fingerprint cards. Sometimes an application included an FBI Form FD-961 that was missing information or the prints on the fingerprint cards were not legible. In these cases, BRAG officials said that they could not complete the SRAs until they received the missing data, which sometimes took months.
The volume of incomplete applications received during the phase-in period also made it appear that BRAG had a large backlog of SRA cases and that it was not processing SRA applications in a timely manner. In fact, BRAG employees could not begin to conduct an SRA until the applicant submitted complete information. BRAG officials said that they sent thousands of letters to laboratory officials requesting the missing information prior to the November 12, 2003, deadline, but did not receive all of the data in time to complete the SRAs by the deadline.
BRAG Processing Capacity Was Significantly Reduced by a Change in Staffing. In April 2003, the FBI temporarily assigned employees to start SRAs while it began selecting a permanent staff for BRAG. However, BRAG’s ability to meet the regulatory deadline of November 12, 2003, was significantly hampered by a staffing change that occurred at the end of October 2003.
Before October 31, 2003, the FBI had staffed BRAG with 18 temporary personnel security specialists from the CJIS Division’s National Instant Criminal Background Check System. On October 31, 2003, the FBI replaced BRAG’s temporary staff with a permanent staff of nine employees that included one unit manager, one supervisor, and seven personnel security specialists. As a result of the staffing change, BRAG’s capability for conducting SRAs dropped from approximately 1,200 to 500 per month just prior to BRAG’s November 12, 2003, deadline for completing all SRAs. The drop in capacity resulted from the reduction in the number of staff as well as the transition from an experienced to an inexperienced staff that required training.
BRAG’s Need to Obtain Pertinent Information from External Sources Increased Processing Times. BRAG officials said that they had trouble obtaining some of the information they needed to determine the access eligibility of individuals with criminal histories and mental health issues. According to BRAG, it can take from two weeks to six months to obtain all the information it needs to make a determination of eligibility for access on one SRA application. BRAG’s processing times can be significantly affected by: 1) the availability of automated state and local criminal history records, 2) difficulty obtaining mental health histories, and 3) BRAG’s reliance on other agencies to conduct certain database searches.
For example, BRAG often needs to acquire copies of court records of dispositions in criminal cases to make its eligibility determinations. BRAG also must verify references to state and local court records, many of which are not automated and, therefore, only accessible through manual research.13 Consequently, BRAG has to obtain copies of court documents and this process can extend the time it takes to conduct an SRA by several months.
In addition, processing times can increase when BRAG has to obtain mental health histories. SRA applicants indicate on Form FD-961 whether they have ever been adjudicated as a mental defective or committed to a mental institution. If an applicant answers "yes," BRAG employees must conduct research to determine whether the individual was voluntarily or involuntarily committed to a mental institution. According to BRAG officials, this research is time consuming, and some institutions are reluctant to share this information.
BRAG also depends on other agencies to complete portions of the SRA database searches. To obtain visa information on alien resident and work status, BRAG downloads applicant information from its Bioterrorism Database and supplies it to the Department of Homeland Security’s Immigration and Customs Enforcement agency. BRAG also provides applicant information to the FBI’s Foreign Terrorist Tracking Task Force to determine whether the applicant is a known terrorist. At times, these agencies are not able to search their databases based on the information BRAG provides. When that happens, BRAG must contact the applicant directly to request additional information, such as birth certificates or alien registration numbers. BRAG employees said complexities such as these can add weeks or months to the SRA application processing time.
BRAG Reduced Large Caseload of Pending SRA Applications
Chart 2 shows that BRAG accrued a large caseload of SRA applications during the phase-in period, with pending applications peaking in August 2003 at 5,809. BRAG had reduced its caseload to 3,855 by November 12, 2003.
Source: Bioterrorism Workload Statistics - Internal, BRAG.
BRAG employees said that they kept CDC and APHIS officials fully informed of their processing issues and the need for CDC and APHIS to encourage laboratory owners and responsible officials to submit the data missing from SRA applications before the deadline. BRAG officials said they also informed CDC and APHIS that – because of BRAG’s heavy caseload and processing times that averaged 45 days – even if all missing SRA application data were submitted immediately, the outstanding applications could not be processed by the November 12, 2003, deadline. On November 3, 2003, CDC and APHIS amended federal regulations, in part, to provide more time for BRAG to complete the pending SRA applications that it accrued during the phase-in period.
CDC and APHIS Amended Interim Final Rules to Allow Grants of Provisional Access. On November 3, 2003, CDC and APHIS officials amended the interim final rules on select agents and toxins. The amendments allowed CDC and APHIS to provide provisional grants of access to individuals who had submitted complete application packages to BRAG and met all other federal requirements by November 12, 2003, but who had not yet obtained an SRA. The amendments did not extend the deadline for complying with SRA requirements, but they did allow for the continued operation of laboratory facilities vital to the public interest. At the same time, the amendments emphasized the need for applicants to provide missing application data. The amendments also gave BRAG more time to finalize individual SRAs for individuals who had submitted all of the required information by the deadline.
As of the November 12, 2003, deadline, BRAG had received 9,720 individual applications. Of those, 61 percent (5,865) had been finalized by the issuance of an eligibility determination (5,265) or by the cancellation of an SRA request by an applicant or responsible official (600). This left 3,855 pending applications. Of that number, BRAG had received 2,947 applications that included all necessary data and 908 applications that were missing data or legible fingerprint cards. Because the 908 individuals with incomplete applications had missed the deadline for submitting all required information, they were not eligible for access and, by regulation, could not work with select agents and toxins.
On November 13, 2003, BRAG reported that it expected to be able to complete 500 SRAs each month and therefore would process the remaining 3,855 pending applications in seven months, or by June 2004. Chart 3 shows the progress that BRAG made in reducing the number of pending applications. BRAG reduced the number of pending SRA applications to 401 as of June 2004 and has since maintained a relatively stable average monthly caseload of 339 pending SRA applications.
Source: Bioterrorism Workload Statistics - Internal, BRAG.
BRAG Significantly Reduced Its Pending Caseload. Table 2 shows that BRAG had received a total of 13,287 SRA applications and conducted 12,982 SRAs as of December 2004. From November 12, 2003, to December 31, 2004, BRAG reduced its pending SRA application caseload from 3,855 to 305 SRA applications and its incomplete SRA applications from 908 to 40.
| Table 2: BRAG Productivity Achievements Before and After the Regulatory Deadline |
||||
|---|---|---|---|---|
| Bioterrorism Databaise |
November 12, 2003 Regulatory Deadline |
December 31, 2003 |
September 19, 2004 OIG Inspection |
December 31, 2004 Current Status |
| Completeda | 5,865 | 7,392 | 12,045 | 12,982 |
| Pendingb With complete informationb With incomplete informationb |
3,855 2,947 908 |
2,652 2,190 462 |
357 316 41 |
305 265 40 |
| Total SRA Applications | 9,720 | 10,044 | 12,402 | 13,287 |
| Source: Bioterrorism Workload Statistics - Internal, BRAG a Includes all records entered that show a decision in the database (cancelled, restricted, or unrestricted). b Includes all records with no decision in the database (those with complete and incompleted applications). |
MANAGEMENT CONTROLS AND MINIMUM STANDARDS
FOR ACCESS ELIGIBILITY
Our review found that BRAG has effective management controls that have resulted in the timely identification and correction of several program vulnerabilities. BRAG monitors its processing capabilities and productivity using its Bioterrorism Database. In addition, BRAG has established an appeals process that, so far, has resulted in BRAG overturning 6 of its 20 "restricted persons" designations. The CJIS Division participates in an interagency working group, which includes HHS, USDA, the Department of Defense (DOD), Customs and Border Protection, and other organizations, to resolve interagency issues affecting the SRA Program. Since the Bioterrorism Act was implemented, the SRA process has provided a reasonably quick minimum standard (usually 45 days or less) for security checks on all persons seeking access to select agents.
BRAG Has Effective Management Controls
Since its creation in April 2003, BRAG has:
- Established procedures for conducting background investigations and completing SRAs,
- Set up a Bioterrorism Database for tracking SRAs, and
- Hired a permanent staff to fulfill BRAG’s SRA responsibilities.
As discussed below, BRAG’s accomplishments are, in part, a product of strong management controls that have led to the early identification and timely correction of program vulnerabilities.
BRAG Closely Monitors the SRA Process and Caseload. BRAG monitors its processing capabilities in an effort to maintain a high level of employee productivity. Among other control measures, BRAG has instituted several productivity measures and goals, and routinely monitors its progress toward meeting those goals. For example, BRAG established a 45-day goal for finalizing SRA applications, and supervisors closely monitor the time that individual requests remain in the database before a final eligibility determination is made.
While BRAG still occasionally receives SRA applications that are missing required information or contain illegible fingerprint cards, those applications are now clearly identified in the Bioterrorism Database. Consequently, those applications no longer appear as part of the backlog of cases pending more than 45 days as they did during the phase-in period.
BRAG has also improved the SRA process by revising the instructions on the FBI’s Form FD-961. Since August 25, 2004, the instructions on Form FD 961 instruct applicants to send their applications directly to the CJIS Division instead of to CDC or APHIS as previously instructed. BRAG reported that this revision has helped to reduce processing times.
Of the total 12,982 SRAs it completed by December 2004, BRAG:
- Granted eligibility for unrestricted access to 11,830 applicants,
- Canceled 1,080 individual requests that were withdrawn, and
- Designated 72 applicants as "restricted persons."
As shown in Table 3, most ineligible applicants had been designated "restricted persons" because of felony convictions (54) or an illegal or unlawful alien status (7). Some of the 72 designations were based on more than one criterion. Twenty of the 72 appealed BRAG’s eligibility restrictions.
| Table 3: Restrictions Applied by Criteria |
|
|---|---|
| Restriction Category | Restrictions Applieda |
| Felony conviction | 53 |
| Fugitive from justice | 4 |
| Illegal/unlawful alien | 7 |
| Adjudicated mental defective | 3 |
| Controlled substance abuser | 2 |
| Under indictment | 2 |
| Agent of foreign power | 1 |
| Dishonorable discharge | 1 |
| Terrorist related | 0 |
| Source: Bioterrorism Workload Statistics Division, BRAG, January 11, 2005. a The table shows total restrictions by criteria (74); some of the 72 individuals found to be ineligible for access were restricted based on more than one criterion. |
BRAG Established an Appeals Process. BRAG established an appeals process that, as of January 2005, had addressed 20 appeals of individual "restricted person" designations. BRAG sustained 14 of the 20 appeals and overturned 6 to grant the appellant eligibility for "unrestricted" access. BRAG does not limit the number of times that an individual can appeal a restriction. In at least one case, BRAG overturned a restriction that it had previously sustained on appeal.
SRA applicants with past felony convictions can successfully appeal a "restricted" designation by getting the appropriate state or local government to expunge their criminal record from local, state, and national databases and other data repositories. Generally, the burden of proof in an appeal rests with the appellant.
If CDC or APHIS officials disagree with a BRAG employee’s eligibility determination, they also can initiate an appeal. This provision of the appeals process, which has never been used, would work for an agency as it does for an individual applicant – the burden of proof would rest with the agency appealing BRAG’s determination.
The CJIS Division Resolves Interagency Issues Through the Select Biological Agents and Toxins Working Group. The CJIS Division routinely participates in a working group that includes representatives from CDC, APHIS, DOD, Customs and Border Protection, and other organizations to resolve interagency issues. This group, called the Select Biological Agents and Toxins Working Group (Working Group), was established by the Bioterrorism Act to consider policy issues and render policy decisions related to security, regulations, and preparing for and preventing bioterrorism and other public health emergencies.
For example, the Working Group considered a request made by the Deputy Under Secretary of Defense for Counterintelligence and Security to the CJIS Division seeking to exempt DOD military and civilian personnel and contractors from SRA requirements. In October 2003, the Deputy Under Secretary wrote to the CJIS Division of her concern that 400 DOD employees would not be able to obtain an SRA by the regulatory deadline. She stated that the SRA process was similar enough to background investigations DOD conducted before granting access to classified information that the SRAs were redundant for individuals already possessing security clearances. Therefore, she wrote, "we take the position that those 400 individuals should be exempt from the risk assessment requirement by virtue of their having been granted security clearances based on favorably adjudicated background investigations."
The CJIS Division, as part of the Working Group, denied DOD’s request for exemptions, citing a legal determination that the Bioterrorism Act does not allow such exemptions even for individuals with security clearances.
SRA Program Provides a Clear Standard for Access
Because of the issues DOD raised at the Working Group and other concerns expressed during our inspection regarding the possible redundancy of SRA background investigations for individuals with security clearances, we compared the scope of the SRA background investigation with that of other types of background investigations. We found that the SRA background investigation includes searches of databases that are not searched routinely during other types of background investigations, including those conducted for national security clearances. We also found that the SRA process provides a clear standard for conducting background investigations to determine eligibility for access to select agents and toxins.
The Bioterrorism Act allows for several exemptions from the SRA requirements. For example, if a laboratory is owned by a local, state, or federal agency, the head of the agency that "owns" the facility is exempt from the requirement of obtaining an SRA (42 C.F.R. 73.8(a)). Also, an owner of an accredited academic institution is not required to obtain an SRA. However, all responsible officials, alternate responsible officials, and individuals with access to select agents and toxins are required to obtain an SRA, regardless of whether they work for a government agency or an accredited academic institution. In addition, the Bioterrorism Act does not exempt federal employees who have a national security clearance from obtaining an SRA.
While the types of background investigations conducted to determine eligibility for access to Top Secret national security information and for a public trust position in the federal government include reviews of some of the same information sources as an SRA, there are differences. All three types of investigations include, for instance, a national agency check, which consists of a review of the:
- Investigative and criminal history files of the FBI, including the National Crime Information Center and fingerprint search;
- Office of Personnel Management’s Security/Suitability Investigations Index; and
- DOD’s Defense Clearance and Investigations Index.
The Minimum Background Investigation (MBI) required for a public trust position includes a national agency check, plus written inquiries and credit record searches, a face-to-face personal interview between the investigator and the subject, and telephone inquiries to selected employers. The Single Scope Background Investigation (SSBI) required for access to Top Secret information is a governmentwide investigation that covers the past seven years of an individual’s activities. It includes verification of citizenship and date and place of birth, as well as national records checks on the individual’s spouse or cohabitant, and interviews with selected references and former spouses.
In contrast, BRAG employees conducting an SRA search databases that contain information to determine whether the applicant meets any 1 of the 11 criteria that would result in a restriction from access to select agents and toxins. Not all of these databases are searched routinely as part of an MBI or SSBI. For example, BRAG routinely searches the Foreign Terrorist Tracking Task Force database for information to determine whether an applicant is a known terrorist or has associated with known terrorists. This database is not searched as part of an MBI or SSBI. BRAG also searches the Immigration and Customs Enforcement database for information on whether an applicant has been determined to be an illegal or unlawful alien.
Table 4 on the next page lists other databases routinely searched for SRA investigations – but not for MBI or SSBI investigations – such as the FBI Indices via the Automated Case Support system, which contains FBI Headquarters’ classified databases; the Department of Veterans Affairs’ database for mental health information; and the Department of State’s Terrorist Watch List and Consular Consolidated Database Indices. According to BRAG officials, BRAG is continuing to refine the SRA process and expand its electronic searches as new databases emerge, especially those that containing counterterrorism information.
Before passage of the Bioterrorism Act, less than half the nation’s laboratories conducted background checks on employees with access to select agents and toxins, and the practice of conducting background checks varied greatly among the different types of laboratories. For instance, while approximately 80 percent of the laboratories owned by research institutes and commercial facilities conducted background checks on their employees with access to select agents and toxins, less than 20 percent of state and university laboratories conducted such checks.
When background investigations were conducted by laboratories, they usually included a basic criminal background check, but not all of the other elements of an SRA background investigation. Since the Bioterrorism Act was implemented, the SRA process has provided a reasonably quick minimum standard (usually 45 days or less) for security checks on all persons seeking access to select agents. The SRA process also contributes to the creation of a database that contains the names of all persons who are using or have used select agents, which agents they have used, and where they are working.
Table 4:
Comparative Analysis of Two Levels of Background
Investigations and the SRA Process
| Types of Background Investigations | |||
|---|---|---|---|
| Information Sources | SRA | SSBI for a special- sensitive position a | MBI for a moderate- risk public trust position b |
| National Crime Information Center | X | X | X |
| Interstate Identification Index | X | X | X |
| FBI Indices | X | ||
| Fingerprint Identification | X | X | X |
| Foreign Terrorist Tracking Task Force | X | ||
| Immigration and Customs Enforcement - check for citizenship only | X | ||
| Immigration and Customs Enforcement - check for citizenship, naturalization status, immigration status, and Student and Exchange Visitor Information System status | X | ||
| Defense Clearance Investigation Index | X | ||
| Department of Defense Dishonorable Discharge Records | X | X | |
| Department of Veterans Affairs mental defective records | X | ||
| Office of Personnel Management's Security/Suitability Investigations Index [previous background investigation history] | X | ||
| State Department Terrorist Watch List and the Consular Consolidated Database Indices for visa information | X | ||
| Court records verification [if necessary]c | X | X | |
| Local law enforcement checks based on previous residences | X | X | |
| Credit report | X | X | |
| Education verification | X | X | |
| Subject interview | X | X | |
| Employment verification | X | X | |
| Residence verification | X | X | |
| Spouse interview | X | ||
| Personal and professional references | X | X | |
| a Information sources such as credit reports are reviewed for a 3- to 10-year period. b Information sources such as credit reports are reviewed for a 5- to 7-year period. c Court records are obtained, if an adjudication decision resulted in "restricted." |
Footnotes
- According to BRAG, its pending workload includes all SRA applications that have been entered into the Bioterrorism Database, but have not been finalized through a determination a eligibility.
- According to BRAG, a backlog occurs when it takes BRAG more than 45 days to determine an applicant's eligibility for access once BRAG has received a complete SRA application, which includes all requested data on the FBI FD-961 and two legible fingerprint cards.
- Forty-five days is the average processing time for BRAG to complete an SRA application. BRAG determined the average processing time by calculating the mean number of days BRAG took to complete pending SRAs during a three-month period.
- As reported previously by the OIG, the lack of automated court records has an impact on other Department programs as well. The OIG report, Review of the Bureau of Alcohol, Tobacco, Firearms and Explosives' Enforcement of Brady Act Violations Identified Through the National Instant Criminal Background Check System, Report Number I-2004-006, July 2004, describes the same requirement to obtain court records, but at the expense of utilizing Alcohol, Tobacco, Firearms and Explosives' agent resources for this task.