There is an interesting article about the Department of Defense database used to track security clearance revocations.
The article talks about a database which had been setup to keep track of those people who had their security clearances revoked. The context was to help in identifying high-risk individuals that might compromise security.
It is another example of how the problem with most personnel tracking is out-processing as opposed to in-processing.
The reason is pretty obvious.
The incentives to ensure in-processing works are very high. Usually the person involved and their organization cannot work or access the information needed until the person has been in-processed and is officially ‘in-the-system’. Therefore both informal pushing, from the person, and official pushing, from the organization, is in effect built into the system. In the usually conflicted world we live in where not everything is accomplished in a timely fashion, in-processing will get bumped to the top of the list.
Out-processing however is much less clear-cut in terms of priorities. Nothing automatically is stopped when out-processing is not accomplished in a timely fashion. Paychecks aren’t prevented from happening, employees aren’t prevented from going to work, projects are typically not negatively impacted. The bad result only occurs indirectly when it is necessary to utilize the system and the data turns out to be faulty or incomplete. By that time, fixing the database often proves to be so resource intensive that it never happens successfully.
The solution to this, to the extent there is a solution, is to build in negative results that cause organizationally damage if the out-processing is not completed in a timely fashion. This is so counter-intuitive that it rarely occurs. However, since out-processing deficiencies are one of the continuing problems in security architecture, it deserves increased attention.
