Audit of the Federal Bureau of Investigation's Management of Its Confidential Human Source Validation Processes
Total Page:16
File Type:pdf, Size:1020Kb
REDACTED FOR PUBLIC RELEASE Office of the Inspector General U.S. Department of Justice OVERSIGHT ★ INTEGRITY ★ GUIDANCE Audit of the Federal Bureau of Investigation’s Management of its Confidential Human Source Validation Processes REDACTED FOR PUBLIC RELEASE The full version of this report contains information that the Department considered to be classified and therefore could not be publicly released. To create this public version of the report, the Office of the Inspector General redacted (blacked out) portions of the full report. Audit Division 20-009 November 2019 REDACTED FOR PUBLIC RELEASE (U) Executive Summary (U) Audit of the Federal Bureau of Investigation's Management of its Confidential Human Source Validation Processes (U) Objectives (U) Audit Results (U) The objectives of this audit were to: (1) evaluate (U) Between FY 2012 and FY 2018 the FBI spent an the Federal Bureau of Investigation's (FBI) Confidential average of $42 million annually in payments to its Human Source (CHS) program policies and procedures, CHSs. As of May 2019, nearly 20 percent of the FBI's including its validation procedures; (2) assess the FBI's CHS base met its definition of a long-term CHS. As we policies and procedures for the use of non-attributable conducted our audit, of particular concern was the FBI's communications between agents and CHSs; and management of these long-term CHSs. (3) examine the FBl's ability to identify and fill gaps in (U) FBI Did Not Comply with the AG Guidelines the alignment of its CHSs with the nation's highest and Faces Ongoing Challenges in Overseeing priority threats and intelligence needs. Long-Term CHSs - The FBI uses CHSs to provide (U) Results in Brief intelligence and support law enforcement and national security operations. The Attorney General Guidelines (U) We found that the FBI's vetting process for CHSs, Regarding the Use of FBI Confidential Human Sources known as validation, did not comply with the Attorney (AG Guidelines) and the FBI categorize CHSs based on General Guidelines. We also found deficiencies in the several risk factors. FBl's long-term CHS validation reports which are relied upon by FBI and Department of Justice (Department or (U) We found that the FBI did not comply with the AG DOJ) officials in determining the continued use of a Guidelines' requirements and its own policies and CHS. Further, the FBI inadequately staffed and trained procedures for managing long-term CHSs and, personnel conducting long-term validations and lacked consequently, a backlog of CHSs awaited validation. In an automated process to monitor its long-term CHSs. addition, the FBI's long-term CHS validation reports were insufficient because they did not ensure the full (U) The joint DOJ-FBI committee tasked with oversight scope of a long-term CHS's operation was reviewed and of the FBl's CHS program did not meet its composition FBI validation personnel told us they were discouraged requirements placing an undue burden on just a few from documenting conclusions and recommendations. members. The committee also had a backlog of CHSs Further, the number of personnel tasked with awaiting continued use determinations, potentially conducting long-term CHS validations was insufficient allowing them to operate when they should not have. due to the size of the long-term CHS validation backlog (U) The FBI also missed an opportunity to identify its and the lack of adequate training. The FBI also lacked non-compliance with established CHS validation an automated process to identify, track, and monitor requirements because it did not follow its own directives long-term CHSs, and there was no automated process for incorporating new procedures into policy. Further, to document approvals that allow the same agent to we identified issues related to the FBI's current continue to manage a CHS in excess of five years. validation process for CHSs with characteristics the FBI These factors increase the likelihood that the FBI has considers significant and its lack of policy for not adequately mitigated the risks associated with long communicating with CHSs. Lastly, a newly proposed term CHSs, including the risks posed by overly familiar system designed to align its CHS base with its highest and non-objective handling agent and CHS priorities will rely on ingesting data from at least one relationships. FBI system with known data quality issues. (U) FBI officials told us that they did not believe "long (U) Recommendations term" to be a useful indicator in determining CHS risk and, towards the conclusion of our audit work, the FBI (U) Our report contains 16 recommendations to help indicated that it now intends to pursue discussions with the FBI better manage its CHS program. DOJ on the AG Guidelines long-term CHS validation requirements. SECRET//NOFORN (U) Executive Summary (U) Audit of the Federal Bureau of Investigation's Management of its Confidential Human Source Validation Processes (U) Human Source Review Committee Was Not headquarters oversight and monitoring to ensure CHS Composed According to Requirements and Faces risk is effectively mitigated. an Ongoing Backlog - The joint DOJ and FBI Human (U) FBI's Annual CHS Validation Report and the Source Review Committee (HSRC) did not comply with Communication of its Importance Should be the composition requirements set forth in the AG Improved - While we found that the FBI's annual CHS Guidelines and a backlog of CHSs awaited the HSRC's validation report met the minimum requirement of the continued use determinations. By not meeting the AG Guidelines, we determined that the report may not composition requirement for the HSRC, an undue be sufficiently addressing CHS risk. In addition, we burden was placed on a few HSRC members to keep up found that the importance of the annual CHS report in with the workload. the overall validation process has not been adequately (U) Further, by not reviewing these long-term CHSs for communicated to FBI field offices. continued use in a timely manner, some CHSs may (U) Challenges Exist in Securing and Safeguarding have remained active when they should have been CHS Communications and Information - We found closed or had additional conditions placed on their that the FBI lacked clear guidance to inform its continued use. For example, we found that the HSRC personnel of the acceptable platforms for requested a CHS be closed because the CHS was a child communicating with CHSs. For example, we found sex offender and the HSRC did not believe the benefits varying practices and opinions among FBI field offices of using the CHS outweighed the associated risks. on whether government-issued cell phones were an Because of the current backlog of long-term CHSs acceptable method to communicate with a CHS. awaiting validations at the FBI, important continued use Without clear guidance, we believe there is increased determinations like this may not occur for significant operational security risk that could result in agents and periods of time. CHSs being put in harm's way. In addition, we found (U) FBI Did Not Follow Its Policy Implementation that the FBI is not ensuring its highly classified CHS Process When Revising Validation Practices - reporting platform is properly safeguarded from Between 2011 and 2019, the Directorate of Intelligence unauthorized access, increasing the potential for (DI) implemented different validation processes without unmitigated insider threat risks. incorporating them into policy. Instead, various (U) FBI Should Prioritize Automation of its electronic communications were issued to provide Processes to Identify and Fill Gaps in CHS guidance on the revised processes. Because the DI did Coverage - We identified issues related to the FBI's not incorporate the revised validation processes into ability to align its CHSs with its highest threat priorities. policy, it missed the opportunity to go through the Specifically, we found that the FBI lacked an automated formal deconfliction process that should have identified process to analyze its CHS coverage and relied on an its non-compliance with AG Guidelines requirements for ineffective process that was time consuming and long-term CHSs. To date, the most recent iteration of resulted in potentially outdated information. Although the validation process, developed in 2017, has not been we learned that the FBI was developing a system to incorporated as policy. automate its assessment of CHS placement to address (U) FBI's Current Validation Process Lacks these deficiencies, we determined that the proposed Adequate Independent Oversight and Should Be system would rely on data from several other FBI Reengineered - We found that the FBI has not systems, including its CHS system of record, which has implemented adequate controls in its latest validation known issues related to data quality. process, creating a risk that CHSs are not adequately scrutinized or prioritized. The FBI's current validation process does not provide sufficient independent FBI ii SECRET//NOFORN SECRET//NOFORN (U) AUDIT OF THE FEDERAL BUREAU OF INVESTIGATION'S MANAGEMENT OF ITS CONFIDENTIAL HUMAN SOURCE VALIDATION PROCESSES (U) TABLE OF CONTENTS (U) INTRODUCTION ...................................................................................... 1 (U) FBI CHS Guidance and Policy ........................................................... 2 (U) CHS Program Management .............................................................. 2 (U) FBI Validation Processes .................................................................