ISCR Case No. 23-00729

DEPARTMENT OF DEFENSE DEFENSE OFFICE OF HEARINGS AND APPEALS

EA c; ... o _.~ .t::~! ~ o \\ In the matter of: )

)

)

ISCR Case No. 23-00729

) Applicant for Security Clearance ) Appearances For Government: John Lynch, Esq., Department Counsel For Applicant: Dan Meyer, Esq. 03/28/2025

GARCIA, Candace Le’i, Administrative Judge: Applicant failed to mitigate the personal conduct security concerns. Eligibility for access to classified information is denied. Statement of the Case On September 29, 2023, the Department of Defense (DOD) issued a Statement of Reasons (SOR) to Applicant detailing security concerns under Guideline E (personal conduct). The action was taken under Executive Order (Exec. Or.) 10865, Safeguarding Classified Information within Industry (February 20, 1960), as amended; DOD Directive 5220.6, Defense Industrial Personnel Security Clearance Review Program (January 2, 1992), as amended (Directive); and the adjudicative guidelines (AG) implemented by DOD on June 8, 2017. Applicant responded to the SOR (Answer) on October 9, 2023, and requested a hearing before an administrative judge. The case was assigned to me on May 3, 2024. The Defense Office of Hearings and Appeals (DOHA) issued a notice of hearing (NOH) on June 26, 2024, scheduling the hearing for August 7, 2024. I granted Applicant’s

request for a continuance and the hearing was canceled on August 2, 2024. DOHA issued another NOH on August 6, 2024, rescheduling the hearing for September 4, 2024. I convened the hearing as rescheduled. At the hearing, Government Exhibits (GE) 1 through 4 and Applicant’s Exhibits (AE) A through E were admitted without objection. Department Counsel called one witness telephonically on the Government’s behalf. Applicant testified and did not call any other witnesses. Neither party requested to keep the record open and the record closed. DOHA received the hearing transcript (Tr.) on September 13, 2024. SOR Amendment At the hearing and pursuant to ¶ E3.1.17 of the Directive, without objection, I granted Department Counsel’s motion to amend SOR ¶ 1.b to conform to the evidence by striking on line 2 the word “rework” and replacing it with “reinvestigate;” by substituting on line 3 the date “January 7, 2020” for the date “June 20, 2020;” by striking on line 3 the word “rework” and replacing it with “reinvestigate;” and by deleting on line 4 the words “between about July 7, 2020 and about March 31, 2021.” (Tr. 8-9) SOR ¶ 1.b was therefore amended to read as follows: Because of the problems noted in subparagraph 1.a, above, the Defense Counterintelligence and Security Agency’s Office of the Inspector General had to reinvestigate the investigations you had worked on between January 7, 2020 and April 8, 2021. During the reinvestigation it was determined that on various occasions you had falsified [Reports of Investigation] ROIs by stating that you had interviewed someone when you had not.

Applicant admitted both SOR allegations in her Answer. Despite her admission to SOR ¶ 1.b, she denied the underlying conduct and maintained she did not falsify ROIs, as alleged. (Tr. 126-136) Applicant is 40 years old. She has never married and she has one child, age 17. (Tr. 8-9, 78; GE 1-2) Applicant graduated from high school in 2003. She earned a Certified Nursing Assistant certification in approximately 2007. She also earned three associate degrees in 2017 and a bachelor’s degree in business administration in 2021. She expected to earn a master’s degree in business administration in December 2024 and to begin a doctorate program in business administration in January 2025. (Tr. 5-6, 56, 76-79, 107-121, 142; GE 1-3; AE C, AE E) Applicant worked as a nursing assistant from 2007 to 2012. She was unemployed from June 2012 to April 2013. She worked for various non-defense contractors from 2013 to 2017. She then briefly worked as a judicial clerk for a county district court in 2017, when she was terminated for lacking the necessary skills to perform the job. She was

unemployed a second time from May 2017 to September 2017. She briefly worked for a federal agency on a temporary contract later in 2017. (Tr. 5-6, 56, 76-79, 107-121, 142; GE 1-3; AE C, AE E) In November 2017, Applicant began working as a background investigator for defense contractor A. She was promoted to Field Investigator 2 in April 2018. She continued to work for the company when it was acquired by defense contractor B in June 2018. She was promoted to Investigator 3 in September 2018 and she resigned from the employment in April 2021, as further discussed below. (Tr. 5-6, 56, 74-76, 78-81, 85-86, 96-97, 110-121; GE 1-4; AE C, AE E) Applicant was unemployed a third time from April 2021 until a date not in the record. She works for a company that delivers laundry bags. In December 2021, she was offered employment as a senior program management analyst for defense contractor C but could not begin the job due to issues with her security clearance. As of the date of the hearing, she had another offer of employment, from defense contractor D, contingent on obtaining a security clearance. She was first granted a security clearance in 2017. (Tr. 5- 6, 56, 93-96, 106-107, 121-123, 142-144; GE 1-3; AE C, AE E) The SOR alleged Applicant was suspended from employment as a federal background investigator for defense contractor B in March 2021, after it was discovered she routinely submitted on their due dates “placeholder” ROIs that contained little to no information, after which time she would contact personnel from the Investigator Help Team to have the placeholder ROIs deleted and then transmitted her completed ROIs. Applicant’s employer reviewed her ROIs after her suspension and noted numerous instances of lifting in the source testimony sections, failure to report issues involving illegal drugs and foreign travel, relatives, and contacts, and record inconsistencies. (SOR ¶ 1.a) The SOR also alleged that, due to the problems noted in SOR ¶ 1.a, the Office of the Inspector General of a U.S. Government agency (Agency) had to reinvestigate the investigations Applicant worked on between June 20, 2020, and April 8, 2021. During the reinvestigation, Agency determined Applicant falsified ROIs on various occasions by stating she had interviewed someone when, in fact, she had not. (SOR ¶ 1.b) The SOR allegations are established by Applicant’s admissions in her Answer; her December 2021 security clearance application (SCA); her September 2023 response to interrogatories; Agency records; Applicant’s hearing testimony; and the testimony of the Government’s witness. (Answer; Tr. at 17-70, 126-136; GE 1, 3-4; AE C) Agency records reflect that it received an alert on March 30, 2021, which indicated that Applicant’s then-field manager had some concerns of “assigned completion date (ACD) manipulation” by Applicant. Her then-employer investigated it and then conducted a five-case sampling at Agency’s request. On May 3, 2021, her then-employer drew the following conclusions and proposed actions: This sampling found numerous Source testimonies containing instances of lifting. Other concerns include possible enhancement, issues obtained but

not reported, record inconsistencies and lack of due diligence. While rework found that [Applicant]’s notes fully support her ROIs, it could be because she is making her notes and ROI fit the circumstances of each case requirement. In her notes, rework found that whenever she reported information that appears to have been lifted, she wrote that information diagonally in her notes rather than following the horizontally lined paper. This gives the appearance that she is adding this information after the fact. It is hard to say for sure which of these findings could have been connected to the initiating concern, as far as her reporting incomplete reports and then transmitting full reports. With all the lifting found, it is possible she was padding or adding information after the fact. Since we only looked at five cases and considering the amount of lifting and irregularities in the reporting, it alludes to a possible larger concern. Therefore[,] it would benefit us to look at more of her work. . . . (GE 4) On May 7, 2021, Agency assumed the investigation into Applicant. Agency staff, consisting of 19 Agency personnel and 13 agents, conducted rework from June 20, 2020, to Applicant’s resignation date of April 8, 2021, and completed the rework on September 9, 2021. Approximately 2,323 labor hours were involved in the Agency’s rework and recovery effort at a total cost of $164,046, for which a contractual offset was completed. (Tr. 17-70; GE 3) The federal rework found 5 falsified sources, 280 validated, and 130 undetermined, detailed as follows: • 5 [employment (EPML)] sources stated they were never interviewed by [Applicant]. • [Agency] categorized the “undetermined” as all items which the source or record provided did not recall the interview or declined to participate. • 18 items/sources categorized as “validated” required case corrections. These items developed issue information as well as additional activities that should have been reported. (Tr. 42-45; GE 4) The Government’s witness (W1), who has worked for Agency since September 2005, has served as a supervisory investigator since 2009. Her responsibilities include overseeing and assuring the integrity of background investigations for individuals who are either employed by or seeking employment with federal agencies or defense contractors. She testified that contract background investigators receive access to the Investigator Handbook, which lists things that personnel are prohibited from doing. She also testified that all background investigations must comply with Federal Investigative Standards, and if a background investigation contains false information, the full investigation becomes suspect. (Tr. 17-70) W1 directed and performed oversight of the investigation into Applicant. W1 stated that Applicant’s then-employer’s field manager had concerns after discovering a placeholder scheme in which Applicant would transmit a placeholder report, which is a report that had little to no information within the testimonies for the sources, to meet an ACD. (Tr. 17-70) She stated, “[Applicant] would transmit [placeholder reports] close to midnight on [the ACD’s] and then call the contractor’s investigator help team the following

morning to request that the report be deleted so she could potentially transmit more information at a later date. Basically[,] a shell report.” (Tr. 27) W1 defined the terms “ghost writing,” “lifting,” “enhancement,” and “issues obtained but not reported,” reflected in the May 3, 2021, report. “Ghost writing” occurs when an investigator reports the testimony for reports that were never actually conducted or for interviews that did not actually take place. “Lifting” occurs when an investigator conducted an interview but is missing specific points of information or failed to obtain specific details from a source or record, so the investigator pulls that information from the case papers provided by the subject of that investigation. It is considered a type of material falsification because the investigator did not directly obtain that information from the source or records. (Tr. 32) “Enhancement” occurs when an investigator adds details or information to the report that was not obtained from a source or record. It is also considered a material falsification. (Tr. 33) “Issues obtained but not reported” constitutes an omission, i.e., another form of material falsification, where known issues are left out of a report. It is usually done to avoid the need for additional issue resolution in that case. (Tr. 32-35, 39- 41) W1 stated that Applicant, by transmitting placeholder reports, essentially made it look like her reports were done on time. In doing so, W1 stated that Applicant falsified her reports because she was certifying that the information she was transmitting in her reports were complete and accurate at the time of transmission. W1 stated that if it is discovered that a contractor has filed shell reports, the contractor is immediately suspended or removed for the falsification. (Tr. 17-70) W1 also stated there were seven instances, between the period January 7, 2020, and early April 2021, where it was confirmed during both the rework and recovery investigations that Applicant wrote in a report she had interviewed someone when she had not. (Tr. 47, 49, 54, 58) Applicant testified she transmitted an estimated five to eight cases daily or approximately 25 cases weekly and she pulled around 20 to 30 records weekly as an Investigator 3. (Tr. 74-76, 79-90, 96-97) She admitted to submitting reports of investigation (ROIs) and then reopening them, which she acknowledged was wrong. (Tr. 86, 88-90, 97-99, 102-105, 123-136) Despite her admissions in her Answer, she denied listing that she interviewed someone without having done so, or putting information in her reports that were not told to her. (Tr. 86-88, 97-99, 102-103, 105-106, 126-136; GE 3; AE C) She stated, “What I did not admit to was ever making up a source and submitting a report for that source. I’ve never done that.” (Tr. 90-91) She stated that as an Investigator 3, she was under pressure by her field manager to meet her ACD dates because of the scrutiny the company was facing during the COVID-19 pandemic and the importance of meeting their metrics. (Tr. 135-136) Applicant testified: Well, first of all, I want to be 100 percent honest with you. Did I transmit reports and reopen them to myself? Absolutely. Yes, I did. And was sometimes that reason was to, so that I didn’t miss my date? Yes. That is true. Lots of investigators do it. You don’t want to miss your date. So I would

submit the report. I would submit part of it, not the whole report. But I would submit the report and then yes, reopen it to me the next day. But it was not because I had not interviewed the person, spoke to the person or talked to them. I had their report. I just had so many contracts, and so many reports to type a day. I just became overwhelmed. I became overwhelmed. And when my mother told me that she had cancer it was a lot. I also had a daughter at that time. I was a single mother. And COVID was going on, which they had no proper protocol when COVID hit. They were scrambling. The company was a mess. They were, they didn’t know what to do with us. Because the truth is we very rarely are able to conduct interviews over the phone. We have to go in person for conduct reasons, which mean we need to go to federal buildings and organizations to do these interviews. When COVID hit these buildings shut down. They were closed. There was no way for me to come to the Court and pull records from the Court. There was no way for me to go to [. . . ] and talk to a supervisor and a coworker. . . . I didn’t want to go out and interview them. They didn’t want to be interviewed, and I didn’t want to go out. I have lupus, and my daughter was born with cancer. I wasn’t, I didn’t want to go out and be close to anyone. . . . (Tr. 97-99) Applicant reported in her SCA and maintained at her hearing that she left employment with defense contractor B because she wanted to focus on completing school, her health, and her family. She submitted her resignation to her then-employer by email on March 25, 2021. Her supervisor emailed her on March 26, 2021, to begin out- processing. She continued to work until April 1, 2021, when her suspension took effect and continued until her last day of employment on April 8, 2021, the effective date in which her employer accepted her resignation. She stated she did not list her suspension on her SCA due to oversight. She further stated she was unaware of the Agency investigation until she was informed she could not onboard with defense contractor C due to issues with her clearance. (Tr. 56, 92-96, 99-101, 104-105, 136-142; GE 3; AE C) From 2017 to 2021, Applicant received training related to her job as a background investigator, which included integrity-related concerns, code of conduct, and ethics. She did not have any other issues while employed by defense contractors A or B. She stated that she has learned her lesson and if she cannot meet a deadline in the future, she will be honest and simply state that she cannot meet the deadline. (Tr. 96. 123, 142-144; GE 3; AE C) She needs her clearance to onboard with defense contractor D, stating, “Absolutely. In fact, my livelihood hinge[s] on it. In order for me to onboard -- I'm still off work. And have been off work since my last day, which was 4/8/2021. (Tr. 106-107) She maintained, however, that she was not vulnerable to exploitation and that “No one could in any way use this as leverage.” (Tr. 101) A number of character references attested to Applicant’s reliability and trustworthiness. These included a former team member from 2013 to 2017 at a previous place of employment, a former coworker of over three years at defense contractor A, a former coworker of four years at defense contractors A and B, and a close friend of five years. The former coworker at defense contractors A and B wrote, “[Applicant] was not only able to juggle approximately six different contracts while holding . . . security

clearances, but she navigated these tasks effortlessly and seamlessly with very little help, instructions, or guidance.” (AE D) He continued, “It was of no surprise to me as I watched her during our time together with both companies go from an Investigator I to an Investigator III, her success was phenomenal.” (Tr. 103-104; AE D)

When evaluating an applicant’s suitability for a security clearance, the administrative judge must consider the adjudicative guidelines. In addition to brief introductory explanations for each guideline, the adjudicative guidelines list potentially disqualifying conditions and mitigating conditions, which are to be used in evaluating an applicant’s eligibility for access to classified information. These guidelines are not inflexible rules of law. Instead, recognizing the complexities of human behavior, administrative judges apply the guidelines in conjunction with the factors listed in the adjudicative process. The administrative judge’s overarching adjudicative goal is a fair, impartial, and commonsense decision. According to AG ¶ 2(a), the entire process is a conscientious scrutiny of a number of variables known as the “whole-person concept.” The administrative judge must consider all available, reliable information about the person, past and present, favorable and unfavorable, in making a decision. The protection of the national security is the paramount consideration. AG ¶ 2(b) requires that “[a]ny doubt concerning personnel being considered for national security eligibility will be resolved in favor of the national security.” Under Directive ¶ E3.1.14, the Government must present evidence to establish controverted facts alleged in the SOR. Under Directive ¶ E3.1.15, the applicant is responsible for presenting “witnesses and other evidence to rebut, explain, extenuate, or mitigate facts admitted by the applicant or proven by Department Counsel.” The applicant has the ultimate burden of persuasion to obtain a favorable security decision. A person who seeks access to classified information enters into a fiduciary relationship with the Government predicated upon trust and confidence. This relationship transcends normal duty hours and endures throughout off-duty hours. The Government reposes a high degree of trust and confidence in individuals to whom it grants access to classified information. Decisions include, by necessity, consideration of the possible risk the applicant may deliberately or inadvertently fail to safeguard classified information. Such decisions entail a certain degree of legally permissible extrapolation of potential, rather than actual, risk of compromise of classified information. Section 7 of Exec. Or. 10865 provides that adverse decisions shall be “in terms of the national interest and shall in no sense be a determination as to the loyalty of the applicant concerned.” See also Exec. Or. 12968, Section 3.1(b) (listing multiple prerequisites for access to classified or sensitive information).

Guideline E, Personal Conduct AG ¶ 15 expresses the security concern for personal conduct: Conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about an individual’s reliability, trustworthiness, and ability to protect classified or sensitive information. Of special interest is any failure to cooperate or provide truthful and candid answers during national security investigative or adjudicative processes. AG ¶ 16 describes conditions that could raise a security concern and may be disqualifying. I considered the following relevant: (a) deliberate omission, concealment, or falsification of relevant facts from any personnel security questionnaire, personal history statement, or similar form used to conduct investigations, determine employment qualifications, award benefits or status, determine national security eligibility or trustworthiness, or award fiduciary responsibilities; (c) credible adverse information in several adjudicative issue areas that is not sufficient for an adverse determination under any other single guideline, but which, when considered as a whole, supports a whole-person assessment of questionable judgment, untrustworthiness, unreliability, lack of candor, unwillingness to comply with rules and regulations, or other characteristics indicating that the individual may not properly safeguard classified or sensitive information; (d) credible adverse information that is not explicitly covered under any other guideline and may not be sufficient by itself for an adverse determination, but which, when combined with all available information, supports a whole-person assessment of questionable judgment, untrustworthiness, unreliability, lack of candor, unwillingness to comply with rules and regulations, or other characteristics indicating that the individual may not properly safeguard classified or sensitive information. This includes, but is not limited to, consideration of: (1) untrustworthy or unreliable behavior to include breach of client confidentiality, release of proprietary information, unauthorized release of sensitive corporate or government protected information; (3) a pattern of dishonesty or rule violations; and (4) evidence of significant misuse of Government or other employer's time or resources.

(e) personal conduct, or concealment of information about one’s conduct, that creates a vulnerability to exploitation, manipulation, or duress by a foreign intelligence entity or other individual or group. Such conduct includes: . . . (1) engaging in activities which, if known, could affect the person’s personal, professional, or community standing. Applicant was suspended from employment as a federal background investigator in March 2021, after she routinely submitted on their due dates placeholder ROIs that contained little to no information, after which time she would contact personnel from the Investigator Help Team to have the placeholder ROIs deleted and then transmitted her completed ROIs. Her then-employer, who reviewed her ROIs after her suspension, noted numerous instances of lifting in the source testimony sections, failure to report issues involving drug and foreign travel, relatives, and contacts, and record inconsistencies. As a result, the Agency Office of Inspector General reinvestigated the investigations Applicant worked on between June 20, 2020, and April 8, 2021, and determined that Applicant falsified ROIs on various occasions by stating she had interviewed someone when, in fact, she had not. I find that AG ¶¶ 16(a), 16(c), 16(d)(1), 16(d)3, 16(d)(4) and 16(e)(1) all apply. AG ¶ 17 describes the following conditions that could mitigate the personal conduct security concerns: (a) the individual made prompt, good-faith efforts to correct the omission, concealment, or falsification before being confronted with the facts; (b) the refusal or failure to cooperate, omission, or concealment was caused or significantly contributed to by advice of legal counsel or of a person with professional responsibilities for advising or instructing the individual specifically concerning security processes. Upon being made aware of the requirement to cooperate or provide the information, the individual cooperated fully and truthfully; (c) the offense is so minor, or so much time has passed, or the behavior is so infrequent, or it happened under such unique circumstances that it is unlikely to recur and does not cast doubt on the individual’s reliability, trustworthiness, or good judgment; (d) the individual has acknowledged the behavior and obtained counseling to change the behavior or taken other positive steps to alleviate the stressors, circumstances, or factors that contributed to untrustworthy, unreliable, or other inappropriate behavior, and such behavior is unlikely to recur; (e) the individual has taken positive steps to reduce or eliminate vulnerability to exploitation, manipulation, or duress; and

(f) the information was unsubstantiated or from a source of questionable reliability. The record evidence, the testimony of the Government’s witness, and Applicant’s testimony raise doubts about Applicant’s reliability, trustworthiness, and judgment. Applicant did not disclose, at the very least, that she was knowingly transmitting placeholder ROIs to meet deadlines. Despite her denial that she falsified ROIs on various occasions by stating she had interviewed someone when, in fact, she had not, the record evidence demonstrates otherwise. I did not find Applicant to be candid or credible at the hearing. Her testimony was inconsistent, in contradiction of the record evidence, and not credible in light of the record evidence. None of the above mitigating conditions apply.

Under the whole-person concept, the administrative judge must evaluate an applicant’s eligibility for a security clearance by considering the totality of the applicant’s conduct and all relevant circumstances. The administrative judge should consider the nine adjudicative process factors listed at AG ¶ 2(d): (1) the nature, extent, and seriousness of the conduct; (2) the circumstances surrounding the conduct, to include knowledgeable participation; (3) the frequency and recency of the conduct; (4) the individual’s age and maturity at the time of the conduct; (5) the extent to which participation is voluntary; (6) the presence or absence of rehabilitation and other permanent behavioral changes; (7) the motivation for the conduct; (8) the potential for pressure, coercion, exploitation, or duress; and (9) the likelihood of continuation or recurrence. Under AG ¶ 2(c), the ultimate determination of whether to grant eligibility for a security clearance must be an overall commonsense judgment based upon careful consideration of the guidelines and the whole-person concept. I considered the potentially disqualifying and mitigating conditions in light of all the facts and circumstances surrounding this case. I have incorporated my comments under Guideline E in my whole- person analysis. Overall, the record evidence leaves me with questions and doubts as to Applicant’s eligibility and suitability for a security clearance. I conclude Applicant failed to mitigate the personal conduct security concerns.

Formal findings for or against Applicant on the allegations set forth in the SOR, as required by section E3.1.25 of Enclosure 3 of the Directive, are: Paragraph 1, Guideline E: AGAINST APPLICANT Subparagraphs 1.a - 1.b: Against Applicant

________________________ In light of all of the circumstances presented by the record in this case, it is not clearly consistent with the national interest to grant Applicant’s eligibility for a security clearance. Eligibility for access to classified information is denied. Candace Le’i Garcia Administrative Judge