Loading case…

ISCR Case ISCR Case No. 22-02555 · CASE

Case record

A decided public DOHA case, shown for research, not advice or a prediction.

Decision Date5/26/2026
Statusdenied
LevelHEARING
TypeSTANDARD ISCR
Participants
Government Counsel: Andrea Corrales, Esq.
Judge: Eric C. Price
Guidelines Evaluated
- KHandling Protected Information · Against Applicant
Questions about ISCR ISCR Case No. 22-02555, answered from its own record: what was alleged, what the judge found, where it says so. Descriptive only; never advice.

Similar decisions
Other decisions whose allegations read most like this one. Descriptive similarity of the allegations only, not a prediction.
Finding similar decisions…

ISCR Case ISCR Case No. 22-02555denied

Case Headnote

ISCR Case No. ISCR Case No. 22-02555

deniedMay 26, 2026· Hon. Eric C. Price· hearing

Synopsis

The applicant, a 40-year-old cybersecurity lead with a history of security clearance, faced allegations under Guideline K related to mishandling protected information while serving as a media custodian. Despite his extensive experience and positive feedback from some supervisors, the judge found that the applicant failed to maintain proper media logs and did not adequately address security compliance issues, leading to the denial of his security clearance.

Why the Applicant Was Denied

The applicant failed to maintain proper media logs as required by his position as media custodian.
There were systemic failures to comply with SAP Insider Threat Program Guidance during the applicant's tenure.
The applicant's relationship with security personnel was strained, contributing to the perception of non-compliance with security regulations.

Conditions Referenced

Disqualifying

K.1raisedUnauthorized Disclosure of Protected Information
K.2raisedFailure to Comply with Security Regulations

Key Rule Quoted

“The TPI Media Custodian shall maintain a removable media log IAW the sample template provided in Enclosure 1 to Enclosure 4.”

Procedural Posture

SOR issuedMar 28, 2023
Answer filedApr 19, 2023
Hearing heldDec 9, 2010conducted via Microsoft Teams
Decision dateMay 26, 2026

Cite For

Failure to Maintain Media Logs Under Guideline K
Systemic Failures in Compliance with Security Regulations
Impact of Strained Relationships on Security Clearance Decisions

Editorial summary generated for research. Not legal advice; not a prediction. Verify against the full decision before relying on any quoted language.

Standardized Decision Profile

SEAD-4 Guideline K (Handling Protected Information) · descriptive summary of a decided case

Posture: Decision on RecordDecided: denied

The judge found multiple allegations under Guideline K concerning the handling of protected information. The applicant admitted some allegations but was ultimately denied security clearance due to significant failures in maintaining media logs and other security protocols, which were deemed to have security significance.

1.a–1.g 7 sub-charges: specific text not stated in this decision (5 against, 2 for the applicant).
Finding: Mixed
Type:
Response:
Disqualifying (¶34): —
Mitigating applied (¶35): —
Mitigation: —
1.h From at least December 2020, until at least March 2021, you failed to properly maintain media logs as required by your position as designated media custodian.
Finding: Against Applicant
Type: Failure to Safeguard or Secure
Response: Denied
Disqualifying (¶34):
(g) any failure to comply with rules for the protection of classified or sensitive information
Mitigating applied (¶35): —
Mitigation: —
1.i–1.l 4 sub-charges: specific text not stated in this decision (for the applicant).
Finding: For Applicant
Type:
Response:
Disqualifying (¶34): —
Mitigating applied (¶35): —
Mitigation: —

¶	Allegation	Finding	Type	Response	Disqualifying (¶34)	Mitigating applied (¶35)	Mitigation
1.a–1.g	7 sub-charges: specific text not stated in this decision (5 against, 2 for the applicant).	Mixed			—	—	—
1.h	From at least December 2020, until at least March 2021, you failed to properly maintain media logs as required by your position as designated media custodian.	Against Applicant	Failure to Safeguard or Secure	Denied	(g) any failure to comply with rules for the protection of classified or sensitive information	—	—
1.i–1.l	4 sub-charges: specific text not stated in this decision (for the applicant).	For Applicant			—	—	—

Descriptive standardized rendering of a decided public case (Guideline K). The verbatim source decision is shown in full below.

Full decision

The complete, official text, footnotes and signatures included, is in the original PDF.

Decision text, by section

DEFENSE OFFICE OF HEARINGS AND APPEALS

HEARING

APPEARANCES

or Security Clearance ) Appearances For Government: Andrea Corrales, Esq., Departmen

DECISION

Counsel For Applicant: Ronald C. Sykstus, Esq. 05/26/2026 Decision PRICE, Eric C., Administrative Judge: This case involves security concerns raised under Guideline K (Handling Protected Information). Eligibility for access to classified information is deni

STATEMENT OF CASE

d. Statement of the Case Applicant submitted a security clearance application (SCA) on November 10, 2021. On March 28, 2023, the Defense Counterintelligence and Security Agency (DCSA) sent him a Statement of Reasons alleging security concerns under Guideline K. The DCSA acted under Executive Order (Exec. Or.) 10865, Safeguarding Classified Information within Industry (February 20, 1960), as amended; Department of Defense (DOD) Directive 5220.6, Defense Industrial Personnel Security Clearance Review Program (January 2, 1992), as amended (Directive); and the adjudicative guidelines (AG) promulgated in Security Executive Agent Directive 4, National Security Adjudicative Guidelines (December 10, 2016). Applicant answered the SOR on April 19, 2023, and requested a hearing before an administrative judge. The case was assigned to me on June 10, 2024. On July 26, 2024, the Defense Office of Hearings and Appeals (DOHA) notified Applicant that the hearing was scheduled to be conducted via video teleconference on August 27, 2024. On

August 19, 2024, Department Counsel requested a continuance because of a medical issue with the Government’s only witness. I found good cause for a continuance and ove

FINDINGS OF FACT

Applicant’s objection approved Department Counsel’s request. (Hearing Exhibit (HE) I) After consultation with counsel including reconciliation of witness availability, the hearing was scheduled for December 9-10, 2024. (HE II) I convened the hearing as rescheduled using the Microsoft Teams video teleconference system. The hearing was conducted on December 9, 10 and 13, 2024. Department Counsel called four witnesses and Government Exhibits (GE) 1 through GE 11 were admitted in evidence without objection. (Transcript (Tr.) 22-27; HE III) Applicant testified, called five witnesses and offered Applicant Exhibits (AE) A through AE QQ. (HE IV) AE A, AE B and AE D through AE QQ were admitted without objection. I sustained Department Counsel’s objection to AE C, an unsigned statement, and later admitted AE OO, a signed version of the same statement. (Tr. 308-311, 713-719) I kept the record open so the parties could submit additional documentary evidence. (Tr. 850-853) Applicant submitted AE RR through AE UU and Department Counsel submitted GE 12 and GE 13, which were admitted without objection. (HE V) DOHA received the transcript on December 27, 2024, and the record closed on January 29, 2025. Findings of Fact The SOR includes 12 allegations under Guideline K. In his answer to the SOR, Applicant admitted the allegations in SOR ¶¶ 1.cand 1.l, with explanations, and denied all other allegations with explanations. (SOR Response) At hearing, he expressed concerns about SOR ¶ 1.c, and I have treated his concerns as a denial of that allegation. (Tr. 433-34, 548-49) Applicant’s admissions are incorporated as findings of fact. Applicant is a 40-year-old cybersecurity lead employed by a defense contractor since September 2019. From December 2008 to September 2019, he was employed by other defense contractors in various information system administration and security positions including as a system and network administrator, communications security (COMSEC) officer, cybersecurity analyst and lead. He earned a bachelor’s degree in management information systems and a master’s degree in cybersecurity. He has obtained multiple certifications including Certified Information System (IS) Security Professional. He was engaged to be married at the time of his hearing and co-parented his fiancée’s four children. He has held a security clearance since 2008. His Special Access Program (SAP) access was suspended by a service SAP central office (SAPCO) in August 2021. (GE 1, GE 10, GE 11 at 5; AE F, AE X; Tr. 315-24, 414, 794-795) In September 2019 Applicant was assigned as a contractor employee in a program management office (PMO) for a military organization (organization) under a program manager (PM1). At the time, the organization had no in-house cybersecurity team, and the PMO was standing up a special program office. Applicant was brought in to support cybersecurity requirements and IS capabilities. His primary duties were as IS Security Manager (ISSM) and included responsibility for ensuring PMO IS and information technology (IT) compliance with SAP regulations. (GE 1; AE H, AE U, AE X; Tr. 45-46) 2

In about March 2020, Applicant was also appointed as the two-person integrity (TPI) media custodian (hereinafter media custodian) for several IS in a SAP facility (SAPF) that supported the PMO. (AE U, AE X) Media custodian duties had previously been performed by security personnel or contractors but assigned personnel requested to be relieved of those duties. Applicant reluctantly accepted and protested being assigned as the “‘lone media custodian’ because he did not want to be a single point of failure[.]” (AE X at 10; Tr. 355) He was selected for this role in part because of his outstanding reputation for mission-accomplishment and professional knowledge. Duties as media custodian include establishing control of media upon entry into the SAPF and accountability for all such media until destruction in accordance with applicable regulations. His primary office and the SAPF were in the same building about five minutes walking distance apart. (Tr. 454-71, 708-09, 721-32; AE H) Applicant’s media custodian duties required frequent interaction with security personnel including the program security officer (PSO). PSOs manage the security, compliance, and access for SAPs including enforcement of policies, approval of access, management of SAPF physical security, and oversight of classified document control. (Tr. 31, 346, 453, 515-517) The working environment in the secure spaces including the SAPF was described as fast paced and affected by professional and personal conflicts. (GE 11; AE H, AE SS-TT; Tr. 96-97, 119-128, 156-160, 199, 237-38) Applicant had a good relationship with some security personnel but not with others including PSO1 and PSO2. He initially had a good personal and professional relationship with PSO2, but the relationship deteriorated after PSO2 was appointed as PSO with responsibility for the SAPF in December 2020. (GE 11; AE H, AE SS-TT; Tr. 447-49) In July 2020, Government Witness 1 (GW1), a GS-13 security professional was hired as PSO for a pr

ogram office with oversight authority over the PSO for the program Applicant supported. (Tr. 31, 42-51, 130-131; AE H at 3, AE M at 4) When GW1 reported aboard there was tension between Applicant, PMO leadership and security personnel over an IS developed by Applicant. Security personnel including GW1, PSO1, and PSO2 believed: Applicant had not provided requested paperwork; he misrepresented that the IS had been granted authority to operate (ATO); he was operating the IS on a SAP system before receipt of an approved ATO constituted a potential security violation; and they sought to shut the system down pending investigation. These tensions culminated in a contentious meeting between program stakeholders and representatives of other organizations and contributed to tensions between Applicant and some security personnel. (GE 11, GE 13; Tr. 32-44, 404-05, 420-21, 570-74, 593-97; AE H, AE X at 5- 6, AE UU) At the time, there was an approved change request for the IS but not an approved ATO. Ultimately no security violation was found, and the IS was permitted to continue operating. (Tr. 70-71, 404-06, 571-74; AE TT) Applicant testified PM1 and PM2 (program manager of another program in the PMO, senior SAPF leader, and Applicant’s primary point of contact for SAPF matters) said he “did a fantastic job”, the SAPCO said “this is fine”, and that he received a “commendation from [his employer]” because program leadership said “[he] did a great 3

job.” Applicant testified that if he “did not do the appropriate documentation” for the IS he “would not have kudos. I don’t even know if I’d have a job.” (Tr. 405, 462-63) After the hearing he submitted a statement from PM2 confirming there was no security violation and noting that after the contentious meeting they developed a plan to get the final ATO approved. PM2 informally counseled Applicant because he failed to submit final ATO paperwork after previously being asked to follow up on it. PM2 counseled Applicant not to let it happen again and stated Applicant told him COVID hit shortly after their change request had been approved, and the final paperwork “fell through the cracks.” (AE TT) Applicant was out of the office with COVID-19 from late December 2020 until mid- to-late January 2021 or February 2021. (SOR Response; Tr. 334, 710-12; AE F at 6) He said he was out “well into January” and later said “out the month of January effectively into February, at least put into a position where I could only work from home. I was not able to reenter the building until middle of February.” (Tr. 334, 752-53) A friend and colleague who worked closely with Applicant estimated he was out for “approximately two weeks” in the January 2021 timeframe. (Tr. 700-13) Applicant’s Witness 1 (AW1), Applicant’s friend and SAPF colleague, stated he returned to the office in “the mid-to-late January timeframe.” (Tr. 113; AE F at 1-6, AE X) While working remotely Applicant only had access to unclassified email and a telephone. (Tr. 764-65) I expressed interest in documentary evidence t o determine how long he was out of the office with COVID and Applicant said he could probably submit emails or time sheets but did not do so. (Tr. 756- 57, 775-76) In February 2021, after learning Applicant was serving as media custodian, GW1 informed PSO2 that he should not be both the media custodian and ISSM because the “purpose of the insider threat program is to make sure that your media custodian doesn’t have the privileges that an ISSM would have.” (Tr. 45-53, 143-45, 217-219) Around the same time, PSO2 determined Applicant committed a security infraction and facilitated the appointment of program security office personnel as media custodians. (GE 4 at 1-2) By memo dated February 23, 2021, PM1 appointed a program security office member as media custodian and two others as alternate media custodians including PSO2. (AE U) The exact date media custodian duties were transferred to security is unclear. Applicant contends duties were transferred on February 23, 2021, and memos from April and May 2021 state media custodian duties were transferred in March 2021, and on March 8, 2021. (Tr. 365, 431, 440, 488, 556; GE 6 at 2, GE 7 at 4, GE 8 at 1) In March 2021, after media custodian duties were transferred, security personnel “discovered systemic failures to comply with [SAP] Insider Threat Program Guidance.” (GE 6 at 2) PSO2 with PM1 concurrence requested GW1 assess media control documentation and processes. GW1 forwarded her review to PM1 by memorandum dated May 3, 2021. (GE 6-7) The review identified discrepancies in media control documentation and implementation of SAP insider threat guidance, and recommended corrective actions including that PM1 address the discrepancies before an Inspector General (IG) visit scheduled for September 2021. (GE 6-7; Tr. 150-152) 4

From April 28 to July 29, 2021, three preliminary inquiries were conducted by program security personnel into 12 suspected security incidents attributed to Applicant and forwarded to SAPCO. (GE 2-5, GE 8-10) Most matters addressed in the preliminary inquiries had been noted in GW1’s review and forwarding memo. (GE 6-7) Most SOR allegations relate to Applicant’s duties as media custodian and allegedly occurred while COVID-19 protocols were in effect. Applicant asserted his lack of media custodian training (notwithstanding his requests), and the lack of an approved SAPF standard operating procedure (SOP) resulted in varying policy interpretations and conflicts between program personnel. (Tr. 362-63, 782-94) He cited a fast-paced working environment, constrained timeline, lack of experience and personnel turnover as contributing to strained relationships between security and cybersecurity. He said his predecessor media custodian provided incomplete records and that security concerns prevented him from auditing all media in the SAPF. Specifically, he said PSO1 and PSO2 denied or ignored his requests for access to some safes and rooms or to audit media stored therein because he lacked the required clearance or need-to-know certain information or cited a lack of security staffing. (SOR Response; AE X at 9-10, AE NN, AE QQ at 4; Tr. 338-40, 354-56, 389-91, 460-78, 551-63, 623, 733-39, 761-63, 782-94) Applicant also alleged PSO2 unfairly targeted him and expressed concerns about the investigative process and reporting to SAPCO and DCSA. He cited tensions with PSO2 including her history of escalating matters, avoiding accountability, and influence over others involved in the inquiries. He suggested PSO2 made good on threats to get his security clearance revoked even if she had to manipulate evidence. (SOR Response; AE X; Tr. 347-49, 410-15, 489-94, 792-94) Several witnesses attested to a personality conflict between Applicant and PSO2, PSO2’s inappropriate comments about getting security clearances revoked or suspended (though most thought she was joking at the time), that some of her past allegations were unfounded, and that PSO2 sometimes elevated security concerns if displeased with initial results. (Tr. 240-41, 335-37, 412-14, 562-66, 624-26, 633-43, 702-05; AE F, AE H at 3-4, AE OO, AE SS, AE TT) PM1 and PM2 believe that PSO2 “targeted” Applicant. (AE SS-TT) PM1 opined PSO2 “used all tools available to her to resolve the situation in an unfair manner” and stated at least three investigations into SAPF security incidents raised by PSO2 and GW1 came back unfounded including an investigation of PM1 himself. (AE SS) PM1 also noted: none of the security incidents [in the program], including [Applicant’s], resulted in impacts to National Security [and stated] a couple of [Applicant’s security] incidents . . . came down to interpretation of [service] Regulations [to determine] if a security violation occurred. In these cases, I had the security team document the incident, then contact [SAPCO] for guidance. [SAPCO] determined that some incidents were violations and other incidents resulted in updated policies. This process of always documenting events is partially why [Applicant] and others had security incident memos, but not all memos turned into security violations. (AE SS) 5

PM2 stated that after counseling Applicant and PSO2 about unprofessional workplace behavior, Applicant modified his behavior but that PSO2 had not. PM2 disagreed with the conduct of the inquiries and with some findings. PM2 opined GW1 unnecessarily exacerbated PSO2’s security concerns and that PSO2 sometimes saw issues where none existed. (AE TT) Applicant and PM2 challenged the accuracy of a key preliminary inquiry, GE 8. Applicant testified that he discussed the preliminary inquiry with his friend and its author, contract security specialist (CSS). Applicant said CSS initially thought the preliminary inquiry “had it right” but after being informed there were policy disputes and reviewing the policy CSS concurred with Applicant’s assessment. (Tr. 490, 521) PM2 stated that CSS said he “would not have written the report the way it was written” but was directed by PSO2 “to change the words in the report to make [Applicant] look bad.” (AE TT at 3) GW3 testified CSS provided a statement in a “formalized inquiry” stating he had been asked to discredit PSO2, to report PSO2 had been “targeting [Applicant]” and that “these security infractions . . . weren’t as bad as they sounded [and] were being reported because [PSO2] had some sort of personal vendetta against [Applicant].” CSS “refuse[d] to oblige” the request and did not believe the derogatory statements about PSO2 were accurate. GW3 cited details from CSS’s statement, but this statement is not in evidence. GW3 noted the inquiry found no fault with PSO2’s handling of matters involving Applicant. (Tr. 230-32) Notably, GE 8 was admitted into evidence without objection, Applicant’s and PM2’s statements do not identify or contradict any specific finding in GE 8, and GW’s testimony directly contradicts most of their assertions. Applicant did not call CSS as a witness or submit a statement from him. Security personnel including GW1, GW2, and GW3 (program executive office director of security and PSO2’s senior rater) attributed tensions between PSO1, PSO2 and Applicant to Applicant’s lax attitude towards compliance with security regulations, unwillingness to provide requested information and his negative attitude towards some security personnel including PSO2. (Tr. 105-125, 158-59, 177-82, 199-202) GW3 reviewed most of the preliminary inquiries and GW1’s assessment and thought the findings and conclusions were supported by the evidence and that the inquiries were consistent with common practices. (Tr. 226-29; GE 2, 4, 6-9) PM2 confirmed PSO2 expressed concerns about losing her security clearance because of SAPF security issues. (AE TT) PSO2 expressed concerns to her supervisors about retaliation from Applicant’s supporters including PM1 and PM2 for investigating and reporting his suspected security issues. Several security professionals attested to retaliation or harassment against PSO2 and others after the suspected incidents were reported. (Tr. 105-109, 190-92, 200-205, 229-38; GE 11) I find GW1, GW2, and GW3’s testimony that PSO2 was required to forward preliminary inquiries regarding incidents involving SAP to the SAPCO, notwithstanding PM1’s or PM2’s concerns, credible. (Tr. 122-25, 156-57, 188-93, 221-28; GE 6-7) I also find GW3’s testimony that SAPCO personnel advised PSO2 to enter the security incidents into a DCSA information system after learning no reports had been entered to be credible. (Tr. 221-26; SOR Response; AE H) Given the evidence of tensions between Applicant 6

and PSO2 and GW1, PSO2’s inappropriate comments about getting his security clearance revoked or suspended, and contradictory claims regarding the fairness of the investigative process and accuracy of the various inquiries, I will conduct a thorough review of the evidence pertaining to the SOR allegations. I will address SOR ¶ 1.hfirst because it also relates to other allegations. SOR ¶ 1.h: From at least December 2020, until at least March 2021, you failed to properly maintain media logs as required by your position as designated media custodian. Applicant denied the allegation. SAPCO Insider Threat Implementation Guidance states “The TPI Media Custodian shall maintain a removeable media log IAW the sample template provided in Enclosure 1 to Enclosure 4.”1 2 (AE CC at 2 subparagraph e.(1)) (emphasis added) The “Sample TPI Media Log” includes Media Control Number - Type of Media - Date Entered Control - Date Issued - Name of Person to Whom Issued - Purpose of Issue - Data Transferred - Session Opened - Session Closed - Transfer Activity Verified - Media Disposition - Date of Disposition. The “Sample TPI Media Log” also provides a “Media Control Number” numbering convention starting with a number and year (“01-2013” and “02-2013”) and “Type of Media” samples (“CD-R” and “DVD-R”). (AE CC at 3) The media control log is used “to record all removeable media data transfers and retain the logs on file for audit purposes.” (AE CC at 2) SAPCO promulgated that “[b]ased on Insider Threat risk assessments, the [SAP] community faces the greatest security risk from information system users, particularly those with privileged status.” (AE AA at 2) Organizations are required to “develop and implement an Assured File Transfer (AFT) [SOP].” (AE AA at 3) A media custodian is required to number all media and enter the n umbers and the date the media entered control into a media log immediately upon removal of original wrapping. When issuing media, the media custodian should update the media control log to include name of person to whom the media was issued, purpose of the issue, date/time of issue and number of files being transferred. The media custodian will receive and review media upon completion of data transfer to verify the number of files transferred matches the original log entry and to ensure destruction of the media using approved methods when no longer required and then update the log accordingly. (Tr. 51-52, 141- 43, 434-40; AE AA at 4, ¶3(e)(2)(c-f), AE CC at 3) Applicant described media custodian duties as “extremely important” and including any SAPF IS that is allowed for an AFT of information, accounting for all media brought under control, marking it accordingly and maintaining a chain of custody associated with the media with a log to back that up “cradle to grave.” (Tr. 739) Media logs are normally 1 The “Sample TPI Media Log” submitted by Applicant and admitted in evidence without objection is “Enclosure 1 to Enclosure 3” vice “Enclosure 1 to Enclosure 4.” (AE CC at 2-3) The Insider Threat Implementation Guidance dated October 23, 2013, includes three enclosures and Enclosure (3) is “TPI Procedures,” therefore, the reference to “Enclosure 1 to Enclosure 4” appears to be a scrivener’s error. I consider the “Sample TPI Media Log” in evidence to be authentic. (AE CC at 3) 2 Applicant misidentified the Insider Threat Implementation Guidance dated October 23, 2013 as AE DD vice AE CC. (Tr. 352, 431, 743; AE CC, AE DD) 7

maintained on a c omputer network or on paper or in a handwritten log. (Tr. 255-56, 758- 59) Applicant decided t o maintain a media log on IS1, a Top Secret network because he wanted to use an available network that was regularly backed-up and because his predecessor as media custodian requested that he do so. (Tr. 758-62) A media log is normally unclassified but takes on the classification of the IS it is stored on until declassified. (Tr. 748) GW3 was unaware of a requirement to backup media logs. (Tr. 255-56) A data transfer agent (DTA) conducts AFTs and is responsible for securely moving, reviewing, and sanitizing data across different security domains or classification levels. A data transfer questionnaire (DTQ) is provided by the media custodian to the DTA, who fills in most fields. After the DTA conducts a data transfer, the DTA fills in the remainder of the DTQ and brings it and the media back to the media custodian who verifies the number of files on the media and disposition information. The eight DTQs in evidence are scanned copies of forms filled in with handwritten information and are discussed in detail under SOR ¶ 1.c. (AE W; Tr. 583-86, 745-47; GE 7 at 1) A preliminary inquiry conducted by CSS (a subordinate of PSO2) found that prior to security personnel taking over as media custodian in March 2021: there is no previous Media Control Database on record. [Applicant] explained no Media Control Database exists due to multiple system crashes. No Media Control Database was rebuilt from latest system crash on December 21st 2020 until the March 2021 timeframe [when the new media custodian established one]. At this current time no Previous Media Control logs exist on record prior to March 2021. See References A [Applicant’s MFR dated June 2, 2021] & B [Applicant’s MFR dated March 23, 2021 “Subject: Media Custodian/Disposition Logs – Data Loss”]. (GE 8 at 1-2; GE 6, GE 7 at 1) GW1’s assessment and report noted “No incoming media logs were maintained as required” by insider threat guidance. (GE 7 at 1, 2, 4, GE 6) Applicant reported losing historical media control logs due to hard drive failures on different workstations on August 20, 2020, and December 21, 2020. (GE 6, GE 7 at 1) The assessment questioned the date of the August 2020 hard drive failure “because the actual replacement hard drive for that workstati

POLICIES

nwas brought into accountability 24 June 2020 . . . before [Applicant] said it failed and he lost his data.” (GE 7 at 1; Tr. 68-69) In response to the SOR Applicant explained that: Media logs were maintained in accordance with established policy and procedures. . . . However, in or around January of 2021 the primary computer used to store the logs and associated media disposition forms suffered a hardware failure. Despite efforts to recover the system, all files and records were lost including the media logs. All available historical 8

documentation – to include paper copies of media forms – were used to support recreation of the media logs to as accurate a level as possible. Despite those efforts, there were several pieces of media for which logs could not be regenerated. A Memorandum for Record (MFR) was created to document this event, and ac

companied the documentation transitioned to the cognizant security authority . . . during the change of media control duties. (SOR Response at 8) Applicant testified he made a digital copy of the “template for a media log” from the insider threat guidance which he stored on IS1, and “had a physical copy that [he] maintained in conjunction with the [DTQs].” (Tr. 352) He used “the sample template” media log from the Insider Threat Guidance to create “an Excel spreadsheet” and kept it on a standalone workstation on IS1 from January 2020 until August 2020. (Tr. 351-52, 740-48, 820) His three requests for access to an automatically backed up network shared drive were denied by PSO1 and PSO2, who cited concerns about granting him access to a drive with informat

ANALYSIS

on he was not authorized to access. (Tr. 344-47, 515-21, 734-39) He said the media log and other disposition records were lost when the hard drive failed in August 2020 because it was not backed up to a shared drive. (Tr. 345-52, 740-48) After the August 2020 hard drive failure, he tried to manually duplicate the records based on information pulled from paper records including DTQs. (Tr. 517-19) “I had some written down. Like I mentioned [the DTQs] were fairly extensive so they included a lot of the documentation and data that comes from that needs to be included on the media log. . . . So, I maintained a digital media log that was in the same templatized format as the one that I showed you and the [DTQs] had the requisite data to fill that out.” (Tr. 517-18) Applicant claimed that after the August 2020 hard drive failure he “recreate[dthe media logs to] the best of my ability based on all the information we pulled from the paper records.” (Tr. 518) He said that he manually duplicated the records and “created a digital log on [IS1 and IS2] because I didn’t have access to the shared drive on [IS1]. My back up strategy was trying to manually duplicate the records on [IS1 and IS2]. But it wasn’t long after that that PSO2 took over the media custodian duties and I handed over everything I had.” (Tr. 517-19) He estimated it took him a week or more to recreate the media log from DTQs and other available information after the August hard drive failure. (Tr. 811-12) The standalone local workstations were not backed up because they were top secret. He was frustrated and angered by the loss of his “media custodian logs because [security] wouldn’t give [him] access to the shared drive [which he conveyed via email].” (Tr. 344-47, 515-21, 737, 810-12) Applicant testified he maintained the media log “in accordance with policy and procedures, but in January [2021] the computer hard drive did crash. I then took the [DTQs] that I had on paper for them, and provided them . . . to reconstitute the logs to the best of my ability. In February when the transition of the media custodial duties was done, I handed all those logs over to [PSO2 and security].” (Tr. 440-41; SOR Response at 8) In a written statement, he indicated the hard drive “failure occurred while [he] was out of the 9

office due to a severe bout of COVID” but testified that it occurred shortly before he was out sick with COVID and believed that it occurred on December 21, 2020. (AE X at 7-8; Tr. 521, 544-45, 750) A preliminary inquiry citing two MFRs from Applicant indicates a hard drive crash occurred on December 21, 2020. (GE 8 at 1-2) He testified that the hard drive failure occurred when a colleague was imaging his standalone computer’s hard drive on IS2 while attempting to migrate the data to IS3. (Tr. 750-52) I informed Applicant the record did not include a statement from his colleague, and he responded “I can get that to you” but did not do so. (Tr. 757-58) Applicant testified he maintained or recreated media logs from paper copies including DTQs and turned them over to security. (Tr. 347-50, 435-36, 517-21, 544-45) He said that he recreated the logs as best he could “in January [2021]” and then created a digital version that he transferred to security in February 2021. (Tr. 544-45) “As soon as I came back [from COVID], I tried to fill out the media custodial log to show TPI accountability. Right? [The DTAs] had destroyed one of the disks, which you know, I can’t maintain the log if they’ve destroyed the disk, so I can’t [show disposition]. So I wrote an MFR to [PM2], [PSO2] and others assigned to security[.]” (Tr. 755-56; AE GG) In a written statement he indicated that he “attempted to recreate the media control logs based on paper logs but had limited time and resources to perform the action before media control was turned over to security[.]” (AE X at 8) In response to questions about why an investigation determined no database was rebuilt from December 2020 until March 2021 Applicant responded “There wasn’t a database. . . . It was just a digital Excel spreadsheet. I provided that to [the newly appointed media custodian from security]. It was on [IS2 and IS3].” (Tr. 544-46, 820) Claims “that there were no logs and that I did not transfer over any logs to Security. That’s just unequivocally false and untrue. I literally have Exhibit W, that shows DTQs.” (Tr. 740) He asserted the “problem is that the source [PSO2] tainted the information. . . . I did give security media logs, because I did keep them manually. I had data transfer questionnaires, the DTQ’s they mentioned. I was able to rebuild those logs. And I provided it to security.” (Tr. 347) “[A]tthat time it was transitioning over so what I did was, I took the digital logs that I had . . . on the other system. I had reconstituted the majority of the logs from . . . the paper DTQs. And I scanned them in and I submitted them all to security[.]” (Tr. 521) Applicant testified AW1, as ISSM for IS3, “could attest . . . to the existence of those logs on [IS3].” (Tr. 545-47) He also identified two program security personnel who could attest to the existence of the logs, including the security specialist he transferred media custodian responsibilities to and CSS. (Tr. 544-48) Applicant did not call his successor as media custodian or CSS as witnesses or submit a statement from either. On direct examination AW1 testified Applicant maintained media logs “on a spreadsheet using the format that’s outlined in the Insider Threat Policy Guidance” until a hard drive failure in about August 2020. (Tr. 569) He said that after hard drive failures in August and December 2020 “there are logs on [IS3] . . . media logs for media that was issued from August to, I think, up to February, when the media custodian duties 10

transferred over to security.” (Tr. 569) During cross-examination, AW1 acknowledged he had not seen a media log in IS3 for the period August 2020 to February 2021. He believed he had seen a media log for the period prior to August 2020 in “spreadsheet format, very similar to the template that’s prescribed in the example that they give you from the insider [threat] policy.” However, for the period from August 2020 to February 2021, he saw only scanned copies of DTQ’s and confirmed Applicant uploaded those files. (Tr. 583-88) “[AW1 did not] believe there’s a spreadsheet media log on [IS3]. I think it’s just, it’s just the scans of the DTQ’s.” (Tr. 587) In January 2024, AW1 wrote Applicant “provided [security] all available historical artifacts to allow for recreation of the lost logs [and] [i]tis accurate to state that upon media custodian role transition no consolidated media log existed, and that it had to be recreated from historical documentation.” (AE F at 6) He believed Applicant scanned DTQ’s onto the shared IS while updating the media log to ensure redundancy in case of another failure based upon his discussions with Applicant. (Tr. 601-607; AE F at 6) Applicant testified a DTQ includes essentially the same information as a media log, “it maps out, especially on outside transfers every single field that’s filled out in that form maps to the -- the requirements by SAPCO.” (Tr. 741-42) The DTQs “included a lot of the documentation and data that . . . needs to be included on the media log.” (Tr. 517-18) AW1 testified a DTQ captures everything required in a log and that he would think it would satisfy SAPCO policy requirements for a media log. (Tr. 601-607) AW1 testified: So for all intents and purposes, the DTQ’s can be seen as the log . . . it’s just not in a spreadsheet format. . . . So the insider threat policy has a sample template that most programs use. . . . It’s an Excel spreadsheet that . . . you can use to input the data for your media logs. But everything that’s [in] those fields are also transferred in the DTQ’s. So the information is there. Now, there was not a spreadsheet associated with all of those DTQ’s. That was not there. But the source files for them are there. (Tr. 586-87) AW1 testified that maintaining media logs from DTQ’s is “not a best business practice” and asserted “spreadsheets . . . are a little bit more of an effective way to do it. But you know, if the purpose is to meet the intent of the policy, I would argue that the DTQ’s meet the intent of that policy.” (Tr. 585-88, 605-07) When asked how DTQ’s could be a reasonable substitute for a media log required by the SAPCO, AW1 responded: all of the pertinent information in the insider threat policy is captured on the DTQ’s. The other thing is the example template that’s provided is just that, it’s an example template. There’s no requirement for organizations to use that template. It’s really just a sample of hey, this is what we think this should look like. (Tr. 605) 11

In her assessment, GW1 recommended attempting “to recreate a historical media log using the [DTQs] on [IS3], which were uploaded August 2020 to February 2021.” (GE 7 at 1) The DTQs “could be used to recreate [a media log] as much as possible.” (Tr. 72) The DTQ’s provide “derivative documentation to re-create the log” and provide some historical data but “we . . . couldn’t track the media as far as what number are you on, what’s the title, how many logs, etc. and then you really -- without these media logs you don’t know if you have an insider threat problem.” (GE 7 at 1; Tr. 68, 83) GW1 did not see media logs created by Applicant or recreated from the DTQ’s. (Tr. 51-77, 134-38) After AW1 testified, Applicant was asked what he did to recreate the media log after the December hard drive failure and responded: “I would say that -- I was not given the opportunity beyond uploading the DTQs. We scanned -- All I was able to do given the sickness, given the investigation, given the series of meetings that we had to talk about the discrepancies. . . . The reconstitution of the logs would have occurred on [IS3] . . . I uploaded all the scanned DTQs into [IS3]. My next step would have been to reconstitute those logs to the best of my ability on [IS3], which was a fully compliant backed up solution.” (Tr. 766-67) He then said the media distributed at the direction of PM2 and PSO2 while he was out sick with COVID was the only media transfer conducted after the December hard drive failure until media custodian duties were transferred. (Tr. 766-68) The following colloquy occurred shortly thereafter: [Administrative Judge] Okay, now, earlier, you indicated that the people were not being completely honest with respect to what they discovered in their investigation. Help me understand what’s not honest, because now you’re referring to the government exhibits with respect to there being no media logs during that time period, specifically. So what did you mean? [Applicant] So it was my understanding that there was some log that was transitioned over, but now that we’ve discussed, the, as you’ve heard from [AW1’s] testimony, right, and mine, I consider the DTQs to be substantive for, you know, for the logs necessary to recreate for the media custodian. But I understand security’s point that they’re saying they didn’t. If they're trying to say they didn’t receive logs, my interpretation, understanding of that accusation was we didn’t give them. Because they, because they said that to us. They said we gave them nothing. [Administrative Judge] I’m not going to parse words with you here, but the distinction between the log and a document that’s a backup document is, I’m not sure we need to. Are you telling me that you think providing DTQs equals providing logs? [Applicant] I do not believe that that constitutes. I agree with you, Your Honor. Like, I don’t think it’s a one for one match. It’s a form that has data that could be used to create a log. It is not a log. 12

[Administrative Judge] Okay, that’s a distinction with [a] difference. But I understand your position and I understand your testimony that you were using the DTQs to reconstitute. There were no further transfers. And at the time you transferred over to [security] you actually provided the DTQs, which in your mind means that you provided some information from which a log could be recons[tituted]. [Applicant] Yes, Your Honor. [Administrative Judge] Okay. I understand and I’m not disputing the logic of that, but the difference between a log and a document that includes most of the information you would have in a log does not equal [a] DTQ, [and a DTQ] does not equal a log. [Applicant] I understand that distinction now. . . . I agree that explicitly I was taking the accusation to mean we did not give them anything based on conversations and emails where it stated that we didn’t give them anything. The accusation states no incoming media logs, you know, were provided. So I understand the distinction. We did give them the DTQs. I was hoping that I could support them and help that transition to help reconstitute the logs with that . . . to support the transition of duties. . . . And I wanted to provide them all the necessary evidence…necessary artifacts and documents to support that transition. I did not give them a log due to the failures. I gave them DTQs and the media that I had. So I do understand the distinction. (Tr. 772-75) (emphasis added) Applicant testified that over the entire time he served as media custodian he distributed approximately “60 or so” pieces of media. When he took over as media custodian: the spindle that they gave me was partially exhausted and it really had very minimal left. I unwrapped and marked an entire full spindle . . . which was 50. And like the DTQ -- so obviously we’re having an extremely hard time pulling them off of the Secret SAR information system, but I did speak with the administrators of [IS3] and they do have records from like the time period that’s cited I failed to do my duties to show . . . here are DTQs. . . . And the number that they said was consistent with what I believed to be, like 60 or so. (Tr. 749) Applicant testified AW1 and his team were trying to obtain copies of DTQs scanned to IS3 and working with security to approve the export of those logs or DTQs. (Tr. 749- 50) However, he did not submit any additional DTQs or request more time to do so. 13

Applicant’s claim that a DTQ includes essentially the same information as a media log and could be used to recreate a media log that satisfies SAPCO requirements is corroborated in part and refuted in part. A DTQ may be used to substantially re-create a media log because it includes much but not all data required to be maintained in a media log by the media custodian. However, a DTQ includes derivative documentation prepared by a DTA, not the media custodian, and the DTQs in evidence do not show the number of logs, the number of media entered into control or when the media was entered in control and include insufficient information to determine if there is an insider threat problem. Notably, in his SOR response, Applicant acknowledged there were several pieces of media for which logs could not be regenerated from historical documentation including DTQs. Two of the eight DTQs in evidence do not include information essential to a media log (one fails to identify where data was transferred to (i.e. purpose), and another fails to identify the date and time of media disposition). (AE W at 1, 3) No media logs exist for the entire timeframe Applicant served as TPI media custodian. His claims that he maintained media custodian logs in a spreadsheet consistent with SAPCO requirements from February 2020 until a hard drive failure in August 2020 are corroborated in part by AW1’s testimony. However, available evidence shows that, at a minimum, he did not use the “Media Control Number” or “Type of Media” conventions specified in the Sample TPI Media Log. Applicant’s claims that he recreated and maintained media custodian logs in a spreadsheet consistent with SAPCO requirements after an August 2020 hard drive failure until a second hard drive failure in December 2020 are unsupported by other evidence. Applicant’s claims he used available documents including DTQs to reconstitute a media log in a spreadsheet consistent with SAPCO requirements after a December 2020 hard drive failure and provided those logs to security are untrue. His belated admission that he did not provide security with media logs but instead provided digital copies of DTQs from August 2020 to February 2021 is corroborated by other record evidence. This allegation is established. SOR ¶ 1.a: In or around 2020 and 2021, while the designated media custodian, you failed to v erify and/or log virus scans on incoming media. Applicant denied this allegation. Applicant acknowledged that virus scans are required to be performed on incoming media and asserted automatic organizational virus scans conducted on media inserted in organization IS after media was issued satisfied virus scan requirements. During his time as media custodian this was accomplished via tracking of information system ATO documentation that required malicious code protections under DoD risk management policies. He acknowledged that he did not conduct virus scans on incoming media prior to issuing it to DTAs. He asserted that logging of virus scans for incoming media is not required. (SOR Response at 2-3; Tr. 350-51, 428-31, 530, 795-810; AE-X at 8) SAP insider threat guidance requires media custodians to “[e]nsure all incoming media is scanned for malicious code,” and SAP organizations are required to “[s]can all 14

media upon issue by the TPI media custodian with an authorized antivirus product when initially connected/re-connected to an information system.” (AE AA at 4 ¶¶ (1)fand (2)a) The DoD Joint SAP Implementation Guide (JSIG) requires organizations to “employ malicious protection mechanisms at [IS] entry and exit points to detect and eradicate malicious code [including] “real-time scans of files . . . as the files are downloaded, opened, or executed.” (AE BB at 6) A preliminary inquiry dated June 30, 2021, found “no records on file to ensure virus scans were being performed” and noted Applicant stated “information systems perform virus scans on media by default.” (GE 8 at 2 citing Applicant’s MFR dated June 2, 2021) In April 2021, GW1 concluded media scans were not conducted as required and noted there was not a current SOP for media scan requirements. (GE 6, GE 7 at 2) GW1 testified she had not asked Applicant for proof automated scans were performed and acknowledged automatic virus scans would satisfy requirements for scanning incoming media when initially connected to or reconnected to an information system. Regulations do not require media custodians to log completion of virus scans on incoming media. (Tr. 51-53, 73-74, 133-36, 246-49; AE AA) GW3 confirmed the ISSM runs reports on what has been introduced into the system and was responsible for virus scans on the system. (Tr. 246-49) PM2 and AW1 confirmed media was automatically scanned upon insertion into a system computer and PM2 stated he was unaware of any program office doing a separate virus scan on newly opened media. (AE TT, AE F at 6-7; Tr. 33) Automatic virus scans run when media was initially connected or reconnected to an IS satisfied JSIG and SAP insider threat virus scan requirements. As ISSM, Applicant was aware of and responsible for virus scans run on the system. As media custodian he was not required to log virus scans on incoming media. This allegation is decided for Applicant. SOR ¶ 1.b: In or around 2020 and 2021, while the designated media custodian, and without authorization, you improperly issued bulk media for future use or for no specific purpose. Applicant denied this allegation explaining: Issuance of multiple (i.e., bulk) media is not prohibited by policy; official appointment as a media custodian authorizes the designated individual to issue media – no further authorization is required nor stipulated. “Purpose of issuance

WHOLE PERSON CONCEPT

is required to be tracked, and a media form was created and utilized for this purpose. The media form accompanied the media upon issuance and was used to update the media log. Data Transfer Agents (DTAs), at times, need to move data between multiple security domains requiring multiple media. Additionally, mission requirements often dictate the issuance of multiple media to meet deadlines or minimize operational impacts. Additionally, during this period I was the only designated media custodian supporting the office, and therefore a single point of failure. This issue was raised to management but was not 15

rectified until February 23, 2021, when the role of media custodian was transferred to the cognizant security authority and two security support staff members. This resulted in several occasions where critical milestones were at risk, and media had to be issued in my absence. (SOR Response at 2-3) Applicant testified a media custodian can issue bulk media, but “you cannot issue it without a purpose.” He denied issuing media without a purpose, said you have to record the purpose, and provided examples such as an “assured file transfer” or “move data from SIPR to NIPR to SIPR.” (Tr. 477-78) He said that issuance of more than one CD was necessary because there were four IS and a transfer on each IS required a different piece of media. (Tr. 353) When asked about issuance of bulk media for future use, Applicant responded “I guess it depends on what the definition of future is, so the way . . . I did it was if someone requested the media to be used to make a burn I provided it to them, with the expectation that there was an expedience to it[.]” (Tr. 531) He was unaware of a requirement that “prohibits, or where it limits or identifies the span of time in which media has to be used.” (Tr. 534) He believed “bulk issuance of media for a future use . . . was subjective based on [his understanding of] media policy and requirements.” (Tr. 541) He said in the absence of an SOP and training he followed insider threat guidance and the JSIG and was unaware of any definition of future use. (Tr. 351-53, 477-79, 530-44; AE BB, AE CC; GE 6-8) Applicant’s written statement was consistent with his SOR response and included the following additional information: In fact, there are multiple instances where it may be necessary to issue multiple media due to separate classification levels or the inability of the media custodian to be available. As long as the media issuance and disposition are tracked, the requirements are fulfilled from a media custodian position. From a best practice perspective, it is not something that should be leveraged out of convenience, but rather from a point of mission requirement when no other alternative exists . . . in one instance when bulk issuance of media was required to support mission requirements, I was not available due to being out sick with COVID. [PM2 and PSO1 overrode my objection] for that issuance which supports my position that bulk media issuance was a known and accepted practice under the circumstances that existed at the time. (AE X at 8-9) Applicant testified: So if one developer needed to transition media or disposition of records to three different sources, he needed three CDs. So it was very common for me, especially not even sitting in the space, to say, okay, I’m going to come 16

in, I’m going to issue you three to four CDs, you’re going to do your job, I’m going to note the disposition of it, it’s in your safe. I’m going to give you media control, you know, CD 1, 2 and 3. . . . And then that’s the issue of purpose is, they’re doing a file transfer to NIPR, to SIPR, to [IS1]. So it’s absurd to say that there’s no specific purpose. I have it documented. It’s in their records. It’s at [organization]. (Tr. 353) A preliminary inquiry into another security concern noted after review of MFRs submitted by the two DTAs “it is apparent that [Applicant] issued blank media in bulk for convenience.” (GE 4 at 2) A second preliminary inquiry found: There were multiple instances where Media was issued in Bulk for various reasons. [Applicant] stated that permission was granted by proper channels for the issuing of bulk media due to mission requirements as of January 2021. PSO/PM issued approval for a one-time mission requirement for this instance. Prior to January 2021 no approval for issuing of Bulk media can be found on record. Prior to January 2021 there are multiple instances where personnel were issued media in bulk. [Three DTAs] stated that they were issued media in bulk for future use or as needed on multiple occasions[.] (GE 8 at 2) GW1 reported: “Multiple incidents of [Applicant] issuing media in bulk while executing media custodian duties without a specific purpose documented in email as well as statements provided by [organization] personnel in violation of [various directives].” (GE 7 at 3) In March 2020, Applicant issued five CDs to a person who died in June 2020. Applicant did not account for the CDs when the person died, and the CDs were apparently discovered during inspection of the deceased person’s work area in about April 2021 and turned over to security. (Tr. 81-83; GE 7 at 5-6) GW1 testified media custodians are required when issuing media, “to update the media log to include name of person to whom the media was issued, purpose of the issue, date/time of issue and number of files being transferred. What I was told was that [Applicant] was busy [or] was gone and so before he would leave, he reportedly, according to the statements that I reviewed at the time, he would just issue bulk media and that’s why blank media was found throughout the SAPF.” (Tr. 75) GW1 reviewed “a series of statements” regarding bulk issuance of media. Bulk issuance of media makes it difficult to properly control or document media control. GW1 could not determine how long the bulk issuances occurred because there was no media log. (Tr. 74-77; GE 7 at 5-6) GW1 acknowledged regulations do not explicitly prohibit issuing media in bulk, and said a media custodian can issue the number of media required to compl

FORMAL FINDINGS

te the job, but noted a specific purpose is required and that the media custodian must document the 17

number of files to be transferred. Issuing bulk media for future use violates SAPCO insider threat guidance because the media custodian would not know the number of files b

CONCLUSION

ing transferred or what the media is being used for. (Tr. 136-39) The “Sample TPI Media Log” and May 2016 SAPCO Insider Threat Implementation Guidance substantially corroborate GW1’s testimony. (AE CC at 3, AE AA at 4 at ¶ 3.e.2.d) GW3 confirmed media custodians a