ISCR Case No. 25-00238

________ ________ DEFENSE LEGAL SERVICES AGENCY DEFENSE OFFICE OF HEARINGS AND APPEALS In the matter of: Applicant for Security Clearance ) ) ) ) ) ISCR Case No. 25-00238 Appearances For Government: Nicholas T. Temple, Esq., Department Counsel For Applicant: Pro se 08/03/2026 Decision HARVEY, Mark, Administrative Judge: Security concerns arising under Guideline E (personal conduct) are not mitigated. Eligibility for access to classified information is denied. Statement of the Case Applicant submitted a security clearance application (SCA) on July 8, 2024. (Government Exhibit (GE 1)) On March 2, 2026, the Defense Counterintelligence and Security Agency (DCSA) issued a Statement of Reasons (SOR) alleging security concerns under Guideline E. (Hearing Exhibit (HE) 2) The DCSA acted under Executive Order (Exec. Or.) 10865, Safeguarding Classified Information within Industry (February 20, 1960), as amended; Department of Defense (DOD) Directive 5220.6, Defense Industrial Personnel Security Clearance Review Program (January 2, 1992), as amended (Directive); and the adjudicative guidelines (AG) promulgated in Security Executive Agent Directive 4, National Security Adjudicative Guidelines (December 10, 2016), which became effective on June 8, 2017. On August 21, 2025, Applicant answered the SOR and requested a hearing before an administrative judge. (HE 3) On May 19, 2026, Department Counsel was ready to proceed, and on May 21, 2026, the case was assigned to me.

On June 1, 2026, the Defense Office of Hearings and Appeals (DOHA) notified Applicant that his hearing was scheduled to be conducted by video teleconference on June 17, 2026. (HE 3) The hearing was convened as scheduled. Department Counsel offered four exhibits; Applicant did not offer any exhibits; and all proffered exhibits were admitted into evidence without objection. (Tr. 10, 14-16; GE 1- GE 4) On July 8, 2026, DOHA received the transcript of the hearing. Applicant did not request that the record remain open after the hearing. Statement of Facts In Applicant’s answer to the SOR, he admitted in part and denied in part the allegations in SOR ¶ 1.a. (HE 2) His admissions are accepted as findings of fact. He also provided extenuating and mitigating information. Applicant is a 54-year-old field service engineer who assists in the training of military pilots who has worked for his current employer since June of 2024. (Tr. 6, 8) In 1990, he graduated from high school. (Tr. 6) In 2004, he received a bachelor’s degree with a major in computer engineering. (Tr. 6-7) He has not served in the military. (Tr. 7) In 2007, he married, and his children are ages 13, 16, and 18. (Tr. 7-8) Personal Conduct SOR ¶ 1.a alleges that Applicant was fired from his employment in January of 2024 because he falsely claimed to have worked approximately 90 hours when his computer showed no activity, and he produced no work product. A workplace investigation concluded that he routinely mischarged his time. In his SOR response, Applicant stated: I deny the “approximately 90 hours” over that 4 or 5 week period they focused on in that “workplace investigation”. That number is absurd. I worked with co-workers daily and saw my manager several times a day. I attended countless meetings throughout the day/week. My manager never had any issues with my work performance. I worked almost exclusively in the lab, and I tried to convey to the person doing the time charging audit that depending on the project, most of my time could be spent using team accounts and my personal computer would show no activity when I’m working on the simulators and post test tools. Work was low and I was working on the simulators and posttest tools. A couple weeks after I was fired, [Applicant’s employer] had a Reduction In Force and laid off many engineers. I wrote my firing off as a pre-emptive measure before the RIF and went back to work with [a former employer]. Now, that same flawed “workplace investigation” is trying to cost me my job a 2nd time. (HE 2) 2

Applicant’s employer’s investigation stated: The investigation concluded that allegations of mischarging by the subject employee . . . were substantiated. The investigative data supported the reported observations that he was frequently missing from the workplace during midday hours. The information revealed daily extended departures. Suspicions of late arrivals and early departures were also confirmed. [Applicant] posted the absences as time worked. During an investigative interview, [Applicant] confessed to the unauthorized midday workplace departures and admitted to the resultant overstated and mischarged hours. He attributed the disappearances to attempts to alleviate pain and discomfort associated with a medical condition [condition omitted]. He recognized that charging worktime for these events was wrong, and that his attempts to relieve the symptoms were misguided and resulted in fraudulent timecard postings. [Applicant] admitted that the mischarged time had been a common occurrence for several months. When asked to elaborate, he stated that his condition had worsened during the Thanksgiving timeframe, which he attributed to dietary changes during the holidays. To some extent the data supported his contention. Since Thanksgiving, the absences appeared to be a daily occurrence. Prior to that, they seemed periodic. [Applicant] suggested that the discomfort impacted his mood. Part of the reason he left work was to minimize the impact on team members. He confirmed that he frequently returned to the workplace late evenings for the sole purpose of posting his time, which were knowingly inaccurate. While sympathetic to his predicament, the result was still intentional mischarging. [Applicant] also acknowledged late arrivals and early departures and noted that he often took his son to school and picked him up after practice. He took responsibility for his actions, apologized, and indicated that he was committed to accurate and compliant postings going forward. The investigation concluded that approximately 90.0-hours (11-06-23 to 01- 10-24) has been overstated and mischarged by [Applicant]. The approximate monetary value is $18.0K. Additional analysis is needed to determine the extent of historical overstatements. All mischarged hours will be disallowed and program funds will be credited. This case involves direct program charges and is subject to disclosure. Based on the outcome of the investigation, and consistent with previous cases, Labor Compliance is recommending termination of employment. As the result of the findings, [Applicant] violated the [employer’s timecard policy]. The investigation included the analysis of the following data points: • Labor Charge Card History • Security Card Access Reports 3

• Audit time stamps • Management input and data analysis • Interview with subject employee • Multiple discussions with management (GE 4 at 4-5) On January 25, 2024, Applicant’s supervisor emailed him that he was terminated from employment. (GE 4 at 7) This email included the following statement: As you know, there was an investigation conducted following allegations of time mischarging. Data reviewed, November 6[, 2023 through] January 10, 2024, revealed that approximately 90 hours of posted time were unsupported by IT activity and or other work activity. The investigation has concluded and it has been substantiated that you routinely mischarged your time. Your employment is being terminated effective immediately. During the investigation, you acknowledged that you were not always compliant with daily reporting requirements. Additionally, you were advised that your IT activity did not support the hours charged as working. Specifically, it has been substantiated that you charged time as working on, but not limited to the following days with limited IT activity: • 01/08/24: 8.0-hours posted, 4.0 hours mischarged • 01/04/24: 8.0-hours posted, 5.0 hours mischarged There was no tangible support or specifics or work activities for those dates. During the investigative audit/interview, you failed to provide legitimate explanations or support for the egregious shortcomings. You were unable to provide data/evidence explaining the pattern of limited IT activity throughout the workday. You provided no plausible explanations for lack of work product during periods of time where no IT activity was indicated. (GE 4 at 7) Applicant provided an undated response for inclusion in his security record, which stated: I want to sincerely apologize for the oversights I have made in recording my time. I have had multiple flare-ups of [medical condition] since Thanksgiving. On the bad days, I would use [personal time off (PTO)], remain home and stay off my feet. On the not so bad days, I would come to work and endure the discomfort. There were also some days while suffering from a bout of [a medical condition], where the workload (analyzing test results in the secure lab) would lighten up and I would go home for lunch, let the dog out and put my foot up. If the lunch break took longer, I knew I could just make it up by staying longer in the evening when the new test results were hopefully in. 4

Then there were the bad [medical condition] days, when PTO was depleted, and I went to work in pain (which made me irritable) and the workload would lighten up; so I would go home for lunch, let the dog out and put my foot up. With no pressing matters at work and trying to manage both the physical and mental discomfort of the [medical condition] flare-ups, these lunchbreaks would become extended. Somedays, the work would lighten up later in the afternoons and I would go home early to get off my feet. I take full responsibility for these mistakes I made and understand the importance of accurate time reporting. I am committed to rectifying these mistakes promptly. From now on, I will either bring in lunch or eat lunch on- site rather than going home for lunch. At my next follow up with my doctor, I will discuss again a new dosage and/or different medications I currently use for both [medical condition] prevention and mitigation. Both medications definitely seem to be less effective now. I have already discussed this audit with my manager, I will be working with him, and the project leads for more work on my plate. Most importantly, I will accurately account for the hours spent on projects. The ramifications these mistakes could have on not just myself, but also my wife and kids terrifies me and keeps me awake at night. I love my job, my company and my colleagues. I appreciate your understanding and assure you that I will not let this happen again. (GE 3 at 3) At his hearing, Applicant admitted that his employer fired him for mischarging hours that he worked; however, he denied that the number of mischarged hour

s was 90. (Tr. 18) He stated that on some days he worked fifteen minutes less than eight hours, and on other days, he worked a ten-hour day. (Tr. 19) Sometimes he assisted a coworker on their project, and he would charge his labor to their charge number. (Tr. 18-19) Applicant believed the investigation was flawed. (Tr. 23) The investigation used the time he entered his building and his computer activity to determine the amount of work during the day. (Tr. 23) He stated: 99 percent of everything I did was in the lab, so it was highly common for me to come into work, drop my coat off at my desk, go to the lab. And then I would work in the lab all day long, go to lunch, come back, work in the lab again all day long. And then at the end of the day, go back by my computer, log into my computer, log into my time, grab my coat and leave. So in the lab, we had internal network and we used team accounts, so none of that activity is shown in their documentation. I mean, all my coworkers would have similar hours to what they’re showing on the documentation because we all did the same thing. We worked in the lab, it was a secure environment. We didn’t use our work PCs depends on what project we were on. I was on legacy project mainly and everything was in the lab. The network was in the lab, all the documentation was in the lab. Our test 5

procedures were in the lab, our post-test procedures were in the lab. We would talk to quality and have them come look at our tests, come look at our post-test procedures, and they would come in the lab and we’d have that meeting inside the lab. Now, they might be logged into their personal computer, you know, checking everything off, but all the work was done in the secure lab. And it was never on, I mean, most of it was on a team account that would not be shown in his documentation. All it just says is you came to the building at this time or you came in the lab at this time, and then it shows the next time you went into the lab or the next time you came in the building. (Tr. 23-24) Applicant explained that sometimes the workload was low, and he took extra time off. He stated: I mean, but I kept telling my managers, like, dude, there’s nothing, we’re running out of work because they’re behind on the software. Sometimes, the simulators go down and we couldn’t run. But coming in the morning and they say nothing ran, there’s nothing to post- test. Normally, I would just say, okay, I’m going to take off a couple hours, go home, and I’ll come back in the afternoon when they run new tests, and then I’ll work later, you know, when there’s new data. Well, there was never any, I mean, not never, but the new data was slow coming in, and I didn’t have -- I started exhausted on my work leave. I had a [medical] flare up; it exhausted my leave. And so, now, fast forward to this window in January, I was out of leave. The work was light. I came in on Monday morning, they said that nothing ran. I was like, okay, I’m going to go, I’m going to take an early lunch, and I’ll stay late and, you know, work on the new data when it gets, when the data gets in. Well, no new data showed up, you know. (Tr. 26-27) The period at issue was from November 6, 2023, to January 10, 2024, or about six weeks. (Tr. 20) Applicant said there was considerable holiday time off during this period, and mathematically, he would have had to work on average only about four hours a day to overcharge 90 hours. (Tr. 21-22) He said the employer had times from when he entered the building but not times when he left the building. (Tr. 29-32) He entered and exited the building multiple times during the workday. (Tr. 29-32, 36) He believed the true overcharged time from November 6, 2023, to January 10, 2024, was maybe about seven or eight hours. (Tr. 22, 37-38) He did not maintain a personal record of the hours he worked. (Tr. 22) Applicant’s employer provided an example in January 2024 when he was absent four hours one day and five hours on another day. (GE 4 at 7) The investigative record included 74 pages of printouts of dates and times, which his employer used to calculate the mischarged hours. (GE 4 at 11-85) He worked for the company that terminated him for twenty years before his termination. (Tr. 38) 6

Policies The U.S. Supreme Court has recognized the substantial discretion of the Executive Branch in regulating access to information pertaining to national security emphasizing, “no one has a ‘right’ to a security clearance.” Department of the Navy v. Egan, 484 U.S. 518, 528 (1988). As Commander in Chief, the President has the authority to “control access to information bearing on national security and to determine whether an individual is sufficiently trustworthy” to have access to such information. Id. at 527. The President has authorized the Secretary of Defense or his designee to grant applicants eligibility for access to classified information “only upon a finding that it is clearly consistent with the national interest to do so.” Exec. Or. 10865, Safeguarding Classified Information within Industry § 2 (Feb. 20, 1960), as amended. Eligibility for a security clearance is predicated upon the applicant meeting the criteria contained in the adjudicative guidelines. These guidelines are not inflexible rules of law. Instead, recognizing the complexities of human behavior, these guidelines are applied in conjunction with an evaluation of the whole person. An administrative judge’s overarching adjudicative goal is a fair, impartial, and commonsense decision. An administrative judge must consider all available, reliable information about the person, past and present, favorable and unfavorable. The Government reposes a high degree of trust and confidence in persons with access to classified information. This relationship transcends normal duty hours and endures throughout off-duty hours. Decisions include, by necessity, consideration of the possible risk the applicant may deliberately or inadvertently fail to safeguard classified information. Such decisions entail a certain degree of legally permissible extrapolation about potential, rather than actual, risk of compromise of classified information. Clearance decisions must be “in terms of the national interest and shall in no sense be a determination as to the loyalty of the applicant concerned.” See Exec. Or. 10865 § 7. Thus, this decision should not be construed to suggest that it is based, in whole or in part, on any express or implied determination about applicant’s allegiance, loyalty, or patriotism. It is merely an indication the applicant has not met the strict guidelines the President, Secretary of Defense, and Director of National Intelligence have established for issuing a clearance. Initially, the Government must establish, by substantial evidence, conditions in the personal or professional history of the applicant that may disqualify the applicant from being eligible for access to classified information. The Government has the burden of establishing controverted facts alleged in the SOR. See Egan, 484 U.S. at 531. “Substantial evidence” is “more than a scintilla but less than a preponderance.” See v. Washington Metro. Area Transit Auth., 36 F.3d 375, 380 (4th Cir. 1994). The guidelines presume a nexus or rational connection between proven conduct under any of the criteria listed therein and an applicant’s security suitability. See ISCR Case No. 95-0611 at 2 (App. Bd. May 2, 1996). Once the Government establishes a disqualifying condition by substantial evidence, the burden shifts to the applicant to rebut, explain, extenuate, or mitigate the 7

facts. Directive ¶ E3.1.15. An applicant “has the ultimate burden of demonstrating that it is clearly consistent with the national interest to grant or continue his [or her] security clearance.” ISCR Case No. 01-20700 at 3 (App. Bd. Dec. 19, 2002). The burden of disproving a mitigating condition never shifts to the Government. See ISCR Case No. 02- 31154 at 5 (App. Bd. Sep. 22, 2005). “[S]ecurity clearance determinations should err, if they must, on the side of denials.” Egan, 484 U.S. at 531; see AG ¶ 2(b). Analysis Personal Conduct AG ¶ 15 provides the security concern arising from personal conduct: Conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about an individual’s reliability, trustworthiness, and ability to protect classified or sensitive information. Of special interest is any failure to cooperate or provide truthful and candid answers during national security investigative or adjudicative processes. AG ¶ 16 provides conditions that could raise a personal conduct security concern and may be disqualifying in this case: (d) credible adverse information that is not explicitly covered under any other guideline and may not be sufficient by itself for an adverse determination, but which, when combined with all available information, supports a whole-person assessment of questionable judgment, untrustworthiness, unreliability, lack of candor, unwillingness to comply with rules and regulations, or other characteristics indicating that the individual may not properly safeguard classified or sensitive information. This includes, but is not limited to, consideration of: (1) untrustworthy or unreliable behavior to include breach of client confidentiality, release of proprietary information, unauthorized release of sensitive corporate or government protected information; (2) any disruptive, violent, or other inappropriate behavior; (3) a pattern of dishonesty or rule violations; and (4) evidence of significant misuse of Government or other employer’s time or resources; and (e) personal conduct, or concealment of information about one’s conduct, that creates a vulnerability to exploitation, manipulation, or duress by a foreign intelligence entity or other individual or group. 8

AG ¶¶ 16(d) and 16(

e) apply. Discussion of the disqualifying conditions is in the mitigation section infra. AG ¶ 17 lists conditions that could mitigate personal conduct security concerns in this case: (c) the offense is so minor, or so much time has passed, or the behavior is so infrequent, or it happened under such unique circumstances that it is unlikely to recur and does not cast doubt on the individual’s reliability, trustworthiness, or good judgment; (d) the individual has acknowledged the behavior and obtained counseling to change the behavior or taken other positive steps to alleviate the stressors, circumstances, or factors that contributed to untrustworthy, unreliable, or other inappropriate behavior, and such behavior is unlikely to recur; (e) the individual has taken positive steps to reduce or eliminate vulnerability to exploitation, manipulation, or duress; and (f) the information was unsubstantiated or from a source of questionable reliability. In ISCR Case No. 22-00761 at 7 (App. Bd. May 27, 2025) the Appeal Board discussed the evidentiary standard for proving the allegations in the SOR as follows: It is well-established that DOHA security clearance adjudications are administrative proceedings, and the “beyond a reasonable doubt” burden of proof associated with criminal proceedings is not applicable. Similarly, the “preponderance of the evidence” standard in civil proceedings such as a [temporary restraining order] is not applicable. Instead, the Government must prove any controverted facts by substantial evidence — that is, more than a scintilla, but less than a preponderance of the evidence. In ISCR Case No. 10-04641 at 4 (App. Bd. Sept. 24, 2013), the DOHA Appeal Board concisely explained Applicant’s responsibility for proving the applicability of mitigating conditions as follows: Once a concern arises regarding an Applicant’s security clearance eligibility, there is a strong presumption against the grant or maintenance of a security clearance. See Dorfmont v. Brown, 913 F. 2d 1399, 1401 (9th Cir. 1990), cert. denied, 499 U.S. 905 (1991). After the Government presents evidence raising security concerns, the burden shifts to the applicant to rebut or mitigate those concerns. See Directive ¶ E3.1.15. The standard applicable in security clearance decisions is that articulated in Egan, supra. “Any doubt concerning personnel being considered for access to classified information will be resolved in favor of the national security.” Directive, Enclosure 2, [App. A] ¶ 2(b). 9

SOR ¶ 1.a alleges, and Applicant admitted that he was fired from his employment in January of 2024. His employer’s investigation concluded that he falsely claimed approximately 90 hours for work he did not do (timecard fraud). Applicant admitted he exaggerated about seven or eight hours during the November of 2023 to January of 2024 period; however, he denied that the magnitude of timecard fraud was 90 hours. The Appeal Board has noted: [T]he Appeal Board gives deference to a company’s findings and conclusions in its security investigations. See, e.g., ISCR Case No. 15- 08385 at 4 (“[B]ecause of the unique position of employers as actual administrators of classified or protected information programs and the degree of knowledge possessed by them in any particular case, their determinations and characterizations regarding security violations are entitled to considerable deference, and should not be discounted or contradicted without a cogent explanation.”). ISCR Case No. 20-00230 at 3 (App. Bd. Dec. 10, 2021); ISCR Case No. 19-02136 at 3 (App. Bd. Mar. 8, 2021) (stating same). See also ISCR Case No. 20-02990 at 4 (App. Bd. Jan. 19, 2022). This deference is not limited to security investigation and applies to an employer’s timecard investigations. See ISCR Case No. 20-00354 at 6 (App. Bd. Feb. 9, 2022) (stating “We have previously stated that an employer’s decisions and characterizations of events are entitled to some deference in the context of an employer’s internal investigation. See, e.g., ISCR Case No. 18-00496 at 4 (App. Bd. Nov. 8, 2019).”). Applicant did not produce sufficient evidence to refute the findings and conclusions of his employer’s investigation, and Applicant has minimized the extent of his timecard’s inflation of his working hours (timecard fraud). His employer’s investigative report resulted in disallowance of hours and disclosure to the entity being billed for his employer’s services. The investigative report stated: The investigation concluded that approximately 90.0-hours (11-06-23 to 01- 10-24)01/24) has been overstated and mischarged by [Applicant]. The approximate monetary value is $18.0K. Additional analysis is needed to determine the extent of historical overstatements. All mischarged hours will be disallowed and program funds will be credited. This case involves direct program charges and is subject to disclosure. (GE 4 at 4-5 (emphasis added)) The amount of Applicant’s timecard fraud is likely to be somewhat less than 90 hours, as Applicant likely performed some work and attended some meetings when his computer was not being used. However, the amount of timecard fraud is substantially more than the seven to eight hours he admitted that he committed. AG ¶ 17(c) does not apply because the timecard fraud is serious, recent, and occurred on multiple pay periods. The circumstances are not unique, and this behavior continues to cast doubt on Applicant’s reliability, trustworthiness, and good judgment. 10

AG ¶ 17(d) does not apply because Applicant minimized the extent of the timecard fraud and did not describe any counseling to change the behavior. He has not taken other positive steps to alleviate the stressors, circumstances, or factors that contributed to untrustworthy, unreliable, or other inappropriate behavior, and such behavior is likely to recur. AG ¶ 17(e) does not apply because Applicant has not taken full responsibility for the extent of his timecard fraud. He continues to be vulnerable to exploitation, manipulation, and duress. AG ¶ 17(f) does not apply because the timecard fraud is substantiated. Personal conduct security concerns are not mitigated. Whole-Person Concept Under the whole-person concept, the administrative judge must evaluate an applicant’s eligibility for a security clearance by considering the totality of her conduct and all the circumstances. The administrative judge should consider the nine adjudicative process factors listed at AG ¶ 2(d): (1) the nature, extent, and seriousness of the conduct; (2) the circumstances surrounding the conduct, to include knowledgeable participation; (3) the frequency and recency of the conduct; (4) the individual’s age and maturity at the time of the conduct; (5) the extent to which participation is voluntary; (6) the presence or absence of rehabilitation and other permanent behavioral changes; (7) the motivation for the conduct; (8) the potential for pressure, coercion, exploitation, or duress; and (9) the likelihood of continuation or recurrence. Under AG ¶ 2(c), “[t]he ultimate determination” of whether to grant a security clearance “must be an overall commonsense judgment based upon careful consideration” of the guidelines and the whole-person concept. My comments under Guideline E are incorporated in my whole-person analysis. Some of the factors in AG ¶ 2(d) were addressed under that guidelines but some warrant additional comment. Applicant is a 54-year-old field service engineer who assists in the training of military pilots who has worked for his current employer since June of 2024. In 1990, he graduated from high school. In 2004, he received a bachelor’s degree with a major in computer engineering. He worked for the company that terminated him in 2024 for twenty years before his termination. The disqualifying and mitigating information is discussed in the analysis section, supra. The reasons for denying Applicant’s security clearance are more persuasive than the reasons for granting him a security clearance. It is well settled that once a concern arises regarding an applicant’s security clearance eligibility, there is a strong presumption against granting a security clearance. See Dorfmont, 913 F. 2d at 1401. “[A] favorable clearance decision means that the record discloses no basis for doubt about an applicant’s eligibility for access to classified 11

_______________________ information.” ISCR Case No. 18-02085 at 7 (App. Bd. Jan. 3, 2020) (citing ISCR Case No. 12-00270 at 3 (App. Bd. Jan. 17, 2014)). I have carefully applied the law, as set forth in Egan, Exec. Or. 10865, the Directive, the AGs, and the Appeal Board’s jurisprudence, to the facts and circumstances in the context of the whole person. Personal conduct security concerns are not mitigated. This decision should not be construed as a determination that Applicant cannot or will not attain the state of reform necessary for award of a security clearance in the future. With continued effort to comply with rules and laws he may well be able to demonstrate persuasive evidence of his security clearance worthiness. Formal Findings Formal findings For or Against Applicant on the allegations set forth in the SOR, as required by Section E3.1.25 of Enclosure 3 of the Directive, are: Paragraph 1, Guideline E: AGAINST APPLICANT Subparagraph 1.a: Against Applicant Conclusion Considering all the circumstances presented by the record in this case, it is not clearly consistent with the interests of national security to grant Applicant eligibility for access to classified information. Eligibility for access to classified information is denied. Mark Harvey Administrative Judge 12