A Review of FBI Security Programs

The Intelligence Community as a whole has failed to learn from history, a failure that
is mirrored in the fragmented security policy governing members of that community. Each
agency is responsible for implementing its own security system in compliance with
government-wide mandates. The Bureau’s security policies, for instance, are an amalgam
of its own traditional practices and a sometimes imperfect reflection of a slough of Executive
Orders, National Security Directives, Presidential Decision Directives, Director of Central
Intelligence Directives, Congressional enactments, and other mandates.
We are not the first to note the lack of a system to ensure that security policy is
implemented properly in the Intelligence Community and that members of that community
learn from their brethren’s mistakes. In 1994, a Joint Security Commission declared that:
. . . [F]undamental weaknesses in the security structure and culture . . . must
be fixed. Security policy formulation is fragmented. Multiple groups with
differing interests and authorities work independently of one another and with
insufficient horizontal integration. Efforts are duplicated and coordination is
arduous and slow. Each department or agency produces its own
implementation rules that can introduce subtle changes or additions to the
overall policy. There is no effective mechanism to ensure commonality. 10
Consequently, in a report to the Secretary of Defense and the Director of Central
Intelligence, the Joint Commission recommended that a security executive committee be
established to “unify security policy development; serve as a mechanism for coordination,
dispute resolution, evaluation, and oversight; and provide a focal point for Congressional and
public inquiries regarding security policy. . . .” Almost a decade earlier, the Senate Select
Committee on Intelligence asserted that “more needs to be done to ensure that agencies learn
from each other’s experiences and that progress achieved in one area can have benefits for
10
Redefining Security 2 (Feb. 1994).
-21-