Ask the Director

Second Special Polygraph Edition
(Questions sent to future@lanl.gov)

Introduction

In the best of all worlds, to ensure national security we would continue to depend upon trust and detailed security background investigations, backed up by CI polygraphs for investigatory purposes. It appears that this view will not prevail in DOE or Congress. The next best solution would be to limit polygraphs to only those people whose work requires access to top secret, compartmented information -- that is, access to the most sensitive secrets of the nation -- those secrets whose loss would cause the greatest amount of damage to the United States. However, the latest DOE proposal would extend polygraphs to a much larger cross section of the Laboratory population. On August 18th, DOE published a notice of proposed rulemaking and public hearings on their proposed Polygraph Examination Regulation in the Federal Register. This gives us an opportunity to offer constructive suggestions as to how a program of polygraph examinations could best contribute to meeting our shared national security goals.

The proposed regulation can be found on the Web at http://home.doe.gov/news/fedreg.htm. There are several ways in which you can participate in the rulemaking process. Public hearings will be held at Livermore, Albuquerque, Los Alamos, and Washington, DC. The Albuquerque hearing will take place on September 16th, in the Steve Schiff Auditorium at Sandia National Laboratory, from 9 a.m. to 1 p.m. and from 3 p.m. to 7 p.m. The Los Alamos hearing will be held on September 17th, in the Main Auditorium in the Administration Building, from 9 a.m. to 1 p.m. and from 3 p.m. to 6 p.m. Requests to speak at the hearings should be phoned in to Andi Kasarsky, (202) 586-3012 by September 14 for the Albuquerque hearing and September 15 for Los Alamos. Each individual's presentation will be limited to five minutes.

Written comments will also be accepted. Send 10 copies to Douglas Hinckley, Office of Counterintelligence, CN-1, Docket No. CN-RM-89-POLY, Department of Energy, 1000 Independence Avenue SW, Washington DC 20585. Comments may also be e-mailed to poly@hq.doe.gov. Commentators are requested to identify the specific section of the proposed rule they are responding to.

If you have concerns or suggestions, this is a chance to express them. However, remember that your participation in the rulemaking process is in your capacity as private citizens.

The questions below, all related to the proposed polygraph program, have been sent to me at future@lanl.gov.

Q #1: Location for Testing

Your responses on polygraph testing provoked a second thought. If the subject population runs up to the 4,000 range, a significant travel cost could accrue to the Lab if tests took place anywhere but locally. If the tests were done in Albuquerque: one or two meals and a half-day minimum absence would result; some persons do not have reliable cars, or otherwise wouldn't be able to drive there on their own; the shortage of vehicles will affect local work-related travel if people drive Lab vehicles; the subject population would incur a significant risk of traffic accident while on Lab business, whether driving a Lab vehicle or their own. Perhaps early consideration should be given to a local testing place or to regular bus runs if the 180 mile round trip is to be made. (Question received 8/9/99)

A: Thank you for raising an issue that I hadn't really thought about yet. DOE is presently expanding its polygraph capability in Albuquerque from two polygraph modules to five. This is intended to be the main polygraph facility for the entire nationwide DOE complex. With each polygraph examination taking roughly half a day, they can do about 50 polygraphs per week. The estimate of 2,500 polygraphs per year comes from just multiplying the weekly figure by 50 weeks per year.

The polygraphers can take their equipment with them and do examinations elsewhere if necessary. However they prefer to do them off-site because the subjects are exposed to fewer distractions off-site. Another reason is that an off-site polygraph is more private, e.g., your colleagues won't know how long your polygraph took. DOE has shown a great deal of flexibility on this topic and has indicated their willingness to work with us to find the most cost-effective way to implement the polygraph program. When we have a better idea of how the program is going to work we'll revisit the travel issue.

Q #2: Polygraph Countermeasure Training

I read the Q&A. I think most employees are against it and the lab is not very happy about it either. Therefore, why don't we start a "false negative" optional training course for employees. That way we can continue as we have been without endangering employees' careers and thumb our noses at congress for their doubt. Sincerely, (Question received 8/9/99)

A: I am sure that no one is "happy" about polygraphing. But surely, you jest about "false negative" training! You might want to re-submit this one on April 1st. Joking aside, I've said many times that even though our system of trust has worked well in the past polygraph examinations are almost certain to happen. Currently, the support for them in Congress is overwhelming and it looks like they will soon be required by federal regulation. I recommend that we participate in the public hearings and try to influence the polygraph program so it is as fair and unobtrusive as possible for its intended counterintelligence purpose.

Q #3: Technical Solution?

First, I believe we are missing the boat here folks. Why are we doing polygraphs? Why are we doing audits? Why are we building a new department security personnel infrastructure? And the list goes on...

The answer is, because we want to improve information security at our national laboratories. But, has anyone one considered that the issue of information security may be more a technical issue than it is an administrative issue? First of all, informations systems are NOT inherently secure! Information security has not been designed into information systems from the bottom up. Its always been something that gets added on through the use of informations systems options, 3rd party products, and recently a large assortment of software and hardware security products. I believe few would disagree that developing, assembling, and maintaining secure information systems, is more an art than a science. We need to change that! Its imperative to the integrity and security of our Laboratory, our government, our economy/country, and to the future of informations systems!

We are a première scientific institution in the world! If there is (and there is) scientific/technical problems with information security, and it is of primary and/or national security importance for us to secure our information, shouldn't we be proposing and working on technical solutions to the problems?

My point was that, I feel that the Lab, DOE, and the government should invest more in solving information security technical problems, than on imposing administrative constraints and requirements to circumvent the problems. So my question was, can't we (i.e. LANL) submit a technical proposal, or proposals, for developing technical solutions to existing government information systems security? And if the government refuses to support our proposal(s), and in the future we continue to have technical problems, well they can't blame us for not trying. (Question received 8/9/99)

A: We have already made many short-term technical improvements to our classified and unclassified information systems in the past year. We have plans for major long-term technical improvements for which we will request funding from DOE. To stay at the cutting-edge of security technology will require that we work with our peers in industry, government and universities. We intend to do so. However your question assumes that information systems are purely technical systems and that their related security problems are amenable only to some technical fix. While I agree that information security technology should be as good as it can be, I don't think that there are many pure technical systems around any more. Increasingly, we are dealing with socio-technical systems, systems whose boundaries include the technology as well as the people who interact with it. By all means, let's continually improve information security technology, but let's not forget that the machine is often no better than the human beings in the systems that use and manage it.

Q #4: 2% False Reading

When we talk about a 2% "false reading" does that mean that only 2% of the participants give a false reading or does that mean, of all the questions asked, 2% give a false reading. This could mean a huge difference. I'm a little suspect of statistics and percentages. (Question received 8/10/99)

Q #5: False Positives

John: In your "Polygraphs Revisited" Q&A of 8/13/99, you said (quoting both the question and your answer)

2. What is the DOE record in resolving "false positives"?

The DOE polygraph experts do not like the term "false positives" because they think it connotes the wrong meaning. They would prefer to deal with "unresolved issues.. Their data indicate that for a statistical sample of approximately 3,000 polygraphs, there have been fewer than 0.3 percent of the people who required extensive testing to resolve an issue and less than 0.1 percent of the people who never were able to resolve the issue. This is a significantly better record that applications of polygraphs elsewhere.

It is worth noting (and you may wish to point this out to the Lab community and to DOE) that this response evades the question. The DOE experts would like to substitute the term "unresolved issues" for "false positives," but the two are not synonymous. I presume that DOE or their people can declare a case resolved whether or not the tested person agrees with the conclusion. If my presumption is correct, then DOE's statistics on the number of cases resolved give no indication of the number of cases in which an incorrect and unfavorable conclusion was reached in the polygraph examination. I suppose incorrect and unfavorable conclusions are the "wrong meaning" which they "do not like," but the question is a valid one and they ought to be willing to address it. (Question received 8/13/99)

Q #6: False Positives and Policy if Polygraph is Failed

Dr. Browne: Thank you for the detailed Q&A you have posted on polygraph testing. I am concerned about the assertion that "false positives" should occur at a rate of no more than 0.1%. It appears that this is a matter of great controversy in the field of psychology (see D. Lykken, Nature, vol. 307, p. 681 (1984)). Some critics maintain that the rate will be far higher. Is this issue worthy of more extensive debate?

I am also worried that the accusation of deception by a polygrapher will not be handled fairly, particularly after reading Mark Mallah's account of his experience at the FBI just a few years ago (see the web site http://www.nopolygraph.com/mallah.htm). Would it be reasonable to establish a firm policy now on the handling of failed polygraph tests, before that testing begins?

Questions #4, #5, and #6 will be answered together.

A: These are good questions that many people are asking. I believe questioner #4 was referring to "false positive", i.e., when an innocent person is judged by the polygrapher to be deceptive. It is true that the DOE polygraph experts prefer the term "unresolved issues" rather than "false positive." My understanding is that the false positive terminology is not used because it has no practical value in the setting of the proposed DOE polygraph program. For example, if the examiner judges a subject to be deceptive there is no way to know if this particular "positive" finding is false or not. However, when DOE says that issues have been "resolved" that means by definition that the subject has been judged to be non-deceptive, i.e., they have "passed" the polygraph exam. If all subjects found to have "unresolved issues" were, in fact, innocent, then the "unresolved issues" rate would be the same as the "false positive" rate, but it could never be higher.

DOE's experience of administering more than 3,000 CI-scope polygraph examinations is that about 99.7% of subjects pass without any particular problem. The remaining 0.3% have difficulty answering one or more questions. The polygraphers work with these individuals to identify the source of the difficulty, perhaps caused by the way a question is worded or because of some personal issue that the individual has. With this additional effort, and possibly a second polygraph exam, about two-thirds of this cohort is able to pass the polygraph exam, leaving about 0.1% of the total covered population with "unresolved issues." We are planning to get the DOE polygraph experts to visit the Lab to discuss polygraph issues with employees before the public hearing on September 17th.

The proposed DOE rulemaking does set forth a DOE policy for the event that a person still has unresolved issues after their second CI-scope polygraph exam (i.e., issues that raise significant questions relevant to their continued access to certain information or activities). DOE will conduct an "eligibility evaluation" that considers the examination results along with other relevant information, such as security track record, prior background investigations, etc. Upon completion of the eligibility evaluation, DOE will decide if the individual can return to their job or if their access to classified material should be discontinued. I will personally be involved with the resolution of any of these cases with the DOE. Questioner #6 raises an important issue about "Laboratory policy" on the handling of "failed" polygraphs. I think it is important that we have such a Lab policy that provides our employees with clear expectations, and we will develop one.

The DOE polygraphy results appear to be much more reliable than what one typically hears about in reference to polygraph examinations that are administered in quite different contexts. This might be due to several factors:

(i) DOE is administering relatively simple and limited counterintelligence-scope polygraphs;
(ii) DOE requires polygrapher qualifications that are much higher than is customary;
(iii) DOE has an extensive Quality Assurance program; and
(iv) The DOE population has already been thoroughly screened (e.g., by clearance investigations) and we would not expect to find many, if any, of this group engaged in espionage or other illegal activities of concern to counterintelligence.

Q #7: Something Doesn't Add Up

John's latest, 8/13, write-up about the proposed polygraph testing states that there are only three or four CI related questions asked. This was also stated in the 8/6 write-up. With only three or four questions being asked, the test is made to appear rather benign.

John's write-up also states "the test takes on the average about 2.5 to 3 hours although the amount of time a person is actually "wired up" is measured in minutes." This does not jive with the "CI polygraphs use only three or four questions" statement from the 8/6 write-up. Something is obviously missing concerning the true intensity of the test.

My lack of comfort with the way the proposed program is being presented by DOE to John Browne (I do believe that John is trying to be sincere) stems from an experience of an acquaintance some years ago. In the process of getting her Q clearance, she was grilled with many hypothetical, often absurd questions. For example, "if your sister and her family were kidnapped by terrorists, would you give up classified information to gain their release?" Other questions went along the lines of questioning her loyalty to the United States based on her religious and ethnic origins. So, our Irish colleagues whose heritage is traced to Northern Ireland or some other volatile or sensitive country might likely be faced with a similar insulting interrogation.

As experienced by my acquaintance, I am sure any interrogatee's anger will rise. This anger will undoubtedly have negative impacts on test results. Nonetheless, "our resistance to the use of polygraphs would be interpreted as just one more example of our 'arrogance' and 'denial' of security problems, as mentioned in the PFIAB report 'Science at its Best; Security at its Worst.'" (8/6) Oh, and let's not forget the age-old admonition used many times throughout history, "if you have nothing to hide, you would not object...."

If one temporarily steps back to observe the chronology of events from when current security issues surfaced early this year, one will see that what started as a logical and systematic approach to a very serious problem slowly change to growing hysteria. The hysteria is still growing and almost McCarthysim-like elements are beginning to surface.

Now, I realize how easy it is to give into the "momentum" (8/6) of the moment. The next couple of years will surely be a test of the courage, moral backbone, and fortitude of us all, especially our managers. It is also difficult for the unprepared, unsuspecting, and often naive person to face those whose job it is every day, week after week and year after year, to find the worst in people, not the best. Based on ageless human history, current fear and reluctance towards mandatory and coercively applied polygraphs must be recognized and accepted.

Furthermore, without legally proven (that is, alleged criminal) justification for such gross personal intrusions, polygraphs are viewed as unwarranted for current LANL personnel whose terms and conditions of employment at the time they were hired did NOT include being subjected to polygraphs. I believe that the proposed mandatory polygraphs are seen as a unilateral change to existing employment contracts.

I personally would not object to having a polygraph if those requesting it complied with our nation's long established legal history. That is, as a class or individually, give LANL employees proper due process in a court of law before mandating polygraphs. (Notice I am being specific to LANL) DOE must be made to justify each and every LANL employee polygraph. Going through such a process is much more acceptable to me than deferring to the whims of bureaucrats and politicians.

By the way, in closing, my acquaintance who was a very talented and promising young scientist (why else would she have been offered a job at LANL?) got so mad about her interrogation that shortly after getting her Q clearance (staying only for the sense of vindication) left LANL forever. What an unfortunate and sad loss. How many more talented people will we lose? (Question received 8/13/99)

A: The hours-long polygraph examination, the limited number of questions asked, and the short time actually "wired up" actually do check out. The polygraph starts with the polygrapher sitting down with the subject, explaining the process and discussing the questions to be asked. The subject is only wired for a short time while the questions are being asked. The subject might leave the chair many times to work with the polygrapher on refining questions so that they can clarify any unresolved issues. The length of the process and the extensive interactions with the polygrapher are some of the features that tend to make this kind of polygraph examination more reliable than most conventional methods.

With regard to a CI-scope polygraph becoming more intrusive than is appropriate, all examinations will be recorded and/or videotaped so that the subject will have the evidence necessary for a formal complaint should the process get out of hand or the polygrapher seem unprofessional. There are undoubtedly some legal issues to be resolved, however there appear to be no obvious legal obstacles to prevent the DOE from implementing its polygraph program as proposed. Congress has passed legislation that mandates DOE's implementation of polygraphing for national security purposes. The present legislation is not in conflict with California law that governs the University's personnel policies related to polygraphing. (See the answer to question #8 in the Special Polygraph Edition, posted on my Webpage August 6, 1999.)

Finally, I must confess that I haven't been hoping for all my life that I would someday be polygraphed as a condition for keeping the job I'm in. Since the polygraph is voluntary, we all do have some choice -- although I admit that I will not be able to find thousands of unclassified jobs for our people whose jobs are identified to be in the program and who refuse to partake. However, the polygraph requirement looks almost certain to become the law of the land and I can think of no other way, to shape this to our liking than to make our concerns known by participating in the comment process. We have been working with the DOE and Congress to require only those jobs that have access to the most sensitive classified information to be subject to the possibility of polygraphy. We will continue to send this message to DOE and our representatives.

Q #8: A Polygraph Test Case

Dear John: I was shocked to read the names of three Laboratory employees in the newspapers who were targeted for discipline by the DOE. Apparently, these names were leaked by a high-level DOE source. Could you please tell us whether the DOE has a vigorous investigation underway to determine who in the upper levels of the Department thinks it acceptable to damage people's reputations in this highly inappropriate way?

Would you please pass the following suggestion on to Mr. Richardson? Since he is a strong supporter of the polygraph, why doesn't he order polygraphs for the high-level officials in the DOE with knowledge of this situation so that the culprit can be identified and disciplined? This would give the secretary an opportunity to show that the rules apply to everyone, including his own department, and would also provide an excellent test case for the polygraph program he wants to impose on us. If this application successfully demonstrated the practical value of the polygraph, how could we possibly object to it? (Question received 8/19/1999)

A: I too was appalled at the leaking of names to the press. I brought this to the DOE's attention, but I am not aware of any investigation at this time to determine who might have leaked the names of the three Lab employees. I will personally relay your suggestion to DOE.

Q #9: Refuses Polygraph Examination

Dr. Browne: As a matter of principle I intend to refuse to submit to an unscientific and unwarranted intrusion into my life by polygraph after 25 years of service. I am very disappointed that no manager at the Laboratory has had the integrity and courage to stand up to this intrusion for the sake of his/her employees and the ultimate good of the nation. Be that as it may I would like to know if the Laboratory intends to pay severance pay to anyone who ultimately loses his employment as a direct result of refusing a polygraph test. I contacted HR (unit and name deleted) and was refused an answer. (Question received 8/19/1999)

Q #10: Another Refusal

Dr. Browne: I would like to relate a story to you and the readers of your Q&A forum in regards to polygraph testing.

A number of years ago, when I was married, my wife was a salesperson at Zales Jewelers -- a national jewelry retail Co. They had a policy requiring polygraph tests be taken by all salespeople every year. She failed to pass the polygraph test one year after having worked there for several years with no history of misconduct. They administered the test two more times on separate occasions, but she still could not pass the test. She was fired because of this. I can tell you with absolutely no doubt that she is the last person that would ever do anything dishonest -- especially something like stealing from her place of employment. She felt so strongly about honesty and moral behavior that just being questioned under those kinds of circumstances frightened her and she would automatically have a physical reaction just thinking about the question.

In the "Polygraphs Revisited" link of 8/13/99 on your web page, a sentence reads:

The polygraph is NOT a "lie detector" but rather records "externally" what an individual "feels internally."

This is absolutely true. A person may not be lying, but if they are so sensitive to being questioned in such an accusing manner, they will naturally have "feelings internally" that will be recorded "externally" and subsequently deemed "deceptive."

You ensure us that all of these "deceptive" employees will be dealt with fairly, but how could you be so willing to "go along" and allow your employees to be subjected to such a witch hunt? Gambling has become pretty popular in this state, but why should lab employees gamble their career, income, and reputation on some unknown odds that they could be falsely accused (and possibly unable to prove their innocence). With the possibility of around 40 people failing the test each year, the odds are in favor of the house. Who's going to burn at the stake this year? Next year? ...

Based on my personal experience with polygraph testing, if I am called upon to take the test, I will refuse -- even if it means giving up my PSAP and Q clearance status. I suspect that many lab employees feel just as strongly as I do. I hope lab management and other decision makers will soon get the message that this is the wrong approach to solving our security problems. (Question received 9/23/99)

Questions #9 and #10 will be answered together

A: There was considerable debate between the lab directors and DOE management about the implementation of the polygraph by the DOE in response to the present case. We obviously were not successful in our arguments. There is just too much emotion wrapped around the allegations for people to listen to us although we continue to make the arguments.

Questioner #9 asked a very good question about the employment conditions for an individual who refuses a polygraph. I respect your principles and admire you for holding to them, but the polygraph program is still a long way from taking its final form. First of all, nobody will be fired for refusing to take a polygraph test. Let me quote from the DOE proposed Polygraph Regulations that I referred to in the introduction to this Q&A:

"All such polygraph examinations will be voluntary. However, if an individual refuses to submit to an examination that is for national security purposes, DOE and its contractors may decline to select the individual for the sensitive positions specified in this rule, and DOE may deny the individual access to the information that justified conducting the examination."

Now what does this mean? First of all, the polygraph is voluntary in the sense that no adverse personnel action will be taken as a result of refusal. An adverse personnel action means, for example, that you cannot be fired, however reassignment or transfer are not considered to be adverse personnel actions. Thus, if you are in a sensitive position, as defined by the proposed rule, and you refuse to take a polygraph examination, we will make every effort to find you a suitable position at the Laboratory that is not part of the population covered by the polygraph program.

There is a German saying that translates as "The soup is cooked hotter than it's eaten." I think it's far too soon to worry about severance pay although our policies will be examined carefully to evaluate your question. Please participate in the public hearing on the proposed regulations. Listen to the DOE polygraph experts explain how their approach differs from, say, the use of polygraph in forensic contexts, or in private industry. Wait and see how the regulation looks when it is final. My advice is to let things cool down a bit, then let me know what you think.