1 DEPARTMENT OF DEFENSE DEFENSE OFFICE OF HEARINGS AND APPEALS In the matter of: ) ) ) ISCR Case No. 17-02662 ) Applicant for Security Clearance ) Appearances For Government: Daniel F. Crowley, Esq., Department Counsel For Applicant: Pro se ______________ Decision ______________ MURPHY, Braden M., Administrative Judge: Applicant was terminated from his employment with a defense contractor in November 2016 for falsifying his time cards. He did not provide sufficient evidence to mitigate the resulting personal conduct security concerns. Applicant’s eligibility for access to classified information is denied. Statement of the Case Applicant submitted a security clearance application (SCA) in February 2015. On October 17, 2017, following a background investigation, the Department of Defense Consolidated Adjudications Facility (DOD CAF) issued him a Statement of Reasons (SOR), alleging a security concern under Guideline E, personal conduct.1 Applicant 1 The action was taken under Executive Order (Exec. Or.) 10865, Safeguarding Classified Information within Industry (February 20, 1960), as amended; DOD Directive 5220.6, Defense Industrial Personnel Security Clearance Review Program (January 2, 1992), as amended (Directive); and the National Security Adjudicative Guidelines (AG), which became effective on June 8, 2017. 2 answered the SOR on November 3, 2017, and requested a hearing before an administrative judge of the Defense Office of Hearings and Appeals (DOHA). This case was initially assigned to another administrative judge on May 18, 2018. Applicant’s hearing was initially scheduled for July 17, 2018, and a notice of hearing was issued. Due to a typographical error in the notice, however, Applicant did not receive it. The hearing was then rescheduled to July 26, 2018, and an amended hearing notice was issued. The case was reassigned to me on July 10, 2018. Applicant’s hearing convened as scheduled. Department Counsel submitted Government’s Exhibits (GE) 1 through 5. GE 1 and 5 were admitted without objection. GE 2, GE 3 and GE 4 were admitted over Applicant’s objections. (Tr. 19-25) Applicant testified and submitted Applicant Exhibits (AE) A, B, and C, which were admitted without objection. The record closed on the date of the hearing. The hearing transcript (Tr.) was received on August 3, 2018. Procedural Issue On June 28, 2018, the initial administrative judge conducted a conference call with the parties. During the call, Applicant requested that the administrative judge issue a subpoena so a certain witness could be made to testify for Applicant at the hearing. The judge explained that she did not have the power to subpoena witnesses in DOHA proceedings, but that witnesses could testify in person, by letter, or by phone. The initial administrative judge memorialized the conference call in a memorandum for the record. At the hearing, I read the memo to the parties verbatim, and they agreed that it accurately reflected the substance of the call. I marked the memo for the record and provided them each a copy. I also confirmed that the Directive does not provide administrative judges with subpoena power in DOHA proceedings. (Hearing Exhibit I; Tr. 13-15) Findings of Fact In his Answer to the SOR, Applicant denied the sole allegation (¶ 1.a) with an explanation. I incorporate the explanation into the findings of fact. After a thorough and careful review of the pleadings and the record evidence submitted, I make the following additional findings of fact. Applicant is 37 years old. He and his wife have been married since 2006. They have a five-year-old daughter, and were expecting another child at the time of the hearing. Applicant served honorably in the U.S. Army from 2000 to 2005. He earned a bachelor’s degree in 2009. He has worked for Federal contractors ever since, with some periods of unemployment. He worked for a Federal contractor in Afghanistan from May 2011 to May 2012. (Tr. 65-67, 87; GE 1) 3 In June 2013, Applicant began working as a network engineer for a large defense contractor (DC 1). In July 2014, he began a second job, in a similar position, for another defense contractor (DC 2). Both jobs were full-time. He worked the night shift for DC 1, and the day shift for DC 2. He took the second job because he had recently purchased a house. He held both jobs when he submitted his SCA, in February 2015. Applicant has held a security clearance since 2010, and now seeks to renew it. His salary for DC 2 was between $75,000 and $80,000. Applicant remains sponsored for a clearance by DC 1, and continues to work there, with a salary of $94,000. (Tr. 11, 32, 61-64, 78; GE 1) He now works on the day shift. (AE C) The SOR allegation concerns Applicant’s termination by DC 2, in November 2016, because he was found to have falsified his timecards. The circumstances are as follows: In fall 2016, Applicant was required by employer DC 2 to complete some on-line training courses. There were 10 required courses, which the employer estimated would take about 25 total hours to complete (about 2½ hours per course). The courses were “self-paced,” and Applicant requested a full 40-hour work week to complete them, from October 3 to 7, 2016. He was to do the training at home, while teleworking. (Tr. 36-37, 39-40, 49-52; GE 2) When Applicant later submitted his time cards for that week, his supervisors first noted that he had erroneously billed the 40 hours to “overhead” rather than to “training,” as required.2 He made the change as requested on the morning of October 17, 2016, noting 40 hours of training time (eight hours each day). (GE 2 at 2) In reviewing Applicant’s course materials, his supervisors then noted that he had only started and completed two of the required courses, on only two of the days (October 6 and 7), and that he had logged in to DC 2’s training program for only two hours and 15 minutes combined. (GE 2) On or about October 18, 2016, Applicant was called to a meeting with his supervisor, Mr. J, and Mr. J’s superior, Mr. W. When Applicant was confronted about the apparent discrepancy, he said he had attended eight hours of training for all five days. He was unable to explain or to justify the 40 hours he had charged, when compared with the 2¼ hours documented in the company’s training system. As the company found: [Applicant] was unable to provide any sufficient evidence to support the hours charged and when challenged to provide a breakdown on what he did on each day of the week, he was unable to provide an adequate breakout and continued to assert that he took classes every day. When 2 On this point, Applicant testified that he prepared his initial time cards according to what his prior supervisor had told him. (Tr. 39) 4 asked if those classed [sic] equated to eight (8) hours per day, he answered, ‘yes.’3 Mr. J and Mr. W then offered to review Applicant’s training records and computer network access records to verify his claims. Instead, Applicant offered to change his time card to reflect 40 hours of personal time off, for the entire week. He was told instead to submit an accurate time card. (GE 2; GE 3) On October 18, 2016, at 1:21 pm (after Applicant’s meeting with Mr. J and Mr. W), he changed his time card to reflect 25 hours of training and 15 hours of personal time off, over the week of October 3, 2016. This was still far more than the 2¼ hours of training that had been documented in DC 2’s training system. (GE 2; GE 3; Tr. 74-75) On October 20, 2016, Applicant’s supervisors considered that he had been given “sufficient opportunity . . . to be truthful on his timesheet regarding his class time,” and they recommended that he be terminated. The memo is signed by both Mr. J and Mr. W. (GE 3) An October 24, 2016 memorandum from DC 2’s human resources office also noted that although Applicant “routinely reports [working] 40 hours of time, badge swipe data shows a pattern of far fewer hours, and that “an office mate corroborates that [Applicant] leaves early often.” (GE 4) Applicant was terminated by DC 2 on November 9, 2016. He was found to have falsified his timesheets on several dates, and to have failed to submit accurate time charges despite having been given several opportunities to do so. (GE 5) (SOR ¶ 1.a) Both before and during the hearing, Applicant claimed that his supervisor, Mr. J, had a second meeting with him later that day and gave him permission to submit a time card reflecting 25 hours of training. In denying the SOR allegation in his Answer, Applicant said as follows: I deny that I falsified my timecard. Before I entered my hours for the week in question, I consulted and talked to my immediate supervisor and we both agreed on the amount of hours that I would enter for that time period. There was a lack of communication between my immediate supervisor and his supervisor. It was not known that we had this conversation. My immediate supervisor can verify this.4 Applicant testified that the training was laid out in a series of videos which he was to watch, one by one, and then take a series of “pass/fail” tests. He testified that instead 3 GE 3 at 1. 4 Answer to SOR. 5 of doing it this way, he chose to take all the tests at the end of the week. He testified, “[s]o at the end of the week, Thursday and Friday, I started taking my tests for this . . . so I took a bunch of tests. And I only passed two or three of them,” which was how he received credit for a few hours of training. “But I still worked the whole [week],” he said. (Tr. 40, 50-51 58) Applicant claimed that he watched all of the training videos, but that the only hours that were logged in the company’s training system were those for tests he took and passed. When asked at hearing to explain the discrepancy, he claimed he was not credited for watching the videos and taking tests that he did not pass: My response to that is that maybe the hours that it took for me to take those tests on Thursday and Friday. But Monday through Friday, I was taking the courses.5 Applicant offered no details about either any of the training videos he allegedly watched, nor about any tests he took, whether he passed them or not. He offered no specifics about what he did on Monday, Tuesday, or Wednesday when the company had no record that he had logged in. Applicant confirmed the October 18, 2016 meeting with Mr. J and Mr. W to discuss the training and the time cards. (Tr. 37-39) This was the only time he met Mr. W. (Tr. 72-73) When asked at hearing whether Applicant believed he did anything wrong, he said, “I’m sorry to laugh, but, no, your Honor.” (Tr. 69) He asserted again that he tried to explain to Mr. W what he did, but “he didn’t agree.” (Tr. 69) He said he and his supervisors “sat in a room for 15 to 20 minutes yelling, not yelling, but talking past each other.” (Tr. 74) Applicant said this was why he offered to take 40 hours of leave time for the entire week. (Tr. 40, 52, 60, 74) As Applicant initially asserted in his Answer, he claimed he was called into Mr. J’s office a few hours later: And he was like, you don’t have to put the 40 hours of leave. Just put, I think it was 25 hours, or whatever is annotated in there. . . . Put that as your hours in class, and then take the rest as leave. So that’s what I annotated in my timecard.6 Applicant repeated this claim several times during the hearing. (Tr. 41, 52, 59, 72-75) In July 2018, he reached out to Mr. J before the hearing in attempt to verify his claim. Mr. J responded, but said only that he had “been advised to refer you back [to] 5 Tr. 58. 6 Tr. 41. 6 HR.” (AE B) Applicant did so, also without success. (Tr. 41-47, 59; AE A) Mr. J was the witness Applicant sought to subpoena to testify and confirm that he had approved the 25 hours of training time Applicant submitted on his time card. (Tr. 48, 67-68) This was despite the fact that Mr. J and Mr. W both signed the October 20, 2016 memo recommending Applicant’s termination, and detailing their rationale for doing so. (GE 3) Applicant denied that he willfully falsified his timecard. (Tr. 59) He also denied the company’s statement that he often left work early, as referenced in GE 4. He said, “If I put 40 hours, whatever hours I worked, that’s what I annotate on my time card.” (Tr. 60- 61) “I really and wholly deny and reject that,” he said. (Tr. 86, 87) Applicant said he thought about it, but chose not to contest his termination by DC 2, though he believes he was terminated improperly. (Tr. 76-77) Applicant provided his 2018 mid-year review from DC 1, his employer and clearance sponsor. His supervisor wrote that Applicant has made a “strong showing” since starting work on the day shift. The review also notes a recent promotion. Applicant was briefed on cybersecurity and other management and computer training. (AE C) Policies It is well established that no one has a right to a security clearance. As the Supreme Court noted in Department of the Navy v. Egan, “the clearly consistent standard indicates that security determinations should err, if they must, on the side of denials.”7 When evaluating an applicant’s suitability for a security clearance, the administrative judge must consider the adjudicative guidelines. In addition to brief introductory explanations for each guideline, the adjudicative guidelines list potentially disqualifying conditions and mitigating conditions, which are used in evaluating an applicant’s eligibility for access to classified information. These guidelines are not inflexible rules of law. Instead, recognizing the complexities of human behavior, these guidelines are applied in conjunction with the factors listed in the adjudicative process. The administrative judge’s overarching adjudicative goal is a fair, impartial, and commonsense decision. According to AG ¶ 2(a), the entire process is a conscientious scrutiny of a number of variables known as the “whole-person concept.” The administrative judge must consider all available, reliable information about the person, past and present, favorable and unfavorable, in making a decision. The protection of the national security is the paramount consideration. AG ¶ 2(b) requires that “[a]ny doubt concerning personnel being considered for national security eligibility will be resolved in favor of the national security.” In reaching this decision, I have drawn only those conclusions that are reasonable, logical, and based on the 7 Department of Navy v. Egan, 484 U.S. 518, 531 (1988). 7 evidence contained in the record. Likewise, I have not drawn inferences grounded on mere speculation or conjecture. Under Directive ¶ E3.1.14, the Government must present evidence to establish controverted facts alleged in the SOR. Under Directive ¶ E3.1.15, an “applicant is responsible for presenting witnesses and other evidence to rebut, explain, extenuate, or mitigate facts admitted by applicant or proven by Department Counsel and has the ultimate burden of persuasion to obtain a favorable security decision.” A person who seeks access to classified information enters into a fiduciary relationship with the Government predicated upon trust and confidence. This relationship transcends normal duty hours and endures throughout off-duty hours. The Government reposes a high degree of trust and confidence in individuals to whom it grants access to classified information. Decisions include, by necessity, consideration of the possible risk the applicant may deliberately or inadvertently fail to safeguard classified information. Such decisions entail a certain degree of legally permissible extrapolation of potential, rather than actual, risk of compromise of classified information. Analysis Guideline E, Personal Conduct AG ¶ 15 expresses the security concern for personal conduct: Conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about an individual's reliability, trustworthiness, and ability to protect classified or sensitive information. Of special interest is any failure to cooperate or provide truthful and candid answers during national security investigative or adjudicative proceedings. . . AG ¶ 16 describes conditions that could raise a security concern and may be disqualifying. The following disqualifying conditions are potentially applicable: (b) deliberately providing false or misleading information; or concealing or omitting information, concerning relevant facts to an employer . . . ; (c) credible adverse information in several adjudicative issue areas that is not sufficient for an adverse determination under any other single guideline, but which, when considered as a whole, supports a whole-person assessment of questionable judgment, untrustworthiness, unreliability, lack of candor, unwillingness to comply with rules and regulations, or other characteristics indicating that the individual may not properly safeguard classified or sensitive information; and 8 (d) credible adverse information that is not explicitly covered under any other guideline and may not be sufficient by itself for an adverse determination, but which, when combined with all available information, supports a whole-person assessment of questionable judgment, untrustworthiness, unreliability, lack of candor, unwillingness to comply with rules and regulations, or other characteristics indicating that the individual may not properly safeguard classified or sensitive information. This includes, but is not limited to, consideration of: . . . (3) a pattern of dishonesty or rule violations; and (4) evidence of significant misuse of Government or other employer’s time or resources. In SOR ¶ 1.a, the Government alleged that Applicant was terminated from his employment for falsifying his timecards. Applicant denied the allegation in his Answer, claiming that he and his immediate supervisor “both agreed on the number of hours I would enter for that time period.” In denying the allegation, Applicant put the burden on the Government to establish it. The Government has done so. GE 3, GE 4, and GE 5 are company business records establishing that Applicant was terminated on November 9, 2016, for what the company concluded was falsification of his timecards. An employer’s characterization of events underlying an adverse action are entitled to some deference.8 Applicant’s disagreement with the reasons for his termination is not enough to overcome that presumption. Applicant’s actions satisfy the general personal conduct security concern (AG ¶ 15) as well as the “catch-all” disqualifying conditions of AG ¶¶ 16(c), 16(d)(3) (pattern of dishonesty or rule violations) and 16(d)(4)(significant misuse of an employer’s time and resources). AG ¶ 16(b) also applies, as Applicant’s actions constitute “deliberately providing false or misleading information . . . concerning relevant facts to an employer.” AG ¶ 17 sets forth potentially applicable mitigating conditions under Guideline E: (a) the individual made prompt, good-faith efforts to correct the omission, concealment of falsification before being confronted with the facts; (c) the offense is so minor, or so much time has passed, or the behavior is so infrequent, or it happened under such unique circumstances that it is unlikely to recur and does not cast doubt on the individual's reliability, trustworthiness, or good judgment; 8 ISCR Case No. 14-00114 at 3 (App. Bd. Sept. 30, 2014), citing ISCR Case No. 10-03886 at 3 (App. Bd. Apr. 26, 2012). 9 (d) the individual has acknowledged the behavior and obtained counseling to change the behavior or taken other positive steps to alleviate the stressors, circumstances or factors that contributed to untrustworthy, unreliable, or other inappropriate behavior, and such behavior is unlikely to recur; and (f) the information was unsubstantiated or from a source of questionable reliability. Records from Applicant’s employer, DC 2, reflect that Applicant was to complete 10 courses of required on-line training, over an estimated 25 hours. The courses were “self-paced,” and Applicant requested 40 hours to complete them. On October 17, 2016, Applicant submitted a time card for the full 40 hours of training (after making a requested change, allocating the time as “training” rather than as “overhead”). DC 2’s computer training system reflected that Applicant had only completed two of the tests, over 2¼ hours, on two days, Thursday and Friday, October 6 and 7, 2016. When Applicant was confronted by his supervisors with this significant discrepancy he claimed to have done eight hours of training for each of the five days, but offered no details. When Applicant’s supervisors then offered to review computer log-in records with him that might corroborate (or disprove) his claim, Applicant balked, and offered to submit 40 hours of personal time off (leave) for the entire week (including for the 2¼ hours of training the company was able to document). Applicant’s supervisors requested instead that he submit an accurate time card. On the afternoon of October 18, 2016, (after his meeting with Mr. J and Mr. W) Applicant then changed his time card to reflect 25 hours of training and 15 hours of leave. Perhaps not coincidentally, 25 hours was exactly the same amount of time the company estimated it would take to complete the 10 training courses. Applicant repeatedly asserted that, later that day, he and Mr. J had a second meeting with Mr. J, at which Mr. J allegedly told Applicant to change his time card to reflect 25 hours of training. This assertion is not simply credible. Chiefly, this is because on October 20, 2016, two days after confronting Applicant, both Mr. J and Mr. W signed a letter recommending Applicant’s termination, and detailing their rationale for doing so. Second, despite Applicant’s protests, there is no independent record evidence to rebut that memo that would bolster Applicant’s claims about a purported “second meeting” with Mr. J, or his claims that they had any sort of “agreement.” Third, Applicant gave no specific detail, either about any of the training videos he purportedly watched or about any related tests he purportedly took. By contrast, his explanation at hearing that “at the end of the week, Thursday and Friday, I started 10 taking my tests” comports precisely with DC 2’s computer record documenting when he logged in. Fourth, Applicant’s testimony that he was not credited with logging in for any tests he took but failed is simply not credible. If he had logged in earlier in the week, it is a reasonable inference that the company’s training system would have verified it. Applicant gives every appearance of having skipped the training for at least three days, before beginning the tests on Thursday and Friday for about two hours, and then giving up. This leaves one to wonder why Applicant attempted to placate his bosses by offering to take a full 40 hours of leave if those 40 hours included several days’ worth of training that he actually did – training time for which, one presumes, he would have wanted proper credit had he in fact completed it. Applicant was found by his employer to have falsified his timecards. This was substantiated by DC 2’s own records, which Applicant was unable to rebut. He was given ample opportunity to come clean and acknowledge his wrongdoing but steadfastly refused to do so. His falsifications were regarded by his employer as part of a pattern, and his actions were found serious enough to warrant termination. Applicant did not provide sufficient evidence to overcome the presumption that DC 2’s decision to terminate him was warranted and appropriate. Applicant never acknowledged any wrongdoing, in the face of credible, documented evidence of his fraudulent actions and falsifications. He has not shown that his actions happened under such unique circumstances that they are unlikely to recur and do not cast doubt on the individual's reliability, trustworthiness, or good judgment. No personal conduct mitigating conditions apply. Whole-Person Concept Under the whole-person concept, the administrative judge must evaluate an applicant’s eligibility for a security clearance by considering the totality of the applicant’s conduct and all relevant circumstances. The administrative judge should consider the nine adjudicative process factors listed at AG ¶ 2(d): (1) the nature, extent, and seriousness of the conduct; (2) the circumstances surrounding the conduct, to include knowledgeable participation; (3) the frequency and recency of the conduct; (4) the individual’s age and maturity at the time of the conduct; (5) the extent to which participation is voluntary; (6) the presence or absence of rehabilitation and other permanent behavioral changes; (7) the motivation for the conduct; (8) the potential for pressure, coercion, exploitation, or duress; and (9) the likelihood of continuation or recurrence. Under AG ¶ 2(c), the ultimate determination of whether to grant eligibility for a security clearance must be an overall commonsense judgment based upon careful consideration of the guidelines and the whole-person concept. 11 I considered the potentially disqualifying and mitigating conditions in light of all the facts and circumstances surrounding this case. I have incorporated my comments under Guideline E in my whole-person analysis. Applicant asserted that his supervisor had told him that it was acceptable to bill 25 hours of training time. He was unable to provide any corroborating evidence for this assertion. I did not find Applicant’s explanation credible, especially when compared with the documentary evidence from his employer (including a memo signed by the very witness Applicant thought would exonerate him). Applicant also never acknowledged any wrongdoing, either before or during his hearing. Overall, the record evidence leaves me with questions and doubts as to Applicant’s eligibility for continued access to classified information. Formal Findings Formal findings for or against Applicant on the allegations set forth in the SOR, as required by section E3.1.25 of Enclosure 3 of the Directive, are: Paragraph 1, Guideline E: AGAINST APPLICANT Subparagraph 1.a: Against Applicant Conclusion In light of all of the circumstances presented, it is not clearly consistent with the national security interests of the United States to continue Applicant’s access to classified information. Eligibility for access to classified information is denied. _____________________________ Braden M. Murphy Administrative Judge