top | item 41260855

(no title)

jdmarble | 1 year ago

I think that a better strategy is to make the work that requires a clearance as "small" as possible. Consider two contractors:

Contractor A does everything in a closed area. All software is written, built, and tested on classified information systems. In this situation, it is impractical to move anything out, regardless if the software is actually classified. It's easy to move things back and forth between the developer's machines and the (necessarily) classified test/production system, but now you have the problem from TFA: you can only hire cleared employees or you eat the cost of them doing nothing useful for ~1 year.

Contractor B has arranged things so that the work that has to be done in a closed area is only on the specific information that _must_ be classified as described in the security classification guide for that program. Depending on the program this could be a small software library or even a configuration file. Interns and first-year employees can work on the majority of the system with dummy/stub libraries and fake data, then hand their work over to cleared employees for further testing in the closed area (if that is even necessary for the work at hand). It is not very hard to move software from an unclassified to a classified area. It is harder to move test results from a classified to an unclassified area. A description of what happened when an unclassified piece of software runs in a classified environment _can_ be sanitized and still leave all information necessary to continue work outside. Aside from the situation described in TFA, this also reduces the "it is miserable working in the SCIF" retention problem.

It requires work to arrange things in this way, but not much more work if the software is written using best practices. Maybe this strategy only applies to software development. There are other professions out there I've heard. :)

discuss

order

No comments yet.