Katie Arrington, who has been on administrative leave with pay since May, has filed a lawsuit against the Defense Department and the National Security Agency in an attempt to clear her name and accelerate the investigation into her alleged violations. Arrington had been DoD’s chief information security officer for acquisition and sustainment to the Undersecretary of Defense for Acquisition and Sustainment since 2020 and led the development of the Cybersecurity Maturity Model Certification (CMMC) program.
In the complaint filed in the District Court of Washington, D.C., Arrington, who is represented by attorney Mark Zaid, claims DoD and NSA suspension of her security clearance and her position in the Pentagon are “baseless or exaggerated,” and are politically motivated.
“The decision was designed to interfere with the cybersecurity activities that Plaintiff was running through DoD, which NSA did not support. Nor did certain high-ranking DoD officials want the Plaintiff serving in a senior position within the Biden Administration due to her close previous ties with President Trump and they are using the NSA’s decision as a pretext to remove her,” the filing stated.
DoD placed Arrington on administrative leave in May after NSA alleged she accessed classified information that she was not authorized to see and suspended her security clearance.
Zaid said in an email to Federal News Network that suing DoD was the only way to accelerate an end to this saga.
“Despite our best efforts over the entire five month suspension period, all of our overtures to cooperate and provide information were categorically rejected by DoD and NSA. There was no indication any end was in sight with respect to this investigation,” he said. “I have seen similar inquiries drag on for years and we were simply not going to tolerate that occurring in this case. The lawsuit now ensures that judicial oversight exists for how the Executive Branch handles this investigation.”
Additionally, Arrington claims DoD and NSA leaked potentially harmful information about her to the press that was an attempt to cause further harm and is “completely false and defamatory, such as assertions that her security clearance had been revoked and that she had been fired. Neither of these events have occurred.”
Arrington and Zaid said NSA and DoD have ignored or not provided any information pertaining to NSA’s actions or the reasons behind the suspension of her security clearance despite repeated requests.
“In fact, there was no reason for DoD to suspend Plaintiff’s Top Secret security clearance simply because NSA had removed her access to a small subset of information that was not needed for her to continue her daily work,” the filing stated. “It has been five months since the Plaintiff’s security clearance was suspended and there have been no indications the Defendants have taken any significant substantive steps to move their investigation forward, much less give the Plaintiff an opportunity to respond to any allegations. It is rare that an individual holding a Senior Executive Service position such as held by the Plaintiff would be left dangling in this way. Generally, these types of investigations would be expedited for senior officials. Upon information and belief, the Defendants are purposefully delaying or failing to take action in this matter in order to compel the Plaintiff to resign.”
Zaid added in an email that while every case is different and fact dependent, and given that this allegation is very narrow , he believes DoD could have easily addressed it through “a full and proper investigation within literally two weeks, perhaps four weeks in light of COVID.”
An email to DoD public affairs seeking comment also was not immediately returned.
Through this lawsuit, Arrington wants DoD to complete its investigation in a timely manner, provide her due process and provide her with a “name-clearing” hearing.
Zaid said Arrington also would want to return to her position in DoD.
She also wants DoD to pay her attorney’s fees and for the court to grant any other relief it deems proper.
The CMMC program, for the most part, has been on pause since DoD launched a review of it last spring. DoD officials recently said the Pentagon would announce changes to the program in the coming months. Meanwhile, industry continues to prepare for the program.
At the CMMC Accreditation Body town hall on Tuesday, Matt Travis, the AB’s CEO, said there are 70 licenses training providers who are beginning to train classes of 20-25 potential assessors to help ramp up the program.
Travis said DoD and the AB recognize the challenge of having enough third-party certified assessment organizations (C3PAOs) and that is one issue the department is reviewing as part of the improvements to CMMC.