Defense

Top former DoD cyber official reaches settlement in bid to clear her name

Katie Arrington, the former top cyber official in DoD’s office of acquisition and sustainment, gained new information as part of a lawsuit, her attorney said.

Jared Serbu@jserbuWFED

February 2, 2022 7:19 am

3 min read

A top Pentagon acquisition official whose security clearance was suspended for allegedly disclosing classified information has reached a legal settlement with the government. It won’t get her clearance restored or get her job back in the near term, but it does give her a chance to see at least some of the evidence behind her suspension.

Katie Arrington served as the chief information security officer in DoD’s office of acquisition and sustainment until May of last year, when the National Security Agency suspended her clearance and DoD placed her on paid administrative leave.

The reasons behind that suspension are themselves, of course, classified. According to court filings, Arrington was told only that it was because of “a reported unauthorized disclosure of classified information,” and never given any details about what kind of information she purportedly released, when it happened, or who she disclosed the information to.

In a lawsuit, Arrington argued that even though government agencies have almost unlimited discretion to decide who should and shouldn’t have clearances, they do at least need to give employees a way to challenge allegations that they’ve mishandled information, especially when they’re proposing to permanently revoke a clearance, as DoD’s Consolidated Adjudication Facility (CAF) eventually did last October.

The settlement, filed this past weekend in the U.S. District Court for D.C., deals with at least that part of Arrington’s case, said Mark Zaid, her attorney.

“As a result of the litigation, Arrington was able to obtain additional crucial information that was necessary in order to respond to the Defense Department’s initiation to revoke her security clearance,” he said.

In an email to Federal News Network, Zaid said the information the government has turned over so far “clearly demonstrates” there was no security violation in the first place, and that he hopes the case will be fully resolved in Arrington’s favor within the next few months.

Before her suspension, Arrington was best known as DoD’s chief advocate for a new approach to dealing with cybersecurity within the Defense Industrial Base. The Cybersecurity Maturity Model Certification program (CMMC), which is still years away from being fully implemented, demands that vendors meet baseline cybersecurity standards before they’re allowed to bid on Defense contracts.

DoD began discussing a reassessment of the CMMC program last summer, and restructured the program to a “2.0” version in November. Among other changes, the new edition is meant to streamline CMMC and make it less costly for small businesses.

Based on the limited information available in the public record, it’s far from clear whether Arrington’s alleged wrongdoing was related to CMMC or to something else entirely. Until this past weekend’s confidential settlement, she didn’t know either, according to court filings.

But those filings also suggest Arrington was never suspected of a classified disclosure grievous enough to warrant serious attention from criminal investigators or prosecutors.

The Air Force Office of Special Investigations (AFOSI) looked into it, and decided not to spend much time on the case, as the Defense Counterintelligence and Security Agency appeared to acknowledge in one email to Arrington.

“Regardless of whether a formal investigation was conducted and despite AFOSI’s determination there was no criminal intent, you disclosed Top Secret, highly sensitive classified and protected information to unauthorized persons, via electronic means, on an unclassified network, which had the potential to inflict exceptionally grave damage to the national security of the United States,” DCSA told Arrington, according to court documents.

As part of the settlement, Arrington will have until March 3 to challenge those allegations to DoD’s Consolidated Adjudication Facility. Prior to the lawsuit, the deadline was Jan. 3, a task her attorneys said she could not possibly accomplish without knowing what information she was accused of disclosing.