The need for a National Personnel Checking Directorate (Vetting)

The SSU finding Russian spies in NABU has highlighted the need for a totally new approach for security vetting in the government organisations in Ukraine. This post tries to shw how it could be don differently to fit into the NATO system. (Best practice folks?)

Vetting people for important and secret work is arguably one of the most important tasks for the SSU and possibly one of the worst conducted. The level of checking appears to be random and the number of those being denied clearance and removed from post does not reflect the challenges of a country at war against Russia in any way.

Having a proper working and efficient security vetting system will be one of, if not THE KEY requirement for NATO membership, and to a lesser extent EU membership. NATO will need to see that the vetting system works and that the FSB and other agents have been cleared from government and state organisations and the SSU itself. Ukraine cannot claim today at all that they have cleared the country of hostile Russian influence.

This directorate requires a strong degree of independence both within the SSU and from all other security organisations if it is to do its job properly and securely and it should either have strong independence within SSU. The international advisers suggest it be removed entirely into an agency.

Tasks for this directorate are:

1. identification of all "security necessary" posts nationwide that require National (also NATO and EU) security clearance:
   
   a) note that in a NATO country there are different levels of checking depending upon the level of access to secrets required.
   b) there must also be a list of counter terrorist posts that require to be checked.
2. conducting checks (and rechecks at appropriate times) to the correct level for all personnel appointees to security graded posts
3. maintenance of a personnel security risks register (data base)
4. maintenance of a regular reporting system about the security status on all personnel in key posts
5. warning and reporting to the appropriate government leadership when someone fails a test or is close to failing
6. liaison with allies and international bodies concerning personnel with international posts or those working in Ukraine and sharing best practice for vetting
7. liaison with other SSU directorates, especially counterintelligence, for vetting support

Security checking (Vetting) of personnel is vital for the safe and secure working of any government. In Ukraine, this task has been given to the SSU. This inclusion within security services is not considered normal in Euro Atlantic countries and DCAF comment about version V of the law in that the law:

"is unusual in granting the SSU with wide ranging powers on the vetting of individuals. This task is normally undertaken by other departments/agencies" (DCAF Geneva Comments to the Ukraine Parliamentary Defence Committee, Analysis of the Draft Law on the Security Service of Ukraine (November 2020), v5).

It is recommended that the government should set up a separate directorate to manage security vetting and that it should either be given considerable independence and separation from the main body of the SSU. Parliament should even consider removing this from the SSU into a separate independent agency.

In most areas of government there is currently an all-or-nothing approach that over-grades security massively in most areas of work, and insufficient or even none in some key areas like the Presidents Administration. A typical example of security nonsense is the SSU itself grading as secret the number of cars it owns. If the level of security of information is not sensible then the security levels chosen for those protecting that security will also not be sensible. Personnel vetting will need serious rethinking and action before NATO membership can be considered seriously.

The initial work required is to identify those posts that require the highest levels of clearance and how checks on people filling those posts are to be conducted. There are already processes but it is obvious that these processes are not being conducted systematically, for example on MOD deputy Ministers or senior army officers, some of whom have close relations inside the Russian government apparatus.

The levels of security and checking should sensibly be brought into line quickly with NATO levels. The standard is the process that is attached to each level. Details of the four levels of NATO classifications can be found in the brief from NATO ACT.

In the lowest level for example, all government personnel in key Ministries (for example all in defence and interior, including cleaners, but only key appointments in areas non security like education or culture) plus key workers in defence industry will be negatively vetted by a simple police and tax check. This would allow occasional access up to secret information or a similar level of access. If Ministries have properly licenced internal security organisations, then this work can be passed to those Ministries to conduct for themselves. This is important for Ministries like defence that have large numbers and a high turnover and frees the SSU to concentrate upon higher government levels of security checking. However, in Ministries, this work should only be done by people professionally trained and licenced by the SSU.

Positive vetting is done in three or more levels:

• Regular access to secret: this would include all officers above Lt Colonel, all security organisation personnel, all members of Parliament etc. Loss of clearance would effectively mean loss of job or movement to a post that does not have access to security information.
• Regular access to top secret. This would be most cabinet ministers, key officials and heads of departments and relevant parliamentary committee members. Again, loss of clearance means removal from post.
• Highest access. This would be for the president’s administration, heads of organisations, some key government ministers, heads of committees and many diplomatic and senior security organisation posts.

For all these levels there are extensive personnel interviews and checking of background, finances, travel and contacts. The higher the level the more rigorous and detailed the check with the highest levels looking back at least 10 years of a person and the activity of his family.

As well as the above four levels, UK also has a fifth level of "Counter Terrorist Check". This check is for individuals who have jobs that:

• involve proximity to public figures assessed to be at particular risk from terrorist attack
• give access to information or material assessed to be of value to terrorists
• involve unescorted access to certain military, civil, industrial, or commercial establishments assessed to be at particular risk from terrorist attack.

It should be noted the importance of this 5^th check to national infrastructure security such as airports even if there are no "national secrets" involved in any way.

It is vital that this organisation, even if remaining within SSU for budgeting, administration, and personnel, should still have a large degree of independence. It is vital that there should be no possibility of political or criminal interference in the system and that all those working on vetting should themselves be cleared to a high level. The head of the directorate must be beyond reproach and likely selected by open competition and confirmed by Parliament. Any hint of Russia or any other hostile state, corruption, excess property ownings or lifestyle, oligarchical or criminal contacts should be automatic disqualification from the post.