Providing sensitive personal info to work on a project

[RacingAZ]

I just got a new project (thru the architect) with a very big defense contractor. Now, to get access to the site we're being asked to submit to a background check, provide personal info and documents and answer a bunch of very detailed questions. I think what they are asking is very similar to a security clearance application.

This is on top of what's already provided during the RFP qualifications process.

I understand why they are doing it but I just have this eerie feeling that somehow, I'll be subjected to a virtual strip search if I go along with it. Not that I have anything to hide but I feel like, this private company is collecting and storing extensive personal info on everyone they do business with, not even any branches of government has compiled and stored in 1 location.

My question: Is anyone here went thru a similar process and felt the same or am I being paranoid? I'd like to hear your take on this.

I'd think it over for a couple of days and decide if I would go along or withdraw from the project.

 

[msquared48]

If you want to work on any defense contracts, expect a thorough background check from the NSA, and others. It is standard and expected.

Mike McCann
MMC Engineering
Motto: KISS
Motivation: Don't ask

 

[RacingAZ]

Mike,

Thanks for the quick response. I understand that part even before your post. My question is, if you have gone thru that process and felt the same way or am I making something out of nothing?

It's not a defense contract. What we're doing is facility improvements / expansion for the defense contractor. No government contracts involved.

 

[msquared48]

Still falls under the same umbrella here as you may have to look at sensitive documents or enter sensitive areas for inspections.

Be mindful that there is no need for the contractor to have your sensitive information though. You should be communicating directly with the appropriate investigating governmental agency, fillint out the authorized governmental forms.

I would trust nothing else here.

Mike McCann
MMC Engineering
Motto: KISS
Motivation: Don't ask

 

[IRstuff]

"What we're doing is facility improvements / expansion for the defense contractor. No government contracts involved. "

Not totally true, unless you never step into their facility. If you do, you may inadvertently see, even if not classified, controlled unclassified information (CUI), for which you pretty much get the same level of scrutiny as the lowest level of security clearance.

I think that most companies would rather NOT acquire such information, if they didn't have to. It's a very annoying burden, since it requires protection, and is potentially a liability if it gets stolen or leaked. There's nothing they can usefully do with it, so there's little ROI for collecting such information.

TTFN

FAQ731-376
Chinese prisoner wins Nobel Peace Prize

 

[mauricestoker]

RacingAZ,

Being a federal employee, I go through that procedure every time I change jobs. This should be only a National Agency Check. It really has nothing to do with classification of security, but rather access to federal owned, leased or operated facilities. As an example, we rarely have to get architect-engineer personnel badged, unless they are going to be working on site for more than three days, or if they will not be escorted. Typically, existing records/data bases are reviewed by assigned agency for existing adverse information on record. No new investgation is typically started, and check is normally completed in 10 days.

A security clearance is much more intense, especially when multiple letters, colors, or the word "surety" is included-those are a bear, and can even lead to the point of psychological analysis and testing on a quarterly basis.

If you think its tough on the applicant side, think of being a fed project manager who has to securely handle all the aplications and coordinate betwen the physical security office and GC. For one project, that was close to two weeks of work, mostly scheduling appointments for badge photos and proof reading applications. The paperwork has to be secured at all times, and any copy shredded when action complete.

If you are not delinquent on child support payments, do not have a domestic violence arrest, or are not on the "no fly" list, should be no problem. If its a surety program, you might not be able to get on it if you regularly take over the counter medications.

 

[IRstuff]

There's a bit of difference between a federal agency, in general, vs. a defense contractor. Even though we don't have classified information lying around, there's tons of CUI and ITAR restricted information on and about our workareas and whiteboards.

The OP didn't stipulate anything about the actual job, but we've certainly had ouside contractors building facilities for classified work and processing, and I'd assume that the contractors are checked at least to the point of knowing whether they might be vulnerable to being coerced into sabotage or bugging our facilities.

TTFN

FAQ731-376
Chinese prisoner wins Nobel Peace Prize

 

[RacingAZ]

Mike - that's a good point. Right now, the Architect is the one collecting all the paper work for all the subs and forwarding them to the GC and the GC presenting them all to the company. Changing hands so many times, I just don't know what's going to happen with the provided info.

IR - I'm just talking about the work itself. No government contracts involved but yes, it's most likely that I'll see some of the government projects that they are working on.

That's also a good point about the burden as the company included some export controlled compliance requirements and the project info not to be seen by non-US persons.

Maurice - I'm sure I'll pass as I have a clean record. My dilemma is giving away so much personal info to a single, private company, which I find scary. They want the passport, birth certificate or naturalization certificate (if you're foreign born), they would pull criminal and consumer reports (not just credit report). Each one of these, you'll have to get from a different agency but they would potentially become that single source for all this info? I'm having a hard time embracing that concept.

 

[MacGyverS2000]

I wouldn't have a problem submitting such details directly to the investigating governmental authority, but directly to the private companies so it can switch unnecessary hands multiple times? Sounds a bit odd to me...

Dan - Owner

http://www.Hi-TecDesigns.com

 

[IRstuff]

That's pretty normal, though, even for simple visits. Visitors to our facility have to give information to our security, who then goes to the government databases to check.

TTFN

FAQ731-376
Chinese prisoner wins Nobel Peace Prize

 

[mauricestoker]

IRStuff,

Access to information systems is a longer and different check than facilities access check. Depending on what facility you need access, the extent of check may differ from 10 days to 6 months. If access to information network is added on top, that is two levels of check. If sensitive, classified or other information beyond access to information systems is required, then you start getting to the Noforn level. Different agencies have different checks, depending on security requirements. Depending on the work, a clearance might still not get you past a Noforn requirement. It does get confusing.

Even if a federal employee has a clasified access clearance, they still need to get the facility access clearance at any new work site.

Who the contractor, or subcontractors, turn private information over to, and how it is safeguarded, should be in the General Requirements portion of the GC's contract. That can be a major issue, and pain in the butt for project managers, as delay claims start amassing when the agency check doesn't come back on time.

My preference, for that reason, is to have the subcontractors turn paperwork over directly to project manager, who is then liable for security until it is turned over to security. The GC's I've dealt with are more than happy to have one less mountain of paperwork and no liability for disclosure. It takes less time to process that way, which reduces chances of delay claims.

Things are certainly different for the agency I work. The valid id must be carried and presented at the security office, and government runs and pays for the NAC.

Does the Architect or GC also do the fingerprinting and pay for the NAC? That could vary by contract as well.

 

[casseopeia]

When I was working on armories and other structures that housed weapons, I was required to go through a criminal back ground check and a DMV check. I was also fingerprinted and had to submit to a pat-down search upon entering and exiting. I didn't mind it mostly, but sometimes waiting for a female officer to do the pat-down took a long time and I'd have to sit and wait. I even tried to get them to waive that requirement saying that i had not seen any weapons in the facility smaller than your average surface-to-air missile and was pretty sure I couldn't hide one under my clothing.

The irony about the whole thing is that I never felt violated in any way, unlike several searches I had to endure while trying to catch a flight right after 9/11.

The only thing I have objected to lately when I was looking for work were places that wanted to do a credit check. I refused to give over my banking information. I was not applying for a position that handled company funds, so I didn't think it was necessary.

"Gorgeous hair is the best revenge." Ivana Trump

 

[IRstuff]

Credit checks are actually about the only halfway easy method to determine whether your finances are stressed, and, in traditional security systems, that makes you vulnerable to financial coercion.

Maurice; I wasn't referring to contractors, per se, just even sales reps. In many cases, our engineers find it easier to do the visits in the lobby, just to avoid the hassle of running security checks. Visitors, including those from other divisions of our own company, have to have prior submittal and verification of security status before they can come into the building, whether doing work or just visiting.

Visitors with more access to the building, particularly, no-escort badged ones, have a higher level of scrutiny, which is still overall, less than that for an actual clearance.

TTFN

FAQ731-376
Chinese prisoner wins Nobel Peace Prize

 

[mauricestoker]

The toughest routine security I've encountered was working in Turkey. At least in this country you only get an external pat down. The group engineer I worked with in Ankara got the crisco and wristwatch treatment on every flight, so he started taking the 10 hour bus ride instead.

 

[looslib]

How much of your data do you really think is 'private' now?
They can find out what they want, but it will take longer and cost more to research it.
Having completed a national security questionaire, they know a lot of information about you. Add in fingerprints for the 'file' and you don't have much that isn't residing in same database someplace.
You might ask what sort of clearance will be required for this job and which agency is issuing the clearance. Once you know that, ask if you can submit the clearance data directly to the agency.
Depending on what level of security you need, the clearance could take 3 to 9 months to get. If you haven't moved much, that speeds up the process somewhat as they have to interview less people.


"Wildfires are dangerous, hard to control, and economically catastrophic."

Ben Loosli

 

[byrdj]

I'll add a strange situation to this "providing info". I have a blanket contract for one customer, for thier facilities that require security, the gather of the information and processing is performed by that customer's contractor. I have access to those facilities and they are my main work

For the facilites that did not require clearance, the customer add conditions to my contract that my company provide the background checks on my employess (they recomended two contractors my company should use). Trying to explain I was the only employee did not make a differance so I tried to comply and contacted the background check companies.

this is where it gets wierd. I had to gather the info, sumbit to contractor, then review the results WITH OUT informing the employee of the results. My company then had to have seperate and secure storage for this info. this storage had to be inspected to insure complainace.

Suprisingly the fact I was the company and only employee was not being realisized. when I finally declined the contract changes did the customer realized what they were requiring