Security Clearances at the Speed of Startups

Getting a security clearance comes with liability and potential downside that doesn't exist in the private sector. Some examples:

* Restrictions and reporting requirements around international travel and contact with foreign nationals

* Restrictions on discussing work with friends and family

* Prohibition on cannabis use

* Prohibition on reading publicly leaked secret documents (from the Snowden days: https://web.archive.org/web/20211120154017/https://sgp.fas.o...)

Interns-to-be should consider carefully whether this lasting infringement on personal liberty is worth any upside of employment at a defense contractor for 3 months.

I think this submission title should be modified to:

> Palantir’s accelerated security clearance plan for students

This addresses several issues with the headline as presented:

- It’s capitalized appropriately for HN.

- It clearly states that this is about students only, reducing the scope of the effort from the unstated framing: “all workers”.

- It reflects the single-company focus of Palantir in the article, improving HN submission search results for that company.

- It reuses the exact wording of the most key heading in the article with only two words added: “for students”.

Daniel Ellsberg giving advice to Henry Kissinger about security clearances, in 1968, from his book "Secrets", https://www.motherjones.com/kevin-drum/2010/02/daniel-ellsbe...

> You will deal with a person who doesn’t have those clearances only from the point of view of what you want him to believe and what impression you want him to go away with, since you’ll have to lie carefully to him about what you know. In effect, you will have to manipulate him. You’ll give up trying to assess what he has to say. The danger is, you’ll become something like a moron. You’ll become incapable of learning from most people in the world, no matter how much experience they may have in their particular areas that may be much greater than yours.

Full quote: https://news.ycombinator.com/item?id=36364006

HN ranking history for this thread: https://hnrankings.info/41238823

Having done startups in the national security space (and had to deal with clearances) -- it's a bad system from both directions -- overly onerous compliance for good people AND ineffective at addressing modern security risks. It made sense in the 1950s as a way to protect large development and operational programs with long tenure employment against penetration by an external adversary (USSR), and to a limited extent, ideological or financially motivated defectors. It doesn't work as well today where someone can become "radicalized" online, foreign/international contacts are routine, etc.

Just being a citizenship bar, even if it did nothing else, really complicates hiring in tech -- what you often end up doing is having as much work as possible done uncleared/commercially and then thrown over the wall to cleared people who can implement it with the client. Works well in infosec with mostly systems integrated with commercial stuff; doesn't work with jet engines or missiles as well

Clearances being handed out like relative candy to 18-28 year olds in the military (so, for someone like Manning, approximately zero information responsive to requests (as minor records excluded, and the 7-10 year lookback isn't relevant when you have far fewer adult years), extreme reluctance to suspend or revoke a clearance when granted), and ineffective reporting of incidents.

The hassle of holding a clearance to some extent depends on the issuing agency/level (DOD Secret is relatively non-hassle; law enforcement ones are more lifestyle focused on paper at lower levels; substantial travel restrictions for levels/programs come in above Secret too).

There is also the difference between official restrictions and reality -- given OPM hack and general government incompetence, it's safe to assume your info becomes public or at least known to adversaries, so even after a clearance expires, it would probably be unwise to travel to some countries for a much longer period. Also exposes your family/other contacts to hassle from both USG investigators and potential foreign adversaries.

I think that a better strategy is to make the work that requires a clearance as "small" as possible. Consider two contractors:

Contractor A does everything in a closed area. All software is written, built, and tested on classified information systems. In this situation, it is impractical to move anything out, regardless if the software is actually classified. It's easy to move things back and forth between the developer's machines and the (necessarily) classified test/production system, but now you have the problem from TFA: you can only hire cleared employees or you eat the cost of them doing nothing useful for ~1 year.

Contractor B has arranged things so that the work that has to be done in a closed area is only on the specific information that _must_ be classified as described in the security classification guide for that program. Depending on the program this could be a small software library or even a configuration file. Interns and first-year employees can work on the majority of the system with dummy/stub libraries and fake data, then hand their work over to cleared employees for further testing in the closed area (if that is even necessary for the work at hand). It is not very hard to move software from an unclassified to a classified area. It is harder to move test results from a classified to an unclassified area. A description of what happened when an unclassified piece of software runs in a classified environment _can_ be sanitized and still leave all information necessary to continue work outside. Aside from the situation described in TFA, this also reduces the "it is miserable working in the SCIF" retention problem.

It requires work to arrange things in this way, but not much more work if the software is written using best practices. Maybe this strategy only applies to software development. There are other professions out there I've heard. :)

Not sure why this article (or Palantir) is trying to paint this as a new thing. I started at a legacy defense contractor immediately after graduating from undergrad. I was hired and had my security clearance process initiated during the fall of my senior year. Unfortunately this was during the great backup of ~2016 so I still wasn't cleared by the time I started, but they still had unclassified work I could do.

I work in this industry and I thought the practice described here was common. I'm aware of multiple companies, including my own, that put in for security clearances for interns so they can have a clearance on the first day of their full time employment.

A job that requires a security clearance is not a job that I want to be doing, ever.

It definitely takes a long time and makes it hard to employ people.

I've had SC clearance twice in the UK, which isn't too bad, just a couple of months or so. Even so, I saw people sit around waiting for their clearance, unable to do anything, and then leave before they had managed to do anything.

One job I applied for needed a DV clearance, and that takes a really long time. They advised me to get another job in the meantime, but it was just too much hassle, so I passed on it.

> Over the last five years more of my students have understood that Russia’s brutal war in Ukraine and strategic competition with the People’s Republic of China mean that the world is no longer a stable and safe place. This has convinced many of them to work on national security problems in defense startups.

oh so that is why there's always that crap on the news?

Man I miss when they lured smart kids with the false promises of moon rockets

Security clearances should take a long time because the risk of information being leaked is so high. Not sure I'm aligned here with Palantir or Steve Blank that the process needs to be sped up. Sounds like a recipe for disaster given all of the leaks we've seen over the past decade or more.

This is how the hiring process already works at government agencies. You get a CJO (Conditional Job Offer) are able to start the clearance process and get the FJO (Final Job Offer) once you receive the clearance.

Rule of Thumb: Unless either (1) your family has been "in that line of work" for several decades, or (2) a Clearance is needed for long-term success in your chosen field, the grief & weirdness of getting & maintaining a Security Clearance is Just Not Worth It.