Top Defense Dept. Official Wins Order Delaying Lawsuit Over Security Breach

WASHINGTON — A federal judge in Washington has set a deadline for next week seeking information in a top Defense Department official’s lawsuit over why she was released from her job after first losing her security clearance.

Katie Arrington oversaw cybersecurity for defense contractors when she was accused of disclosing classified information from the super secret National Security Agency.

She claims in her lawsuit filed in U.S. District Court in October that she doesn’t know anything about leaking information. She suspects she was suspended for political reasons.

The lawsuit is giving a rare glimpse into the clandestine world of spies and counterspies that normally stays behind closed doors.

The National Security Agency uses high-tech eavesdropping techniques to collect information on foreign adversaries, mostly through satellites. It transfers the information to the Defense Department.

The agency has refused to comment on Arrington’s lawsuit, partly because it is a pending legal matter but also to protect national security.

Arrington’s job title with the Defense Department was chief information security officer for acquisition and sustainment.

She got the job partly based on her experience as a two-term Republican state representative from South Carolina who later ran unsuccessfully for Congress in 2018. Her campaign emphasized her corporate background with cybersecurity.

Her Defense Department biography says, “She has over 15 years of cyber experience acquired through positions at Booz Allen Hamilton, Centuria Corporation, and Dispersive Networks. These positions have given her a unique experience of supporting and working with the government at large, small, and non-traditional contracting firms.”

When she joined the Defense Department in 2019, she was classified as a “highly qualified expert.” She later applied and was hired for the Senior Executive Service, which placed her in a key position one step below presidential appointees.

One of her responsibilities was implementing a certification process for defense contractors. They were required to have their cybersecurity programs audited every three years.

The certifications are supposed to be done on as many as 300,000 companies. Critics in Congress say it is moving too slowly.

The Defense Department’s May 11 notification of her security clearance suspension said this “action is being taken as a result of a reported Unauthorized Disclosure of Classified Information.” It also warned Arrington that she might have committed a federal crime.

On Tuesday, her attorneys filed a motion for an injunction asking the court to order the Defense Department to explain why her security clearance was removed.

The motion implied political reprisal was the real motive when it said, “Arrington was notified by Deputy Assistant Secretary for Industrial Policy, Jesse Salazar, a political appointee of President Joseph R. Biden’s Administration … that she was now in a paid, non-duty status given the suspension of her clearance access.”

She has acknowledged that she had ties to former President Donald Trump.

Her motion added that she is willing to cooperate in providing information to investigators about her actions, “[b]ut until she is properly provided with the relevant comprehensive details, whether classified or unclassified, she is unable to participate in the process.”

On Wednesday, U.S. District Judge James Boasberg ordered the lawsuit put on hold pending more information from the parties. They are supposed to submit updated reports to the judge by Dec. 10.

A previous Defense Department report said Arrington “disclosed Top Secret, highly sensitive classified and protected information to unauthorized persons, via electronic means, on an unclassified network, which had the potential to inflict exceptionally grave damage to the national security of the United States.”

Arrington said the report was too vague to comply with Defense Department personnel guidelines. It should have informed her when the alleged leak occurred and the person or organization that received the classified information, she said.

The Defense Department also failed to explain why it was not giving more complete information, she said.

The lawsuit is filed as Katherine Arrington v. Department of Defense et al., case number 1:21-cv-02669, in the U.S. District Court for the District of Columbia.

Tom can be reached at [email protected]