Defense Dept. Official Sues to Get Answers on Suspension

WASHINGTON — A high-ranking Defense Department official sued in federal court in Washington, D.C. this week to determine why her security clearance still is suspended after five months.

The DOD has accused Katie Arrington of “unauthorized disclosure of classified information,” says her lawsuit filed in U.S. District Court for the District of Columbia.

Arrington is on paid administrative leave after being chosen in 2019 to organize a cybersecurity program for government contractors.

She claims she has been “left dangling” about why she is being investigated. She suspects it is politically motivated.

“Nor did certain high-ranking DOD officials want the Plaintiff (Arrington) serving in a senior position within the Biden Administration due to her close previous ties with President Trump and they are using the [National Security Agency’s] decision as a pretext to remove her,” the lawsuit says.

It says “unknown individuals” in the Defense Department leaked private and defamatory information about her.

“Generally, these types of investigations would be expedited for senior officials,” the lawsuit says. In Arrington’s case, “the defendants are purposefully delaying or failing to take action in this matter in order to compel the plaintiff to resign.”

The DOD notified Arrington in a memo on May 11 that her security clearance was suspended. The next day, Arrington was told she was being put on paid administrative leave.

The memo did not give a detailed explanation. In addition, she says her repeated requests for information to the Defense Department, the National Security Agency and the Defense Counterintelligence and Security Agency went unanswered. 

Arrington was hired as the Defense Department’s chief information security officer for acquisition and sustainment in 2019, months after an unsuccessful run for Congress. Her bio says she had 15 years working in cybersecurity for firms such as Booz Allen Hamilton.

Her lawsuit also alleges that suspending her security clearance appears to be an example of overkill by the Defense Department.

She acknowledged that the NSA removed her access to a small subset of information. However, she said it was not needed for her to do her cybersecurity work.

Arrington’s lawsuit claims violations of the Administrative Procedure Act and the Fifth Amendment, which she says should give her rights to a hearing that includes an explanation for a suspension or termination. 

The lawsuit requests a court to order the DOD and NSA to complete their investigation. She also wants her attorney to be given information relevant to the case.

Although the Defense Department has declined to comment on the lawsuit, it comes at a time of heightened awareness of cyberattacks against the U.S. government.

Several bills are pending in Congress to improve the nation’s cybersecurity. Arrington was supposed to oversee a Defense Department program called Cybersecurity Maturity Model Certification, or CMMC.

It would require all defense contractors and subcontractors to meet minimum requirements for cybersecurity. They would be assessed before certification by government auditors.

The Defense Department plans to begin implementing the program this year, according to a White House Office of Management and Budget statement.

Nevertheless, at least one senior Pentagon cybersecurity official says the Defense Department is dragging its feet.

He resigned in frustration last month after alleging the Defense Department was unwilling to take adequate measures to match the threat from China.

Nicholas Chaillan became the U.S. Air Force chief software officer in 2018. Two years later, the departments of Defense, Treasury, State and Homeland Security were hit with the Russia-based SolarWinds cyberattack. Other hacking attacks are blamed on China.

Chaillan said on his LinkedIn page that the Defense Department has minimal chances of protecting against sophisticated Chinese cyberattacks without a more dedicated and well-funded effort.

Arrington’s lawsuit is Katherine Arrington v. Department of Defense et al., case number 1:21-cv-02669, in the U.S. District of Court for the District of Columbia.

Tom can be reached at [email protected].