Red tape, 'tattoo-aversion' snarls government hiring of cybersecurity experts | Hacker News Reader

Red tape, 'tattoo-aversion' snarls government hiring of cybersecurity experts

chicagotribune.com

46 pointsdigisth47 comments

My brother's fiancee has a pretty coveted fellowship with a 4 letter agency here in the US (full ride, lots of lab time, money goes with her, etc).Her hair color changes with the week, but no tats or piercings otherwise. She says that sitting down at dinners with the higher-up is just confusion. The older grey-beards just do not understand the gaps. Their generation was one of service and is mostly white men that did not go to Viet Nam and are now 60+ and have at least 3 ex wives. Her generation is mixed in race and gender, marital status (if ever), and age (22 to 35 year olds). The divide is cultural to her. These guys are always 'behind the fence' and have been for 40 years. Their resumes are basically classified, they could never quit as they could never be hired in another job.

So, when she dines with them and they complain that all their fellows just go off to Apple or Sun, she knows that she just has to bite her tongue. They just won't understand because they have been so sheltered for the last 4 decades. The 'silver tsunami'[0][1] as it is known, is starting to rock the boat of the Military Industrial Complex.

[0]https://en.wikipedia.org/wiki/Aging_in_the_American_workforc... [1]http://management.fortune.cnn.com/2013/11/12/aerospace-worke...

  [The DHS] is vying with the private sector and other
  three-letter federal agencies to hire and retain talent
  to secure federal networks  [...] "The hiring process is 
  very, very difficult," she said.

Let's be honest, even if you desperately wanted to work for the government, the DHS is all about confiscating water at airports. Who in their right mind would choose that over the much cooler FBI, NSA or DOD?

The TSA is one of the many agencies of the DHS. TSA budget - $7b, DHS budget - $60b.

Yep. Cost guard, customs, secret service, federal computer incident response, FEMA, law enforcement training, INS, biological warfare defense, national communications system, and more.

>cost guard

we wish.

I work with a consulting firm, and while I do mostly private sector projects, I get stuck in DoD and DHS projects sometimes.... The DHS is a tremendously broken organization. It is bloated, wasteful, filled with overpaid middle management idiots, run by overpaid middle management idiots, and has a conservative (in a bad way) culture due to the politically biased security clearance process of the United States. (What I mean by that is the security clearance process weeds out left of center people. Peace Corps, attended school at Berkeley, smoked pot? Forget about it, you're out. Well, the smartest people often fit this profile. And they ain't at DHS)

This article hits the nail on the head in one sense. The hiring process is broken for the Federal government, but so is the firing process. If you are a productive individual and you work in a place where lazy, late to arrive, early to leave, incompetent individuals are not only tolerated but promoted, why would you stay? If you do stay, why would you work hard? That's the US Federal gov't GS workforce, particularly the DoD and DHS, in a nutshell.

TLDR: The Federal government is not only slow to hire, but because it doesn't fire, let alone identify incompetent and lazy shitbags, the Dead Sea effect is in constant overdrive with competent people.

>>> If you are a productive individual and you work in a place where lazy, late to arrive, early to leave, incompetent individuals are not only tolerated but promoted, why would you stay? If you do stay, why would you work hard? That's the US Federal gov't GS workforce, particularly the DoD and DHS, in a nutshell.

Annnnnnnnnnnnnnd pretty much every large corporation I've ever worked for.

Most of the smartest people I know usually start their own companies, or work at smaller firms where they get lucrative work to maintain a nice upper six figure salary; doing what they really love to do without all the corporate entanglements.

For example, I had a friend who worked at Thomson Reuters. After three years, he got fed up with the same scenario you pointed out. He started his own translation company (he's from Bulgaria and speaks 6 languages fluently) and now his biggest client? Oh yeah, its Thomson Reuters. He makes triple now running his own show as opposed to when he was working in the meat grinder.

"politically biased security clearance process of the United States"

Sounds interesting, have you links or can you described it in more details? I get smoke pot example, although not sure that it has left wing bias (right wing pot smoking is not that much lower - maybe they got caught less?)

Membership or expressed intent to be a member of the Communist Party of the USA will result in a rejection. It's a hold-over from the Cold War, but it's still there.[0]

[0] I dunno, google it? Make sure to include the term 'executive order' though.

This would only weed out approximately 0% of liberals in the modern U.S. though...

The greater levels of drug crime/drug crime prosecution in minority communities, leaving a documented criminal history involving drugs, is potentially a systematic form of discrimination against minorities in the hiring process.

(You can get a DOD clearance while admitting to having used drugs, although it seriously complicates a law enforcement clearance unless it was very long ago. It can't be ongoing. Having gotten arrested for it makes it a whole lot worse, though, form what I've seen of the adjudication reports from DISCO, though. White people generally do not get arrested for small amounts of drugs; black people do.)

Yes, that's a very good point, though having briefly worked HR for civil service I'd say the diversity "upcheck" would be more beneficial. It doesn't erase the systemic discriminatory factor from the difference in criminal records for the same offense, but it does try to address it in a systemic form.

Of course, diversity initiatives simply covers hiring, not clearance adjudication. But there have certainly been many other areas of DoD where people with known criminal histories (to include felons) have made it to positions of responsibility, often to the amazement of the public. E.g. childcare workers at DoD bases, and even the civilian security forces at a grouping of Navy bases.

Even diversity planning has to bow to "bona fide occupational qualification" though. If the position description requires you to have a record free of things like organized criminal activity, then diversity planning can't help you (though it can make it that much easier for minority groups with no such criminal record to make it in).

Sorry, just pointing out that there is de facto political discrimination

Well, the Communist Party of the USA was committed to the subversion of the democratic government, at least at the time. And it was only limited to subversion because direct violent overthrow was impossible.

Even today membership in groups that espouse the "violent overthrow" of the government will exclude you from positions of responsibility in said government. You can correctly call it discrimination, but I'd simply note that the Constitution of the U.S. is not a suicide pact.

I dealt with the Federal civil service hiring rules at lot at my last command.

It would take us weeks to hire someone to do routine military personnel administrative tasks. No clearance needed, no degree, no special skills beyond being trainable on a computer, etc. Weeks.

I can only imagine the difficulty present in needing to run through the hiring process and having to run a security clearance. Especially in the wake of Snowden, Aaron Alexis, Manning, and USIS screening contractor scandals, which have all combined to help guarantee that no one tries to so much as streamline any part of the SF-86 and its background investigation.

The military even has problems with this; it's not uncommon for new accessions to be delayed at their initial entry training schoolhouses due to "clearance issues". But they're at least already drawing a paycheck, and it's not as if the students waiting can just take a new job out of their frustration. And as the article mentions, it's in many ways much easier (as far as red tape goes) to join the military than to join the civil service.

I hope DHS get better hiring authorities. It may seem weird in SV but "direct hire" is practically fighting words for many groups watching the government, who are concerned that it would just be abused for nepotism.

However I do agree with the points about not needing people with a clearance. By definition DHS is not engaged in offensive cyber and defending critical network infrastructure is hardly a task that requires a year-long background check.

What? Three letter agencies recruit very heavily at my particular school and computer science department.

While I can't comment on their hiring practices for people without a college degree (even though I know a few people who have had successful careers with the govt without any college experience), I think a more likely reason heavily tattooed people could have a problem working at the government is that they are more likely to be people who are difficult to clear (heavy drug use in the past, surrounded by people who are heavy drug users, etc.). They clearance process is honestly really stupid. Having tattoos will not disqualify you, but surrounding yourself in people with bad habits will.

As someone watching close friends get hired weekly to places where they "can't say where they will be working", it seems like Uncle Sam will hire anyone with a pulse who even expresses an interest in security.

And if not, the people will just go make twice the money at a defense contractor....

edit: I think a lot of the "red tape" belief for the government comes from people who are on the outside of this industry looking in not understanding the hiring process. It is the opposite from a place like Google.

Basically. You end up in someone's office and they talk to you for a few minutes and know if they are going to hire you within the first 3 minutes of the interview. The important part though, is that you are clearable. Since this is a long and expensive process, a lot of contractors put on their job requisitions "must be able to obtain a security clearance". They will believe you if you tell them you are clearable. That's because getting denied a clearance can be a big deal if you want to work at the gov't later. It also is a auto-fire for the particular job (I would know. The clearance I was denied was the best thing that ever happened to me)....

Did you even read the article? It's about the difficulties of DHS in particular, and in the very beginning of the article, explicitly makes a distinction between it and the other three letter agencies: "the department is vying with the private sector and other three-letter federal agencies to hire and retain talent".

Not sure how you can separate DHS from any of the other 3 letter agencies... The cultures are all pretty much the same....

What experience do you have with all of those agencies to give you the knowledge to tell us that?

He has a point, though. The entire clearance process is a gigantic pain in the ass, and it takes WAY more time than anything else the DHS (or any triple letter agency) would throw at you. I, personally, been waiting for 15 months and know firsthand just how annoying it can be.

That is one of the bottlenecks here; it is something that prevents the government from hiring the best and the brightest, and having them actually do useful work.

I'm not sure that I feel good about people named "shitlord" on HN are the types of people working at the DHS with clearance.

Not DHS. Anyway, I had another account here a long time ago (back when HN had google sign in). After they got rid of google sign in, I couldn't access my account anymore and had to make a new one. I was kind of annoyed, so I decided to make my username as shitty as possible.

Actually, someone with the username "shitlord" is exactly who I'd want to be working at DHS.

All: Far too many Hacker News comments begin with "Did you even read the article?" or the equivalent. Please don't do this. It's gratuitously personal and corrodes civility.

You can communicate the same information without a personal edge by simply writing "The article says" or "As I read the article".

Your equating of tattoos, "heavy drug use", and "bad habits" is ridiculously judgmental, naive, and has almost nothing to do with the article.

Part of the problem is that in general, people who have the technical chops for security work don't really care about clearances and gov't red tape.

More importantly, they don't know what is required to get clearance. They probably feel a bit of imposter's syndrome, thinking that stuff they've done in the past will disqualify them (even if it won't, because they've never been told the specifics of what will in fact disqualify someone for a security clearance).

Govt or not, I know many people and companies that would have an initial bias against individuals w/ certain tattoos. The ones that come to mind are people I know responsible for some of the initial screening and first person to interview with. Right, wrong, that is the sample set I am thinking about.

Shoulders down, rarely an issue on tattoos. Many times easily concealed.

Neck and up? There is a definite bias to get by. Even myself, I'd be a bit more hardcore in questions.

> I think a more likely reason heavily tattooed people could have a problem working at the government is that they are more likely to be people who are difficult to clear (heavy drug use in the past, surrounded by people who are heavy drug users, etc.). They clearance process is honestly really stupid. Having tattoos will not disqualify you, but surrounding yourself in people with bad habits will.

What the fuck is this drivel? Did you honestly just imply that anyone with tattoos is likely to have a history of heavy drug use? Seriously?

I imagine the aversion is symmetrical. Given the extent to which the USG has systematically and cynically abused the trust of the American people, and done everything in their power to avoid detection, it's no surprise that the people who have the technical chops to do legitimate cyber-security work for the USG would balk at doing so. These "self-inflicted wounds" only cement the truth that no self-respecting technologist with any scruples would work for the USG in any capacity. Until something big happens (a constitutional amendment, or at least legislation that unambiguously protects us from blanket surveillance) I would expect the talent supply to be dry.

This makes me incredibly sad. I grew up believing in the goodness of my country; The Change started on 9/11. Now, we're a nation that no longer has even a speck of moral high ground: we torture, we assassinate, we spy on everyone. Defending your country doesn't matter if your countries values have been decimated by power-mad leaders manipulating the public into accepting their new lot as an under-class.

Jesus Christ, Snowden showed the NSA is spying on every American! And instead of taking strong action to correct the mistake, they went after Snowden! Is that really the kind of organization worth saving?

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive “secrecy tax”) and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption. Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.

If total conspiratorial power is zero, then clearly there is no information flow between the conspirators and hence no conspiracy. A substantial increase or decrease in total conspiratorial power almost always means what we expect it to mean; an increase or decrease in the ability of the conspiracy to think, act and adapt…An authoritarian conspiracy that cannot think is powerless to preserve itself against the opponents it induces.

Here's hoping the malady proves fatal, bravo.

I don't understand the aversion to tattoos in many workplaces. I have tattoos myself, one on each leg and one on my arm. You cannot see them when I'm wearing my interview clothing, but during the summer when I wear shorts and a t-shirt at work you can easily see them. When people see them, they don't expect me to be the kind of person that has tattoos.

By associating tattoos with a certain type of person before you even get to know their abilities means that you lose out on a lot.

The same goes for people who have differently coloured or styled hair. The lead developer for one of our products at the company I work for has a green mohawk, yet he's an extremely talented and knowledgeable developer.

Appearances have nothing to do with knowledge or ability. The quicker people learn this, the better for all of us.

Playing devil's advocate: Let's be honest here - just like gender, age, nationality, political view doesn't have anything with knowledge. Well.. It kinda does, but in a different way. Just like anything else. This is system - if you do not fit in particular one - it become expensive and risky to try to fit you in. Why HR should risk, what is the point? They will find another developer who have more in common with their management expectations. And then we start talking about not just knowledge, but blob of characteristics under "company culture"...

> Why HR should risk, what is the point? They will find another developer who have more in common with their management expectations.

Except they won't. The talent pool isn't infinite, passing up talent for silly reasons is a major opportunity cost. The whole article is about how that's having a huge impact on the government. I imagine it has just as much impact elsewhere, except few people have the guts to answer the "why can't we find anyone?" questions with "because you already disqualified the best candidates".

Having tatoos and being in software development doesn't automagically make someone "best candidate."

There is still risk that person who wear tatoos is trying to get against system. Just like girls would be expected to be less technical, just like foreigners would be expected to be hard communicate with.

Startups and other frugal types of businesses can afford that. Big corps - not really. The whole point of big corporations is to standardize everything and run as few expenses (including time of CTO to interview "non standard" candidate) as possible.

Again, simplifying a lot, HR have either hire someone wearing tatoos, or tell "well, for salary we have in budget we don't have anyone." So why they should risk?

If you reduce your talent pool intentionally and then you find you have problems filling roles, you have only yourself to blame. At large companies it may not be as obvious that they aren't getting the same level of talent they could have but usually the end result is a diminished capacity to execute successfully.

Why should they risk? For two reasons.

The best people are often not "normal". Look at some of the best coders or hardware hackers out there. Imagine if Netscape didn't hire Jamie Zawinski, would they have been as successful? When Jobs and Wozniak started Apple their previous most successful business venture was phone phreaking, selling illegal "blue boxes" that allowed people to hack the telephone network (and make free calls, incidentally). If you only want boring people then you will quickly remove some of the most talented people from consideration.

>>> Except they won't. The talent pool isn't infinite, passing up talent for silly reasons is a major opportunity cost.

This is a great point. Spoke with a recruiter just last week who talked about the market here in the midwest. He said there's so many openings, he can't find the talent, and companies are advertising further and further out from the city.

He said the last person one of his clients hired lived two hours away and they had to pay him a monthly stipend to cover his daily commute. Sure, they let him telecommute at times, but for the most part they expect him in the office and have to pay for it.

Tattoos and lifestyle do strongly correlate with other factors which are themselves viewed as correlating with "personnel unreliability or susceptibility to foreign influence or coercion".

Tattoos and pink hair ->

drugs, party lifestyle, potential crime ->

bad at managing money/desperate, making bad life choices, sleeping around, etc. ->

pressureable by foreign intelligence -- potentially by threatening to reveal those issues to the Government (which is irony in purest form...)

It's inherently discriminatory, but if I had to hire a code clerk (or other non-differentiated role, which did need to be trustworthy), I'd hire a successful 45 year old Mormon with kids comfortably in school and no history of any problems.

Where this is fucked is that quality computer security people are also usually (false?) positives for the pink hair and tattoos.

There's also the HUGE factor of foreign citizenship or foreign ties -- a Pakistani or Iranian or Chinese engineer with grandparents in the home country is definitely at risk for coercion by a foreign power. Parents, even more so. Personal citizenship, vastly more so. Lots of great engineers meet this criterion.

The way contractors deal with this is by having low-side roles doing the actual work, with untrusted employees, in a way which doesn't directly touch anything classified; they then throw the work product over a wall to the high-side where much less skilled people make $300k to take the research/products and implement them in the classified environment, while being US-citizen 2nd+ generation white people without tattoos.

The word tattoo appears 3 times in this article, two of them in headlines. Nothing substantive in the article actually says tattoos sharply impact hiring. Can anyone cite an actual source?

As an insurance policy against life getting so bad that I feel compelled to work for the dark side of the government I think I might just head down to the nearest tattoo parlour.

Maybe I could get tattoo-cliche-style text but with offensive wording like 'Dulce et decorum est...'. Or, like Lady Gaga, a CND symbol, somewhere not so easy to cover up under a suit and tie. Or, to absolutely, definitely make sure that I don't end up doing things like spying on my neighbours or dropping bombs on innocent people overseas, I could get a hammer and sickle. That should do it. In so doing I could guarantee never working for the military industrial complex, be able to filter out narrow-minded conservative folk and maybe get on with those common tattooed folk a bit better.

Back in 1993 I was doing the whole tourist cross-country road trip thang in the US. A couple of hundred miles south of DC I had this bar room conversation with this guy who told me he resigned from the FBI because they wouldn't let him hire the right people to do the job. Now - I have no actual evidence that he was what he said he was - but the two things he talked about were:

* FBI hires had to be full agents. Run the assault courses, cleared for firearms, etc. Which made hiring some of the white-hat hackers he wanted next to impossible since they were... not really the assault course running types.

* Inter-agency hiring was almost impossible. He wanted to get better humint skills into his group. He had some guy who wanted to move across from the DEA who was dealing with folk who were informing against drug cartels in Mexico who would have been ideal... but couldn't because "that's not how we do things".

Again - no idea if the guy was just bullshitting me... but it seems a mildly odd topic to confuse the English guy with if so ;-)

Believe the "must be full agents" bias, at least back then.

The FBI has been notorious for various sorts of incompetence because of their bias that a full agent, vs. a domain expert, be in charge of things. E.g. their infamous crime lab.

In addition to the issues laid out in the article (which are problems for finding good talent in all areas of government, not just cybersecurity) is that the cybersecurity mission for the United States crosses a number of agencies and I'm not really sure anybody knows what is going on - let alone new hires trying to navigate the morasse.

The result is that multiple agencies cannibalize talent to perform what could be the same mission - and might not even talk to each other.

Who is responsible for domestic network security? Government network security? Public/private cooperation? Critical infrastructure? Cyber crime? Cyber crime that crosses international boundaries or that might impact national security? Right now cyber is a great way to get money out of congress. To be effective moving forward the responsibilities for each agency need to be figured out, and the checks and balances on each should be established.

That kind of discrimination makes me wonder about 2 things:

1) what kind of weird people would like to work there?

2) what other weird rules do they have? earrings? hairpieces? nail polishing? dyed hair? beards? skirts? what about shoes? what about tan people? Is natural tan ok, but solarium tan forbidden?

The entire "clearance" stuff is a steaming pile of bullshit waiting to blow up.

IIRC millions of people hold various levels of secret information clearance - even assuming a low probability of 0.01% you have thousands of potential leakers, and a lot of them isn't employed by the government, but private companies instead.

fluff piece.

My understanding of the excellent feminist discourse related to geek subcultures and the tech industry, is that the dominance of certain fields by particular subcultures, encourages exclusion and discrimination.

So instead of thinking of 'tattoo-aversion' as discrimination, we should consider it a form of affirmative action. It will help the government to hire more talented security experts who don't have tattoos, or self-identify as hackers.

I don't understand your last sentence, or rather the last part of it.

It seems to be suggesting (incincerely, of course) that looking to hire people without tattoos would help to hire people who identify as hackers (but who would not be considered to be hackers by some standard or definition not including self-identity).

But I don't see the connection between tattoos and hackerishness or self identifying.

Is it a thing, and just not one I had noticed/heard of?

I get (somewhat anyway) the "feminist:self-identity" connection, And some of the other connections,

But I don't understand what meaning is being expressed by the last part of the last sentence.

Reply on news.ycombinator.com