As you may have read, Katie Arrington, the prior point person for the

DoD’s CMMC program, has filed a lawsuit against her employer and the NSA alleging they have failed to provide her “due process.” This arose after Arrington’s security clearances were suspended pending an investigation into whether she leaked classified information. But Arrington filed the suit after only five months, while official DoD policy provides for an unlimited processing time, and implies a routine processing time of six months. Meaning: Arrington sued the Federal government without likely ever having read the rules for due process that govern her case.

With her clearances suspended, her work as Chief Information Security Officer is now both impossible and ironic, and Arrington has since been put on paid “non-duty status.”

Arrington hired famed whistleblower attorney Mark S. Zaid in what is another bit of stinging irony. Zaid has a long history of defending whistleblowers and going after former President Donald Trump, having been co-counsel on litigation that led so Trump’s impeachment. Zaid represented Lt. Col. Yevgeny Vindman in a whistleblower suit against the Trump administration, in a high-profile case that made international headlines. Zaid now finds himself representing a Trump political appointee who has publicly attacked whistleblowers.

Worse, Zaid has been reduced to filing a highly partisan, conspiracy-filled complaint in Federal court which now alleges — without citing any law or evidence — that the “Biden Administration” was seeking to punish Arrington for some unspecified reason:

The decision was designed to interfere with the cyber security activities that Plaintiff was running through DoD, which NSA did not support. Nor did certain high-ranking DoD officials want the Plaintiff serving in a senior position within the Biden Administration due to her close previous ties with President Trump and they are using the NSA’s decision as a pretext to remove her.

Zaid — whose Twitter feed would have you believe he’s a liberal lion — now finds himself having to speak with Arrington’s voice and attack the highest-ranking openly gay Latino at the Pentagon, Jesse Salazar. In his filing, Zaid brands Salazar as a Biden “political appointee”, suggesting he was in on this Deep State scandal against Arrington, all for being the guy who had to notify Arrington not to come to work for a while. Throughout the CMMC project, Salazar has been openly supportive of Arrington’s positions and has largely carried on her exact work, without deviation, so attacking Salazar makes no sense.

Arrington, meanwhile, has a problematic history with Latino immigrants.

But the heart of Arrington’s argument is she was “deprived of procedural and substantive due process.”  Zaid then fails, however, to indicate the “procedure” he’s referring to. This means his team was either unaware of the procedures — which is professionally problematic —  or did not want to point them out to the court at the risk of having his case thrown out on its face.

So here it is: DoD Manual 5200.02Procedures for the DoD Personnel Security Program (PSP)” addresses Arrington’s situation directly, and has no limit on the processing time for suspensions. Instead, the manual says “suspension cases must be resolved as quickly as circumstances permit.” There is, however, a provision that suggests suspensions should be processed within six months:

Suspension cases must be resolved as quickly as circumstances permit. Suspensions exceeding 180 days must be closely monitored and managed by the adjudication facility concerned so as to expeditiously reach a new national security eligibility determination.

But Arrington didn’t wait for six months, and filed after only five months. From the docket filing:

It has been five months since the Plaintiff’s security clearance was suspended and there have been no indications the Defendants have taken any significant substantive steps to move their investigation forward, much less give the Plaintiff an opportunity to respond to any allegations.

Even then, the procedure does not even limit the investigation to six months. There is no actual upper limit, and the only rule is that after six months, a suspension case must be tracked by the Office of the Undersecretary for Defense, Intelligence & Security (OUSD I&S), and only then to “monitor the number of suspensions that exceed 180 days.” OUSD I&S has no authority to push for faster processing of cases, and only tracks the cases presumably to report the data later.

The complaint goes on to presume that the US Constitution’s Fifth Amendment can be applied to the government’s decision to temporarily suspend a security clearance. It’s not at all clear that that will pass muster, since a security clearance is a privilege, not a right, and can be withdrawn or suspended at any time, for any reason.

Zaid then repeats a claim that I can’t verify anywhere: that some unknown parties have been circulating posts saying Arrington was “fired.” You may recall that Zaid threatened to sue Oxebridge — via Twitter, of all places — because he claimed we reported she had been fired. The problem is, we never reported that at all, and Zaid never provided any actual proof. Subsequently, I haven’t been able to find anyone that said this, but Zaid appears fixated on this claim.

Since the suspension action of May 11, 2021, unknown individuals within DoD have improperly, and possibly illegally, leaked privacy protected information concerning Plaintiff to unauthorized third parties for the purpose of further causing harm. Some of the leaked information has, in fact, been completely false and defamatory, such as assertions that her security clearance had been revoked and that she had been fired. Neither of these events have occurred.

That paragraph is particularly confusing since it simultaneously declares Arrington being “fired” as untrue, but then aims to assert privacy rights over the claims anyway. One cannot claim privacy over something which isn’t true.

(In truth, Arrington cannot be fired because she holds a Senior Executive Services position in government.)

In the end, the Arrington suit is a mess of conspiracy-theory, Deep State silliness compounded by a lack of any legal citations or references to so-called procedures, and complete ignorance of actual DoD policy on the prime matter being put forth. Normally, such a case would be challenged and defeated easily, but given the high-profile nature of both Arrington and her attorney, Zaid, we can probably expect the parties to act with professional restraint.

I personally don’t see how Arrington wins this. But that may not be the point here.

Arrington’s career at DoD — specifically for CMMC, at least — is effectively dead.  This filing appears to satisfy two core needs: first, to keep her name in the headlines and feed her obsession for attention, and second, to prepare her next political campaign, where she can argue that she personally fought the anti-Trump “Deep State” and fell victim to it.

Certainly, Arrington playing the victim isn’t something new.

UPDATE 12 November 2021. Attorney Zaid has filed an amended complaint, as of yesterday, which appears to attempt to address some of the deficiencies I note above.

Whereas the original filing claimed procedural failure without mentioning any actual procedures, the amended complaint now specifically references DoD Manual 5200.02, which tells me that Zaid likely read my article.

The amended filing is better — it pivots from emphasizing the timeline problems, which were self-defeating (as noted above) and tries to strengthen the procedural arguments — but it’s still not great.

For one, Zaid cannot seem to get his head on straight about the concept of “revocation.” Recall that he threatened to sue Oxebridge when he said we claimed Arrington’s security clearance had been “revoked.” The problem is, the reporting here never said that. Then, Zaid is trying to claim “privacy” privileges over this allegedly defamatory claim — but you can’t claim privacy over something that isn’t true.

In the amended filing, Zaid still says the claim that his client’s security clearances were “revoked” is defamatory, but then adds text that appears to prove her privileges were revoked. He now writes that “On Friday, May 7, 2020… the Plaintiff was telephoned and notified that NSA had revoked her access…

He then goes on to cite multiple policies dealing with the processing of revocations — not suspensions.

It seems to my non-lawyer mind that you can’t argue in one paragraph that it is “completely false and defamatory” to suggest her rights were revoked, and then base your legal arguments on revocation rules.

(Also, people — including officials — often use the terms “suspended” and “revoked” interchangeably, even if they have different meanings when digging into the weeds of policy.)

So, Zaid may have corrected some of the original filings deficiencies, but he added new ones that will only help the opposing side.

Of note are two other details which were not included in the original filing. First is that whatever was leaked was apparently flagged by someone in the US Air Force, and second, that the information was “Top Secret.”

With CMMC 1.0 now entirely dead, and 2.0 effectively erasing nearly every trace of Arrington’s fingerprints on the CMMC program (at least in my reading of it), it still seems as if this is all kabuki theater. Arrington has no real job to return to, since CMMC is already being handled by the office of the CIO (Deputy DoD CIO Dave McKeown drove much of the recent CMMC Town Hall, alongside Jesse Salazar, telegraphing the handoff.) So this appears, as I said, to be a political stunt aimed at keeping Arrington in the headlines, giving her attention, and prepping her future campaign appearances.

About Christopher Paris

Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years' experience implementing ISO 9001 and AS9100 systems, and is a vocal advocate for the development and use of standards from the point of view of actual users. He is the author of Surviving ISO 9001 and Surviving AS9100. He reviews wines for the irreverent wine blog, Winepisser.


Free ISO 9001 Template Kit