For Your Eyes Only

SCIFs protect America’s national secrets

• By John Gaydos
• Aug 24, 2009

When employees of a government agency, contractor or research center need to discuss national security issues or other classified topics, they need more than a standard office. They need a place where only authorized staff can enter; they need to know that any stored documents or other materials are safely protected; and, they need to be confident that what is said within the room stays within that room.

A sensitive compartmented information facility is an accredited area, room, group of rooms or buildings, or installation where classified material may be stored, used, discussed and/or electronically processed. A SCIF may be as small as a 6x8 foot closet with a single computer terminal or as large as an entire building. It may a portable trailer that can be moved to different locations or it may even be found on an airplane or ship.

There are many different names and classifications for areas like these. Each is governed by its own document and administered by the agency having jurisdiction. Additionally, a number receive special certification from an Underwriter Laboratories-listed third party, such as an alarm service company, with regard to the type of physical installation, monitoring and services provided.

Since Sept. 11, 2001, SCIFs have been in greater demand to help protect classified data and conversations. This has presented a major opportunity for security vendors and contractors with the ability to handle this exacting work. An SCIF is highly regulated by a complicated series of government and private standards.

A 75-page manual known as the “Director of Central Intelligence Directive 6/9” provides the guidelines -- such as construction specifications, electrical connections, environmental systems, sound masking and security equipment -- for designing and building a SCIF. Other directives provide specifications for computer and telecommunications equipment.

According to “DCIC 6/9”, an SCIF’s perimeter walls, floors and ceiling must be permanently constructed and attached to each other in such a manner as to provide visual evidence of unauthorized penetration. Entry into an SCIF is expected to be limited to a single door with other doors serving as emergency exits as required by local fire regulations.

Vents, ducts or other openings that could allow passage of a person must contain a barrier to keep an intruder from using this as a means of entry. Windows must be opaque or equipped with blinds or drapes to preclude visual surveillance from outside. There are specific requirements for the thickness and types of materials used for vaults, perimeter walls, doors and many other aspects of the facility.

As a result, SCIFs are expensive to build. One contractor with experience in building SCIFs recently said the most basic facility costs $60 to $70 per square foot, about double the cost for conventional office space. SCIFs with the highest level of security can cost up to $300 per square foot.

Before it can be used to house classified material, the SCIF is accredited through an inspection by an official from the regulating government agency. The SCIF may be re-inspected at any time, announced or unannounced. If the inspector determines that classified information could be compromised or that security conditions are unsatisfactory, accreditation will be suspended or revoked.

When it comes to security, the “DCID 6/9” is clear about its importance.

“Proper security planning for a SCIF is intended to deny foreign intelligence services and other unauthorized personnel the opportunity for undetected entry into those facilities and exploitation of sensitive activities,” the guidelines state.

All areas that allow access to a SCIF must be protected by an intrusion detection system. It is not uncommon to find a building corridor with adjacent SCIFs each used by a different agency. The “DCID 6/9” makes it clear that each SCIF is required to have a stand-alone alarm panel, alarm and access control system. Even a SCIF within a SCIF must follow the same regulations.

If entry into a SCIF uses an automated access control system, two credentials are required. Typically, an authorized user will be required to enter a PIN into a keypad and present an access badge to a card reader. PINs must be a minimum of four digits, randomly selected, with no known or logical association with the individual. Other, more secure SCIFs may replace the card reader with biometric readers.

All areas of a facility that reasonably afford access to the SCIF, or where classified information is stored, also must be protected. Many facilities employ cameras to provide visual verification and keep a record of who enters the facility.

The security equipment must be monitored at all times in a continuously staffed central station. In some cases, a government agency may provide monitoring, such as in the case of SCIFs located on a military base. However, in most cases, private vendors conduct the monitoring.

Some regulations require that all intrusion detection equipment comply with standard UL-2050, established by Underwriters Laboratories. UL-2050 applies to the operation of the detection equipment and how alarm signals are transmitted to offsite monitoring centers. Security vendors are required to comply with UL-2050 by maintaining an active UL listing of installation and service.

Once completed, the vendor can, issue a certificate to the SCIF’s owner that the facility meets UL requirements.

The UL-2050 places other requirements on SCIF vendors. For example, if any problems occur, the vendor must have a crew at the SCIF within four hours. The time translates into a coverage area and is based on a land-based vehicle traveling from the vendor’s office. That can put a limitation on the ability of smaller local and regional vendors lacking multiple offices across the country to service government agencies or nationwide contractors.

Also, the vendor’s employees must be U.S. citizens and may require security clearances depending upon the work they are asked to do.

There are no available estimates on the number of SCIFs in the United States. But in the Washington, D.C., area alone, hundreds of thousands of square feet of privately developed SCIF space has recently become available for occupancy. With more secret information to protect every day, SCIFs are vital to our nation’s homeland security.