Military Installation Access Authority Failure Through Credential-Clearance Status Desynchronization at Washington Navy Yard
Context
Access to military installations in the United States is controlled through a layered authorization system. Personnel requiring regular access must hold an appropriate security clearance—a determination by the Department of Defense that the individual is trustworthy and eligible for access to classified information and secured facilities. The clearance determination is based on a background investigation examining criminal history, financial records, personal conduct, and other adjudicative criteria. Once cleared, the individual receives a physical access credential—typically a Common Access Card—that is presented at installation entry points and verified against the access control system to confirm the holder is authorized to enter.
The access control architecture separates two functions: the clearance determination (assessing whether a person should be authorized) and the credential verification (confirming at the entry point that the presenter is authorized). The clearance determination is performed once, with periodic reinvestigation at intervals—every ten years for Secret-level clearances at the time of the incident. Between reinvestigations, the clearance remains active unless affirmatively revoked based on new derogatory information. The physical access credential remains valid as long as the underlying clearance has not been revoked.
Trigger
On the morning of September 16, 2013, Alexis entered Building 197 at the Washington Navy Yard and opened fire, killing twelve people and wounding eight others before being killed by responding law enforcement. Post-incident investigation revealed that Alexis had an extensive history of conduct that, under existing adjudicative guidelines, should have prompted review of his security clearance and access authorization—but that information had not been aggregated, transmitted to the clearance adjudication system, or acted upon to revoke his credential.
Alexis had been arrested in Seattle in 2004 for shooting out the tires of a construction worker's vehicle in an anger-related incident. He was arrested again in Fort Worth, Texas in 2010 for discharging a firearm through his apartment ceiling. In both cases, charges were not filed or dismissed, and neither incident was reported to DoD as potentially disqualifying information. In August 2013—weeks before the shooting—Alexis contacted police in Newport, Rhode Island, reporting that he was hearing voices and believed people were sending vibrations through hotel walls to prevent him from sleeping. Newport police reported the contact to Naval Station Newport police, who forwarded a report to the Navy.
Failure Condition
The access authorization system failed because the physical access credential reflected clearance status at the time of issuance rather than current fitness for access. Alexis's building credential was valid because his Secret clearance had not been revoked. His clearance had not been revoked because the information that would have prompted revocation had not reached the adjudication system. The credential verified that Alexis was authorized based on a clearance determination made five years earlier—a determination that remained in effect because the system depended on affirmative reporting of disqualifying information to trigger review, and no such reporting had occurred despite multiple relevant incidents.
The ten-year reinvestigation cycle for Secret clearances created a structural window during which the clearance—and the access credential derived from it—persisted on the basis of the original investigation. Between the 2008 clearance grant and the 2013 incident, Alexis's circumstances had changed materially: two firearms-related arrests and an acute mental health episode documented by police. But the periodic reinvestigation model assessed fitness at scheduled intervals rather than monitoring it continuously. The clearance system's authoritative record showed Alexis as cleared because the record had not been updated, not because the underlying assessment remained valid.
Observed Response
The Navy conducted an internal review resulting in multiple recommendations for security improvements at military installations. The DoD Inspector General investigated the security clearance process that had granted and maintained Alexis's access. Congressional hearings examined the broader failures in the personnel security clearance system, including the gap between the periodic reinvestigation model and the need for continuous evaluation of cleared personnel.
Analytical Findings
- Aaron Alexis entered Washington Navy Yard using a valid building access credential derived from a Secret security clearance granted five years earlier, despite intervening firearms arrests and an acute mental health episode documented by police
- Physical access credential reflected clearance status at time of issuance—the gate verified the badge without capability to evaluate whether the holder remained fit for access
- Ten-year periodic reinvestigation cycle for Secret clearances created a structural window during which the clearance persisted on the basis of the original investigation regardless of changed circumstances
- Disqualifying information existed in multiple systems—local police records, VA medical records, Naval Station Newport police reports—but no mechanism aggregated it into the clearance adjudication process
- Local police departments had no obligation or standardized mechanism to report arrests to DoD clearance authorities; VA medical records were constrained by privacy protections
- The clearance system's authoritative record showed Alexis as cleared because the record had not been updated, not because the underlying assessment remained valid
- Post-incident reforms accelerated Continuous Evaluation and Trusted Workforce 2.0, replacing periodic reinvestigation with continuous vetting through automated database monitoring
- Cross-reporting effectiveness remained limited by identification gaps—reporting entities may not know an individual holds a security clearance
- 1. Department of the Navy, "Washington Navy Yard Shooting: Internal Review," findings and recommendations, November 2013.
- 2. Department of Defense, Inspector General, "Evaluation of the DoD's Personnel Security Clearance Process for Employees and Contractors of DoD," DODIG-2014-062, 2014.
- 3. U.S. Senate Committee on Homeland Security and Governmental Affairs, "A Ticking Time Bomb: Counterterrorism Lessons from the U.S. Government's Failure to Prevent the Fort Hood Attack," and related hearings on security clearance reform, 2013-2014.
- 4. Government Accountability Office, "Personnel Security Clearances: Additional Guidance and Oversight Needed at DOD to Ensure Consistent Implementation of Continuous Evaluation," GAO-18-117, 2018.
- 5. Defense Counterintelligence and Security Agency, "Trusted Workforce 2.0: Transforming Federal Personnel Vetting," program documentation, 2019-present.