Former FBI and CIA director William Webster
But the commission, chaired by former FBI and CIA director William Webster, reports the FBI never followed up on these clues with a systematic and thorough probe of Hanssen's finances, even though individual background investigators pointed out inconsistencies and anomalies they had observed in his case.
The money trail
For instance, Hanssen made expensive improvements to his house, paying many of the bills in cash. At one point, a background investigator interviewed a family friend who guessed that Hanssen or his wife Bonnie may have inherited money — but nobody in the FBI followed up to verify the supposed bequest. "They never pursued things that didn't make any sense," says a senior official familiar with the Webster commission report." The comments just went into the personnel file."
The commission report, a scathing critique of the FBI's slipshod internal security practices, will cite a glaring lapse first disclosed in the book "The Spy Next Door," co-authored by this reporter and former TIME correspondent Ann Blackman: if FBI background investigators had looked at a widely available commercial database that lists vehicle registrations, they would have discovered that in August 1991, Hanssen bought a Mercedes for his paramour, stripper Priscilla Galey, and registered it in her name but at his home address. In fact, the FBI didn't find out about Hanssen's extramarital — and pricey — relationship with Galey until his arrest in February 2001.
The Webster commission will recommend a radical revamping of the FBI background check system, with more extensive disclosure and more rigorous probing by specialists in reviewing financial data. The commission believes the bureau dropped the ball in the Hanssen case because there was no unified, professional security structure. Instead, background checks were handled by multiple outside contractors who assigned crucial tasks to generalists inexpert at tearing apart financial disclosures.
Closing up security loopholes
Other top items on the to-do list: tightening access to the FBI's classified computer databases to prevent Hanssen-like freeform browsing. Already FBI director Bob Mueller has ordered up a full array of software safeguards, many of which hinge on the completion of the bureau's massively expensive Trilogy project, an information systems overhaul scheduled to go on line over the next several years. But Ken Senser, the assistant director for security, is moving faster: he has installed safeguards designed to pick up on activities as blatant as Hanssen's habit of running his name and spook slang through the computers to see if the FBI was onto him. A career CIA official who moved to the FBI in 1999, he admits to being surprised at the low priority accorded security prior to Hanssen's arrest in February 2001.
"If somebody's doing searches in the system with their name and the words 'dead drop,' that's kind of a clue, huh?" Senser observes sardonically. In his spare time, Hanssen also surfed the FBI's computers for tidbits on Bill and Hilary Clinton, whose liberal politics raised his arch-conservative hackles. According to the Webster commission report, Hanssen ran more than 20 searches on the Clintons, even snooping on the Clinton's daughter, Chelsea. Hanssen even ran a search on his boss, FBI director Louis Freeh. "Had the FBI been aware of these searches, it seems likely that auditors would have found this activity peculiar and it would have received close scrutiny," the commission report says. But apparently nobody noticed.
The Webster commission is expected to recommend limiting highly sensitive files to those with a strong need-to-know — "role-based access," in FBI jargon. Mueller and Senser agree and have already reduced the number of FBI employees with access to any data bearing the above-Top-Secret classification of SCI (Sensitive Compartmentalized Information)
Immediately after Hanssen was arrested, 700 FBI employees were polygraphed, including Mueller himself. ("Nobody likes taking a polygraph," he told reporters. "I didn't particularly enjoy taking a polygraph.") Roughly 7 employees failed to pass the polygraphs. They haven't been fired or disciplined, but Senser says they are being subjected to further investigation. Now Mueller is considering ordering several thousand more FBI employees to go on the box. But he won't force preventive polygraphs on all 28,000 FBI employees, all of whom have at least Top Secret clearance, in part because he, like most career FBI executives, doesn't want to mimic the CIA, where polygraphs have generated false positives that have consigned innocent government employees to career limbo.
Looking beyond the checklist
Perhaps the FBI's most creative post-Hanssen reform is a new analytical unit whose mission will be to look for subtle behavioral clues that may hint at a very guilty conscience. The old-bureau culture was caught up in a "checklist mentality," says Senser, and because Hanssen didn't fit the standard "booze-broads-bills" profile of an espionage suspect, none of his colleagues or supervisors pieced together the wildly disparate parts of his personality. He was racking up computer security violations, experiencing fits of anger and paranoia, spending more than he made and proselytizing even as he was carrying on a relationship with a stripper and posting lurid fantasies in Internet sex chat rooms. The new unit, says Senser, will try to figure out "what makes the person tick — why these things are happening." Had anyone really seen Hanssen's quirks, says Senser, and had called attention to them, the former agent might have been polygraphed, sent for psychological testing and subjected to financial checks that might have unveiled his true criminality.