The issue is made worse, the report continues, by the fact that Homeland Security’s internal record-keeping is so shoddy that it was impossible to determine how many ex-staffers have working access cards they aren’t supposed to.“Without effective PIV card and security clearance management and monitoring, DHS cannot ensure only authorized individuals have access to its controlled electronic systems and facilities.”The December 20 report — based on interviews and firsthand analysis of the internal database Homeland Security is supposed to use to track its active personal identity verification cards and associated owners — says the department failed to deactivate nearly half of the cards it was supposed to within the recommended 18-hour window after termination.While the cards also grant holders access to sensitive DHS data networks, the department claimed to the inspector general that the electronic network access keys embedded in the cards were deactivated, “preventing access to electronic systems.”On the PIV cards, the report’s conclusion is blunt: “We determined that unauthorized individuals could gain access to Department facilities.”The inspector general report found that Homeland Security’s failure to secure its borders was caused by a widespread disregard for its own rules.“Some DHS officials also told us they intentionally did not enter a revocation date after revoking PIV cards.”Department personnel told auditors the Identity Management System, which Homeland Security is supposed to use to track card status, has a serious flaw: “Some DHS officials also told us they intentionally did not enter a revocation date after revoking PIV cards because doing so caused reports to become too large, resulting in IDMS slowing down.”Given that the software used to track access card revocation apparently can’t track access card revocation without “slowing down,” the report notes, “it was impossible for DHS OIG to conclusively determine if DHS officials revoked PIV card access promptly or at all.”The auditors also found that Homeland Security may not have withdrawn employee security clearances, as required, for its over 53,000 former employees since 2021, again because the department isn’t using an internal database meant to track such activity.With the card and security clearance revocation issues taken together, the auditors identified a distinct threat — albeit somewhat muddled, owing to bad bookkeeping: “As a result, there is a risk that individuals who no longer require access to systems and facilities could circumvent controls and enter DHS buildings and controlled areas.”According to the report, the department disagrees with the Office of the Inspector General as to the magnitude of the problem, but not that the problem exists."