Oh, I know that they don't! And as I said, I agree that the other suggestions are useful in general.

But speaking specifically, there are a few things that we could consider including as part of your proposal. Clearly, the vetting that these groups were doing previously was not perfect. That's part of why what occurred last month happened, and part of why we've been asked to bring forth our suggestions for how to improve them, is it not?

If their current process is merely checking an interested party's background, then more needs to be done. We can suggest probationary periods before newer parties have access to anything truly confidential or dangerous, which will give them time to prove themselves and allow for more thorough vetting. Or we can suggest that anyone who works on these projects does so in pairs or trios, which will be determined by someone known to be trustworthy. This could lessen the chances of a group managing to make away with sensitive information without anyone noticing.

You're right that this is a discussion. Do you have any suggestions along these lines of your own? I'd love to discuss them with you.