Aldrich Ames began selling secrets to the KGB in April 1985. Over the following nine years he compromised more than a hundred operations and identified essentially every Soviet asset the CIA and FBI were running. At least ten of them were executed.
He took a CIA polygraph in 1986. He passed. He took another in 1991. He passed that one too.
Ames has described what he did to prepare, and what he describes is not a technique. His Soviet handlers told him to get a good night's sleep, to be relaxed and rested, and to be friendly and cooperative with the examiner — to develop a rapport, to make the examiner like him and want to believe him. That was the whole of it.
He was arrested in 1994 on the basis of financial analysis and traditional counterintelligence work. A man on a government salary had paid cash for a house and drove a Jaguar.
The National Research Council reviewed the entire polygraph literature and published its report in 2003, and its conclusions are careful and worth separating.
On specific-incident testing — a defined event, a defined set of relevant questions — the report concluded that polygraph accuracy is well above chance, though well below perfection, and that most of the research is of low quality and conducted in laboratory conditions unlike real testing.
On security screening, which was the question the Department of Energy had asked, the conclusion was unequivocal: the polygraph is completely unsuited to it, and its use is more likely to harm national security than to help.
The reasoning is the base rate arithmetic that has now appeared three times in this guide. Suppose ten thousand employees are screened and ten are spies. Suppose the test is far better than the evidence supports — say it catches eight of the ten. At a threshold that sensitive, the false positive rate on the remaining 9,990 innocent employees will run to hundreds of people. So the overwhelming majority of failures are loyal employees, whose careers are damaged, while a competent penetration agent who is calm and coached has a good chance of passing.
The report's most quoted sentence makes the strategic point: national security is too important to be left to such a blunt instrument.
Yet screening polygraphy continues across US federal agencies, and the reason is not that anyone has rebutted the National Research Council. It is deterrence and admission. Applicants and employees who believe the machine works disclose things during the pre-test interview that they would not otherwise disclose, and some candidates self-select out. Those are real effects.
They are also effects of belief, not of measurement, and they carry a cost the report identifies: an agency that trusts a screening instrument that does not work will feel secure while not being secure, which is a worse position than knowing you cannot screen.
Ames passed twice while the system believed it was watching.
Cross-ref: polygraph history chapter above