> or associate with anyone who does

No wonder they're having problems finding candidates. Hackers are probably way more likely to use certain drugs like weed, MDMA and psychedelics than the general population, due to their intellectual curiosity and intelligence levels (which I assume are significantly higher than the average).

Do they really force applicants to disassociate with their friends and family, like in Scientology, or is it just a rule they only care really about in the most serious cases (if friends are dealers or have drug problems etc)?

>Do they really force applicants to disassociate with their friends and family

Anecdotal but it wasn't enforced at all. I suspect it was a CYA measure for firing someone with undesirable connections but no illegal activities.

Well, they make everyone sign the papers, and they frequently polygraph. It's risky to get a clearance if you are breaking the rules. You'd have to keep your story straight, and have the ability to defeat test anxiety. Maybe that's a good process if you are trying to find a good spy. Not very good for recruiting a hacker.

I hear they bend the rules for extraordinary candidates - maybe that applies to all hackers these days.

Using a broken lie detection methodology? Is that even legal?

Polygraph evidence is not admissible in US courts anymore.

The Employee Polygraph Protection Act prevents US employers from testing their employees. The government is exempt.

Now, you may have experimented up to a certain very low threshold (something like experimented with marijuana less than 3-5x in your life) before applying for your first clearance. You are still fucked if you have a clearance and do drugs, ever.