Energy IG report raises more security concerns

NNSA chief information officer says lack of resources caused compliance delays

IG report: Excessing of Computers Used for Unclassified Controlled Information at Lawrence Livermore National Laboratory [.pdf]

The Energy Department’s inspector general found the National Nuclear Security Administration’s chief information officer created security risks by failing to implement departmentwide excess equipment directives at the Lawrence Livermore National Laboratory for almost two-and-a-half years. The CIO’s office cited resource constraints for delaying the enforcement of security directives that had 90-day implementation deadlines.

The Lawrence Livermore lab was in the process of implementing those directives as of March 1. NNSA did not incorporate them into the lab’s management contract with the University of California until 2006, the IG said in a report released in March.

“Instead of directing LLNL to implement the directives, NNSA waited while its Office of the Chief Information Officer drafted a policy letter to provide LLNL and other NNSA sites with specific requirements for clearing, sanitizing and destroying unclassified controlled information on computers and electronic devices,” wrote Gregory Friedman, DOE’s IG, in a memo accompanying the report on excess equipment policies at Lawrence Livermore.

The Lawrence Livermore lab disposes of about 5,300 computers each year. The departmentwide excess equipment directives issued in February 2004 and June 2005 apply to computer equipment containing unclassified information such as controlled nuclear data and official-use-only, proprietary and personally identifiable data.

David Schwoegler, a Lawrence Livermore lab spokesman, said the IG’s report took a limited view of the lab’s excess equipment policies by criticizing them for not aligning with departmentwide policies. Schwoegler said the lab has strong policies and procedures for disposing of unclassified computers and memory devices, and it complies with those policies. 

“We don’t reuse unclassified drives,” Schwoegler said. “We destroy them. We hammermill them. We actually witness their destruction.” He said a contractor destroys them, and a lab employee documents it.

But Schwoegler said that because of the delays the IG cited, the lab shouldn’t be held liable for any data that might have been improperly disclosed during the past two-and-a-half years. The IG reported no improper disclosures. 

DOE’s excess equipment policies are defined in two publications: a departmentwide notice released in February 2004 and a manual released in June 2005. However, NNSA did not enter the two publications into the lab’s contract until February 2006. According to the IG’s report, an official at NNSA’s Office of the CIO blamed the delay on “problems with resources and other issues.” Julianne Smith, an NNSA spokeswoman, said it was a resource allocation problem.

“As with all issues relating to cybersecurity, implementation of a policy is risk-based,” Smith said. “Within the allocated budget, each organization must prioritize policy implementation.”

DOE Secretary Samuel Bodman fired the previous administrator of NNSA,
Linton Brooks, in January for data security lapses breaches that occurred on his watch.
Inspector general takes DOE labs to taskThe Energy Department’s Office of the Inspector General released multiple reports during the past year that are critical of excess equipment policies and procedures at DOE’s national laboratories.
  • Idaho National Laboratory: In February, the OIG criticized the Idaho National Laboratory’s excess equipment policies after the lab auctioned a computer containing unclassified information and stored excess hard drives in an insecure wooden container.
  • Lawrence Livermore National Laboratory: A March report criticized the lab’s excessive reuse of computer storage devices. The IG identified other problems with the lab’s management of security badges in a report released in January 2006.
  • Los Alamos National Laboratory: A report released in November 2006 found inconsistent or nonexistent security policies for protecting classified  information, nonfunctioning internal cybersecurity controls, and a lack of monitoring by federal and lab officials.
  • Sandia National Laboratory: The OIG tagged Sandia for not adequately documenting the destruction of classified hard drives in August 2006.
— Wade-Hahn Chan

Featured

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above