Lee indictment ignites polygraph, security debate

The Energy Department has issued new counterintelligence regulations in the aftermath of a security breach at a national laboratory that call for polygraph examinations of hundreds of agency employees, including highlevel political appointees who have access to classified information and computer systems.

The Energy Department has issued new counterintelligence regulations in the aftermath of a security breach at a national laboratory that call for polygraph examinations of hundreds of agency employees, including high-level political appointees who have access to classified information and computer systems.

But the rules have reheated a debate among members of the scientific and computer security community about whether polygraph technology is an effective counterintelligence tool.

DOE issued the rules Dec. 13, three days after the Justice Department indicted a former DOE employee, Wen Ho Lee, on 59 counts of altering, concealing and removing sensitive data from classified computer systems at the Los Alamos National Laboratory.

According to the indictment, Lee is alleged to have collected information from a classified network and then altered and downloaded the information to an unclassified portion of the network, "with the intent to injure the United States and with the intent to secure an advantage to a foreign nation."

In a memorandum sent last week to all DOE department heads, DOE Secretary Bill Richardson said the questions that will be asked as part of the department's "Counterintelligence Polygraph Implementation Plan" will be limited to "narrowly focused topics of espionage, sabotage, terrorism, intentional unauthorized disclosure of classified information...and deliberate damage or malicious misuse of a U.S. government or defense system."

Of the 800 DOE and contractor personnel targeted by the new polygraph rule, many will come from offices involved in Internet and network security. The Office of Independent Oversight and Performance Assurance and the Office of Safeguards and Security will test personnel who are regularly engaged in Internet security assessments and digital file transfer operations, according to the memorandum.

According to the charges, Justice believes Lee made deliberate attempts during a six-year period to conduct unauthorized transfers of classified information that dealt with various aspects of the U.S. nuclear weapons and research program. Lee is accused of creating 19 archive files containing restricted data classified at both the secret and confidential level and transferring those files to the unclassified portion of the network. The indictment also alleges that he downloaded weapon design data to various tape drives.

Steven Aftergood, an intelligence specialist with the Federation of American Scientists, said the new polygraph policy is unlikely to improve cybersecurity at the department, although it may help raise awareness about security issues.

"The new policy strikes me as incoherent," Aftergood said. "If the polygraph is an effective security tool, it should be employed throughout the work force at sensitive facilities. But if it is a bogus technology that is prone to error, it should not be used at all.... More security does not always mean better security, and the new policies could end up doing lasting damage to our national security technology base."

Members of the General Accounting Office division with oversight of DOE security programs said they have never looked to polygraph tests in the past as a method for solving security issues, and they were also skeptical about how effective the new regulation would be.

"In the bulk of the cases, these [security] problems boil down to the Department of Energy not following their own rules," said William Fenzel, assistant director of Energy audits at GAO. "So putting one more layer in place is just one more rule that probably won't be enforced."

Mark Lowenthal, a former deputy assistant secretary of State for intelligence, said he is skeptical about the utility of polygraphs, largely because of the cases in which they have not worked.

For instance, convicted spies Aldrich Ames and Larry Wu-tai Chin "both passed [polygraphs] while actively engaged in espionage," he said.

However, although State and Congress do not use them, Lowenthal said he does not see any alternative to the polygraph's use.

In a report on the fiscal 2000 intelligence authorization bill, the Senate questioned the accuracy of polygraph technology and called on the counterintelligence community to identify alternative technologies. "Given the potential unreliability of the polygraph system, the committee believes that alternatives to the polygraph should be explored," the report stated.

DOE heard from dozens of other experts and employees departmentwide who raised similar concerns and argued that the use of the polygraph would prevent the department from attracting and retaining the best scientific talent available. Although some experts recommended to DOE several alternatives, including enhancing computer security and external surveillance systems, DOE rejected those recommendations.

"DOE does not believe that it is necessary to spend more money on additional external security enhancements since its systems already are among the best in the federal government," states the final DOE ruling. "Additional enhanced external security measures by themselves provide little protection against the cleared employee who decides to engage in espionage."

MORE INFO

Security alternatives recommended to DOE by experts and employees

* Conduct old-fashioned detective work and surveillance

* Establish interview hot lines to report suspicious behavior

* Increase the size of security staffs

* Conduct spot checks of employees as they enter and leave DOE facilities

* Establish an open dialogue with lab employees on how to improve security

* Conduct peer counseling for new hires

* Examine financial records and money wired to employee accounts from foreign sources

* Monitor banking and charge accounts to look for unusual financial or travel activities

* Make improvements to computer system security

* Create classified areas of DOE facilities, with some individuals having two offices: one for classified work and one for unclassified work

Read DOE's polygraph regulation and the alternatives DOE employees and security experts presented the department.

BY DANIEL VERTON
Dec. 20, 1999

More Related Links
X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.