Energy IG report raises more security concerns

NNSA chief information officer says lack of resources caused compliance delays

IG report: Excessing of Computers Used for Unclassified Controlled Information at Lawrence Livermore National Laboratory [.pdf]

The Energy Department’s inspector general found the National Nuclear Security Administration’s chief information officer created security risks by failing to implement departmentwide excess equipment directives at the Lawrence Livermore National Laboratory for almost two-and-a-half years. The CIO’s office cited resource constraints for delaying the enforcement of security directives that had 90-day implementation deadlines.

The Lawrence Livermore lab was in the process of implementing those directives as of March 1. NNSA did not incorporate them into the lab’s management contract with the University of California until 2006, the IG said in a report released in March.

“Instead of directing LLNL to implement the directives, NNSA waited while its Office of the Chief Information Officer drafted a policy letter to provide LLNL and other NNSA sites with specific requirements for clearing, sanitizing and destroying unclassified controlled information on computers and electronic devices,” wrote Gregory Friedman, DOE’s IG, in a memo accompanying the report on excess equipment policies at Lawrence Livermore.

The Lawrence Livermore lab disposes of about 5,300 computers each year. The departmentwide excess equipment directives issued in February 2004 and June 2005 apply to computer equipment containing unclassified information such as controlled nuclear data and official-use-only, proprietary and personally identifiable data.

David Schwoegler, a Lawrence Livermore lab spokesman, said the IG’s report took a limited view of the lab’s excess equipment policies by criticizing them for not aligning with departmentwide policies. Schwoegler said the lab has strong policies and procedures for disposing of unclassified computers and memory devices, and it complies with those policies. 

“We don’t reuse unclassified drives,” Schwoegler said. “We destroy them. We hammermill them. We actually witness their destruction.” He said a contractor destroys them, and a lab employee documents it.

But Schwoegler said that because of the delays the IG cited, the lab shouldn’t be held liable for any data that might have been improperly disclosed during the past two-and-a-half years. The IG reported no improper disclosures. 

DOE’s excess equipment policies are defined in two publications: a departmentwide notice released in February 2004 and a manual released in June 2005. However, NNSA did not enter the two publications into the lab’s contract until February 2006. According to the IG’s report, an official at NNSA’s Office of the CIO blamed the delay on “problems with resources and other issues.” Julianne Smith, an NNSA spokeswoman, said it was a resource allocation problem.

“As with all issues relating to cybersecurity, implementation of a policy is risk-based,” Smith said. “Within the allocated budget, each organization must prioritize policy implementation.”

DOE Secretary Samuel Bodman fired the previous administrator of NNSA,
Linton Brooks, in January for data security lapses breaches that occurred on his watch.
Inspector general takes DOE labs to taskThe Energy Department’s Office of the Inspector General released multiple reports during the past year that are critical of excess equipment policies and procedures at DOE’s national laboratories.
  • Idaho National Laboratory: In February, the OIG criticized the Idaho National Laboratory’s excess equipment policies after the lab auctioned a computer containing unclassified information and stored excess hard drives in an insecure wooden container.
  • Lawrence Livermore National Laboratory: A March report criticized the lab’s excessive reuse of computer storage devices. The IG identified other problems with the lab’s management of security badges in a report released in January 2006.
  • Los Alamos National Laboratory: A report released in November 2006 found inconsistent or nonexistent security policies for protecting classified  information, nonfunctioning internal cybersecurity controls, and a lack of monitoring by federal and lab officials.
  • Sandia National Laboratory: The OIG tagged Sandia for not adequately documenting the destruction of classified hard drives in August 2006.
— Wade-Hahn Chan

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group