Energy IG report raises more security concerns

NNSA chief information officer says lack of resources caused compliance delays

IG report: Excessing of Computers Used for Unclassified Controlled Information at Lawrence Livermore National Laboratory [.pdf]

The Energy Department’s inspector general found the National Nuclear Security Administration’s chief information officer created security risks by failing to implement departmentwide excess equipment directives at the Lawrence Livermore National Laboratory for almost two-and-a-half years. The CIO’s office cited resource constraints for delaying the enforcement of security directives that had 90-day implementation deadlines.

The Lawrence Livermore lab was in the process of implementing those directives as of March 1. NNSA did not incorporate them into the lab’s management contract with the University of California until 2006, the IG said in a report released in March.

“Instead of directing LLNL to implement the directives, NNSA waited while its Office of the Chief Information Officer drafted a policy letter to provide LLNL and other NNSA sites with specific requirements for clearing, sanitizing and destroying unclassified controlled information on computers and electronic devices,” wrote Gregory Friedman, DOE’s IG, in a memo accompanying the report on excess equipment policies at Lawrence Livermore.

The Lawrence Livermore lab disposes of about 5,300 computers each year. The departmentwide excess equipment directives issued in February 2004 and June 2005 apply to computer equipment containing unclassified information such as controlled nuclear data and official-use-only, proprietary and personally identifiable data.

David Schwoegler, a Lawrence Livermore lab spokesman, said the IG’s report took a limited view of the lab’s excess equipment policies by criticizing them for not aligning with departmentwide policies. Schwoegler said the lab has strong policies and procedures for disposing of unclassified computers and memory devices, and it complies with those policies. 

“We don’t reuse unclassified drives,” Schwoegler said. “We destroy them. We hammermill them. We actually witness their destruction.” He said a contractor destroys them, and a lab employee documents it.

But Schwoegler said that because of the delays the IG cited, the lab shouldn’t be held liable for any data that might have been improperly disclosed during the past two-and-a-half years. The IG reported no improper disclosures. 

DOE’s excess equipment policies are defined in two publications: a departmentwide notice released in February 2004 and a manual released in June 2005. However, NNSA did not enter the two publications into the lab’s contract until February 2006. According to the IG’s report, an official at NNSA’s Office of the CIO blamed the delay on “problems with resources and other issues.” Julianne Smith, an NNSA spokeswoman, said it was a resource allocation problem.

“As with all issues relating to cybersecurity, implementation of a policy is risk-based,” Smith said. “Within the allocated budget, each organization must prioritize policy implementation.”

DOE Secretary Samuel Bodman fired the previous administrator of NNSA,
Linton Brooks, in January for data security lapses breaches that occurred on his watch.
Inspector general takes DOE labs to taskThe Energy Department’s Office of the Inspector General released multiple reports during the past year that are critical of excess equipment policies and procedures at DOE’s national laboratories.
  • Idaho National Laboratory: In February, the OIG criticized the Idaho National Laboratory’s excess equipment policies after the lab auctioned a computer containing unclassified information and stored excess hard drives in an insecure wooden container.
  • Lawrence Livermore National Laboratory: A March report criticized the lab’s excessive reuse of computer storage devices. The IG identified other problems with the lab’s management of security badges in a report released in January 2006.
  • Los Alamos National Laboratory: A report released in November 2006 found inconsistent or nonexistent security policies for protecting classified  information, nonfunctioning internal cybersecurity controls, and a lack of monitoring by federal and lab officials.
  • Sandia National Laboratory: The OIG tagged Sandia for not adequately documenting the destruction of classified hard drives in August 2006.
— Wade-Hahn Chan

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group