Energy IG report raises more security concerns

NNSA chief information officer says lack of resources caused compliance delays

IG report: Excessing of Computers Used for Unclassified Controlled Information at Lawrence Livermore National Laboratory [.pdf]

The Energy Department’s inspector general found the National Nuclear Security Administration’s chief information officer created security risks by failing to implement departmentwide excess equipment directives at the Lawrence Livermore National Laboratory for almost two-and-a-half years. The CIO’s office cited resource constraints for delaying the enforcement of security directives that had 90-day implementation deadlines.

The Lawrence Livermore lab was in the process of implementing those directives as of March 1. NNSA did not incorporate them into the lab’s management contract with the University of California until 2006, the IG said in a report released in March.

“Instead of directing LLNL to implement the directives, NNSA waited while its Office of the Chief Information Officer drafted a policy letter to provide LLNL and other NNSA sites with specific requirements for clearing, sanitizing and destroying unclassified controlled information on computers and electronic devices,” wrote Gregory Friedman, DOE’s IG, in a memo accompanying the report on excess equipment policies at Lawrence Livermore.

The Lawrence Livermore lab disposes of about 5,300 computers each year. The departmentwide excess equipment directives issued in February 2004 and June 2005 apply to computer equipment containing unclassified information such as controlled nuclear data and official-use-only, proprietary and personally identifiable data.

David Schwoegler, a Lawrence Livermore lab spokesman, said the IG’s report took a limited view of the lab’s excess equipment policies by criticizing them for not aligning with departmentwide policies. Schwoegler said the lab has strong policies and procedures for disposing of unclassified computers and memory devices, and it complies with those policies. 

“We don’t reuse unclassified drives,” Schwoegler said. “We destroy them. We hammermill them. We actually witness their destruction.” He said a contractor destroys them, and a lab employee documents it.

But Schwoegler said that because of the delays the IG cited, the lab shouldn’t be held liable for any data that might have been improperly disclosed during the past two-and-a-half years. The IG reported no improper disclosures. 

DOE’s excess equipment policies are defined in two publications: a departmentwide notice released in February 2004 and a manual released in June 2005. However, NNSA did not enter the two publications into the lab’s contract until February 2006. According to the IG’s report, an official at NNSA’s Office of the CIO blamed the delay on “problems with resources and other issues.” Julianne Smith, an NNSA spokeswoman, said it was a resource allocation problem.

“As with all issues relating to cybersecurity, implementation of a policy is risk-based,” Smith said. “Within the allocated budget, each organization must prioritize policy implementation.”

DOE Secretary Samuel Bodman fired the previous administrator of NNSA,
Linton Brooks, in January for data security lapses breaches that occurred on his watch.
Inspector general takes DOE labs to taskThe Energy Department’s Office of the Inspector General released multiple reports during the past year that are critical of excess equipment policies and procedures at DOE’s national laboratories.
  • Idaho National Laboratory: In February, the OIG criticized the Idaho National Laboratory’s excess equipment policies after the lab auctioned a computer containing unclassified information and stored excess hard drives in an insecure wooden container.
  • Lawrence Livermore National Laboratory: A March report criticized the lab’s excessive reuse of computer storage devices. The IG identified other problems with the lab’s management of security badges in a report released in January 2006.
  • Los Alamos National Laboratory: A report released in November 2006 found inconsistent or nonexistent security policies for protecting classified  information, nonfunctioning internal cybersecurity controls, and a lack of monitoring by federal and lab officials.
  • Sandia National Laboratory: The OIG tagged Sandia for not adequately documenting the destruction of classified hard drives in August 2006.
— Wade-Hahn Chan


  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.