From: Bob Van Cleef <revc@Garg.Campbell.CA.US>
Newsgroups: ba.politics,ca.politics,sbay.talk
Subject: NASA Ames Security Audit
Keywords: NASA Ames ARC security audit management review
Date: Thu, 19 Nov 92 23:41:24 PST
Distribution: ca
Organization: The Land of Garg

Because it is not available on the local NASA computer networks,
I captured a copy of the recent NASA press release on a commercial
system and am posting it here for those who are interested.

Bob
--- beginning of press release ---

11/17/92: NASA RELEASES FINDINGS OF REVIEW TEAM ON SECURITY CONCERNS

HQ 92-207/SECURITY CONCERNS

Bill Livingstone
 Headquarters, Washington, D.C.        November 17, 1992

RELEASE:  92-207

       In July 1992, a Management Review Team (MRT) was established, after a
classified briefing was presented to NASA Headquarters management by Ames
Research Center (ARC) management located at Mountain View, Calif. The briefing
identified potential national security problems.

       NASA Administrator Daniel S. Goldin determined that the situation at
ARC warranted a special one-time review to determine whether the issues and
problems existed and, if so, what type of corrective action should be taken.
The Federal Bureau of Investigation (FBI), the Department of Justice and the
Department of Defense were consulted on the national security and foreign
counterintelligence aspects of the problems identified.

       "Upon learning about the potential security problems, I immediately
ordered a review of the situation," Goldin said. "Based on the review,
information has been forwarded to proper authorities. The recommendations of
the review are being taken very seriously and I intend to promptly implement
them."

       Based upon the review and discussions with senior management, the MRT
does not believe that the problems encountered at ARC are occuring at other
NASA centers.

Findings of Review

       ARC is considered "high risk" for hostile intelligence operations.  ARC
exacerbated a marginally effective security posture by not focusing
appropriate management attention on the handling of sensitive technology.

       Structural and functional weaknesses existed in the way the ARC
security office worked in relation to other center operations. In addition to
security concerns, processes and practices in the areas of personnel, legal,
procurement, and data and technology protection are contributing to the
potential risk rather than serving as controls over the risk.

       The ARC culture and environment were found to be the underlying cause
of NASA's vulnerability; the culture is strongly biased toward maintaining an
academic reputation, rather than meeting U.S. industry and national needs.

       Generally accepted management controls, as well as security, legal,
personnel, and procurement policies, are often viewed as impediments and are
sometimes sidetracked or avoided.  Lax procedures and attitudes were
identified that set the stage for widespread dissemination of commercially
valuable applied technology being developed by ARC personnel.

       ARC's credibility with the U.S. aerospace industry has been damaged as
a result of these problems.  Some of NASA's customers and partners are
reluctant to share important data with NASA for fear it will be disseminated
with little or no regard for its sensitivity. In order to regain credibility,
specific processes for the identification and handling of sensitive and
commercially valuable technologies at ARC must be developed and fully
implemented by ARC employees.

       To resolve the conflict between NASA's desire to share technology
internationally and the need to place U.S. interests first, an environment and
culture must be developed at ARC and elsewhere at NASA, which focuses NASA's
attention on the needs and expectations of U.S. industry and the taxpayer.

       Basic science efforts actively involve and will continue to involve the
international community but applied technology, developed at U.S. taxpayer
expense, must be protected for U.S. industry use in accordance with applicable
laws and regulations. NASA must work internally, and externally with
appropriate members of the Administration and Congress to address the problems
and develop long-term solutions.

Information Referred to OIG and FBI

      The MRT found a number of specific discrepancies in the areas of
procurement, misuse of government equipment and apparent violations of the law
and/or NASA policy.

      The MRT referred this information, as appropriate, to the NASA Office of
Inspector General (OIG) and the FBI, which has jurisdiction over foreign
counter intelligence issues resulting from the review.  Cases were opened up
by both the OIG and the FBI.

      It is anticipated that the OIG effort will be completed in December
1992.

Review of the MRT Team

      Because the review was unexpected by the ARC workforce and
 employees of Asian-Pacific ancestry appeared to bedisproportionately
affected, there was a significant adverse reaction to the review among some of
the ARC workforce.  The NASA Administrator took immediate action to address
employees' concerns.  He met with representatives of the ARC Asian Pacific
Island Advisory Group to discuss their concerns.

      The Administrator also appointed an Assessment Panel on Aug. 26, 1992,
to assess the approach and process used by the MRT. The assessment panel was
charged with examining the concerns that could have unnecessarily increased
the levels of employee discomfort or organizational disruption flowing from
the review.

      It was also tasked to make recommendations that would alleviate employee
concern about the process, and minimize difficulties, should a similar review
be required in the future.

      The Assessment Panel concluded that "the scope and objective of the
management review were legal and that individuals were not selected for
interview and search of their workplaces based upon their race or national
origin."

      "The Panel further concluded that there was a confluence of factors
prior to, during and after the management review, some of which were avoidable
and some not, which caused negative reactions within the workforce."

--- end of press release ---

><>  ><>  ><>  ><>  ><>  ><>     \|/     <><  <><  <><  <><  <><  <><
Bob Van Cleef                    -0-        revc@garg.Campbell.CA.US
The Land of Garg BBS             /|\               BBS (408) 378-5108
><>  ><>  ><>  ><>  ><>  ><>      |      <><  <><  <><  <><  <><  <><
Xref: sparky ba.politics:7288 ca.politics:9752