beyond oversight and investigations this hearing will be the first of the hundred tenth congress is entitled continuing security concerns at los alamos national laboratory will begin with the members opening statements plus alamos national laboratory is a place of great history is home to many of our nation's most secret weapons development and yet it's also home to some embarrassing lax security protocols very much twelve years on the oversight investigation  subcommittee i've sat through far too many hearings detailing problem after problem at los alamos now as i take over as chairman of this distinguished subcommittee i find myself presiding over yet another hearing about inadequate security at the la the latest security to baku begins in october two thousand and six when los alamos county police responded to a call at a private residence and discovered several hundred pages of classified and unclassified materials as well as electronic files that were stolen from the los alamos national lab documents were taken from the lab by sub contract employee employees simply walked out of the lab with stolen documents in her purse or on a thumb drive which she easily inserted into ports open ports on classified computers over the last eight years this subcommittee has held eleven hearings into various security lapses at los alamos i have this chart which i will enter into the official record illustrating eleven hearings that this committee has hel hearings members have heard time and again how the department of energy and the lab managers were going to improve securities we've heard excuse after excuse and plan after plan of how the lab would improve security the deal we went so far as to competitively bid out the labs operation and hope that a new management team would bring about change security and accountability but deal we awarded the contract to a consortium that includes a previous contractor the university of california with this brilliant be sation did anyone really expect the law a fair culture of los alamos to change as a result of our investigation i have a number of questions that need to be answered today hall and why did the october security breach occur what is the potential and actual harm to national security as a result of the breach why do security breaches continue to plague los alamos what plans do los alamos deal we and national nuclear security administration have for preventing breaches at los alamos who's accountable for the most recent security breach at los alamos what tools are available to the federal government to hold los alamos accountable for the latest security breach for example new accountability rules allow do you eat to penalize contractors and or sub contractors for violations of dealy rules regulations and orders regarding the safeguarding of restricted data and other classified information based upon our staffs investigation my real concern here is whether dealy is using these tools or is it just giving contractors a slap on the wrist for egregious security violations are the tools available for the federal government to adequately do to your security breaches this incident does raise serious questions about the manner and policies of the department of energy and granting the security clearances to employees this question as well as many others will of course have to be answered in closed session due to their sensitivity during our last turn into a six i became so fed up that i asked the question what do we do at los alamos that cannot be done at our other national laboratories i was serious when i asked that question back then and i must tell you i've been asking myself the same question again in recent months i'm a former police officer in michigan we like to use auto analogies for far too long we've essentially been issuing parking tickets to los alamos in july of two all four we  centrally put a boot on the lab when it was shut down for seven months to clean up its act this cost the american taxpayers more than three hundred fifty million dollars it was supposed to result in a more secure facility unfortunately there's been yet another bridge not long after los alamos reopened los alamos did not change after repeat it tickets it did not change after putting a boot and now i'm convinced that we may need just told the car something drastic must be done at los alamos in order to change the systemic security problems the american people demand in these are the highest level of protection of our national secrets but the department and the lab won't change provide security at our labs congress must explore ways to protect our security therefore i will in cooperation with my friends and minority side be asking the government accounting office to perform a comprehensive audit of all services performed at los alamos i w evaluate whether the footprint and mission at the lab is too large i will also ask them to evaluate the possibility of consolidating and moving many of the classified operations at los alamos to another lab such as saying where there is a willingness reports of the review or due at the end of february it's our expectation that department will take these reviews seriously provide concrete answers and submit detailed plans to remedy the security lapses i fully expect secretary bodman will appear before articulate what has it will be done to improve security at los alamos in conclusion i'm pleased that the first hearing of the old i committee is truly a bipartisan effort by myself the ranking member and our staff this is what i hope will be the first of many bipartisan efforts to make our country safer and our government more effective thoughtful in tough oversight is neither republican nor democratic it is just good government i salute the former chairman and his staff for all their work in this inquiry i look forward to continuing to work with him the constitution and trusted congress with a solemn duty to oversee the activities of the executive branch oversight is the only way congress can assure that our laws are adequately and properly administered without effective oversight how can members of congress truly determine with confidence what additional laws are needed as chairman of the subcommittee i plan to be persistent in our oversight responsibilities fully realizing that congress's power to probe is necessary to have our democracy that is best who wield it in a non partisan manner again i want to thank our former chairman gentleman from kentucky i look forward to working with all the members of the committee in the sub oversight investigations subcommittee missed and with that i would you to mr whitfield the chairman thank you so much for holding this important hearing and i certainly want to congratulate you on your new response with your new responsibilities as chairman of this subcommittee as you said we've held several hearings to review ongoing security problems at los alamos over the last three or four years and as long as important continue to do so i'm delighted that we're continuing to hold these hearings prior investigations led by this subcommittee have uncovered the details of the nine hundred ninety nine when holy case the two thousand in the s t team hard drive incident and several incidents in two thousand and three and two thousand and four relating to the improper handling and destruction of classified removable electronic media and then in two thousand and four operations at los alamos were shut down for a six month period in an attempt to deal with many of these problems and each subcommittee hearing loss almost officials have promised to solve ongoing security problems but they have failed to follow through i was pleased when the department recently decided to compete the los alamos contract for the first time that over sixty years in june of two thousand and six a new consortium named los alamos national security began operations at this site and its contract land has made several commitments to solve security problems at los alamos unfortunately for alliance only four months pass before the most recent security incident occurred in october of two thousand and six it was discovered that one thousand five hundred and eighty eight pages of classified documents from a classified volves had been removed and paper form and also downloaded onto a portable thumb drive the documents in the thumb drive showed up in the trailer home of a former l a in el employ way now one thousand five hundred eighty eight pages i just want to show you this is one thousand five hundred eighty eight page so it's really quite shocking that this is still going on in this magnitude however unfortunate the timing lands must be held accountable compromise in these documents and it should pay a price the incident demonstrates that the department and lands have failed to implement an effective security policy at los alamos d o a must assert its contract and regulatory authorit compel greater security performance this most recent security incident demonstrates the same pure secure poor security management lack of formality of operations and insufficient oversight that has plagued the lab for decades i do not think the security problems at los alamos can be solved with small changes on the margin dramatic new ideas from the department from lands and from congress are needed i have cosigned legislation drafted by chairman barton to strip in as say of its autonomy with respect to safeguards and security worker health and safety and cyber security oversight and i understand that chairman dingell and chairman stupak have also co sponsored this important legislation i would also note that we signed a coder last night along with chairman barton and representative hastert that asked the department to take immediate steps to solve the security problems at los alamos the letter has several recommendations and urges d o a to take action to reduce the volume of classified material across the laboratory at los alamos operations are spread out over a forty three square mile area the lab has approximately fifteen thousand employees three thousand classified computers and one thousand seven hundred seventy four classified security areas to give you some perspective there are more classified here any areas at los alamos then there are total rooms and the rayburn cannon and make l i n l susceptible to security failures i hope this subcommittee can help in a father right solutions to fix this problem once and for all thank you thank jim and from kentucky next with so many from this subcommittee you will do an outstanding job you've been a supporter member of the committee and the ship for breaking member and i'm delighted that she's sitting where you are graduations i would also say  express my good wishes to the gentleman from mr whitfield who was so gracious and kind in his conduct of this subcommittee we look forward to working with him as i know we all do i am i feel a little bit like this is groundhog day all of us will remember that we seem to be waking up each morning to repeat the same events over and over with regard to securit hearings to go into the conduct of matters at deal we and how things were done at that time with regard to the laboratories they're all matter of difficulties i will lay belabor the matter or delay the process by talking about it but the events there with regard to securities security breaches at los alamos and the other laboratories were very serious and so i've reminded of what you know he rarely used to say this we could drag out stacks of letters sent to the department secretaries the presidents over the past two decades on the issue we're viewing today we could also display a small tower of hearing records many of which i chaired relating to security breakdowns at deal we and at the los alamos national laboratory in specific this would be good dram in a movie these however she curity breaches and are deadly serious threaten our security guard our nation's military secrets our nuclear secrets and other matters important for some reason or other deal we has proven itself incapable of managing this critical security and preventing problems that we will discuss today there's a new twist to this story and i find it a did worrisome development apparently this latest security breach raises six serious questions about deal ways process and procedures in granting security clearances and you to cation of adverse information dealing with the suitability of employees and contractors this appears to be in part at least a new issue and it should b the subject as it is going to be of an executive session which is going to take place later today we may very well need to expand the investigations a subcommittee and to deal with these personal security system mr chairman it is our joint concern that we hear this that we will hear the same promises that we've heard in the past about how do you we will remedy the situation how this lab is not going to take matters she carry seriously and how the lab will be reorganized how some officers and officials and managers may be removed i must confess that i've been hearing these promises for a long time and i'm beginning to find them somewhat tedious the there may be nothing in the secretary's tool box effective enough to turn this lab around we will need to determine that in today's hearing and to find whether penalties are sufficient to effectively improve security at los alamos i understand secretary bodman for whom i have considerable affection is considering yet another security review regarding los alamos specifically in the department in general i look forward to hearing rather to his appearance before this committee in february to learn what he intends to do to fix this mess i support requesting the government accountability office to conduct a comprehensive audit of los alamos operations in order to determine what functions need to be retained are verses being moved to another government or private facility it increasingly appears that the overall footprint of the lab may be too big in both physical scale and in the scope of this mission to be properly managed at this point all options should be open on the table for consideration as to how we correct this intolerable situation again mr chairman congratulations thank you for holding this hearing and i look forward to hearing what will be said by our witnesses but i mr chairman i too want to congratulate you on the assumption of your new duties as the subcommittee chairman of oversight and investigations i consider this subcommittee to be the heart of the  full energy and commerce committee you're following in some big footsteps of the prior congress mr whitfield but if you want to go back to when your party was last in the majority everything full committee chairman we're going to have a good a good relationship i want to echo what mr dingell just said if there's nothing else to do in the oversight investigation subcommittee that seems you  always hold a hearing on security lapses at los alamos i believe this is the tenth hearing in the last four years i could be wrong about that but i wouldn't be off by much two thousand and four the entire laboratory complex was shut down for seven months two thousand and five steen hundred records of the including social security numbers some some people hacked into the system stole those numbers and the administrator then didn't even bother to tell the secretary of energy about it  this last october approximately sixteen hundred documents were stolen and carried out of the complex and if my memory is correct were found in a mobile home when the local police responded to a domestic disturbance anough is enough this is this is not a fast food restaurant on the corner somewhere i am and i think my frustration is shared by every member of the full committee and i am happy to report that last evening we introduced a bipartisan bill mr st problems and gives it back to the secretary of energy to delegate is as he sees fit and it's h r seven o three and i hope that bill is given a  if if there were a way to start over i would say shut down los alamos fire everybody out there and build a new weapons laboratory somewhere  else that's not cost effective you know obviously there are many many good people at the laboratory but there is an absolute inability or unwillingness to address the most routine security issues at this laboratory i have sent a letter to the secretary of energy mr bodman today making him aware of this new legislation but i've also asked him to immediately consider doing the following things by his authority as the senior executive officer of the department of energy i've asked that he consider directing the office of health safety and security conduct and immediate inspection at los alamos and to repeat it for the next two years to report any problems and report any progress the number of classified vaults so they've got classified material strewn all around the complex i have visited los alamos seen for myself some of the side some where they store classified material i am not an expert on security but i consider the current number of sites to be many many more than is absolutely necessary and one simple solution as a problem would be just reduce the number of places they keep this material i also think that the current contractor at los alamos apparently doesn't give a damn about this and i hate to use that kind of language but that's the way i feel if it's contractually legal i think their part of their fees should be withheld  perhaps even forfeited if the contract allows for civil penalties i put hope the secretary would consider assessing those penalties if you can get somebody's attention any other way sometimes you can get their attention by withholding financial assets so it's obvious that we're not going to solve this problem with one hearing mr chairman but i do want to commend you for being willing in your first hearing of of all the things you could do to tackle this issue it is a very serious issue and i will pledge to you that the minority is going to continue to work on this problem and now that you're the chairman and mr doing was a full committee chairman you'll have our full cooperation in trying to get to the bottom of it and rectify the situation if it's possible and if it's not if after a year year and a half if it doesn't look like any progress is being made i do reserve the right to request that we consider shutting down this laboratory if that's the only way to do it and we have to start over then that's so be it subcommittee which i consider to be the best subcommittee in the house and i also want to add my congratulations to the new vice chairman of the subcommittee miti mr monson he's going to have a great time one thing that's so great about this subcommittee is when we get mad we get really mad in a bipartisan way and i want to echo what former chairman barton said because i've been on this subcommittee now my ten years in congress and he you're exactly right we've had about six to ten hearings in the last two years alone on this subject and we've been told repeatedly in every single hearing that this problem would be fixed in two thousand and barton and i visited los alamos and this was a kid into a state visit for los alamos psych at guess we went in there was tremendous local interest there was a tremendous tremendous effort to brief us and show us what was going on the deputy secretary was there the new director was there everybody was there we to facility we had some very tough conversations we were told that this situation was going to be fixed and that this it situation was going to be fixed immediately and subsequently that director who was with us was drummed out and nothing happened as we've now seen mr dingell talked about groundhog day and this week in fact it's groundhog day so it's appropriate that we're having these hearings this week but it is not funny about the security breaches the lab is home to some of the most confidential and important data in the nation weapons development security of our nuclear stockpile the development of technology to protect us from terrorist attacks and it's not the first time either that we seem to be dependent on dumb luck to discover a breach of security if it hadn't have been for the vigilance of police officers investigating unrelated drug charges this classified data would still be sitting at the home of a former sub contractor for yet to be discovered purpose and so really the issue is so much broader than just a single incident and as well here today the department of energy's inspector general recently spout found that physical and cyber security at the lab have been consistently compromised we keep saying to ourselves why does this happen time after time year after year that we haul everybody and we rant and rave and then it happens again i think there are two problems there's the oft discussed culture at los alamos where people really think themselves beyond the requirements of true security measures but there's another problem and the former chairman burton alluded to this it is such a large side and wit many different areas that that contain this data that it is very difficult to secure it and in addition when i visited i found three years ago some of the security measures being implemented would be just routine security measures at a private facility and so you've got to wonder do these government for silage think that they that they have to comply with lower standards than in private industry so so really i think the continue all those in favor of moving to an executive session later please just raise your hand or people have done before me of have laid it out pretty clearly and forcefully there are just few things as important our nation's security as maintain the security of our classified data and our national labs i think my colleagues have made that clear you've heard it from me before in these hearings we've had in the past the chairman said these are the crown jewels of our weapons systems and i guess what strikes me is we've got employees who still are walking out the front door with the diamonds out of the crown jewels set and that's a problem that is a very serious problem and one that this subcommittee has railed on before in public and in private sessions perhaps even more so than what people are hearing us in public session there are some fundamental questions that will have for all of you today that will come in both sessions clued in access to these computers once again how is that controlled how does somebody walk out with a thumb drive i understand you're now using a product like this j b weld the world find this cold weld weld to actually seal up the u s b and firewire ports so that somebody can't use one of these devices it's great it works for engine blocks and it works for fossil it's and i guess it works to plug leaks in our national security system too but why do we even order computers that have those ports in them it would seem to me that the government could work out a contract to get a computer doesn't have i'm glad you've now sealed up seventy two hundred of these ports or whatever the actual count is perhaps we'll learn later today but it strikes me subcommittee mr moms on thank you mr chairman i don't have any written statements i'd like to move as quickly as we can into testimony being you on the committee and just picking up the gist of what for allowing me to be part of the committee and to the ranking member and the members of the committee thank you thank the gentleman next turn to mr burgess dr burgess thank you chairman steve hackett and ranking member whitfield for continuing this committee's important oversight over los alamos germans to pack i appreciate the bipartisan nature of this hearing and i hope it is a sign of how you will handle hearings in the months to come you and your staff are to be commended for your preparation and your willingness to share relevant information with members across the aisle mr chairman it is my sincere hope that we have your commitment to continue this collegial and bipartisan disposition and throughout all hearings of this congress i would also like to take a minute and thank ranking member whitfield for his investigation of los alamos throughout the years clearly today's hearing builds upon the hard work of the determination that you and your staff have displayed on this crucial matter of national security i thank you for your leadership on this important issue today we have three panels before us that will hopefully be able to explain to us not only what exactly happened in october but also what has been done to prevent another recurrence i welcome you all here today and hope that we can get to the bottom of this continuing problem and for all i would especially like to welcome my fellow texan deputy secretary clay cell thank you for being here with us today and sharing your valuable insight into the department of energy in the post nine eleven world that we in which we live today our national security has become the most important issue facing our nation we must do everything within our power to ensure that we do not become the victims of terrorism again as terrorists become more and more sophisticated must continue to implement and maintain c of comprehensive measures to a secure our safety while we often think of terrorists as being from foreign lands it is easily plausible that people living in on american soil can compromise our country's national security interest the fact that someone can walk out of an institution that developed the atomic bomb with a disk full of classified information is deeply disturbing this is absolutely indefensible los alamos has some of the smartest minds people of almost immeasurable brilliance working on the facility and the recurrence of so many security breaches it is simply inexcusable i was taught that people should be held accountable for their actions while there are many organizational changes that can be made to better to better ensure the security of our countries classified information one of the easiest and most effective remedies is to make the contractor in charge of security pay a steep penalty as a steward of the taxpayer dollar i fully support this idea if a contractor is penalized millions upon millions of dollars maybe then they will finally realize this how serious the problem is and that it must be stopped while there is clearly an institutional problem at los alamos we all must also remember that there are thousands fifteen thousand hardworking employees at the lab who make a remarkable contribution to science in this country on a daily basis i had the pleasure of the on or visiting the lab in july of two thousand and five and i met many of those hardworking and dedicated men and women i was impressed by their dedication i was impressed by the overall intellect of the individuals involved in preparation for this hearing i came across a posting on a well known blog of los alamos employees the posting was addressed to members of this timidity and ended with th thought quote don't give up on us just yet please be careful with your words direct them at those who are truly at fault and avoid belittling calm comments directed against the whole workforce and against the vital work that we can do to help this country and one more thing yes you do need los alamos a well functioning los alamos and of quote i completely agree with this employee the country needs a well functioning los alamos and that is why we are here today to protect what is a national treasure and i would oppose any diminution of that mission or relocation of the resources but oversight is our obligation mr chairman i have several questions that i hope we will get answered and one of those questions deals with the r f p process that the lab went through just a little over a year ago was a fair process was the university and the contractors that was not selected were they given a fair shake were they given a fair chance to to compete for that contract it seems as if the embedded culture at los alamos is incapable of change perhaps that is reason enough that we should reopen the r f p process mr chairman i again thank you for the bipartisan hearing in which we can further address this troubling issue and what needs to be accomplished with this dismal and depressing cycle of security breaches at los alamos and i feel it is important that we continue to work on this problem so that we do not risk the welfare of our nation and succeeding generations who will either benefit from our decisions or inherit the failings of in our security lapses but that i'll yield back seemed like we ended and that last term with los alamos obviously back then much more serious allegations and and then we have today but mr chairman i have a statement i'd like to place in the record and express the same frustration i think everyone's heard on a bipartisan basis but i like as you get moving and see what we could do but also i'm thankful that we have local law enforcement who was sharp enough to pick that up and but hopefully we can stop it before it actually leaves the lab but with  removed at los alamos national laboratory indicates a careless attitude towards our national security and deserves the intense scrutiny of this committee one such a splay of this disregard for national security occurred in two thousand and five as referenced by the members here when the former administrator than ask your administration linton brooks for nine months administrative brooks refused to report computer hackers that to fifteen hundred social security numbers and personal information of employees of the n s a another instance in october of two thousand and six we know that placed on the flash drives and hundreds of pages of classified documents at the home of a former socratic subcontractor the content of which is so classified it can't be released the public but one would nonetheless raise our concerns deeply for the sake of our national security we must determine how they were moved and take immediate steps to prevent this from occurring in the future we need to prevent breaches through better security systems on computers and hardware to thoroughly screen everyone especially contractors  alamos to fully inspect those materials that come in and out of the facility and to prosecute to the fullest extent of law and give certain penalties for those who brief that security as our society is growing more dependent on technology we have seen  disturbing trend in the theft or loss of sensitive personal information from government agencies such as the v a and large corporations that at times use for malicious intent what has been the consequence of the theft of this material and who was responsible for the misuse we need answers to these questions and we need ideas on how to prevent this in the future misuse of personal information must have consequences for example in the hundred ninth congress congress i introduced the service act which would physically secure all sensitive personal information and all equipment containing such information processed or made to by the department of veterans affairs well i would have also required the v a and its contractors to encrypt sensitive personal information the survey act also impose criminal penalties for the unauthorized disclosure of sensitive person permission but we are here not to address just one or two of these problems but to find a way to solve a chronic failure a chronic failure to follow national security procedures in guarding classified materials i look forward to is always been a strong advocate for los alamos and see the concerns of members but welcome and look forward thank you and a pleasure to join you today mr chairman thank you ok we're in recess till noon so we should be able to get hopefully most this hearing and it was a policy of the subcommittee to take all testimony under oath please be advised that wouldn't this have the right under the rules of the house to be advised by counsel during your testimony  desire to be advised by counsel at this time if so please introduce your counsel so he and no reaction buys given what you have said we do swear in witness would you please rise raise your right hand mr chairman and members of the subcommittee i'm pleased to be here at your request to testify in the office of inspector general's review of the recent compromise of classified data at the department of energy of los alamos national laboratory well sow most has  been as has been stated earlier today has been at the forefront of our nation's security related research and development enterprise for over sixty years there have been a number of highly publicized incidents of cast doubt on the laboratories ability to protect national security the office of inspector general was before numerous audit inspections investigations of physical and cyber security related issues at the laboratory are reviews of covered diverse areas such as the implementation of design basis threat safeguards over classified material and property and security of information systems i've been asked to testify before this subcommittee and other congressional panels on several occasions regarding management security interests issues at los alamos no doubt to the subcommittee is fully aware of the circumstances surrounding the recent seizure of classified information from a residence by the los alamos county police department shortly after the material was seized the secretary bodman requested the office of inspector general begin a review of the compromise  data the secretary also asked that we evaluate certain aspects of the department security clearance process the results of which can be discussed in closed session our special inquiry disclosed that despite the expenditure of tens of millions of dollars by the national nuclear security administration to upgrade various components of the laboratory security apparatus the security environment was inadequate specifically our special inquiry revealed that first certain computer ports which could have been used inappropriately migrate information from classified systems to un classified devices and computers had not been disabled second classified computer racks were not locked third certain individuals were in appropriately granted access t classified computers and equipment to which they were not and sidled for computers and peripherals that could have been used to compromise network security were introduced into a classified computing environment without approval and five critical security functions had not been adequately separated essentially permitting systems administrators to supervise themselves when it came to security and to override controls in many instances laboratory management staff had not developed policies necessary to protect  information and not enforce existing safeguards or had not provided the emphasis necessary to ensure protective measures were adequate some of the security policies were conflicting or applied inconsistently also both laboratory and federal officials were not as aggressive as they should have been in conducting security reviews in inspections our findings raise concerns about the laboratories ability to protect both classified sensitive information the picture before you right now is depicts the rac classified computers at last at los alamos from which the diverted classified information originated as you can see the rack that held the computer was computers was unlocked a condition that permitted access to the exploitation of the open port and i know you all are familiar this is a thumb drive similar to the one which in fact was used to divert the material from the laboratory this is a one gigabyte thumb drive and this can contain the equivalent of two file cabinets full of information to show you how powerful this little item is and a diversion of classified material creates a potentially serious national security situation the full extent of the damage related to the removal of classified information in this case may never be fully known a criminal investigation of this matter by the f b i continues we made a number of recommendations to correct identify deficiencies for example we recommended the department take immediate action to disabled a need a computer porous secure classified computer records segregate critical security functions and limit classified computer access and privileges to those who specifically require it and response to our report secretary bodman established two high level task forces to act to address our findings and deputy secretary self directed in the media review of policies and practices related to computer ports at each of the department's facilities the subcommittee requested that we have done a five other actions that can prove security at the laboratory in short we concluded the department should first establish an up to date unified coherent risk based security policy that flows throughout all elements of the department it is essential this policy be applied consistently and that all aspects of security physical cyber and personnel be integrated to ensure a seamless system secondly aggressively hold individuals and institutions at both a federal and contractor levels accountable for failure to follow establish security policies penalty should include meaningful reductions in contractor fees personnel reassignments and terminations civil penalties program redirection and ultimately should need be contractor emanation one final no one of the most disturbing aspects of this event is a fact that it was not discovered by the laboratory but by local police during an offsite investigation unrelated to laboratory activities without this inadvertent discovery the diversion of classified material may never have been disclosed in that light the department los alamos need to strengthen efforts to proactively detect and prevent security breakdowns and this might include for a bit for instance first improving the level of monitoring of classified computer use through the application of specialized software which is currently available to enhancing computer activity logging in three initiating a program of unannounced security checks beyond routine inspections admittedly there is a cost involved with such undertakings but  subcommittee appreciate the opportunity to testify today regarding the improper removal of classified information from the los alamos national laboratory at the time of this incident was discovered our office of independent oversight was conducting scheduled inspection  the laboratories security cyber security and emergency management programs as we heard from my colleague mr friedman his office conducted the inquiry into the circumstances surrounding the incident therefore i  remarks on our inspection of the laboratory in terms of appropriate for this unclassified hearing our independent oversight inspection just completed resulted in the lowest set of performance ratings for security and emergency management topics that we have seen at los alamos since one thousand nine hundred ninety nine that combined with a history of security problems at los alamos is of great concern to everyone however these rating should not lead this committee to conclude that the laboratory is not protecting their most important national security asset this inspection concluded that special nuclear material an area with historical significant weakness is adequately protected additionally the ratings  part reflect the fact that our independent oversight inspection process has become more technically going to enhance and increasingly focus on performance protection based activities especially in the area of cyber security and protection of classified matter we note some improvements however we continued to conclude that extensive work remains to ensure that los alamos fully meets department expectations while special nuclear materials were adequately protected and overall performance of the protect force was considered affective we identified a number of significant problems with the protection of classified documents and materials and with the configuration of all type rooms it was evident that the site is overly dependent on the use of nonstandard storage configurations for the protection of many of its classified weapons parts compensatory measures established to support approval of the nonstandard storage configurations were found to be inconsistent and not performing according to plans the overall impact of the deficiencies related to the protection of classified matter is substantial also while some cyber security enhancements have been made the laboratories cyber security policies are not comprehensive and not up to date with dealy and then i say requirements and they do not sufficiently address threats posed by merging the technologies additionally risk management processes are insufficient resulting in risk assessments decisions being made at lower staff levels which is inappropriate in many cases the protection of classified systems is overly dependent on administrative controls to mitigate potential insider activity rather than more robust controls and barriers as a result los alamos national security systems continue to operate at increased risk from malicious insiders intent on subverting established departmental requirements another area of concern is the certification and accreditation above classified and unclassified information systems the los alamos certification and credit aging process has not kept up with current methodology is and existing processes do not ensure a consistent approach for applying testing necessary security controls for example over twenty five as an existing unclassified workstations and servers at los alamos were not certified and accredited self assessment processes are weak and very few systems are actually being tested as part of these assessments moreover deficiencies identified during self assessments are not always reported to the los alamos site office or n s a and development of corrective action plans to address them seems to be optional consequently there is little in depth understanding of program weaknesses considering the progress made to date balanced against the cyber security issues that remain we conclude that strong and aggressive management action is required there does the  sound new laboratory plans for conducting self assessments and implementing a contractor performance or churns program as part of the contract transition however the plans are not yet fully implemented in addition the laboratory does have an effective process for managing corrective actions for identified deficiencies excuse me does not have an effective process for managing corrective actions for identify deficiencies similarly the n s a site office security survey program is inadequate in few cases the laboratory has decided not to comply with departmental requirements and the laboratory and n s a did not utilize the department's mandated deviation process to fully assess and accept risk associated with these decisions the recent inspection results illustrate some improvement however the most important national security asset at last los alamos must be recognized to be protected and that is the security of nuclear material nevertheless significant and disturbing protection and emergency management program deficiencies continue to exist at los alamos that require prompt attention forceful and sustained management action and corrective actions to be followed we have heard all too often from a long line of dealing and here's how serious lando issues are and changes are needed however mr chairman it's my professional opinion that no secretary sell it's imperative that n s a in the last almost side office in particular follow the leadership of the secretary in the deputy secretary and let's immediately enhance and then say capabilities to affectively oversee the contractor performance now and in the future mr chairman one other note in the course of this hearing there may be privacy issues to arise and i would like to recognize that erik figgy from general counsel is here in th representing the department thank you before we move to our next witness we should note that heather wilson from new mexico represent congresswoman wilson is a member of the  subcommittee but we welcome her participation here today thank you it was that will next year from a mist and you know brian executive director project on government oversight that's right thank you for inviting me to testify today i'm daniel bryan executive director of the project on government oversight we've been investigating and exposing security failures in the nuclear weapons complex since two thousand and one despite the creation of an n s a security failures have continued to plague the complex six especially at los alamos now n s a administrator linton brooks has been asked to resign and our nation's secrets have been mishandled by los alamos again not only have n s a and you see failed to correct security issues but now there will be even less oversight of los alamos as a new pilot program has been implemented at los alamos in which oversight has been handed over to the contractors and self perhaps this new legislation that congressman introduced could help turn the tide of this just regard for federal oversight since two thousand and one there have been at least seven instances in which classified information was mishandled los alamos and i suspect there are many others that have simply flown below the radar classified computer disks have gone missing computers that may have contained classified information somehow disappeared from lab property either having been stolen or lost classified information has been transmitted through unsecured e mail and the list goes on the cyber security episode has occurred on average nearly once a year since pogo began its investigations and all these instances occurred after the infamous episode of the two missing hard drives which were later discovered behind th now in the recent incident a subcontractor employee freely took over two hundred pages of hard copy classified documents and over four hundred classified documents on flash drives to her home which she shared with a drug dealer this could only have happened if there was a complete collapse of multiple supervisory and security systems it was only by happenstance that she was caught not because in effect a security system was in place we would never have known about the security breach if it hadn't been for a domestic disturbance furthermore we have no way of knowing how many other instances like this there are out there that we don't know about it's important to remember that n s a attempted to keep this instance secret from congress and the public until poco learned about it eight days after the local police raid after the most recent security incident a cyber security audit was launched and according to a lab e mail from just a few days ago that i asked to be submitted for the record quote as a result of the preliminary findings of the cyber security audit this is just a week and a half ago lanolin has agreed to suspend all non essential classified computing activities for at least the next forty eight hours by the close of business today and this is not the first time security failures have significantly impacted operations at the lab in two thousand then secretary bill richardson announced a new system so there would be no longer classified removable electronic media to be lost or stolen the labs essentially ignored the order in may two thousand and four then secretary abraham announced that the complex is going to have a new system doing essentially the same thing again the labs essentially ignored the order i suspect secretary bodman will soon be announcing a new initiative to solve cybersecurity problems and i'm sure he is genuine in his belief that his directives will fix the problem but those of us who have been around for a while have reason to be skeptical in addition to cybersecurity failures los alamos continues to suffer from a litany and of other problems and wh los alamos is a big problem it is by no means the only problem in the nuclear weapons complex as other sites are also currently facing their share of serious problems despite these other sites that urgently need attention los alamos does stick out as the bad child why there's a joke around the complex that goes something like this the secretary of energy tells the three national labs to jump sandy asks how high livermore makes an excuse for why it's too busy to jump and los alamos asks who the secretary of energy is los alamos sticks out as a bad child because of its consistent and utter disregard for federal oversight at this rate as was mentioned before we can all schedule next year's hearing right now given the likelihood will still be discussing problems at los alamos unless the entire incentive system is reversed i have enumerated in my written testimony a number of specific recommendations but in the interest of time to highlight them first is that n s a or perhaps simply the department of energy needs to make it a priority to fund oversight and promote federal employees who are thorough in their oversight work in it current state the los alamos site office is nonfunctional there are over twenty vacant federal positions in that office and officials should also be held accountable if they do not implement the recommendations made by the two gentlemen who are sitting at the witness table the department of energy's inspector general and the office of health safety and security as we've mentioned before there are numerous reports that have been issued on these issues but no one gets in trouble when they don't do anything about what these people have recommended the performance incentives in the los alamos contract should be recalculated and equally weighted to reflect the equal importance of accomplishing the mission with ensuring security and ensuring security and doing so safely of the sixty one million dollars  currently on the table for f y o seven in the performance fee for the los alamos budget only six percent or three million of that amount is tied to security fortunately that small percent is not set in stone and should certainly be revisited and disallowing cars with los alamos this failure to perform adequately pogo also recommends that the at will employment provision at los alamos the change for their employees because currently if an employee is the bearer of bad news to management the employee can be fired at will creating exactly the wrong incentives this is an important issue for the committee to be conscious of at is a it is of particular concern for livermore employees who are not currently operating under this condition but as you see appears to be opposed to retain the contract at livermore there is in fact concern that this will now in fact acted for the livermore employees as well i'm thrilled that the committee has already undertaken next recommendation to audit the missions currently being conducted at los alamos i think it's a very important effort the committee's undertaking in closing the deal we will soon be submitting a request of a hundred and fifty billion dollars to fund a wildly ambitious project to revamp the nuclear weapons complex known as complex twenty thirty before any funding for further expansion is improved i respectfully suggest that congress must have confidence in the mission and in the ability of the complex to carry out that mission safely and securely thank you thank you we'll begin questioning mr friedman your investigation of the recent incident at los alamos revealed the lab security framework was seriously flawed for example is it true the number of the key areas including security policy was nonexistent applied inconsistently or not follow that is correct mr chairman in two thousand and four the lab was shut down when we did this massive review wasn't that one of the recommendations in what is it why are we having such problems with los alamos as brian says secretary richardson giving orders like abraham now secretary bodman we've been reassured by mr but i'm sure that things are going to change but since ninety nine that's what eight years now obviously i think one of the problems that we found consistently is a question of sustainability mr chairman if i can put it that way use that term a lot of good intentions people start off with the right to set of principles they have new policies new procedures as they begin to implement in the implementation begins but there's not the stay with it the closing the deal the sustainability that's necessary to go from a good idea to implementation to execution  consistency and i tend to think that's one of the fundamental fundamental problems that we've seen a los alamos over time said good starting principles but no follow through a lack of follow through there's a lack of follow through because of tur personnel or we lose interest in the principles that were disposed put forth i think it's the latter rather than the former certainly there is a turnover in personnel but i don't i don't think my sense is that that's not the heart of the problem for in your recently released port of los alamos in doing your work your team uncovered a number of much broader concerns than merely the concerns related to the october incident let me read from your report and i'm quoting now it says our review reviewed a serious breakdown in core laboratory security controls and your report reached the conclusion and it states in short your findings raise serious concerns about the laboratories ability to protect both classified and sensitive information systems i presume you still stand by that report and that conclusion yes yes we do there's been a lot of talk this morning about maybe we should just change the focus of this lab or for some of the missions be shifted to other labs like sandia it's a very very large complex your thoughts on that graduate degrees there eminent scientists last year lab personnel one i believe five are in the one hundred awards there are twenty eight e o lawrence award winners there it's extraordinary and vision and i question if i might that that before we do anything truly radical and i understand the motivation and where it's coming from that we make sure we balance so that we don't throw out the baby with the bathwater if i can if i can put it that way so i hope that we give the new contractor i mean after all this took place two months when we last spoke mr mistress to pack we agreed that the new contract was coming on board and they deserved an opportunity to turn the situation around this series of events occurred within two months or three months after they took over they identified a number preconditions preexisting conditions that concern them before they assumed responsibility cyber security was one of those preconditions i'm hopeful that we can give them a chance with increased federal intervention and oversight to do what they were hired to do which is to enhance dramatically the management of the laboratory including better security and better cyber security specifically so i understand at some point down the road a more more dramatic more radical departure may be warranted conceivably but at this point i hope we give them the benefit of the doubt at least for a period of time recognizing that the problem we face here is a very very serious national security problem sure but if it wasn't for los alamos county police department we would not even know about th incident how many other breaches are alter that we do not know about because there's been no mechanism in place to detect it or even if it was detected from your testimony no one at the lab seems to want to follow up on it well i said in my testimony that the one of the most frightening parts of this whole incident is that had it not been for an inadvertent set of circumstances totally unrelated to this issue we might not not have known about it today we might never have known about it and that is a frightening thought and we've identified a couple of a more intense activity logging at the laboratory and monitor shipping with new software that can be costly but may be necessary to make sure that other breaches other similar breaches are not occurring prevention is the key in my view my my time is up hopefully will go into a second round next let me turn to the ranking member mr i would feel from kentucky thank you very much mr chairman and thank the witnesses for their testimony this morning  all three of you have extensive experience in this area and then the consensus appears to be that los alamos is for lack of a better term the problem  child all of them and all of these weapons labs have had some problems but the los alamos problems seem to be more serious and certainly more frequent and i know the california does manage the lawrence livermore has a contract for that and for sixty some years had the contract that los alamos and now is a fifty percent  participant in the new consortium exactly that's correct isn't that that is roughly correct yes now just from your personal experience how would you explain if you were talking to the rotary hopkinsville kentucky of what your theory is as to why los alamos has so many breaches when you have for many years in the same management  contract responsibility at both los alamos and livermore i would like to ask each one of you to just give me your impressions as to why that is the case i don't mr wickfield have a good answer for that question i mean it is the it is an extremely important question and i frankly despite spending years at looking at all of the laboratories i don't have a good answer i wish i did i think it would get to the heart of the cure but what i would say is that los alamos is  slightly different i think livermore and i can be might be wrong about this is essentially located on one square mile of territory and that may not be quite right sandy is larger but i think none of them have the diversity and the geographic diversity nothing else than that and that may be a contributing factor to the problem i mean as we point out in the testimony and has been discussed earlier we found i believe twenty seven hundred classified computing environments  have long taken the position that closing reducing the footprint is the way to go and it may well be that the number of classified computing environments the number of classified materials that are there in sheer numbers may be  observations and continuing issues that have developed is the lack of accountability which is why i say in my opening testimony why the the committee here all talks about the preceding managers previously but they're taking action i've been through a number of previous secretaries through all of these incidences and come up with great plans but they don't get converted into action and so specifically to your question sir i would say that's account ability and holding people responsible for the jobs and they have out there and we have not seen that consistently at last almost fifty years and in some other six places but predominantly at los alamos can i saying that you and mr that correspondence ok ms bryan what about what i've been struggling with this question for a while myself i think it's a combination as i mentioned in in the joke that goes around that there is some a different attitude at los alamos and i think because of that different attitude they're more difficult at the federal level to manage and i think the bottom line is when you get the push back from los alamos and the federal structure is not there really with the willingness to stick with them and demand change i think that's where there's really the break up that i think we could in fact be on this planet if you let me ask a question two thousand and four los angeles is closed down for six months because of security breaches what was the dollar amount of the penalty that the period you found a lot of serious problems at the site is that correct that's correct mr chairman mr friedman in fact didn't your investigation the recent incident reveal that a number of key areas that security plans and policies were either safeguards were not functioning as intended the various places across the l a n l yes or no mr mr friedman is that also correct that monitoring by both the laboratory and federal officials was also found to be inadequate or in other cases non existent it was mr it is not correct also mr friedman that even those those that work insurance engineering officials and others within the labs chief of information office express concerns about open ports and problems with managing temporary indicating devices these concerns were largely ignored by l a n l officials yes and can i live right on my answer on that one chairman now mr brodsky i believe your testimony also says that the los angeles rather the los alamos receive the lowest set of performance ratings for security and emergency management since one nine nine is that correct yes or no mr friedman to mr because he both of you know that i've been working at this security problem for more than a little while mr pedantic you gave los gatos almost received some of the lowest scores since one nine hundred ninety nine on security issues mr friedman your report found that the core breakdown at low sell almost ability to protect classified information that's correct is it not gentleman would you like tell us what is going on here and we're going to ask the secretary why we need to keep on having these hearings what comments do you have gentlem well i think your series of questions mr chairman from my perspective basically outlined that you know it as you say we are on the in the ground a relatively short period of time although we spend we have a resident staff at los alamos he spent a lot of time there but it  only thing i would like to again point out to the committee has that when our inspection team was at the site we again did determine that the nuclear material was protected and that's not insignificant that is something mr chairman as you call that the eighty's we paid a lot of attention to that doesn't make it a good story because they classify them and matter is something of grave concern to all of us and as my colleague mr friedman has talked about we do believe that los alamos has a mission to form to perform for the for the country but the security performance that they've demonstrated an inspection after inspection continues to leave us concerned and baffled now i'd  recent incident a sub contractor employee freely took over two hundred pages of hard copy classified documents over four hundred classified documents on flash drives for a home which she shared with a drug dealer this could only have happened if there was a complete collapse of mult supervisor in security systems it was only by happenstance that she was caught not because effective security system in place we never know we never would have known about the security breach it had been for domestic disturbance then she goes on to say this furthermore we have no way of knowing how many other instances like this are out there or a flown below the radar it's important to remember that n s a attempts to keep this incident secret from congress and the public until pogo learned about about the leg about it eight days after a local police raid then here as a side note i reports in statements by investigators are accurate this is the most recent this most recent case points to extraordinary faders in personnel security clearance process in addition to  while that is what i i think the problem here is a combination of extraordinary breakdowns maybe systems aren't even there it's a case of broken system but i'm also equally concerned that at the time this is becoming known at los alamos there was a real effort to make sure that people in the congress didn't know about it they were hoping the make this go away thank you there's progress give us food which we did not investigate the actual circumstances as i said  testimony mr freeh and mr friedman did the investigation we were there doing a comprehensive safeguards security inspection which gave us an overall comprehensive review of the various topics but we did see clearly that the suffering from a lack of policies procedures adequate management adequate oversight both both the contractor and federal and all of that would contribute we believe to the incident that the inspector general investigated mr chairman you made a point in your earlier question that i wanted to comment on which i think would respond to this question as well you pointed out which is which was a good read of our report if i may say so that we found that in i think it was the march two thousand and six timeframe there was communication e mail communication within the laboratory about the concern about open ports so in other words the the institution itself identified it is a problem there was a fair amount of traffic e mail traffic on that issue and it gets to the point that i was trying to make earlier about closing the deal sustainability and the ultimate fix is that tragically even though it was discussed extensively and i think it was march two thousand and six and i don't have that instant recall i think that's the right date no one took it to the next step which is to make sure that the proper fix was implemented to address the address the concern now was not you know of universal concern there were people the laboratory who didn't think the open ports were serious problem but there were enough people who did that it would seem to me and i think this perhaps is revealing as it's of the sort the essence of the problem that they didn't address the problem then and resolv first of all i think the laboratory is an extraordinary institution and but secondly i think that in fairness and believe me i'm not here i probably write more critical reports about los alamos than anyone but i think and fairness i think the new contractor is really brand new was brand new when this occurred and they deserve an opportunity to try to fix the problem and if they can't fix the problem i'd be the first one to sit before you and tell you that a much more radical solution needs to be tried california who is the new contractor it is a i think it's a consortium it's a limited liability believe the hmong who's a new contractor at the university of california you might not know they've got a consortium and there may be some different players but the university of california has had this contract for sixty years they were the old contractor they're the new contractor is that not correct well  no no it's not no they're not they're not part of our they are the primary science player there's no question about that but the whole concept as i understand they have fifty percent of the contract that's true but the parson has been moved to the a new lab director is a university of california employee that is correct the bechdel individual who's the top person has already left is that correct that is correct yes now at least be honest with the committee well i've tried to be honest mr chairman there is this this semantics about old and new is an affront to least to me my gosh is it not true then under the new contract the performance part of it is a risk if there is a security lapse but let me give you the read of the contract as i understand  mr barton and obvious there are people who are at least on the third panel who will be able to explain who are the negotiators of the contract who can give you more detail and its full bloom i understand is about a seventy million dollars a year potential award fee thirty percent of which as i understand it is seventy three million two hundred eighty thousand dollars to be exact as i understand it thirty percent of it is is fixed and seventy percent is at risk that's the way i understand the formulation of the contract i believe there also as a provision and i'm not an expert on the contract there are people here who are i believe there are provisions that and extraordinary circumstances at least the entire at risk portion can be withheld from the contract is it not true that in your testimony you suggested that there be serious withholding of the incentives part of the contract yes sir i did you want to put a number on that how serious is serious the safeguarding security execution part of the mission success is three million dollars yes and i is that serious or do you think serious would be ten million dollars now i don't i don't think i don't  think i think i think it may be three point eight million mr chairman mr chairman but i don't think that's serious money mr stupak is the chairman i'm the ranking member mr ranking member then i apologize i know i do not know the exact number but yes i do know that they are short what's the number what would be the full complement if every is it like forty people at the site office one hundred people mr barton complement if they were fully manned at the sign office i don't know i do know that of the twenty vacancies a large percentage of them are in the security and safety areas does that indicate that the department is serious in the the new contractor is serious about this well that's actually the federal government understands it so my worry is that the u a e is unsafe or and in this day could we get there and get that information what the total staffing is what the what these vacancies are mr vance q do you do you think that we ought to fill those slots yes sir i i think that they need to be filled with you very much mr chairman supreme and i wanted to ask you some questions about what you had said in response to several of the other members questions the first thing is you said that we really need to give this new contractor i chanced and that we need to if we need to do something dramatic we should do it down the road so i'm i'm kind of wondering how long is that road because i've been sitting hundred ninety nine hearing these assurances i understand what you're saying about the quality of people that we have there and the high level work that's going on but but how how how much longer do do you think we need to be patient how much longer do we need to give these folks to to fix these problems well my view is from the start date it should be probably one year so you know this issue this year yes and and do you think that and my second question is how will we know if the new contractors have fixed the problem when we know that if the local law enforcement authorities bust some people or if the local newspapers have an expos how are we going to know if the problem's been fixed well i ironed it with twelve thousand people there you may never know for sure i understand that but i think the next six months time would be devoted by the department who is intensive examination of all aspects of the function of the lab to make sure that the problems have been addressed what do you think we haven't had that intensive x examination in the past and the many past times that we've worked on that i do not think we've had that intensive exam that's just appalling to me because we need to close down the lab after we  visited in two thousand and four and you don't think they did that intensive examination well i think they didn't sense of examination but as the point i've been trying to make is that once they did the extensive examination did they sustain an aggressive program to address the problems that we're going to find you've not smart that's the that's the concern that i'm expressing today do you have some specific recommendations as to what the department can do to to do this intensive an examination within the next would you mind supplementing your responses by delineating those specific things that the department can do certainly i think you misread what was your view about all of this that we should give some time for for the department  line i just think that the government has been doing its end of the job and what do you think the government can do i think we need to have well one of the things that i think really important is a lot of these these issues as i discussed in my written testimony are infuriating year we have known about these problems before we've had i g e and various iterations of mr because his office make recommendations and nothing has no one's required the people and say to actually implement these recommendations we've had secretaries in fact the issues that i think that mr walden is raising with the glue sticks those are the kinds of things that were supposed to have been dealt with back with secretary richardson right and they've been buying new computers for the last ten years with continuing to have the u s b ports because as i learned the people who were in charge of buying the computers at los alamos weren't really talking to the cyber security people to realize that they didn't want to h do you have a view on that do you do you think this problem can be fixed in six months without any and the substance of central changes no i think there are we do believe that there needs to be substantial changes and we do believe that the secretary and the deputy secretary moving towards that direction and not just promissary notes of the past we've seen actions taken that we have never seen in twenty five years of this department where people were actually held accountable we do need to have performance measures that the contractors held accountable against we also have an enforcement function within the office that we also need to employ so there are a lot of lot of tools for the department to exercise now and get on with fixing the laboratory together with fixing the n s a and the policy of the department do you think mr friedman that the physical size of los alamos is a problem yes i think it's a challenge and what can we do to deal with that challenge do you think well first of all we could make a concerted effort to consolidate functions reduce the number of balls reduce the number of computers a classified computing environments i don't know how practical that is i think it's something that we need to look at very carefully thank you secondly i think we need to  close the footprint so that the security perimeter is reduced so physical security will be will be somewhat easier mr chairman i think a good time for a follow up hearing might i mean we should have some interim ones but we also need to have one in has been reviewed has been by an employee who's received a security clearance is that correct my recollection is that the predominantly cleared individuals have been violating the only requirement was that the case in this most recent  event in october i believe so ok and the individual who claimed assault at the bar couple of years ago was that also an individual had been cleared i believe that is the case is there a problem with how we're granting clearances to in an essay is granting security clearances the personnel security process is one of the task force that the dept that the secretary initiated at the beginning of this b right now is something that we need to get on with and that's what we're doing and we're going to be making recommendations to the secretary in the dept the secretary at the end of or is what to do with a personal security program within the department of energy and will that include any type of program that  to clear to individuals in an in an ongoing fashion when i was there in july of zero five was right after the credit card abuses came to light moves appeared as i recall that those were cleared individuals who had then subsequently developed these are domestic problems or substance abuse problems that that led them to misuse the credit cards and i could just imagine that other things may have happened also as a result so will be an ongoing evaluation the recommendations that i believe are coming out of the task force will be covering both from the beginning of hiring all the way through current employees so that we have an ongoing review of people holding clear mr friedman inspector even do you think in retrospect reference the r f p process that the lab just went through chairman barton also referenced the contractor do you think that was an open and fair process would that be in the purview of the inspector general's office to know that or is that outside is that outside your capabilities no it's not outside our capabilities if it and by the way if there had been concerns by the proposers that we not considered would not be unusual for us to get complaints about that and to the best of my recollection and i could be wrong about this i don't think we received any complaints along those lines and yet some of the some of the traffic from the from the bloggers on line and i realize that that carries its own inherent dangers but there is some question as to whether or not the current contractor it was in fact the best one and is the best one going so far against the current contractor do we have of a dollar figure on that are you referring that question to me yes or i do not have a number on that now is there is there a way to because for anyone is there a way to get that dollar figure on the  fines levied against a contractor respectably the third panel i think includes people who would have that information does the contractor recognise the amount of dollars that they're putting at risk  i suspect they know the contract intimately ok mr friedman just to finish up your statement said the criminal investigation into the matter last fall is ongoing and may yet reveal additional security problems in an open session can you expand on that statement well simply the f b i is conducting a has been conducting a criminal investigation from the get go and the purpose of that statement in our tent my testimony and i think i think it's in our report as well if i'm not mistaken is that until their investigation is complete we don't know what will turn up there may be more what what would be a reasonable timeframe for this committee to expect that that investigation will will take that's in the purview within the purview of the f b i sir and i have no idea what mr chairman we'd be privy to that report when they are the department of justice completes that good question we'll double check on it i when you look at and i understand this problem with drug use is apparently with this one particular breach but apparently there's some additional problems out there within the do does the staff or the security people  require or do the random drug sampling the urine test at all on the employees is it your hi i'm in open session part of your question i think i can address the part of that i would prefer not to address my understanding is and again there are people in the third connell who can address the issue of the current policy my understanding is that they have that's that's that's transpired with the the issue of security breaches and you've replaced the chain of command the latest chain of command replacement took place when how long ago june first and june contractor and the security on site security they ultimately were responsible for the on site security who who did they show up contract out for the security i don't think universe california is a security company well  they are at some locations interesting leigh enough and i forget the name of the contractor to be honest with you the sub contractor i should say the diversity of the science in this is for someone new to me that's out there on the regimens that you've had that you have a different scientist is there some way and i think maybe you spoke to it earlier is there some way to to isolate these and provide better security on each sector  rather than just say this and i have been the facility twelve thousand people just coming and going wherever they want to go well there are a number of secure areas at the facility and it's worthwhile going to see it it's  quite impressive so i wouldn't say there's one thousand people running back running back and forth that will it's much more systematic and controlled than that i'm not sure there's a practical way of doing it by discipline but i haven't thought that through so i don't know the i don't know a good give you can't if you could answer i'd like to go and see it the only view i've had of it was from cross the valley at a friend's house at night with the lights getting in there and looking at it i guess close and would do me a lot of good to to june why did it take so long from the seven month shutdown that's another year year and a half before we got the new contract in and now we're waiting a year to see if we're going to get what's what's the problems with moving the same quicker and i know the numbers are big but i'm not sure i can give you the precise timeline but in general sense this  is this is this is a the re company we competition of this contract was a very turbulent issue it was a very costly issue was very labor intensive issue and it was a time time issue as well it takes a long time to prepare t to address hopefully the issues that have been resident at los alamos for sixty four years and to go to the street give people time to propose to evaluate the proposals and some move forward so i don't know if that printers being brought in things like that about what extent things were copied to distributed sold or who these documents also went to if you're directing that to me i would give you the same answer the f b i really ultimately will have to address that same with mr fenton ms bryant simoneau yet i would say the same thing is mr friedman we don't have the answers to that i can speak to this press reports from her attorney which were that she was taking the work to get extra work done that she was behind has anybody to determine if there's been any of these convents sort of appeared anywhere else besides just saying guess what i'm getting to here  with regard to this information that even though we're waiting for the details from the f b i have we learned anything from this yet that can be used to take other steps other than just blocking some of the ways you can put i drive or something but what do we learn that affects security of how will affect hardware and software inspections how people come on and off the site their security clearances have we learned things from this unique to  this that that has affected our what we're doing overall and what's been implemented or we still going to wait the f b i reports on this i would start first of all congressman with the with the task force that we're heading up on the personal security piece we  believe there's going to be a lot of serious lessons learned that come out of these specifics to the case as well as the broader issue on personal security that one of the members of the committee asked earlier we believe that in terms of  cybersecurity as well there are also lessons learned that we know that the cia goes for both and n s a as well as the department are looking at and we also know that the the third panel well has in fact on a damage assessment that they could session and i will look forward to that point i was just wondering here while we are still in public hearing what we can assure the american public with regard to some lessons learned because it concerns me that this sub committee has looked at these issues for a long time your inspections which appear to be give us pretty solid frightening information on the levels of breach of security that we're still awaiting another another review before we determine what else we need to do when so much has been out there for a while and so it is just something i just have to continue to raise the question of what more do we need to know before we really put the heel down in this congressman if i could answer one question i'm hoping by the end of this hearing that one thing that could change a pilot program at los alamos which is essentially self policing for safety in cyber security i i'm generally not a big fan of self policing as a rule and i think that ability like los alamos hasn't earned the trust of th congress or the public to be essentially left up to themselves to report when they have problems and i think that's something that should be changed immediately anybody else on that issue is for him to have something and i did want to point out to you mr murphy our report i think we have fourteen recommendations for corrective actions they're not all encompassing all inclusive but we think it's a good first start the secretary as i indicated in my testimony has the task force looking at those and we'll be interested to see what their report says in february in terms of how to convert those ideas into into reality at the laboratory in both the federal level and the contractor level mr polanski as the independent overseer for the for the secretary and the deputy secretary i would just tell you that i have a prejudicial answer and that is we don't think that self assessment by itself is good in the contractor should have federal oversight that's why we have contractors and the feds managing them we should be managing them so while the n s a has this pilot proposed we don't we don't think it's it's ready for time prime as exemplified by their performance today and i would add that i with waiting for further investigations will review in these fourteen recommendations it seems to me a lot of time is ticking by and i'm just frightened and i shudder to think what is out there what else could be happening while all these breaches of occurred and continue to occur so we'll hopefully speed up this whole process thank think the gentleman mr green from texas questions thank you mr chairman mr bernanke's he you state your testimony to twenty five thousand classified workstations and servers are not satisfied or credited  does that actually mean are they unprotected workstations no sir i should i should clarify that the certification accreditation process make sure that security features are in place and operating as designed when you it when they didn't do the accreditation of the twenty five thousand and classified work stations they did do a network accreditation of our cyber experts tell me that that's not sufficient because you don't know if you have individual vulnerabilities on  those twenty five thousand computer workstations so that's something that we believe should be done and should be included in their city and their certification credit ation process you know it seems like and again you've heard it from every member up here for the last at least eight years i guess what we've we've identified problems time and time again in a dignified solutions but for some reason there's no follow through on closing a deal like i know it's a great task to do just deal with that twenty five thousand workstations and servers but you know why wasn't that done before this particular person walked out with this and you know it seems like that would have come up in the last eight years before  at least before this committee and is there a problem or can we is there a problem nobody knows how to implement the solutions to what sir we've identified that the lab has inadequate cyber plans policies and procedures incomplete risk management process e week self assessment so there's a there's a whole litany of things that the that the laboratory could do to fix this ok i magine this is not news to anyone sitting on this panel for the last eight years like i said i just came back after six years off of it why can't it be fixed why can't we have this since it's a new contract i assume and it went out for beds there's new contract or was security conscious and is it just not a it's just not an issue that makes it to the to the floor of the of the actual los alamos serve here addressing that to me i would answer it can be six and i believe under the current leadership of the department it will be thinks as i said for my third time now having listened to all the plans before this answer your question specifically is that they contractor in years past have not been held accountable to do what the department has expected them to do do you have a comment on well a number of the failures that we identified in our report mr green are low hanging fruit plug the holes where they should be the ports where they should be plugged essentially segregate duties where they need to be segregated and ensure that there's adequate monitoring i mean these are not high tech costly time consuming difficult things to do and they should be done instance should have been done instantaneously and if the lab has not taken steps to do those at this point i would be very just discouraged very disappointed well as chairman seems like it again my memory on this summer over the years we've had this is really a college campus security it's mostly research and what they're doing and they're more interested in that and it seems like since the last time on the committee we haven't seen any changes even though it went out for bid and and i hope the next panels even a closed session will show us what can be done from to make sure that this oversight investigation committee doesn't continue to be dealing with what's happening also alamos for testimony today we've heard that system breaks down there's broken systems it's inadequate in july of two thousand and four the lab was shut down you're doing this extensive review everything is supposed to be fixed after that cost the taxpayers three hundred fifty million dollars so what happened the three hundred fifty million dollars in the six month shutdown didn't accomplish anything the systems weren't updated the polls weren't plugged what happened what did we get for three hundred fifty million dollars besides a shut down lab for six months you directed to me sure mr friedman look mr chairman if i gave anybody the impression by my earlier testifying testimony that i think that what the situation fine now is ok and it will get better automatically i i left the wrong impression and i apologize for that extremely discouraged and disappointed that after the litany of reports and the series of  unsettling events that have taken place that the simple fixes that are obviously readily available have not been in place regardless of whether this new contractor or not so if you're asking what we've got for our money  it seems to me if this is the result we did not get a lot for our money you know as i stated earlier mr friedman in your report you said if you're a serious breakdown in the core laboratory security controls core they're very basic fundamental security is broken down if we could fix after shutting it down for six months and three hundred fifty million dollars how do we fix that no other than we have a new person coming on board well i think i tried to lay out as i say we have fourteen recommendations in our report i try to lay out some bigger picture items that we talked about one is a question of accountability real accountability significant material impact on award fee reassignments terminations perhaps a change of the the mix of the mission of the lab is a possibility so i think there need to be some really fundamental changes to shake up the top scientists do similar tests the most sense that work there no doubt about that and i asked the question last hearing and never really got an answer maybe you can answer it no answers sometimes reflecting upon it what do we do at los alamos that cannot be duplicated or done at the other lives is there anything so unique that can only be done at los alamos and not at the other labs well let me try to answer this way you did ask that question and let the hearing that i participate and no one else come up with a unique and i mission me once you get past the facilities the physical plant sure there are unique aspects of the physical plant that would cost tens hundreds of millions of perhaps billions to replicate once you get past the core of the extraordinary intellectual invigoration that exists there the people with the unique talents it seems to me the things that the fundamental issues that go on there could be done someplace else here i think the answer to your to assess penalties or fees which we had discussed a number of times today and does the national nuclear security administration have the primary responsibility of inforcing the contract for enforcing the contract is here and and could you just briefly explain the process that would be entailed and assessing a penalty under the contract not under the contract i would have to differ as requested you defer that to the third panel ok so you're not involved in that i'm not in that involved in that type of enforcement ok for next panel if we may would consist of the autoclave cell deputy secretary department of energy mr selig and i have to ask you that since we take all testimony under oath and did you bring that legal counsel with you if i would just note mr chairman the presence of our deputy general counsel from the department of energy very good case here i'd ask you please chairman stupa act congressman whitfield members of the subcommittee i welcome this opportunity to appear before you today to discuss security within the department of energy and the recent security incident at los alamos national lab the national security responsibilities intrusted to los alamos are our nation's most important the successes that have sprung forth from this great lab in years past and today are properly a source of great pride and great power in our country the capabilities of the men and women of los alamos continue today to make this lab the only place to go for many national security requirements and of course the secrets  entrusted to this lab are among the nation's most sensitive these are among the reasons that the facts of the most recent security incident at los alamos are so troubling and the source of such tremendous frustration and concern to the secretary to me and to many others throughout the dio enterprise and now despite years of focused attention and the expenditure of millions of dollars we are confronted again with a security failure the facts of which suggest we still have a much larger and a much deeper problem as has been alluded to many well intentioned leaders have work to improve security at los alamos over the last few years and in many key areas the department has made substantial progress but secretary  are less interested in effort process and good intentions and more interested in results and the results the results on matters of security at los alamos national laboratory remain unacceptable you have already heard from earlier witnesses and in fact you each have made statements about what have led to the problems and what happened in this recent matter later today you will hear from the acting administrator of the n s a our departments chief information officer and the director of the los alamos national lab in more detail therefore i intend to focus the balance of my remarks on what the secretary and i are doing to fix the problems and move forward first in the immediate aftermath of learning about the security breach at los alamos we acted immediately to assess the situation and understand the facts a administrator dispatched the chief of defense nuclear security and the cyber security team to the site to begin an immediate review of the incident on october twenty sixth the secretary ordered the inspector general to investigate and on october thirtieth i personally traveled to the lab to meet directly with those on the ground and to gain firsthand knowledge of the incident and remedial actions to address the problems second we took quick action to address realized vulnerabilities on november eighth issued a memorandum to improve cyber security protection for classified computer systems throughout the dealy complex that memo included immediate direction to every lab and every field every facility operating a classified system to conduct an examination of the adequacy of its practices and procedures to ensure that classified information is protected using multiple layers of cyber security protection including protection against potential insider threats also the memo required an accounting by each lab and facility throughout our complex for full implementation by january fifteenth of this year today i informed that the entire complex is in compliance the line managers will be responsible for ensuring continued herit to this policy third in response to findings contained within the inspector general's report issued on november twenty seventh the secretary directed two specific actions first the creation of a senior level ad hoc committee to review all of the recommendations in the i g s report except those concerning the department's security clearance process second the establishment of a task force to review the personal security programs throughout the entire dealy complex both reviews will complete will conclude and provide recommendations to the secretary no later than february twenty eighth of this year once we have reviewed the results of the laboratories actions corporate and federal validation activities the secretaries to task force recommendations and other actions that have been directed we will follow up we will follow up and develop additional improvements and additional reviews as necessary we will be pleased to the scuffs with the subcommittee the additional actions the secretary decides to take once once he's received in review the task force recommendations for there are numerous occasions meetings and conversations with the n s a with the n s a administrator and his team with the los alamos director and with members of the executive board of the new contractor at los alamos the secretary and i have expressed our depth of concern our sense of urgency and clear expectations for accountability from the top of the department to the bottom of the lab tory and that these continuing security problems must be addressed rectified prevented and prevented in the future if if even before the recent incident los alamos the department had substantially increased focus and attention on matters of cyber security including hiring of a new chief information officer in of ember of two thousand and five to reinvigorate and strengthen our efforts among other things he accelerated the effort to update our cyber security order and national city security systems control manual and has taken numerous actions to improve our department cyber security posture we also brought in a new chief of counterintelligence and reorganize the office to improve its performance six the department also previously recognized and i would add with strong urging from the congress that the leadership the laboratory could be strengthened by competing to him in a contract and last june and nor a new corporate leadership team took over management of the laboratory for the first time in its sixty four year history seventh and finally because it is our view that we are that we the department the secretary and are accountable to the president the congress and the american people not just for efforts but for results the secretary now made the extremely difficult decision to replace the administrator of the n s a and bring in new leadership now only time will tell if we are to be successful if we are to distinguish ourselves from our predecessors but the secretary and i are committed to making the tough decisions required to lead our department to a level of security performance the fitting the great missions the countries assist to carry out we have made progress in improving the security across the department and that los alamos that has the latest incident indicates we have much more work to do we remain committed to the task i'm happy to answer your questions at this bodmin with the upcoming presidential election will only be there two years those problems that we see the problems the constant problems we see won't be resolved in two years whether the effort to resolve these problems in my judgment will take continuous effort over the course the next few years and continuous effort in the years thereafter threats of all technologies evolve or a constant vigilance but want to be easy for folks to los alamos say well ok there's that directive we've seen that one for two years knows that people coming in we can just sit back now mr chairman that is certainly a limitation of the manner in which the executive branch of our government operates i will be gone in two years as will the senior leadership of this department as will the president so we we are taking great effort to institutionalize the changes that we are making and i'll give you an example after previous sentence in one thousand nine hundred ninety then secretary richardson issued a substantial press release announcing a number of changes to correct the then perceived security problems at the lab that secure those announcements that were made were never put into the directives which actually govern the relationship between the department and its contractors and we've just seen a three hundred fifty million dollar edu and letter sure let's talk about the directives though you personally travel los alamos you did a memo on november eighth directing each laboratory and dealey facility operate a classified computer didn't know anything about unclassified classified computer system to conduct an immediate and thorough examination to ensure the classified information is protected using multiple layers of cyber security but it isn't also true that in this memel you set forth minimum standards that must be met by january fifteenth two thousand and seven  that is correct or those minimum standards accomplished by january fifteenth not in all cases not in all cases your member also says steps are to be taken i'm looking at your memo i'm sure you have one there in front you steps to be taken are to include add a minimum those in the attached guidance prepared by deely chief information officer this so these are the minimum things that anyone at los alamos come back to you and say  secretary you asked for the minimum we went over and above we went beyond a minimum that they do anything beyond a minimum any recommendations to go beyond the minimum yes mr chairman the lab is doing a number of things  addressed in the memo the memo that i put out was based on the immediate recognition that we had a real problem specifically with ports we understand that i wanted to take the lesson that we had learned under very unfortunate fortunate circumstance at los alamos but you said part of the of it was a clyde buy or complied with your request by january fifteenth other parts were not correct well to clarify completely los alamos was the last of our lab some facilities to come into compliance and that occurred on january twenty second but that is a report that i have right well let me ask you this question then here chief information officer of and a and essay in staff interviews that she sent a team out on january eighth to see whether los alamos was complying with your directive they found widespread noncompliance with your directive isn't that correct i know as of january of the lab was not in compliance ok does it also true that even in the face of all the publicity of the most recent security lapse that and this had to pull the entire team back from the lab because they either could not understand your directives or simply were incapable of responding to your directives of securing the very areas and items that were under question as a result of the october sixth event why did and if they have to pull back it seems mr chairman we are trying to deal in a very serious way and we have given out i gave out in this case very clear guidance as to what was to be accomplished now i could have just given clear guidance and gone on and done something else but we followed up on that clear guidance by sending the team out and they had t even we've we sent the team out even before the deadline for compliance and we found out when the team was out there that we weren't making progress we're not making progress we were not making progress on a sufficient at a sufficient pace to accomplish what needed to be accomplished by january fifteenth that came to our attention we gave further direction we clarified i talked to the lab director they understood what their requirements were we sent a team back out shortly after january fifteenth and concluded approx january twenty second that they have complied with the directive i think it's indicative that unfortunately insuring compliance  making progress requires continued effort it requires vigilance it requires follow up and it will require that long after i'm gone i only have control of the two years and i'm sure president will in that i remain in my position and that's the way i intend to deal and i hope we can also institutionalize the progress that we are making and there are a number of means within our disposal to help do that through the contract through the outstanding career staff that we have in our department through a number of the individuals and leaders of the laboratory that will remain into the next administration but it is it is difficult there are reasons sufficient progress has not been made in previous years and the only thing i can commit to you is that i am trying to deal in a way which is distinct and different indistinguishable from the ways that folks have built in the past i believe the secretary and i have taken more aggressive action and because i believe we are acting differently at least i have some reasonable expectation that this time we will get different results but only time will tell time has expired mr whitfield for five minutes thank you mr chairman then secretary selwyn enjoyed your testimony today and appreciate your being here it seems to me the years that i've been on this subcommittee and this issue of security breaches has been a subject contract the length of the contract i believe mr wickfield is a seven year and mischel period but could be extended to twenty years ok and i may be off one or two years but and what is the half to two billion dollars a year flow through the contractor one and one half to to want to have to believe the fee available to the contractor is on rough water seventy million dollars a year so that's the potential not to the contractor so accurate or inaccurate to describe this seventy million dollars as an incentive pay that they can receive in addition to the base and i believe the seventy now you would think that since the real problem is safety and security i mean that's one of the major problems that the incentives apportion to that would be greater than three million dollars out of a total of would find to be a great explanation although the next panel and i don't mean to just kick this to me i do think he is more informed on that but i would a loss of state my belief that we have greater authority to restrict and pull back awards for failures beyond just the three to six million figure security are you are you aware yourself of the amount of penalty in the two zero with two thousand and four six months shut down or are not i am aware that it was generally in the in the neighborhood of around three million dollars recent contract that the consortium agreed that the twenty one key personnel committed that they committed to stay for a minimum of two years and after six months the deputy director has already left is that mr sale i was just wondering if los alamos for your children because of this premature gray hair both the some of the thoughts that run through my is the deal eighteen is it on site or was it just sent and came back and made a report and how long were they on site when they were there we have a federal site individuals from headquarters from other locations around the complex site experts that have come for the various reviews and evaluations and recommendations since this most recent incident in october well i think it may well help but i want to emphasize that we have a team there that work for me i mean they work for the secretary and the administrators and on down the chain and their responsibility is to ensure that the contractor is put performing to the terms of their contract and in addition to that we have other oversight groups from headquarters and we have other other oversight groups from the contractor that they have hired and they will continue to go i mean it's going to take continuous vigilance and monetary and perhaps other groups consistent with your suggestion would be helpful as well in ensuring that we make institutionalized progress at the lab that the people that are on the deal team are the people that are responsible from deal he to to monitor acting administrator then subsequently made a change in the person that is heading the office at los alamos and so we are trying to find the right kind of leadership that can ensure much higher levels of performance at the lab i've got a general in louisiana i can suggest because it sounds less can you take more just a manager out there in that guess that's the concern that i have is it appears to me and this is new to me that we've rolled ahead or two but the problem is the tail is wagging the dog and i just didn't have any comments how deep is our problem or is our problem is a problem at the upper levels our security at the lower level well it has been suggested mr laurenson that we shoot the dog and i have to reject that suggestion in the strongest possible terms we do have twelve thousand individuals at los alamos that were there under the university of california they are there under lance and will continue to be there they are the core capability that laboratory and i do believe that we have deep seated issues that are going to take time and i would suggest with all due respect to our inspector general it will take longer than a year it is going to take time to change but we do have an outstanding new leadership team in place and i believe the lance team is the right team to lead the administrator an acting administrator in tom dagestani know we're putting in place new policies that will actually be incorporated into the terms of the contract by which we can hold the contractor accountable and we intend to use the authorities in that contract to the greatest extent possible to ensure compliance and institutionalization of progress that is our approach going forward and if the tail continues to wag the dog then the committee may properly question whether i am the right one to continue to provide leadership but i've laid out our path as to how we are proceeding and i am we have made in the last few months substantial progress i mean just for example we had there were thousands of open ports on classified computers  the day this thing came to light i have some level of confidence not supreme confidence but some level of confidence that that situation has been rectified and will stay rectified at los alamos we are changing our process but it will take so we will continue to make progress but the nature of security particularly at a place as dynamic as los alamos is constantly evolving and i don't think there is ever a point where we will reach where we say we are where we can say we are done and we need not worry about security anymore we will have to be constantly tending the kennel door to make sure we've got the secretary good good to see you again you mentioned in your testimony to give a response to a question that you were not the select door in the process of going to the r f e last year and i've asked this question of other witnesses but in your opinion the process was fair and open and aboveboard yes let me ask you this the ad was almost what measures are are being taken to ensure that laptops and removable media are being encrypted or sequestered so the sensitive data is not leaving your your site unprotected dishonest and this is a different set of vulnerabilities as in christian of data that is that is then you mean when it's communicated across open lines is or when it's is it to reduce it in laptops encryption of classified material on on laptops when they are out of a secure facility is a matter that is that is covered under our policies and those  policies are those directives the manual which governs that is being updated and will be finalized in the course of the next few weeks that governs the other panel that the concept of at will employment be be curtailed but that really is not something that's within the purview of the department of energy is if that's up to the individual contractor involved that is something i believe that we we largely leave to the contractor as as to the negotiation of employment terms with their employees when the contract was awarded to lands a year ago was done so in the belief that it could substantially improve security at los alamos do we still believe that i do and we believe we have in place the metrics by which we're going to be able to show not just this committee but america at large that that is that is indeed the case we have some metrics and we're developing additional metrics and we will  develop even further ways of measuring progress once we have the full recommendations from our two groups that are that are reviewing the i g f report and once we put in place all the policies going forward but certainly our ability to measure progress and understand when there are failures or when there are potential failures before they actually happen or  before they get outside the gates of the laboratory is a is a very important management tool that we must have and i will ensure that we will have it so in your opinion that's what real progress will looks like hopefully doesn't look like the absence of breaches and we will be back here every six months for covering one of these incidents it is a much higher level of performance generate they generate many secrets that is the nature of their business that is the tools of their trade and we talk about one hundred thirty nine volt type rooms and three thousand classified computers that is the nature of the work that we do and in order to print something or to move it around the lab or to store it it requires lots of computer capability it requires ports it requires it is a very complex manner dealing with our business and you didn't reduce the number of computers without compromising your business i don't know that we can that is such certainly something that we are looking at and i think it is a sound suggestion it is a suggestion that has been made internally but i have not received a recommendation that we can in fact do that if we can we will but our business at nationals at that it may not be as simple as taking one hundred thirty nine volt top rooms and going to one hundred that may mean that a third of the work that we like to do can't get done thanks sharon all your ba at los alamos and the findings of the inspector general report indicate there may be significant deficiencies involving the application of personal security policies and standards within the department what were those significant deficiencies mr chairman i i can't i don't know that i can get into the details of the deficiencies without treading into areas which are governed by the privacy act in the instant case but are you stay for the exec's of session then we can ask you the questions and i will accommodate the committee and you mr chairman however you would like ok because i had a couple of of computers this is a similar question relating to the separate security areas over seventeen hundred of them and i was just wondering have you yourself formed any of kenyans about how to believe that such a large number of geographically dispersed and classified areas increases the vulnerability of operations and do you think the area should be reduced and your views on that just wh field i believe that there may be benefits from the and certainly instinctively i would think that we could perhaps do that i know that there is there are views inside our department that we can do that we are looking at it and i know in your letter of last night you suggested also that we look at it and we will do that we are we were looking for suggestions and good ideas from many corners from which they come i just do not i have not made a conclusion that that is going to be possible but it may well andy thank you mr secretary and yes sir you want to clarify so well mr chairman i wanted to take an opportunity to answer a question which you posed to other witnesses but sure you did not pose to me what is unique about los alamos know that you need mission that they do their what's the unique mission that would not be duplicated at any of our labs los alamos national lab and the men and women of that lab invented and designed and are responsible for certifying to this day two thirds of our strategic nuclear weapons stockpile they are the only place in the country today where we can build a plutonium pit which is the trigger in layman's terms for a nuclear weapon they have many many other unique capabilities beyond that but it is my view that we have to have los alamos and we have to be successful but more importantly that we can be successful we are not destined to failure we can be successful but it is no doubt men and women at los alamos are unique the way they work in san diego los alamos lawrence livermore they're all unique they're all talented people and we have no problem with that but we're not going to continue to have lapse after last they owe it to the american people not this committee american people to guard you tell us about the most sensitive things are going on not only for nuclear but anti terrorism or thing else we can't have it going on at same time going out the back door that's what we want to impress three hundred fifty million dollars taxpayers spent the finalists three million less than one percent no wonder why there's no accountability they'll just ignore it and continue we just want things done and done properly the american people deserve it see merican people pay for those weapons american people that have developed this and we appreciate everyone who works at those labs but it's not going to continue like it has been with forward talking a little bit more in executive session thank you sir we have our third panel our final panel consist of five people mr thomas the i guess venal acting administrator national nuclear security administration miss linda will for defense nuclear security and mr thomas pike jr chief information officer he apartment  it's a policy of this subcommittee to take all testimony under oath please advise that the witnesses have a right under the rules of the house to be advised by counsel during testimony do any of the witness this desire to be advised by counsel at this time if so would you please or induce your counsel oh and i'm the acting in ministre tour of the national nuclear security administration in the u s department of energy and position i've held since january twentieth two thousand and seven and also the deputy administrator for defense programs i want to personally assure you with respect to the current issue of security at los alamos national laboratory that we are committed to providing the most effective security possible for nuclear weapons nuclear material and classified information both at the laboratory a and at each of our n s a facilities the primary reason i am acting administrator is because of the secretary of energy is dissatisfaction with continuing series of security incidents when the secretary does not see results he expects he take and to be accountable for our performance and make decisions when they need to be made that's exactly what i'm doing i've made it clear to los alamos national security or lands the contractor who manages the laboratory that we're expecting them to take appropriate action against any plans employees determined to be accountable for most recent security incidents lances reported that formal disciplinary action will be taken against twenty four employees i've decided to spend my first two days on the job as acting administrator in new mexico both visiting the laboratory itself and the federal side office responsible for overseeing the laboratory to get firsthand up front and personal information that i can use i did that last monday and tuesday i stress to them my expectations concerning oversight of the laboratory activities and the importance of accountability and meeting our commitments i've directed to dan glenn one of the department's most experience side office managers from the  texas to serve as the acting federal side office manager until a permanent replacement is found mr glenn has extensive nuclear safety and security experience at our most sensitive site in fact than texas the only n s a facility where we have complete nuclear weapons on site dan has my complete confidence dan spent last thursday and friday at los alamos assessing current activities and operations at the los alamos site office and he's assembling a team to aggressively oversee laboratory security and safety programs and to mecca recommend not only immediate but near term fixes fixes that we can implement and take on right away dan will take over los alamos site office on february the with respect to work specific interactions with plants management operating contractor on this latest security incident all contractual options for both penalties and motivation are under consideration and on the table i want to assure you that this is not an academic exercise with a nominal fee at stake the maximum available annual fee with security and safety as key factors is over seventy million dollars the majority of lanza's fee is at risk as is their ability to earn additional award terms for years added on to the contract the combination of award fee an award term are very powerful incentive some performance and i intend to fully utilize these tools that are available to me in managing this contractor the department is also conducting the review of the incident to determine whether notice a violation will be issued as was discussed earlier finalize a contractor the contract has a clause called conditional payment a fi profit incentives this cla allows for the complete elimination of fee in the event of serious safety or security events that result in a loss of life and irrecoverable harm for the screw to night united states on january third two thousand and seven to further direct action and unilaterally notified the lands board of governors executive committee that i was calling session in washington that following week on january tenth i met with the executive committee and told them of my specific concerns on how they've handled the current security incident  alamos set my expectations for performance secretary and the deputy secretary joined me to emphasize seriousness of the situation the executive committee will provide me with their plans on how they will address the current situation and improve the culture of the laboratory in the coming months i'll be routinely meeting with members of the executive committee to hear how they're progressing with their plans additionally i've asked the chairman of the committee mr gerald parsky to call the secretary on a regular basis probably monthly maybe more like on a five week basis to update him personally on the actions that the board is taking to reach back to corporate parents and to support improvements at the laboratory in closing mr chairman i commit to you that if the current laboratory management team is unable or unwilling to change the security culture at los alamos i will use every tool available to me consistent with the terms of the contract to effect the kind of positive changes i expect and we deem necessary for taxpayers thank you and i'd be pleased to take any questions the committee may have mr desmond your opening statement will banks open each then chairman stupak ranking member whitfield are members of the committee that afternoon i am dr linda wilbanks the national nuclear security administration chief information officer thank you for the opportunity to discuss the cyber security incident at los alamos national laboratories and the actions n s a has taken to prevent similar action incidents as c e o i am responsible to the administrator for cyber security specifically policies and procedures to ensure the security of the information and technology as it relates to the n s a mission and to enhance our ability to protect the classified sensitive and i'm classified information system i came to n s a after almost three years six goddard space flight center at the cia i have over thirty years experience in information technology a bachelor's degree in mathematics a master's degree in engineering and a doctorate in computer science when the recent incident was reported at my direction the n s a cyber security program manager and the director of the disclose work station task force immediately flew to los alamos with two members of the g o p cyber security team their objective was to learn as much as possible about the incident from the cyber security perspective and determine if any of the contributing factors could put leno at a further risk or they could take place at other n s a sites i also travel to los alamos met with a cyber security personnel responsible for the los alamos computer systems to further understand the issues we quickly identified two issues the accessible u s b ports and a cyber security plan that said not address the specific risks of the system and was incomplete which contributed to the system's vulnerabilities the los alamos incident occurred when a trusted insider maliciously decided to use a personal device to electronically remove classified material the cyber security plan allowed for the cages to be unlocked with exposed u s b ports because the servers were in a secure room with limited access by people with clearances to access the classified material as a result of this incident we have taken a number of actions to strengthen the cyber security at los alamos and all n s a sites addressing the cybersecurity root crawl root causes that allowed this incident to occurred as a result of the incident i immediately required that all n s a sites identify the open ports and classified systems and determine if they needed to be open or could be permanently disabled we purchased an enterprise license for software to monitor the open port activity all sites including los alamos are now in compliance with the port closure with any ports that can be used to transfer data being sealed a policy i have temporarily reassigned the d a from the sandia site office to los alamos to strengthen the cyber security there i have directed the d a s at all n s a site to review the cyber security plans and i hold them accountable to ensure that those plans now address the specific risks of each system and to identify and rewrite the plans with omissions such as those that allow the incident at los alamos i have increased the funding to los alamos to hire three cyber security experts to support the federales activity there i have assembled a team of eight cybersecurity experts from headquarters and n s a and has them inspect all the vaults at los alamos to determine if they were in compliance with apartments directives to close ports the team initially found areas of noncompliance however when reconvene on this site this past week they inspect all vaults and are now in compliance i further directed the team to inspect the cyber security implementation at all and n s a sites those inspections will start in february and conclude in april when the team revisit alamos my office has worked with the d o d c i a o mr tom pike to identify areas where policies and procedures are needed to strengthen cybersecurity and joe aggressively implement them as quickly as possible and n s a is responsible for over seventy percent of the classified networks within the department we take this responsibility very seriously and maintaining the security of the classified networks is our highest priority because of the dynamic nature of cyber security no one can  e there will never be another cyber security incident at any n s a site it is not possible to have perfect and complete security we live in a world where hacking into federal systems is a hobby of many students and many highly paid professionals we are using every tool available and i've put in place strong cyber security policies to ensure this type of event does not happen again and n s a is working very diligently to maintain a secure environment for our information and that of the department we work closely with our sites to identify the risks and we are moving ahead in many areas and we are making progress i am happy to answer your question sir  chairman my name is tom pike i am the chief information officer of the department of energy i came to the department in november two thousand and five and i've given a high priority to revitalizing the management of cybersecurity within the department over the last year deal we has undertaken a major effort to improve our cyber security we developed a plan to update departmental cyber security directives and issued guidance  specific high priority areas in december two thousand and six the deputy secretary signed a new deal we cyber security departmental order which established a new governance structure for cyber security program manager the order directs the use of a risk based management approach and mayfly are assigned a responsibility to the under secretaries and other senior officials to oversee cybersecurity management within their organizations including the field organizations under their jurisdiction the undersecretary of have accepted this and hants wrote this hand enhanced and roll and are working hard to strengthen the management of cybersecurity this order is a key part of the institutionalization forceful new direction to the department as referred to by earlier by deputy secretary clay so the new order provides for timely issuance of urgently needed cybersecurity guidance to date i have issued twenty cybersecurity documents guidance documents and the office of the chief information officer continues to develop guidance in accordance with the plan developed last year i've already issued guidance on certification  systems and on system configuration management both directly relevant to the recent los alamos incident we have also issued special guidance on protection of personally identifiable information and all disposal of disk drives finally directly to the concerns being addressed at this hearing we have recently completed a planned deal we national security system controls manual it is now in final review in the department we have been able to incorporate actions in the manual based on a number of the lessons learned from this incident i would be pleased to respond to any questions you may have mr antos he'll chairman stupefaction ranking member with field and other members of the subcommittee i thank you for the opportunity to speak with you today michel anastacio and since the first of june two thousand and six i've been the director of the los alamos national laboratory i'm also president of the laboratories new management company the los alamos national security l l c often referred to as lands previously i served our country for over twenty five years at the lawrence livermore national laboratory first as a scientist and ultimately as the director of that institution the security breach at los alamos national laboratory is deeply troubling i want to make it absolutely clear to all of you that my board and i personally find this incident totally unacceptable and it's precisely because of such incidents that the deal we made its decision three compete the contract at at the laboratory to talk with you today and in my opening comments about four main points first that we take this incident very seriously that we took immediate action upon learning about the issues that we bring a different approach to running this laboratory and that this incident accelerates our plans for to develop a robust security system that that handles today's issues and anticipates the future although this incident only occurred only weeks after we took control of the laboratory i'm responsible for this incident but even more importantly we're responsible for the solution to fix the laboratory with regard to security and other matters i've detailed in my written set testimony a number of corrective actions that we've taken and i just like to cover six of those right now we've tightened controls on the ports on all the classified computers through our parent organizations we've tapped into into tenet security or expertise from across the country we've established a new cyber security organization the purport to directly to me our guard forces significantly increase the number of searches of laboratory personnel as they leave the site we terminated the relationship with a standing sub contractor and i've disciplined twenty four employees of the laboratory as a result of this incident we're prescreening for illegally illegal drugs all new hires and there will be randomly testing the existing workforce these steps have already proven effective as we heard elian and i say have certified last week that all devolve of all type rooms that we have at the laboratory with classified computing are now compliant but these is an issue of actions aren't sufficient we must move beyond the quick fix band aid approach that's been used in the past and that means we must now having to address security in a comprehensive integrated manner that anticipates risks associated with aggregate advancement of technology there will not be a silver bullet solution because there are none but we've developed a forward looking approach addressing all the elements of unhandsome food security that needs to be done and do them simultaneously will quickly put in place a demonstration projects that creates a test bed to try out all these new security approaches that we have in mind will consolidate  tens of twenty of our existing of vaal type rooms into one overall facility and there will implement clear policies with advanced technologies and proven behavioral methods and this way we'll have a plan that we've demonstrated will work and then we can then implemented across the entire laboratory so mr chairman in conclusion the steps that i and the board are taking are a fundamental break from the past  lance partnership brings together expertise and expect and successful performance from across the federal and the commercial sectors as president of the lands i report to a very demanding board of boards of provides a level of oversight engagement and rigor that though this laboratory has not seen before i have a brand new management team that i personally selected from across our parent companies the partnership  of these four companies gives me a deep bench of capabilities and personnel that i'm already tapping into i'm already seeing evidence of positive change at the laboratory and in time the dramatic improvement in the overall performance of the laboratory we've taken immediate action we have an ambitious and comprehensive plan we have extraordinary capabilities to draw upon and we are working aggressively to execute our plan all of my leadership team and i personally are deeply committed to the los alamos national laboratory success and if essential role in protecting our country's national security thank you mr chairman and i look forward to answering all of your me i've been working a lot longer hours or if you mean if i've been disciplined in any way sure i've been certainly in contact with my board from the very beginning of this incident and they've made their expectations very clear to me of the board also talk with and then i say in the secretary and based on that conversation they pass along those expectations and i've heard the same from the department as well personally so i've been very clear to me what everyone expects of us at the laboratory and well what are the lessons you learn from lessons learned and what is being done to ensure this incident doesn't happen again well as i tried to detail for you a little bit in my oral testimony and more so in the written that we've taken a number of aggressive actions such as i learned such as as soon as i learned about this incident within hours where aready started to control the  ports on classified computers we started taking that action immediately but we've heard that since two thousand we had eight hearings on cybersecurity since we first brought up to thaw and so excuse me but i don't what's going to be different we've heard all this before but i just might hearing on this not actually succeeded in doing that and the reason audit confirms that in fact that we've complied with with all the direction we've given we've also been on audit from the inspector general mr friedman said the whole our security at los alamos is in shambles the horse security a read it for you exactly if you want it so i asked him about it and it was very basis of los alamos the very core of our security was not good to determine i find this incident and the issues around it totally unacceptable on my board finds that totally unacceptable they're going to hold me accountable to fix this and we find it totally acceptable there and we're going to do to fix it i understand that and we're in the process of doing that and so we've taken a series of immediate actions which i think address the immediate concerns and risks that the laboratory and at the same time we have a long term plan that will get us to a point where we can be out in front of these issues not always playing catch up that we've done in the past and that will allow me and the american people and you the congress to have confidence in this laboratory again the department three competed this contract we understand very well they repeat repeated this reconsider this contract because of these issues and i understand that the reason i've been brought in and my team and this new contractor is that we need to fix these in the other issues that are going on in the laboratory and that's what i'm here to commit to your inspector general report as quote a review review or a serious breakdown in core laboratory security controls in short these findings raise serious concerns about laboratories ability to protect both classified and sends to information systems so that's the challenge you have  this will banks at los alamos most sensitive and classified computer systems are they adequately protected from today's threat you mentioned hackers always trying to get in on classified mist provisions ship what would you bet your job on that all twenty five thousand  we have since secured all u s b ports at all and as a sites and are reviewing all cyber security plans to ensure they address the specific risk for that system this type of incident we undertake the transfer of classified information to a portable device could no longer occur at any and as a site so let me ask you why wasn't all of this fix prior to this incident actually at some of our sites or was fixed i have it right but i did all o you ever review the report of two thousand and four and see what was required for cybersecurity at the labs computers yes i did sir there was very minimal in there for cybersecurity ok hopefully at some time for some follow up because i would follow that up my time is up  you've been here now for about seven months that was our knowledge and that's correct well you might have some of the unique perspectives on this that we've been asking a lot of people and i read this comment that said lannes volume of classified holdings is unnecessarily large conducted in too many security areas involving too many people and is spread out over too large of an area would you agree that that assessment and they give a synopsis of the primary differences in los alamos lawrence livermore and would explain why security is such a challenge at los alamos well i would agree those factors add a challenge to los alamos but i believe the one of the fundamental issues at the laboratory right now is that there is unclear complicated policies which are inconsistently applied across the laboratory and of course one of the reasons for inconsistency is the fact that there are so many different locations but in the past the laboratory has has each organization has implemented their own version of the overall policies have led to inconsistency and i would also argue that the policies are over complicated and sometimes inconsistent so we have not been enabling our employees to be a success what they see is confusing  don't know what is allowed and what's not allowed so that's one of the things that was sort of core approach that we take in to fix the laboratory but at the same time we're also to consolidate the number of vaults the bring those down the laboratory before we arrived has done a lot to reduce the total number of accountable removal of electronic media a number of documents so i think these are all approaches to an overall plan that we're putting together so the confusion in policy is that partly the responsibility of the government and the holder of the and the no contract well certainly we are driven by the policies that come  from the department through our contract but i believe my responsibility goes beyond that my job is to make sure the laboratory is secure i have to be compliant with the policies but if that is not sufficient i have to take further action but  u found a lot of things wrong with the policies and the confusion in the policy when you arrived there i mean there obviously was room for improvement yes there's certainly room for improvement and we're off dealing with that and trying to understand why would we to that there would really be a great improvement when the university of california had responsibility for sixty four years prior to the news in the no contract and now they are a fifty percent stakeholder in the new contract i think there's a number of reasons why you should have confidence this is a new team first we have a board of directors that we've never had before who's very demanding and who is on the board of directors there are eleven members of the board of directors six from the parent companies and five from the outside outside world and the parent companies would be university of california back to hell and who else b w x technology and washing group international now what is the who is the  six members from those four into the that's correct and then five members outside of those that interact and who selected the board members the five that are outside of the parent t board the executive the six members on the inside from the companies yes and those five who what companies do they represent we have one to four for oversight from pricewaterhouse tell of the board is nominally meets orderly but whenever they need to so we've had quite a number of meetings those are the formal meetings but i'm in constant conversation on the telephone with the key members of the board whenever that's necessary and that has expired i slide to ask one quick question as a result and most recent breach the fifteen hundred some documents that were a problem as the director of los alamos representing the pride of the president of the new consortium would you expect that the government would penalize your company financially for that breach i certainly understand that that part of ultimately all of our fee could be at risk for this or any other incidents that go on the laboratory we understand that very well thank you thank you very much mr chairman sir and associate i wanted to follow up on some of the ranking members question because you successfully ran lawrence livermore for a good number of years and i'm wondering if you could just tell me very briefly what is what is that that's so different that at this facility you said a minute ago there are so unclear competing policies that are applied inconsistently are there other things excuse me how some around among the employees all the morale of the employees there really i think it's improving they've been through a lot of controversy over the last few years they understand because of the contract competition that change is happening and that needs to happen and i think they're very very committed to their mission do you do you think they're kind of mid to to comply with security procedures i think the employees are very committed to do their job very well including their security responsibilities and if i had a change in attitude well you've only been there since june i can't say how much that's a change in attitude because i would be frank when we were out there a couple of years ago when when mr barton and i were there was not the sense that part of the problem was that many of these these high level employees i felt like these were the security procedures were ridiculous and they didn't really want to comply well i found some of that attitude the attitude i found as first very loyal commitment to the country and their mission but also a confusion about what is standard they're being held to and so they want to comply but they're not clear what they're supposed to and this is what you're talking about unclear competing as you supply things and i think one of the things we're trying to do is as we define the overall goal and policy we want them to achieve we're trying we're involving some of the employees and in developing the implementation plan that way they're there from the beginning now they don't get the final choice in what that plan is but they're part of that discussion so they understand why the policy in place and how it let me ask you this mr friedman said that that he felt like we should give the agency and tell do which would be your one year anniversary to fix this can you fix all these problems place that june i when are you willing to commit to that today i would agree with what the deputy director that we're off fixing them right now we have been fixing these problems ever since the incident occurred that we were making progress every ok my question is can you do it by  d'agostino in the in the binders this fiscal year two thousand performance evaluation plan i'm sure you're familiar with that plan and my part of that plan on page five is the performance based incentives for a little confused up here about if we wanted to take mr at estadio testified about everybody now understands that there are senators under this new contract we're a little concerned about if we wanted to take some kind of punitive action if these problems are fixed how much we could penalized the leave the management by is it the entire seventy three million two hundred eighty thousand or so some other number of that maybe you could  quickly explain that yes ma'am thank you for the opportunity to do that a couple of points one is there is a clause i mentioned during my oral testimony conditional payment a fee puts that whole seventy three million dollars at risk for  determines the level of severity there will be an analysis done the damage assessment for example in this particular incident will be looked at there maybe you know if there are further safety and security activity problems that happen those would get added up into the problem if you will and when we look at fee determination at the end of the end of the fiscal year so what we will do is at the end of the fiscal year which is september thirtieth of this year take a look at the laboratories performance not only on this particular security incident but on whether there have been any safety issues associated with the laboratory and look at whether that conditional fame in a plea could feed clause actually applies here in addition to your question ma'am was referring to this particular page which referred which broke down essential to the seventy plus million dollars there is a fixed fee right than the thirty percent of about twenty two million dollars and the incentive to see within the incentive fees is called performance base only three million dollars right of the whole seventy why is that why should we feel qantas so how do you think we can only penalize them three million dollars they don't have an e q man no ma'am the all the seventy three that steak and what i've i want to get to a point i want to make i did spend the first few days in this job at los alamos last week i got a chance to see firsthand the conditions that you've talked about earlier in the hearing based on that i directed the  manager at the side office working with mr desmond to go re evaluate we can unilaterally re evaluate and we are you know that laterally reevaluating the sfi allocation within this particular plan so we have two approach and we will as i mentioned in my testimony i want to make full use of the contract that is the main tool and it's the tool that we should use and we'll use in order to make sure that the message gets across that the contractor so what i'd like i'm falling for taking so long we're going to do conduct a reevaluation of this allocation and we'll be working with lands on on that reactor allocation but if we don't come to agreement the federal government has the ability to unilaterally impose a change on th testimony about re completing the contract i'm assuming there you were talking about the re competing of the contract that happened a year ago not a not of we compete that's some point in the future with i'm actually referring to a re compete  it should come to this point if it should come to the point where myself as the acting administrator of the n s a feels that we have a material breach of the contract or we have a situation where it's in the best interest of the government i as the administrator through my contracting officer have an have an ability to repeat that is not the case right now i want to make that clear because i do believe first of all we don't have we don't have all of the analysis together on as a result of the current criminal investigation that's underway but you do have the ability then to recompete the contract the contract allows me to terminate for cause the existing contract without waiting the seven years to do so that's right yes sir well let me just ask you a question then we've heard all kinds of testimony about the fines levied whether it's three million or seventy three million seventy three million would be a significant find to levy against the  contractor would they be able to continue with their mission if they were hit with that level of funding that damaged their ability to provide the services the security that they were going to demand of them i believe that if i were to decide today that i wanted to levy and i had all of the data with me today i know the analysis is continuing that it would be a bad management decision to make that move right now before the fiscal years over i have complete faith and confidence in dr anastacio i understand the plans he's putting in place he does take this seriously he's taking specific steps there are obligations on the part of the federal government as well and i'm making changes on that particular side but i do believe that it would be irresponsible and a bad management move from my years of managing organizations to be for the fiscal years actually over to make that decision so the answer your question and i wouldn't do it at this point but what's clear is that this is see this is not of resources that are set aside let me just interrupt even as far as just the management aspects of it we had a team that was on site for over sixty years i'm relatively new but it sounds like in this committee we've been dealing with the same sort of problem over and over again i don't know whether they're in a related or not i've got to assume that a laser injury of the eye is not related to the removal of the thumb drive is not related to the guy getting beat up at the bar but still there are all these things that keep to keep coming up how good a management decision is it's to continue on with the same group that has that has that has brought you these troubles in the past and and should we not have been able to anticipate a subsequent breach because of the behavior the least been exhibited since nine hundred ninety nine so i'd like to address in two ways one is to make sure that it's clear that the same organization is not running this laboratory it's clear that the proposal that i review has alter actually changed then since the awarding of the contract  i would say i don't know the answer that question but here's what i would hope you find of quickly that's exactly right the executive committee knows the executive board of governors the executive committee on the board truly understands that i put this in writing that i don't believe this is just a matter of well let's straighten out our policies and procedures do a couple of checks and follow up and everything will be all right my job as a manager is to set expectations demand performance and follow up and use the tools that i have that board actually the structure actually allows me the opportunity to do that never before has the department had this much money on a contract and i hope you have the courage to enforce that this will break so we just ask you briefly you use the word malicious in your testimony  is that did i understand that accurately yes or so this person willfully downloaded material took it back to her living quarters what would be the if i'm going to do something maliciously presumably i have a reason for doing it have you explored that that we know what that answer is or is that still locked up in the f b i report i believe it's part of the f b i investigation and at some going to mr chairman that information is going to be shared with us mr chairman  congressman if i could try to answer that briefly all the conversations i've had with the f b i have they've given me oh no evidence that the anything's happened beyond taking that material to home but there must've been some financial incentive or warning to damage someone i mean that you do you don't just do something like that on a whim and i can't believe that you would certainly the f b i is the one that can answer that in better detail but what they've expressed to me in my discussions with them  s there they have no indication that she did anything beyond what was reported in the press but again the motive i mean the laser into the eye ok that was an accident getting beat up in a bar that's bad judgment but taking material from the server back to your living quarters i mean there's there's got to be a reason why someone would engage in that type of activity was it a for sale or for damage someone else but again we don't know the answer to that at this point but what are working hard to do is make sure that never happens again and i and i would very much like an answer as to why it happened the first place we give this the room would just be one more question or so and get back to the f b i we talked a little bit off the record there we'll probably have them come in give us a briefing members briefing on the status their answer some your questions review with details look at all the incidents going back to over a year and a half ago when this project was first set up the conditions of security that were built into the planning that they did all the way through the activities up until up until recent times and in that there were a variety of people that were disciplined either removed from their job or other forms of discipline for for all the different sorts or one of the worst i think the worst the worst problem was the ways the security was set up for this particular project the people who set it up actually were trying hard to be very conscious of  security but they didn't they didn't make a plan that addressed all their potential risks and the people that were responsible for that security plan and that involved of all type room i think were the ones that got the most severe penalty and then these the second most i would say was the was the cyber security team that was responsible for the overall policies of the institution of the twenty some odd how many did you fire three were removed from their assignments many of the people who were responsible for this activity are low or no longer in the sign that when when we came on board so they had been moved out of their job for a variety of reasons before we even got there even though they were responsible a year and a half ago for four overall security things that we have you've been in the know you've been they shot me but has the process been to try and ferret out all these people far back because i don't know how far back we went back to the very beginning when the project was set up we had done to fight all the people who were responsible the organization itself that was responsible the time doesn't any longer exists we've reorganized etc but we went in and then a fight all the individuals who've been involved over this entire period of time and again went through a very detailed effort to examine all the issues and who was responsible for them and that led to the twenty four different disciplinary actions you have lawrence livermore zacharias or how many employees at lawrence livermore oh i guess i don't remember offhand i'd say about eight to nine thousand so about two thirds to three quarters of what you have it and that's approximately right and there's not any security problems that you experience or cyber otherwise there were some security problems at lawrence livermore while i was there one incident that got quite a lot of attention was some security keys they got they got lost and the approach i'm taking to the incidents here is the same i took there which is the act very quickly and decisively to find out those who are responsible and make sure that they're properly held accountable and to go build up a system that that that addresses the issues and i would say defer to others but i've been told  lawrence livermore now has the model security program for keys in the complex and the lab goes around and briefed the other sites on the lessons learned and and how to do better job so i think we responded very decisively there you when you look at the security that is provided in this country and other places by our government why is there not some type of guidelines some type of program that we could model after i mean this is all we making it up as we go when we bought brought these new contractors in well certainly there's an element that's very clear on how how to do this that has the behavioral issues involved that has issues policies and procedures infrastructure that we've talked about how big is your infrastructure is better but there's another piece which i think is a very large challenge for the country and us at the laboratory which is the advance of technology when the last time the laboratory reviewed its policies and we could argue they should have done it much sooner these little memory sticks thumb drives were not in common usage and yet now they are it's quite obvious what a risk they are for security and so what what's going to be the challenge we have two years from now  we really need to develop a system in place that is robust against the future advancement of technology so we don't have to fix it after the fact like we're doing now and that's the plan we're off doing and i would argue that as one of the previous  in use but if you look after january of two and five after the shutdown the lab for a while that five out of fourteen points dealt with cyber security dealt with the fact that these things are accessible so i would suggest that maybe a good place to start for security is go back and look after we shut down the lab that cost three hundred fifty million dollars that we look at the recommendations made and implement those procedures i can't speak to exactly what happened during during that shutdown and why they did it i can say that we have looked at and have in fact develop plans for all the issues that came up associated with that shutdown and the corrective actions in place we have a before that yes sir and i guess what i was maybe to be clear the the policies that the laboratory has for cyber security were not changed to be cognizant of  the new technology that was available and that was a mistake on the laboratories part and we're all sexing that miss wilbanks was asking some questions about the cyber security and the computer systems and i asked to use the same thing had you reviewed the are the chief information officer but even states and i'm looking at january two thousand and five memel says that the office of chief information officer is leading the effort to implement cyber security enhancement plan to protect the confidentiality integrity and availability of all the only information systems so you certainly as the chief information officer certainly has a huge role to play in shoring up all the classified unclassified concern that they feel they can't discuss with airline management they had there's a confidential reality process a separate group of people to who we also have an arms but program we have a variety of mechanisms that employees have available to and then as a result of the deputy lab director announcing his retirement which basically was in violation of the contract the contract administrator  contracting officer edwin wilmot wrote a letter to you on the summer six requesting a briefing on what steps you all intended to take to ensure the retention of all key personnel out have you all had that briefing yet our i have not formally responded to his letter but he and i in fact just last week talked about this very subject on the phone and i gave him an update and he requested me to send him some more information which i promise to do right after this hearing ok roughly it's roughly two billion dollars or that's basically for managing the side it's that's right it's for managing the site there i think there's a fee element associated with that that's that's right and then and on top of that we have seventy three million dollars pool that can be given for extraordinary performance or incentives or whatever it is that correct as a subsets or not on top that's it's roughly two two billion dollars it depends on how much work we allocate to los alamos national laboratories and the amount of work they have the laboratory gets its resources from a number of different areas within the department and across the federal government about sixty percent of it may be closer to seventy percent of it actually comes from the n s a probably about fifteen percent of it comes from other elements of the department of energy and about fifteen percent comes from what we call work for others which is work for other federal agencies partnered defense and other intelligence agencies but the one and a half charge that we allow the laboratory in the part of it's management to make it an allowable cost and it's set aside in a specific account within the indirect pool so it's not in addition to on top of  follow miss wilbanks when when i was that the facility in two thousand and four we were told that all of these ports were going to be secure that and then in your testimony system this type of incident and detective transfer of classified information to a portable device could no longer occur at any n s a site i guess my and my great frustration here and i think the frustration of the rest of the committee is that we keep trying to close the barn door after the horses scapes on mr anastasia those well now we're drug testing the employees before they get the security system now you're in here saying that the ports have been secured why why didn't that happen before this incident if we knew the problem existed several years ago why didn't it happen i did not come to the department of energy till the end of october two thousand and four so i can speak to the comment that was made before i was there i can tell you that the ports have been in the process of being closed and the site has been working on it i don't have any other it took two and a half years to do that i don't know ma'am ok when did you say you came october thirty first two thousand and four ok so that was right after we were there and and so by the way when you came and then in october of this year that was two years and the parts so were close in that time right yes ma'am there was no policy or procedure in place to require the port closure it was not identified as a high risk because my assumption ok so if we were told when we were you would have no knowledge so no one told you that that was a high priority no and i was not aware of it ok so that's that's why we're so frustrated is because when we were there earlier that year we were told that that was a high priority i guess this is what you're talking about mr honest a c e o about the the unclear competing policies thanks but this this is the well this is what that's the part that's baffling know i just like mr anastacio that that that you really do have a job ahead of you and i hope that you and your team can can do that job because because i don't think there's very long for that to happen before we do take really drastic changes we've been sitting here for eight years doing this and this is a perfect drug testing is another example i'm assuming at lawrence livermore on the other labs that drug testing for a high level security clearances is is pro forma wouldn't it there was not a policy for drug testing at morris livermore when i was there we have a requirement for certain specific activities that handling of th nuclear material for example at the department requires us to have a drug testing for program for and of course those are in place all across all the sites what i've done a lot of alamosa say that actually i'm going to have drug testing for all employees whether they have a top level security clearance or not and just anybody who comes that works on my site i won't stand for people using illegal drugs well that's that's good but even under the previous standards this this  was who who was cleared should probably should have had that level of security clearance would you agree i can't speak to that i don't know i don't know all the background that she had an that will drug test our athletes and we're not drug testing at lawrence livermore i don't see that as good information mr pike let me ask you a question on if the designation of an official use only documents what would be the reason to to designate something as official use only what that means if we shouldn't be distributing it say around in this room for everyone to look at my understanding that the official use only designation is given when someone has reason to believe they're sensitive information in there that should not be disseminated broadly said in course you're aware that one of our staff members is mourning downloaded a document from your website that's marked official use of only this report to me late morning is very disturbing to me in fact now appreciate it very much he put in something similar last year and i'm told that our staff went out and assured that the offending material had been taken down immediately that very day off of the web i gave directions from after i heard from them this morning that if in fact that information is still on the way and that it be taken down immediately we have a clear directive to the department that not only is all you owe and other sensitive and classified information not to be placed on the web and to say nothing of classified information not to be placed on the web but there has to be a process in place to ensure regular monitoring of web sites to ensure that such information has not crept onto the web by mistake or otherwise and or otherwise and you know with all of the talk that we've had this morning you do have to worry about the otherwise fortunately for you i'm not smart enough to understand what i'm holding in front of me i don't know that i could say the same about the staff member who downloaded it  it's not off the web site i do encourage that you do that and just as a final thought on everything we've been talking about this morning up you know i hope we don't focus on so much the individual worker at los alamos the person who may have given him to a moment of human frailty but we really have to put those procedures in the culture in place that just does not allow this to happen in the future and heaven help us all if we're back here doing the same thing all thank you and you're excused we will go in executive session and twenty two eighteen room twenty two eighteen in fifteen minutes five after two mr friedman mr button ski and and deputy secretary cell if you would please this record will remain open for thirty days of members have questions i'd like to submit to any of the witnesses the record will remain open for thirty days for those questions