Depa rtment of Homeland Securit y

Office of Inspector General 
 

 

Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

October 1, 2008 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General was 

established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 

to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the implementation of technical 

and information security policies and procedures at DHS components located at Los 

Angeles International Airport, California. It is based on interviews with employees and 

officials of relevant agencies and institutions, direct observations, and reviews of 

applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 

office, and have been discussed in draft with those responsible for implementation. It is 

our hope that this report will result in more effective, efficient, and economical 

operations. We express our appreciation to all of those who contributed to the 

preparation of this report. 

Richard L. Skinner 

Inspector General 
Table of Contents/Abbreviations 
 

Executive Summary............................................................................................................ 1 
 

Background......................................................................................................................... 2 
 

Results of Review ............................................................................................................... 5
 


CBP Did Not Comply Fully With DHS Sensitive System Policies........................ 5 
 

Recommendations................................................................................................. 14 
 

Management Comments and OIG Analysis ......................................................... 15 
 

ICE Did Not Comply Fully With DHS Sensitive System Policies....................... 16 
 

Recommendations................................................................................................. 21 
 

Management Comments and OIG Analysis ......................................................... 22 
 

TSA Did Not Comply Fully With DHS Sensitive System Policies...................... 23 
 

Recommendations................................................................................................. 29 
 

Management Comments and OIG Analysis ......................................................... 29 
 

USCG Did Not Comply Fully With DHS Sensitive System Policies .................. 29 
 

Recommendations................................................................................................. 33 
 

Management Comments and OIG Analysis ......................................................... 33 
 

Appendices 

Appendix A: Purpose, Scope, and Methodology .....................................................34 
 

Appendix B: Management’s Comments to Draft Report ........................................36 
 

Appendix C: Major Contributors to This Report.....................................................52 
 

Appendix D: Report Distribution ............................................................................53 
 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 
 

 

 

 

 

Table of Contents/Abbreviations 
 

Abbreviations 

CBP 

 CIO

 DAA 

DHS 

DHS Directive 4300A 

DHS 4300A Handbook 

FISMA 

FTP 

 FWFL

 HVAC 

ICE 

ISA 

ISSM 

IT 

 LAN

 LAX 

NOC 

OIG 

SAC 

SOC 

SSP 

TA-FISMA 

TECS 

TSA 

UPS 

 USCG

 WLAN 

 Customs and Border Protection 

 Chief Information Officer

 Designated Accrediting Authority 

 Department of Homeland Security 

DHS Sensitive Systems Policy Directive 4300A 

DHS 4300A Sensitive Systems Handbook 

 Federal Information Security Management Act 

 File Transfer Protocol 

 Far West Field LAN

 Heating, Ventilation, and Air Conditioning 

 Immigration and Customs Enforcement 

 Interconnection Security Agreement 

 Information Systems Security Manger 

 Information Technology 

 Local Area Network

 Los Angeles International Airport 

 Network Operation Center 

 Office of Inspector General 

 Special Agent in Charge 

 Security Operation Center 

 System Security Plan 

 Trusted Agent FISMA 

 Treasury Enforcement Communications System

 Transportation Security Administration 

 Uninterruptible Power Supply 

 United States Coast Guard

Wireless Local Area Network 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 
 

OIG 
 Department of Homeland Security 

Office of Inspector General 

Executive Summary 

As part of our Technical Security Evaluation Program, we 

evaluated technical and information security policies and 

procedures of Department of Homeland Security components at 

Los Angeles International Airport. Customs and Border 

Protection, Immigration and Customs Enforcement, Transportation 

Security Administration, and the United States Coast Guard 

operate information technology systems or have a presence at this 

airport in support of Homeland Security operations. 

Our evaluation focused on how these components had 

implemented computer security operational, technical, and 

management controls for their information technology assets at this 

site. We performed onsite inspections of the areas where these 

assets were located, interviewed Department of Homeland Security 

staff, and conducted technical tests of internal controls. We also 

reviewed applicable policies, procedures, and other relevant 

documentation. 

The information technology security controls implemented at this 

site have deficiencies that, if exploited, could result in the loss of 

confidentiality, integrity, and availability of their information 

technology systems. Specifically, these components need to 

improve their physical security operational controls for 

telecommunications equipment and servers. These components 

also could improve their technical controls by 

Additionally, these components need to improve their management 

controls by upgrading documentation to include information 

technology assets at Los Angeles International Airport. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 1 
Background 

We designed our Technical Security Evaluation Program to 

provide senior Department of Homeland Security (DHS) officials 

with timely information on whether they had properly 

implemented DHS information technology (IT) security policies at 

critical sites. Our program is based on DHS Sensitive Systems 

Policy Directive 4300A (DHS Directive 4300A), which applies to 

all DHS components. It provides direction to managers and senior 

executives regarding the management and protection of sensitive 

systems. DHS Directive 4300A also outlines policies relating to 

the operational, technical, and management controls that are 

necessary for ensuring confidentiality, integrity, availability, 

authenticity, and non-repudiation within the DHS IT infrastructure 

and operations. A companion document—the DHS 4300A 

Sensitive Systems Handbook (DHS 4300A Handbook)—provides 

detailed guidance on the implementation of these policies. 

DHS IT security policies are organized under operational, 

technical, and management controls. According to DHS Directive 

4300A, these controls are defined as follows: 

•	 Operational Controls – Focus on mechanisms 

primarily implemented and executed by people. These 

controls are designed to improve the security of a 

particular system, or group of systems. These controls 

require technical or specialized expertise and often rely 

on management and technical controls. 

********** 

•	 Technical Controls – Focus on security controls 

executed by IT systems. These controls provide 

automated protection from unauthorized access or 

misuse. They facilitate detection of security violations, 

and support security requirements for applications and 

data. 

********** 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 2 
 

 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 3 

•	 Management Controls – Focus on managing both the 

IT security system and system risk. These controls 

consist of risk mitigation techniques and concerns 

normally addressed by management. 

Customs and Border Protection (CBP), Immigration and Customs 

Enforcement (ICE), Transportation Securit y Administration 

(TSA), and the United States Coast Guard (USCG) each have 

activities at Los Angeles International Air port (LAX). They rely 

on a range of IT assets to support their respective missions. As a 

Category X airport, LAX is classified amo ng those airports with 

the largest number of enplanements.1 

CBP’s activities at LAX include processing passengers and 

baggage on arriving international flights. CBP staff at LAX use 

their systems to access various applications, including the Treasury 

Enforcement Communications System (TECS).2 

ICE’s Office of Investigations at the El Segundo Field Office 

supports operations at LAX that focus on a broad array of national 

security, financial, and smuggling violations, for example, 

•	 Illegal arms exports, 

•	 Financial crimes, 

•	 Commercial fraud, 

•	 Human trafficking, 

•	 Narcotics smuggling, 

•	 Child pornography/exploitation, and 

•	 Immigration fraud. 

Using their unique legal authorities, ICE special agents also 

conduct investigations aimed at protecting critical infrastructure 

industries that are vulnerable to sabotage, attack, or exploitation. 

TSA’s activities include screening passengers and baggage on all 

departing flights at LAX. In support of these activities, TSA has 

operations in several buildings at LAX, and TSA staff use Digital 

Subscriber Lines circuits to access computer systems. 

1

 There are five categories of airports—X, I, II, III, and IV. Category X airports have the largest number of 

enplanements and category IV airports have the smallest number. 

2

 TECS is a CBP mission-critical law enforcement application designed to identify people and businesses 

suspected of or involved in violation of federal law. TECS is also a communications system permitting 

message transmittal among DHS law enforcement offices and other national, state, and local law 

enforcement agencies. 
Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 4 

USCG personnel at LAX, designated Air Station Los Angeles, 

maintain search and rescue helicopters 24 hours a day, 365 days a 

year. They are responsible for protecting the coastal area of 

Southern California from Dana Point to Morro Bay. Additionally, 

USCG helicopters conduct homeland security patrols for the Ports 

of Los Angeles, Long Beach, and Hueneme. Its responsibilities 

include the over-water approach and departure corridors for LAX 

and the Channel Islands National Parks. 
 

 

 

 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 5 

Results of Review 

CBP Did Not Comply Fully With DHS Sensitive System Policies 

CBP could strengthen operational, technical, and management controls for 

its servers, routers, and switches operating at LAX. For example, CBP 

could improve business continuity and physical security, and ensure that 

Additionally, CBP should take actions to ensure that its IT assets are 

scanned on a regular basis. Further, required system documentation 

should be updated to include CBP’s IT assets at LAX. Collectively, these 

deficiencies could place at risk the confidentiality, integrity, and 

availability of the data stored, transmitted, and processed by CBP at LAX. 

Operational Controls 

Onsite implementation of operational controls that did not conform 

fully to DHS policies included 

Additionally, CBP needs to improve its 

Communications Redundancy 

CBP experienced a network outage that disrupted its operations for 

more than 10 hours and affected more than 17,000 passengers on 

August 11, 2007.3 This outage resulted in significant delays in 

processing arriving international passengers, causing the terminals 

to fill with passengers waiting to be processed. Because of this 

situation, the LAX fire marshal restricted the number of passengers 

that CBP could stage in the waiting areas and jet ways. 

Consequently, CBP staff at LAX were forced to keep many 

passengers on board aircraft for hours following international 

flights. Additionally, CBP staff were forced to reroute some 

flights to a nearby airport. This outage was exacerbated by an old 

IT infrastructure, which did not have network or power redundancy 

at LAX. 

Subsequently, CBP has taken steps to ensure communications 

redundancy at LAX. Specifically, CBP added circuits and 

hardware to remove a single point-of-failure deficiency that 

previously existed. CBP also established a new 

3 Our draft report, Customs and Border Protection Did Not Manage Effectively a Network Outage at Los 

Angeles International Airport, will provide further information on the outage. 
 

 

 

telecommunications closet in a second building at LAX. These 

actions ensure that CBP users at LAX will not be limited to one 

communications pathway when accessing CBP systems. 

Business Continuity 

CBP’s business continuity capability needs to be strengthened at 

LAX. For example, 

CBP has implemented uninterruptible power supplies (UPS) 

Further, installing UPS devices for telecommunications equipment 

is not enough to ensure that CBP workstations will be in operation 

following a power failure. 

However, CBP has taken steps to ensure that they will be able to 

process passengers during a communications or power outage that 

lasts for a long duration. 

According to the DHS 4300A Handbook: 

“DHS must have the capability to ensure continuity of 

essential functions under all circumstances.” 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 6 
 

Physical Security Controls 

CBP has taken steps to place its communications assets in locked 

cabinets within areas controlled by CBP. These actions will help 

secure CBP’s IT assets at LAX from damage. 

Figure 1: CBP replaced the old rack (left) with a new locking cabinet (right) 

However, CBP has not completed this conversion at all locations at 

LAX. 

According to the DHS 4300A Handbook: 

“Controls for deterring, detecting, restricting, and 

regulating access to sensitive areas shall be in place and 

will be sufficient to safeguard against possible loss, theft, 

destruction, damage, hazardous conditions, fire, malicious 

actions, and natural disasters.” 

Environmental Controls 

During our September 2007 walk-through of DHS facilities, we 

noted that many of the CBP telecommunications rooms had 

temperatures exceeding 70 degrees Fahrenheit. While CBP is 

placing this equipment in cabinets that contain fans, there are no 

temperature sensors in the cabinets to automatically turn on the 

fans or to alert CBP staff if temperature exceeds 70 degrees 

Fahrenheit. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 7 
 

According to the DHS 4300A Handbook: 

“Temperatures in computer storage areas should be held 

between 60 and 70 degrees Fahrenheit.” 

Additionally, at LAX, CBP is relying on the facility’s fire 

suppression system. However, there were also fire extinguishers in 

two telecommunications rooms that either were not charged or had 

not been inspected within 12 years. Fire extinguishers that will not 

perform could cause CBP staff to waste valuable time during an 

emergency. 

Further, in several of the server and telecommunications rooms 

there was poor electrical wiring, misplaced ceiling tiles, dust, and 

storage of non-IT assets. While we are aware that construction is 

ongoing, CBP should take steps to ensure that its IT assets will not 

be accidentally damaged during this transition period. 

Figure 2: Missing ceiling tiles and inadequate storage at LAX. 

Technical Controls 

CBP’s implementation of technical controls at LAX that did not 

conform fully to DHS 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 8 
 

 

 

Inadequate Network Monitoring 

Specifically, CBP has centralized 

its network monitoring activities 

Unsupported Operating System 

CBP is operating six refugee fingerprint processing machines at 

LAX. At least one of these machines has an unsupported operating 

system. CBP is now working with the vendor to upgrade the 

operating systems on the refugee fingerprint devices at LAX and 

four other airports. 

Operating systems that are not supported by their vendors may not 

receive updates or patches when a vulnerability or exploitation has 

been identified. 

Inadequate Vulnerability Assessment 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 9 
 

 

According to DHS Directive 4300A: 

conducted should be included with Security Assessment 

Reports (SAR).” 

Inadequate Access Control 

CBP could strengthen the access controls on its servers at LAX. 

“Components shall conduct vulnerability assessments 

and/or testing to identify security vulnerabilities on IT 

systems containing sensitive information annually or 

whenever significant changes are made to the IT systems. 

This should include scanning for unauthorized wireless 

devices. Evidence that annual assessments have been 

According to the DHS 4300A Handbook, 

“Passwords shall be at least 8 characters in length ... shall 

be changed or expire in 180 days or less.” 

Automated systems are vulnerable to fraudulent or malicious 

activity by anyone with the authority or capability to access 

information not required to perform their job-related duties. 

According to the DHS 4300A Handbook, 

“To protect sensitive information and limit the damage that 

can result from accident, error, or unauthorized use, the 

principle of least privilege must be applied. The principle 

of least privilege requires that users be granted the most 

restrictive set of privileges (or lowest clearance) needed for 

performance of authorized tasks—i.e., users should be able 

to access only the system resources needed to fulfill their 

job responsibilities.” 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 10 
 

 

 

 

 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 11 

Vulnerable Services 

CBP servers, routers, and switches at LAX have numerous 

 increase the risk that CBP 

systems may be compromised by malicious users or external 

attacks. 

According to DHS Directive 4300A: 

“Components shall manage systems to reduce 

vulnerabilities through vulnerability testing, promptly 

installing patches, and eliminating or disabling unnecessary 

services, if possible.” 

Further, CBP’s switches at LAX were not properly configured to 

prevent an “insider” from gaining unauthorized privileges and 

information.4

 This may allow an attacker to capture login 

credentials and remotely take control of the router and change or 

delete configuration files. 

4

According to the National Institute of Standards and Technology’s Threat Assessment of Malicious Code 

and Human Threats (NISTIR 4939), “Insiders are legitimate users of a system. When they use that access 

to circumvent security, that is known as an insider attack.” 

 

 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 13 

According to DHS Directive 4300A: 

“Components shall conduct and document risk assessments 

every three years, when high impact weaknesses are 

identified, or whenever significant changes to the system 

configuration or to the operational/threat environment have 

been made, whichever occurs first.” 

According to DHS 4300A Sensitive Security Handbook, 

Attachment D –Type Accreditation: 

“To account for unique physical and logical variations at 

the site level, a description of any differences and the 

associated risks at each site are documented, and the sitespecific documents are incorporated as attachments or 

appendices to the master C&A package.” 

Wireless Local Area Network 

In November 2006, CBP installed a WLAN at LAX to provide 

high-speed mobile data connectivity and wireless coverage to CBP 

agents operating in and around LAX. However, CBP staff at LAX 

did not test the WLAN once it was connected to the CBP network. 

During the time of our visit at LAX, December 2007, CBP staff 

were unable to operate this system because of technical problems. 

According to CBP staff, CBP did not test the WLAN after it was 

connected to the CBP network and does not know if CBP staff 

have ever used this system. Additionally, CBP did not document 

the WLAN in the FWFL SSP. Further, the WLAN was not 

included in CBP’s systems inventory, DHS’ Trusted Agent FISMA 

(TA-FISMA) reporting tool.7 

According to the DHS 4300A: 

“Component [Information Systems Security Managers] 

ISSMs shall ensure that a risk assessment is conducted 

whenever any modifications are made to sensitive IT 

systems, networks, or to their physical environments, 

interfaces, or user community. SSPs shall be updated and 

re-certification conducted if warranted.” 

7

 DHS uses an enterprise management tool, Trusted Agent FISMA, to collect and track data related to all 

Plans of Action and Milestones, including self-assessments, and certification and accreditation data. 
CBP management cannot be assured that IT systems and data are 

adequately secured unless the various activities leading to 

accreditation are performed and the Designated Accrediting 

Authority (DAA) has accepted in writing the risks associated with 

operating the systems. 

Miscellaneous Issue 

CBP operates 1,900 IT devices at various facilities throughout the 

country that are not regularly scanned for vulnerabilities. 

 Further, the CBP SOC maintains a list of an 

additional 1,048 devices that it has excluded from being scanned 

for vulnerabilities. During the course of this evaluation, CBP 

started requiring vulnerability assessments 

Finally, 

according to CBP staff, they have developed a new approach to 

vulnerability assessments 

starting in February 2008. 

These deficiencies increase the risk that CBP IT systems used at 

LAX and other locations are vulnerable . CBP is 

at increased risk that a device may be open to attack if it does not 

perform vulnerability assessments regularly. 

Recommendations 

We recommend that the CBP Chief Information Officer (CIO) take 

the following actions for CBP activities at LAX: 

Recommendation #1: Implement business continuity of 

operations capability for CBP facilities at LAX, including the 

installation of a backup power supply. 

Recommendation #2: Implement stronger physical security and 

environmental controls to protect CBP’s IT assets from possible 

loss, theft, destruction, accidental damage, hazardous conditions, 

fire, malicious actions, and natural disasters. 

Recommendation #3: Use a connection protocol that employs 

secure authentication. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 14 
 

 

Recommendation #4: Apply the necessary operating system 

upgrades. 

Recommendation #7: Regularly perform vulnerability 

assessments on IT systems containing sensitive information, as 

required by DHS Directive 4300A. 

Management Comments and OIG Analysis 

We obtained written comments on a draft of this report from the 

DHS Chief Information Officer. We have included a copy of the 

comments in their entirety at Appendix B. 

Recommendation #5: Close all unnecessary ports from the 

servers, routers, and switches. 

Recommendation #6: Update the FWFL SSP and perform risk 

assessments whenever there are significant changes to the system. 

In the comments, CBP concurred with recommendations one, two, 

and four through seven. These recommendations will be 

considered resolved but open pending verification of all planned 

actions. 

CBP did not concur with recommendation three. 

We maintain that CBP should comply with DHS 4300A and use a 

secure communications protocol. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 15 
 

 

 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 16 

ICE Did Not Comply Fully With DHS Sensitive System Policies 

ICE could strengthen operational, technical, and management policies for 

the server, router, and switches at the El Segundo Field Office.8 For 

example, ICE could enhance physical security of its server room, 

 Additionally, required system documentation 

should be updated to include ICE’s IT assets at the El Segundo Field 

Office. Collectively, these deficiencies could place at risk the 

confidentiality, integrity, and availability of the data stored, transmitted, 

and processed by ICE at El Segundo. 

Operational Controls 

Onsite implementation of operational controls that did not conform 

fully to DHS policies included physical security and environmental 

controls. Specifically, ICE could better protect its IT assets by 

restricting access to ICE’s server room or by placing the IT assets 

in a locked cabinet. Additionally, ICE IT assets are at risk of 

damage or malfunctioning because of the absence of an adequate 

HVAC system in its server room. These environmental and 

physical security controls deficiencies place the IT assets at the El 

Segundo Field Office at increased risk from unauthorized access 

and damage. 

Physical Security and Environmental Controls 

The ICE suite at El Segundo was not properly secure to prevent 

unauthorized access. 

8

 The El Segundo Field Office of Investigations supports ICE operations at LAX. 
 

 

 

ICE also needs better physical security controls to limit access to 

its server room, which is located next to the main entrance to ICE 

office space. However, the server room door is always left open 

because the room does not have an adequate HVAC system. For 

example, the server room temperature was 76.6 degrees Fahrenheit 

at the time of our visit. Additionally, anyone entering the server 

room would have access to ICE back-up tapes, server, router, and 

switches because they are not stored in a locked cabinet. Figure 4 

illustrates how the server room is not restricted, and the door is left 

open because of the absence of an HVAC system. Figure 5 shows 

the ICE IT assets that are not in a locked cabinet. 

Figure 4: ICE server room with open door 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 17 
Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 18 

Figure 5: ICE server not secured in a locked cabinet 

According to the DHS 4300A Handbook: 

“To protect sensitive information and limit the damage that 

can result from accident, error, or unauthorized use, the 

principle of least privilege must be applied. The principle 

of least privilege requires that users be granted the most 

restrictive set of privileges (or lowest clearance) needed for 

performance of authorized tasks—i.e., users should be able 

to access only the system resources needed to fulfill their 

job responsibilities.” 

********* 

“Controls for deterring, detecting, restricting, and 

regulating access to sensitive areas shall be in place and 

will be sufficient to safeguard against possible loss, theft, 

destruction, damage, hazardous conditions, fire, malicious 

actions, and natural disasters.” 

********* 

“Temperatures in computer storage areas should be held 

between 60 and 70 degrees Fahrenheit.” 

Technical Controls 

ICE’s implementation of technical controls that did not conform 

fully to DHS policies includes operating a server that was running 

an unsupported operating system. Additionally, ICE’s server, 
 

router, and switches were not properly configured to prevent an 

insider from gaining unauthorized privilege and information. 

These deficiencies increase the risk that ICE IT systems used at El 

Segundo Field Office are vulnerable to internal attacks. 

Unsupported Operating System 

An unsupported operating system was running on ICE’s server at 

the El Segundo Field Office. 

 Operating systems that are 

not supported by their vendors may not receive updates or patches 

when a vulnerability or exploitation has been identified. 

Access Controls 

ICE could strengthen its access controls at the El Segundo Field 

Office. Specifically, users had administrative access to multiple 

files and directories. Additionally, shared administrative login 

accounts were in place, allowing multiple people to use the same 

account for system access. 

This configuration increases the risk of loss or theft of ICE 

mission-sensitive data. For example, unauthorized personnel may 

have the ability to write, alter, or delete data that reside on shared 

resources. 

According to the DHS 4300A Handbook: 

“To protect sensitive information and limit the damage that 

can result from accident, error, or unauthorized use, the 

principle of least privilege must be applied. The principle 

of least privilege requires that users be granted the most 

restrictive set of privileges (or lowest clearance) needed for 

performance of authorized tasks—i.e., users should be able 

to access only the system resources needed to fulfill their 

job responsibilities.” 

Vulnerable Services 

 An attacker could 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted)

Page 19 
potentially exploit this vulnerability to gain a list of usernames and 

other sensitive information. 

Further, ICE’s switches at El Segundo were not properly 

configured to prevent an insider from gaining unauthorized 

privileges and information. 

 This may allow an attacker to 

capture login credentials, remotely take control of the devices, and 

change or delete configuration files. 

According to DHS Directive 4300A: 

“Telnet shall not be used to connect to any DHS computer. 

A connection protocol such as Secure Shell (SSH) that 

employs secure authentication (two factor, encrypted, key 

exchange, etc.) and is approved by the Component shall be 

used instead.” 

Management Controls 

ICE’s implementation of management controls at El Segundo did 

not conform fully to DHS policies. For example, ICE did not 

provide a system security plan that included the IT assets located at 

the El Segundo Field Office. Additionally, ICE’s server and 

telecommunications equipment uses the CBP backbone for 

connectivity. However, ICE did not have an interconnection 

security agreement (ISA) between ICE and CBP for use of this 

system connectivity. These management controls deficiencies 

increase the risk to ICE’s IT investments, systems, and data from 

new threats and vulnerabilities for which safeguards have not been 

implemented. 

According to the DHS 4300A: 

“Component [Information Systems Security Managers] 

ISSMs shall ensure that a risk assessment is conducted 

whenever any modifications are made to sensitive IT 

systems, networks, or to their physical environments, 

interfaces, or user community. SSPs shall be updated and 

re-certification conducted if warranted.” 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 20 
 

 

According to the DHS 4300A Handbook: 

“Components shall document interconnections with other 

external networks with an Interconnection Security 

Agreement (ISA).” 

********** 

“Interconnections between DHS Components shall require 

an ISA when there is a difference in the security 

categorizations for confidentiality, integrity, and 

availability for the two networks. ISAs shall be signed by 

both DAAs or by the official designated by the DAA to 

have signatory authority.” 

Recommendations 

We recommend that the ICE CIO take the following actions for 

ICE activities at LAX: 

Recommendation #8: Implement stronger physical security to 

protect ICE’s IT assets from possible loss, theft, destruction, 

accidental damage, hazardous conditions, fire, malicious actions, 

and natural disasters. 

Recommendation #9: Provide an adequate HVAC system for the 

server room or obtain a waiver from the DAA. 

Recommendation #10: Use a connection protocol that employs 

secure authentication. 

Recommendation #11: Apply the necessary operating system 

upgrades to the server. 

Recommendation #12: Eliminate or disable unnecessary ports 

from the server and router. 

Recommendation #13: Establish and maintain the required 

interconnection security agreements. 

Recommendation #14: Include the IT assets at the El Segundo 

Field Office in the system security plan for the Special Agent in 

Charge, West Region. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 21 
 

 

Management Comments and OIG Analysis 

In the comments, ICE concurred with recommendations 8 through 

12. These recommendations will be considered resolved but open 

pending verification of all planned actions. ICE did not concur 

with recommendations 13 and 14. 

According to ICE, the deficiency associated with recommendation 

13 is not applicable as both systems would have an aggregate 

security categorization of ‘high.’ 

Additionally, according to ICE, the deficiency associated with 

recommendation 

 However, according to DHS 4300A, Attachment D, 

Type Accreditation: 

“The documentation contains two critical types of 

information: 

o	 Site-specific details (e.g., deviations to 

functionality, configurations, and physical controls) 

o	 Site-specific risk analysis (e.g., additional risks that 

are perpetrated by the deviations at the site)” 

 We maintain that ICE should 

comply with DHS 4300A and include the El Segundo Field Office 

in the appropriate system security plan. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 22 
TSA Did Not Comply Fully With DHS Sensitive System Policies 

TSA could strengthen operational, technical, and management controls for 

its servers, router, and switches operating at LAX. For example, TSA 

could remove excess storage from its server room, implement fire 

suppression, and ensure that the most recent software security patches are 

installed on its server, router, and switches. Additionally, not all TSA IT 

resources at LAX are included in the TSA system inventory. Collectively, 

these deficiencies could place at risk the confidentiality, integrity, and 

availability of the data stored, transmitted, and processed by TSA at LAX. 

Operational Controls 

Onsite implementation of operational controls that did not conform 

fully to DHS policies included excess storage near computer 

equipment and inadequate environmental controls. Specifically, 

TSA could better protect its IT assets by ensuring that the 

immediate areas around the server and communication equipment 

are not used for general storage. 

Physical Security 

TSA administrative functions for LAX operations are performed in 

an offsite facility where TSA has several rooms with IT 

equipment. Although, these rooms are behind several locked 

doors, TSA needs to improve its physical security. For example, 

the server room at this location was being used to store new 

equipment as well as old equipment prior to disposal. There were 

also two unbraced shelves that could hinder access to the TSA 

servers, router, and switches following an earthquake. Figure 6 

illustrates the condition of the TSA server room. 

Additionally, the TSA telecommunications room in the logistics 

department contains a switch and a server that were not in a locked 

cabinet. This room was also used to store some non-IT related 

items. Further, TSA has a switch in another room that also was not 

in a locked cabinet. 

The examples mentioned above increase the risk of accidental loss 

of power or damage to IT resources supporting TSA operations at 

LAX. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 23 
 

According to the DHS 4300A Handbook, 

“Controls for deterring, detecting, restricting, and 

regulating access to sensitive areas shall be in place and 

will be sufficient to safeguard against possible loss, theft, 

destruction, damage, hazardous conditions, fire, malicious 

actions, and natural disasters.” 

Figure 6: TSA server room used for storage 

Environmental Controls 

TSA also could improve environmental controls for its IT assets. 

For example, the temperature was 76.7 degrees Fahrenheit in the 

telecommunications room in the logistics department. Further, 

TSA was using a portable fan to cool down the switch mounted on 

the wall and the stand-alone server underneath the table. Figure 7 

illustrates the condition of the TSA telecommunications room at 

LAX. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 24 
Figure 7: Portable fan used to cool switch and server area 

TSA’s communications equipment was also at risk of failure 

because of the absence of temperature or humidity sensors in the 

communications rooms. The absence of environmental sensors 

and proper HVAC for IT equipment increases the risk that TSA’s 

IT assets may malfunction. 

According to the DHS 4300A Handbook, 

“The condition of the air is important to prevent damage to 

IT equipment.” 

Additionally, TSA did not have a fire suppression system in place 

at LAX. Specifically, no water sprinklers or fire extinguishers 

were at the server room or telecommunication closets. The 

absence of an adequate fire suppression system places TSA’s IT 

assets at risk of possible loss, destruction, damage, hazardous 

conditions, fire, malicious actions, and natural disasters. As a 

compensating control, TSA has already deployed fire extinguishers 

to resolve this deficiency. 

According to the DHS 4300A Handbook: 

“When a centralized fire suppression system is not 

available, fire extinguishers should be readily available.” 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 25 
Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 26 

Technical Controls 

TSA’s implementation of technical controls at LAX that did not 

conform fully to DHS policies include inadequate access controls, 

insecure communications protocols, and open ports with known 

vulnerabilities. These deficiencies increase the risk that TSA IT 

systems used at LAX are vulnerable to internal attacks. 

Access Controls 

Configuration management for the TSA server needs to be 

strengthened. Specifically, the Lightweight Directory Access 

Protocol is configured to allow anonymous access to the TSA 

server. As a result, an unauthorized user or a hacker could log in 

to the system without proper credentials. 

Additionally, the Windows built-in user group “EVERYONE” was 

configured to allow full control and access to shared data. This 

may allow an unauthenticated user to upload malicious code onto a 

shared resource. 

The purpose of access controls is to protect against the 

unauthorized disclosure, modification, or destruction of data 

residing in these systems, as well as the applications themselves. 

Automated systems are vulnerable to fraudulent or malicious 

activity by anyone with the authority or capability to access 

information not required to perform their duties. 

According to the DHS 4300A Handbook: 

“To protect sensitive information and limit the damage that 

can result from accident, error, or unauthorized use, the 

principle of least privilege must be applied. The principle 

of least privilege requires that users be granted the most 

restrictive set of privileges (or lowest clearance) needed for 

performance of authorized tasks—i.e., users should be able 

to access only the system resources needed to fulfill their 

job responsibilities.” 

Insecure Communications Protocols 

TSA’s switches at LAX were not properly configured to prevent an 

insider from gaining unauthorized privileges and information. For 

example, telnet was being used on a TSA switch at LAX. 

However, telnet does not encrypt login and password credentials. 

This may allow an attacker to capture login credentials and 
remotely take control of the router and change or delete 

configuration files. 

Additionally, the File Transfer Protocol (FTP) port 21 was active, 

leaving the device vulnerable to unauthorized access. FTP is not 

permitted on DHS systems due to the potential risk when used for 

non-administrative purposes. For instance, just like telnet, FTP 

transmits login and password credentials in clear text. 

According to DHS Directive 4300A: 

“Telnet shall not be used to connect to any DHS computer. 

A connection protocol such as Secure Shell (SSH) that 

employs secure authentication (two factor, encrypted, key 

exchange, etc.) and is approved by the Component shall be 

used instead.” 

************ 

“File Transfer Protocol (FTP) shall not be used to connect 

to or from any DHS computer. A connection protocol that 

employs secure authentication (two factor, encrypted, key 

exchange, etc.) and is approved by the Component shall be 

used instead.” 

Vulnerable Services 

TSA’s servers, router, and switches at LAX have numerous open 

ports and services on its system that may not be necessary. For 

example, the following services with known vulnerabilities were 

running: 

•	 The server was configured to allow Domain Name 

System zone transfers to be performed. This 

potentially poses a security risk of denial of service 

attacks. 

•	 Web Server was running on a nonstandard port. 

•	 The version of Internet Information Services running 

on the system is vulnerable to denial of service attacks. 

Additionally, the Null session was configured to allow a user to 

connect to the system without authentication. An attacker could 

potentially exploit the null session to gain a list of usernames and 

other potentially sensitive information. Unnecessary open ports 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 27 
and services increase the risk that TSA systems may be 

compromised by malicious users or external attacks. 

According to DHS Directive 4300A: 

“Components shall manage systems to reduce 

vulnerabilities through vulnerability testing, promptly 

installing patches, and eliminating or disabling unnecessary 

services, if possible.” 

Management Controls 

TSA’s implementation of management controls at LAX did not 

conform fully to DHS policies. Specifically, not all TSA IT 

resources at LAX are accounted for in its system inventory. For 

example, the logistics server and database are not included in the 

TSA system inventory or the TSA certification and accreditation 

process. TSA management cannot be assured that IT systems and 

data are adequately secured unless the various activities leading to 

accreditation are performed and the DAA has accepted in writing 

the risks associated with operating the systems. 

These management controls deficiencies increase the risk to TSA’s 

IT investments, systems, and data from new threats and 

vulnerabilities for which safeguards have not been implemented. 

According to DHS 4300A Handbook: 

“The initial Risk Assessment is updated and revised and 

becomes the final Risk Assessment as part of the overall 

accreditation process after the controls are implemented 

and tested and the results/corrective actions are 

implemented. Through the development of the final Risk 

Assessment, the definition of the program residual risk can 

be determined for the DAA’s acceptance during 

accreditation.” 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 28 
Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Recommendations 

We recommend that the TSA CIO take the following actions for 

TSA activities at LAX: 

Recommendation #15: Improve its physical and environmental 

controls to protect TSA’s IT assets from possible accidental 

damage, hazardous conditions, fire, malicious actions, and natural 

disasters. 

Recommendation #16: Use a connection protocol that employs 

secure authentication. 

Recommendation #17: Eliminate or disable unnecessary ports 

from the servers, router, and switches. 

Recommendation #18: Ensure that all IT systems are included in 

TSA’s inventory. 

Management Comments and OIG Analysis 

In the comments, TSA concurred with recommendations 15 

through 18. These recommendations will be considered resolved 

but open pending verification of all planned actions. 

USCG Did Not Comply Fully With DHS Sensitive System 

Policies 

USCG could strengthen operational and technical controls for its server, 

router, and switches operating at LAX. For example, USCG back-up 

tapes should be stored in an off-site facility. Additionally, USCG could 

strengthen access controls and ensure that only necessary ports are open 

on its server, router, and switches. 

 Collectively, these 

deficiencies could place at risk the confidentiality, integrity, and 

availability of the data stored, transmitted, and processed by USCG at 

LAX. 

Operational Controls 

Onsite implementation of operational controls that did not conform 

fully to DHS policies included USCG IT assets that were not in a 

locked cabinet. Further, USCG needs to better safeguard its 

sensitive data stored on back-up tapes. Unauthorized personnel 

Page 29 
 

 

may have access to USCG IT assets and sensitive data stored in the 

back-up tapes. Figure 8 below illustrates USCG’s open-rack pack 

with its back-up tapes stored in the USCG server room. 

 To ensure the availability and 

integrity of USCG data, back-up tapes should be stored in an offsite facility accessible by authorized personnel only. 

According to the DHS 4300A Handbook: 

“Components shall ensure backup media are stored off site 

in accordance with their business continuity and IT 

Contingency plans.” 

Technical Controls 

USCG’s implementation of technical controls at LAX that did not 

conform fully to DHS policies include access control and password 

management requirements. 

These deficiencies increase the 

risk that USCG IT systems used at LAX are vulnerable to internal 

attacks. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 30 
 

Access Controls 

Excess privilege given to users can put USCG data at risk by 

allowing insiders and others the opportunity to penetrate a system. 

This could result in the loss, theft, or destruction of USCG data. 

Additionally, USCG could strengthen password policies on its 

LAX systems. 

According to the DHS 4300A Handbook: 

“To protect sensitive information and limit the damage that 

can result from accident, error, or unauthorized use, the 

principle of least privilege must be applied. The principle 

of least privilege requires that users be granted the most 

restrictive set of privileges (or lowest clearance) needed for 

performance of authorized tasks—i.e., users should be able 

to access only the system resources needed to fulfill their 

job responsibilities.” 

System Patches 

According to our technical scans, 

USCG data 

may be compromised if patches are not installed in a timely 

fashion. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 31 
 

 

 

 

 

Vulnerable Services 

Unnecessary open ports and services increase the risk that USCG’s 

systems at LAX may be compromised by malicious users or 

external attacks. 

According to DHS Directive 4300A: 

“Components shall manage systems to reduce 
 

vulnerabilities through vulnerability testing, promptly 
 

installing patches, and eliminating or disabling unnecessary 
 

services, if possible.” 
 

Insecure Communications Protocols 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 32 
According to DHS Directive 4300A: 

“Telnet shall not be used to connect to any DHS computer. 

A connection protocol such as Secure Shell (SSH) that 

employs secure authentication (two factor, encrypted, key 

exchange, etc.) and is approved by the Component shall be 

used instead.” 

Management Controls 

We did not find any reportable management control deficiencies 

for the USCG site at LAX. 

Recommendations 

We recommend that the USCG CIO take the following actions for 

USCG activities at LAX: 

Recommendation #19: Store back-up tapes in an off-site facility. 

Recommendation #20: Implement the password policy 

established by DHS Directive 4300A. 

Recommendation #21: Develop a process for implementing 

identified patches in a timely fashion. 

Recommendation #22: Eliminate or disable unnecessary ports 

from the server and router. 

Recommendation #23: Use a connection protocol that employs 

secure authentication. 

Management Comments and OIG Analysis 

In the comments, USCG concurred with recommendations 19 

through 23. These recommendations will be considered resolved 

but open pending verification of all planned actions. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

Page 33 
Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 34

 

Appendix A

Purpose, Scope, and Methodology 

Purpose, Scope, and Methodology 

This review is part of a program to evaluate, on an ongoing basis, 

the implementation of DHS technical and information security 

policies and procedures at DHS sites. The objective of this 

program is to determine the extent to which critical DHS sites 

comply with the department’s technical and information security 

policies and procedures, according to DHS Directive 4300A and its 

companion document, the DHS 4300A Handbook. 

We coordinated the implementation of this technical security 

evaluation program with the DHS Chief Information Security 

Officer (CISO). We mutually agreed to the wording for the Rules 

of Behavior for the technical testing.9 Our entrance and exit 

conferences were held with DHS components officials. 

Technical evaluations were performed only after the DHS CISO 

and DHS components official agreed to our negotiated Rules of 

Behavior. These technical evaluations included: 

•	 Security scans of the servers, routers, and switches 

using various software packages, and 

•	 Scans to determine whether wireless devices were 

being used by DHS components. 

We reviewed applicable DHS and components’ policies and 

procedures, and components’ responses to our site surveys and 

technical questionnaires. For example, we used components’ 

responses to identify occupied space, server rooms, and 

telecommunications closets. Our onsite review included a physical 

review of components’ space and interviews with components 

staff. 

Our technical review included technical scans of security controls 

as well as scans for DHS wireless devices operating at LAX. 

Additionally, we reviewed guidance provided by DHS to the 

components in the areas of patch management, operation systems, 

and wireless security. 

We provided components with briefings concerning the results of 

fieldwork and the information summarized in this report. We 

conducted this review between September 2007 and March 2008. 

9

 The Rules of Behavior established the boundaries and schedules for the technical evaluations. 
 

Appendix A

Purpose, Scope, and Methodology 

We performed our work according to the Quality Standards for 

Inspection of the President’s Council on Integrity and Efficiency 

and pursuant to the Inspector General Act of 1978, as amended. 

We appreciate the efforts by DHS management and staff to provide 

the information and access necessary to accomplish this review. 

Our points of contact for this report are Frank Deffer, Assistant 

Inspector General for Information Technology, (202) 254-4100, 

and Roger Dressler, Director for Information Systems and 

Architectures, (202) 254-5441. Major OIG contributors to the 

review are identified in Appendix C. 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 35 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 36 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 37 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 38 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 39 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 40 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 41 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 42 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 43 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 44 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 45 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 46 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 47 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 48 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport – 

(Redacted) 

 Page 49 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 50 
 

Appendix B 

Management’s Response to the Draft Report 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 51 
 

Appendix C 

Major Contributors to This Report 

Roger Dressler, Director, Department of Homeland Security, 

Information Technology Audits 

Kevin Burke, Audit Manager, Department of Homeland Security, 

Information Technology Audits 

Domingo Alvarez, Senior Auditor, Department of Homeland 

Security, Information Technology Audits 

Ernie Bender, Senior Auditor, Department of Homeland Security, 

Information Technology Audits 

Karen Nelson, Senior Auditor, Department of Homeland Security, 

Information Technology Audits 

Matthew Worner, Program Analyst, Department of Homeland 

Security, Information Technology Audits 

Syrita Morgan, Management and Program Assistant, Department 

of Homeland Security, Information Technology Audits 

Richard Saunders, Director, Department of Homeland Security, 

Advanced Technology Division 

Steve Matthews, Manager, Department of Homeland Security, 

Advanced Technology Division 

Jeffrey Devine, Technical Evaluator, Department of Homeland 

Security, Advanced Technology Division 

Sukhonthip Rueangvivatanakij, Technical Evaluator, Department 

of Homeland Security, Advanced Technology Division 

Shannon Frenyea, Referencer 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 52 
 

Appendix D 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Under Secretary, Management 

Assistant Secretary, Office of Policy 

Assistant Secretary, Office of Public Affairs 

Assistant Secretary, Office of Legislative Affairs 

Chief Information Officer (CIO), DHS 

Chief Privacy Officer 

Deputy CIO, DHS 

Chief Information Security Officer, DHS 

Chief Information Security Officer, CBP 

Chief Information Security Officer, ICE 

Chief Information Security Officer, TSA 

Chief Information Security Officer, USCG 

Information Systems Security Manager, CBP 

Information Systems Security Manager, ICE 

Information Systems Security Manager, TSA 

Information Systems Security Manager, USCG 

DHS Audit Liaison 

CBP Audit Liaison 

ICE Audit Liaison 

TSA Audit Liaison 

USCG Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

Technical Security Evaluation of DHS Activities at Los Angeles International Airport 

(Redacted) 

 Page 53 
ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.