INFORMATION ACCESS PROGRAM 

Inspection Report 

Office of Intelligence and 

Counterintelligence Internal Controls 

Over the Department of Energy’s 

Sensitive Compartmented Information 

Access Program 

DOE/IG-0790 March 2008 

U.S. Department of Energy 

Office of Inspector General 

Office of Inspections and Special Inquiries 


OFFICE OF INTELLIGENCE AND COUNTERINTELLIENCE 

INTERNAL CONTROLS OVER THE DEPARTMENT OF 

ENERGY’S SENSITIVE COMPARTMENTED INFORMATION 

ACCESS PROGRAM 

TABLE OF 

CONTENTS 

OVERVIEW 

Introduction and Objective 1 

Observations and Conclusions 2 

DETAILS OF FINDINGS 

Background 3 

Removal from SCI Roster 3 

Administrative Debriefing 4

Employment Status Change 5 

Incomplete Nondisclosure Agreements 6 

RECOMMENDATIONS 7 

MANAGEMENT COMMENTS 7 

INSPECTOR COMMENTS 7 

APPENDICES

A. Scope and Methodology 8 

B. Related OIG Reports 9 

C. Management Comments 10 
Overview 

Page 1 Office of Intelligence and Counterintelligence 

 Internal Controls over the Department of 

 Energy’s Sensitive Compartmented 

 Information Access Program 

INTRODUCTION The Department of Energy (DOE) is 1 of the 16 members of the 

AND OBJECTIVES U.S. Government’s Intelligence Community and serves as the 

 premier technical intelligence resource in the areas of nuclear 

weapons, nonproliferation, energy, science, and technology and 

emerging nuclear threats. In addition to providing intelligence 

analyses, DOE offers specialized technology development and 

operational support to both intelligence and law enforcement 

agencies. DOE accomplishes its intelligence mission by drawing 

from broad technical expertise located throughout the Department 

complex, including the National Laboratories, and uses Sensitive 

Compartmented Information (SCI) that is shared between members 

of the Intelligence Community. SCI is a designation given to 

classified information derived from intelligence sources, methods, 

or analytical processes that requires formal access control systems. 

 DOE’s Office of Intelligence and Counterintelligence (IN) is 

responsible for granting SCI access to DOE Federal and contractor 

employees who need access to such intelligence information. 

Individuals must have an active Top Secret or “Q” clearance to be 

granted SCI access authorization. 

 The objective of this inspection was to determine if IN had 

adequate internal controls for granting, maintaining, and 

terminating SCI access authorizations to DOE Federal and 

contractor employees. As of December 2006, there were 5,240 

SCI access holders across the DOE complex. This review focused 

on the 969 Federal and contractor employees listed on the 

Headquarters SCI access roster. The Office of Inspector General 

(OIG) is currently completing a second review of internal controls 

over SCI access from a field element perspective. 
Page 2 Observations and Conclusions

OBSERVATIONS AND We concluded that IN did not have adequate internal controls over 

CONCLUSIONS its SCI access program. From a judgmental sample of 199 of the 

969 individuals on the Headquarters SCI access roster, we found 

that: 

• IN was not timely in removing individuals from the SCI access 

roster who no longer needed SCI access: 17 individuals who 

had already left the Department or had been debriefed from SCI 

access remained on the Headquarters SCI roster; 

• Five individuals apparently were “administratively debriefed” 

from SCI access by IN without that office making all attempts 

to contact those individuals to ensure they received instructions 

regarding their continued obligation to safeguard SCI. 

(Administrative debriefing occurs when an official from IN 

annotates the individual’s Debriefing Acknowledgement 

indicating that he/she is “Unavailable to Sign”); 

• Four individuals did not properly rejustify their need for 

continued SCI access as a result of job or employment status 

change; and, 

• Five nondisclosure agreements for SCI access, which serve as 

legal agreements between the individual and the Government, 

were not properly signed or witnessed. 

Past reviews by the OIG at various DOE sites have identified 

weaknesses in the internal controls designed to ensure individuals’ 

security clearances and accesses are terminated appropriately and 

expeditiously. (A list of the associated reports is located in 

Appendix B.) IN established an SCI debriefing policy in response 

to one of those reviews. However, based upon our findings during 

this review, we remain concerned that IN is not following existing 

policies and believe that IN needs to establish additional internal 

controls, such as periodic internal reviews, to ensure that 

requirements are followed regarding granting, maintaining, and 

terminating SCI access. 
Details of Findings 

Page 3 Details of Findings 

BACKGROUND We reviewed a judgmental sample of 199 (20 percent) of the 969 

Federal and contractor employees listed on the Headquarters SCI 

access authorization roster as of December 2006. 

Pursuant to DOE Order 5639.8A, “Security of Foreign Intelligence 

Information and Sensitive Compartmented Information Facilities,” 

the Department must implement Director of Central Intelligence 

Directives (DCIDs) 1/19 and 6/4 for the protection of SCI. 

DCID 1/19, “Security Policy for Sensitive Compartmented 

Information and Security Policy Manual,” establishes the policies 

and procedures for the security, dissemination, and use of SCI. 

DCID 6/4, “Personnel Security Standards and Procedures 

Governing Eligibility for Access to Sensitive Compartmented 

Information,” establishes the standards, procedures, and security 

programs for the protection of SCI. 

As a result of a previous OIG report published in 2006, IN 

produced the “Sensitive Compartmented Information Debriefing 

Policy No. 001-06.” This policy established criteria and guidelines 

to administer debriefings, including administrative debriefings. 

REMOVAL FROM We found that IN was not timely in removing individuals from the 

SCI ROSTER SCI access roster who no longer needed SCI access. Specifically, 

17 individuals who had already left the Department or had been 

debriefed from SCI access remained on the Department’s SCI 

roster. DCID 1/19 states that when a previously established needto-know no longer exists due to reorganization, reassignment, 

change in duties, or any other reason, the SCI access shall be 

cancelled and the individual debriefed from SCI. Debriefing is the 

final instruction provided to individuals regarding their continued 

obligation for safeguarding SCI, as defined by DCID 6/4. An IN 

official told us that an individual is terminated from SCI access 

when the individual is debriefed. 

We determined that 14 of the 17 individuals had left DOE but had 

not been debriefed and removed from the SCI access roster. Based 

on the separation dates, these individuals remained on the SCI 

roster between 2 months and 64 months after their departure or the 

termination of their DOE clearance. In one instance, IN received a 

request from the National Nuclear Security Administration to delay 

removal of an individual from the SCI roster for a few months and 

allowed that individual to remain on the roster after his departure 

from DOE. However, IN did not follow up on the issue, and the 

individual remained on the roster 11⁄2 years later, until we identified 

the lapse. Further, as noted previously, a Q or Top Secret
Page 4 Details of Findings 

clearance is a prerequisite to having SCI access. We were told by 

IN that if a Q clearance were terminated, then the SCI access 

would also be discontinued immediately. Yet we determined that 

3 of the 14 individuals had their Q clearances terminated in August 

2001, June 2006, and September 2006, respectively. The 

individual whose Q clearance was terminated in August 2001 was 

detailed to DOE from another agency and should have been 

removed from DOE’s SCI roster when he left. Responsible IN 

officials were unaware of the detailee’s departure until we brought 

the issue to their attention. 

Finally, we identified that the remaining 3 of the 17 individuals 

from the roster had been debriefed from SCI and had signed the 

requisite out-processing SCI nondisclosure agreement, yet they 

were still listed as holding SCI access authorizations. These 

individuals remained on the SCI roster between 9 and 27 months 

after having been debriefed from SCI. An IN official agreed that 

these individuals should not have been on the SCI roster.

The Intelligence Community maintains a database of the current 

status of individuals’ clearances and SCI accesses. Failure to 

remove DOE individuals from the SCI roster could result in 

inaccurate reporting to the Intelligence Community and cause other 

agencies to rely on inaccurate clearance and access information, 

resulting in individuals potentially gaining access to SCI with 

expired authorizations. 

ADMINISTRATIVE We found that five individuals apparently were administratively 

DEBRIEFING debriefed from SCI access by IN without IN making all attempts to 

contact those individuals to ensure they received instructions 

regarding their continued obligation to safeguard SCI. 

Debriefing from SCI is intended to remind individuals of their 

continued obligation to safeguard SCI and to have them sign a 

nondisclosure agreement. Pursuant to DCID 6/4, the debriefing 

includes, among other things, reading appropriate sections of U.S. 

laws regarding espionage and unauthorized disclosure of classified 

information; acknowledging lack of possession of any documents 

containing SCI; and agreeing to report to the Federal Bureau of 

Investigation information regarding any attempt by an individual to 

solicit classified information. IN’s “Sensitive Compartmented 

Information Debriefing Policy No. 001-06” states that all attempts 

should be made for a personal debriefing (in-person, by telephone, 

or by mail) and that administrative debriefings should only be 

performed under extenuating circumstances, such as medical 

illness or death. Administrative debriefing occurs when an official 
Page 5 Details of Findings 

from IN annotates the individual’s Debriefing Acknowledgement 

indicating that he/she is “Unavailable to Sign.” 

In five instances, when the OIG informed an IN official that there 

were individuals who had left DOE and were still on the SCI 

roster, the IN official contacted the program offices that had 

employed the individuals and verified that the individuals had left 

DOE and should no longer have been on the SCI roster. 

Regarding two of these individuals, the IN official, in the presence 

of the OIG, signed the debriefing forms stating that the individuals 

were administratively debriefed, without making any further 

attempt to locate these individuals for an actual debriefing. 

Regarding the other three individuals, we had concerns that they 

were similarly administratively debriefed after we identified that 

they were still on the SCI roster. Although we did not observe the 

action taken by the IN official to follow up on the individuals’ 

unsigned debriefing forms, subsequently we observed that all three 

forms were simply signed by an IN official. This was done within 

one day of IN having been notified by the OIG that the individuals 

should have been removed from the SCI roster. The forms were 

not signed by the individuals, there was no statement on each 

debriefing form that the individual was unavailable to sign for the 

debriefing, and there was nothing in the files to indicate IN had 

made any attempts to locate the individuals. 

EMPLOYMENT We found that four individuals did not properly rejustify their need 

STATUS CHANGE for continued SCI access as a result of job or employment status 

change. These employees had transferred internally within DOE 

or had changed from Federal to contractor employee status. 

DCID 1/19 states that when a previously established need-to-know 

no longer exists due to reorganization, reassignment, change in 

duties, or any other reason, the SCI access shall be cancelled and 

the individual debriefed from SCI. We were told by an IN official 

that if an individual transfers to another program office, becomes a 

contract employee, or has changed personnel status, that 

individual’s need for SCI must be rejustified or terminated. 

We were told by an IN official that one way that IN can determine 

a change in personnel status is through self-reporting during the 

biennial SCI security refresher training. Despite this apparent 

safeguard, one of the individuals we had identified had transferred 

to another program office more than two years earlier and had 

subsequently attended SCI refresher training. After we identified 
Page 6 Details of Findings 

the issue, IN determined that the individual no longer needed SCI 

access, and he was subsequently debriefed. 

The second employee we identified had retired from Federal 

service in 2002, became a contract employee in the same office 

doing the same work, but did not have an SCI rejustification, as 

required. An IN official agreed that the employee’s office should 

have rejustified the individual’s SCI access. 

The third employee we identified had transferred to another 

program office several months prior. IN officials were unaware of 

this personnel change and subsequently had the individual provide 

another justification for maintaining SCI access. 

The fourth employee we identified had transferred to another 

program office, and the rejustification document submitted for the 

employee was signed by his supervisor, who did not have SCI 

access. DCID 1/19 states that a “need-to-know” determination 

should be made by an authorized individual, having the appropriate 

security clearances and access approvals, certifying that a 

prospective SCI recipient requires access to specific classified 

information to perform his duty. Upon our inquiry, IN verified 

that the individual’s supervisor did not have SCI access and could 

not have properly made the request. IN subsequently approved a 

properly executed rejustification request for the individual. 

INCOMPLETE We found that five nondisclosure agreements for SCI access, 

NONDISCLOSURE which serve as legal agreements between the individual and the 

AGREEMENTS Government, were not properly signed or witnessed. In three 

instances, the portion of the nondisclosure agreement form 

acknowledging an understanding of the responsibilities for holding 

SCI access was not signed by the individuals, as required. The 

remaining two nondisclosure agreements were not signed by an IN 

witness and the section of the form acknowledging security 

briefing indoctrination was not signed by the individual receiving 

the SCI access. 

DCID 1/19 states that, as a provision of access to SCI, individuals 

must sign an authorized nondisclosure agreement and that failure 

to do so is cause for denial or revocation of existing SCI access. 

The nondisclosure agreement serves as a legal agreement between 

the individual and the Government that the individual has been 

granted SCI access and that the individual understands his 

obligations and the criminal penalties for any unauthorized 

disclosure of SCI. An IN official agreed that the forms should 
Page 7 Recommendations 

 Management and Inspector Comments 

have been properly signed and subsequently had the individuals 

sign and properly complete the nondisclosure agreements. 

RECOMMENDATIONS We recommend that the Director, Office of Intelligence and 

Counterintelligence, ensures that the policies for granting, 

maintaining, and terminating SCI access are followed so that: 

1. Individuals no longer requiring SCI access are removed from 

the Department’s SCI roster on a timely basis; 

2. Debriefings are completed in accordance with IN policy; 

3. Nondisclosure agreements are properly executed; and 

4. A periodic review of SCI access holders is accomplished at 

Headquarters and throughout the Department complex to 

ensure that all SCI access program requirements, including 

both employment status and rejustification of access, are being 

followed. 

MANAGEMENT In comments to a draft version of this report, IN management 

COMMENTS concurred with our recommendations and identified corrective 

actions. Management’s comments are included in their entirety at 

Appendix C. 

INSPECTOR We found management’s comments to be responsive to our 

COMMENTS recommendations. 

 
Appendix A 

Page 8 Scope and Methodology 

SCOPE AND We conducted our inspection fieldwork between December 2006 

METHODOLOGY and May 2007. We interviewed officials from DOE’s Office of 

 Intelligence and Counterintelligence and DOE’s Office of Health, 

Safety and Security. We reviewed applicable policies and 

procedures pertaining to SCI access. We obtained an SCI roster of 

DOE Headquarters individuals and reviewed the SCI access 

personnel files of select individuals on the SCI roster. 

As part of our review, we evaluated implementation of the 

“Government Performance and Results Act of 1993” in the context 

of activities included in our review. We did not identify any 

performance measure issues regarding DOE’s SCI access program.

 This inspection was conducted in accordance with the “Quality 

Standards for Inspections” issued by the President’s Council on 

Integrity and Efficiency. 
Appendix B 

Page 9 Related OIG Reports 

RELATED OIG The following OIG reports involve work similar to this inspection: 

REPORTS 

• “Selected Aspects of the East Tennessee Technology Park's 

Security Clearance Retention Process” (DOE/IG-0779, 

October 2007); 

• “Badge Retrieval and Security Clearance Termination at 

Sandia National Laboratory-New Mexico” (DOE/IG-0724, 

April 2006); 

• “Security Clearance Terminations and Badge Retrieval at the 

Lawrence Livermore National Laboratory” (DOE/IG-0716, 

January 2006); 

• “Security and Other Issues Related to Out-Processing of 

Employees at Los Alamos National Laboratory” 

(DOE/IG-0677, February 2005); 

• “Personnel Security Clearances and Badge Access Controls 

at Selected Field Locations” (DOE/IG-0582, January 2003); 

and 

• “Personnel Security Clearances and Badge Access Controls 

at Department Headquarters” (DOE/IG-0548, March 2002). 
Appendix C 

Page 10 Management Comments 
Appendix C (continued) 

Page 11 Management Comments 
Appendix C (continued) 

Page 12 Management Comments 
IG Report No. DOE/IG-0790 

CUSTOMER RESPONSE FORM 

The Office of Inspector General has a continuing interest in improving the usefulness of its 

products. We wish to make our reports as responsive as possible to our customers’ requirements, 

and, therefore, ask that you consider sharing your thoughts with us. On the back of this form, 

you may suggest improvements to enhance the effectiveness of future reports. Please include 

answers to the following questions if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 

procedures of the inspection would have been helpful to the reader in understanding this 

report? 

2. What additional information related to findings and recommendations could have been 

included in the report to assist management in implementing corrective actions? 

3. What format, stylistic, or organizational changes might have made this report’s overall 

message clearer to the reader? 

4. What additional actions could the Office of Inspector General have taken on the issues 

discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may contact you should we have 

any questions about your comments. 

Name Date 

Telephone Organization 

When you have completed this form, you may telefax it to the Office of Inspector General at 

(202) 586-0948, or you may mail it to: 

Office of Inspector General (IG-1) 

Department of Energy 

Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 

Inspector General, please contact Judy Garland-Smith at (202) 586-7828. 
The Office of Inspector General wants to make the distribution of its reports as customer friendly and cost 

effective as possible. Therefore, this report will be available electronically through the Internet at the 

following address: 

U.S. Department of Energy Office of Inspector General Home Page 

http://www.ig.doe.gov

Your comments would be appreciated and can be provided on the Customer Response Form 

attached to the report.