U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

63–238 PDF 2010

A REVIEW OF CONTINUING SECURITY CONCERNS 

AT DOE’S NATIONAL LABORATORIES 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT AND 

INVESTIGATIONS 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TENTH CONGRESS 

SECOND SESSION 

SEPTEMBER 25, 2008 

Serial No. 110–152 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

JOHN D. DINGELL, Michigan, Chairman 

HENRY A. WAXMAN, California 

EDWARD J. MARKEY, Massachusetts 

RICK BOUCHER, Virginia 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BART GORDON, Tennessee 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

BART STUPAK, Michigan 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

Vice Chair 

LOIS CAPPS, California 

MIKE DOYLE, Pennsylvania 

JANE HARMAN, California 

TOM ALLEN, Maine 

JAN SCHAKOWSKY, Illinois 

HILDA L. SOLIS, California 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

DARLENE HOOLEY, Oregon 

ANTHONY D. WEINER, New York 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

CHARLIE MELANCON, Louisiana 

JOHN BARROW, Georgia 

BARON P. HILL, Indiana 

DORIS O. MATSUI, California 

JOE BARTON, Texas 

Ranking Member 

RALPH M. HALL, Texas 

FRED UPTON, Michigan 

CLIFF STEARNS, Florida 

NATHAN DEAL, Georgia 

ED WHITFIELD, Kentucky 

BARBARA CUBIN, Wyoming 

JOHN SHIMKUS, Illinois 

HEATHER WILSON, New Mexico 

JOHN SHADEGG, Arizona 

CHARLES W. ‘‘CHIP’’ PICKERING, 

Mississippi 

VITO FOSSELLA, New York 

ROY BLUNT, Missouri 

STEVE BUYER, Indiana 

GEORGE RADANOVICH, California 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE FERGUSON, New Jersey 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

PROFESSIONAL STAFF

DENNIS B. FITZGIBBONS, Chief of Staff 

GREGG A. ROTHSCHILD, Chief Counsel 

SHARON E. DAVIS, Chief Clerk 

DAVID L. CAVICKE, Minority Staff Director 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

BART STUPAK, Michigan, Chairman 

DIANA DeGETTE, Colorado 

CHARLIE MELANCON, Louisiana 

Vice Chairman 

HENRY A. WAXMAN, California 

GENE GREEN, Texas 

MIKE DOYLE, Pennsylvania 

JAN SCHAKOWSKY, Illinois 

JAY INSLEE, Washington 

JOHN D. DINGELL, Michigan (ex officio) 

JOHN SHIMKUS, Illinois 

Ranking Member 

ED WHITFIELD, Kentucky 

GREG WALDEN, Oregon 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

JOE BARTON, Texas (ex officio) 

(III) 

C O N T E N T S 

Page 

Hon. Bart Stupak, a Representative in Congress from the State of Michigan, 

opening statement ................................................................................................ 1 

Hon. John Shimkus, a Representative in Congress from the State of Illinois, 

opening statement ................................................................................................ 3 

Hon. Gene Green, a Representative in Congress from the State of Texas, 

opening statement ................................................................................................ 5 

Hon. Marsha Blackburn, a Representative in Congress from the State of 

Tennessee, opening statement ............................................................................ 5 

Hon. John D. Dingell, a Representative in Congress from the State of Michigan, opening statement ....................................................................................... 6 

Prepared statement .......................................................................................... 8 

Hon. Michael C. Burgess, a Representative in Congress from the State of 

Texas, opening statement .................................................................................... 9 

WITNESSES

Gregory H. Friedman, Inspector General, U.S. Department of Energy .............. 11 

Prepared statement .......................................................................................... 13 

Glenn S. Podonsky, Chief Health, Safety, and Security Officer, U.S. Department of Energy ..................................................................................................... 15 

Prepared statement .......................................................................................... 18 

Gregory C. Wilshusen, Director, Information Security Issues; Accompanied 

by Allison Bowden, Senior Auditor, Government Accountability Office .......... 33 

Prepared statement .......................................................................................... 35 

Bradley A. Peterson, Chief and Associate Director, Defense Nuclear Security, 

National Security Administration ....................................................................... 72 

Prepared statement .......................................................................................... 75 

Thomas N. Pyke, Jr., Chief Information Officer, U.S. Department of Energy ... 90 

Prepared statement .......................................................................................... 92 

Linda R. Wilbanks, Ph.D., Chief Information Officer, National Nuclear Security Administration, U.S. Department of Energy .............................................. 96 

Prepared statement .......................................................................................... 75 

Stanley J. Borgia, Deputy Director for Counterintelligence, Office of Intelligence and Counterintelligence, U.S. Department of Energy .......................... 97 

Prepared statement .......................................................................................... 100 

Michael R. Anastasio, Ph.D., Director, Los Alamos National Laboratory .......... 104 

Prepared statement .......................................................................................... 106 

George H. Miller, Ph.D., Director, Lawrence Livermore National Lab ............... 131 

Prepared statement .......................................................................................... 132 

Thomas O. Hunter, Ph.D., President and Laboratories Director, Sandia National Laboratory .................................................................................................. 138 

Prepared statement .......................................................................................... 141 

SUBMITTED MATERIAL

Letter of September 1, 2008, from Terry D. Turchie to Mr. Dingell ................... 165 

Letter of September 28, 2007, from Thomas P. D’Agostino to Mr. Turchie ........ 169 

Article, ‘‘Scientist accused of selling rocket data to China,’’ The Associated 

Press ...................................................................................................................... 170

Chart entitled ‘‘Total DOE Foreign National Assignees,’’‘‘Scientist accused 

of selling rocket data to China,’’ The Associated Press ..................................... 171 

CRS Report, July 28, 2008 ...................................................................................... 186 

(1) 

A REVIEW OF CONTINUING SECURITY CONCERNS AT DOE’S NATIONAL LABORATORIES 

THURSDAY, SEPTEMBER 25, 2008 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON ENERGY AND COMMERCE, Washington, D.C. 

The subcommittee met, pursuant to call, at 10:09 a.m., in room 

2123, Rayburn House Office Building, Hon. Bart Stupak (chairman 

of the subcommittee) presiding. 

Present: Representatives Stupak, Green, Inslee, DeGette, Dingell 

(ex officio), Shimkus, Burgess, and Blackburn. 

Staff Present: Scott Schloegel, John Sopko, Chris Knauer, Steve 

Futrowsky, Joanne Royce, Kyle Chapman, Alan Slobodin, Peter 

Spencer, and Whitney Drew. 

OPENING STATEMENT OF HON. BART STUPAK, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. STUPAK. This meeting will come to order. Today we have a 

hearing entitled, ‘‘A Review of Continuing Security Concerns at Department of Energy’s National Labs.’’ We’ll start with opening 

statements. I’ll begin. 

Today we’ll hear from several independent sources about security 

problems that continue to plague the Department of Energy’s nuclear weapons labs. We’ll also hear from DOE officials responsible 

for the operations of the labs and then we’ll hear from the lab directors who will tell us what they’re doing to address the shortcomings. 

The Department of Energy’s nuclear weapons labs are home to 

some of the country’s most sensitive secrets and the country’s most 

dangerous nuclear materials. These labs—Sandia, Los Alamos, and 

Lawrence Livermore—employ the world’s most brilliant scientific 

minds, but they’ve also been home to some very serious security 

breaches. 

Los Alamos has historically been our most challenged of the 

three labs. This is the 14th hearing our subcommittee has held into 

security problems at Los Alamos over the past 8 years. We’ve also 

requested numerous Government Accountability Office investigations, which have resulted in countless recommendations for improvements at Los Alamos. Thankfully, the LANL has implemented several changes that appear to be improving the physical 

security posture. Our staff was encouraged by many of the changes 

they saw at the lab with regard to physical security, and these 

views appear to be echoed by the GAO and the Office of IndeVerDate Nov 24 2008 14:39 Jan 10, 2011 Jkt 037690 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 P:\MY DOCS\HEARINGS\110-152 CHRIS
2 

pendent Oversight Reports. We remain optimistic, but guarded, 

that Los Alamos will continue to improve. 

Unfortunately, at the same time that physical security at Los Alamos was improving, Lawrence Livermore National Lab was actually regressing. Earlier this year the Department of Energy’s Office 

of Independent Oversight conducted a force-on-force exercise at 

Lawrence Livermore which, according to GAO testimony, resulted 

in the lab receiving, and I quote, ‘‘the lowest possible ratings for 

protective force performance and for physical protection of classified resources,’’ end of quote. While we are told by lab officials that 

they have made numerous changes to their security force and procedures to correct the problems, we expect to learn exactly why or 

what led to the failures and what corrective measures have been 

put in place to ensure that they will not occur again. 

Physical security is just one component to keeping our nuclear 

secrets safe. The most recent vulnerability is that a host of unauthorized sources are trying to exploit our lab’s cyber networks. The 

Department of Energy’s cyber networks are attacked millions of 

times each month by individuals ranging from a high school kid 

looking for a challenge, to the most sophisticated adversaries who 

are seeking very specific information. 

Today, we will hear concerns about the Department of Energy’s 

cyber security posture from three government entities. 

First, the Government Accountability Office will discuss their report detailing shortcomings of the unclassified computer network at 

Los Alamos National Lab. Moreover, they will document how highly sensitive—but unclassified—information on the Department’s 

network may possibly be pieced together and could become classified information which would be ‘‘a valuable target for foreign governments, terrorists and industrial spies.’’ 

Second, DOE’s Office of Independent Oversight will tell us about 

how a small team of their cyber attack experts, known as a ‘‘Red 

Team,’’ were able to hack into and gain full administrative control 

over two of the Department of Energy’s science lab computer systems. This same team was also able to gain a foothold into part of 

the weapons labs computer systems. 

Third, we will hear from the DOE’s Inspector General, who will 

discuss their recent report outlining the vulnerabilities in the Department’s unclassified cyber security program and its need to improve management and controls. They will document that ‘‘since 

the end of fiscal year 2007, the Department has experienced a 45 

percent increase in reported cyber security incidents.’’ In addition, 

we will hear from the DOE’s Associate Director of Counterintelligence that DOE networks have picked up an increased tempo of 

potential adversarial activity, and in some cases, sensors have documented ‘‘well over 400 million such indicators of hostile activity 

every month.’’ 

Make no mistake about it, cyber security at our Nation’s energy 

labs should be of paramount concern to Congress and the American 

public. The sophistication of our adversaries when it comes to cyber 

attack is significant. But if the Department of Energy, and all the 

Federal Government for that matter, does not heed the warning set 

forth by these independent reports, we will put our Nation further 

3 

at risk. Much is being done to protect our sensitive information but 

much more needs to be done. 

We began this Congress by holding a hearing into the security 

concerns at Los Alamos National Lab. We’re ending this Congress 

with yet another hearing into security concerns at the Department 

of Energy’s labs. 

All too often we find that security improves at the DOE while 

Congress, the GAO and the inspector general or the Office of Independent Oversight is shining a light on them. However, far too 

often labs slip back into their own ways and have yet another security relapse. 

The Department can be sure that as long as I am chairman of 

this subcommittee there will be a constant light shining on them 

to ensure they are doing all they can to protect our Nation’s nuclear materials and secrets. 

That is the end of my opening statement. I next turn to Mr. 

Shimkus, the ranking member, for his opening statement, please. 

OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

Mr. SHIMKUS. Thank you, Mr. Chairman. I recognize your valiant 

effort to fight this cold and turning from a baritone to a bass, it 

really is Chairman Stupak, and I’ll testify to that. But thanks for 

soldiering on, and thanks for this hearing. 

There are few topics the subcommittee will examine as important 

to our national security as those concerning the security of our national weapons labs. And although I am new to this committee, the 

Oversight and Investigation Subcommittee has done it for years, 

and the committee’s responsibility has been well noted. And there 

are few topics where we have been as frustrated as those that concern the security at the labs. 

Today’s hearing serves as a progress report on work requested by 

the bipartisan committee and subcommittee leadership. Our requests were prompted by a series of physical and cyber security 

debacles at Los Alamos National Laboratory and poor performance 

at Lawrence Livermore National Laboratory in an April 2008 DOE 

physical security evaluation. 

We will hear from the Government Accountability Office this 

morning on two topics, one concerning physical security and the 

other one concerning cyber security on the unclassified computer 

network. The GAO details areas of accomplishment, but also identifies continued significant concerns. Of these concerns, the most 

troubling involve the cyber threats to what is called the ‘‘yellow 

network,’’ the lab’s protected unclassified network. The yellow network serves as a backbone for lab operation and its research mission. However, both the GAO and DOE Independent Office of 

Health, Safety and Security have identified particular 

vulnerabilities with the security of the yellow network. 

Action is needed to improve the security of the yellow network, 

but what corrective actions is to take place is based on a risk assessment and risk management. Do DOE and NNSA know or will 

they know soon exactly what information is on the yellow network? 

Will DOE and NNSA be willing to identify information that needs 

4 

special protection? And will they be able or willing to implement 

corrective actions? 

Are there any recommendations or corrective actions that they 

believe would be too costly, time consuming or disruptive to implement? If so, what evidence supports that belief? And does it outweigh the cost to national security? Striking that balance is a challenging task. 

There are about 13,000 users of the network at Los Alamos, including cleared foreign nationals, some from sensitive nations of 

concern for security officials. We will hear this morning that the 

network fire walls deflect more than 10 million cyber probes every 

month and that threats to cyber defenses are rapidly escalating in 

number, sophistication and complexity. 

And what is the information on this network? It is not classified, 

but it is sensitive and can have an impact on national security. 

Panelists will detail some of the categories for us which, GAO reports, presents a valuable target for foreign governments, terrorists 

and industrial spies. 

How robust is network security especially when probed by the 

most sophisticated adversaries? Have any of the probes succeeded? 

And if they have, what has been lost? What may be lost? These 

critical questions underscore the findings of GAO that more needs 

to be done to protect the network. And if we cannot be satisfied 

that network protections can safeguard fully the information of 

these ever-more sophisticated attacks and soon, what other options 

can we pursue for information security? The answer to this will not 

be easy, and it involves striking the balance between mission and 

security, but we have to find an answer. 

This GAO testimony provides just the starting point for the security issues we will discuss this morning. When coupled with the 

government audits and evaluations, the testimony raises important 

questions that apply not only to the overall security posture at Los 

Alamos, but at Lawrence Livermore National Laboratory and 

Sandia National Laboratories as well as labs overseen in Washington. 

I look forward to hearing the perspective of the lab directors with 

us on the second panel, as well as from DOE and the National Nuclear Security Administration officials also on the second panel. I 

will want to hear their answers to the questions I pose about enhancing the security of the yellow network. 

We should identify measures and indicators for progress on improving security going forward as rapidly as possible. We also have 

to ensure that any measures for security can be sustained for the 

long term with sufficient flexibility to respond to emerging threats. 

And finally we have to recognize the human factor at work here; 

this means the researchers, the security people and the management. I understand there appear to be two cultures at the lab with 

different priorities, the research academic culture and the security 

culture. These solutions need to reflect that reality as well as reconcile the differences. 

Thank you, Mr. Chairman. 

Mr. STUPAK. Thank you, Mr. Shimkus. 

Mr. Green for an opening statement, please. 

5 

OPENING STATEMENT OF HON. GENE GREEN, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. GREEN. Thank you, Mr. Chairman. And I’ll make my statement relatively brief. 

I hate to sound like a broken record over these last few years, 

but it’s the subcommittee’s 14th hearing on security issues facing 

the Department of Energy’s national labs. I hope that today we can 

finally show some progress towards securing the critical infrastructure and information of our weapons labs. With the emerging 

threats facing our Nation, we cannot afford more empty promises 

of change. 

Los Alamos, Livermore and Sandia house America’s most sensitive and top secret weapons development programs. The only 

thing not secret about these labs is that there are security 

vulnerabilities. 

In September 2006, the subcommittee learned how simple it was 

for a contract employee to remove a USB ThumbDrive containing 

hundreds of pages of classified documents. Just this year, after a 

mock terrorist attack by DOE at Livermore, we learned how easily 

lab security could be compromised through their ill-trained workforce and protective strategy. 

Sometimes I think we have to say enough is enough. I do not 

want to sit through future congressional hearings where we must 

piece together how a perpetrator gained access to classified nuclear 

weapons design information from our labs because we did not have 

the resolve to correct the lab security deficiencies today. 

The testimony from this morning’s hearing will show that some 

progress has been made. For example, Los Alamos National Lab 

has drastically reduced the number of removable electronic media 

and eliminated thousands of classified nuclear weapons parts and 

reduced the number of bulk-type rooms and areas containing special nuclear material. These efforts should be commended. But 

when we are protecting information critical to the national security 

of the United States, incremental action is notable but not sufficient. 

We in Congress owe it to the American people to ensure that 

weapons labs are safe and secure. And if the Department of Energy 

or their labs are not up to the task of providing the highest level 

of protection, Congress must be willing to make the tough choices 

to protect our national interests. 

And again I thank you, Mr. Chairman, for continuing these hearings. I look forward to the testimony, and I yield back my time. 

Mr. STUPAK. Thanks, Mr. Green. 

Mr. STUPAK. Ms. Blackburn for an opening statement, please. 

OPENING STATEMENT OF HON. MARSHA BLACKBURN, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF TENNESSEE 

Ms. BLACKBURN. Thank you, Mr. Chairman. As has been stated, 

we have had several hearings on the issue of problems with the national labs, and with the accountability or the lack thereof with the 

labs. It is frustrating to us to see a reticence to make any changes. 

And I think it is also frustrating to our constituents because now 

more than ever they are paying close attention to energy issues, to 

6 

how the Department of Energy is working, to security issues or 

lack thereof of security. 

And I think that today, as you come before us and as we hold 

this hearing, and as we are in the midst of this financial crisis, 

many people are very concerned about a proposed plan to give the 

Secretary of the Treasury a blank check to bail out Wall Street. 

And what we’re hearing is, they don’t trust government. And we 

know that that lack of trust is going to, therefore, be reflected onto 

each and every department and agency of the Federal Government. 

And I think that it amplifies some of the lack of accountability and 

the hesitancy that we have seen from some of our government 

agencies and from you. 

And the problems with these labs are more—they’re just more 

symptoms of what many people believe to be an incompetence of 

the bureaucracy in the Federal Government, that you have gotten 

too big and too unwieldy and too out of control for your own good 

and definitely for the taxpayers’ good. 

If these government-run labs cannot protect classified and sensitive information and material, then Congress must begin to discuss alternatives to the current operating procedures that will 

solve the problems. It would be interesting to know what your best 

practices are and what your timeline is for meeting those best practices. 

Mr. Chairman, I think that protecting that classified material 

and that sensitive data is one of the key responsibilities of government. And if it does not, then our Nation faces serious risk in the 

area of breaches of security. 

Congress should put forward initiatives. We are going to take the 

lead on this. If you cannot and will not, then we will. We’ll take 

the lead that will increase transparency, that will demand accountability on behalf of the taxpayers that are footing the bill for this. 

And it’s not only for you. It is for the entire Federal Government. 

So as my grandmother would have said, You are on my last nerve; 

and I hope that you’re going to be willing to work with us and increase some accountability and some transparency. 

And Mr. Chairman, I will yield back the balance of my time. 

Mr. STUPAK. I thank the gentlewoman. 

Mr. Dingell, chairman of the full committee, for an opening statement, please. 

OPENING STATEMENT OF HON. JOHN D. DINGELL, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. DINGELL. Mr. Chairman, good morning. And thank you for 

your vigorous leadership in the matters before us. And I want to 

thank you also for holding another important hearing on the distressing state of security at our Nation’s weapons labs. 

This will be the 14th hearing we’ve held on this topic over the 

last 8 years. It was the topic of our first oversight hearing in the 

110th Congress and today it may well be one of the last of this 

Congress. 

I feel a little bit like Sisyphus or like Heracles when he was confronted with the Augean Stables. We have before us an agency 

which has been totally incapable of addressing problems. 

7 

Back in the days when I was chairman of the Subcommittee on 

Oversight and Investigations 20-some years ago, we had hearings. 

We found a huge problem with regard to security at our Nation’s 

labs. We found that they turned off the sprinkler systems because 

they didn’t want to wet their computer systems. We found they had 

vehicles, emergency vehicles, that would not start. 

We found them with employees in charge of security who did not 

have the ability physically to participate in the suppression of penetration of those facilities. We found that the tests and the efforts 

to assure that the Agency could respond to security challenges were 

carefully cooked by informing the people beforehand what was 

going to happen so that the drill could take place in the most favorable of circumstances. And we found, curious enough, they still 

were not able to do the job that had to be done. 

We found that there were stings with regard to controlled substances which were suppressed. We found dissipation of public resources and scientific equipment amounting to millions of dollars. 

We found losses of equipment. And we found inability to keep track 

of government property. 

We found the Agency had to go lightly on their drills because employees charged with security were having heart attacks as a result 

of having to defend these facilities. It was a situation worthy of the 

Grand Duchy of Graustark. And it was indeed a situation which 

would have been humorous were it not for the fact that it was so 

sad and so dangerous. 

I will not burden my colleagues with further details of the events 

that this committee has had the distressful experience of disclosing 

over the years. But classified information has disappeared. Drug 

users have obtained clearances. Sensitive information is being uncovered in drug raids. And promises are made and continually broken to improve security by every administration that has been before this committee. 

After our last hearing this hearing asked the Government Accountability Office to conduct a comprehensive review of ongoing 

security issues at Los Alamos National Lab. Today we’re going to 

hear the results of that work as a result, as well as the results of 

a number of audits and studies by the Department of Energy’s inspector general and its Office of Independent Oversight. 

These conclusions are mixed, and I must say that I achieve a 

small measure of comfort by finding that they’re mixed. And at 

least they are not, for a change, all bad. While GAO found a number of ongoing concerns at Los Alamos National Laboratory that 

deserved the attention of the committee, they also found some evidence of improvement for which we rejoice, enough to make me 

slightly optimistic that the lab’s security is in some way improving. 

This improvement must be tempered, however, by GAO’s warning that security at DOE labs appears to be cyclical. I’m not quite 

sure what that means, but it may relate to the fact that from time 

to time this committee has hearings to find out how the matter 

progresses. Indeed, however, it is not clear to me or, I suspect, anybody else how Los Alamos intends to ensure that these problems 

will not reoccur. 

Unfortunately, we will also learn today that while Los Alamos 

has improved security, another critically important DOE weapons 

8 

lab, Lawrence Livermore National Laboratory, has not. In April of 

2008, DOE’s Office of Independent Oversight completed an evaluation review of security at Livermore. The results, quite frankly, 

were shocking and sufficiently serious that we can only discuss the 

specific details in our closed session this afternoon. 

I’d like to observe that we have before us identified major problems with key aspects of Livermore’s protective strategy, including 

malfunctioning equipment, inadequate staffing, insufficient training of the protective workforce. And while we understand that 

many of these shortcomings are being addressed, or at least we’re 

so informed, the OIO findings are so troubling that we must learn 

more about how DOE allowed this to happen and what they’re 

doing to prevent a recurrence. 

Lastly, today, we will hear from an even bigger problem facing 

these labs and DOE as a whole. And that is the threat from cyber 

attacks, a new and increasingly serious danger. At our request, 

GAO conducted a comprehensive review of Los Alamos’s unclassified cyber network; and the results of the review highlight the need 

for significant security improvements to protect sensitive information on Los Alamos’s unclassified network. 

As noted by the GAO, the information on this network presents 

a valuable target for foreign governments, terrorists and industrial 

spies. And it’s an interesting thing that this kind of threat enables 

people to do the kind of penetration of our national security simply 

sitting in their living room, working with their computers. 

This problem, however, is not unique to Los Alamos. All of DOE’s 

labs are facing cyber security challenges. We’re going to hear testimony that the labs are virtually naked to concerted cyber attacks, 

especially by assault from persistent or funded and dedicated assailants right in there, terrorists or foreign governments. 

Given the sensitivity of these facilities and the people who work 

there, we need to learn how DOE is working to correct this problem 

and when we may expect that it will, in fact, be corrected. 

Mr. Chairman, under your leadership I know that this committee 

is going to continue its examination into cyber security in the next 

Congress and to broaden it to include all departments and agencies 

within our jurisdiction. Because the potential consequences of this 

situation are very, very serious, I expect that this will be one of our 

most important oversight priorities next year. 

And I want to thank you for the work and the leadership that 

you have done and shown, and express my hope that I will be able 

to work with you again on this very important matter. Thank you, 

Mr. Chairman. 

Mr. STUPAK. Thank you, Mr. Dingell. 

[The prepared statement of Mr. Dingell follows:] 

PREPARED STATEMENT OF HON. JOHN D. DINGELL

Mr. Chairman, thank you once again for holding another important hearing on 

the state of security at our Nation’s weapons labs. This will be the fourteenth hearing we have held on this subject over the last eight years. It was the topic of our 

first oversight hearing for the 110th Congress, and today it may conclude this Subcommittee’s hearings for this Congress. 

I will not bore my colleagues with all the gory details of security misadventure 

and mishap that this Committee has uncovered over those 8 years-of classified information disappearing, of drug users obtaining clearances, of sensitive information 

9 

being uncovered in drug raids, and of promises made and continually broken to improve security. 

Rather, after our last hearing, this Committee asked the Government Accountability Office (GAO) to conduct a comprehensive review of ongoing security issues 

at Los Alamos National Lab. Today we will hear the results of that work as well 

as the results of a number of audits and studies by the Department of Energy’s Inspector General and its Office of Independent Oversight. 

Their conclusions are mixed. While GAO found a number of ongoing concerns at 

Los Alamos National Laboratory that deserve our attention, they also found evidence of some improvement-enough to make me cautiously optimistic that lab security is in some ways improving. However, this improvement must be tempered by 

GAO’s warning that security at DOE labs appears cyclical, and it is not clear how 

Los Alamos intends to ensure these problems will not reoccur. 

Unfortunately, we will also learn today that while Los Alamos has improved security at another critically important DOE weapons lab—Lawrence Livermore National Laboratory—has not. 

In April 2008, DOE’s Office of Independent Oversight (OIO) completed an evaluation and review of Livermore’s security posture. The results were shocking and so 

serious that we can only discuss the specific details in our closed session this afternoon. 

Let me just say that they identified major problems with key aspects of Livermore’s protective strategy, including malfunctioning equipment, inadequate staffing, 

and insufficient training of its protective workforce. While we understand that many 

of these shortcomings are being addressed, the OIO findings are troubling, and we 

must learn how DOE allowed this to happen and what they are doing to prevent 

a reoccurrence. 

Lastly, today we will hear of an even bigger problem facing these labs, and DOE 

as a whole, and that is the threat from cyber attacks. At our request, GAO conducted a comprehensive review of Los Alamos’ unclassified cyber network, and the 

results of this review highlight the need for significant security improvements to 

protect sensitive information on Los Alamos’ unclassified network. As noted by 

GAO, the information on this network presents ‘‘a valuable target for foreign governments, terrorists, and industrial spies.’’ 

Unfortunately, this problem is not unique to Los Alamos. All of the DOE labs are 

facing cyber-security challenges. We will hear testimony that the labs are virtually 

naked to concerted cyber attacks-especially by assault from persistent, well-funded, 

and dedicated assailants. Given the sensitivity of these facilities and the people who 

work there, we need to learn how DOE is going to correct this problem. 

I would urge this Subcommittee to continue its examination into cyber security 

in the next Congress and broaden it to include all departments and agencies within 

our jurisdiction. I expect this may be one of our most important oversight priorities 

next year and look forward to working with you on this matter. 

Mr. STUPAK. Mr. Burgess for an opening statement, please. 

OPENING STATEMENT OF HON. MICHAEL C. BURGESS, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. BURGESS. Thank you, Mr. Chairman. This does seem like 

deja vu all over again, doesn’t it? 

We’ve had hearings in the past and we’ve established some serious lapses in security and managerial oversight at Los Alamos National Laboratory. Indeed, we went through an entire process with 

those Requests for Proposals as to whether or not the management 

of the lab should change. 

I took a trip out to Los Alamos in July of 2005. I just wanted 

to see for myself on the ground. I have got to say, I was impressed 

by the work being done; I was impressed by the dedication of the 

employees. But as we continued to hear after that, even after the 

evaluation and even though there was no management change, but 

there was promise of some changes, we still heard the reports of 

things that weren’t quite right. 

10 

Through all of those hearings, we always heard that things at 

Sandia, things at Lawrence Livermore were the gold standard, and 

that’s what we should aspire to. But now we have got a GAO report that say significant problems exist in physical and electronic 

security at Lawrence Livermore as well. So the security of these 

agencies may have made some progress in strengthening some of 

the security weaknesses at Los Alamos—and I think that’s still in 

question. 

The NNSA needs to be more consistent with their progress in 

other facilities. Gaps in the physical protection of classified documents, but especially the electronic uses of both classified and unclassified, but sensitive; this committee should maintain persistent 

oversight until these problems are corrected. 

I am concerned with the cyber security weaknesses and lab policies towards the physical protection of computers, portable storage 

devices and other sensitive areas in the labs. It seems like we’ve 

been through this before at Los Alamos, and I guess I have to wonder why we’re not learning the lessons as they’re given to us. 

It’s taken for granted that almost any enterprise undertaken in 

life will involve a computer, a cell phone, a BlackBerry or some 

other electronic device. It’s also a near certitude that an ill-meaning person or persons can attempt to illegally access electronic systems and devices for a variety of reasons, none of which are good. 

The rapid advancements in technology make the nature of the 

threat to our electronic systems one that is constantly evolving, 

therefore we need to be flexible on the committee, but we need to 

be vigilant. 

In 2002, Congress passed the Federal Information Security Management Act to protect our critical information infrastructure. This 

was before I was elected. And I do wonder if our Federal agencies, 

particularly the Department of Energy, are in compliance with this 

important law. It’s a dangerous time. Our national security secrets 

should be closely held, closely guarded; and they should stay our 

national secrets. 

The Office of Inspector General has noted that our nuclear labs 

and Department of Energy work information systems are compromised. I will look forward to working with the chairman of this 

subcommittee and the chairman of the full committee to ensure 

that our nuclear secrets do not fall into the wrong hands. 

And I will yield back the balance of my time. 

Mr. STUPAK. I thank the gentleman. We have our first panel before us. Let me introduce them if I may: 

Mr. Gregory Wilshusen, who is the Director of Information Security Issues at the U.S. Government Accountability Office. And 

you’re accompanied by Ms. Allison Bowden of the GAO. And you 

are senior auditor, correct? OK. Mr. Glenn Podonsky, who is the 

Chief Health, Safety and Security Officer in the Office of Health 

Safety and Security of the Department of Energy; and the Honorable Gregory Friedman, who is the Inspector General at the Department of Energy. 

Welcome to all of our witnesses. 

It’s the policy of this committee to take all testimony under oath. 

Please be advised you have a right by the Rules of the House to 

11 

be advised by counsel during your testimony. Do any of you wish 

to be advised by counsel during your testimony? 

Everybody indicating ‘‘no.’’ Therefore, I will ask you to stand, 

raise your right hand and take the oath. 

[Witnesses sworn.] 

Mr. STUPAK. Let the record reflect that the witnesses have answered in the affirmative to the oath. They are now under oath. 

Mr. STUPAK. We will begin with opening statements. 

Mr. Friedman, let’s start with you. If you don’t mind, pull that 

mic up. And you are recognized for 5 minutes. If you have a longer 

statement, it will be submitted for the record. So if you would 

begin, please. 

STATEMENT OF GREGORY H. FRIEDMAN, INSPECTOR 

GENERAL, U.S. DEPARTMENT OF ENERGY 

Mr. FRIEDMAN. Thank you, Mr. Chairman and members of the 

subcommittee. I’m pleased to be here today at your request to testify on matters relating to security at the Department of Energy’s 

national defense laboratories. These laboratories, which are part of 

the National Nuclear Security Administration, process some of the 

Department’s most sensitive information, information which is critical to the Nation’s defense. 

Since 2002, the Office of Inspector General has categorized information security as one of the Department’s most significant management challenges. In April of 2007, I testified before this subcommittee on the special inquiry conducted by my office regarding 

a diversion of classified data from the Los Alamos National Laboratory, an event made possible in large part by cyber security-related 

weaknesses. 

The Office of Inspector General has continued its efforts in this 

area by conducting a number of cyber security reviews throughout 

the Department, including NNSA and its national defense laboratories. Early this year we conducted an extensive review of the 

process to certify and accredit classified national security information systems. Simply stated, certification and accreditation is a critical management tool used to recognize and address risks by ensuring that cyber security controls are in place. 

Our findings relative to the NNSA and its laboratories revealed 

a number of weaknesses. In particular, we found, first, critical security functions had not been adequately segregated, providing the 

opportunity for systems security officers to gain access and modify 

systems without review or approval. 

Secondly, risks associated with classified and unclassified systems operating in the same environment had not always been adequately evaluated. 

Third, the system security plans omitted information on hardware such as servers, network printers, and scanners, a condition 

paralleling one of our concerns relating to the diversion of classified 

material at Los Alamos. 

And finally, contingency plans outlining actions necessary to resume operations in the event of a disaster were not always developed or they were incomplete. 

These weaknesses occurred, in part, because the NNSA had not 

been fully successful in ensuring its laboratories implemented the 

12 

Department’s updated cyber security requirements. For example, 

two laboratories completed their certification and accreditation 

process using outdated requirements, leaving a number of systems 

vulnerable to control weaknesses. In addition, headquarters and 

field site officials had not effectively reviewed security plans to ensure that they were accurate and adequately addressed system 

risks. 

In our recently issued Federal Information Security Management 

Act evaluation, we identified a number of weaknesses that exposed 

unclassified systems to an increased risk of compromise. 

We found, first, two of the three defense labs had not yet completed certification accreditation of certain business systems, a deficiency first reported in 2006. 

Mandatory security controls were not included in systems security plans at one laboratory. 

All three laboratories had not completed implementation of the 

federally mandated standard desktop configuration. 

Computer incident reports did not always include information 

needed for implementing—needed for reporting to law enforcement 

and for subsequent analysis for trending. 

And at one laboratory vulnerabilities were identified that may 

have allowed unsupervised foreign visitors to inappropriately access the site’s intranet. 

We found that NNSA had not in a timely manner incorporated 

Federal and departmental cyber security requirements into its policies and guidance. In addition, NNSA also had not effectively completed reviews and performance monitoring, activities essential for 

evaluating the adequacy of cyber security operations. 

Our evaluations reveal a mixed picture. The Department and 

NNSA have improved their cyber security efforts, yet weaknesses 

still exist. Additional action is necessary to protect systems and the 

information they contain from increasingly sophisticated and persistent attacks. 

Since the end of fiscal year 2007, as has been referred to earlier 

in the opening statements, the Department has experienced a 45 

percent increase in reported cyber security incidents. This significant increase demonstrates the need for sustained action in securing the Department’s information systems. 

Our work suggests that there are some recurring challenges that 

NNSA should consider as it moves forward. Specifically, NNSA 

should implement in a timely manner all relevant Federal departmental cyber security requirements, strengthen the management 

and review process by better monitoring field sites to ensure adequacy of cyber security program performance and, finally, ensure 

that all outstanding cyber security weaknesses are corrected in a 

timely manner. 

The Office of Inspector General recognizes well the importance of 

cyber and physical security and we are committed to continuing 

our work in these areas. 

Mr. Chairman, this concludes my statement. I would be pleased 

to answer any questions you may have. 

Mr. STUPAK. Thank you Mr. Friedman. 

[The prepared statement of Mr. Friedman follows:]

13 

STATEMENT OF GREGORY H. FRIEDMAN

SUMMARY

• Since 2002, the Office of Inspector General (OIG) has categorized information security as one of the Department of Energy’s (Department) most significant management challenges. While incremental improvements have been made to improve security and reduce risks to systems and data, additional work needs to be done. 

•The OIG recently issued a report on the certification and accreditation of the Department’s national security information systems. Our review disclosed that weaknesses exist in the areas of risk management, security planning, and contingency 

planning. In addition, the National Nuclear Security Administration (NNSA) had 

not been fully successful in ensuring that its laboratories implemented the Department’s updated, strengthened policies designed to protect national security information systems. 

• A Fiscal Year 2008 review of the Department’s unclassified cyber security program identified opportunities for improvements in areas such as certification and 

accreditation of systems, systems inventory, contingency planning and segregation 

of duties. 

•The problems identified occurred because NNSA had not revised and implemented, in a timely manner, policies and guidance incorporating Federal and Departmental cyber security requirements. NNSA also had not effectively completed 

review and performance monitoring activities essential for evaluating the adequacy 

of cyber security operations. 

• Since the end of Fiscal Year 2007, the Department has experienced a 45 percent 

increase in reported cyber security incidents. This significant increase demonstrates 

the need for sustained action in securing the Department’s information systems. 

STATEMENT

Mr. Chairman and members of the Subcommittee, I am pleased to be here at your 

request to testify on matters relating to cyber security at the Department of Energy’s (Department) national defense laboratories. These laboratories, which are part 

of the National Nuclear Security Administration (NNSA), possess and process some 

of the Department’s most sensitive information; information which is critical to the 

Nation’s defense. 

BACKGROUND

The Office of Inspector General (OIG) has a long-standing, proactive program to 

assess the effectiveness of the Department of Energy’s cyber security strategy. Since 

2002, the OIG has categorized information security as one of the Department’s most 

significant management challenges. In April of 2007, I testified before this Subcommittee on the special inquiry conducted by my office regarding a diversion of 

classified data from the Los Alamos National Laboratory; an event made possible, 

in large part, by cyber security related weaknesses. The OIG has continued its efforts in this area by conducting a number of cyber security reviews throughout the 

Department, including NNSA and its national defense laboratories - Los Alamos, 

Lawrence Livermore, and Sandia. 

REVIEW OF NATIONAL SECURITY INFORMATION SYSTEMS

In response to our special inquiry on the diversion of classified data at Los Alamos, the Department initiated a wide range of actions to address cyber security 

weaknesses related to classified systems. For instance, the Department updated and 

strengthened its national security information systems policy for segregation of duties and system access techniques. 

Earlier this year, we conducted an extensive review of the process to certify and 

accredit classified national security information systems at the NNSA laboratories. 

Certification and accreditation (C&A) is a critical part of the risk management process and is vital to understanding and mitigating cyber-related vulnerabilities. This 

process is designed to ensure that systems are secure prior to beginning operation 

and that they remain so throughout their lifecycle. It includes formal steps to: (1) 

recognize and address risks, (2) determine whether system security controls are in 

place and operating effectively, and (3) ensure that changes to systems are adequately tested and approved. Our findings relevant to the NNSA and its national 

defense laboratories revealed that: 

14 

• Critical security functions had not been adequately segregated, providing the opportunity for system security officers to gain access and modify systems without review or approval, creating an environment in which controls could be manually 

overridden; 

• Risks associated with classified and unclassified systems operating in the same 

environment had not always been adequately evaluated. This weakness - exacerbated by the lack of segregation of duties - increased the risk that classified information could be transferred to unclassified systems; 

• Users at one laboratory were allowed to manually change passwords, a practice 

specifically prohibited by the Department and one which rendered passwords on 

classified systems more susceptible to compromise; 

• At the same laboratory, a number of security plans were not reviewed and approved by a Federal official, depriving NNSA of the opportunity to ensure that all 

risks to the systems were addressed; 

• System security plans omitted information on hardware such as servers, network 

printers and scanners, the presence of which could have created a security vulnerability and enabled the unauthorized processing, diversion or theft of classified material. This condition paralleled one of our concerns related to the diversion of classified information at Los Alamos; and, 

• Contingency plans outlining actions necessary to resume operations in the event 

of a disaster were not always developed or were incomplete. 

The Department had strengthened policies designed to protect national security 

information systems in response to our recommendations following the Los Alamos 

incident. However, NNSA had not been fully successful in ensuring that its laboratories implemented these updated and stronger requirements. For example, two laboratories completed their C&A process using outdated requirements, leaving a number of systems vulnerable to control weaknesses such as the lack of segregation of 

duties and strong authentication techniques. In addition, Headquarters and field 

site officials had not effectively reviewed security plans to ensure that they were accurate and that they adequately addressed system risks. 

REVIEW OF UNCLASSIFIED SYSTEMS

The OIG has also devoted substantial resources to evaluating security measures 

designed to protect the Department’s unclassified information systems and data. 

The Federal Information Security Management Act requires that agency Inspectors 

General conduct an annual independent evaluation of their Department’s unclassified cyber security program and practices. Our recently issued Fiscal Year (FY) 2008 

evaluation revealed a mixed-picture: on one hand, the Department had made incremental improvements in its unclassified cyber security program. For example, various sites had taken action to address weaknesses we identified during our FY 2007 

evaluation by strengthening configuration management, updating policy, and incorporating cyber security performance requirements into management and operating 

contracts. However, a number of weaknesses that exposed systems to an increased 

risk of compromise still existed within the Department. This specifically included 

NNSA and its national defense laboratories. In particular: 

•Two of the three defense laboratories had not yet completed certification and accreditation of certain business systems, a deficiency we first reported in FY 2006; 

• System security plans at one laboratory did not include mandatory security controls. Such information is necessary for management to determine that all system 

risks have been fully considered and that mitigating controls are in place; 

• At one laboratory, unneeded computer services had not been disabled on over 40 

servers that hosted publicly accessible websites. These services, which in a number 

of instances could be accessed without the use of passwords or other authentication 

techniques, increased the risk of malicious damage to the servers and the networks 

on which they operated; 

• All three laboratories had not yet completed the deployment of the Federallymandated standard desktop configuration, an action that when implemented is intended to significantly enhance cyber-related controls; 

• Computer incident reports did not always include information needed for reporting to law enforcement and for subsequent analysis for trending. Further, reported 

information was not always shared with other Department elements; and, 

• At one laboratory, vulnerabilities were identified that may have allowed unsupervised foreign visitors to inappropriately access the site’s intranet. Such practices, 

if exploited, could have permitted those individuals to probe the laboratory’s network for vulnerabilities, implant malicious code, or remove data without authorization. 

15 

ISSUES REQUIRING CONTINUING ATTENTION

While NNSA has taken steps to address a number of weaknesses identified in the 

past, additional action is necessary to protect systems and the information they contain from increasingly sophisticated and persistent attacks. Since the end of FY 

2007, the Department has experienced a 45 percent increase in reported cyber security incidents. This significant increase demonstrates the need for sustained action 

in securing the Department’s information systems. 

Our work suggests that there are some recurring challenges that NNSA should 

consider as it moves forward. Specifically, NNSA should: 

1. Implement, in a timely manner, all relevant Federal and Departmental cyber 

security requirements; 

2. Strengthen the management review process by better monitoring field sites to 

ensure the adequacy of cyber security program performance; and, 

3. Ensure that all outstanding cyber security weaknesses are corrected in a timely 

manner. 

To achieve the recommended reforms as promptly as possible, NNSA should establish firm schedules with specific implementation timeframes and benchmarks. 

ONGOING INSPECTOR GENERAL EFFORTS

Both cyber and physical security continue to be pressing management challenges. 

For that reason, the Office of Inspector General has ongoing activities to examine 

information technology and systems security, implementation of physical security 

technology upgrades, protection of sensitive unclassified information, and accounting 

for nuclear materials in the hands of domestic licensees. 

Mr. Chairman, this concludes my statement and I would be pleased to answer any 

questions you may have. 

Mr. STUPAK. Mr. Podonsky, please, for your opening statement. 

STATEMENT OF GLENN S. PODONSKY, CHIEF HEALTH, SAFETY 

AND SECURITY OFFICER, U.S. DEPARTMENT OF ENERGY 

Mr. PODONSKY. Chairman Stupak, Ranking Member Shimkus 

and members of the subcommittee, I want to thank you for inviting 

me to testify today on the status of the security and cyber security 

programs at the Department of Energy’s three weapons laboratories. 

As the Department’s Chief Health, Safety and Security Officer, 

my office and I have a direct interest in the levels of rigor and effectiveness at which these laboratories and all DOE sites implement the Department’s security requirements. 

In the area of physical protection and the protection of special 

nuclear material, the HSS Office of Independent Oversight conducted a comprehensive security inspection this past spring at 

Lawrence Livermore National Laboratory and just recently completed an inspection at Los Alamos National Laboratory. While 

there were a number of identified weaknesses, most notably at 

Lawrence Livermore, reports of progress indicate that they are aggressively addressing identified deficiencies. We will validate the 

effectiveness of these corrective actions when we conduct a followup inspection in the spring. 

The results of our evaluations indicate that the systems in place 

to protect classified matter at these laboratories are generally adequate and in compliance with expectations, but there are residual 

issues that must be addressed. In the area of cyber security, 

threats to DOE and NNSA cyber security defenses continue to escalate both in terms of the number of attacks and in the sophistication and complexity of those attacks. 

16 

Mr. Chairman, DOE, along with many other government agencies and corporate organizations, are experiencing a broad range of 

cyber security threats that we must protect against on a continuous 

basis. Our interconnected society and dependency on the rapid exchange of vast quantities of electronic information exposes all of us 

to cyber threats similar to those faced by DOE and NNSA. I believe 

the entire U.S. Government is at a crossroads on how we protect 

sensitive information. 

Our independent oversight inspections have identified numerous 

positive attributes of the classified cyber security programs at each 

of the weapons laboratories, and while there are some deficiencies 

that need to be addressed, the classified cyber security program 

throughout DOE remains strong. 

Unclassified cyber security presents a different challenge. The 

primary threats to our unclassified networks used to be directed at 

our perimeter defenses, and as a result, the Department directed 

significant effort toward strengthening its network perimeter 

through implementation of fire walls and intrusion detection systems. However, as external network’s defenses have grown stronger, our adversaries have shifted strategies and most attacks today 

are less direct. 

Many new network penetrations now occur as a result of an authorized user activating malicious software program commonly 

used known as a Trojan horse or some form of social engineering. 

Once a user activates a malicious program, a communication channel is established to the adversary system, essentially ignoring the 

otherwise effective fire wall. 

In January of 2005, my office added to our existing inspection 

program an unannounced network testing process commonly referred to as ‘‘red teaming’’ to provide a more rigorous evaluation of 

this new threat environment. Red teaming evaluates the strengths 

and weaknesses and security controls, as well as the Department’s 

ability to detect and disseminate information about attacks and 

how it addresses the attacks. 

Our most recent red team activity, conducted with only six cyber 

specialists and in under 90 days, resulted in our ability to take full 

control of two site networks and one small site office network. Our 

red team was able to download a very large quantity of data in 

gigabytes, 40,000 documents, some of which were sensitive without 

being detected. 

Additionally, with this access, we installed our own malicious 

programs on a number of laptop computers. As these laptops were 

legitimately connected to other networks through authorized accounts, we were able to see these networks and to browse the information on them, thus demonstrating our ability to migrate through 

the Department into sensitive networks. 

While there has been moderate improvement in the unclassified 

cyber security arena, including better segmentation of computer 

networks and improved vulnerability scanning, we continue to 

identify problems in fully implementing some fundamental security 

controls at DOE and NNSA sites. For example, while some sites 

within NNSA have improved their process for controlling outbound 

network connections, many other sites have not fully implemented 

mechanisms to prevent malicious software programs from sending 

17 

sensitive unclassified information to sources outside their networks. 

The DOE Chief Information Officer and the Under Secretaries 

have made progress in recent years with respect to developing new 

policy and governance model to implement these new policies. This 

governance model essentially enables each Under Secretary to determine how they will implement departmental requirements 

through their programmed cyber security plans. Our inspections, 

however, have continued to demonstrate that some fundamental 

cyber security requirements are not consistently implemented 

throughout the Department. 

We don’t want to underestimate the work that has already taken 

place. Some sites, especially within NNSA, have addressed many of 

these issues. However, the Department continues to identify successful penetrations of our networks. 

To protect sensitive information more effectively, we need to enhance certain aspects of departmental policy to include requiring 

encryption of sensitive information stored on all computers, implementing a more robust program cyber security plan and review 

process by the DOE’s Office of the CIO to ensure that the plans are 

meeting expectations and revisiting some of the risk decisions that 

have been made with particular emphasis on the evolving threat 

environment. 

Additionally, we need to continue to educate our users regarding 

the threats involved with opening attachments and running programs from untrusted sources. We should implement authenticated 

gateways for all outbound Internet access to reduce the ability for 

automated programs to establish pathways to external systems, as 

we did with our red team. We should also more efficiently analyze 

suspicious activities across the network. Finally, we need to do a 

better job of keeping attackers who manage to gain access to sensitive information on our systems from sending that data outside 

our network perimeters as well as limit their ability to migrate to 

other areas of the site’s network. 

Mr. Chairman, my office and I believe this subcommittee and 

DOE share the same goal of ensuring that our national security assets are well protected and also share the concern when the protection effectiveness falls below our standards. However, the Department and the laboratories have additional work to do to ensure 

that protection of the classified information they possess in both 

physical and electronic form. 

I cannot stress strongly enough our belief that we need to get 

back to the basics of risk management to identify which information needs special protection, to determine appropriate protection 

measures to apply to that information, and then we need to ensure 

that the protection measures are actually implemented. 

Thank you, Mr. Chairman. 

Mr. STUPAK. Thank you, Mr. Podonsky. 

[The prepared statement of Mr. Podonsky follows:] 

18 


63238.001
19 


63238.002
20 


63238.003
21 


63238.004
22 


63238.005
23 


63238.006
24 


63238.007
25 


63238.008
26 


63238.009
27 


63238.010
28 


63238.011
29 


63238.012
30 


63238.013
31 


63238.014
32 


63238.015
33 

Mr. STUPAK. Mr. Wilshusen, your opening statement, please, sir. 

STATEMENT OF GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES; ACCOMPANIED BY ALLISON 

BOWDEN, SENIOR AUDITOR, GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. WILSHUSEN. Chairman Stupak, Ranking Member Shimkus 

and members of the subcommittee. 

Mr. STUPAK. Is your mic on, sir? Just pull it up a little bit, if you 

don’t mind. 

Mr. WILSHUSEN. Can you hear me now? OK. 

Chairman Stupak, Ranking Member Shimkus and members of 

the subcommittee, I am pleased to be here today to testify on physical and cyber security at the Los Alamos National Laboratory or 

LANL, one of three national laboratories operated by the National 

Nuclear Security Administration that designs and develops nuclear 

weapons for the U.S. stockpile. I am joined by Allison Bowden, a 

GAO senior analyst specializing in physical security. 

A basic management objective for any organization is to protect 

the assets and resources that support its critical operations from 

theft, unauthorized access, use, modification, destruction or disruption. It is especially critical for national laboratories, such as 

LANL, that possess and process special nuclear material, nuclear 

weapons parts and highly sensitive and classified information. 

A successful physical or cyber attack on LANL could have devastating consequences for the site, its surrounding communities 

and the Nation’s security. Because of these risks, LANL needs effective physical and cyber security programs. Today I will summarize our recently completed work on physical and cyber security at 

Los Alamos and share our preliminary observations on physical security at the Lawrence Livermore National Laboratory. 

Mr. Chairman, LANL is improving its physical security. It is implementing over two dozen initiatives to reduce, consolidate and 

better protect its classified assets. It has reduced the physical footprint of the laboratory by closing unneeded facilities, although this 

initiative is focused more on reducing maintenance costs than addressing facility security. 

Other challenges remain. Significant physical security problems 

related to nuclear weapon part storage, inadequate self-assessments and complete corrective action plans have been fully addressed—or have not been fully addressed at the time of our review. 

In addition, LANL’s ability to sustain security improvements 

over the long term is unproven because its approach is for sustaining progress contained weaknesses in the early stages of development. For example, a system intended to track long-term improvements would not be fully completed for 3 to 4 years. 

Furthermore, the Los Alamos site office, which is responsible for 

overseeing security at LANL, may not have enough staff or the 

proper training to provide effective security oversight. 

To help strengthen LANL’s physical security program, GAO recommended, among other things, that LANL develop a comprehensive strategic plan for addressing identified weaknesses and improving program effectiveness. 

34 

At Lawrence Livermore our preliminary observations on physical 

security indicate that its self-assessment and performance-assurance testing programs need improvement and that NNSA and the 

Livermore site office have not always provided effective security 

oversight. Both Livermore and the site office have actions under 

way that are intended to improve these deficiencies. However, similar to LANL, sustaining improvements may be a continuing challenge. 

Turning to cyber security—and in reports being released today, 

Mr. Chairman, we note that Los Alamos has implemented numerous measures to enhance cyber security, but weaknesses remain 

that impair the laboratory’s ability to sufficiently protect the confidentiality, integrity and availability of sensitive information on 

the unclassified network. At the time of our site visits, LANL had 

vulnerabilities in several critical areas, including, identifying and 

authenticating users of the networks, encrypting certain sensitive 

information, monitoring compliance with security policies, implementing and testing software patches, and planning for contingencies when the network services are disrupted. A key reason for 

these weaknesses is that the laboratory had not fully implemented 

its cyber security program to ensure that controls were effectively 

established and maintained. 

In addition, the number of foreign nationals who have access to 

the unclassified network, including about 300, as of May 2008, 

from DOE’s designated sensitive countries, had raised concerns 

amongst some laboratory and NNSA officials because of the sensitive information contained on the network. 

To enhance cyber security over the unclassified network, we are 

making a total of 52 recommendations to improve LANL’s program 

activities, correct specific control weaknesses, and ensure a clear 

and consistent strategy for determining resource requirements 

based on risk. 

In summary, LANL has taken steps to improve its physical and 

cyber security programs, but more remains to be done. Until known 

deficiencies are adequately addressed and improvements sustained 

over the long term, sensitive and classified resources will remain 

at increased and unnecessary risk. 

Mr. Chairman, we’d be happy to answer any questions. 

Mr. STUPAK. Thank you. 

[The prepared statement of Mr. Wilshusen follows:] 

35 


63238.016
36 


63238.017
37 


63238.018
38 


63238.019
39 


63238.020
40 


63238.021
41 


63238.022
42 


63238.023
43 


63238.024
44 


63238.025
45 


63238.026
46 


63238.027
47 


63238.028
48 


63238.029
49 


63238.030
50 


63238.031
51 


63238.032
52 


63238.033
53 

Mr. STUPAK. Ms. Bowden, would you care to make an opening 

statement? 

Ms. BOWDEN. No, sir. 

Mr. STUPAK. OK. Let’s begin our questioning then. Let’s go 10 

minutes and move it along. 

Mr. Wilshusen, let me ask you this: I’m glad to hear that Los Alamos is doing better. This committee has really been on their case, 

because we have had so many hearings concerning their physical 

security. So we’re pleased to see that. 

We’ve asked in the past that GAO take a look at the need for 

a Los Alamos. In other words, there’s a lot of redundancy in our 

labs. Is it necessary to keep that—is that investigation or report by 

GAO ongoing, looking at the physical assets of Los Alamos and is 

it needed? 

Ms. BOWDEN. Yes, Mr. Chairman. We have finished the first part 

of that review, which was the report that was issued on physical 

security in June 2008. And we are just beginning the second phase 

of that review, which will take a comparative look at infrastructure 

across the nuclear weapons complex. 

Mr. STUPAK. OK. Thanks. 

Well, let me ask you this, Ms. Bowden, if I may. One of the concerns you raised in reporting on Los Alamos’ physical security 

structure, that it seemed to be cyclical in nature. I’m glad to see 

that they’re improving. But the labs appear to improve when we’ve 

had a mishap and they know they’re under scrutiny. 

How do we make sure there are improvements in the physical security, whether it’s cyber or just physical security, unless this committee or—unless there’s an incident, it seems like they regress. 

How do we break the cyclical nature of this? 

Ms. BOWDEN. In our June 2008 report, we’ve recommended specifically that NNSA effectively incentivize financially, through 

newly established performance-based contracts, effective incentives 

for physical security performance. They get beyond compliance-oriented measures, but really look at the effectiveness of the security 

programs at Los Alamos. 

In addition, we believe that effective security oversight through 

the NNSA site office will help address the sustainability of improvements in security at the laboratory. 

Mr. WILSHUSEN. Regarding cyber security, it will take several 

things to make that happen. One, of course, is first getting the current control situation up to snuff in terms of—in particular, like 

implementing our recommendations over the weaknesses in its 

present controls. But that’s only as a point certain. 

It’s also imperative that the Agency develop the processes and 

the structure to ensure that these controls and its risks are adequately assessed over time because the computing environment 

changes. The cyber security environment is very dynamic. There 

are constantly new threats, new technologies and new business 

processes and functionality that are being added to the unclassified 

networks and to any network, speaking generally. And so it requires that the Agency sets up the processes and effectively implements them over time. 

Mr. STUPAK. Well, let me ask you this: To the extent that you 

can testify, you or Mr. Podonsky, in open session here, what is the 

54 

level of sophistication of these cyber attacks? And I take it they’re 

increasing in capability. 

It’s getting much more sophisticated these cyber attacks, is it fair 

to say? 

Mr. WILSHUSEN. Definitely, they’re becoming more sophisticated 

and they’re also becoming more targeted. In the past, many of the 

attacks were just through hackers or virus writers that might 

throw out a virus across the Internet and see what they might be 

able to infiltrate. Now attackers—and they come from a variety of 

sources—more specifically target their—well, they more specifically 

try to target their more particular systems or individuals that they 

want to attack; and they tailor that attack to try to encourage an 

individual to open up an e-mail attachment or to provide sensitive 

information, like personally identifiable information, or to go to a 

Web site to which can then be downloaded malicious software 

which can provide the opening to the attacker. 

Mr. STUPAK. Mr. Podonsky, I think you actually said in your testimony that before instead of a straight-in attack, now they use a 

different method or go through someone who will already have access to it, get them to open an e-mail or whatever, and then make 

the attack. 

Mr. PODONSKY. In my opening statement I did talk about the sophistication of these attacks. And I’m sure in the closed session 

we’ll be able to talk with greater granularity. 

However, I want to emphasize again, as I said in my opening 

statement, while DOE is a target, so is the entire United States 

Government. 

Mr. STUPAK. Sure. 

Mr. PODONSKY. And we need to be sensitive that these attacks 

are very real, not only against our laboratories, but against all of 

our agencies. 

Mr. STUPAK. Well, and in my testimony, I had mentioned that 

tens of millions of attacks are taking place each month. Are we at 

a point where the number of attacks have outpaced our ability to 

defend against them, or to identify them when they do occur? 

Mr. PODONSKY. In our opinion, from independent oversight, we 

believe that there are things that we can do to help protect some 

of the information that we have. But the reality is that these attacks continue to be, as you point out, more sophisticated and more 

numerous. And it’s a constant, continuous struggle for all of us. 

Mr. STUPAK. But you also mentioned in your testimony your Red 

Team and how you’re able to penetrate two of the DOE labs and 

downloading a very large quantity—gigabytes, you said—of information. 

Can you expound further on what your Red Team did? And what 

does this suggest about the capability of the Department of Energy 

to thwart cyber attacks? 

Mr. PODONSKY. What I can say in open session, first, yes, I would 

like to explain in greater detail in a closed session what they actually did and the only reason I can say that is because we do not 

want to confirm for hackers out there what the successful practices 

are, because we’ve proven that within the Department. 

55 

But suffice it to say that, as I said, with a very small group of 

cyber security specialists, and in under, as I said, 90 days, we were 

able to take over the network of two of the sites. 

We believe that were we with more people—and I’m not asking 

for more, but were we with more people and had we pursued this 

for a longer period of time, there would have been more 

vulnerabilities that we would have found. 

Mr. STUPAK. I think, Mr. Wilshusen, and I think, Mr. 

Podonsky—I think you both mentioned it—the so-called yellow network, if you will, or the unclassified network at the labs is not sensitive enough to warrant major action to protect it. But yet these 

unclassified networks can lead you to terribly sensitive information; is that correct? 

Mr. WILSHUSEN. Yes. Certainly the information on the yellow 

network contains very sensitive information, including unclassified 

controlled nuclear information, export control information, and personally identifiable information about LANL employees. This information has intrinsic value to attackers and to—of various different 

types. 

It can be—information from a network potentially can aid our 

competitors, or provide a competitive advantage to—in the commercial sector. It can also be a source for intelligence gathering and 

possibly disruption for other adversaries. 

And so certainly that information has value. And I think that’s 

indicative, in part, by the number of attempted probes that occur 

at that site. 

Mr. STUPAK. Well, you mentioned maybe the commercial nature 

of it. But what about national security? Does the information contained in the unclassified network pose a danger from an adversary 

by going through the yellow network or unclassified network? Can 

you get to something where an adversary, from a national security 

point of view, could penetrate and then cause us problems? 

Mr. WILSHUSEN. Well, I would say that the type of information 

on that network could certainly aid intelligence operations from 

other organizations. It’s highly sensitive and it could potentially 

lead to that, yes, sir. 

Mr. STUPAK. Well, what’s your opinion? And on the network access that’s been provided to foreign nationals from both sensitive 

and nonsensitive countries, do you think that’s too open to foreign 

nationals? 

Mr. WILSHUSEN. Well, I think the issue relates to—it really 

comes down to a risk and benefit decision; you know, what is the 

risk of giving these individuals, particularly from the sensitive 

countries, access to the unclassified network; and then what’s— 

first is, what is the benefit of giving them access to it? 

And once it’s decided whether or not these individuals should 

have access to it, it’s incumbent then upon the organization to ensure that—as it would for any user, to ensure that the access 

granted to that individual is based on the principle of least privilege, and that they’re only given the access that they need to do 

the job and no more, and that that access is based on need to know. 

Now, we’ve been informed that the NNSA has decided to remove 

the access of all the foreign nationals from sensitive countries, from 

the yellow network. 

56 

Mr. STUPAK. OK. Because isn’t it sort of like what we did in Los 

Alamos? I mean, I think we had a hearing on it where foreign nationals had access—many people thought too much—and then they 

just pulled back for the foreign national to limit the access at Los 

Alamos; am I correct? 

Ms. Bowden or—do you know? 

Mr. WILSHUSEN. You mean previously? 

Mr. STUPAK. Right. 

Mr. WILSHUSEN. That I don’t know, sir. 

Mr. STUPAK. OK. 

Mr. Friedman, if I may ask one question. I don’t want to leave 

you out there. Maybe we’ll get around the second time. 

In your January 2008 you reported that the Department failed 

to adequately address cyber security incidents, coordinations and 

communications. In our next panel Dr. Wilbanks will say just the 

opposite. 

Why is there such a difference of opinion as to the effectiveness 

of cyber security incident coordination and communication? And 

why is this such a challenging area for the Department? And who 

within the Department is really responsible for collecting, reporting 

and disseminating cyber incident information? 

In other words, I guess, who is responsible for the program? Why 

do we have such diverse views on how effective they’re being on the 

cyber security? 

Mr. FRIEDMAN. Well, Mr. Chairman, I can’t speak to Ms. 

Wilbanks’ testimony, and I’m not sure I can completely understand 

the distinction. 

The Department does have a fairly sophisticated system of collection, both a NNSA system and a non-NSA system of collection of 

these incidents, in part to report to law enforcement, partially my 

office and others, and in part to do trending analysis and best practices and to alert the various facilities within the Department as 

to where the problems may be, and trends they may see that may 

affect all of the individuals. 

What we found in the past is that these two entities, which by 

the way are in the process of being consolidated, at least in part, 

that they did not receive—we did not receive from them all the information that we needed to have a quality referral to law enforcement and we had to go back and get additional information. 

So the structure is in place along the spectrum. The question is, 

is it as complete and comprehensive as it needs to be and as responsive to the needs of law enforcement and to the others 

throughout the Department? 

Mr. STUPAK. OK. I thank you. Before I yield to Mr. Shimkus, you 

know, there has been this report or letter by Mr. Terry Turchie, 

and Mr. Dingell brought it up more in his opening statement. And 

I am sure you are going to be looking into that, the comments 

made in the letter by Mr. Turchie as to counterintelligence and the 

intelligence. Will your office be looking at that? 

Mr. FRIEDMAN. Is that directed to me? 

Mr. STUPAK. Yes. 

Mr. FRIEDMAN. I first saw the letter from Mr. Turchie this morning at 10 minutes to 8:00 and I hadn’t seen it previously. I had 

seen the report by the Congressional Research Service about 5 or 

57 

6 months ago, which addresses many of the same issues. We are 

certainly looking at it carefully and we will be considering what the 

next step should be. 

Mr. STUPAK. We look forward to working with you on that, because we are going to look at cybersecurity at all the agencies 

under our committee’s jurisdiction. So I just wanted to let you 

know. Thank you. 

Mr. Shimkus for questions, please. 

Mr. SHIMKUS. Thank you, Mr. Chairman. Still being relative new 

to the committee and the oversight, having been on the full committee for a long time, I don’t come with the years of analysis and 

frustration that many members do in delving into this. 

But current events dictate internationally that if a cyber red 

team, given a month and six to seven folks, can do great mischief, 

it poses a question, what can a nation state do with unlimited people and really unlimited dollars? In the international arena we 

have seen it with Estonia, we have seen it most recently in Georgia, not the State but the country. 

So it begs the question, if there is information, whether it is technical in nature or that can be combined on this yellow network, 

that is, quote/unquote, sensitive and all these words are—if it is 

sensitive, either personal information or it can then be placed together to create other information, that is I think a problem. 

And also, if in this definition of sensitive information and that 

information then runs the risk of—well, let me say it this way. In 

a communication environment, as we talked about before, you have 

got information available for doing the job, there is risk entailed. 

Are we willing to take the risk? Are we willing to assume the risk? 

I understand there is an open green—kind of like a green system 

which we can go to the general information on DOE, then the yellow system, and then the more—the issue that is classified. How 

do we clean up the yellow network so that the classified information isn’t there and it is not accessible through the other networks? 

And let me go to Mr. Wilshusen first. 

Mr. WILSHUSEN. Well, I think, first of all, with regard to the information on the yellow network, classified information is not authorized to be on that network. And so there has to be a process 

that goes through to make sure that information that is on that 

network is not classified. And so there is some classification requirements on that to assure—determine whether or not somebody 

that is on the yellow network can gain access to the red network. 

Is that what you are asking? 

Mr. SHIMKUS. Or green to yellow to red. 

Mr. WILSHUSEN. Right. Well, we are— 

Mr. SHIMKUS. And then is part of that the Trojan Horse part of 

thing that you’re talking about is accessing in and then sleeping 

and then awakening and then moving through aspects? 

Mr. WILSHUSEN. Right. We are, at the request of this subcommittee and the full committee, reviewing the security controls 

over the classified network at Los Alamos, too. So I can’t comment 

on that at this point in time. Our work is still premature to make 

any type of preliminary information or observations on the security 

controls over the red network. 

58 

However, with regard to the yellow network and the green network, they were interconnected in the past, and that was one of the 

issues that we have identified that weaknesses—even though our 

work on this particular engagement focused on the yellow network, 

we found that there were paths from the green network into the 

yellow network. 

Mr. SHIMKUS. And then I would ask if that was identified, have 

those paths then severed that we know of today, that interconnect—the interconnection, the ability to do that? 

Mr. WILSHUSEN. You mean today is that capability, do those 

weaknesses still exist? 

Mr. SHIMKUS. And that is probably a question for Mr. Friedman 

and Mr. Podonsky. But, again, I have been on the telecommunications, the tech committee and stuff, but I think the only way you 

can really—information gets compromised in one or two ways. You 

either have hackers that can use the system to move through, so 

you have to sever the connection. Or you have actually humans 

who surreptitiously, illegally, as in flash drives, grab information. 

And we know that has happened in the past, too. 

So that for security aspects, one would be sever the connections 

on the green network so that it does not have? And that is what 

you recommended. And the question would be to Mr. Podonsky and 

I guess Mr. Friedman, your analysis. Has that happened? And can 

it? Or can you not do the mission if you do that? 

Mr. PODONSKY. So far, Congressman, we have never identified 

any pathway from the green to yellow network. However, we 

strongly believe that the yellow network that we are referring to, 

which varies from lab to lab and site to site in terms of what goes 

on there, the certification and accreditation process that is part of 

the Department, and Mr. Friedman talked about, is there to make 

sure that we look at some of this sensitivities of these networks. 

While my colleague from GAO mentioned that there is no classified, or supposed to be, on the yellow network, the fact of the matter is we do need a classification process for classified information. 

The labs also do need a sensitive process. We need better controls. There is no doubt in our minds from the oversight perspective 

that while the information is not classified but is sensitive, that 

doesn’t mean it is not valuable to somebody. And that is what we 

are concerned about. But we also believe, as I said in my opening 

statement as well as the written testimony, that we believe there 

are things that we can do, like encryption of the information that 

is on the network. 

Mr. SHIMKUS. The yellow system, can they e-mail outside of the 

system? If you are on the yellow network, can you e-mail to like 

Berkeley or the country of Georgia? And if you can, is that then 

a main pathway of concern? 

Mr. PODONSKY. Yes, it is. And they can. And one of the things 

I mentioned, and I want to reiterate my point in my opening statement, is that we need to make tighter controls on making sure that 

if somebody who is unauthorized into the yellow network cannot 

send the information out the way our red team did. And there are 

mechanisms that can be used by the Department to prevent that 

as best we can. 

59 

One of the other problems is at Los Alamos, for example—and 

it is not unique to Los Alamos and it is not unique to DOE, I can 

emphasize—is that when you have 25,000 individual laptops or 

stand-alone computers and these people are cleared to use those, 

there is also a trust factor. And we have seen at all the sites within 

the Department sometimes that human factor fails. So what we do 

need is we need systems in place to put tighter controls. 

Mr. SHIMKUS. I am just trying to do a comparable to our systems 

here. We have the Web sites, we have the e-mails. There are some 

firewalls that disallow individuals from e-mailing us unless they 

kind of identify that they are from the constituency, and there is 

a blocking portion of that. I am not sure if that is off-the-shelf 

type—of probably not very—because we really don’t handle sensitive—it might be sensitive politically or for other purposes, but 

not to the extent that this is. This is of a concern. 

So I would—that would be where I would follow up, is trying to 

make sure that the individuals are well-screened and we do the 

background checks. Foreign nationals is a concern. And the risk, 

the whole question of risk and reward based upon the available information and the work that foreign nationals can do. 

So, again, this is my first oversight investigation hearing on this 

subject. I know this committee continues to be very diligent. We 

have had really bad case scenarios in the past. And I just pledge 

my support to the chairman to be engaged with him as we move 

forward. And thank you for your time. 

Mr. STUPAK. I appreciate that. I appreciate the gentleman’s comments. 

If I just may. On this yellow that you were talking about, yellow 

network. Information out there may be unclassified. But if I take 

a piece of yellow unclassified, put it with another piece of yellow 

unclassified, put it together, that information then could become 

classified. Is that? 

Mr. PODONSKY. If I can, Mr. Chairman. We call that the mosaic 

effect. And I would say it is counterintuitive to think that there is 

not a value of the information on the network. It is speculative for 

any of us to say that it would actually fit together and become classified. But irrespective of whether it is classified, the sensitivity 

can be of extreme value to people who mean to do harm to our Nation. It may not be in the realm of national security information, 

but let me give you an example. 

We sometimes send things that’s password protected. We’ll send 

a message, and then it will be followed up by another message that 

has the password in it. So if—I am not from the Intelligence Committee, but if somebody is vacuuming up all the information they 

can, they can put those two together and get that password protection. Again, it’s not classified, but it’s sensitive enough that we 

need to have stronger controls in place. 

Mr. STUPAK. Mr. Friedman. 

Mr. FRIEDMAN. Mr. Stupak, first of all, the mosaic effect is important. And you described it well, I think. But one of the problems 

with the yellow network, and it’s not—it’s understandable and it’s 

the nature of the contents of the network, is that—and if you recall, if I might divert you for a second. In 2005 or 2006, we had 

60 

the exfiltration of PII, personally identifiable information, at the 

Albuquerque Service Center, I believe. 

One of the problems is that this information, while it may not 

be classified, if it falls into the hands of the wrong individual, that 

individual could conceivably be exploited by an inappropriate 

source. So there are—it’s sensitive information that needs to be 

carefully protected. 

Mr. STUPAK. Mr. Dingell for questions, please. 

Mr. DINGELL. Mr. Chairman, I thank you. Mr. Chairman, first I 

would like to insert in the record a letter received by me from Mr. 

Terry D. Turchie, which pretty much speaks for itself about the situation with regard to security at the Lawrence Livermore National 

Weapons Laboratory. I will have some questions about that after 

I finish my first set of questions and perhaps some later time. 

These questions, yes or no. Mr. Podonsky, in your testimony you 

mentioned one of your most recent red teams was able to penetrate 

the networks of two DOE labs. Is that correct? 

Mr. PODONSKY. That is correct, sir. 

Mr. DINGELL. Which were those? 

Mr. PODONSKY. They were two science labs. 

Mr. DINGELL. You don’t want to identify them by name? 

Mr. PODONSKY. I am happy to identify those in executive session, 

sir. 

Mr. DINGELL. Thank you. Mr. Podonsky, isn’t it true that your 

red team was able to download very large quantities; i.e., 

gigabytes, of data, some of which were sensitive, without being detected by DOE authorities? 

Mr. PODONSKY. Yes, sir. 

Mr. DINGELL. Mr. Podonsky, you also indicated that the level of 

access your team was able to quickly obtain over the course of just 

a few months would have allowed you to change data or otherwise 

corrupt a particular lab’s cyber network. Isn’t that correct? 

Mr. PODONSKY. Yes, sir, it is. 

Mr. DINGELL. Mr. Podonsky, I am gathering what your red team 

did to these labs’ cyber networks has rather profound security implications. Is that correct? 

Mr. PODONSKY. Yes, sir, it does. 

Mr. DINGELL. Mr. Podonsky, doesn’t this suggest that the DOE 

does not currently have sufficient capability regarding its cyber defenses. 

Mr. PODONSKY. No, sir, it does not. 

Mr. DINGELL. What, in your words, does this exercise suggest as 

to the capability of DOE and its labs to thwart cyber attacks? 

Mr. PODONSKY. What it tells us, Mr. Dingell, is that we have 

some of our sites that are inconsistent in their application of DOE 

policies. We have some sites that perform better. But, overall, the 

Department of Energy as the rest of the government has to 

strengthen our cybersecurity networks. 

Mr. DINGELL. Mr. Podonsky, isn’t it true that the addition to the 

access your team gained at these two sites, by installing your own 

malicious programs on a number of their laptop computers your 

red team was able to make important footholds into the networks 

of other facilities after these laptops were legitimately connected to 

their respective networks? 

61 

Mr. PODONSKY. Yes, sir. That is correct. 

Mr. DINGELL. Mr. Podonsky, moreover, didn’t additional activity 

conducted by your red team demonstrate your team’s ability to possibly move around throughout a number of DOE sensitive networks? 

Mr. PODONSKY. We believe that that would have been the case 

if we had continued on with the activity. 

Mr. DINGELL. What more can you tell about that? 

Mr. PODONSKY. Well, we terminated our activity because we were 

aware that there was actual infiltration in some of the sites that 

we were looking at. 

Mr. DINGELL. Now, Mr. Wilshusen, yes or no again, please. Some 

have suggested the information on the yellow unclassified network 

at the labs is not sensitive enough to warrant major action to protect it. This is a question that our chairman has been raising on 

this. I gather you don’t agree with that statement. 

Mr. WILSHUSEN. That is correct; I do not agree. 

Mr. DINGELL. Now, Mr. Wilshusen, in fact your reports say that 

the information in the Los Alamos unclassified network contains 

such information as Naval propulsion data, personally identifiable 

information, unclassified controlled nuclear information, and a host 

of other sensitive categories of information. Is that correct? 

Mr. WILSHUSEN. That would be those categories of information. 

Yes. 

Mr. DINGELL. Could you mention any other categories that 

should be addressed? 

Mr. WILSHUSEN. Did you include our unclassified controlled nuclear information? 

Mr. DINGELL. Yes. 

Mr. WILSHUSEN. OK. 

Mr. DINGELL. Mr. Wilshusen, isn’t it the case that your report 

said that that kind of information a valuable target for foreign governments, terrorists, and industrial spies? 

Mr. WILSHUSEN. Yes. 

Mr. DINGELL. Mr. Wilshusen, I gather that GAO does not believe, 

given your findings at the labs, the DOE as a whole is sufficiently 

prepared for cyber attacks or cyber intrusions. Is that correct? 

Mr. WILSHUSEN. I would say that they are at increased risk. Yes. 

Mr. DINGELL. And that would be a substantial risk? 

Mr. WILSHUSEN. It could be. Yes, sir. 

Mr. DINGELL. Now, Mr. Podonsky again. Let’s talk about—let’s 

talk about this. The Director of Los Alamos remarks in his testimony that your offices draft audit report for August/September recognizes that Los Alamos National Laboratory is making progress in 

many security areas. Is that correct? 

Mr. PODONSKY. That is correct. They are making improvements 

that we have not seen in 20 years. 

Mr. DINGELL. But I gather, however, that the lab is still not out 

of the woods when it comes to physical security. Is that correct? 

Mr. PODONSKY. There are areas that they need to improve upon, 

but they have made quantum leaps from our last inspection. 

Mr. DINGELL. Ms. Bowden, isn’t it true that DOE’s Office of Independent Oversight found major concerns regarding Lawrence Livermore’s security capability in April of this year? 

62 

Ms. BOWDEN. Yes, sir. 

Mr. DINGELL. Ms. Bowden, in your testimony you say concerning 

the exercise that, and I quote, ‘‘Livermore received the lowest possible rating for protective force performance and protection of classified resources.’’ Isn’t that correct? 

Ms. BOWDEN. Yes. That is what the Office of Independent Oversight found. 

Mr. DINGELL. And, GAO, to the extent that you can identify this 

in an unclassified setting, how did Lawrence Livermore get into 

this position and what are the root causes? 

Ms. BOWDEN. Well, in a general sense, and based on our preliminary observations, because this work is ongoing, we discussed that 

question with officials at the laboratory and with officials—Federal 

officials at the site office. And there are a number of factors that 

may have contributed, though we will continue to work on this. 

Those included focus—a focus shift on contract transition, the 

declaration of the site as non-enduring for Category I special nuclear material. And, in addition, frequent security policy changes 

over the different design basis threats that had been issued over 

a period of time. 

Mr. DINGELL. Thank you. 

Mr. Podonsky, it was your claim that GAO referred to in their 

testimony as doing the physical red teaming of Lawrence Livermore. Is that correct? 

Mr. PODONSKY. Yes, sir. 

Mr. DINGELL. Mr. Podonsky, I have limited time so I know you 

will speak quickly. But tell us how you believe Lawrence Livermore 

got into the posture where it has performed so poorly. 

Mr. PODONSKY. It’s a mystery to us, Mr. Dingell, because we 

have seen in our last inspection before the spring that they were 

performing well. We do believe that a great contributor is, as the 

GAO just mentioned, having to do with the contract change-out. 

Mr. DINGELL. Ms. Bowden again, if you please. One of the concerns you have raised in your report about Los Alamos’s physical 

security posture is the cyclical nature. What—that is, the labs appear to improve when they have had a mishap and know that they 

are under scrutiny. Is that correct? 

Ms. BOWDEN. Yes, sir. 

Mr. DINGELL. Ms. Bowden again. What explains the root cause 

of the cyclical nature of the security at the labs, and how can we 

prevent this? 

Ms. BOWDEN. In our report we have made several recommendations that we think will address sustaining improvements over 

time, the first of which is providing better financial incentive for 

effective security performance in the contract determinations for 

the award fees at the end of each fiscal year. In addition, we feel 

it’s important to ensure adequate NNSA site office oversight of security on a consistent basis at the laboratory. 

Mr. DINGELL. Mr. Chairman, because of the limited amount of 

time, I request that this letter be inserted in the record, and I 

would ask that our witnesses give us their comments on the findings and the statements made in the letter, and I would ask that 

the record be kept open so that that may be inserted into the 

record at the appropriate fashion in time. 

63 

Mr. STUPAK. Without objection. I would also note that it’s in our 

binder. So it will be made part of the record, Mr. Chairman. 

[The information appears at the conclusion of the hearing.] 

Mr. DINGELL. Thank you, Mr. Chairman. 

This to Mr. Friedman. The Federal Information Security Management Act requires that the Office of the Inspector General conduct an independent annual evaluation to determine whether the 

Department’s unclassified cybersecurity program properly protects 

its information systems. Is that correct? 

Mr. FRIEDMAN. That is correct. 

Mr. DINGELL. Mr. Friedman, in 2008, your evaluation report of 

the Department’s unclassified security program states: The Department continues to make, quote, incremental improvements in this 

program. Yet, isn’t it true that you have continued to find ongoing 

concerns with DOE’s cyber defense capability? 

Mr. FRIEDMAN. That is correct. 

Mr. DINGELL. Mr. Friedman, in fact, isn’t it correct that your latest reports found the following over the past few years: Unsolved 

issues surrounding risk assessments and adequacy of security controls? Yes or no? 

Mr. FRIEDMAN. You are correct, sir. 

Mr. DINGELL. Lack of centralized department-wide inventory of 

information systems. 

Mr. FRIEDMAN. That is correct. 

Mr. DINGELL. That is a fairly simple to do, isn’t it, to perform 

that particular act? 

A failure of some sites to complete contingency disaster plans. 

Mr. FRIEDMAN. Correct. 

Mr. DINGELL. Failure of Department officials to implement Federal and Department security requirements in a timely manner. 

Mr. FRIEDMAN. That is correct. 

Mr. DINGELL. Mr. Friedman, in your opinion, do these weaknesses continue to exist? 

Mr. FRIEDMAN. They—our reports are current. And the answer 

to your question, Mr. Chairman, is that until we do another review 

and see that they are not in effect, we will continue to believe that 

they exist. Yes. 

Mr. DINGELL. Now, why do these security questions and weaknesses continue to exist? 

Mr. FRIEDMAN. That is one of the most perplexing questions that 

I deal with every day, Mr. Chairman. 

Mr. DINGELL. It seems to be a leadership problem. Doesn’t it? 

Mr. FRIEDMAN. Well, I would say this. The conclusions that we 

reach after thinking about this over a great deal of time is that the 

Department lacks the ability to close the game, in the sense that 

a lot of good actions are initiated but they don’t get completed and 

implemented. And that seems to be a problem. 

Mr. DINGELL. Thank you. 

Mr. Chairman, I appreciate your courtesy. Thank you. 

Mr. STUPAK. Thank you, Mr. Chairman. 

Mr. Burgess for questions. 

Mr. BURGESS. Thank you, Mr. Chairman. 

64 

Let me ask a question to the GAO related to the management 

of the money available for security. How much money have we allocated for overseeing that security’s implemented and followed? 

Ms. BOWDEN. In fiscal year 2007, it was about $188 million. 

Mr. BURGESS. And so that is not a huge sum by Washington 

standards, but a significant sum, and the problems persist. What 

sum is it going to take so that we get to the place we want to be? 

Mr. WILSHUSEN. That is a very difficult question to answer, and 

I don’t know if I can point to say this is the sum that is needed. 

I think what I can say, though, is that the agency needs to properly 

assess its risks and determine what policies and procedures that 

they need to implement to cost effectively reduce those risks to an 

acceptable level. 

We have to remember that security is a risk management problem; it’s not a risk elimination or risk avoidance problem. Because 

you can throw so much money at security and you can lock down 

everything, but at the same time the costs would be prohibitive as 

well as it will probably take a major hit on productivity. So it’s 

really a balancing act to determine how much is necessary to secure the systems based on risk. 

Ms. BOWDEN. And if I may clarify, the dollar figure was for Los 

Alamos. 

Mr. BURGESS. But we are going to have—it will be budget time 

again before we know it, and we are going to have to be thinking 

through these things. At some point we are going to need some advice from people like you as to whether or not we are doing our job 

in providing you the resources; i.e., the funds that you need to hire 

the personnel, to purchase the software, to run the red teams, to 

make sure that things happen the way that they are supposed to 

happen. 

Mr. WILSHUSEN. Well, certainly what I will say, too, is that for 

many of the recommendations that we are making in our reports 

that are being released today, much of that would not necessarily 

require additional acquisition of software devices. It’s more of a 

management issue, taking the security controls, the devices that 

are presently there, and configuring them in such a manner to 

make them more secure. 

Mr. BURGESS. We may come back to the management question 

in just a moment. But is it also a matter of time? 

Mr. WILSHUSEN. Yes, sir. Time is of—in our view, time is of the 

essence in terms of taking the corrective actions to improve the security over the unclassified network at Los Alamos, because of the 

sensitive information it contains and because of the risks associated with the weaknesses that we have identified. 

Mr. BURGESS. Well, giving you more time may increase the risk. 

Providing you more money, if you can do it in a shorter period of 

time, in my mind at least, would be a reduction of risk. I am just 

not sure how much. I am not sure how much flexibility we should 

be willing to give on time for implementation just because of the 

risk that is out there. I mean, and it’s not just you, but certainly 

your area is—it’s such a significant vulnerability that we really 

can’t overlook it. 

65 

A question, Mr. Podonsky, about the number of laptops. What 

was the number that you told us, the number of laptops that may 

move around? 

Mr. PODONSKY. I misstated. I was meaning the stand-alone sets 

of computers, which I said were 25,000 users at Los Alamos. And 

I used that example to answer Chairman Stupak’s questions about 

the vulnerability of the yellow network. 

Mr. BURGESS. What would be the correct figure for the number 

of laptops that may move around in so-called trusted circles within 

the lab? 

Mr. PODONSKY. I don’t have that number. I would have to get 

that number and get it back to you. 

Mr. WILSHUSEN. One of the things that we’ve identified on our 

review was that there are about 13,000 users. Now, this is just on 

the unclassified networks, so I can’t comment on all of the networks at Los Alamos. But just for a scope. There are about 13,000, 

a little bit over 13,000 users on the unclassified network, and that 

network contained about 25,000 devices. And so those would include work stations, but also routers, switches, and other types of 

devices. 

Mr. BURGESS. But as we have seen from these reports and other 

areas, a misplaced laptop is a source of great vulnerability. And all 

of us, you and us, are under great scrutiny in that regard to make 

certain that these very powerful and very useful devices—they can 

certainly increase productivity but they really expose a great deal 

of vulnerability if we are not careful. So I just wonder if we 

shouldn’t be a little bit more circumspect about the number of devices that are actually out there with information. 

I think it was on this panel that we heard about the purchase 

of some of the equipment, which is proprietary equipment, with 

USB ports that might be vulnerable to access. And we sealed them 

up with JB Weld—which is a good Texas product, so I am glad but 

we used J Weld, but it just seemed like a significant oversight in 

the purchase of that equipment to lead us to that degree of vulnerability. And then laptops that can move around so easily and be 

left somewhere or stolen or lifted, or even if someone did have an 

idea to do something that they shouldn’t be doing, it just makes it 

that much easier for the person who has a criminal intent. 

I guess, Mr. Podonsky, this is for you. On the issue of—I think 

we’ve talked about this before on this subcommittee, about this 

issue of encryption and sequestration. How is that project going? 

Where are we with that? Can you develop that a little bit for us 

on the sequestration and the equipment side? 

Mr. PODONSKY. What I can tell you—first, I am sure the second 

panel can give you more clarity on how far they have gone in that 

arena. But from our inspection process, we don’t feel that enough 

of the sites are encrypting the information that needs to be 

encrypted. There is— 

Mr. BURGESS. Why is that? 

Mr. PODONSKY. Well, because the policy says it is preferred that 

the information be encrypted. And we have learned over time that 

unless there is a regimented language that says you shall encrypt 

it, then using the word ‘‘preferred’’ becomes accounting option. And 

we find that a little disturbing. 

66 

Mr. BURGESS. Too much flexibility, in other words? 

Mr. PODONSKY. That is what we believe. 

Mr. BURGESS. Now, is there any problem with obtaining the software or the type of software that is available? Is there a satisfactory program that is out there that you all are using for the 

encryption? 

Mr. PODONSKY. I believe the software is out there; but I also understand that the process would be a little bit less convenient when 

doing business. 

Mr. BURGESS. And what about the sequestration aspect of it? 

Mr. PODONSKY. I will have to defer to the CIOs. 

Mr. BURGESS. And I think it was your testimony where you said 

the attacks were becoming more sophisticated, more targeted. Are 

they also becoming more frequent? 

Mr. PODONSKY. Yes, sir, they are. 

Mr. BURGESS. And do we have a general idea of where they are 

coming from? 

Mr. PODONSKY. I think that is a question that really should be 

answered in the executive session. 

Mr. BURGESS. Fair enough. We will do that. 

A question was asked about what caused the lower security level 

at Livermore, and I think you answered, Mr. Podonsky. But 

Ms.Bowden, do you have an opinion on that as well through your 

study? 

Ms. BOWDEN. I think we both agree that there was a shift in 

focus to the contract, the management and operating contract transition. 

Mr. BURGESS. And that is at Livermore? 

Ms. BOWDEN. Yes. 

Mr. BURGESS. Because at Los Alamos, we had the contract evaluation but we didn’t change the contract. Correct? Do I remember 

that correctly? 

Ms. BOWDEN. The contractor was changed in 2006. 

Mr. BURGESS. At Los Alamos? 

Ms. BOWDEN. Um-hmm. 

Mr. BURGESS. So when we talked about some of the leadership 

problems as that, do you think that has been dealt with satisfactorily? 

Mr. PODONSKY. Sir, I would like to answer that, having inspected 

Los Alamos for the last 24 years. The answer is absolutely we see 

a sea change that we haven’t seen there before. I just came back 

from the Los Alamos inspection closeout for my independent oversight, and we have seen a lot of improvements. We have seen commitments that we don’t think were just pabulum. And we believe 

it’s because of the accountability. We know that they are watching 

our enforcement actions and compliance orders. We know that they 

are paying attention to the inspections. 

Mr. BURGESS. And do you think that there’s going to be a way 

to extrapolate those successes to, say, the Livermore facility? 

Mr. PODONSKY. I am sorry? 

Mr. BURGESS. Is there going to be a way to extrapolate those successes to other facilities where we’ve fallen behind? 

Mr. PODONSKY. Based on the aggressiveness by which the Livermore folks are addressing our very serious concerns from the 

67 

spring inspection, we are hopeful. But, again, the sustainability is 

going to be an issue that we are going to be watching. 

Mr. BURGESS. Very good. 

Thank you, Mr. Chairman. I’ll yield back. 

Mr. STUPAK. I thank the gentleman. 

Ms. DeGette for questions. 

Ms. DEGETTE. Thank you very much, Mr. Chairman. 

I would like to follow up on some of the questions that Mr. Dingell was asking. The first one being, on this yellow network, the 

unclassified network, there is still sensitive information. And everybody has agreed with that here today. And the question is, what 

dangers do we have if people can access that information? Because 

even though it’s not classified, it still is important. Mr. Dingell 

mentioned a couple of the nuclear issues, but I just want to go 

through the list that the GAO listed in their report because it’s 

really kind of shocking. 

Business proprietary information. The nuclear information he 

talked about. Export control information. The military critical technology list. Confidential foreign government information. And personally identifiable information, including names, aliases, Social 

Security numbers, and biometric records of employees, contractors, 

and visitors. 

Now, a lot of this information if someone were to access it would 

be criminal and even worse. This is not just completely neutral information. And so I have some follow-up questions on what is happening to try to preserve that information. 

I guess my first question would be maybe to you, Mr. Podonsky, 

is do you think that the labs or the DOE have the technical expertise and resources to protect this information that is currently residing on the unclassified networks? 

Mr. PODONSKY. Congresswoman DeGette, we do believe that the 

technical expertise exists within the laboratory community as well 

as with the rest of the Department. We do also believe that the 

sensitivity—we share your concerns about the sensitivity that is on 

the yellow network. That is why I have said in my testimony and 

in my opening statement we do believe tighter controls are necessary. 

Ms. DEGETTE. Well. 

Mr. PODONSKY. If I might continue. As exemplified by our red 

teaming effort, and we are not the most sophisticated red teaming 

hackers in the world, but given our capabilities and what we were 

able to do, that should give us all pause as to what we need to do. 

Ms. DEGETTE. I was going to ask that question in a minute, because unlike my friend, our ranking member, I have been on this 

committee for 12 years and I have been to Los Alamos and I have 

been in these hearings and we have you guys down all the time. 

And every time you come in, you say, you know, we have these 

risks, we have these problems. It’s always cropping up some other 

place. So if we have got the expertise and capability to do it, here’s 

my simple question to you, why aren’t they doing it? Because you 

are right, it’s not just the yellow information, it’s the red information. 

Mr. PODONSKY. I can give you an opinion from oversight as to 

why the Department is not doing it. 

68 

Ms. DEGETTE. I would love that opinion. 

Mr. PODONSKY. And our opinion is it’s not always been the highest of priorities from different administration to different administrations. I would also say— 

Ms. DEGETTE. But we have had this administration now—do you 

mean Washington administration or lab administration? 

Mr. PODONSKY. No. Washington administration. 

Ms. DEGETTE. Well, we have had this administration 8 years. 

Mr. PODONSKY. In 2000, ma’am, we came to the floor of this 

hearing room and gave a demonstration, a live demonstration of 

how we could crack codes of passwords. 

Ms. DEGETTE. I remember it. I was there. 

Mr. PODONSKY. So we know that these problems exist. 

Ms. DEGETTE. So why—we have had this administration 8 years. 

Is your testimony today that it has been a low priority for this administration? Yes or no? 

Mr. PODONSKY. No, ma’am. 

Ms. DEGETTE. Then why haven’t we done it? 

Mr. PODONSKY. I don’t have a complete answer for you because 

I am not within the CIO’s office. That is in the next panel. But 

from our perspective, we have written reports on this very subject 

multiple times. 

Ms. DEGETTE. I am frankly, with all due respect, I am not particularly interested in the written reports. I am interested in when 

are we going to do this. If we have got the technical ability to do 

it, if we’ve identified the problem, then how quickly could we solve 

the problem if appropriate attention were given? Anybody can answer that if you know the answer. 

Mr. PODONSKY. I don’t know what my colleagues on the panel 

think, but I think this is a problem that can be solved. 

Ms. DEGETTE. No. How soon can it be solved? 

Mr. PODONSKY. As soon as the resources are applied. 

Ms. DEGETTE. OK. So it’s a resource question. That goes back to 

Dr. Burgess’ question, which is, what kind of resources are we talking about here? 

Mr. PODONSKY. We’re talking about dedicated people within the 

cyber community to solve the problems. 

Ms. DEGETTE. How many dedicated people? How much money? 

Mr. PODONSKY. I would have to—without just giving it off the top 

of my head, I couldn’t tell you that. But I think that we have— 

Ms. DEGETTE. Do you know that? 

Mr. PODONSKY. I believe we have it in the Department. We have 

the technical intellectual capabilities and we have the resource capability to make the changes. 

Ms. DEGETTE. All right. So if you could supplement your answer 

within 30 days, I would appreciate it, telling us what kind of resources we would need to give to this. 

Now, let me ask another question. And again if other people 

know, please chime in. Do we, if we have got the ability to do it 

and it’s just a matter of resources and priorities, do we have a full 

inventory of all the information that is residing on these unclassified networks? 

Mr. PODONSKY. I don’t believe that we have a complete inventory 

on what resides. 

69 

Ms. DEGETTE. Is that something we would need to do? 

Mr. PODONSKY. That would be a major undertaking for millions 

and millions of documents. And I am not so sure, Congresswoman 

DeGette, that that is the best use of the monies. The best use of 

the monies is to protect the information from going out, and protect 

the information from having access by hackers. 

Ms. DEGETTE. It would probably also be worth reviewing categories of information to see if we really do need to have that on 

our networks then if we can remove it. Correct? 

Mr. PODONSKY. Yes, ma’am. And that would be up to the individual program offices as to what types of information they are allowing their folks to put on the network. 

Ms. DEGETTE. Well, maybe not. Because for some of these types 

of information, you could probably make a decision from the top 

whether you needed to have that information on certainly unclassified yellow networks. Information like aliases and Social Security 

numbers and biometric records of employees. It’s hard to see how 

you would need to have that on some kind of a network. What do 

you think? 

Mr. PODONSKY. Well, I don’t know how they use all the information, but I do know they use that network to conduct business. And 

they separate that from the classified. 

Ms. DEGETTE. See, what I worry about, though, is if you are 

leaving it up to each individual department head, that then you 

have no overall standard by which they could weigh it. So if you 

had an overall standard, then they could come in and ask for an 

extension if they had a need to put that on the network. 

Mr. PODONSKY. And the CIO when he came on board in 2005, I 

believe, or 2006 put together with the three undersecretaries a governance model of federalizing the federation of policy that has the 

overarch policy, and then NNSA, Science, and Energy are able to 

tailor that to what their individual missions are. 

Ms. DEGETTE. Now, Mr. Podonsky, do you think that the DOE 

lab should consider removing certain information on the unclassified network or increase its level of classification? 

Mr. PODONSKY. As I said, Congresswoman DeGette, the laboratories need to take a good look, and the Department, in making 

sure that there are stronger protections of that information. Some 

of that information may need to be removed. But one of the problems is, where do you put it? If you put it on the classified net, you 

have now redefined what classified is. 

So I again go back to our oversight perspective, is we need to 

keep people out of it, and we need to make sure that we have a 

rigorous process to make sure that anybody that might get in it 

cannot send information off the net. 

Ms. DEGETTE. What is your opinion on that, Mr. Wilshusen? 

Mr. WILSHUSEN. Well, I think I would also agree to the point 

that the information on that yellow network, whether or not that 

should be upgraded, if you will, and then reclassified and then put 

on the red network is a decision that is whether or not that information is classified or not. And that is something that needs to be 

done, and it probably has already been done, you know, it’s been 

determined to be sensitive but unclassified. That is why it’s on the 

yellow network. 

70 

But I agree with Mr. Podonsky, that the first thing that needs 

to be done is to better protect the information that is on that network by— 

Ms. DEGETTE. I want to ask you one more question. Do you think 

there is some argument to be made about maybe making an intermediate network between the yellow and red networks for some of 

this unclassified information? You don’t want to be calling things, 

as Mr. Podonsky rightly says, you don’t want to be calling things 

classified if they are not. On the other hand, there is things that 

might be sensitive, like employees’ Social Security numbers that 

are not necessarily classified information. 

Mr. WILSHUSEN. Right. And because of that, such as personally 

identifiable information needs to be protected. But should that be 

on a different network? That is what the yellow network is for; it’s 

the unclassified protected network. 

Ms. DEGETTE. So your view is we need to protect that network 

better. 

Mr. WILSHUSEN. Yes, ma’am. And— 

Ms. DEGETTE. I just want to say, I know you folks can’t make 

the rules, you can only make the recommendations. And I am sure 

that—you don’t have to answer this, I am sure that many days you 

are just as frustrated as we are; you keep identifying these problems but yet no progress is made. So I want to thank you for your 

commitment to these issues. They are very important. 

Mr. WILSHUSEN. Thank you. 

Mr. STUPAK. Mr. Shimkus has a quick question, and then we will 

go on to Mr. Inslee. 

Mr. SHIMKUS. And I will be brief. One thing I wanted to follow 

up with what I didn’t was just an overall assessment of the corporate culture, or the culture of these labs and this whole issue. I 

agree with Chairman Dingell that it’s leadership, and its leadership goes from the top and then the director of the lab, the director 

of the sub environments. 

Has the corporate—let me, Mr.Wilshusen first. Has the corporate—did you evaluate the culture of the labs? And with respect 

to my colleagues who have been on this issue for a long time, which 

again which I haven’t, has the culture changed positively in the security environment for the labs? 

Mr. WILSHUSEN. Well, related to just the cybersecurity portion of 

it, and I will defer to Ms. Bowden on the physical security, we have 

just completed our review, and that is our first review that we have 

done reviewing cybersecurity out at Los Alamos. We have noted 

that some of their technical folks in terms of technical security individuals are among some of the better ones within the Federal 

Government. And, indeed, they implemented many innovative techniques to try to secure their unclassified network. However, we also 

found though that there were still a number of very significant 

vulnerabilities that impaired their ability to adequately protect 

that information on their network. 

But in terms of the culture, I think there has been a change over 

the last year from what we have seen during the course of our 

audit. It seems like they are more concerned about the 

cybersecurity. But whether that is in response to our initial field 

71 

site visits and how long that remains, of course, remains to be 

seen. 

Mr. SHIMKUS. Mr. Friedman, can you respond to that? 

Mr. FRIEDMAN. Yes. In all fairness, while we still find problems 

and there are still concerns, and lot of them are serious, I don’t 

think there is any question that the results of our work suggests, 

and our interactions with the laboratory personnel, that there has 

been a change in mindset, much more aggressive in the area of security. It may be beyond their capability to fix all the problems, but 

I think—and I have been observing this, sir, for three decades— 

there is a change. There is no question about that. 

Mr. SHIMKUS. Thank you. And I would just hope that the position would be—I am not going to ask Mr. Podonsky to follow up, 

but I would just say, if there is a positive change in the culture, 

we need to push hard to sustain that change. 

Thank you, Mr. Chairman. 

Mr. STUPAK. Thank you. 

Mr. Inslee for questions, please. 10 minutes. 

Mr. INSLEE. Thank you. There has previously been a letter entered into the record from Mr. Terry Turchie that discloses very 

significant concerns by him. He’s formerly with the FBI and he 

served as senior counterintelligence officer at Lawrence Livermore 

Nuclear Weapons Laboratory. This letter is dated September 1, 

2008. And basically the letter is intended to alert Congress, it’s a 

letter to Chairman Dingell, of what he considers very serious failures to focus on counterintelligence. 

He describes there being a significant change from an emphasis 

or at least a significant commitment to counterintelligence to simply what he considers intelligence gathering. And he outlines in his 

letter quite a number of occurrences that would suggest there has 

been, at least in his view, a significant reduction in counterintelligence as he would define that activity. That, to me, is a significant issue, and I just would ask for the comment of any of you to 

respond to those concerns. 

I want to note, too, that there are many people that are disgruntled with Federal activity. This is a gentleman who seems to have 

credibility, his resume is pretty outstanding, and I think his concerns ought to be ones that we would investigate. So I would ask 

for any of your response, I don’t know if you have seen the letter, 

could respond to the general issue he has raised. His letter in general discusses a lack of financial and organizational commitment to 

counterintelligence as opposed to just what he would consider intelligence gathering. I just would ask for your comments, if you can 

provide them. 

Mr. PODONSKY. The only thing, Congressman, that I can tell you 

is that, number one, I have not seen the letter. We do work with 

the intelligence and counterintelligence office, and I could not give 

you any informed answer to your question based on our interaction 

with the intelligence/counterintelligence. But I would also defer to 

the second panel where the director of the counterintelligence is 

going to be a witness. 

Mr. INSLEE. Well, I would ask the panel to take a look at it and 

provide us your review, if you can do so. I do think it brings up 

some significant issues which would suggest there has been a real 

72 

change of emphasis, and we would appreciate your further comments. Thank you. 

I yield back. 

Mr. STUPAK. The gentleman yields back. Let me thank and ask 

this panel—that’s all the questions we are going to ask you in open 

session; as you referred to once or twice, we will go to closed session after the next panel. So I would ask that you just stay in the 

vicinity, not necessarily have to sit in the hearing room because we 

are going to do the next panel which has eight witnesses. It will 

take us some time, but we are going to go into closed session. We 

will invite you back for closed session. Thank you. 

I am going to ask our next panel to come forward, please. 

On our second panel we have Dr. Michael Anastasio, the Director 

of the Los Alamos National Laboratory; Dr. George Miller, who is 

the Director of Lawrence Livermore Laboratory; Dr. Thomas 

Hunter, who is the President and Laboratory Director at Sandia 

National Laboratories; Mr. Thomas Pyke, Jr., who is the Chief Information Officer at the Department of Energy; Dr. Linda 

Wilbanks, who is the CIO, Chief Information Officer, at the National Nuclear Security Administration within the Department of 

Energy; Mr. Bradley Peterson, who is the Chief and Associate Administer for the Defense Nuclear Security at the National Nuclear 

Security Administration within the Department of Energy; and Mr. 

Stanley Borgia, who is the Deputy Director for Counterintelligence 

in the Office of Intelligence and Counterintelligence at the Department of Energy. 

Have we got everybody? We are missing Dr. Wilbanks. We will 

have to wait for Dr. Wilbanks here for a minute. It will be just a 

second. And it looks like Mr. Peterson, too. 

[Brief recess.] 

Mr. STUPAK. It is the policy of this subcommittee to take all testimony under oath. Please be advised that witnesses have the right 

under the rules of the House to be advised by counsel. Do any of 

you wish to be advised by counsel? Everyone shook their head no. 

So we will do the oath. 

Do you swear or affirm that the testimony you are about to give 

will be the truth, the whole truth, and nothing but the truth in the 

matter pending before this subcommittee? 

[Witnesses sworn.] 

Mr. STUPAK. Let the record reflect all of our witnesses took the 

oath. You are now under oath. We will start with 5-minute opening 

statements. 

I understand, Mr. Peterson, you wish to go first. So we will accommodate that request for your opening statement, please. 

STATEMENT OF BRADLEY A. PETERSON, CHIEF AND ASSOCIATE ADMINISTRATOR, DEFENSE NUCLEAR SECURITY, NATIONAL NUCLEAR SECURITY ADMINISTRATION 

Mr. PETERSON. Good morning, Chairman Stupak, Ranking Member Shimkus, members of the subcommittee. My name is Brad Peterson. I was recently appointed Chief Defense Nuclear for the National Security Administration, the NNSA. Prior to this appointment, I was the Director of the Office of Independent Oversight 

within DOE’s Office of Health Safety and Security. It gives me a 

73 

unique perspective into the issues to be discussed today. In my new 

role, I have overall responsibility for physical and cybersecurity 

within NNSA. 

Following my remarks, Dr. Linda Wilbanks, the NNSA Chief Information Officer with operational responsibility for cybersecurity, 

will provide her opening comments. 

While the NNSA faces many challenges and it has significant 

room to improve, we continue to make enhancements in our physical and cybersecurity postures to maintain strong and robust security. NNSA operates some of the most secure facilities in the world 

and generally maintains effective physical security programs. Over 

the last 2 years, while there have been some issues, we see overall 

progress in improving performance at the NNSA weapons laboratories. 

Earlier this year, the Office of Independent Oversight conducted 

a safeguard security inspection of Lawrence Livermore National 

Laboratory and identified significant weaknesses in protective force 

operations, based in part on poor performance during force-on-force 

training exercises. 

Immediately after the inspection results were known, the Office 

of Defense Nuclear Security within NNSA devoted considerable attention to understanding the issues and providing subject matter 

expertise from across NNSA. While the NNSA was not pleased 

with their results from the Livermore inspection, I can attest to the 

fact that the Office of Defense Nuclear Security Livermore site office and laboratory have taken the issues very seriously and 

worked aggressively to implement corrective actions. 

Livermore launched a comprehensive recovery plan, and today 

we see the results of their efforts taking hold. Protection force capability at Livermore is much improved and there are more 

changes in progress. 

Upon assuming my new position in June, the NNSA Administrator directed me to dispatch a team of senior NNSA security professionals to conduct an onsite review of the Los Alamos National 

Laboratory Protective Force operation to determine if they had 

similar issues. The NNSA team found that the Los Alamos Protective Force had a strong and rigorous performance testing program 

and was performing effectively. This assessment of Los Alamos was 

reinforced by preliminary positive results from the recently completed independent oversight inspection. 

Seeking to build sustainable security programs, I intend to look 

across the NNSA for examples of where we are getting it right. We 

are also engaging in efforts to improve the flow of information 

across the NNSA security community through our security leadership coalition. The coalition has been actively engaged in evaluating the underlying causes of security and management issues 

that we face and developing standardized solutions. The objective 

of this effort is to break down organizational stovepipes and turn 

a previously reactive approach to security problems into a proactive 

approach. 

NNSA is making real and fundamental changes to our security 

program. These changes seek to reduce the opportunity for human 

error by relying on engineered controls. We are also focused on 

making our security challenges easier by reducing our classified 

74 

footprint. We have emphasized the need for strong contractor assurance programs designed to spot problem areas quickly and resolve them before they turn into real security issues. 

Finally, we need to continue to develop a strong Federal security 

staff that is technically capable. We need to ensure that our Federal oversight program takes advantage of the tools at our disposal, 

including substantial deductions of award fee for poor performance 

and fines provided under 10 CFR 824 when appropriate. We also 

need to ensure that we are appropriately incentivizing and rewarding the right behaviors to drive needed improvements. 

In closing, since taking over as the Chief Defense Nuclear Security, I have seen a renewed sense of commitment across the NNSA 

security community to improve performance through the sharing of 

lessons learned and working collectively to address significant challenges. Security activities at our national labs are large and complex. The security professionals within NNSA are working together 

today to reduce the opportunities for error and react quickly to any 

problems that do occur. 

Mr. PETERSON. I am confident in our ability to continue to grow 

and I look forward to the continued challenge. 

That concludes my opening comments. I would be pleased to answer any questions after other opening statements. 

Mr. STUPAK. Thank you, Mr. Peterson. 

[The prepared statement of Mr. Peterson follows:] 

75 


63238.039
76 


63238.040
77 


63238.041
78 


63238.042
79 


63238.043
80 


63238.044
81 


63238.045
82 


63238.046
83 


63238.047
84 


63238.048
85 


63238.049
86 


63238.050
87 


63238.051
88 


63238.052
89 


63238.053
90 

Mr. STUPAK. Mr. Pyke, let’s start with you. We’ll go right down 

the line. And your opening statement, please, for 5 minutes. If you 

have a longer statement, it will be submitted for the record. 

STATEMENT OF THOMAS N. PYKE, JR., CHIEF INFORMATION 

OFFICER, U.S. DEPARTMENT OF ENERGY 

Mr. PYKE. Good afternoon, Chairman Stupak, Ranking Member 

Shimkus, members of the subcommittee. My name is Tom Pyke. I 

am Chief Information Officer of the Department of Energy. 

Over the past 3 years the Department has undertaken a major 

effort to improve its cyber security posture. DOE has a comprehensive cyber security program that includes establishment of DOEwide policy, a senior-level governance structure, cyber security 

awareness and specialized cyber security training, improved cyber 

security incident management and compliance monitoring. 

The program is governed according to a cyber security management order issued in December 2006. This order directs the use of 

a risk-based approach to cyber security management, and it establishes a governance structure within the Department that assigns 

primary responsibility for implementation of cyber security to the 

Under Secretary and other senior leaders. These senior leaders determine and assess program-unique threats and risks and they 

issue direction for implementing cyber security within their respective organizations. 

DOE-wide cyber security direction, including direction for special 

protection of sensitive unclassified information, builds on government-wide guidance from the Office of Management and Budget as 

well as Federal information processing standards and other cyber 

security guidance issued by the National Institute of Standards 

and Technology. We also follow applicable guidance issued by the 

Department of Defense. 

Employing a risk-based approach, DOE senior management, including NNSA, has given special attention during the past year to 

the graded protection of DOE systems and data, taking into account threat and risk and the sensitivity of the data. Under our 

cyber security governance structure, each part of the Department 

reviews the sensitivity of the data under its jurisdiction relative to 

the strength of the controls that are in place to protect the data 

and takes action to strengthen those controls if needed. 

The management of cyber security incidents is an integral part 

of cyber security management, including providing timely alerts to 

the entire Department of known threats, detecting cyber attacks as 

they occur or as soon as possible afterward and responding to such 

attacks. The response includes reporting all cyber security incidents to the US-CERT, which is the Federal Government’s cyber 

incident handling center. It also includes mitigating the potential 

adverse impact of each incident at the site at which it was detected 

and elsewhere in the complex, determining the impact of the incident and repairing any damage or disruption resulting from the incident. 

Cyber attacks are increasing in complexity and frequency and 

are becoming more aggressive. DOE is attacked over 10 million 

times each day in a wide variety of ways, and DOE has in-depth 

protection mechanisms in place throughout the complex. Even with 

91 

this protection, some of the most sophisticated attacks against 

DOE have, on occasion, been able to penetrate our unclassified systems and networks. 

DOE has an in-depth cyber security defense based on industry 

and government best practices. And we continually improve our defenses, including our ability to detect attacks. However, some cyber 

attacks continue to evolve to avoid detection by these defenses. 

Within the Department, the Office of the Chief Information Officer and NNSA cooperate in the reporting of cyber incidents and 

support tour sites as they handle each incident. The Office of the 

CIO and NNSA have recently signed an agreement to improve further the way we work together to respond to cyber incidents. Our 

office also works in partnership with the Department’s Office of Intelligence and Counterintelligence as we prepare for future cyber 

attacks and respond to them. Counterintelligence data analysis associated with activities that may have a foreign nexus provides 

useful input to the cyber security incident management process led 

by the Office of the CIO. 

I would be pleased to respond to any questions you may have, 

Mr. Chairman. 

Mr. STUPAK. Thank you, Mr. Pyke. 

[The prepared statement of Mr. Pyke follows:] 

92 


63238.054
93 


63238.055
94 


63238.056
95 


63238.057
96 

Mr. STUPAK. Dr. Wilbanks, your opening statement, please. 

STATEMENT OF LINDA R. WILBANKS, PH.D., CHIEF INFORMATION OFFICER, NATIONAL NUCLEAR SECURITY ADMINISTRATION, U.S. DEPARTMENT OF ENERGY 

Ms. WILBANKS. Chairman Stupak and members of the subcommittee, I am Dr. Linda Wilbanks, Chief Information Officer for 

the National Nuclear Security Administration. Thank you for the 

opportunity to appear before you today regarding the NNSA’s cyber 

security program. As the CIO, I am responsible to ensure the protection of electronic classified and unclassified information. 

The cyber threats to the Department of Energy and NNSA are 

similar to those faced by the Federal Government, every public and 

private enterprise, and every individual. NNSA’s facilities are targeted, over 1 million cyber attacks every day of varying sophistication, ranging from relatively harmless curiosity seekers to sophisticated hackers to corporate thieves and national state and beliefbased espionage. 

In response to these threats, NNSA has established a robust 

technical operational managerial-based approach to cyber security 

of unclassified, controlled unclassified and classified information. 

We believe our approach, which is continually improving, is sound 

and provides effective security for our unclassified and classified 

networks. 

Even with a wide range of threats, I can say very confidently 

that our classified networks, which protect our crown jewels are extremely well protected. We operate separate networks for our classified information, which are air-gapped from our unclassified networks. We’ve implemented a diskless workstation initiative across 

the complex to manage the movement of data within the classified 

networks. 

We also have a wide range of technical and administrative controls to manage access to the data that resides on our controlled 

unclassified networks, which, while not classified, may include important information. This information requires added protection, 

including encryption during transmission and at rest, the use of 

two-factor authentication for remote access. 

We continue to assess other controls, collaborating with our peers 

in government, leveraging the results of the assessments to find 

even better ways to protect our unclassified networks. Other defense and depth tools we use for cyber protection are multiple firewalls and monitoring systems to check for incoming, outgoing and 

internal unclassified network traffic to ensure it is authorized and 

there are no anomalies. 

When our systems detect unusual activities, we quickly terminate the communication pathways, and when necessary, selectively 

isolate portions of our network to quarantine any potentially harmful activities. Once a harmful activity is isolated, we deploy our exceptional forensics capabilities to eradicate the threat, restore the 

systems to secure operations. 

Policy and standards are an important part of establishing an effective cyber security program, and in May 2008 NNSA’s cyber security policy was issued, addressing many previous recommendations and findings. This policy was developed in collaboration with 

97 

our sites, incorporates the recently issued DOE National Security 

Manual and many of their requirements, such as security plans 

and certification and accreditation procedures have already been 

implemented. 

We also have established strong and effective cyber security incident response capabilities. The DOE and NNSA have partnered to 

implement a state-of-the-art facility in Las Vegas, Nevada. This facility monitors DOE and NNSA networks and coordinates the response to incidents by utilizing extensive communications and collaboration among DOE/NNSA sites, other Federal agencies, law enforcements, intelligence, and counterintelligence. 

In summary, NNSA has a robust technical, operational and management-based approach to cyber security of the unclassified, the 

controlled unclassified and the classified information. However, we 

acknowledge the need for continual improvement. We believe our 

approach is fundamentally sound, but the nature of the threat 

changes daily. We must keep pace with the adversary and continue 

to improve the collaboration between our sites, DOE counterintelligence and the cyber security experts across the government and 

industry to succeed in the future. 

This concludes my opening statement. And I’m pleased to answer 

questions at the end. 

Mr. STUPAK. Thank you. 

[The statement of Ms. Wilbanks is included with the statement 

of Mr. Peterson.] 

Mr. Borgia, your opening statement, please. 

STATEMENT OF STANLEY J. BORGIA, DEPUTY DIRECTOR FOR 

COUNTERINTELLIGENCE, OFFICE OF INTELLIGENCE AND 

COUNTERINTELLIGENCE, U.S. DEPARTMENT OF ENERGY 

Mr. BORGIA. Thank you, Mr. Chairman. 

Mr. STUPAK. You may want to pull that a little closer. It doesn’t 

pick up very well. 

Mr. BORGIA. Chairman Stupak, Ranking Member Shimkus and 

distinguished members of the committee, thank you for the invitation to appear before you on a subject of importance, the cyber 

threat. 

I’m addressing you today as the Deputy Director of Counterintelligence in the Department of Energy’s Office of Intelligence and 

Counterintelligence. However, sir, I would like to go just a little 

further in my introduction, because there is a letter that is controversial, and explain to you that I am also a Deputy Assistant 

Director in the FBI, assigned by Director Mueller to the Secretary 

of Energy to run the counterintelligence program. I have been here 

for over 2 years, since July of 2006, and I will continue. 

We and DOE counterintelligence are both a producer of intelligence information and a consumer of intelligence information. We 

develop and facilitate the transfer of DOE-unique information to 

the United States Intelligence Community and convey actionable 

Intelligence Community threat information to all departmental action offices, including the National Nuclear Security Administration, NNSA. We appreciate that physical security is an essential 

element in the protection of information, and we participate in the 

98 

National Joint Terrorism Task Force, National Counterterrorism 

Center, to enhance the protection of DOE equities. 

Likewise, we are a very active member of the FBI-led National 

Cyber Investigative Joint Task Force, or NCIJTF, which allows us 

to provide unique DOE and NNSA information to the cyber investigations community and collaborate at national initiatives. Membership also provides DOE with invaluable current cyber-based 

threat information relevant to our departmental assets and critical 

energy infrastructure. 

DOE’s Counterintelligence Office performs a broad range of 

cyber-related functions, including analysis of cyber security incidents with a foreign nexus. Our work is closely coordinated with 

the DOE Office of the Chief Information Officer and the NNSA’s 

Office of the Chief Information Officer with which we’ve maintained a strong and mutually supportive relationship in the cyber 

security team. 

The nature of the cyber threat to the DOE complex is constantly 

evolving. DOE sensors, monitoring attacks on the DOE networks, 

have picked up an increased tempo of potential adversarial activity, 

including network reconnaissance, scanning for potential attack 

vectors and outright cyber attacks. In 3 of the past 6 months sensors have documented well over 400 million such indicators of hostile activity every month. 

Further, we have seen thousands of socially engineered e-mails. 

They may appear to come from known associates or support an interesting subject line, but they contain malicious computer code designed to infect the recipient’s computer, steal and transmit information it contains, and eventually spread to the rest of the network. A single mouse click by a single user can contaminate large 

numbers of networked computers. 

In order to generate counterintelligence investigative leads from 

all this activity, I have directed expanded use of cyber techniques 

at DOE and NNSA. The results have been dramatic. In particular, 

cyber tools developed under this initiative have enabled investigators at the intelligence and military organizations to make strides 

toward attribution for ongoing computer intrusions directed against 

DOE and other United States Government computer networks, a 

major accomplishment for DOE, that has demonstrated the value 

of these cyber tools for CI analysis. 

The counterintelligence cyber program has developed professional working relationships with the Defense Information Systems 

Agency, the Military Service Information Operation Centers, the 

military service Criminal Investigation Divisions and the Joint Information Operations Warfare Analysis Center in San Antonio, 

Texas. These are comprehensive information-sharing relationships 

as well as expanded partnerships for information and cyber data 

exchange. They serve to increase awareness of the operational 

methods being employed by individuals and state-sponsored entities engaged in unauthorized computer intrusions into DOE computer networks. 

DOE in collaboration with the Intelligence Community partners, 

DOE national laboratories, chief information officers and DOE 

cyber security use data integration tools and intrusion detection 

99 

sensors to uncover, investigate and mitigate suspicious cyber 

events with a foreign nexus. 

In closing, Mr. Chairman, the attacks we see place virtually 

every computer connected to the Internet at risk of compromise, including those of the U.S. Government and our critical energy infrastructure. Moreover, an attacker has a significant advantage over 

the protect-and-defend cyber security community. DOE’s Office of 

Intelligence and Counterintelligence will continue to pursue all 

available lawful means to detect, investigate and mitigate the pervasive cyber threats we as a nation now face. 

Thank you, Mr. Chairman. 

Mr. STUPAK. Thank you. 

[The prepared statement of Mr. Borgia follows:] 

100 


63238.058
101 


63238.059
102 


63238.060
103 


63238.061
104 

Mr. STUPAK. Dr. Anastasio, please, for your opening. 

STATEMENT OF MICHAEL R. ANASTASIO, PH.D., DIRECTOR, 

LOS ALAMOS NATIONAL LABORATORY 

Mr. ANASTASIO. Thank you, Mr. Chairman and Ranking Member 

Shimkus. I’m Dr. Michael Anastasio, Director of the Los Alamos 

National Laboratory. Thank you for the opportunity to discuss the 

lab’s continuing efforts to improve and sustain security. 

For my first appearance before this subcommittee in January of 

2007, I clearly understood the message from the Members: Continued security issues at Los Alamos were not going to be tolerated. 

I’m pleased to report that at Los Alamos we now have a record of 

successes in both physical security and cyber security. We’ve taken 

concrete actions to reduce risk, clarify policy, establish roles and responsibilities and develop solutions to continuously improve the security posture at our site. 

These measures are working. Over the past year the laboratory 

has reduced potential unauthorized disclosures of information by 

two-thirds, and that number continues to improve. 

My written statement details our progress, but there are three 

points I’d like to make here now. First, I am especially proud that 

the improvements made at the laboratory link directly to the actions and attitudes of our employees. Members of our workforce 

have very little tolerance for any of their coworkers who are not security conscience. The workforce understands that the Nation must 

trust them to handle our most sensitive secrets, and our actions 

have helped justify that trust. 

Second, the changes by the employees of Los Alamos have been 

coupled with an aggressive security improvement program. For example, we’ve reduced the number of vault-type rooms by one-quarter. We’ve reduced our classified accountable, removable electronic 

media from 12,000 items to fewer than 4,000. We’ve designed and 

opened the first supervault-type rooms and are planning for more. 

We’ve converted 94 percent of our targeted classified workstations 

to diskless operation. We’ve destroyed more than 40,000 classified 

nuclear weapon parts and more than 3 million pages of classified 

documents. 

We’re implementing a further segregation of our unclassified 

cyber network that will provide foreign national employees access 

only to the information that they require for their jobs. 

And, third, in anticipation of how the cyber threat will continue 

to evolve, we’re developing new approaches and technologies so 

that we can get ahead of the game to better protect our unclassified 

networks. 

I’m encouraged that the three recent assessments in the testimony we heard on the previous panel by our external reviewers 

from GAO and HSS have validated our significant progress. However, these reports also clearly demonstrate that we need to make 

further improvements. I agree, and we’re moving aggressively to 

address them. 

Continuous security improvement is essential, and nowhere is 

this more evident than in cyber security. As I expressed in my last 

appearance before you, the cyber threat remains my most great 

concern. This is an ever-increasing, evolving threat from adverVerDate Nov 24 2008 14:39 Jan 10, 2011 Jkt 037690 PO 00000 Frm 00108 Fmt 6633 Sfmt 6633 P:\MY DOCS\HEARINGS\110-152 CHRIS
105 

saries who are relentless and technically skilled. Protecting our 

classified resources is my highest priority, but further securing our 

unclassified yellow network is essential. 

This network is the backbone of our operation. It’s crucial that 

we develop solutions that manage risk and allow users to access 

the information they need to do their jobs. One example is something we call ‘‘glove box computing.’’ With this technology, a user 

can access, create and manipulate information, but has no ability 

to remove it, similar to how we handle nuclear material. 

The cyber threat is one faced by the entire Nation. It’s something 

that requires a coordinated national response using our country’s 

combined assets, skills and experience. The unique cyber capabilities of the national laboratories can be a valuable resource, building on the integration efforts that are already under way among all 

three of our laboratories and with NNSA and DOE. 

In conclusion, Mr. Chairman, Los Alamos is making significant 

progress improving our security posture, and we are committed to 

continuous improvement to stay ahead of the evolving threat. I 

would like to invite you and other members of the committee to 

come visit the lab and see how we’re doing. 

And with that, I’ll thank you and be ready to take your questions. 

[The prepared statement of Mr. Anastasio follows:] 

106 


63238.062
107 


63238.063
108 


63238.064
109 


63238.065
110 


63238.066
111 


63238.067
112 


63238.068
113 


63238.069
114 


63238.070
115 


63238.071
116 


63238.072
117 


63238.073
118 


63238.074
119 


63238.075
120 


63238.076
121 


63238.077
122 


63238.078
123 


63238.079
124 


63238.080
125 


63238.081
126 


63238.082
127 


63238.083
128 


63238.084
129 


63238.085
130 


63238.086
131 

Mr. STUPAK. Well, thank you. And I know the staff was just 

there, and unfortunately they didn’t get a chance to meet with you. 

But hopefully there will be another time, and hopefully it’s not 

when we’re there looking at a lapse or something. 

But I think we all know that there have been improvements at 

Los Alamos. 

Mr. ANASTASIO. Thank you. I appreciate that. 

Mr. STUPAK. Dr. Miller, your opening statement, please. 

STATEMENT OF GEORGE H. MILLER, PH.D., DIRECTOR, 

LAWRENCE LIVERMORE NATIONAL LAB 

Dr. MILLER. Mr. Chairman, members of the committee, thank 

you for the opportunity to provide you my perspective on the security challenges we face together. 

As the director of a national security laboratory, I am very familiar with the threats to our Nation and take very seriously our special responsibilities to protect special nuclear materials and some 

of the Nation’s most sensitive secrets. Safety and security are my 

highest priorities, and they are integrated into a single culture at 

the laboratory. 

Particularly in the cyber security area, threats are rapidly evolving, continue to grow more sophisticated. My approach involves anticipation, prevention, detection, response and sustainment through 

continuous improvement. 

The laboratory uses a variety of techniques to assess both physical and cyber security, and they are an integral part of our continuous improvement efforts. These include GAO audits, ongoing site 

inspections by DOE’s Office of Health Safety and Security, local 

site surveys and our own self-assessments. 

The HSS inspection this last spring was instrumental in helping 

us identify deficiencies in our security readiness. In summary, the 

HSS, as you have heard, found significant weaknesses in two 

areas, protective force and classified matter protection. We’ve made 

significant progress in addressing these inspection findings. 

I led a thorough review of our actions and decisions to identify 

the root cause of what was an unacceptable decline in our protective force’s level of posture demonstrated just 16 months earlier. 

I’m pleased to report that these actions have significantly improved 

the readiness of our protective force as demonstrated through a security incident response of a fully integrated force-on-force with an 

external adversary just 8 weeks ago. This exercise was monitored 

both by NNSA and HSS, and the Office of the Chief of Defense Nuclear Security concluded that the lab’s effort has resulted in a posture of robust protection. Let me tell you how we achieved this. 

In short, our analysis revealed that restrictions on and postponement of comprehensive robust exercises due to safety considerations had a detrimental effect on the protective force readiness. 

We have addressed those safety issues and resumed frequent exercises while ensuring the safety of our employees. My written testimony details some of these corrective actions. I’m committed to 

sustaining that performance and that level of progress, and we 

have scheduled future robust exercises quarterly to ensure that. 

I believe that maintaining adequate cyber security requires constant attention, utilizing counterintelligence experts and informaVerDate Nov 24 2008 14:39 Jan 10, 2011 Jkt 037690 PO 00000 Frm 00135 Fmt 6633 Sfmt 6633 P:\MY DOCS\HEARINGS\110-152 CHRIS
132 

tion technology professionals to anticipate, develop and deploy effective defensive systems and quickly respond to emerging threats 

to assure appropriate protection. 

Over the last 2 decades Livermore has hosted and staffed the Department of Energy’s computer incident advisory capability. This 

staff of highly trained computer scientists have provided support 

for the entire complex with forward-looking cyber analysis assessments, best practices and training. In this regard, HSS concluded 

that the lab faces significant challenges in this area, but has the 

teams, technologies and methods needed for success to effectively 

deliver and address cyber security. 

Protecting classified information from compromise is my highest 

priority. That’s why our classified network is air-gapped from the 

rest of the laboratory. 

We also maintain a separate unclassified network to handle our 

unclassified and our business information. Within this yellow network, different functions are segregated and isolated. It is used for 

programmatic activities that are essential for the laboratory. 

These functions require external communication. It is, therefore, 

connected to the Internet. But it is protected by a firewall. And 

again, as I said, within that network it is segregated—different 

functions are segregated. Constant daily vigilance is required to 

protect the network, and we use a comprehensive site-wide risk assessment methodology along with shared information from my colleagues at the other laboratories and across the Federal Government to focus our cyber security efforts on emerging threats. 

As an element of our continuous improvement, the lab has developed a blue network to provide appropriate computer access for essential mission work by the lab’s foreign nationals and our external 

collaborators. Technical controls separate that from the yellow network. 

As another example of our continuous improvement and further 

segmentation of important data, last year I invested in the building 

of and the commissioning of a consolidated data center for unclassified data. This provides uniform physical protection, appropriate 

backup, enhanced reliability and, most important, state-of-the-art 

cyber protection. 

In conclusion, Mr. Chairman, taking personal and collective responsibility for safety and security is a fundamental value of the 

laboratory and an expectation of all employees. I can assure you 

that I am committed to provide the security that you and your colleagues expect from Lawrence Livermore Laboratory. 

I appreciate the opportunity to testify and welcome your questions. 

Mr. STUPAK. Thank you, Dr. Miller. 

[The prepared statement of Dr. Miller follows:] 

STATEMENT OF GEORGE H. MILLER

OPENING REMARKS

Mr. Chairman and Members of the Committee, thank you for the opportunity to 

provide my perspective on the security challenges facing the Lawrence Livermore 

National Laboratory (LLNL) and the other NNSA laboratories. I am George Miller, 

Director of LLNL and President of Lawrence Livermore National Security (LLNS), 

which has been managing the Laboratory for almost one year. I started at LLNL 

133 

in 1972 as a research physicist in the nuclear weapons program. In my career I 

have had responsibilities at every level of management at LLNL. As a national security laboratory, we are very familiar with the threats to our nation and take very 

seriously the special responsibilities entrusted to us to protect special nuclear materials (SNM) and some of the nation’s most sensitive secrets. Particularly in the 

cyber area, threats are rapidly evolving and continue to grow more sophisticated. 

Vigilance and continuous improvement are required. 

The Laboratory’s approach to both physical and cyber security employs a multilayered, defense-in-depth strategy with opportunities for regular feedback, assessment, and improvement. This process draws on both internal and external assessments and I will report on the aggressive actions LLNL is taking to continue to 

strengthen both physical and cyber security. Recently, DOE’s Office of Health, Safety, and Security (HSS) conducted an inspection of LLNL Safeguards and Security 

and Cyber Security, and found areas of effective performance, areas needing improvement, and some areas of significant weakness. We took immediate action to 

respond to these findings and have made significant progress. Recently the NNSA 

Office of the Chief of Defense Nuclear Security stated that improvements made in 

LLNL Protective Force response capabilities since the HSS inspection ‘‘have resulted in a robust protection strategy.’’ In the area of cyber security, the HSS report 

concluded that the Laboratory faces challenges but ‘‘.has the teams, technologies, 

and methods needed for success to effectively address cyber security program 

needs.’’ We are drawing on those capabilities to expeditiously make necessary improvements. 

LABORATORY SECURITY AND THE RECENT HSS INSPECTION

I can assure you that LLNL is committed to the safe and secure fulfillment of its 

mission responsibilities. The Laboratory takes an integrated approach to safety and 

security with a commitment to continuous improvement. Safety and security are the 

most important considerations in day-to-day operations. A fundamental value of the 

Laboratory is for all employees to take personal and collective responsibility for providing for a safe and secure work environment. 

An extensive security infrastructure is in place at the Laboratory, and continual 

improvements are made to address new threats and arising concerns. LLNL uses 

a defense-in-depth approach to physical security that includes fences, buildings, 

doors, repositories, and vaults with various levels of access control in addition to aggressive armed defense and response capabilities protecting the Superblock Facility, 

the special area where work with SNM is conducted. 

Cyber security is a growing and rapidly evolving defense challenge for all government entities, including the NNSA laboratories. Cyber attacks are a serious national security threat that require interagency attention, cooperation, and investment to improve protection. Recognizing the public trust placed in the Laboratory 

to protect some of the nation’s most sensitive secrets, LLNL takes its cyber security 

responsibilities very seriously. The Laboratory employs an integrated management 

approach to protect its cyber resources in an ever changing threat environment. 

LLNL leverages expertise in security management, counterintelligence, and information technology to identify and quickly respond to emerging threats and 

proactively develop and deploy protective measures. Most importantly, classified information at LLNL is secure. It is confined to networks that are isolated and segmented to ensure need-to-know access and well protected by technical processes that 

provide both system and information security. 

Unclassified computing at LLNL is separated into individually protected, NNSA 

accredited, network segments that include a Green network, a Yellow network, and 

a new Blue network. Through the use of firewalls, authorization codes, and other 

means of security, this segmentation allows for greater control and increasing levels 

of hardware and data protection depending on the types of data and applications 

that are on each of the networks. The Yellow network, which is subsequently discussed in more detail, is the main unclassified network for desktop computers, applications and databases, unclassified programmatic activities, internal communications, and business services. Employees receive and send email, fill out their time 

card, do their on-line training, work on technical data and information, and access 

benefits and other employment information on this network. It does contain sensitive unclassified information such as business proprietary and personnel information that is segregated within the Yellow network with additional access controls. 

The Yellow network is restricted to Laboratory employees and collaborators. Connected to the Internet, this network is protected by a robust firewall and network 

segments that must be diligently maintained in the face of ever more sophisticated 

threats. 

134 

The Blue network has recently been piloted and is now approved for expansion. 

Its purpose is to provide controlled access to assets necessary for our foreign national employees and collaborators to do their work, but at the same time restrict 

their access to resources on the Yellow network. The Green network is lightly 

firewalled and provides public access to general LLNL information including job 

postings. 

The Laboratory utilizes a variety of tools to continually assess and test both physical and cyber security. These include Government Accountability Office (GAO) audits, on-site inspections by DOE’s HSS, local NNSA site office surveys, self-assessments, risk assessments, vulnerability scanning, and system testing conducted by 

the LLNL cyber security program. These assessments provide valuable input and 

are an integral component of LLNL’s continuous improvement process to sustain the 

Laboratory’s security in an evolving threat environment. 

In early March 2008, DOE HSS initiated an inspection of LLNL Safeguards and 

Security and Cyber Security. Over a six-week period, 86 auditors participated in a 

comprehensive evaluation of eight security elements. The inspection was conducted 

with a high level of professionalism. For example, the composite adversary team 

that conducted the force-on-force exercise was very experienced and innovative in 

their approach, and they conducted the force-on-force exercise in a manner to test 

LLNL’s Superblock Facility security posture to specific criteria. We value the approach taken by HSS in all facets of its inspection and the receipt of in-depth feedback to improve our security posture. 

In summary, the HHS inspection found LLNL to have effective performance in 

Classification and Information Control, Personnel Security, and Material Control 

and Accountability. HSS found that the Laboratory needed improvement in Physical 

Security Systems, Protection Program Management, and certain aspects of Cyber 

Security not related to technical controls. HSS found significant weakness in 

LLNL’s Protective Force and its Classified Matter Protection and Control. 

The Laboratory took immediate steps to address weaknesses identified in the HSS 

inspection. In addition, LLNL developed a comprehensive set of corrective action 

plans. HSS reviewed the Laboratory’s draft corrective action plans and HSS comments have been incorporated into the plans. These draft plans contain 254 milestones to correct and sustain LLNL’s progress toward ensuring a long-term, 

strengthened security posture. Aggressive efforts to sustain NNSA site security compliance requirements have resulted in the completion of one-third of the milestones 

to date. 

The results of the HSS force-on-force exercise were disappointing to me and my 

team. The Laboratory’s Protective Force had performed well in the prior HSS forceon-force exercise only 16 months earlier (December 2006), and I was determined to 

identify the root cause leading to the decline in the Laboratory’s Protective Force 

readiness. I immediately ordered a thorough review of our actions and decision making to identify and correct the root cause. In short, the analysis revealed that restrictions on and postponements of robust exercises had a detrimental effect on Protective Force readiness as well as our ability to conduct the full-scale exercises that 

are necessary to appropriately practice team tactics and fully assess performance. 

The lack of a robust exercise environment inhibited the Laboratory’s ability to obtain the necessary feedback to assess our performance. 

Safety considerations and attrition in LLNL’s Protective Force were some of the 

most influential factors that placed limitations on exercises. For example, the Laboratory’s initiative in 2006 to improve ladder safety practices resulted in the suspension of force-on-force exercises on the roofs in the Superblock. In addition, NNSA’s 

prohibition on the use of smoke due to health concerns prevented us from utilizing 

this tool in our training. Other concerns regarding Superblock employee health and 

safety further restricted the ability of our Protective Force officers to engage in realistic exercises inside Superblock facilities. 

Another contributing factor was attrition in the Laboratory’s Protective Force, 

which has averaged about 10 percent per annum, FY 2006 through FY 2008. Forceon-force exercises in the Superblock are labor intensive, requiring sufficient Protective Force personnel to participate in defensive and offensive teams, help conduct 

the exercise, and to provide a stand-alone force to protect the area during the exercise. With high attrition and a two-year training regiment for new officers, shortfalls 

in staffing required careful workload balancing and significant overtime to provide 

defense, train, and exercise. 

The limitations emanating from these considerations resulted in Protective Force 

exercises that were insufficient in scope and degree of realism to identify weaknesses in equipment performance and team tactics. 

We took actions to address this root cause. First, we devoted special attention to 

expeditiously resolve safety concerns by, for example, marking and providing guide 

135 

structures on roofs for safe access and providing ventilation within hallways so that 

blank ammunition can be used. Once we resolved these concerns, we resumed robust exercises in the Superblock, and will conduct robust force-on-force exercises on 

a quarterly basis. Second, we reinvigorated our physical security self-assessment 

program and assigned a seasoned security professional to a newly created position 

as the Security Organization Program Performance Assurance Manager. Finally, we 

took away valuable lessons from each of the factors that contributed to decisions 

that had self-limited exercises and assessments. 

We have applied the lessons learned from all facets of the HSS inspection. Working closely with NNSA and utilizing expertise accessible through reachback to LLNS 

parent organizations, LLNL has significantly strengthened its security posture over 

the last several months. Highlights are discussed below in the areas of Protective 

Force, Classified Matter Protection and Control, and Cyber Security. In addition, 

the Laboratory has implemented management changes to clarify roles and responsibilities through an integrated chain of command that incorporates expertise in 

SNM research, safety, and security. Vulnerability assessments are being updated to 

include the recent protective force, physical security, and cyber security enhancements. 

PROTECTIVE FORCE IMPROVEMENTS

LLNL has implemented improvements to its manpower deployment and training, 

to its defensive equipment, to its command and control systems, and continues to 

implement improvements to its hardened fighting positions in the Superblock. These 

improvements were guided in part by the lessons learned during a period of intensive activity in May and June 2008 when over 25 scrimmages, limited-scope performance tests, and 12 force-on-force exercises against a variety of adversary teams 

were conducted in the Superblock Facility exercising all LLNL Protective Force 

shifts. The Laboratory’s integrated plan ensures a high-quality training environment with the appropriate equipment resources to continually challenge and test 

the responsiveness of its Protective Force. LLNL has implemented Protective Force 

improvements in four areas: Personnel, Equipment, Team Tactics, and Training Environment. 

Personnel. The HSS Inspection found that LLNL’s Protective Force security officers were individually well trained and capable as demonstrated by their high test 

scores. This is due in part to LLNL adopting the newly proposed Tactical Response 

Force (TRF) Standards as part of its training. LLNL is currently the only site in 

the complex to qualify all of its Level 2 and 3 Protective Force officers in this weapons and physical fitness proficiency standard. 

Lessons learned from HSS force-on-force exercise, and the subsequent force-onforce exercises, resulted in the addition of Protective Force officers in the Superblock 

Facility on each shift, and the addition of a Sergeant to each shift to engage exclusively in Command and Control. Both of these actions have been completed and are 

incorporated into the Security Incident Response Plan (SIRP). 

Equipment. LLNL utilizes Dillon gatling guns, integrated into Mobile Weapon 

Platforms (MWP), as part of the security posture for the Superblock Facility. Since 

the HSS inspection, LLNL has developed a robust security incident response plan 

that utilizes a MWP deployment strategy that does not rely upon all vehicles being 

deployed at all times. This plan allows LLNL to deploy some or all of the vehicles 

and maintains a high level of protection by augmenting and re-deploying forces 

within the Superblock in towers, bullet-resistant enclosures, hardened-fighting positions, or as ground-based strike teams. Consequently, this plan protects the SNM 

and provides for cycling vehicles out of the Superblock Facility for necessary vehicle 

service, vehicles to conduct training, and the ability to upgrade vehicle systems 

without degrading LLNL’s protection effectiveness. In addition, it forces an adversary to develop a plan and commit resources to address multiple protection strategies-a much bigger task for an adversary than would be required to deal with a static protection configuration. 

We have upgraded the defensive equipment used by our officers to protect the 

Superblock including improvements to the MWP that mitigate maintenance and reliability issues. In addition, the operability of the MWPs is verified each shift. 

Team Tactics. Daily and nightly training began and has continued since April to 

ensure effective implementation of the SIRP and verify compliance of the Protective 

Force officers with it. These training exercises and Limited Scope Performance Tests 

involve individual, small unit, and full team movement and tactics. Refinements to 

command and control protocols have been developed based on these exercises, as 

well as actions to address security officer vulnerabilities identified during the exercises. 

136 

Training Environment. In order to facilitate more realistic training, LLNL engages in force-on-force activities in the Superblock Facility and indoors with realistic 

Multiple Integrated Laser Engagement System (MILES) gear on a routine basis. 

During the first week of August 2008, a fully integrated force-on-force exercise was 

conducted by an adversary force from Idaho National Laboratory. This force-on-force 

exercise was attended by representatives of the Office of the Chief of Defense Nuclear Security, NNSA Field Security professionals, and observers from DOE HSS. 

The force-on-force exercises were particularly challenging, designed to test the 

changes to our SIRP and the additional training of our security force. LLNL’s security incident response was very successful. The Office of the Chief of Defense Nuclear Security asserts, ‘‘The results of the exercises demonstrate that activities completed as part of the site recovery plans, along with the planned configuration, have 

resulted in a robust protection strategy.’’ 

IMPROVEMENTS IN PHYSICAL SECURITY SYSTEMS AND CLASSIFIED MATERIAL

PROTECTION & CONTROL

LLNL’s security construct is based on a series of defensive layers-a graded approach that provides increasing barriers that correspond to the increasing security 

value of critical Laboratory assets. Classified information resides in ‘‘limited’’ areas 

and is stored in repositories and/or vault-type rooms (VTRs). Some of LLNL’s VTRs 

were found to be deficient in sensor protection by the HSS inspection, and the necessary additional sensors were immediately installed. 

In addition to enhancing the VTRs, LLNL formalized roles and responsibilities, 

and improved VTR configuration management. The Laboratory is consolidating 

databases that document the location of classified repositories into a master database and has established a policy and verification procedures for configuration control of classified repositories and VTRs. In addition, procedures for logging and inventory of failed classified computer hard drives now address concerns raised by the 

HSS inspection. LLNL has upgraded the lighting and video coverage in the 

Superblock. 

CYBER SECURITY IMPROVEMENTS

As an integral component of LLNL’s security organization, the Laboratory’s cyber 

security program proactively develops and deploys effective defensive systems and 

quickly responds to emerging threats to ensure appropriate protection. The cyber security program takes an integrated approach, strongly engaging counterintelligence 

experts and information technology professionals. The Laboratory has established 

centralized policies and procedures for managing cyber security, and it has in place 

many effective technical processes and tools for providing protection. These include 

perimeter and internal firewalls, vulnerability scanning, and intrusion detection systems. In addition, the Laboratory has developed and utilizes an effective system for 

user identification, authentication, and access control to enforce security standards 

and ensure appropriate configuration management of software and hardware systems. 

The HSS inspection rated LLNL’s cyber security technical controls ‘‘effective’’ and 

found that the cyber security program ‘‘has taken an aggressive stance to ensure 

that when issues are recognized, corrective action plans and plans of action and 

milestones are developed.’’ In response to deficiencies identified in the HSS report, 

LLNL is strengthening its cyber security controls for planning, acquisition, certification, and accreditation of systems to reduce overall risk. The Laboratory is updating its cyber security plans to reflect the most up-to-date directives and include 

more detailed operational protocols in order to better test, certify, and accredit systems. 

Classified information at LLNL resides on separate networks for Secret/Restricted 

Data and Secret/National Security Information, a practice HSS found ‘‘commendable.’’ Their report concludes that, ‘‘Strong identification and authentication controls 

for access to applications and effective segmentation to ensure need-to-know boundaries, as well as effective vulnerability scanning and patching, are key factors in the 

classified environment being almost totally devoid of vulnerabilities.’’ 

As mentioned earlier, the Yellow network at the Laboratory is the main unclassified network for desktop computers, applications, and databases. This network contains access-controlled sensitive unclassified information that is required by most 

Laboratory employees and collaborators to conduct their mission responsibilities. It 

is the backbone for unclassified programmatic activities, internal communications, 

and all business services. Laboratory research, business functions, and operations 

require external communications; hence, the Yellow network is connected to the 

Internet and protected by a firewall and network segments. 

137 

Vigilance is required to protect Yellow network systems and data. LLNL first 

completed a comprehensive sitewide unclassified risk assessment in 2005. Updated 

annually and as new risks are identified, the assessment includes an analysis of 

systemic conditions and threats, probabilities of occurrence, and impact. Consideration of the risks guides strategies for vulnerability scanning and patching as well 

as the implementation of additional measures to limit inward and outward flows 

through the firewall. The Laboratory is working to fully implement effective risk 

management processes to identify risks at the system-specific level. 

One notable step LLNL is taking to minimize risks is the development of a Blue 

network. To be used by foreign nationals whose collaboration is necessary for LLNL 

to meet mission responsibilities, the network was established to provide even greater assurance that access restrictions to LLNL information systems are enforced 

based on need-to-know. The Blue network segment is separated from the Yellow 

network through technical controls. Users have access only to approved resources 

on the Yellow network and that access is only permitted with controls enforced by 

firewall policy. This prevents foreign nationals from having the ability to ‘‘knock on 

doors’’ and gain access to Yellow network resources on an uncontrolled basis. They 

are not able to search the Yellow network or monitor activities on it. The Blue network is being piloted in one of the Laboratory’s directorates and is planned for sitewide implementation in Fiscal Year 2009. 

CLOSING REMARKS

The Laboratory requires annual training for every LLNL employee to ensure that 

each understands the importance of protecting the classified information and materials at the Laboratory and their individual and collective security responsibilities. 

Security is an obligation that we take extremely seriously. The adversarial threats 

we face are growing more sophisticated and defense requires vigilance. When deficiencies are uncovered or an emerging threat is identified, we act as promptly and 

effectively as we can to fix the specifically identified issue as well as address the 

root causes. That is why the Office of the Chief of Defense Nuclear Security was 

able to assert that LLNL’s concerted efforts ‘‘.have resulted in a robust protection 

strategy’’ after shortcomings were uncovered by HSS only several months earlier. 

I have confidence in LLNL’s Protective Force and the effectiveness of the Security 

Incident Response Plan. 

Cyber security is a challenge facing all government entities, including LLNL. I 

agree with the HSS report that concluded ‘‘the laboratory has the teams, technologies, and methods needed for success to effectively address cyber security program needs.’’ LLNL welcomes the opportunity to share some of the lessons we have 

learned-and to learn from others-through broader, more concerted, and effectivelyintegrated DOE and interagency efforts to cope with this very serious national security threat. 

LAWRENCE LIVERMORE NATIONAL LABORATORY’S SECURITY POSTURE-SUMMARY

(ATTACHMENT) 

Lawrence Livermore National Laboratory (LLNL) is committed to the safe and secure fulfillment of its mission responsibilities. A fundamental LLNL value is that 

all employees must take personal and collective responsibility for providing for a 

safe and secure work environment. An extensive security structure is in place at 

LLNL, and we are taking aggressive actions to address arising security threats and 

concerns. Particularly, in the cyber area, threats are rapidly evolving, continuing to 

grow more sophisticated and vigilance is required. 

The Laboratory benefits from both internal and external assessments to identify 

weakness and areas for improvement. Recently, DOE’s Office of Health, Safety, and 

Security (HSS) held an inspection of LLNL Safeguards and Security and Cyber Security that provided valuable feedback. We took immediate steps to address the 

identified weaknesses. We conducted a thorough review to identify the root cause 

of the disappointing results of the force-on-force exercise and took corrective actions. 

Restrictions on and postponements of robust exercises had a detrimental effect on 

Protective Force readiness and inhibited the Laboratory’s ability to obtain essential 

feedback on our performance. We resumed the conduct of realistic force-on-force exercises in the Superblock, and we will conduct future comprehensive force-on-force 

exercises on a quarterly basis. We have also upgraded the defensive equipment used 

in the Superblock. Following a fully integrated force-on-force exercise in August 

2008, the NNSA Office of the Chief of Defense Nuclear Security, improvements 

made in LLNL Protective Force response capabilities ‘‘have resulted in a robust protection strategy.’’ 

138 

In the area of cyber security, the HSS report concluded that ‘‘the classified environment [at LLNL is] almost totally void of vulnerabilities.’’ LLNL’s (unclassified) 

Yellow network faces challenges, but it is well protected and the HSS report states 

that LLNL ‘‘has the teams, technologies, and methods needed for success to effectively address cyber security program needs.’’ We are drawing on those capabilities 

to expeditiously make improvements, including the development of a new Blue network for use by foreign national employees and collaborators. 

Mr. STUPAK. Dr. Hunter, your opening statement, please, sir. 

Dr. HUNTER. Thank you, Mr. Chairman. 

Mr. STUPAK. You’re going to need the mic there. Thanks. 

STATEMENT OF THOMAS O. HUNTER, PH.D., PRESIDENT AND 

LABORATORIES DIRECTOR, SANDIA NATIONAL LABORATORIES 

Dr. HUNTER. Thank you, Mr. Chairman, Ranking Member and 

distinguished members of the committee. I am Tom Hunter, President of Sandia Corporation and Director of Sandia National Laboratories. It’s a pleasure to appear before you and talk about this 

extremely important matter. 

Sandia, as you know, is a national security laboratory and part 

of the NNSA; and we develop and support the nonnuclear parts of 

the nuclear term, but we also are, further, involved in research and 

development across a wide range of national security areas. I provided written testimony at some length, but I would like to emphasize just a few points. 

First, I would like to talk about our commitment and my personal commitment to security. 

We can only serve the Nation in so many sensitive areas, and we 

do place security at the very top of our value system. I should also 

be clear that I do not support the view that science in our world 

and security should be in conflict or can be in conflict. I believe 

that science in the national interest must embrace effective security. 

It is a matter of great personal pride that the Nation has entrusted us with this most sensitive information. I and my entire organization are committed to always honor that trust. We can all 

live up to our security responsibilities if we’re ever vigilant and 

constantly aware of the threat facing us and any vulnerability that 

may occur. We have decades of experience evaluating the threats 

to our nuclear deterrent, and we’ve applied that experience to the 

cyber world as well. 

The second point I would like to make is, this Nation’s made a 

great investment in its classification system, both of information 

and materials. We see great value in that system and we use it as 

the foundation, the very core, of our security systems. And this allows us to place the most emphasis on our security systems in the 

right places where there’s the most sensitivity. 

We believe we have made great progress in the last few years in 

our protective systems for physical security. We’ve reduced our vulnerability to attack by limiting all discrete Category I and Category 

II nuclear material at our site. We did that just recently and ahead 

of schedule. 

Last year we received the highest possible rating on all seven 

major areas of physical security in the evaluation done by DOE’s 

139 

Office of Independent Oversight. Yet we do not believe, and it’s my 

strong conviction, that we can rest on any of our accomplishments. 

The challenge will always be greater and our expectation will always be higher. 

We’re acutely aware of the threat of malicious insiders and have 

an active counterintelligence program and one that is acknowledged to be uniquely effective because of the strong integration we 

have because of counterintelligence and our cyber and physical security programs. 

As the committee has so well noted, there is one area, though, 

that we, like the majority of the Nation’s institutions, must be even 

more vigilant. We are part, and a fundamental part, of the Nation’s 

cyber system. We find that modern information systems are essential to manage and operate an enterprise such as ours. But with 

this great enabler comes a great risk. 

There have rarely been threats to the very core of our Nation’s 

infrastructure as pervasive and as asymmetrical as a cyber threat. 

We have acted aggressively to address the cyber threat. We have 

three separate networks for cyber information. Each system has 

been uniquely designed for the security provisions of the information there. All are controlled and monitored centrally by the laboratory. 

When I sign on to my personal computer, it reminds me every 

time, like every employee, that I will be subject to observation and 

should expect no privacy from our monitoring systems. We block 

over 80 percent of our incoming e-mail. We save and evaluate all 

cyber traffic at the laboratory by expert and electronic means. If 

any user on our system does not conform to our security requirements, we’ll promptly terminate access from the system. 

We maintain a complete registration of all devices on our system, 

deploy encryption for sensitive transmissions and require common 

operating environment for all desktops. Each network is subdivided 

into segments that have separate monitoring and separate need-toknow protection. 

We have close ties with the other institutions in the Federal Government and the other laboratories in the DOE. When an attack 

occurs, there is a direct and effective communication between 

Sandia, other laboratories and the DOE. 

Finally, I would like to close my comments with emphasis on one 

point that I think is most central to the path forward for the cybersecure world of the future, and that’s people. I’ve had the opportunity to witness the dedicated professionals who defend our cyber 

systems. I’ve come to admire and respect their talent, their expertise and their dedication. Each day—and in most cases, very long 

days—they face an adversary that is more creative and better 

equipped than the day before. And any day they may be called 

upon to scan enormous files and spot anomalies that could easily 

allude most trained observers. They may be called on to go to another laboratory to help sort out an ongoing attack. 

Why do they do it? It is not a matter of compliance. It is not a 

matter of administrative requirement. It is not even a matter of 

compensation or reward. And it’s certainly not because they could 

not work anyplace else. It is, in my judgment, because they are inVerDate Nov 24 2008 14:39 Jan 10, 2011 Jkt 037690 PO 00000 Frm 00143 Fmt 6633 Sfmt 6633 P:\MY DOCS\HEARINGS\110-152 CHRIS
140 

dividually committed to serve this country, to defeat this pervasive 

threat. 

I’m thankful each day they’re there with us, and I believe they’re 

examples of the country’s principal hope in the coming escalation 

of cyber attacks—talented people surrounded by talented people 

and equipped with unique experiences and assets who devote their 

careers to this conflict. If we could do only one thing in the whole 

world of cyber security, it will be to apply our Nation’s best minds 

to the problem, train them, hire them, support them, and empower 

them. 

And I now urge the committee, with all of us, to do whatever we 

can to help create an environment where these people have the opportunity to commit, to excel and to prevail. 

Thank you, Mr. Chairman; and I would be pleased to answer any 

questions. 

Mr. STUPAK. Thank you, Dr. Hunter. 

[The prepared statement of Dr. Hunter follows:] 

141 


63238.087
142 


63238.088
143 


63238.089
144 


63238.090
145 


63238.091
146 


63238.092
147 


63238.093
148 


63238.094
149 


63238.095
150 


63238.096
151 


63238.097
152 


63238.098
153 


63238.099
154 


63238.100
155 

Mr. STUPAK. That concludes the opening statements. We’ll go to 

questions. We’re going to go 10 minutes. 

I think we’ll have votes coming up; maybe we can get our questions in before that. 

Dr. Anastasio, if I may, GAO testified on the first panel that Los 

Alamos pulled the access to foreign nationals to the yellow network. Is that correct? 

Mr. ANASTASIO. No, that’s not correct. 

Mr. STUPAK. It’s not? 

Mr. ANASTASIO. Foreign nationals do have access to our yellow 

network. 

But we have a number of protections in place to ensure that 

proper care is taken. We do counterintelligence assessment of every 

individual. We have security plans and a very significant process 

we go through. 

Mr. STUPAK. Do you have encryption on some of the more sensitive parts that are on your yellow? 

Mr. ANASTASIO. We have some encryption on the more sensitive 

parts that are on the yellow network, and we have segmentation 

that we’ve put in place and we’re further proceeding with that. 

Mr. STUPAK. All right. 

Dr. Miller, do foreign nationals have access to the yellow information? The yellow network, I’m sorry. 

Dr. MILLER. Yes, sir. Just like Dr. Anastasio, we currently do 

have foreign nationals on our network. As I indicated in my testimony, we are in the process of creating another network. It was 

just—we did a pilot last year. It was just credited by NNSA about 

a week ago. So this fiscal year we will be creating a separate network for all of our foreign nationals that is separate from the yellow network. 

Mr. STUPAK. All right. Would some of the information on your 

yellow network go on this new network you’re— 

Dr. MILLER. Yes, sir. I mean, for instance, all of the training requirements that are completely unclassified are required by—the 

foreign nationals require access to the training requirements. So 

the training courses, things like that that they require access to, 

will be on the blue network. So there will be some information that 

is transmitted. 

Mr. STUPAK. Dr. Hunter, how about yourself, the foreign nationals on your yellow network? 

Dr. HUNTER. On our yellow network we have about 11 foreign 

nationals that have some access in the appropriate areas, but none 

are from sensitive countries and I think the DOE requirement for 

the future is about sensitive countries. 

Mr. STUPAK. Let me ask this question, if I may—Dr. Wilbanks, 

if I may. 

The Director of Los Alamos noted in his opening statement that 

cyber threat is the greatest security concern. Would you agree that 

this is perhaps the greatest security concern facing DOE labs at 

this point in time? 

Ms. WILBANKS. I can only speak from the cyber perspective. But, 

yes, sir, I would agree that it’s a very high threat. 

156 

Mr. STUPAK. Well, let me ask you—to point that to the point that 

you can in open session here—what’s the level of sophistication of 

these attacks? Are they increasing in capability? 

Ms. WILBANKS. Yes, sir. I would be happy to elaborate in a closed 

session, sir. 

Mr. STUPAK. Mr. Borgia, Ms. DeGette asked the question earlier—let me ask you this if I can. 

Has a full inventory of the information residing on the unclassified networks of DOE national labs been inventoried? 

Mr. BORGIA. No, not that I know of. 

Mr. STUPAK. The other panel didn’t necessarily think it was necessarily a wise choice. Do you it would be? 

Mr. BORGIA. I think that I would defer to that answer. 

I think the most important thing to do with this information is 

to be able to stop the intrusion, if it’s possible. But to be able to 

catalog that information would be—that would be a tremendous library of cataloging we would be responsible for doing in the Department, and it would be overwhelming. 

Mr. STUPAK. Let me ask you this question, if I may. 

You testified that your work is closely coordinated with DOE’s 

Office of Chief Information Officer and NNSA’s Office of Chief Information Officer, and that you maintain strong, mutually supportive relationships in the cyber security. Yet for the past 3 years 

the Office of Inspector General has reported that the Department 

has failed to adequately address cyber security coordination and 

communication. 

From a counterintelligence point of view, are you satisfied with 

the coordination and communication between the Counterintelligence and Information Technology Divisions in the DOE complex 

regarding the reporting of cyber incidents? And what, if anything, 

can be done to improve coordination and communication? 

Mr. BORGIA. Yes. Thank you, Mr. Chairman. 

I would have to say the answer to that is yes. There has been 

a substantial increase in the communication between my office and 

the chief information officers in cyber security. We—in the 2 years 

I’ve been here, we’ve had increasing contact with these offices— 

daily contact, weekly meetings, sometimes twice weekly meetings 

where we sit down and review matters of classified concern. 

And there is continuing contact at the executive levels in each of 

these offices too. Dr. Wilbanks and Mr. Pyke and myself and their 

executive management staffs and mine are very, very familiar with 

one another, and we talk very frequently. 

Mr. STUPAK. Let me ask this question, if you can answer it or 

if we have to go to a closed session, just let me know. 

Mr. Podonsky and his group said they’re not very sophisticated 

in cyber security, but yet they’re able to get in with his Red Team 

and take control of—I don’t want to say take ‘‘control,’’ but have 

pretty good access in two science labs. And everyone is telling me 

today it is more sophisticated. It’s a great concern. 

Is it possible that there have been breaches of our cyber security 

that we don’t know about? Is the sophistication—the level of sophistication—in other words, like when I play basketball, are you 

above the rim or not? 

157 

I’m below the rim, believe me. But are there teams above that 

rim that we possibly don’t even know about? 

Mr. BORGIA. Yes. 

Mr. STUPAK. OK. I have more questions, but I’m going to ask 

those in closed session on that aspect of it. 

Let me ask this. We’ve talked a little bit about this yellow network. And let me—in light of that answer, Mr. Borgia, what is 

NNSA’s opinion on the network access that’s been provided to foreign nationals? What control does, like, let’s say, Los Alamos have 

in place to ensure that foreign nationals have a need-to-know for 

the access they have been provided with on the network? 

Mr. BORGIA. Sir, perhaps the lab director or NNSA would be better to answer that question. 

Mr. STUPAK. OK. 

Dr. Wilbanks, do you want to add anything to that question? 

Ms. WILBANKS. The labs have done a great job in segregating 

various components within their yellow network that allows their 

foreign nationals on there. 

Excuse me. As you heard, Lawrence Livermore is building a separate network for the foreign nationals. They take great strides to 

limit the access of the foreign nationals to specific areas of information, and then to limit their access within the network itself. 

Mr. STUPAK. My concern—I guess I brought it up earlier in the 

first panel—was that mosaic approach. You take something that 

doesn’t seem real sensitive. It’s on the yellow. So I take a piece 

here, take a piece there, put it together, does it become then sensitive, that we should have greater restrictions? 

Do you care to comment on that, Dr. Anastasio? 

Mr. ANASTASIO. Let me indicate that before we have any foreign 

national on our network, we go through a very extensive review, 

including a counterintelligence review of those individuals before 

we allow them on. We’re essentially moving to do the same thing 

Lawrence Livermore is doing in their blue network to have a separate network that’s segregated in a way that allows the foreign national to have access only to the information they need, as I said 

in my testimony. 

And the other thing is that the yellow network has many protections on it. It’s segregated in a sense already to be the network we 

use for information that’s beyond what would be revealed to the 

general public. Before we put any information on that network, we 

go through an extensive classification review before that information is allowed to be on the network. 

But then, beyond that, the mosaic issue is always a challenge. 

And it’s something they watch out for as we go and do our reviews 

of the information and as we look at any issues that may arise. 

But, yeah, I think we are very vigilant about these issues. 

Dr. MILLER. Mr. Chairman, if I could just add a slight amplification of that in the sense of an example. 

Personally identifiable information is obviously something we’re 

all very sensitive to. That information is separately segregated and 

protected on the yellow network. So, for instance, I do not have access to the PII of all of the employees at the laboratory; it is separately segregated. The number of people who have access to it is 

158 

limited to a very small number who actually are required to be able 

to do that in concert with their job. 

An example of why somebody might want to have access to it is, 

if an employee were taken to the medical facility in an emergency, 

the medical people need to be able to get access to personal information about what drugs, whatever. So there are specific circumstances under which people could get access, but generally the 

information is very tightly segregated, based upon the function and 

based upon the need to know of the rest of the people. 

Mr. STUPAK. But you don’t—on your yellow networks you don’t 

have anything where you catalog what foreign nationals are looking at or working on, do you? 

Mr. ANASTASIO. We’re very—we keep—as Dr. Hunter said, we 

keep a full record of all the in-going and out-coming traffic on our 

network and we watch that and search it. And we have sensors deployed to look at the traffic that’s going on. And we periodically do 

scans, as well as do scrubs of the information that’s moving 

around, to ensure ourselves that the proper behavior is going on on 

the network. 

Mr. STUPAK. OK. 

Dr. Wilbanks, let me ask you one more question, if I may. If information was being exfiltrated from any of the DOE labs, would 

this be detectable? In other words, does DOE have the ability to 

fully understand whether information is being lost from any of the 

DOE labs’ networks? 

How would they know this? 

Ms. WILBANKS. DOE, NNSA and the site offices themselves have 

many sensors that monitor the outgoing traffic. And there are techniques, technologies to determine what information is being 

exfiltrated. I’d be happy to elaborate, sir, in a closed session. 

Mr. STUPAK. But it’s possible the sensors don’t pick up what’s 

being exfiltrated, right? It just depends on— 

Ms. WILBANKS. Yes, sir. That’s always a possibility we face. 

Mr. ANASTASIO. Excuse me, Mr. Chairman. Just to amplify on 

that, we do have layers of defense, though. I think that’s important. 

Although no layer is perfect, we have sensors that we use inside 

the laboratories. We have—NNSA has a set of techniques that they 

use, DOE and then even the broader national security community. 

So we rely on all those layers to allow us to know what’s going on, 

and if we have a problem, how we can react. 

Mr. STUPAK. Sure. I agree with that. But the attacks are becoming more and more sophisticated. And if we’re playing above the 

rim, you’re not going to know. 

Mr. ANASTASIO. But our job as a national laboratory is to have 

the innovation and creativity to stay ahead of the game, to be leading the world on these activities and to draw on the full resources 

of all the elements of the government to do our job. 

So we’re very conscious, and Dr. Hunter, I thought, was very eloquent about the people, that that is a key issue for us to make sure 

we have those people that can be at the state of the art, ahead of 

the state of the art. 

Mr. STUPAK. I don’t disagree with any of that. But then when we 

see reports from other offices indicating that our cyber security is 

159 

sort of lacking, and if this is our 14th hearing over the last 8 years, 

when it comes to security, I’m very concerned—not just the physical, but maybe more so the cyber security which has taken on 

greater significance. 

And if our enemy is getting more sophisticated—well, I hope 

we’re above the backboard, not above the rim. I’m not real confident we are at this point in time. 

Dr. Hunter, and then I’m going to go to Mr. Shimkus. 

Ms. WILBANKS. Mr. Chairman, if I may elaborate, please, sir. 

One of the things I mentioned in my opening statement was the 

fact that DOE and NNSA have now combined in their incident 

management, incident handling and identification to help keep us 

above the backboard, sir. 

Mr. STUPAK. Right. 

Dr. Hunter. 

Dr. HUNTER. Thank you, Mr. Chairman. 

Mr. STUPAK. Turn that mic on, please. I’m sorry. 

Dr. HUNTER. Mr. Chairman, we’ve all acknowledged the rightful 

concern about the cyber issue, as you just stated. 

One point I would like to add to what he just said: The laboratories and the DOE are working very closely together so they pool 

their expertise. If there’s any evidence, as we watch very carefully, 

of things that might have been or could be exfiltrated, these people 

call each other and quickly analyze and try to understand the situation. In a way—so it’s like a big team. When you address one 

place, you get the team of the other place that’s quickly providing 

the benefit of their experience to try to understand what is happening and to respond to it. 

Mr. STUPAK. I agree you’re doing all that. I hope it works, but 

when I get figures like 400 million attacks a month, that’s almost 

impossible to keep on top of. So I hope those sensors and filters 

really are doing their job. 

Mr. Shimkus. 

Mr. SHIMKUS. Thank you, Mr. Chairman. 

I think you can continue to hear from Members of Congress, hope 

that security is improving; but you also hear great skepticism over 

the years of Members being involved in some pretty big breaches. 

Let me ask the three directors of the labs, because, Dr. Miller, 

you mentioned a blue network. Or the—all labs being unique, as 

I understand, Dr. Anastasio, Dr. Hunter, are you developing blue 

networks? Are there best practices? Do you communicate and share 

information to make you all better? 

Mr. ANASTASIO. Yes, sir, very much. 

And so at Los Alamos we—as I said, we’re building a further segmented element of our segmented network on our yellow network. 

That’s conceptually equivalent to what Lawrence Livermore is 

doing with their blue network. We haven’t given it a name of a 

color; it’s essentially the same thing. But—we’re using slightly different approaches to accommodate the differences we have, but it’s 

really the same thing. 

But as far as sharing goes, absolutely we share—we, the three 

of us, talk together. We’ve talked about this issue for years 

amongst ourselves, about how to approach it. Even more important, 

our technical staff is in constant contact with each other. 

160 

When we had a concern about a penetration of the yellow network, we had, in fact, people from Sandia to come up to Los Alamos to actually work in our team. So it’s an example of how we’re 

working together. 

Mr. SHIMKUS. The other thing is time frame. When we’re talking 

about sensitive information and—yeah, good lessons learned; you’re 

sharing information—time. 

Dr. Anastasio, I’m going to come back to you. But let me finish 

with Dr. Miller and Dr. Hunter. And then I’m going to come back 

to Los Alamos. 

Dr. MILLER. Yes. I think the question you raise is a very important one. And as Dr. Anastasio said, we work very, very hard. 

We’re very cognizant of the technical approaches that both Los Alamos and Sandia have taken. They have developments that—we are 

watching very carefully; when those developments mature to the 

point where they can be adequately assessed, we will frequently 

move those across from one laboratory to the other. 

We share people. We share information. So there’s a very, very 

tight coupling between the three of us and again, as we have said 

before, with the NNSA/DOE and the much broader Federal community in this area. 

Dr. HUNTER. Thank you. I think I commented on the sharing and 

the working together. I will comment on your specific question 

about the best practices. 

The existence of a three-level network—the unclassified, the yellow network, as we just described and the classified—is, in fact, a 

best practice developed by the laboratories, which we feel is somewhat unique and important. 

Secondly, we have not decided to go to a blue network at this 

point. But what we have decided to do is much like what Mike 

Anastasio said, emphasize stronger segmentation of the yellow network to really be sure the need-to-know controls are in place, and 

emphasize then monitoring of information coming and going into 

that network. 

And then finally to really look at this question of what do foreign 

nationals particularly need in terms of their requirements to work 

at the laboratory, say, on broad science? Sometimes it’s limited to 

things like payroll and benefit information, which you can really 

segment very strongly. 

So the combination of those things, we think, will lead us to the 

proper decision. 

Mr. SHIMKUS. And let me follow up. 

We don’t want to get too—you know, just put all the burden on 

the foreign national debate, because a lot of our security breaches 

would—you know, are nationals—you know, born U.S. citizens. 

But, you know—and we—you know, this list is public on some of 

these. But the vetting process for those, I mean, they’re still citizens of countries that we have identified as sensitive or nonsensitive. So the vetting has to be as good as we do when we give our 

security clearances, I would assume. 

Let me go to Mr. Borgia to respond to the vetting process of the 

individuals who are hired, both alien, visitors and citizens. 

161 

Mr. BORGIA. Sir, there is a vetting process that counterintelligence uses to look at foreign nationals who are coming into the 

complex. 

However, I think it would be better to talk about that in a classified setting, to give you a more detailed understanding of what we 

do. The security program is responsible for conducting backgrounds 

of other persons who are hired, you know— 

Mr. SHIMKUS. And that’s fine. We’ll have that opportunity. So 

thank you. 

Let me go to Dr. Anastasio because you’re the one who obviously 

was the subject of the most recent report. And I think our position 

is, anyone who’s been, you know, in an executive position and 

you—and the inspector general comes down or—in the military, a 

former Army officer or someone from the corporate headquarters, 

who is doing that same thing, they’ve identified numerous deficiencies. 

I guess this thing was finally left in December. So then the compilation of the report, their analysis, finished just a month ago; and 

then this is a very recent—you know, a publication of September 

2008. 

So if we would go through it, you know, starting on page—although a risk assessment was completed, it was not comprehensive. Are we now able to say that the risk assessment is now comprehensive? 

Mr. ANASTASIO. Yes, we are. As part of our process to get accreditation and verification with the process we have with NNSA, we 

have gone through a very formal set of risk assessments, and we 

are—for all our networks and all our activities on the yellow network, as well, of course, as the classified network. And we are just 

now completing that. We’ll be done in December, and we’ll finish 

the full accreditation and certification of all our systems. 

But we’ve gone and taken other steps in response to the GAO. 

Mr. SHIMKUS. I’ll just keep following, because that’s what you 

hear by Members, you know, guidelines. You know, if I was the— 

you know, the Secretary of Energy, I would say not good. These are 

the deficiencies. When will they be resolved? And I think that’s 

where Members are. 

So the other one is policies and procedures have shortcomings. 

Have the shortcomings been addressed? 

Mr. ANASTASIO. Yes, sir, they have. Again, we’ve done a comprehensive look for all the issues that are—at least in the draft report. Since the final just came out today, I haven’t seen the final, 

but we have certainly seen the draft report, and we are already responding to all of the issues that have been raised in that report, 

including more stringent protections, reducing the number of ports 

that are active, more robust cyber detection. We’ve changed our 

policies and made them more clear, as I said in my—and comprehensive—in my opening statement. And we’re just addressing 

all those things. 

Mr. SHIMKUS. OK. Because my time’s short and there are going 

to be votes, so you understand the point. I would then just turn to 

the other directors. And it would make common sense for you all 

to review the report from that position and relook at your own 

processes and procedures. 

162 

Quickly, if you’d like to, sir. 

Dr. MILLER. Yes. Again, we certainly are aware, have read the 

draft report and have reflected it on ourselves. We will do the same 

thing with the final report that just came out. 

Mr. SHIMKUS. The primary job, other than passing the laws of 

the land—and we are justly criticized for not doing a good job in 

oversight. This is our job; this is what we’re supposed to be doing. 

And so that’s why we’re continuing to be on this. 

Sir, do you want to add? 

Dr. HUNTER. Yes, sir. 

I just agree. We share the same challenges, and we’ll derive the 

same lessons learned from every activity. 

Mr. SHIMKUS. You all were out with the rest of the folks when 

the first panel was being asked, and we did spend a lot of time on 

the yellow network. I did talk about e-mails and attachments and 

the Trojan horses and all these things that some of us are just getting to understand and those types. 

A lot of the responses were that we monitor what is—my impression, just trying to pay attention, was, we monitor what’s being 

sent out. We grab it, and we segregate it. We hold onto it. 

So it just led me to the question, if we grab and hold onto it, do 

we grab and hold onto it before it gets out to the system, or it’s 

going out the door, so we at least know what we lost? 

Who wants to respond to that question? We know what we lost. 

Is that really what we’re talking about? 

Mr. PYKE. Mr. Shimkus, in quite a number of cases we are able 

to actually block the outgoing transmission before it takes place. 

There are occasions where we learn about it after the fact or block 

it when it’s partway out. But we are able, through the collaboration 

that’s been discussed by various members of the panel; and 

through an active collaboration with the counterintelligence folks, 

we are able to work together not just week by week, but in near 

real time, to use the information we have to block outgoing attempted exfiltration of information. 

Mr. SHIMKUS. And Mr. Chairman, if I may, I just want to end 

up with—the inspector general testified about incomplete certification and accreditation. We’re kind of raising some of that at the 

labs about incomplete implementation by the Department of Federal cyber security policies, especially for DOE and for NNSA. 

What’s your response to these findings? 

Ms. WILBANKS. NNSA has implemented new policy as of May 

2008 that completely strengthens the certification and accreditation 

process. It also strengthens some of the requirements and restrictions on the yellow network. And the labs are in the process of implementing this policy at this time. 

Mr. SHIMKUS. Go ahead. 

Mr. PYKE. Mr. Shimkus, if I may, we have a comprehensive set 

of requirements DOE-wide in the cyber security area; always, of 

course, looking to improve them and to add to them, but they are 

in place. 

And it’s my understanding in working with Dr. Wilbanks and her 

staff and my personal observations that NNSA not only follows 

these requirements, but given the nature of the mission of NNSA, 

163 

they frequently strengthen them to provide protection against the 

special risks faced by NNSA programs. 

Mr. SHIMKUS. You know, the inspector general recommends time 

frames and benchmarks. I mean, would you agree with his recommendation? And if you do, do you have them? And if you do, 

would you supply those to the committee? 

Ms. WILBANKS. Yes, sir. We do agree. Yes, sir. We do have them. 

And yes, sir, we will supply them. 

Mr. SHIMKUS. Thanks. Thanks, Mr. Chairman. 

Mr. STUPAK. Thank you, Mr. Shimkus. 

Mr. Borgia, if I may, we had some questions of the first panel— 

Mr. Friedman, in particular—about the letter that was sent to Mr. 

Dingell by a former senior counterintelligence officer at Lawrence 

Livermore. 

Are you familiar with that letter at all? 

Mr. BORGIA. Yes, Mr. Chairman, I am. 

Mr. STUPAK. What’s your reaction to it, especially when they say 

that as a result of the changes, vulnerability of DOE personnel and 

facilities to hostile intelligence entities has increased exponentially? 

Mr. BORGIA. I couldn’t hear the first part of the— 

Mr. STUPAK. That as a result of the changes at DOE, the vulnerability of DOE personnel and facilities to hostile intelligence entities has increased exponentially. 

Mr. BORGIA. That would be wrong, Mr. Chairman. 

Mr. STUPAK. That would be wrong? 

Mr. BORGIA. Yes. 

Mr. STUPAK. And the letter cites about five different examples. 

Mr. BORGIA. Sir, I can give you in a classified hearing great examples of the success that this program is experiencing right now 

that collectively have not been experienced throughout the rest of 

the 10 years of the program. 

We have an extraordinary marriage with the FBI. The FBI is 

dedicated, as I mentioned myself, but also 20 other special agents 

who are agents in the labs included—including agents in the weapons labs. 

There has been—there’s been extraordinary connection with the 

Intelligence Community. And this program today has a much bigger profile in the Intelligence Community. The national counterintelligence executive has identified this as one of the top four programs. He’d always talked about this in briefings on the Hill as the 

‘‘top three programs.’’ 

Now he says the top four programs. That’s DOE’s counterintelligence program. There is a great new confidence in the counterintelligence program that is identified and experienced not only 

outside in the intelligence community, but I believe my colleagues 

in the Department as well as the Secretary and the NNSA Administrator would agree. 

Mr. STUPAK. So you wouldn’t agree that, if I can summarize what 

this individual who had 29 years experience with the FBI in this 

area, that the counterintelligence aspect of our security has been 

diminished while the intelligence gathering has increased at the 

expense of counterintelligence and DOE? 

Mr. WILSHUSEN. Yes. That would be wrong. 

164 

Mr. STUPAK. That would be wrong? 

Mr. WILSHUSEN. Yes. And, sir, I have almost 25 years in the FBI, 

worked counterintelligence, counterterrorism, and criminal investigative programs. I could sit, and I would be very happy to sit and 

talk about and give you the details in a classified setting about 

what the accomplishments of this program are. 

Mr. STUPAK. Well, I wanted to raise it, and I am glad you are 

familiar with it because it probably will come up in our closed session, which we are going to go into soon. 

Mr. Shimkus, questions, please. 

Mr. SHIMKUS. Just a unanimous consent request for these two 

documents. I think the staff shared them with you. The one’s a 

Foreign National Assignments with computer access. It just has a 

listing of all that. And another one, just to highlight the fact that 

we have U.S. citizens that are not good citizens also. There is a 

story today, an AP story: Scientist Accused of Selling Rocket Data 

to China, an AP story about that. I am asking unanimous consent 

to accept those. 

Mr. STUPAK. Without objection, then—I’m looking for the date on 

this one here. Today’s date, Scientist Accused of Selling Rocket 

Data to China, that will be made part of the record, that AP news 

story. And Foreign National Assignees With Computer Access, 

dated September 12, 2008, will also be made part of the record. 

[The information appears at the conclusion of the hearing.] 

Mr. STUPAK. That is going to conclude the open part of our hearing. We are going to have a couple votes on the floor, so why don’t 

we do this: Instead of reconvening in 10 minutes, I think, let’s 

shoot for 2:00. We have got at least three votes on the floor; they 

are going to call them here in a second, and then we can meet in 

2218. So let’s meet in Room 2218 of the Rayburn Building at 2:00. 

And only those individuals who have appropriate Top Secret/Q 

level clearances that have been previously sent to the committee 

clerk and the House security will be admitted. So I will dismiss 

this panel then. 

And before we close this portion of the hearing, I ask unanimous 

consent that the hearing record will remain open for 30 days for 

additional questions for the record. Without objection, the record 

will be open. 

I ask unanimous consent that Tabs 1 through 7 and Tabs 25 and 

26, those nonofficial use only exhibits of our document binder, be 

entered into the record. Without objection, the documents will be 

entered into the record. 

Mr. STUPAK. That concludes the open portion of this hearing. We 

will recess until 2:00 and reconvene in Room 2218 of the Rayburn 

Building for our closed portion of this hearing. 

[Whereupon, at 1:13 p.m., the subcommittee recessed to proceed 

in closed session at 2:00 p.m. the same day.] 

165 


63238.034
166 


63238.035
167 


63238.036
168 


63238.037
169 


63238.038
170 


63238.101
171 


63238.102
172 


63238.103
173 


63238.104
174 


63238.105
175 


63238.106
176 


63238.107
177 


63238.108
178 


63238.109
179 


63238.110
180 


63238.111
181 


63238.112
182 


63238.113
183 


63238.114
184 


63238.115
185 


63238.116
186 


63238.117
187 


63238.118
188 


63238.119
189 


63238.120
190 


63238.121
191 


63238.122
192 


63238.123
193 


63238.124
194 


63238.125
195 


63238.126
196 


63238.127
197 


63238.128
198 


63238.129
199 


63238.130
200 


63238.131
201 


63238.132
202 


63238.133
203 


63238.134
204 


63238.135
205 


63238.136
206 


63238.137
207 


63238.138
208 


63238.139
209 


63238.140
210 


63238.141
211 


63238.142
212 


63238.143
213 

Æ 


63238.144