Report to the Chairman, Committee on

Energy and Commerce, House of

Representatives

United States General Accounting Office

GAO

August 2001 NUCLEAR SECURITY

DOE Needs to

Improve Control Over

Classified Information

GAO-01-806
Page i GAO-01-806 Nuclear Security

Letter 1

Results in Brief 2

Background 3

Laboratories Have Implemented DOE's Access Controls and Needto-Know Requirements, but These Requirements Could Permit

Unnecessary Access 5

DOE Needs to Further Enhance Security For Top Secret

Information and Expedite Implementation of Classified

Information Security Upgrades 11

Conclusions 14

Recommendations for Executive Action 15

Agency Comments and Our Evaluation 15

Scope and Methodology 17

Appendix I Comments From the Department of Energy 19

Contents
Page 1 GAO-01-806 Nuclear Security

August 24, 2001

The Honorable W. J. “Billy” Tauzin

Chairman, Committee on Energy and Commerce

House of Representatives

Dear Mr. Chairman:

The Department of Energy (DOE) maintains millions of classified

documents containing highly sensitive nuclear weapons design and

production information. Allegations that the Peoples Republic of China

obtained nuclear warhead designs from an employee of DOE's Los Alamos

National Laboratory, as well as the disappearance of two computer hard

drives containing highly sensitive weapons information from that same

laboratory, have raised concerns about how effectively DOE protects

classified information, particularly the most sensitive classified

information that is contained in vaults and computer systems.

DOE's information security program consists of numerous strategies for

protecting and controlling classified information, such as controlling

access to classified information through physical and administrative

barriers and determining whether a person's work requires a "need to

know" the information. DOE has recently increased protection for top

secret documents by revising its Classified Matter Protection and Control

Manual, which provides detailed requirements for the protection and

control of classified matter. DOE is also in the process of upgrading its

Control of Weapon Data Order, which establishes procedures for control

of weapon-related classified information, to provide additional control for

highly sensitive weapons information.

Because of the Committee's concerns about the security of classified

information, you asked us to determine (1) the extent to which DOE's

Sandia and Los Alamos National Laboratories have implemented DOE's

established access controls and need-to-know requirements for classified

vaults and computer systems containing the most sensitive classified

information as well as the adequacy of these requirements and (2) the

steps DOE is taking to upgrade protection of its classified information. As

agreed with your office, we reviewed the implementation of DOE's access

controls and need-to-know requirements at two of the weapons

laboratories, Los Alamos National Laboratory and Sandia National

Laboratory, because of the volume, sensitivity, and diversity of the

classified matter held at these facilities.

United States General Accounting Office

Washington, DC 20548
Page 2 GAO-01-806 Nuclear Security

GAO has designated information security as a high-risk area

governmentwide because growing evidence indicated that controls over

computerized federal operations were not effective and because related

risks were escalating. This report does not address computer operations at

DOE facilities. However, we did address DOE's vulnerabilities in this area

in a previous report on DOE's systems for unclassified civilian research

(GAO/AIMD-00-140, June 9, 2000), and, because this is a high-risk area,

over the next few years we plan to continue to examine information

security at DOE and other federal agencies.

The Los Alamos and Sandia National Laboratories have implemented

DOE's access controls and need-to-know requirements for both vaults and

classified computer systems containing the most sensitive classified

information. However, DOE's requirements for documenting need to know

lack specificity, allowing laboratory managers wide variation in

interpretation and implementation. Need-to-know determinations made by

laboratory managers vary from detailed, specific, individual justifications

to long-term blanket approvals for hundreds of staff for all classified

information in a vault or computer system. More specific requirements and

guidance for documenting need-to-know determinations would help

ensure that only persons who require access to specific classified

information to conduct their current work are granted access to that

information.

DOE has recently taken, and continues to take, steps to upgrade

protection and control over its classified information, but additional steps

are needed. DOE's recent revision of its Classified Matter Protection and

Control Manual adds several security requirements for top secret

information. However, the revised manual does not reinstitute several top

secret security requirements, in effect prior to 1998, that would enhance

the protection of top secret information by providing a more traceable

record of the document if it were to be lost. In addition, DOE is revising its

Control of Weapon Data order to increase the security of documents that

contain compilations of highly sensitive nuclear weapons information.

According to DOE officials, this order is to be issued in fall 2001. However,

this effort to upgrade security for the most sensitive weapons documents

has already been under way for almost 8 years. Before the order can be

issued, DOE must finish drafting it, distribute it for comment, resolve the

comments, and obtain the concurrence of all affected organizations. These

steps often take many months. Until the order is issued, these documents

will have a lower degree of protection.

Results in Brief
Page 3 GAO-01-806 Nuclear Security

We are making recommendations to the Secretary of Energy aimed at

providing more guidance for documenting need-to-know determinations,

evaluating the reinstitution of requirements for the protection and control

of top secret documents, and ensuring issuance of the order to increase

protection over certain documents.

In commenting on a draft of this report, DOE misunderstood the intent of

our recommendation for additional guidance for making need-to-know

determinations and disagreed with our recommendation for conducting a

cost-benefit study of reinstituting certain requirements for protecting top

secret documents. We have clarified our recommendation that DOE

should require better documentation of need-to-know determinations. We

continue to believe that DOE should evaluate the reinstitution of

requirements for top secret documents and ensure the issuance of the

order to increase protection for certain classified documents. Appendix I

contains DOE’s comments.

DOE is responsible for the nation's nuclear weapons programs. The

National Nuclear Security Administration (NNSA), a semi-autonomous

administration within DOE, carries out these responsibilities. The primary

mission of the NNSA's Albuquerque Operations Office is the stewardship

and maintenance of the nation's nuclear weapons stockpile. As part of that

mission, the Albuquerque Operations Office oversees two of DOE's major

nuclear weapons laboratories, the Los Alamos National Laboratory,

located in Los Alamos, New Mexico, and the Sandia National Laboratory,

located in Albuquerque, New Mexico. These laboratories were established

in the 1940s as part of the Manhattan Project to design, test, and assemble

nuclear weapons. Los Alamos National Laboratory officials estimate that

the laboratory has about 7 million classified documents, while Sandia

National Laboratory officials estimate that the laboratory has over 2.5

million classified documents.

DOE policies for information security are contained in DOE Order 471.2A,

Information Security Program. DOE supplements its order with DOE M

471.2-1C, Classified Matter Protection and Control Manual. The manual

provides requirements for the protection and control of classified matter

and applies to contractors with access to classified matter, including the

contractors operating the national weapons laboratories. The DOE manual

requires that access to classified matter be limited to persons who possess

appropriate access authorization and who require such access, that is,

have a need to know, in the performance of official duties. Need to know

is defined as a determination made by an authorized holder of classified

Background
Page 4 GAO-01-806 Nuclear Security

information that a prospective recipient requires access to specific

classified information in order to perform or assist in a lawful and

authorized governmental function. Access is defined as the ability or

opportunity to gain knowledge of classified information.

The DOE manual states that control systems are to be established and

used to prevent unauthorized removal of classified information. The

manual also requires that certain classified material be put in

accountability, which is a system of procedures to provide an audit trail

for classified matter when it is originated, reproduced, transmitted,

received, or destroyed. DOE revised the manual several times in the 1990s

to change the accountability requirements for top secret and secret

information. The latest revision was issued in April 2001.

DOE has also required the laboratories to implement several

enhancements in response to a recent security incident. In June 2000, DOE

discovered that two computer disks containing sensitive weapons

information were missing. These disks, which were subsequently found,

are used by DOE's Nuclear Emergency Search Team and its Accident

Response Group. These groups are responsible for responding to nuclear

weapon emergencies around the world, such as terrorist threats. In

response to this occurrence, in June 2000, the former Secretary of Energy

announced the following six security enhancements:

• Institute a system to record all personnel's entry and exit from vaults

containing emergency response assets (such as laptop computers and hard

drives), nuclear weapons design information, weapons use control

systems, security vulnerabilities, or top secret information.

• Require that all open vaults containing emergency response assets, nuclear

weapons design information, weapons use control systems, security

vulnerabilities, or top secret information, be controlled at all times by at

least one person with appropriate clearance and need to know, and when

not controlled, be locked and alarmed.

• Require that DOE field offices evaluate vaults and security containers for

compliance with DOE requirements.

• Place removable electronic media in separate storage (not commingled

with other classified material) under accountability and conduct a baseline

inventory of the removable electronic media.

• Place Nuclear Emergency Search Team and Accident Response Group

material under accountability and conduct an inventory of that material.

• Require National Security Agency-approved encryption for high-volume

media containing certain classified information, including emergency
Page 5 GAO-01-806 Nuclear Security

response assets, nuclear weapons design information, weapons use

control systems, security vulnerabilities, and top secret information.

Our review at the Sandia and Los Alamos National Laboratories indicates

that existing DOE access controls and need-to-know requirements for both

vaults and classified computer systems are being carried out in practice

and the laboratories have implemented the Secretary's six security

enhancements. Recent DOE inspections and surveys resulted in similar

conclusions. However, these conclusions may not be especially

meaningful because DOE's need-to-know requirements are general,

allowing laboratory managers wide latitude in interpretation and

implementation. Our review found that need-to-know determinations

ranged from detailed, specific, individual justifications to "blanket" need to

know for hundreds of employees—an entire organization—to have access

to all classified information for long or open-ended periods of time. This

could allow employees access to classified information that they do not

need to perform their current tasks.

DOE's security requirements state that access to classified information

shall be granted only to persons who possess the appropriate clearances

and need to know. Supervisors and other responsible officials who are

knowledgeable about the classified information and the responsibilities of

the individual may determine need to know. Implementing guidance

provided by the Sandia and Los Alamos National Laboratories echoes the

DOE requirements. For example, the Sandia National Laboratory manual

for classified information states that employees may only grant access to

classified information to other individuals with similar work needs, and it

cautions that possession of a security clearance does not give that person

a right to have access to classified information unless the person has a

legitimate work need.

We found that DOE’s access control and need-to-know requirements were

being followed for the vaults and classified computer systems at Sandia

and Los Alamos National Laboratories. Line managers had certified that

staff had proper clearances and a need to know before access to vault and

Laboratories Have

Implemented DOE's

Access Controls and

Need-to-Know

Requirements, but

These Requirements

Could Permit

Unnecessary Access

Laboratories Conform

With DOE Access Controls

and Need-to-Know

Requirements
Page 6 GAO-01-806 Nuclear Security

classified computer systems—and the information contained therein—was

granted.1

In addition, we found that the former Secretary of Energy's June 2000

enhancements had been implemented to the extent possible. The first

enhancement required instituting a system to record all persons entering

and leaving vaults containing certain highly sensitive classified

information. The laboratories have required that all vaults have systems

for recording the entrance and exit of personnel, and all the vaults we

reviewed had implemented either an electronic or manual system to

record the entrance and exit of all staff and visitors.

For the second enhancement, all open vaults containing certain highly

sensitive classified information were required to be controlled by at least

one person with appropriate clearance and need to know, and when not

controlled, to be locked and alarmed. The laboratories have instituted this

requirement and have forbidden a previous practice of leaving an

uncontrolled vault locked, but not alarmed, for several hours during the

normal working day.

For the third enhancement, DOE field offices were required to evaluate

vaults and security containers. The Albuquerque Operations Office has

reviewed vaults and security containers at the Sandia and Los Alamos

National Laboratories and found that DOE requirements for vaults and

security containers were being followed. In addition, the Albuquerque

Operations Office's Kirtland Area Office has evaluated about 35 percent of

Sandia National Laboratory's vaults and found that they met or exceeded

current DOE requirements for vault configuration and operation.

The fourth enhancement required that removable electronic media, such

as computer disks, not be commingled with classified documents and that

these media be placed in accountability and be inventoried. This

enhancement has been implemented. Removable electronic media have

been placed in separate storage and in an accountability system, and

inventories have been completed. The requirement for separate storage

was rescinded on October 2, 2000, because it was believed that security

 1

 According to officials at Los Alamos and Sandia National Laboratories, computer system

administrators, by virtue of their jobs, have access to everything on the systems. To

mitigate the risks, the laboratories' system administrators are cleared to the highest level of

information on the system. In addition, the Los Alamos National Laboratory separates the

duties of system administrators.
Page 7 GAO-01-806 Nuclear Security

measures already in place were adequate and that separate storage did not

provide more security.

The fifth enhancement required that classified equipment and information

belonging to the Nuclear Emergency Search Team and Accident Response

Group be kept in separate storage, be placed in accountability, and be

inventoried. This requirement has been completed at both Sandia and Los

Alamos National Laboratories.

Finally, under the sixth enhancement, certain classified electronic media

were required to be encrypted. Both laboratories had implemented this

requirement to the extent possible. Part of the enhancement covered

databases deployed with DOE emergency response teams. Encryption

technologies for classified electronic media must be approved by the

National Security Agency. There is a National Security Agency-approved

encryption technology for one of the computer operating systems that the

laboratories use for these databases and encryption is in place on that

system at both laboratories. Another part of the enhancement covered

highly classified information on other computer operating systems.

However, all computer systems could not be encrypted because the

National Security Agency has not approved encryption software for these

other computer operating systems. The agency has told DOE that it is

working on a hardware-based solution and that the time frame for

availability is not currently known. In the meantime, those systems may be

encrypted with an interim solution software until the National Security

Agency’s hardware-based solution is available.

Recent inspections by DOE's Office of Independent Oversight and

Performance Assurance and surveys by DOE's Albuquerque Operations

Office generally had similar observations on access, need to know, and the

June 2000 enhancements. An October 2000 report by the Office of

Independent Oversight and Performance Assurance on Sandia National

Laboratory did not cite any problems related to implementation of DOE

vault or classified computer network access or need-to-know

requirements. The report also indicated that the June 2000 security

enhancements had been implemented at the Sandia National Laboratory. A

July 2000 Albuquerque Operations Office survey report on the Sandia

National Laboratory similarly had no vault or computer network access or

need-to-know findings and found that the laboratory had successfully

implemented the DOE-mandated enhanced protection measures.

In August 2000, reporting on the Los Alamos National Laboratory, DOE's

Office of Independent Oversight and Performance Assurance had no
Page 8 GAO-01-806 Nuclear Security

specific recommendations concerning compliance with DOE access or

need-to-know requirements. The Office also found that Los Alamos

National Laboratory had completed the former Secretary of Energy's June

2000 security enhancements. The Albuquerque Operations Office

September 2000 security survey at Los Alamos National Laboratory

inspected containers storing classified documents and had no findings.

That survey did not review the security enhancements.

We found that line managers at the laboratories were making and

approving need-to-know determinations in accordance with DOE's

requirements. However, the nonspecific nature of those requirements

allowed wide latitude in their implementation. While differences in the

type of work performed may justify some differences and required some

flexibility in implementation, it is difficult to determine if the differences

were warranted because the need-to-know determinations were

inconsistent in documenting (1) the reasons an individual's work requires

access to classified information, (2) time during which an individual has a

need to know, and (3) information that an individual has a need to know.

In addition, in some cases, the use of "blanket" need-to-know

authorizations resulted in the undocumented authorization of all

personnel in a laboratory division or department to access all classified

information indefinitely.

DOE and the Sandia and Los Alamos National Laboratories require

managers to determine that an individual's work requires a need to know

the classified information before the individual is granted access to the

information. There is no requirement on how this determination should be

documented and what criteria should be used. As a result, the degree of

specificity in documenting need-to-know determinations varied widely.

For example, at one vault, a justification form, which specifies the nature

of each individual's work and states specifically why the individual has a

need to know the classified information in the vault, is required before

vault access is permitted. In contrast, at other vaults, documentation

consisted only of a list of persons granted access by the signing manager.

Each individual on the list may have a legitimate need to know as

determined by that individual's manager; however, there is no

documentation to justify that determination.

Need-to-know determinations for some classified computer systems were

also not documented. One classified computer system required that the

manager approve each individual for access to the system. The manager

certified that the individual had appropriate clearance, but there was no

Need-to-Know

Determinations Are Not

Well Documented
Page 9 GAO-01-806 Nuclear Security

documented reason provided for why the access was necessary or

justification of the individual's need to know based on the work being

done.

We also noted a wide variation in the degree of documentation of need-toknow time limitations. Both laboratories require that access be limited to

the term that the individual has a legitimate work-related need to know,

but the documentation on need-to-know time limitations varied. At one

vault, access time was specifically limited to the exact calendar days an

individual had a work-related need to know for classified data in the vault.

In contrast, for another vault, the manager initially determines that an

individual has a need to access the information. An annual review is

conducted to determine if all personnel still have a work-based need to

know.

For another classified computer system, virtually open-ended access is

granted. The manager initially signs a form stating that the individual has a

clearance. This form authorizes access to the system. The form does not

specify a time period for which the individual will require access to the

system—only that the manager will notify the system manager when the

individual transfers, terminates, or no longer requires access to the

system.

Similarly, DOE's requirements for determining what specific classified

information an employee has a need to know do not specify a process or

procedure. DOE and both laboratories require that an individual be

allowed access to only the classified information for which that individual

has a work-based need to know. However, the determination is generally

not documented, and the degree of specificity varied. In one vault where

specific determinations were made, all classified information was stored in

individually locked safe drawers. Staff could access only the drawers

containing the information for which they had been determined to have a

need to know. More typical, however, were vaults where staff had access

to thousands of documents in open storage.

At some vaults, need-to-know time determinations combined nonspecific

justifications, time duration, and access to information. Need to know was

authorized to entire groups—rather than to only those who had been

individually justified—for all classified information in a vault for long or

indefinite periods of time. This practice has been referred to as a "blanket"

or common need to know. At one vault we reviewed, 250 staff—basically

the division's entire roster of nuclear engineers, nuclear physicists, and

physicists—were granted access to all information (about 50,000
Page 10 GAO-01-806 Nuclear Security

documents) in the vault for a period of 1 year without any specific

documentation. Laboratory officials told us that the list of staff with need

to know and access to the vault is reviewed annually. Laboratory officials

explained that management has determined that the entire staff's work is

relevant to all information stored in the vault. The Los Alamos National

Laboratory has issued two criteria for using blanket need to know:

• "Project activities are sufficiently integrated as to require that all program

staff may require access to any project-related classified matter at any

time.

• [A] project is of a research nature and as such project staff may require

access to all project-related classified matter at any time."

According to our review of their usage patterns, however, it does not

appear that all staff require unlimited access to classified data. At the Los

Alamos vault, all 250 staff with "Q" clearances in the group were granted

access to all 50,000 classified documents in the aforementioned vault, but

only about 25 division staff access information in the vault on a regular

basis, according to the vault custodian. This could indicate that these 25

individuals are the only staff that actually do have a need to access the

information in the vault on a continuing basis. Others could be granted

access for specific periods of time—as they need it. In addition, without

more detailed documentation, it is not clear that the 25 individuals who

access the vault regularly or others who use the vault less often, need

access to all 50,000 documents in the vault.

DOE's Office of Independent Oversight and Performance Assurance has

also reviewed need-to-know processes, and in June 2000, it reported on

blanket need-to-know determinations. It found that in some organizations,

laboratory officials "made a blanket determination that everyone in the

Division needed access to all information located in a large vault that had

a wide variety of information on different programs. While a questionable

practice, there are no specific provisions in the DOE order that explicitly

preclude such a practice." The Office recommended that DOE clarify needto-know policy by adding "prudent measures to restrict access to those

with a specific need to know (rather than unilateral decisions that an

entire Division has a need to know all information in a vault or program)."2

 2 Report on the Control of Classified Weapons Data at the National Weapons

Laboratories, Office of Independent Oversight and Performance Assurance, U.S.

Department of Energy, June 22, 2000.
Page 11 GAO-01-806 Nuclear Security

DOE is upgrading its protection and control of classified information. DOE

has issued a revision of its classified matter protection and control

requirements to increase security and accountability for top secret

information. However, the revision lacks several top secret security access

controls that were in place prior to 1998. These controls, if reinstituted,

would provide a more traceable record of the document in the event it

becomes lost. In addition, DOE has worked with the Department of

Defense and is revising an order to increase security for compilations of

the most sensitive classified information, to be designated "Sigma 16."

However, the Sigma 16 initiative has been in process for almost 8 years,

and according to DOE officials, the order will not be issued until the fall of

2001, at the earliest. Before the order can be issued, DOE must finish

drafting the order, distribute it for comment, resolve the comments, and

obtain the concurrence of all affected organizations, processes that often

take many months to complete. Until the order is issued, these documents

will be provided a lower degree of protection.

DOE issued its revised Classified Matter Protection and Control Manual on

April 17, 2001. The manual requires the following new requirements for top

secret information:

• conduct an annual inventory of all top secret documents;

• establish control stations to maintain records and control top secret

matter received by or dispatched from facilities; and

• maintain accountability records to record when top secret documents are

originated, reproduced, transmitted, received, destroyed, or changed in

classification.

Prior to 1998, DOE required accountability for top secret information that

included annual 100-percent inventories, accountability records, unique

identification numbers, a top secret control officer, records of individuals

who have access to the documents, internal transfer receipts, external

transfer receipts, and approval for reproduction. In 1998, DOE removed

top secret matter from accountability, which eliminated many of these

requirements. According to DOE officials, the time and cost of performing

the requirements did not sufficiently add to the assurance that the

information was being controlled.

While the revised Classified Matter Protection and Control Manual

reinstates some of these security procedures, it does not include two pre1998 requirements. The revised manual does not require approving

reproduction of top secret documents and maintaining an access list for

DOE Needs to Further

Enhance Security for

Top Secret

Information and

Expedite

Implementation of

Classified Information

Security Upgrades

Revisions to Top Secret

Information Security

Requirements Lack Key

Controls
Page 12 GAO-01-806 Nuclear Security

each top secret document. DOE officials informed us that these

requirements were not reinstituted because they were not cost effective—

the additional cost was not justified by the additional protection provided.

In addition, a DOE official said that under the new requirements, each

organization that has top secret documents will maintain accountability

for these documents. The DOE official also said that if a top secret

document should not be reproduced, it should be specifically marked that

reproduction is not allowed without the originator's approval. Finally,

according to the DOE official, a top secret access list was a formality to

document need to know. Supervisors are currently responsible for

determining need to know.

DOE's argument that these requirements are not cost effective is not

supported by a cost-benefit analysis or a study, and DOE officials could

not provide us with cost estimates for implementing the requirements.

Although DOE has decided not to reinstitute these requirements, some

organizations have determined that these procedures are necessary. For

example, the Sandia National Laboratory maintains top secret access lists

and requires pre-approval for the reproduction of top secret documents.

DOE's Office of Defense Programs also maintains top secret access lists.

Security officials at Sandia and Defense Programs said that they

maintained these controls on top secret documents, even though they

were not required, because they believed those procedures are necessary

to adequately protect and control top secret information.

These accountability measures provide an additional level of control for

top secret information. A top secret access list would further enhance

security of top secret matter by documenting which staff are authorized

and required to have access to a specific top secret document.

Reproduction approval ensures that only authorized copies of top secret

documents are made and that those copies are properly entered into

accountability.

On December 7, 1993, the former Secretary of Energy announced an

"Openness Initiative" in an effort to make information in areas of concern

to the public more accessible. As a result, large numbers of classified

documents were declassified and released. A DOE official told us that

because so many documents were being declassified, DOE officials

believed that the more sensitive documents should be better protected.

DOE Order to Protect the

Most Sensitive Classified

Documents Is Not

Expected to Be Issued

Until Fall 2001
Page 13 GAO-01-806 Nuclear Security

Subsequently, in response to the National Industrial Security Program

Operating Manual,

3

 DOE and the Department of Defense began discussing

clearances and access to classified information.

In January 1997, DOE recommended more stringent security measures be

implemented for the protection of 137 classified information topics that

had been identified as the most sensitive. By 1999, DOE and the

Department of Defense had reduced the number of topics to 65, but,

according to DOE officials, the potential costs of implementing a program

to better protect such information "choked" the project, and a joint

DOE/Department of Defense group was formed to look at feasible

alternatives. According to members of this group, rather than not do

anything about a large number of topics, the group decided to increase

security for a smaller number of items. The group agreed to create a new

designation—Sigma 16—for these items. Sigmas are categories of

information related to the design, manufacture, or utilization of atomic

weapons or nuclear explosive devices that require different or more

stringent protection. Sigma 16 will be a new category comprised of

documents containing (1) nuclear weapons design specifications that

would permit the reproduction and function of the weapon and (2)

aggregations of design information that provide comprehensive insight

into nuclear weapon capability, vulnerability, or design philosophies.

According to DOE officials, when the designation becomes effective, all

Sigma 16 documents at all classification levels (top secret, secret, and/or

confidential) would be placed in accountability, including inventories and

documentation of reproduction, transfers, and destruction. Access lists

will be required and single scope background investigations will be

required for access.4

 One person will be identified to ensure accountability

of Sigma 16 documents. These additional security measures are not

currently required for these documents. DOE and the Department of

 3

 The National Industrial Security Program Operating Manual prescribes requirements

and other safeguards that are necessary to prevent unauthorized disclosure of classified

information and to control authorized disclosure of classified information released by the

U.S. government to its contractors. The Secretary of Defense is responsible for issuing the

manual with the concurrence of DOE, the Nuclear Regulatory Commission, and the Central

Intelligence Agency.

4

 The single scope background investigation is a full field background investigation

concerning the most recent 10 years of an individual's life. This is in addition to the

National Agency Check normally conducted. The National Agency Check is a name check

of the individual at appropriate federal and local law enforcement agencies, credit search,

and a classification of the individual's fingerprints.
Page 14 GAO-01-806 Nuclear Security

Defense approved Sigma 16 on December 7, 2000. The category will not be

in effect until DOE issues a revised Control of Weapon Data Order

(currently DOE 5610.2, dated Aug. 1, 1980). DOE does not expect to issue

the revised order before October 2001. However, before the order can be

issued, DOE must finish drafting the order, distribute it for comment,

resolve the comments, and obtain the concurrence of all affected

organizations, processes that often take many months.

Although the Sandia and Los Alamos National Laboratories have

implemented DOE's requirements for access and need to know for vaults

and classified computer networks, DOE does not have requirements for

documenting need-to-know determinations. Without such requirements,

the justification for granting need to know was not documented in many

cases and DOE cannot ensure that access to classified information is

limited only to individuals who have appropriate clearances and whose

work requires access to specific classified information for a specific

period of time. In addition, the use of blanket need-to-know

determinations allows groupwide determinations to be made for access to

all information in a vault on a continuing basis. However, blanket

determinations bypass documentation of the specific considerations

necessary to ensure that only the personnel who actually have a need for

specific classified information are granted access for the time they actually

require and therefore should be used only as an exception to individual

need-to-know determinations. Additional guidance is needed to define

when such exceptions would be appropriate.

DOE has recently enhanced security for top secret information, but it did

not reinstate the requirements for a top secret access list and reproduction

of top secret documents only with authorization. DOE's statement that

these requirements are not cost effective is not supported by cost data or a

cost-benefit analysis or study. We believe reinstituting these procedures

would increase security for top secret documents by providing better dayto-day control of these documents and better records for tracking the

documents if they are ever missing. In view of the potential benefits of

these controls, DOE needs to support its position that these controls are

not cost effective. This is particularly important, given that these

requirements are still being performed in some organizations because they

are considered to be effective.

Finally, DOE is revising an order that would increase security for certain

classified information, to be designated as Sigma 16. This classified

information will not receive increased security until the order is approved.

Conclusions
Page 15 GAO-01-806 Nuclear Security

DOE has many processes to complete before the revisions to the order are

final, approved, and implemented. Given the importance of the order,

however, DOE needs to make sure that it meets its fall 2001 deadline for

implementation.

To improve classified document security and accountability, we

recommend that the Secretary of Energy:

• Issue more specific requirements for documenting need-to-know

determinations.

• Provide guidance on when the use of "blanket" need-to-know approvals for

large numbers of employees is appropriate and how it should be

documented.

• Conduct cost-benefit analyses for reinstituting the requirements for top

secret access lists and approval for reproduction of top secret documents.

• Ensure the issuance of the revised Control of Weapon Data order

establishing Sigma 16 by fall 2001.

We provided DOE with a draft of this report for its review and comment.

In general, the Department disagreed with three of our

recommendations—the need for more specific requirements for making

need-to-know determinations, the use of blanket need-to-know

justifications, and the reinstatement of certain top secret security

requirements.

First, DOE misunderstood the intent of our recommendation concerning

requirements for need-to-know determinations. We are not recommending

that DOE should adopt more stringent rules for granting need to know. We

believe that DOE needs to require better documentation of the analysis

and justifications for granting need to know. We acknowledge that there

are differences in the type of work performed that may justify some

differences and require some flexibility in need-to-know implementation.

However, it is difficult to determine if the differences in implementation

are warranted because need-to-know determinations are not documented

the same at and within various DOE sites. We have clarified our

recommendation that the Secretary of Energy should issue more specific

requirements for documenting need-to-know determinations.

Second, DOE disagreed with our recommendation for guidance on the use

of blanket need to know. DOE stated that there are situations in which

broad, or blanket, need-to-know access is granted but that these are

restricted to very specific situations, (for example, X-Division at Los

Recommendations for

Executive Action

Agency Comments

and Our Evaluation
Page 16 GAO-01-806 Nuclear Security

Alamos National Laboratory) where large organizations are collaborating

on one program–such as nuclear weapons stockpile stewardship. DOE

believes that there should not be more “granular” access to the 50,000

classified documents within the X-Division vault, because the information

is derived from a fairly common foundation (weapons physics) and

represents the underlying science applied to a wide variety of test shots

and other analytical activities. Also, DOE stated that combining more

restrictive access with a requirement to limit the time period for access

does not consider that many of the staff involved spend their entire

careers in a particular aspect of national security.

We do not dispute that in some situations blanket need to know may be

warranted. However, DOE has no guidance or criteria to allow a

determination of these situations. DOE’s comments cited X-Division at the

Los Alamos National Laboratory as an example of where blanket need to

know is appropriate. Our review of X-Division, however, revealed no

documentation that justifies the need for every person in X-Division to

have access to all the division’s classified documents at all times. DOE, in

its comments, acknowledges that clarification of the roles and

responsibilities and the use of blanket authorizations may be necessary. It

stated that clarification, if necessary, will be issued in the first quarter of

fiscal year 2002.

DOE also disagreed with the recommendation to conduct a formal costbenefit analysis for the reinstitution of the requirements regarding a top

secret control officer, top secret access lists, and pre-approval for the

reproduction of top secret information. DOE believes that its current

policy has reasonably and responsibly defined the objectives and

requirements for protecting classified information, including top secret.

DOE also stated that a requirement for a top secret control officer is not

cost effective at facilities that have a small number of top secret

documents because the revised Classified Matter Protection and Control

Manual required establishment of control stations that carry out functions

similar to control officers.

We do not agree that the requirement by itself for control stations provides

security and control similar to that previously provided by the top secret

control officers. However, the requirement for control stations in

conjunction with the April 2001 reinstatement of accountability for top

secret documents meets the intent of our recommendation. Accordingly,

we have deleted our recommendation that DOE do a cost-benefit study of

reinstituting the top secret control officer.
Page 17 GAO-01-806 Nuclear Security

Regarding conducting a cost-benefit study of reinstituting the

requirements for top secret access lists and pre-approval for reproduction

of top secret documents, DOE has no basis to support its belief that access

lists and reproduction approval are not cost effective. We have not

recommended that DOE reinstitute this requirement. However, we

maintain that these requirements, which were in effect until 1998, have the

potential to increase control over top secret documents and that DOE

should conduct a study of their costs and benefits.

DOE agreed to ensure the issuance of the revised Control of Weapon Data

order by November 2001.

To answer your questions, we visited DOE's Germantown, Maryland, and

Washington, D.C., offices; obtained documents, DOE orders, and DOE

manuals; and interviewed cognizant officials about DOE's requirements

for need to know and access controls. We also visited the Los Alamos and

Sandia (New Mexico) National Laboratories, obtained documents and

requirements, and interviewed cognizant laboratory officials concerning

their access controls and need-to-know requirements. During our visits to

the laboratories, we inspected and observed operating procedures for

vaults containing the most sensitive classified information, as determined

by laboratory officials.

GAO has designated information security as a high-risk area because

growing evidence indicated that controls over computerized federal

operations were not effective and because related risks were escalating.

This report does not address computer operations at DOE facilities.

Rather, as agreed with your staff, we evaluated the administrative

requirements and managerial decisions on who is allowed access to

classified information on DOE's classified computer systems. In this

regard, we reviewed DOE's administrative requirements and the

laboratories' compliance with those requirements. We have also issued a

report that described vulnerabilities in DOE's systems for unclassified

civilian research,5

 and as a high-risk area, over the next few years, we plan

to continue to examine information security at DOE and other federal

agencies.

 5 Information Security: Vulnerabilities in DOE's Systems for Unclassified Civilian

Research, GAO/AIMD-00-140, June 9, 2000.

Scope and

Methodology
Page 18 GAO-01-806 Nuclear Security

As arranged with your office, unless you publicly announce its contents

earlier, we plan no further distribution of this report until 10 days after the

date of this letter. At that time, we will send copies of the report to the

Ranking Minority Member, House Committee on Energy and Commerce;

the Secretary of Energy; and the Director, Office of Management and

Budget. We will also make copies available to others on request.

If you or your staff have any questions about this report, please call me at

(202) 512-3841. Major contributors to this report were William Fenzel,

Kenneth E. Lightner, Jr., Ilene Pollack, and Susan W. Irwin.

Sincerely yours,

(Ms.) Gary L. Jones

Director, Natural Resources

and Environment
Appendix I: Comments From the Department

of Energy

Page 19 GAO-01-806 Nuclear Security

Appendix I: Comments From the Department

of Energy

Note: GAO comments

supplementing those in

the report text appear at

the end of this appendix.

See comment 1.
Appendix I: Comments From the Department

of Energy

Page 20 GAO-01-806 Nuclear Security
Appendix I: Comments From the Department

of Energy

Page 21 GAO-01-806 Nuclear Security

See comment 3.

See comment 2.
Appendix I: Comments From the Department

of Energy

Page 22 GAO-01-806 Nuclear Security

See comment 7.

See comment 6.

See comment 5.

See comment 4.
Appendix I: Comments From the Department

of Energy

Page 23 GAO-01-806 Nuclear Security

See comment 10.

See comments 2 and 3.

See comment 9.

See comment 9.

See comment 8.
Appendix I: Comments From the Department

of Energy

Page 24 GAO-01-806 Nuclear Security
Appendix I: Comments From the Department

of Energy

Page 25 GAO-01-806 Nuclear Security

The following are GAO’s comments on the letter dated August 13, 2001,

from the Director, Office of Security and Emergency Operations.

1. We recognize that our recommendation, if implemented, would result

in additional policies and requirements. Compliance with these

additional policies and requirements could result in changes in

operations in some organizations, but other organizations’ current

operating procedures would comply without significant changes.

These inconsistencies are the reason additional guidance is necessary.

While additional guidance may go beyond what is required in other

agencies, given the nature of the classified information held by DOE

and its contractors and the consequences that could result from its

unauthorized release, we believe additional guidance is necessary. This

view is also held by DOE’s own Office of Independent Oversight and

Performance Assurance. In a June 2000 report, the Office stated: “The

current national requirements for controlling classified matter are not

as stringent and clear as needed in light of DOE’s particularly sensitive

nuclear-weapons-related information; improvements in policy are

needed to further enhance security at DOE sites.”

2. As we noted on page 16 of this report, we recognize that blanket need

to know may be warranted in certain cases. We are concerned,

however, that DOE has no guidance or criteria for judging when that

blanket need to know is appropriate or how it should be documented.

3. We believe that DOE has misinterpreted our views of the laboratories’

implementation of DOE’s need-to-know requirements. We have

clarified the wording of our recommendation. We are recommending

that DOE provide guidance on documenting need-to-know

determinations. As the guidance is currently implemented, in many

cases, the lack of documentation makes it impossible to determine

(1) the basis for granting need to know, (2) the specific information for

which access was granted, and (3) the time period for which access

was granted. The flexibility that DOE says it requires would not be

limited by a requirement to document the basis and nature of the needto-know determination. Such documentation would allow, and better

justify, granting need to know in the wide range of activities conducted

at DOE’s laboratories.

4. By nature, blanket need to know lacks specific determinations for

individual access. The Los Alamos National Laboratory’s criteria for

using blanket need to know specifically states that blanket need to

GAO Comments
Appendix I: Comments From the Department

of Energy

Page 26 GAO-01-806 Nuclear Security

know is granted to “all program staff” for “all project-related classified

matter at any time.” Los Alamos National Laboratory does not

document the specific justification for each individual included in a

blanket need to know.

5. The DOE Classified Information Systems Security Manual contains a

requirement for annual revalidation of classified computer system

accounts by verifying the user’s phone number, address, and sponsor.

There is no requirement to revalidate the user’s need to know. In fact,

the manual provides for removing the user’s account only when the

user leaves the organization or loses access to the system “for cause.”

In practice, we found that access to the classified computer system

discussed on page 9—once granted—remained valid until the

employee transferred or was terminated, or someone made a

determination that the employee should no longer have access.

6. As we noted on page 16 of this report, the requirement for control

stations in conjunction with the April 2001 reinstitution of

accountability for top secret documents appears to meet the intent of

the recommendation that was contained in our draft report.

Accordingly, we have deleted that recommendation from this report.

7. As suggested, we have modified our statement to change “procedures”

to “requirements.” The question of whether these requirements are

new is a matter of semantics. These security processes were required

prior to 1998 when accountability for top secret matter was no longer

required. They were eliminated in 1998 and were not required again

until April 2001, when most of them were reinstituted. In the sense that

they were not required from 1998 to 2001, they are new requirements.

8. Our statement that in 1998, DOE eliminated procedures for protecting

top secret information is correct. The 1998 and 1999 iterations of the

Classified Matter Protection and Control Manual required

accountability records, inventories, and control stations only for top

secret matter stored outside of “limited areas,” that is, areas with

higher levels of physical protection. All DOE and laboratory areas

storing top secret matter that were included in the scope of our review

were inside limited areas. Reinstituting accountability for top secret

inside limited areas did not occur until April 2001. Therefore, from

1998 until April 2001 accountability records, inventories, and control

stations were not required for top secret information stored inside

limited areas, including the areas that were part of our review.
Appendix I: Comments From the Department

of Energy

Page 27 GAO-01-806 Nuclear Security

9. As noted on page 16 of this report, the use of control stations

combined with DOE’s April 2001 reinstitution of accountability for top

secret information meets the intent of the recommendation that was

contained in our draft report. We have deleted that recommendation.

10. As noted on page 16 of this report, the use of control stations

combined with DOE’s April 2001 reinstitution of accountability for top

secret information meets the intent of the recommendation that was

contained in our draft report. We have deleted that recommendation.

We continue to believe that DOE should conduct an analysis of the

costs and benefits of reinstituting top secret access lists and preapproval for the reproduction of top secret information. These

procedures were required prior to 1998 and are currently used by some

DOE organizations and contractors to control top secret information.

(141488)

The first copy of each GAO report is free. Additional copies of reports are

$2 each. A check or money order should be made out to the

Superintendent of Documents. VISA and MasterCard credit cards are also

accepted.

Orders for 100 or more copies to be mailed to a single address are

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St., NW (corner of 4th and G Sts. NW)

Washington, DC 20013

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and testimony. To

receive facsimile copies of the daily list or any list from the past 30 days,

please call (202) 512-6000 using a touchtone phone. A recorded menu will

provide information on how to obtain these lists.

Orders by Internet

For information on how to access GAO reports on the Internet, send an

e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• E-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs