National Aeronautics and Space Administration 

Office of the Administrator 

Washington, DC 20546-0001 

February 7, 2014 

The Honorable Richard Thornburgh 

Chair 

Panel on Independent Review 

ofNASA's Foreign National Access Management 

National Academy of Public Administration 

1600 K St., NW 

Suite 400 

Washington, DC 2006 

Dear Governor Thornburgh: 

~~.. . ~ ~-

I would like to take the opportunity to thank you and your National Academy of Public 

Administration panel for the thoughtful and thorough review of NASA's Foreign National 

Access Management program. I deeply appreciate the panel's overall recognition ofNASA's 

need to balance the advancement of our missions--which are prescribed by statute and national 

policy to include significant and valuable international involvement--with the protection of our 

sensitive information and technologies. Your recognition of the professionalism ofNASA 

employees and their on-going efforts to improve our security processes is also appreciated. 

NASA is committed to reviewing your recommendations thoroughly and to having them 

inform changes to our existing processes. To that end, I have directed the appropriate NASA 

offices to examine each recommendation and, where appropriate, to incorporate the panel's 

recommendation into our processes or identify any barriers to implementation, including 

resource constraints. The panel identified several broad areas of interest, with associated 

findings and recommendations, which I have addressed below. I would also like to bring to 

your attention those areas where we do not fully concur with the panel's findings. 

Integration of Foreign National Access Management 

Across several findings, the Report recommends the need for a more integrated Foreign 

National Access Management program that consolidates and standardizes various 

components across multiple Agency offices. NASA recognizes the value of a 

consolidated program to provide clear, consistent, and effective direction concerning 

foreign national access management. I have asked the Assistant Administrator for 

Protective Services to work with relevant Headquarters offices and NASA Centers on 

how best to accomplish this integration, with an emphasis on: (1) providing consistent 

guidance, training, and oversight across all NASA Centers; (2) engaging all stakeholders 

in the identification of best practices and creation of operational manuals and materials; 

and (3) incorporating stronger compliance and accountability mechanisms into NASA's 

existing Integrated Center Functional Reviews. 
Information Technology Security 

The panel rightly identifies information technology (IT) security as a major area of 

emphasis. The panel's findings map with the findings of several other groups and 

reports, including by NASA's Inspector General, analyzing the state ofiT security at 

NASA and across the Government as a whole. Based on these assessments, NASA's 

Chief Information Officer (CIO) is already moving to improve security in this area 

overall and the panel's findings will help to further inform these efforts. Specifically, 

the CIO will continue to work toward improvements in areas such as: (1) focusing IT 

security investments in capabilities that will provide a more holistic approach to 

protecting NASA's critical data; (2) developing a cross-functional IT Security and IT 

Operations project team to design and implement a modernized, risk-based solution for 

role-based elevated privileges management and tracking; and (3) implementing a more 

effective approval and maintenance paradigm that will enforce privilege pursuant to 

security requirements. 

Counterintelligence 

The panel identifies several areas in which NASA's counterintelligence process can be 

enhanced in terms of awareness, resources, and coordination. I recognize the need to 

elevate awareness of this important program across the Agency, as well as the benefits of 

an enhanced counterintelligence program with increased integration of 

Counterintelligence Special Agents into Center Operations. I have directed my Assistant 

Administrator for Protective Services to examine the report's findings in this area and to 

develop an educational and awareness program for the Agency. The Assistant 

Administrator has recognized and begun to address the need for additional resources, 

and I have also asked him to analyze the Panel's recommendation that NASA add assets 

in this area and to present his recommendations in the budget planning process. 

While I appreciate the factors underlying the panel's suggestion that reporting of Special 

Agents be realigned to respective Center Directors, I concur with the panel's intent but 

not with the implementation recommendation. NASA's counterintelligence program is 

focused on Agency assets, and by retaining the existing reporting structure, we ensure a 

standardized and consistent program across the Agency. NASA believes the underlying 

factors for the panel's recommendation can be achieved with an increased focus on the 

relationship between counterintelligence personnel and their respective Center 

leadership teams, without eliminating the benefits of the current management approach. 

Export Control 

The panel found that NASA's export control processes could benefit from a more 

systemic and standardized approach, as well as by enhanced awareness of the program 

across the Agency. Accordingly, I have asked the Associate Administrator for 

International and Interagency Relations to review the panel's recommendations, with an 

emphasis on: (I) enhancing and standardizing our training and education for all Centers; 

and (2) exploring stronger compliance and accountability mechanisms. This review will 

include an assessment of additional resources that may be required to successfully 

implement the proposed recommendations. 

2 
3 

Organizational and Functional Relationships 

The panel made a number of observations and findings concerning communication, 

accountability, alignment, and awareness -- all Agency--level areas of emphasis to which 

I am strongly committed. I agree with the panel's focus on the importance of senior 

leadership attention and cross-Agency cooperation to ensure an increasingly effective 

security program. As you know, I am committed to our continuous improvement in this 

area, including by requesting this independent assessment of our operations. I will direct 

all NASA senior leadership to review this important report and, as appropriate, they will 

be involved in the examination and execution of the above-identified actions. I will also 

direct all senior leadership to express regularly to the workforce that security and the 

appropriate management of foreign national access to our facilities, technology, and 

information are critical elements to the successful implementation of our mission. 

Relative to the panel's general findings regarding NASA's culture, specifically about 

Center competition and the panel's suggestion that NASA may have a tendency not to be 

a "learning culture," I would share my view that NASA's culture combines the richness 

of diversity and appropriately healthy competition among our Centers, while fostering an 

overall NASA team environment. I think that the panel understands NASA's 

commitment to this balance. Of course, we must still ensure better consistency, 

alignment, and accountability among all elements of NASA. As a former astronaut and 

leader in NASA's independent safety oversight panel, I have seen NASA continue to 

grow and learn from its past triumphs and tragedies. I expect no less in this area. 

I want to thank you and the panel again for a job well done. The panel's acute level of 

attention to the details of foreign national access management, while recognizing the unique role 

and importance of international engagement to NASA's mission, ensures that this Report will 

make an essential contribution to the Agency's efforts as we continue to move forward to open 

frontiers, reach new heights, partner with international entities to advance our understanding of 

the world, and protect the Nation's investment in our research, technology, and programs. 

Sincerely, 

Charles F. Bolden, Jr. 

Administrator 

cc: 

Joseph P. Mitchell, NAPA Director ofProject Develop 

Joe Thompson, NAPA Project Director