Managing Sensitive Information: Actions Needed to Prevent Unintended Public Disclosures of U.S. Nuclear Sites and Activities
Published: 2009-12-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: On May 7, 2009, the Government Printing Office (GPO) published a 266-page document on its Web site that provided detailed information on civilian nuclear sites, locations, facilities, and activities in the United States. At the request of the Speaker of the House, this report determines (1) which U.S. agencies were responsible for the public release of this information and why the disclosure occurred, and (2) what impact, if any, the release of the information has had on U.S. national security. In performing this work, the Government Accountability Office (GAO) analyzed policies, procedures, and guidance for safeguarding sensitive information and met with officials from four executive branch agencies involved in preparing the document, the White House, the House of Representatives, and GPO.
section_title: What GAO Found
paragraphs: While no single U.S. government agency or office was entirely responsible for the public disclosure of the draft declaration, all of the agencies and offices involved in preparing and publishing the draft declaration share some responsibility for its release. GAO identified several points during the life cycle of the draft document where problems in the process occurred. First, none of the agencies that prepared the draft declaration--the Departments of Energy (DOE) and Commerce, and the Nuclear Regulatory Commission (NRC)--took the added precaution of ensuring that the consolidated draft they helped prepare had a U.S. security designation on each page of the document. Rather, the final version of the document, which they all reviewed, was marked only with the International Atomic Energy Agency's (IAEA) designation--"Highly Confidential Safeguards Sensitive." This marking has no legal significance in the United States. Second, the Department of State, which prepared the draft declaration for transmittal to the White House, sent a transmittal letter to the National Security Council indicating that the contents of the draft declaration should be treated as Sensitive but Unclassified (SBU). Not all federal agencies use this particular marking and, therefore, the marking created confusion for other executive and legislative branch offices that subsequently received the draft declaration on whether the information could be published. Third, the National Security Council, which reviewed the draft declaration on behalf of the White House, did not provide explicit and clear instructions on how to handle the draft declaration to the White House Clerk's Office. Fourth, the legislative branch offices which reviewed and then transmitted the document to GPO for publication--the House of Representatives' Parliamentarian and Clerk's Office--determined incorrectly, in GAO's view, that the document could be published. Officials from these congressional offices were not familiar with the phrase "Sensitive but Unclassified" and did not know how to safeguard that information. Finally, GPO, which proofread and processed the document for publication, did not raise any concerns about the document's sensitivity. GAO believes it is important to correct these problems as soon as possible because the United States is required to submit a declaration to IAEA annually. The public release of the draft declaration of civilian nuclear sites and nuclear facilities does not appear to have damaged national security, according to officials from DOE, NRC, and Commerce. Commerce, DOE, and NRC did not assess the national security implications of the draft declaration's public release because these agencies--plus the Department of Defense--had reviewed the list of civilian nuclear facilities and related activities prior to transmitting it to the White House and Congress to ensure that information of direct national security significance was not included. Information in the draft declaration was limited to civilian nuclear activities, and most nuclear-related information was publicly available on agency Web sites or other publicly available documents. However, according to officials from all of the agencies responsible for compiling this information, the information consolidated in one document made it sensitive and, thus, it should never have been posted to GPO's Web site.

section_title: Letter
paragraphs: On May 7, 2009, the Government Printing Office (GPO) published a 266- page document on its Web site that provided detailed information on  civilian nuclear sites, locations, facilities, and activities in the United  States. The document described, among other things, nuclear activities at  Department of Energy (DOE) facilities such as Los Alamos, Lawrence  Livermore, and Oak Ridge National Laboratories. The document also  included 14 diagrams of buildings or facilities, 2 of which were marked  Official Use Only (OUO). For example, the document provided the  building and vault numbers where highly enriched uranium is stored at the  Y-12 nuclear production facility near Oak Ridge National Laboratory, as  well as a diagram showing the layout of the part of the building where the  material is stored. According to DOE officials, this information was  sensitive because it identified the specific building and vault number, but  no classified information was revealed because the diagram does not show  a map of the entire Y-12 facility and information about the storage area at  Y-12 was already publicly available.
The document was a draft of a declaration being prepared pursuant to an  agreement known as the Additional Protocol with IAEA. The declaration  supplements information provided pursuant to the U.S. Safeguards  Agreement with IAEA by providing IAEA with a broader range of  information on U.S. nuclear and nuclear-related activities. Safeguards  allow IAEA to independently verify that quantities of nuclear material  declared to the agency have not been diverted for nuclear weapons uses.  The Additional Protocol allows IAEA to, among other things, access  locations containing nuclear material declared by a country. Within the  United States, the Additional Protocol allows IAEA to access a selected  number of facilities and locations containing nuclear material.
This was the first time the United States had prepared and submitted a  declaration to IAEA, and the United States will now be required to submit  a declaration to IAEA every year. Sixty days before sending the  declaration to IAEA, the President is required to send the draft declaration  to Congress. Congress had received the first draft declaration on May 5,  2009. On June 1, 2009, the Federation of American Scientists, a nonprofit  group that reports on scientific and technological security issues,  discovered the draft declaration on GPO’s Web site and posted it on the  Federation’s Web site. On June 2, 2009, multiple media outlets began  reporting that the U.S. government had “accidentally” and “mistakenly”  posted a list of nuclear sites and a description of their nuclear activities on  GPO’s Web site. For example, The New York Times reported that a  security official found the disclosure of the draft declaration “a one-stop  shop for information on U.S. nuclear programs.” In response to media  inquiries, GPO temporarily removed the document from its Web site, and  after consulting with the Clerk of the House of Representatives,  permanently did so.
In addition to posting the draft report on its Web site, GPO printed over  900 copies of the document and shipped about 240 copies to Congress and  some federal agencies. GPO recalled these copies and, as of December 2,  2009, around 670 copies were secured in a safe in its security office.  However, it is possible that copies were downloaded from various Web  sites. The location of any such downloaded copies is unknown and cannot  be accounted for. As of October 2009, copies of the document could still  be found on a number of Web sites. We brought this matter to the  attention of State officials and provided them with internet addresses for  two such sites in late October 2009. A State official subsequently informed  us that the department was able to get at least one Web site to remove the  information.
The disclosure of sensitive information on U.S. nuclear facilities and  activities raises concerns about procedures to properly handle and  safeguard such sensitive information. In this context, you asked us to  determine (1) which U.S. agencies were responsible for the public release  of this information and why the disclosure occurred, and (2) what impact,  if any, the release of the information has had on U.S. national security.
To determine which U.S. agencies were responsible for the disclosure and  why the disclosure occurred, we analyzed the policies, procedures, and  guidance for safeguarding sensitive information from the departments of  Energy and State; the Nuclear Regulatory Commission (NRC); the House  of Representatives Clerk’s Office; and GPO. We also reviewed transmittal  sheets prepared by DOE, State, the House of Representatives’ Clerk’s  Office, and GPO to determine how the document was marked for security  purposes as it was distributed and prepared for publication. In addition, to  determine how each of these agencies and offices safeguarded and  transmitted the document, we interviewed officials from DOE; Commerce;  State; NRC; GPO (including the Inspector General’s office); and the Clerk’s  Office, Security Office, and the Office of the Parliamentarian in the House  of Representatives. In addition, we asked to meet with the officials from  the White House National Security Council and Executive Clerk’s Office  who had handled and transmitted the draft declaration to Congress so that  we could obtain information directly from the individuals responsible for  reviewing and handling the document. The White House declined to make  these individuals available to us; instead, attorneys from the White House  Counsel’s office met with those individuals and then conveyed information  to us.  To determine what impact the release of the information has had on  U.S. national security interests, we reviewed the draft declaration to  identify potentially sensitive nuclear sites and activities and then  interviewed officials from DOE, Commerce, State, and NRC to determine  whether any information of direct national security significance was  compromised and whether these departments took any actions to enhance  security at the declared sites, locations, and facilities.
We conducted our work between June 2009 and November 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: Under its Safeguards Agreement with IAEA, the United States submitted a  list of civilian nuclear facilities—primarily civilian nuclear power reactors.  The Additional Protocol, a separate agreement between the United States  and IAEA, supplements the United States’ Safeguards Agreement with  IAEA. Under the Additional Protocol, the United States must provide  IAEA with a broader range of civilian nuclear and nuclear-related  information than that required under the Safeguards Agreement, such as  the manufacturing of key nuclear-related equipment; research and  development activities related to the nuclear fuel cycle; the use and  contents of buildings on a nuclear site; and exports of IAEA-specified,  sensitive nuclear-related equipment. The United States must also provide  IAEA with access, through on-site inspections, to resolve questions  relating to the accuracy and completeness of the information. As a nuclear  weapon state party to the Treaty on the Non-Proliferation of Nuclear  Weapons, the United States is not obligated by the Treaty to accept IAEA  safeguards or to implement an Additional Protocol. However, according to  U.S. officials, voluntarily adopting the Additional Protocol underscores  U.S support for IAEA’s strengthened safeguards system and makes efforts  to encourage more countries to adopt the Additional Protocol more  effective and credible.
In its act implementing the Additional Protocol, Congress prohibited the  inclusion of certain information: any classified information; any  information that would be deemed restricted data under the Atomic  Energy Act; and any information of direct national security significance  regarding any location, site, or facility associated with activities of the  Department of Defense or DOE. The act also provided that information  collected for the purposes of the Additional Protocol would be exempt  from disclosure under 5 U.S.C. § 552, which is the Freedom of Information  Act. Figure 1 shows a timeline of the U.S. implementation of the Additional  Protocol.
The U.S. government classifies information that it determines could  damage the national security of the United States if disclosed publicly.  Beginning in 1940, classified national defense and foreign relations  information has been created, handled, and safeguarded in accordance  with a series of executive orders. Executive Order 12958, Classified  National Security Information, as amended, is the most recent. It  demarcates different security classification levels, the unauthorized  disclosure of which could reasonably be expected to cause exceptionally  grave damage (Top Secret), serious damage (Secret), or damage  (Confidential).
Federal agencies also place dissemination restrictions on certain  unclassified information. Federal agencies use many different designations  to identify this type of information. For example, DOE uses the designation  OUO, while State uses SBU. According to a May 2009 presidential  memorandum, there are more than 107 unique markings and over 130  different labeling or handling processes and procedures for documents that  are unclassified, but are considered sensitive. For example, according to  DOE officials, although OUO information is less sensitive than classified  information, OUO information may be shared with people lacking security  clearances provided that officials determine they have a “need to know.”  These restrictions are used to indicate that the information, if disseminated  to the public or persons who do not need such information to perform their  jobs, may cause foreseeable harm to protected governmental, commercial,  or privacy interests. Such information includes, for example, sensitive  personnel information, such as Social Security numbers and the floor plans  for some federal buildings. It may also include information exempted from  disclosure under the Freedom of Information Act.
section_title: Each of the Federal Agencies and Offices Involved in Preparing and Publishing the Draft Declaration Shares Some Responsibility for Its Release to the Public
paragraphs: While no single U.S. government agency or office was entirely responsible  for the public disclosure of the draft declaration, all of the agencies and  offices involved in preparing and publishing the draft declaration share  some responsibility for its public release. We identified several points  during the life cycle of the draft document where problems occurred.  Specifically, we found that opportunities to improve the secure handling of  the document were missed because of the absence of clear interagency  guidance, different procedures across the agencies governing the handling  and marking of sensitive documents, poor decision making, and a lack of  training and adequate security awareness. These missed opportunities  occurred between February 2008 and May 2009. Several U.S. government  agencies played key roles in preparing and making important decisions  regarding the publication of the draft declaration: DOE, Commerce, State,  NRC, the White House (the National Security Council and Executive  Clerk’s Office), the U.S. House of Representatives (Office of the  Parliamentarian, Office of Security, and the Clerk’s Office), and GPO.  Figure 2 is a two-page summary of key dates and events that occurred  during the life cycle of the draft declaration, leading up to its inadvertent  public release on May 7, 2009.
subsections: section_title: DOE, NRC, and Commerce Began Collecting Information on Civilian Nuclear Sites to Be Included in the Draft Declaration in Early 2008
paragraphs: After the President signed an executive order in February 2008 to  implement the Additional Protocol, DOE, Commerce, and NRC began  collecting information on nuclear sites, facilities, and activities to be  included in the draft declaration. DOE collected information from national  laboratories and nuclear weapons production facilities. NRC, which  regulates the civilian use of nuclear materials, collected information from  NRC-licensed nuclear facilities, including four civilian nuclear power  plants previously selected by IAEA for the application of safeguards. DOE  and NRC provided nuclear-related information to Commerce on January  15, 2009, and March 18, 2009, respectively. Commerce collected  information from private nuclear-related industries not regulated by DOE  or NRC, such as the location, operational status, and production capacity  of conventional uranium mines. Commerce then consolidated all nuclear- related information from its offices, as well as from DOE and NRC, into a  draft U.S. declaration for final interagency approval and transmittal to  State. The process for collecting and consolidating this information from  the three agencies took several months.
Commerce, in consolidating and formatting the information in the draft  declaration, did not mark the document with an official U.S. government  security marking. The only marking on the draft declaration was IAEA’s  designation on the top of the document—“Highly Confidential Safeguards  Sensitive”—which has no legal significance in the United States. To  consolidate and properly format the information, Commerce established  and managed a central database, known as the U.S. Additional Protocol  Reporting System (APRS). IAEA provided a software program for this  database that standardizes the information sent to IAEA by each member  state and helps IAEA assess the completeness of the information. Before  transmitting data to Commerce or adding data to the APRS, each agency  reviewed the information it collected for accuracy, data consistency, and  national security concerns. Each agency also reviewed the information to  ensure that no classified information was being disclosed. The agencies  had agreed that the information in the U.S. declaration would not be  classified, as required by the U.S. Additional Protocol Implementation Act;  that an unclassified database could be used to process the information;  and that the data were sensitive and would be restricted to authorized  personnel only.
When Commerce and NRC added information to APRS, IAEA-supplied  software automatically marked the top of each page of the draft  declaration as “Highly Confidential Safeguards Sensitive.” IAEA uses this  designation to ensure the document’s appropriate handling and control.  According to IAEA officials, Highly Confidential Safeguards Sensitive  information is the agency’s highest classification level. This type of  information, if released, could cause grave damage to IAEA interests.  When IAEA receives a document from a country with this classification, it  cannot publicly disclose the information in the document because, in some  instances, its release could disclose confidential business information,  create potential security issues, or identify reporting discrepancies  between countries. Distribution of this information is limited and released  on a need-to-know basis. Since this IAEA marking has no legal significance  in the United States, DOE, Commerce, and NRC treated the information as  OUO. These agencies use OUO markings to provide a warning that  information in a document is sensitive and is generally only to be released  to those with a need to know, regardless of their security clearance.
DOE, NRC, and Commerce took steps to safeguard the information that  each contributed to the draft declaration. Specifically, before DOE and  NRC submitted data to Commerce in January and March 2009,  respectively:    DOE marked the top and bottom of each page it submitted to Commerce  with nuclear information from the national laboratories and production  facilities as OUO and added a statement that the information may be  exempt from public release under the Freedom of Information Act.
NRC officials hand carried a compact disc containing its nuclear-related  information to Commerce, rather than electronically sending the  information.
Commerce officials also safeguarded the information by password  protecting APRS and sending State the draft declaration through secure e- mail that included a transmittal letter explaining that the contents were  considered OUO. In addition, they hand carried a compact disc to State  that was marked with “For Official Use Only/Not For Public Release/IAEA  Highly Confidential Safeguards Protected” hand written on the disc.
Although each agency designated the information it contributed as OUO,  the document—which was produced from each agency’s contributions— did not have any U.S. government security markings.  The agencies  reviewed the draft declaration multiple times, but no agency marked the  pages containing information it had contributed to the full draft  declaration as OUO. Once all the information was consolidated, the 266- page document was not marked OUO or any other security designation  recognized in the United States that would have clearly indicated that the  data were sensitive, restricted to authorized personnel only, and not  releasable to the public. The only OUO markings were next to site  diagrams of two DOE facilities found on two different pages of the draft  declaration.
According to Commerce officials, while the IAEA software template  automatically adds the IAEA designation, it does not add a U.S. security  designation to the top and bottom of each page and does not allow  Commerce to modify the IAEA designation or add U.S. security markings.  They stated that the only way to mark the draft document as OUO would  have been to print out each page, stamp the U.S. designation by hand, and  then scan the document back in as a new electronic file. Furthermore,  according to DOE officials, the agencies wanted to submit a draft  declaration to Congress that was identical to the final declaration  submitted to IAEA. Providing Congress with a draft declaration that had  both the IAEA and U.S. security markings would not have been an exact  representation of the declaration sent to IAEA. However, there were no  requirements in the U.S. Additional Protocol Implementation Act binding  U.S. agencies to submit a declaration free of any additional U.S. security  markings.
Even after Commerce circulated the draft declaration to DOE, NRC, and  the Department of Defense for a final interagency review in late March  2009 to ensure no information of national security significance was  included in the draft before submission to State, agency officials did not  raise any concerns about the draft declaration’s lack of a U.S. security  designation. According to DOE, Commerce, and NRC officials, they  assumed that the draft declaration would never be publicly released and  that, once delivered to IAEA, it would be properly safeguarded. As a result,  they saw no need to add an additional U.S. government security marking.
section_title: In Mid-April 2009, Commerce Sent the Draft Declaration to State for Transmittal to the White House
paragraphs: Commerce sent the consolidated draft declaration to State on April 17,  2009. State prepared the draft declaration for transmittal to the White  House. In completing the draft declaration for transmittal, State prepared a  letter to the National Security Council asking it to treat the contents of the  draft declaration as SBU. Unlike DOE, Commerce, and NRC, State does  not use the OUO designation, but rather the SBU designation. State’s  guidance governing the use and handling of SBU documents is similar to  that of the other agencies for handling OUO. State also prepared a draft  message from the President to Congress that would accompany the draft  declaration. In describing the purpose and contents of the document and  the classification level of the information, State wrote in the draft  presidential message, “the IAEA classification of the enclosed declaration  is ‘Highly Confidential Safeguards Sensitive’; however, the United States  regards this information as ‘Sensitive but Unclassified’.” The two-page  transmittal letter described the contents of the draft declaration and the  top and bottom was clearly marked SBU, accompanied by a footnote  explaining that the draft declaration was exempt from disclosure under  the Freedom of Information Act.
State completed its review of the draft declaration and accompanying  transmittal documentation in mid-April 2009 and sent the “package” to the  Executive Secretary of the National Security Council on April 30, 2009.
section_title: The White House’s National Security Council and Executive Clerk’s Office Did Not Provide Explicit and Clear Instructions on How to Safeguard the Draft Declaration When It Sent the Document to Congress
paragraphs: In early May 2009, the National Security Council completed its review of  the draft declaration and presidential message and provided the  documents to the Executive Clerk of the White House for transmission to  Congress. The National Security Council, which reviewed these  documents on behalf of the White House, did not add explicit and clear  instructions in the presidential message on how to handle the draft  declaration, such as whether or not it should be published, when it sent  the documents to the White House Clerk’s Office, which transmitted the  documents to Congress. The National Security Council also did not  include a transmittal letter, as other executive branch agencies had, with  instructions on how to handle the draft declaration. Attorneys from the  Office of the White House Counsel provided two reasons why the National  Security Council did not feel it was necessary to take these additional  measures to protect the document from disclosure. First, counsel stated  that they did not think Congress would publish the report and the National  Security Council and the Executive Clerk’s Office followed their standard  practice for transmitting unclassified documents, which does not involve  using a transmittal letter or modifying text in the presidential message.  However, attorneys from the Office of the White House Counsel did not  provide us with any written guidance on how these offices usually handle  documents that are unclassified, but are considered sensitive, such as  those marked SBU, and should not be publicly released. In addition,  attorneys from the Office of the White House Counsel told us that the  Executive Clerk’s Office does not have written guidance on how it  transmits documents to Congress. Second, counsel pointed out that the  draft declaration was an unusual and unique document because it was the  first time that the United States had prepared a draft declaration and  submitted it to Congress. “The IAEA classification of the enclosed declaration is ‘Highly Confidential Safeguards  Sensitive;’ however, the United States regards this information as ‘Sensitive but  Unclassified.’ Nonetheless, under Public Law 109-401, information reported to, or  otherwise acquired by, the United States Government under this title or under the U.S.- IAEA Additional Protocol shall be exempt from disclosure under section 552 of title 5,  United States Code.”
The language in the presidential message prepared by State and used by  the National Security Council did not clearly and explicitly state that the  information was not to be published, and the additional legal citations did  not clarify how to handle the document.
According to attorneys from the Office of the White House Counsel, the  White House clerks who transmitted the document to Congress read the  presidential message and noticed its reference to the draft declaration as  SBU. However, while the White House clerks have security clearances and  have received training on how to handle unclassified, sensitive, and  classified documents, they do not normally see SBU documents and did  not have the authority or responsibility to determine whether Congress  could print the document. Attorneys from the Office of the White House  Counsel told us the draft declaration was an unusual and unique document  because of the IAEA classification markings and the reference to the  information as SBU.
The White House clerks transmit only unclassified documents. The  National Security Council does not transmit documents that cannot be  printed, such as classified documents, to the White House clerks. Instead,  the National Security Council transmits those documents directly to  congressional committee staff with the appropriate clearances. Because  the clerks received the draft declaration from the National Security  Council, the clerks transmitted the presidential message and the draft  declaration to Congress just as they had received it from the National  Security Council—without a transmittal sheet or SBU markings on the top  or bottom of any page.
section_title: Congressional Offices That Reviewed and Transmitted the Draft Declaration Determined Incorrectly That the Document Could be Published
paragraphs: Congressional offices that reviewed and then transmitted the draft  declaration to GPO for publication—the House of Representatives’ Office  of the Parliamentarian and Clerk’s Office—determined, incorrectly in our  view, that the document could be published. The draft declaration passed  through several congressional offices. First, on May 5, 2009, the Executive  Clerk of the White House formally delivered the presidential message and  draft declaration while the House was in session. The Parliamentarian  read the presidential message and decided the message should be referred  to the House Committee on Foreign Affairs and ordered it printed as a  House of Representatives document. The Parliamentarian told us that  while he received security training on classification issues, he did not  recall ever seeing a presidential message that just mentioned the SBU  designation and did not know how that type of information should be  safeguarded. The Parliamentarian believed that the draft declaration could  be published because it was unclassified. According to the  Parliamentarian, sensitive and classified messages and documents are  usually not delivered to the floor of the House, but rather are transmitted  by secure courier and referred directly to the appropriate committee for  handling and storage. In addition, while the Parliamentarian read the  presidential message—the one-page message from the President to  Congress that described the purpose and contents of the draft  declaration—he did not read the draft declaration, which listed U.S.  civilian nuclear sites and activities. Staff in the Office of the  Parliamentarian do not routinely read enclosures accompanying a  presidential message, according to the House Parliamentarian.
Second, the Office of the Parliamentarian gave the document to the House  of Representatives’ Clerk’s Office to process it for referral to the House  Committee on Foreign Affairs and prepare it for transmission to and  publication by GPO. After reading the President’s message and seeing the  IAEA markings on the draft declaration, the Executive Communications  Clerk, who works in the Clerk’s Office, told us she was confused about the  classification level of the document and whether it could be published. As  a result, the Clerk locked the document in a safe while she sought  clarification and guidance from the following sources before sending the  draft declaration to GPO for publication:    The Journal Clerk in the House of Representatives’ Legislative  Operations Office. On May 5, 2009, this clerk had received the documents  from the Office of the Parliamentarian and stamped the documents  acknowledging receipt from the White House before providing the  documents to the Executive Communications Clerk. According to the  Executive Communications Clerk, the Journal Clerk told her she could  print the document because it was unclassified.
The House of Representatives’ Security Office. The Security Office  Director reviewed the document on May 5, 2009, but did not take custody  of it or make inquiries on its proper handling and safeguarding. Instead,  the Security Office Director told the Executive Communications Clerk to  obtain clarification from IAEA—incorrectly assuming that IAEA was the  classifier of the document—and the White House Clerk’s Office. The  Security Office stated that it was not required to take custody of the  document and the Executive Communications Clerk did not request that  the Security Office store the document or help her in contacting the  agencies and offices that transmitted the document.  However, the  Security Office did not raise concerns with the House Clerk’s Office about  publicly releasing 266 pages of information on U.S. nuclear sites and  activities and, in our view, missed an opportunity to be more directly  involved in ensuring that the document was not publicly released without  explicit authorization from the agencies that designated the information as  SBU.
An IAEA official located in New York. According to the Executive  Communications Clerk, this official told her on May 5, 2009, that IAEA  member states have discretion on how to treat information provided to  IAEA and publication of the declaration is a decision left to each member  state. In July 2009, we interviewed IAEA officials in the Department of  Safeguards in Vienna, Austria. This department is responsible for  reviewing all Additional Protocol agreements between the agency and  member states. These officials told us that the Executive Communications  Clerk received correct information from IAEA’s New York office, but the  appropriate inquiry should have been directed to their office in Vienna.
The White House Clerk’s Office. The White House Clerk’s Office and the  Executive Communications Clerk disagreed in their recollections of the  advice the White House clerk provided to the House of Representatives.  According to attorneys from the Office of the White House Counsel, the  White House Clerk’s office told the Executive Communications Clerk that  the document was unclassified but did not make a legal judgment or  provide any advice on whether the document should be printed. However,  according to the Executive Communications Clerk, the White House  Clerk’s office referred her to the penultimate paragraph in the presidential  message stating that the United States regards the information as SBU as  justification for printing the document. According to the Executive  Communications Clerk, the White House Clerk’s justification for going  forward with the printing was that the document was unclassified.
On the basis of advice from these various offices, on May 6, 2009, the  Executive Communications Clerk ordered GPO to print the presidential  message and the draft declaration.
section_title: GPO Did Not Raise Concerns about Publishing the Draft Declaration
paragraphs: GPO, which edited and processed the document for publication, did not  raise any concerns about the document’s sensitivity. On May 6, 2009, GPO  received a request from the House of Representatives’ Executive  Communications Clerk to print the presidential message and draft  declaration by 7:00 a.m. on May 7, 2009. The transmittal page from the  Clerk did not include any special handling instructions and ordered the  documents to be printed. The presidential message, which contained the  language that the contents of the draft declaration should be treated as  SBU, was typeset and proofread twice by GPO production employees.  According to an August 2009 GPO Inspector General’s report, GPO  production employees are not required to read and proof for meaning, but  merely to check for proper characters and format. The 266-page draft  declaration was digitally scanned, rather than typed and proofread. While  “Highly Confidential Safeguards Sensitive” was marked on nearly every  page of the draft declaration, the GPO Inspector General found that no  GPO employees raised any concerns during the processing of the  document. According to the GPO Inspector General’s report, GPO  employees who reviewed the scanned copy looked for page numbers and  format, without proofreading or reviewing the document text or markings.
GPO officials told us that GPO rarely prints sensitive or classified  documents. They told us that GPO relies on its customers to identify  sensitive documents and notify it of special instructions, given the high  volume of print requests. However, the August 2009 GPO Inspector  General’s report found that GPO does not have procedures for identifying  potentially sensitive documents and safeguarding them. In addition, most  employees had not received education or training for recognizing or  identifying sensitive documents or information.
Although the GPO Inspector General found no wrongdoing on the part of  GPO or its employees, it made several recommendations to improve GPO’s  process for handling sensitive information and preventing the inadvertent  disclosure of such information in the future. These recommendations  included    establishing a protocol with customer agencies on clearly identifying  sensitive information that may be published and developing written  procedures for handling such information;    establishing written procedures for verifying any requests for publishing  documents that are clearly identified or marked as being of a sensitive or  otherwise restricted nature;    updating GPO guidance to define “sensitive information” and how to  specifically recognize, mark, and safeguard such information; and    developing and conducting ongoing training of GPO employees on how to  recognize, handle, and safeguard sensitive information and documents.
During the course of our review, officials from several of the federal  agencies and offices told us that it would be helpful if there was a  standardized marking system for documents that are sensitive but are  unclassified. In fact, the term sensitive but unclassified was very confusing  for several officials who handled the draft declaration. To help clarify, a  May 2008 presidential memorandum had adopted the phrase “Controlled  Unclassified Information” (CUI) as a single designation for all information  previously labeled SBU or with another similar marking. This  memorandum also charged the National Archives and Records  Administration with implementing a framework for CUI terrorism-related  information, which is not expected to be in place until 2013. Despite these  efforts, a May 27, 2009, presidential memorandum found that there is still  no uniformity across federal agencies on rules to implement safeguards for  information that is deemed SBU. The memorandum noted that agencies  use SBU as a designation for federal government documents and  information that are sufficiently sensitive to warrant some level of  protection, but that do not meet the standards for national security  classification. With each agency implementing its own protections for  categorizing and handling SBU material, the memorandum stated that  there are more than 107 unique markings and over 130 different labeling or  handling processes and procedures for SBU information. The 2009  memorandum directed the creation of a Task Force to review agencies’  current procedures for categorizing and sharing SBU information, to track  the progress federal agencies are making to implement the framework for  CUI terrorism-related information, and to recommend whether the CUI  framework should be extended to apply to all SBU information.
section_title: Public Release of Draft Declaration Does Not Appear to Have Harmed National Security, According to DOE, NRC, and Commerce Officials
paragraphs: The inadvertent public release of the draft declaration of civilian nuclear  sites and nuclear facilities does not appear to have damaged national  security, according to officials from DOE, NRC, and Commerce.  Information in the draft declaration was limited to civilian nuclear  activities, and most nuclear-related information was publicly available on  agency Web sites or in other published documents, according to officials  from the three agencies. However, officials from all of the agencies that  compiled this information told us the information—all of which was  considered unclassified—was sensitive because it was consolidated into  one document and should never have been posted to GPO’s Web site.  Commerce, DOE, and NRC did not formally assess the impact of the public  release of the information on U.S. national security. According to DOE,  NRC, and Commerce officials, it was not necessary to do so because the  agencies reviewed the list of civilian nuclear facilities and related activities  on multiple occasions to ensure that no information of direct national  security significance was included and that no classified information was  contained in the declaration prior to transmitting it to the White House  and Congress.
subsections: section_title: Consolidated List of Civilian Nuclear Facilities and Activities Contained in the Draft Declaration Is Considered Sensitive and Was Never Meant to be Made Public
paragraphs: According to U.S. government officials, the draft declaration in totality  represents a consolidated list of hundreds of U.S. civilian nuclear facilities  and activities that never should have been publicly released. These  officials asserted that it could be potentially problematic if such a  consolidated list of facilities and activities found its way into the hands of  individuals who had malicious or malevolent intentions. For example,  agency officials told us, in several instances, the draft declaration  contained maps showing detailed diagrams of civilian reactor facilities or  buildings storing nuclear materials at national laboratories.
The draft declaration included 14 diagrams of buildings or facilities, 2 of  which were marked OUO. For example, the declaration provided the  building and vault numbers where highly enriched uranium is stored at the  Y-12 nuclear production facility, as well as a diagram showing the layout of  the part of the building where the material is stored. According to DOE  officials, this information was sensitive because it identified the specific  building and vault number, but no classified information was revealed  because the diagram does not show a map of the entire Y-12 facility and  the specific location of a vault at the Y-12 complex. Of the other 12  diagrams, 1 was of a plutonium oxide storage area at DOE’s Savannah  River site and 11 were of civilian nuclear facilities. The pages containing  these diagrams did not have any markings: Highly Confidential Safeguards  Sensitive, OUO, or any other U.S. designation.
The 11 diagrams of civilian nuclear facilities accompanied information on  8 NRC licensed commercial sites—4 reactors and 4 fuel fabrication  facilities. For example, the draft declaration included a site map of the  Turkey Point reactor in Florida and a diagram identifying the building  where spent fuel is stored. According to NRC officials, the information and  diagrams related to the facilities in the draft declaration are not classified  because they do not specify the quantities and types of nuclear materials  held at these facilities. However, the information is sensitive because it  includes commercially sensitive data, such as the actual annual  production, rather than the more general and publicly available  information on how much material the facility is licensed to produce.
According to DOE and State officials, the release of the information could  be problematic for the United States because other countries could  scrutinize the completeness and accuracy of the information and  potentially pressure IAEA to do more rigorous inspections of the facilities  listed. Inspections of nuclear facilities with nuclear materials and nuclear- related activities are the cornerstone of IAEA’s data collection efforts and  provide the ability to independently verify information in countries’  Additional Protocol declarations. Potential pressure to conduct more  comprehensive inspections of U.S. facilities could divert time and  resources from more rigorous inspections in countries and facilities of  proliferation concern, such as Iran or Syria.
section_title: Agencies Did Not Assess National Security Implications of Disclosure of Draft Declaration
paragraphs: Commerce, DOE, State, and NRC did not undertake any assessments after  the draft declaration was released to determine its impact on U.S. national  security. According to officials from these agencies, no such assessment  was necessary because all of the agencies involved in the development of  the draft declaration (as well as the Department of Defense) had fully  reviewed the consolidated list of civilian nuclear facilities and related  activities on multiple occasions to ensure that no information of direct  national security significance was included and that no classified  information was contained in the declaration prior to transmitting it to the  White House and Congress.
DOE, which provided most of the information in the draft declaration, had  three separate levels of security review and approvals for the information  it submitted for the document. First, the national laboratories’  counterintelligence, export controls, and security offices reviewed the  information submitted for the declaration. Second, the national  laboratories’ site managers reviewed the information, and each site  manager certified to DOE that the national laboratory had completed  vulnerability assessments on the national security impact of releasing the  information to IAEA and that the facilities were ready for IAEA  inspections. Finally, program managers and security officers at DOE  headquarters reviewed the contents. According to DOE officials, at all  levels of review, officials from the national laboratories and DOE  concluded that no information detrimental to national security was  included in the document. NRC and Commerce reported information  about facilities’ activities and locations that was mostly, if not all, publicly  available. State obtained additional confirmation from DOE, Commerce,  NRC, and the Department of Defense that the draft declaration contained  no classified or national security information before sending it to the  White House.
According to agency officials, there was no requirement to conduct a  formal assessment of any possible security concerns arising from the  declaration’s publication because classified information was not released.  A formal assessment is required only if there is a release of information  that could harm U.S. national security. DOE and NRC did seek assurances  after the release of the draft declaration from officials at the national  laboratories and civilian nuclear facilities that physical security at those  locations was sufficient. DOE asked the national laboratories to review  their security procedures and ensure that the facilities were secure. Based  on these assessments, DOE officials told us they did not increase security  at any site. NRC contacted every NRC licensee and agreement states with  licensees included in the draft declaration to notify them of the disclosure  of information. Agreement states notified their affected licensees. NRC  and agreement states’ licensees reviewed their security procedures to  make sure there were no vulnerabilities. According to NRC, the only NRC  facility to express concern was Turkey Point in Florida because of its  spent fuel pool. NRC officials told us that the location of this facility was  already publicly disclosed, and satellite images show the building that  houses the spent fuel pool. Turkey Point operators reviewed their security  procedures and determined the procedures they had in place were  sufficient, even with the release of the draft declaration.
section_title: Conclusions
paragraphs: The draft declaration listing civilian nuclear sites and activities under the  terms of the Additional Protocol was the first of its kind prepared by the  United States for IAEA and sent to Congress for review. However, the  draft declaration contained sensitive civilian nuclear information that,  when taken in its totality, needed to be properly handled and safeguarded.  Protecting sensitive information from inadvertent public disclosure is a  critical function of all federal entities that possess, handle, or transmit  such information. Since the United States is required to submit a draft  declaration to Congress and then send the declaration to IAEA every year,  there is an opportunity to address the problems that occurred to ensure  that this inadvertent disclosure does not occur again.
A more systematic, well-coordinated approach by all of the agencies that  handled the draft declaration would have reduced the chances of publicly  releasing sensitive information—particularly if the document had been  clearly identified as not for public release. We found several critical points  where opportunities to improve safeguards over the document were  missed due to: the absence of clear interagency guidance, different  procedures across the agencies governing the handling and marking of  sensitive documents, poor decision making, and the lack of training and  adequate security awareness.
No agency or office that was involved with the production or transmittal  of the draft declaration ensured that the final document was marked with  any U.S. security designation. DOE, NRC, and Commerce marked the  information they submitted for the draft declaration as OUO. However,  none of these agencies took the added precaution of ensuring that the  consolidated draft declaration maintained the OUO designation on each  page of the document once the IAEA marking was placed on the  document. Further contributing to the subsequent confusion over how to  handle the draft declaration was State’s use of the SBU marking. Many  officials focused on the unclassified portion of the marking and  determined, incorrectly in our view, that the document could be made  public. We believe that it would have been a simple matter to clearly state  in the presidential message that the draft declaration was not meant for  public dissemination.
Furthermore, the White House failed to take measures to ensure that the  draft declaration was not published. Attorneys from the Office of the  White House Counsel did not provide us with any written guidance on how  the National Security Council and the Executive Clerk’s Office usually  handle documents that are unclassified, but are considered sensitive, such  as those marked SBU, that should not be publicly released.  However,  counsel did indicate that individuals with the National Security Council  and White House Clerk’s office handled the draft declaration according to  White House practices. In our view, these practices, as best as we  understand them, are not sufficient to prevent similar problems from  occurring in the future.
In addition, legislative branch officials did not properly safeguard the draft  declaration and did not properly handle the information. In particular, we  believe that the House of Representatives Security Office Director should  have been more directly involved in resolving conflicting and confusing  information regarding the classification of the draft declaration.  Conversely, the Executive Communications Clerk is to be commended for  taking actions to do everything in her power—at her level of  responsibility—to pursue the right course of action.
Finally, in our view, GPO officials also share responsibility for the public  disclosure of the draft declaration. Although the August 2009 GPO  Inspector General’s report assigns no wrongdoing to either GPO or its  employees, GPO officials should have had procedures in place to prevent  such a release from occurring. Thus, we agree with the Inspector General’s  proposed recommendations and we encourage GPO to implement them as  expeditiously as possible.
section_title: Recommendations for Executive Action
paragraphs: To ensure that corrective actions are taken to prevent the inadvertent  public disclosure of sensitive information in future draft declarations or  other documents prepared for IAEA by multiple U.S. agencies, we are  making the following four recommendations:    The Secretaries of Commerce, Energy, and State, and the Chairman of the  NRC should enter into an interagency agreement concerning the  designation, marking, and handling of such information, and make any  policy or regulatory changes necessary to reach such an agreement. This  agreement should be revised, as necessary, to take into account future  direction from the President or the Controlled Unclassified Information  Council regarding standardization of the procedures for designating,  marking, and handling documents that are unclassified but are not  intended for public release.
The Secretary of State should clearly indicate in the text whether the  presidential message and attached documents, if any, should be printed  and made publicly available when preparing presidential communications  to Congress for documents to be presented to IAEA.
The Executive Office of the President should consider revising any written  guidance and/or practices it has and conduct staff training for handling  and safeguarding sensitive information in future declarations or other  documents between the United States and IAEA before it needs to issue its  next declaration in May 2010.
GPO’s public printer should implement, as expeditiously as possible, the  recommendations from the agency’s August 2009 Inspector General report  in order to improve the security culture and reduce the possibility of  future postings of sensitive information to the GPO Web site.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOE, State, GPO, NRC, Commerce,  Office of the White House Counsel, and the House of Representatives’  Sergeant at Arms and Offices of the Clerk and Parliamentarian for  comment.  DOE, State, GPO, NRC and the House of Representatives  Sergeant at Arms provided written comments, which are presented in  appendixes I, II, III, IV and V, respectively.  State and the Office of the  White House Counsel provided technical comments which we  incorporated as appropriate. Commerce and the House Offices of the  Clerk and Parliamentarian reviewed, but did not provide comments on our  draft report.
DOE, State, and GPO agreed with our recommendations.  NRC neither  agreed nor disagreed with our recommendations, but did provide technical  comments which we incorporated as appropriate.   In response to our  recommendation involving an interagency agreement to designate, mark,  and handle sensitive information provided to IAEA on U.S. nuclear sites  and activities, DOE noted that the interagency agreement would  specifically address the marking and handling of future draft declarations  and other documents provided to IAEA under U.S. safeguards agreements.   The interagency agreement will not address broader, governmentwide  standards on how to mark and handle all unclassified, but sensitive  information.  These standards will be developed by the Controlled  Unclassified Information Council or other entity designated by the  President.  This is consistent with our recommendation.  As we state in  our report, the interagency agreement should be a corrective action to  prevent the inadvertent public disclosure of sensitive information in future  draft declarations or other documents prepared for IAEA by multiple U.S.  agencies, rather than addressing broader, governmentwide standards on  how to mark and handle all unclassified but sensitive information.
The House of Representatives’ Sergeant at Arms did not comment on our  recommendations but provided three points of clarification regarding the  Office of Security’s role in reviewing and transmitting the draft  declaration.  First, the House Sergeant at Arms stated that, contrary to  what we stated in our draft report, the House Security Office made no  determination as to whether the draft document could be published and  did not provide the House Clerk’s office with any direction or legal advice  regarding this matter.  Second, according to the House Sergeant at Arms,  the House Security Office properly advised the House Clerk’s office to  contact IAEA regarding the handling of the draft document.  Third, the  House Sergeant at Arms stated that the House Security Office did not need  to take control of the draft document, nor was the Security Office  requested to take control of the document.  In addition, the Security Office  does not have the authority to order a House of Representatives office or  entity to store a document with the Security Office.
Regarding the first point, we believe that given the sensitive nature of the  draft document—and commensurate with its role and responsibilities— the House Security Office should have, at a minimum, raised concerns  with the House Clerk’s Office about publicly releasing 266 pages of  information on U.S. nuclear sites and activities and advised the House  Clerk not to print the document without explicit authorization from the  agencies that designated the information SBU.  While we do not dispute  the statement that the House Security Office did not provide any advice or  direction regarding the printing of the document, we believe that it would  have been appropriate for this Office to play a more assertive role because  the House Clerk sought advice and guidance in determining whether the  document could be printed.  However, based on these comments, we  modified the text of the report to reflect the claims made by the House  Security Office.  Specifically, we removed reference to the Security Office  on page 16 to avoid inferences that the Security Office provided direction  or legal advice to the Clerk’s Office that it could print the document.
Regarding the second point, the House Office of Security has  misconstrued what we stated in the draft report.  While there was nothing  inherently wrong with the Office of Security suggesting that the Clerk’s  Office contact IAEA about the document, IAEA did not prepare, transmit,  or mark the document.  As we noted in our report, the U.S. agencies that  prepared the draft declaration placed the IAEA markings on the document.   The presidential message explained that the draft declaration was  prepared by the United States and would be submitted to IAEA.  Because  the IAEA markings on the document have no legal significance in the  United States, the presidential message further explained that information  in the document should be treated as SBU and was exempt from  disclosure.  IAEA was not the originating agency for the information.  As a  result, it continues to be our view that the Director of the House Office of  Security did not provide the correct advice to the House Clerk on who she  should contact to obtain authorization on releasing SBU information.
Finally, regarding the matter of physical custody of the document, we do  not dispute Security Office’s claim that it was not required—nor did it have  the authority—to take control of the document.  However, we believe that  it would have been prudent for that office to take physical control of the  document as a precautionary measure until a determination was made  concerning whether or not the document could be published.  The  Director of the Office of Security missed opportunities to prevent the  document’s release and should have been more directly involved in  resolving conflicting and confusing information regarding the  dissemination of the draft declaration.  However, we modified the text on  page 17 to include information about the Security Office’s physical  custody requirements and the assistance the House Clerk requested from  the Security Office.
As agreed with your office, unless you publicly announce the contents of this  report earlier, we plan no further distribution of it until eight days from date  of this report.  At that time, we will send copies of this report to the  Secretaries of Commerce, Energy, and State; the Chairman of the Nuclear  Regulatory Commission; the House of Representatives’ Parliamentarian,  Clerk, and Sergeant at Arms; the Executive Clerk of the White House; the  Public Printer of the Government Printing Office; and interested  congressional committees. In addition, the report will be available at no  charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-3841 or aloisee@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix VI.
section_title: Appendix I: Comments from the Department of Energy
section_title: Appendix II: Comments from the Department of State
section_title: Appendix III: Comments from the Government Printing Office
paragraphs: The following are GAO’s comments to the Government Printing Office  letter dated December 2, 2009.
subsections: section_title: GAO Comments
paragraphs: 1.  We added GPO to the Highlights page as one of the agencies and  offices we met with to discuss why the disclosure of the draft  declaration occurred.  2.  We modified the text on page 3 to include the most recent data on the  status of the printed copies of the draft declaration, based on  information contained in the technical appendix provided by GPO.
section_title: Appendix IV: Comments from the Nuclear Regulatory Commission
paragraphs: The following is GAO’s comment to the Nuclear Regulatory Commission  letter dated December 2, 2009.
subsections: section_title: GAO Comment
paragraphs: 1.  We modified the text on the bottom of page 4 in the Background  section to clarify that under the Additional Protocol, the U.S. must  declare exports of sensitive nuclear-related equipment specified by  IAEA.
section_title: Appendix V: Comments from the House of Representatives’ Sergeant at Arms
paragraphs: The following are GAO’s comments to the House of Representatives  Sergeant at Arms letter dated December 2, 2009.
subsections: section_title: GAO Comments
paragraphs: 1.  We have modified the text on page 16 by removing a reference to the  Security Office to clarify that it did not make a determination as to  whether the document could be published.  2.  The Sergeant at Arms is incorrect when he states that IAEA marked  the document “Highly Confidential Safeguards Sensitive.”  As we state  in our report, U.S. agencies that prepared the declaration marked the  document, not IAEA.  U.S. agencies used an IAEA-supplied software to  mark the document with the highest IAEA security marking to put  IAEA on notice, once it received the document, that it should be  properly safeguarded against disclosure.  However, the draft  declaration is a U.S. document and should not have been publicly  disclosed.  3.  We agree that U.S. agencies and offices that prepared and transmitted  the document prior to sending it to the House of Representatives  missed opportunities to better mark the document and avoid confusion  about whether it should have been published.  However, the  presidential message that accompanied the draft declaration explained  that the United States regarded the information as SBU.  The  presidential message also explained that the information was exempt  from disclosure under FOIA.  In our view, the information in the  presidential message should have been sufficient to put the House  Security Office on notice that the information should be treated as  SBU and should not be published or publicly released without a more  rigorous inquiry.  4.  See comment 2.  5.  See comment 1.  6.  While there was nothing inherently wrong with the Office of Security  suggesting that the Clerk’s Office contact IAEA about the document,  IAEA did not prepare, transmit, or mark the document.  IAEA was not  the originating agency for the information.  As a result, it continues to  be our view that the Director of the House Office of Security did not  provide the correct advice to the House Clerk on who she should have  contacted to obtain authorization on releasing SBU information.    7.  As we noted in our report, U.S. agencies that prepared the draft  declaration placed the IAEA marking on the document.  The  presidential message explained that the draft declaration was prepared  by the United States and would be submitted to IAEA.  IAEA was not  the originating agency for the information.    8.  We have modified the text on page 17 to clarify that the Security Office  was not required to take custody and control of the document.  9.  See comment 8.  10. We have modified the text on page 17 to clarify that the Security Office  was not required to take custody and control of the document.   However, given the unfamiliar markings and 266 pages of detailed  information on U.S. nuclear sites and activities, we believe that it  would have been prudent to take positive physical control of the  document as a precautionary measure until a determination was made  concerning whether or not the document could be published.  The  Director of the Office of Security missed opportunities to prevent the  document’s release and he should have been more directly involved in  resolving conflicting and confusing information regarding the  classification of the draft declaration.   11. See comment 8.  12. We have modified the text on page 17 to clarify that the Security Office  was not required to take custody and control of the document and the  Executive Communications Clerk did not request that the Security  Office take custody of the document or assist her in contacting the  agencies and offices that transmitted the document.  13. We have modified the text on page 17 to clarify the Security Office’s  document custody requirements and what was asked of the Security  Office by the House Clerk.  However, we believe that given the  sensitive nature of the draft document—and commensurate with its  role—the House Security Office should have, at a minimum, raised  concerns with the House Clerk’s Office about publicly releasing 266  pages of information on U.S. nuclear sites and activities and advised  the House Clerk not to print the document without a more rigorous  inquiry as to whether it should have been published.  14. We believe that the recommendation suggested by the Sergeant at  Arms to require Member offices and other non-Committee House  entities that are not equipped to properly store sensitive or classified  data to relinquish custody of such material to the House Security  Office would involve a change in House rules and procedures that is  beyond the scope of our review.
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
paragraphs: Gene Aloise (202) 512-3841 or aloisee@gao.gov.
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Glen Levis, Assistant Director,  Antoinette Capaccio, Leland Cogliani; Ralph Dawn, Karen Keegan; Tim  Persons; and Carol Herrnstadt Shulman made significant contributions to  this report.