l’ ..--_-..-... .-. ._... _. -_ ..- -. _.. .-. ._. _.. GAO I --,__.”_II._.._. -._ _.-__ .-----.---_.- ~~ 1!I!10 ARMS CONTROL .I lily AND DISARMAMENT AGENCY Some Progress Made in Protecting Top Secret Documents 141844 GAO/NSIAI)-90-240 _-.---- ~~_-_-_-l._-l_-~ _____ _____I_____ . s . United States GAO General Accounting Office Washington, D.C. 20648 National Security and International Affairs Division B-240182 July 23, 1990 The Honorable Dante B. Fascell Chairman, Committee on Foreign Affairs House of Representatives The Honorable William S. Broomfield Ranking Minority Member Committee on Foreign Affairs House of Representatives In response to your request, we performed a follow-up review to deter- mine the extent of actions taken to address our recommendations in two previously issued reports on protecting and safeguarding classified doc- uments at the Arms Control and Disarmament Agency (ACDA).' In this report, we describe ACDA'S actions to improve control and protection of national security information at its headquarters in Washington, D.C., and its negotiating offices in Geneva, Switzerland. We recently reported separately on the protection and control of sensitive compartmented information (codeword) in ACDA’S sensitive compartmented information facility.? In our November 1988 report, we stated that ACDA had not complied Background with regulations designed to protect national security information from unauthorized disclosure and, as a result, could not ensure that it had control over all its classified material in its Washington and Geneva offices. We recommended that ACDA take the following actions: . Implement and enforce existing regulations to ensure proper handling, control, and accountability of Top Secret, codeword, and other sensitive documents, including appointing a Top Secret control officer for Geneva, developing control procedures for all ACDA and delegation staff in Geneva, and establishing procedures to ensure that information on Top Secret documents is recorded in a timely and accurate manner. l Inventory its Top Secret documents in Washington and Geneva to deter- mine what it should be accountable for, identify what documents on its ’ Arms Control and Disarmament Agency: Better Controls Are Needed to Protect Classified Infonna- tion (GAO/mAD _89 -26 , Nov. 10,1988) and Arms 3 mmented Information (GAO/NSIAD-88-216, Aug. 24, 1988). “Arms Control and Disarmament Agency: More Corrective Actions Needed to Control Classified Codeword Documents (GAO/NSIAD-90-176, June 22,199O). Page 1 GAO/NSLAbQO-240 Arms Control and Disarmament Agency B-240182 control logs might be missing, and report those that it cannot account for to the originating agencies. . Account for missing security containers (safes and barlock cabinets with padlocks) and develop and maintain accurate records on their location. l Enforce regulations to ensure the physical protection of classified infor- mation, including meeting storage requirements, changing security container combinations, taking basic security precautions such as checking security containers at the close of business, and properly marking documents. l Act on the Information Security Oversight Office’s recommendations for improving its information security program, including security educa- tion programs, self inspections to ensure proper storage, and adherence to classification regulations. has made improvements but has not implemented all of our prior Results in Brief ACDA recommendations and thus is not fully complying with its security regu- lations. ACDA appointed a Top Secret control officer and instituted new procedures for control and accountability of Top Secret documents in Geneva and inventoried Top Secret documents in Washington and Geneva. However, our review showed ACJMhad not accounted for 33 of the 86 Top Secret documents that were missing during our prior review or reported these missing documents to the originating agencies, as regu- lations require. Also, ACDA identified additional uncontrolled Top Secret documents in Washington and Geneva. Because of limitations in its inventory procedures, ACDA does not have adequate assurance that employees are properly controlling and storing all classified documents. ACDA has conducted three inventories of its security containers since our 1988 report. However, ACDA records continue to contain inaccuracies as to the location and number of security containers, and it has not accounted for all of those that we previously reported missing. ACDA has not changed combinations as frequently as required, and employees have not always conducted close-of-business security checks, although it has made some improvements since our 1988 report. ACDA has started implementing the Oversight Office’s recommendations on security edu- cation and self inspections. Page 2 GAO/NSIAIMO-240 Arms Control and Msarmam ent Agency B-240182 In Washington, ACDA conducted two Top Secret document inventories- ACDA Discovers in February and October 1989. In May 1988, ACDA officials instructed Additional Washington staff to consolidate Top Secret documents into a single loca- Uncontrolled tion per office. In June 1988, before our 1988 report was issued, ACDA inventoried the contents of the security containers designated for Documents storing Top Secret documents to determine what it should be account- able for. During its February 1989 inventory, ACDA found 46 Top Secret documents that were not recorded in the logs, indicating that employees were not promptly reporting Top Secret documents to the control officer and/or the June 1988 inventory was incomplete. During its October 1989 inventory, ACDA did not report any uncontrolled Top Secret or codeword documents, suggesting that it had made some improvements in controlling its classified documents. In 1988 and 1989, ACDA officials reported that ACDA did not have any Top Secret documents in Geneva. However, during a Geneva visit by ACDA Washington officials in November 1989, a spot inspection revealed 46 uncontrolled and improperly stored Top Secret documents in two locations. At the time of our review, ACDA had not spot-checked in Washington the approximately 350 security containers designated for storing material classified below Top Secret. Without routine spot checks, ACDA does not have adequate assurances that classified documents are properly stored and accounted for in Washington and Geneva. Federal regulations require that ACDA notify the originating agencies Missing Documents about any missing documents. As a result of inventories and other Are Not Reported actions, ACDA has accounted for 53 of the 86 Top Secret documents we had identified as unaccounted for in our 1988 report. As of May 1990, ACDA had investigated 3 of the remaining 33 documents but could not account for them and was continuing to investigate the other 30 docu- ments. ACDA officials stated that when they completed the investigation, they would notify the originating agencies of any documents that are unaccounted for. ACDA had not notified the originating agencies about missing documents 2 years after it initially discovered that it could not account for them. As of May 1990, ACDA had not established any dead- line for reporting on the 30 documents still under investigation. Page 3 GAO/NSWW-240 Arnw Control and Dhrmament Agency B-240182 ACDA'S records on its security containers were inaccurate, but it began ACDA Is Developing correcting them at the time of our review. The Office of Administration an Accurate Inventory has conducted three inventories of security containers since our pre- of Security Containers vious report. However, on the most recent inventory list, some security containers were not included and some of the containers on the list did not qualify as security containers because they were barlock cabinets without padlocks. The number of containers on ACDA'S inventories ranged from 303 in November 1989 to 377 in December 1989. Also, ACDA had not located any of the 62 security containers identified as missing in our 1988 report. Based on our January and February 1990 inventory, 49 of the 62 security containers are still not accounted for. ACDA officials claimed that historical records are so inaccurate that ACDA may never be able to determine what happened to these containers. ACDA has not changed security container combinations as frequently as ACDA Has Made required, and employees have not always conducted security checks at Limited ImprOVementS the close of business. However, ACDA officials told US they are currently in Physical Security having all combinations changed. In addition, in a letter dated October 1989, the Security Director reminded all ACDA employees of their respon- sibility to perform close-of-business security checks. ACDA has been slow to respond to the Oversight Office’s reports. How- ACDA Starting to ever, in December 1989 and January 1990 it started mandatory security Respondto Oversight briefings, submitted a new plan for self inspections, and began a quar- Office terly self-inspection program as recommended by that office. Recommendations We obtained the views of officials from ACDA and the Information Agency Comments Security Oversight Office on information in this report and have incor- porated their comments as appropriate. Subsequent to our fieldwork, ACDA officials indicated that they had performed additional corrective actions. In May 1990, as part of its new self-inspection program, ACDA officials conducted an unannounced spot inspection of six security con- tainers designated for storing material classified below Top Secret in Washington. They did not find any uncontrolled Top Secret or codeword documents. These results are encouraging; however, until ACDA reviews the contents of additional security containers, it will not have adequate Page 4 GAO/NSJAD-90-240 Arms Control and Disarmament Agency \ . . B-240182 assurances that Top Secret documents are stored and controlled as regu- lations require. In June 1990, ACDA informed us that it had completed its investigation of the additional 30 missing Top Secret documents but still could not account for them. According to the Security Director, by the end of July 1990, ACDA will notify the originating agencies of all 33 unaccounted for documents. Appendix I contains more detailed information on ACDA’S actions in response to our prior recommendations. Appendix II sets forth our objectives, scope, and methodology for this review. We are sending copies of this report to interested congressional commit- tees; the Director, Arms Control and Disarmament Agency; the Director, Information Security Oversight Office, General Services Administration; the Secretary of State; and the Director, Office of Management and Budget. Copies will be made available to others on request. Please contact me at (202) 275-4128 if you or your staff have any ques- tions concerning this report. Major contributors to this report are listed in appendix III. Joseph E. Kelley Director, Security and International Relations Issues Page6 GAO/NSIAD-fKb24OAmwCmtrol and IMsamament Agency t Contents Letter 1 Appendix I 8 The Arms Control and Background 8 9 Summary of Prior Report Disarmament Agency ACDA Cannot Ensure That All Classified Documents Are 10 Has Made Progress in Properly Controlled and Accounted for ACDA Has Not Accounted for Missing Security Containers 13 Protecting Classified but Is Working to Develop Accurate Inventory Information Records ACDA Has Made Limited Improvements in Physical 14 Security ACDA Starting to Respond to Oversight Office 15 Recommendations Appendix II 16 Objectives, Scope,and Methodology Appendix III 18 Major Contributors to This Report Abbreviations ACDA U.S. Arms Control and Disarmament Agency GAO U.S. General Accounting Office Page 6 GAO/NSLAD-90-240 Arms Control and Diemmament Agency . Page 7 GAO/NSLAD-90.240 Amw Control and Msarmament Agency Appendix I The Arms Control and Disamment Agency Has Made Progressin Protecting ClassifiedInformation The Arms Control and Disarmament Agency (ACDA) has made improve- ments but has not implemented all of our prior recommendations and thus is not fully complying with its security regulations. Moreover, ACDA does not have assurances that employees are properly handling, control- ling, and accounting for Top Secret documents. is the central organization in the U.S. government for the formula- Background ACDA tion and implementation of arms control policy, as established by the 1961 Arms Control and Disarmament Act (22 U.S.C. 2551). ACDA carries out its responsibilities at its Washington, D.C., headquarters and its Geneva, Switzerland, offices with a staff of 218, plus approximately 50 detailees from the Departments of State and Defense. As part of its mission, ACDA handles classified material, including intelligence informa- tion, both internally generated and received from external sources. Executive Order 12356 prescribes a uniform system for classifying, declassifying, and safeguarding national security information. The Gen- eral Services Administration Information Security Oversight Office’s Directive 1 implements the order. The order and directive require agen- cies to protect classified information commensurate with the degree of damage that could be caused to national security by unauthorized dis- closure. Agencies must use physical safeguards to protect information classified Confidential or Secret, but individual records on such docu- ments are not required. Top Secret material must be accounted for through a controlled access system and annual inventories. Especially sensitive intelligence information, known as sensitive compartmented information, or codeword, must also be controlled and stored in a vault called a sensitive compartmented information facility. The Director of Central Intelligence issues directives governing the handling and control of codeword documents. ACDA’S implementing regulations for information security, which are the same as the Department of State’s, establish more stringent require- ments for storage of classified information at overseas posts. Specifi- cally, in addition to storing Top Secret information in security containers with built-in three-way dial combinations, the security con- tainers must be located in a security-approved vault. PagrN GAO/NSIAD-90-240Arms Controland Disarmament Agency . t Appendix I The Arms Control and Disarmament Agency Has Made Progress in Protecting Cla&fied Information In November 1988, we reported that ACM did not control classified Summary of Prior information in compliance with applicable standards at its Washington Report and Geneva offices. In addition, ACDA had not provided adequate control systems or oversight and had not complied with security regulations. ACDA did not have an adequate Top Secret control system. In Wash- ington, ACDA could not locate 86 Top Secret documents from our sample of log entries; its records were inaccurate, incomplete, and out of date; and it had not completed required annual inventories of all Top Secret material. In Geneva, A~DA had no system for controlling Top Secret docu- ments and had not appointed a Top Secret control officer. A~DA had not complied with regulations for physical protection of classi- fied information at either its Washington or Geneva offices. In both loca- tions, numerous Top Secret, codeword, and other sensitive documents were improperly stored. Daily close-of-business security checks were not always done, security container combinations were not changed as often as required, and documents did not always have proper classification markings. ACDA also did not have up-to-date records on its security con- tainers and could not locate 62 security containers in Washington. Also, in three inspections of ACDAsince 1984, the Information Security Oversight Office identified weaknesses in several areas of ACDA’Sinfor- mation security program. In its 1986 inspection report, the Oversight Office made recommendations aimed at improving all aspects of ACDA’S information security program. These included increasing the ACDA staff’s familiarity with proper classification and safeguarding procedures through a security education program, developing and implementing a security inspection plan, and rigorously enforcing security regulations and procedures. At the time of our 1988 review, ACDA had not imple- mented these recommendations, Our November 1988 rep number of actions, as Page 9 GAO/NSIAD-90-240 Arma Control and Disarmament Agency , f Appendix I The Arms Control and Disarmament Agency Has Made Progress in Protecting Classified Information In Washington, ACDA conducted two Top Secret document inventories- ACDA Cannot Ensure in February and October 1989. In May 1988, ACDA officials instructed That All Classified Washington staff to consolidate Top Secret documents into a single loca- Documents Are tion per office. As noted in our prior report, in June 1988, ACDA invento- ried the contents of security containers designated for storing Top Properly Controlled Secret documents. and Accounted for During its February 1989 inventory, ACDA officials identified 46 Top Secret documents that were not recorded in the logs. This suggests that (1) employees were not following regulations that require them to promptly report possession of Top Secret documents, and/or (2) employees did not comply with ACDA'S instruction to consolidate all Top Secret documents for the June 1988 inventory. It is also possible that in its June 1988 inventory, ACDA failed to record these documents on the logs. This is plausible given other mistakes made on the June 1988 inventory. For example, in February 1989, ACDA determined that there were 71 duplicate entries on the June 1988 inventory. During its October 1989 inventory of its designated security containers, A~DA did not report any uncontrolled Top Secret or codeword documents, suggesting that it had made some improvements in controlling its classi- fied documents. However, because ACDA did not perform spot inspections of the several hundred security containers designated for documents classified below Top Secret, it did not have adequate assurances that Top Secret, codeword, or other sensitive documents were properly stored and accounted for. Before ACDA'S June 1988 inventory, ACDA offices indiscriminately stored Top Secret documents in security con- tainers located throughout the agency. As noted in our prior report, many Top Secret documents were not controlled. Inaccuracies Found in In response to our prior recommendation, ACDA designated a Top Secret Geneva Records control officer and developed document control procedures in Geneva. Under ACDA'S new procedures, the executive secretary for each arms control delegation is responsible for controlling Top Secret documents retained by the negotiating group. These procedures require delegation staff to immediately report Top Secret documents to the control officer and store them in a vault. In 1988 and 1989, ACDA officials reported that ACDA did not have any Top Secret documents in Geneva. This was based on a review of the one des- ignated security container in the mission’s vault. However, during a Geneva visit by ACDA Washington officials in November 1989, a spot Page 10 GAO/N&ID-90-240 Arms Control and Dissrmsment Agency . 7 Appendix I The Arms Control and MS armament Agency Has Made Progrew in Protecting Cla~~siflcd Infornubtion inspection revealed 46 uncontrolled and improperly stored Top Secret documents in two locations. The findings of these limited surveys of only a few security containers indicate that delegation staff are not com- plying with ACDA'S security regulations and new procedures for control- ling and storing Top Secret documents. Security Violations Not ACDA regulations state that each employee is responsible for becoming Issued familiar with and adhering to all security regulations. Specifically, all personnel must immediately take Top Secret documents to the control officer for proper registration in the logs and ensure they are stored as required. A security violation occurs when classified material is not properly safe- guarded, according to ACDA regulations. When a violation is identified, the security officer must submit a written report to the security official at the next higher level. Security officials must investigate reports of violations to determine the possibility of compromise and to identify the person(s) responsible for the violation. .&DA'S Office of Security adjudi- cates the violation. The agency may take disciplinary action, ranging from a written warning to dismissal. In Washington, the ACDA Security Director did not report any violations in 1988 and 1989 for uncontrolled Top Secret documents because he gave staff a grace period to transfer previously uncontrolled Top Secret documents to designated security containers. This grace period expired in December 1989 when the Security Director required each Washington ACDA employee to certify in writing that he or she did not have any Top Secret documents other than those on ACDA'S inventory. According to the Security Director, since the staff members have signed these certificates, if they do not report Top Secret documents to the control officer, he will report a security violation. For the Geneva security infractions, the ACDA Security Director verbally reported the uncontrolled documents to the Department of State regional security officer. According to ACDA'S Security Director, ACDA did not cite violations for the uncontrolled documents because the regional security officer is responsible for investigating violations. ACIMstated that the documents were archival materials and had apparently been stored in their locations for some time, Therefore, ACDA officials stated, it was difficult to determine who was responsible for the documents, and it was unlikely that a former official would acknowledge responsibility. Page 11 GAO/NSIAD-W-240 Arms Control and Dhmuunent Agency Appendix I The Arms Control and Disarmament Agency HasMadeProgressinProtecting Cla.mslfiedInfoPiilation Although it may not have been obvious who was responsible for the uncontrolled, improperly stored documents, sound security practices would indicate a need for formal notification of the violation to the State Department regional security officer. One aspect of an investigation would have been to determine, if possible, who was responsible for the documents. However, contrary to regulations, ACDA'S Security Director did not write a report and the regional security officer did not conduct an investigation. Missing Documents Are If an agency knows that classified information has been lost or possibly Not Reported to compromised, Directive 1 requires the agency to notify the originator of the material. The originating agency can then assess the extent to which Originating Agency national security has been damaged. ACDA has found or otherwise accounted for 53 of the 86 Top Secret docu- ments that were identified as unaccounted for during our prior audit work. As of May 1990, ACDA had investigated 3 of the remaining 33 doc- uments but could not account for them and was investigating the other 30 documents. After conducting Top Secret document inventories and subsequent investigations, ACDA officials believed that they had accounted for all but three of the missing documents. In December 1989, we informed ACDA that other documents on the list of 86 were not accounted for. ACDA subsequently initiated an investigation of these additional documents. According to the Security Director, upon comple- tion of the investigation, he would notify the originating agencies of any unaccounted for documents. ACDA has not yet complied with the requirement to notify originating agencies of missing documents. Prompt reporting would allow those agencies to conduct a damage assessment and take appropriate mea- sures to minimize any adverse effect. ACDA had an obligation to notify the agencies 2 years ago when it initially discovered that documents were missing. As of May 1990, ACDA had not established any firm dead- line for reporting the other 30 unaccounted for documents to the originating agencies. Page 12 GAO/NSIAD-90.240 Arms control and Disarmament Agency , Appendix I The Arms Control and Disarmament Agency Has Made Progress in Protecting Classified Information records on its security containers were inaccurate, but it began ACDA Has Not ACDA'S correcting them at the time of our review. After our physical inventory Accounted for Missing in January and February 1990,49 of the 62 security containers identi- Security Containers fied as missing in our prior report remained unaccounted for. but Is Working to A~DA'S Office of Administration has conducted three inventories of Develop Accurate security containers since our prior review-in December 1988, and Inventory Records November and December 1989. However, on the most recent inventory list, some security containers were not included and some of those on the list did not qualify as security containers because they were barlock cabinets without padlocks. The number of containers on ACDA'S invento- ries ranged from 303 in November 1989 to 377 in December 1989. Our 1988 report indicated that ACDA had 3 11 security containers. The results of our own physical inventory conducted in January and February 1990 differed from ACDA'S records and our prior report. Of the security containers on ACDA'S list, we located 346 containers during our inventory and were told that 1 additional security container was at the Director’s home. We did not include 24 containers on ACDA'S list that were barlock cabinets without padlocks. We could not locate 20 of the containers on ACDA'S December 1989 inventory list and found 15 con- tainers that were not on the list. We subsequently discovered that 3 of the 20 missing containers from ACDA'S December 1989 inventory list had been sent to excess storage in early 1989. According to the Security Director, ACDA staff move security containers between offices without notifying the Office of Security. In one case, an ACDA employee exchanged three security containers for State Depart- ment security containers that he considered cosmetically more attrac- tive than ACDA security containers. He did not report the exchange to the Office of Security. According to ACDA regulations, office moves must be coordinated with the Office of Security. In January 1990, ACDA'S Office of Administration agreed to obtain approval from the Office of Security before moving security containers. Under this agreement, the Security Director expects to maintain accurate records on the number and loca- tion of ACDA'S security containers. He plans to keep a list separate from that of the Office of Administration. According to ACDA, to ensure accu- racy, the Office of Security will cross-check the number and location of security containers on its list with the Office of Administration’s prop- erty inventory. A~DA may not be able to locate the missing security containers identified by padlock numbers because ACDA does not keep records on the padlocks Page 13 GAO/N&W-90-240 Arms Control and Disarmament Agency Appendix I The Arms Control and Die armament Agency Haa Made Progrem ln Protecting Claaelfled Information when they are taken out of service, according to the Security Director. In addition, we discovered that ACDA had placed some security con- tainers in excess storage without recording the control numbers. If any of these containers are among those listed as missing, the Security Office may be unable to locate the container. XDA is not changing security container combinations as frequently as ACDA Has Made required and employees are not always conducting security checks at Limited ImprOVemeIJtS the close of business. However, ACDA is now having all the combinations in Physical Security changed, and indications are that, compared to our previous review, more employees are conducting close-of-business checks. Security Container ACDA regulations state that combinations should be changed (1) when an Combinations Not employee knowing the combination terminates employment or no longer requires access, (2) when it is known or suspected that an unauthorized Changed as Frequently as person knows the combination, or (3) at least once every 12 months. We Required reviewed combination cards only to determine if ACDA met the minimum requirement of changing combinations at least every 12 months. According to our review, ACDA has not been changing combinations as frequently as required, although it has made some improvements since our previous review. During our 1988 review, ACDA officials told us that they were unaware of the annual requirement. The current Security Director, however, is aware of the regulations and stated that he is having the combinations on all security containers changed. The 303 combination cards we examined in December 1989 indicate that ACDA had not changed the combinations on 131 (43 percent) of the con- tainers for more than 1 year; 24 of the 131 had not been changed for more than 2 years. There were no cards for 54 of the 347 security con- tainers we identified during our recent inventory. Combination cards for 13 of these containers are kept in the sensitive compartmented informa- tion facility, and the contractor responsible for physically changing the combinations had the other 41 cards, according to the Security Director. Security Checks Not ACDAstill does not consistently follow regulations requiring that check Consistently Ln-tplemented sheets be affixed to each security container and that employees indicate the date and time the security container was opened, closed, and checked at the close of business. On over 80 percent of ACDA’S security containers in Washington, employees have signed check sheets when Page 14 GAO/NSIAD-90-240 Arma Control and Disarmament Agency Appendix1 The Anna Control and Diearmament Agency Hae Made Progress in Protecting Claesifled Information opening and closing security containers. However, about 40 percent of the check sheets showed no indication that ACDA staff had conducted the required close-of-business security check. This is an improvement over the 56 percent we found in our prior review. has been slow to respond to the Oversight Office’s recommenda- ACDA Starting to ACDA tions. However, in December 1989 and January 1990, ACDA started Respondto Oversight implementing two recommendations. Office ACM had not implemented a number of the Oversight Office’s recom- Recommendations mendations dating as far back as 1986, according to the Office’s report of its August and September 1988 inspection. The Office found ACDA’S lack of responsiveness disturbing and repeated its recommendations from previous reviews. Furthermore, the Office found ACDA'S failure to implement its recommendation on security training particularly trouble- some because, on at least three occasions, it had provided ACDA copies of security briefing material. The Office recommended in 1986 and again in 1987 that ACDA develop a plan of self inspections, including a checklist, and submit a copy for its review. According to the Office, ACDA'S earlier plan for self inspections was inadequate. Also, ACDA had not developed a systematic checklist for conducting the security checks and did not regularly review classified material to determine whether it was properly classified and marked. ACDA has started implementing two recommendations. In January 1990, ACDA began mandatory security briefings using three Oversight Office videotapes on classification, marking, and safeguarding classified mater- ials. Also, ACDA submitted a new plan for self inspections in December 1989, including a check sheet for security self inspections and a schedule for quarterly reviews. At the time of our review, the Oversight Office had not commented on the adequacy of ACDA'S self inspection plan. In January 1990, the ACDA Security Director conducted a trial inspection and examined 60 documents for adherence to classification regulations. According to ACDA, the purpose was to establish a baseline for future inspections and enable ACDA to determine the effect of the recent security briefings. ACDA found that compliance with classification requirements has improved since the Oversight Office’s 1988 inspection. Page 15 GAO/NSIAIMO-240 Arms Control and Dis armament Agency Appendix II Objectives,Scope,and Methodology Our objective was to determine the extent to which ACDA has imple- mented our November 1988 recommendations on its national security information program in Washington, D.C., and Geneva, Switzerland. We interviewed the Director, the Advisor on Internal Affairs (formerly the Deputy Director and Acting Director), and officials in the Offices of Security and Administration in ACDA; an ACDA consultant; and the State Department regional security officer in Geneva. We asked these officials to describe how ACDA had responded to our recommendations and requested documentation to verify ACDA'S responses. We reviewed pre- vious internal and external reports on ACDA security procedures, including reports by the Information Security Oversight Office, the State Department Inspector General, and ACDA'S Advisor on Internal Affairs. To determine if ACDA had located missing Top Secret documents identi- fied in our prior review, we examined the agency’s records of three Top Secret document surveys it conducted in Washington in June 1988 and in February and October 1989. We also reviewed ACDA memorandums on Top Secret document holdings in Geneva in 1988 and 1989. We examined ACDA'S records of three inventories on the number and location of security containers in Washington to see whether ACDA had located the 62 missing security containers and developed and main- tained accurate records on its security containers. We also conducted our own physical inventory of security containers. We reviewed check sheets on the containers to determine whether employees had followed regulations for signing check sheets when they opened and closed security containers and at the close of business. We also reviewed ACDA'S records to determine when combinations for security containers had been changed. To evaluate the extent to which ACDA had responded to the Oversight Office’s recommendations, we interviewed the senior program analyst who conducted recent reviews of ACDA'S information security program, and attended ACTDA'S mandatory security briefing. We examined ACDA'S written responses to the Oversight Office, its self inspection plan, and its reports on the results of two inspections. Due to time and resource constraints, we did not (1) physically review security practices or interview officials in Geneva, (2) examine Top Secret documents to verify the accuracy of the inventories and the clas- sification markings in Washington and Geneva, or (3) examine the con- tents of security container drawers in Washington and Geneva. Page 16 GAO/NSIAD-90-240 Arms Control and Disarmament Agency Appendix II Obhctives, &kope, and Methodology Our work was conducted from October 1989 to May 1990 in accordance with generally accepted government auditing standards. Page 17 GAO/NSIAD-90-240 Arma Control and Disammm ent Agency Appendix III Major Contributors to This Report Louis H. Zanardi, Assistant Director National Security and Mary K. Quinlan, Evaluator-in-Charge International Affairs Kathleen J. Hancock, Evaluator Division, Washington, D.C. (467348) Page 18 GAO/NSIAD-W-240 Arm Control and Disarmament Agency : _,....__ ..-._^_ I.__-..---_---___--l-l_l.ll_“_I_-I- _..._ “__..--. -_- --- _------ -- 1i.S. Gewral Awounting Offiw Post Offi<rt* 130x 6015 (;ait.htwburg, Maryland 20877 ‘I’t+3phont~ 202-275-6241 ‘l’ht~ first, fiw twpiw of each report, are free. Actttit.ional copies are .y;z.oo wch. ‘l%t~rt~ is a 25% tliscounl on orders for 100 or more copies mailed to a single address. Ortttbrs must be prepaid by cash or by check or money order made oul 1.0 1he Sit~)t~rilit,t~ncient of Document~s. l F .-.
Arms Control and Disarmament Agency: Some Progress Made in Protecting Top Secret Documents
Published by the Government Accountability Office on 1990-07-23.
Below is a raw (and likely hideous) rendition of the original report. (PDF)