oversight

Arms Control and Disarmament Agency: Some Progress Made in Protecting Top Secret Documents

Published by the Government Accountability Office on 1990-07-23.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

 l’
   ..--_-..-...   .-.   ._... _. -_   ..- -.                _..   .-.     ._.   _..




          GAO                                                                                                             I




      --,__.”_II._.._.
                    -._ _.-__                             .-----.---_.-                       ~~
                   1!I!10
                                                                                      ARMS CONTROL
      .I lily




                                                                                      AND DISARMAMENT
                                                                                      AGENCY
                                                                                      Some Progress Made in
                                                                                      Protecting Top Secret
                                                                                      Documents


                                                                                                                 141844




 GAO/NSIAI)-90-240
_-.----                                ~~_-_-_-l._-l_-~                               _____
                                                                                                   _____I_____
        .
    s
.
                 United States
GAO              General Accounting Office
                 Washington, D.C. 20648

                 National Security and
                 International Affairs Division

                 B-240182

                 July 23, 1990

                 The Honorable Dante B. Fascell
                 Chairman, Committee on Foreign Affairs
                 House of Representatives

                 The Honorable William S. Broomfield
                 Ranking Minority Member
                 Committee on Foreign Affairs
                 House of Representatives

                 In response to your request, we performed a follow-up review to deter-
                 mine the extent of actions taken to address our recommendations in two
                 previously issued reports on protecting and safeguarding classified doc-
                 uments at the Arms Control and Disarmament Agency (ACDA).' In this
                 report, we describe ACDA'S actions to improve control and protection of
                 national security information at its headquarters in Washington, D.C.,
                 and its negotiating offices in Geneva, Switzerland. We recently reported
                 separately on the protection and control of sensitive compartmented
                 information (codeword) in ACDA’S sensitive compartmented information
                 facility.?


                 In our November 1988 report, we stated that ACDA had not complied
Background       with regulations designed to protect national security information from
                 unauthorized disclosure and, as a result, could not ensure that it had
                 control over all its classified material in its Washington and Geneva
                 offices. We recommended that ACDA take the following actions:

             . Implement and enforce existing regulations to ensure proper handling,
               control, and accountability of Top Secret, codeword, and other sensitive
               documents, including appointing a Top Secret control officer for Geneva,
               developing control procedures for all ACDA and delegation staff in
               Geneva, and establishing procedures to ensure that information on Top
               Secret documents is recorded in a timely and accurate manner.
             l Inventory its Top Secret documents in Washington and Geneva to deter-
               mine what it should be accountable for, identify what documents on its


                 ’ Arms Control and Disarmament Agency: Better Controls Are Needed to Protect Classified Infonna-
                 tion (GAO/mAD _89 -26 , Nov. 10,1988) and Arms
                                                            3
                 mmented Information (GAO/NSIAD-88-216, Aug. 24, 1988).
                 “Arms Control and Disarmament Agency: More Corrective Actions Needed to Control Classified
                 Codeword Documents (GAO/NSIAD-90-176, June 22,199O).



                 Page 1                              GAO/NSLAbQO-240 Arms Control and Disarmament Agency
                       B-240182




                     control logs might be missing, and report those that it cannot account for
                     to the originating agencies.
                   . Account for missing security containers (safes and barlock cabinets with
                     padlocks) and develop and maintain accurate records on their location.
                   l Enforce regulations to ensure the physical protection of classified infor-
                     mation, including meeting storage requirements, changing security
                     container combinations, taking basic security precautions such as
                     checking security containers at the close of business, and properly
                     marking documents.
                   l Act on the Information Security Oversight Office’s recommendations for
                     improving its information security program, including security educa-
                     tion programs, self inspections to ensure proper storage, and adherence
                     to classification regulations.


                             has made improvements but has not implemented all of our prior
Results in Brief       ACDA
                       recommendations and thus is not fully complying with its security regu-
                       lations. ACDA appointed a Top Secret control officer and instituted new
                       procedures for control and accountability of Top Secret documents in
                       Geneva and inventoried Top Secret documents in Washington and
                       Geneva. However, our review showed ACJMhad not accounted for 33 of
                       the 86 Top Secret documents that were missing during our prior review
                       or reported these missing documents to the originating agencies, as regu-
                       lations require. Also, ACDA identified additional uncontrolled Top Secret
                       documents in Washington and Geneva. Because of limitations in its
                       inventory procedures, ACDA does not have adequate assurance that
                       employees are properly controlling and storing all classified documents.

                       ACDA  has conducted three inventories of its security containers since our
                       1988 report. However, ACDA records continue to contain inaccuracies as
                       to the location and number of security containers, and it has not
                       accounted for all of those that we previously reported missing. ACDA has
                       not changed combinations as frequently as required, and employees
                       have not always conducted close-of-business security checks, although it
                       has made some improvements since our 1988 report. ACDA has started
                       implementing the Oversight Office’s recommendations on security edu-
                       cation and self inspections.




                       Page 2                     GAO/NSIAIMO-240   Arms Control   and Msarmam ent Agency
                    B-240182




                    In Washington, ACDA conducted two Top Secret document inventories-
ACDA Discovers      in February and October 1989. In May 1988, ACDA officials instructed
Additional          Washington staff to consolidate Top Secret documents into a single loca-
Uncontrolled        tion per office. In June 1988, before our 1988 report was issued, ACDA
                    inventoried the contents of the security containers designated for
Documents           storing Top Secret documents to determine what it should be account-
                    able for. During its February 1989 inventory, ACDA found 46 Top Secret
                    documents that were not recorded in the logs, indicating that employees
                    were not promptly reporting Top Secret documents to the control officer
                    and/or the June 1988 inventory was incomplete. During its October
                    1989 inventory, ACDA did not report any uncontrolled Top Secret or
                    codeword documents, suggesting that it had made some improvements
                    in controlling its classified documents.

                    In 1988 and 1989, ACDA officials reported that ACDA did not have any Top
                    Secret documents in Geneva. However, during a Geneva visit by ACDA
                    Washington officials in November 1989, a spot inspection revealed
                    46 uncontrolled and improperly stored Top Secret documents in two
                    locations.

                    At the time of our review, ACDA had not spot-checked in Washington the
                    approximately 350 security containers designated for storing material
                    classified below Top Secret. Without routine spot checks, ACDA does not
                    have adequate assurances that classified documents are properly stored
                    and accounted for in Washington and Geneva.


                    Federal regulations require that ACDA notify the originating agencies
Missing Documents   about any missing documents. As a result of inventories and other
Are Not Reported    actions, ACDA has accounted for 53 of the 86 Top Secret documents we
                    had identified as unaccounted for in our 1988 report. As of May 1990,
                    ACDA had investigated 3 of the remaining 33 documents but could not
                    account for them and was continuing to investigate the other 30 docu-
                    ments. ACDA officials stated that when they completed the investigation,
                    they would notify the originating agencies of any documents that are
                    unaccounted for. ACDA had not notified the originating agencies about
                    missing documents 2 years after it initially discovered that it could not
                    account for them. As of May 1990, ACDA had not established any dead-
                    line for reporting on the 30 documents still under investigation.




                    Page 3                     GAO/NSWW-240    Arnw Control   and Dhrmament   Agency
                                B-240182




                       ACDA'S records on its security containers were inaccurate, but it began
ACDA Is Developing     correcting them at the time of our review. The Office of Administration
an Accurate Inventory has conducted three inventories of security containers since our pre-
of Security Containers vious report. However, on the most recent inventory list, some security
                       containers were not included and some of the containers on the list did
                                not qualify as security containers because they were barlock cabinets
                                without padlocks. The number of containers on ACDA'S inventories
                                ranged from 303 in November 1989 to 377 in December 1989. Also, ACDA
                                had not located any of the 62 security containers identified as missing in
                                our 1988 report.

                                Based on our January and February 1990 inventory, 49 of the
                                62 security containers are still not accounted for. ACDA officials claimed
                                that historical records are so inaccurate that ACDA may never be able to
                                determine what happened to these containers.


                                ACDA   has not changed security container combinations as frequently as
ACDA Has Made                   required, and employees have not always conducted security checks at
Limited ImprOVementS            the close of business. However, ACDA officials told US they are currently
in Physical Security            having all combinations changed. In addition, in a letter dated October
                                1989, the Security Director reminded all ACDA employees of their respon-
                                sibility to perform close-of-business security checks.


                                ACDA   has been slow to respond to the Oversight Office’s reports. How-
ACDA Starting to                ever, in December 1989 and January 1990 it started mandatory security
Respondto Oversight             briefings, submitted a new plan for self inspections, and began a quar-
Office                          terly self-inspection program as recommended by that office.
Recommendations

                                We obtained the views of officials from ACDA and the Information
Agency Comments                 Security Oversight Office on information in this report and have incor-
                                porated their comments as appropriate. Subsequent to our fieldwork,
                                ACDA officials indicated that they had performed additional corrective
                                actions. In May 1990, as part of its new self-inspection program, ACDA
                                officials conducted an unannounced spot inspection of six security con-
                                tainers designated for storing material classified below Top Secret in
                                Washington. They did not find any uncontrolled Top Secret or codeword
                                documents. These results are encouraging; however, until ACDA reviews
                                the contents of additional security containers, it will not have adequate


                                Page 4                      GAO/NSJAD-90-240   Arms Control   and Disarmament   Agency
        \
    .
.
            B-240182




            assurances that Top Secret documents are stored and controlled as regu-
            lations require.

            In June 1990, ACDA informed us that it had completed its investigation of
            the additional 30 missing Top Secret documents but still could not
            account for them. According to the Security Director, by the end of July
            1990, ACDA will notify the originating agencies of all 33 unaccounted for
            documents.


            Appendix I contains more detailed information on ACDA’S actions in
            response to our prior recommendations. Appendix II sets forth our
            objectives, scope, and methodology for this review.

            We are sending copies of this report to interested congressional commit-
            tees; the Director, Arms Control and Disarmament Agency; the Director,
            Information Security Oversight Office, General Services Administration;
            the Secretary of State; and the Director, Office of Management and
            Budget. Copies will be made available to others on request.

            Please contact me at (202) 275-4128 if you or your staff have any ques-
            tions concerning this report. Major contributors to this report are listed
            in appendix III.




            Joseph E. Kelley
            Director, Security and International
              Relations Issues




            Page6                       GAO/NSIAD-fKb24OAmwCmtrol   and IMsamament   Agency
                                                                                                      t



Contents


Letter                                                                                                    1

Appendix I                                                                                                 8
The Arms Control and    Background                                                                         8
                                                                                                           9
                        Summary of Prior Report
Disarmament Agency      ACDA Cannot Ensure That All Classified Documents Are                              10
Has Made Progress in        Properly Controlled and Accounted for
                        ACDA Has Not Accounted for Missing Security Containers                            13
Protecting Classified       but Is Working to Develop Accurate Inventory
Information                 Records
                        ACDA Has Made Limited Improvements in Physical                                    14
                            Security
                        ACDA Starting to Respond to Oversight Office                                      15
                            Recommendations

Appendix II                                                                                               16
Objectives, Scope,and
Methodology
Appendix III                                                                                              18
Major Contributors to
This Report




                        Abbreviations

                        ACDA      U.S. Arms Control and Disarmament Agency
                        GAO       U.S. General Accounting Office


                        Page 6                    GAO/NSLAD-90-240   Arms Control   and Diemmament   Agency
.




    Page 7   GAO/NSLAD-90.240   Amw Control   and Msarmament   Agency
Appendix I

The Arms Control and Disamment Agency
Has Made Progressin Protecting
ClassifiedInformation
             The Arms Control and Disarmament Agency (ACDA) has made improve-
             ments but has not implemented all of our prior recommendations and
             thus is not fully complying with its security regulations. Moreover, ACDA
             does not have assurances that employees are properly handling, control-
             ling, and accounting for Top Secret documents.


                   is the central organization in the U.S. government for the formula-
Background   ACDA
             tion and implementation of arms control policy, as established by the
             1961 Arms Control and Disarmament Act (22 U.S.C. 2551). ACDA carries
             out its responsibilities at its Washington, D.C., headquarters and its
             Geneva, Switzerland, offices with a staff of 218, plus approximately
             50 detailees from the Departments of State and Defense. As part of its
             mission, ACDA handles classified material, including intelligence informa-
             tion, both internally generated and received from external sources.

             Executive Order 12356 prescribes a uniform system for classifying,
             declassifying, and safeguarding national security information. The Gen-
             eral Services Administration Information Security Oversight Office’s
             Directive 1 implements the order. The order and directive require agen-
             cies to protect classified information commensurate with the degree of
             damage that could be caused to national security by unauthorized dis-
             closure. Agencies must use physical safeguards to protect information
             classified Confidential or Secret, but individual records on such docu-
             ments are not required. Top Secret material must be accounted for
             through a controlled access system and annual inventories. Especially
             sensitive intelligence information, known as sensitive compartmented
             information, or codeword, must also be controlled and stored in a vault
             called a sensitive compartmented information facility. The Director of
             Central Intelligence issues directives governing the handling and control
             of codeword documents.

             ACDA’S  implementing regulations for information security, which are the
             same as the Department of State’s, establish more stringent require-
             ments for storage of classified information at overseas posts. Specifi-
             cally, in addition to storing Top Secret information in security
             containers with built-in three-way dial combinations, the security con-
             tainers must be located in a security-approved vault.




             PagrN                      GAO/NSIAD-90-240Arms   Controland Disarmament Agency
     .
 t

                   Appendix   I
                   The Arms   Control and Disarmament    Agency
                   Has Made   Progress in Protecting
                   Cla&fied   Information




                   In November 1988, we reported that ACM did not control classified
Summary of Prior   information in compliance with applicable standards at its Washington
Report             and Geneva offices. In addition, ACDA had not provided adequate control
                   systems or oversight and had not complied with security regulations.

                   ACDA  did not have an adequate Top Secret control system. In Wash-
                   ington, ACDA could not locate 86 Top Secret documents from our sample
                   of log entries; its records were inaccurate, incomplete, and out of date;
                   and it had not completed required annual inventories of all Top Secret
                   material. In Geneva, A~DA had no system for controlling Top Secret docu-
                   ments and had not appointed a Top Secret control officer.

                   A~DA  had not complied with regulations for physical protection of classi-
                   fied information at either its Washington or Geneva offices. In both loca-
                   tions, numerous Top Secret, codeword, and other sensitive documents
                   were improperly stored. Daily close-of-business security checks were not
                   always done, security container combinations were not changed as often
                   as required, and documents did not always have proper classification
                   markings. ACDA also did not have up-to-date records on its security con-
                   tainers and could not locate 62 security containers in Washington.

                   Also, in three inspections of ACDAsince 1984, the Information Security
                   Oversight Office identified weaknesses in several areas of ACDA’Sinfor-
                   mation security program. In its 1986 inspection report, the Oversight
                   Office made recommendations aimed at improving all aspects of ACDA’S
                   information security program. These included increasing the ACDA staff’s
                   familiarity with proper classification and safeguarding procedures
                   through a security education program, developing and implementing a
                   security inspection plan, and rigorously enforcing security regulations
                   and procedures. At the time of our 1988 review, ACDA had not imple-
                   mented these recommendations,

                   Our November 1988 rep
                   number of actions, as




                   Page 9                               GAO/NSIAD-90-240   Arma Control   and Disarmament   Agency
                                                                                                                  ,
                                                                                                                      f

                        Appendix     I
                        The Arms     Control and Disarmament    Agency
                        Has Made     Progress in Protecting
                        Classified    Information




                        In Washington, ACDA conducted two Top Secret document inventories-
ACDA Cannot Ensure      in February and October 1989. In May 1988, ACDA officials instructed
That All Classified     Washington staff to consolidate Top Secret documents into a single loca-
Documents Are           tion per office. As noted in our prior report, in June 1988, ACDA invento-
                        ried the contents of security containers designated for storing Top
Properly Controlled     Secret documents.
and Accounted for
                        During its February 1989 inventory, ACDA officials identified 46 Top
                        Secret documents that were not recorded in the logs. This suggests that
                        (1) employees were not following regulations that require them to
                        promptly report possession of Top Secret documents, and/or
                        (2) employees did not comply with ACDA'S instruction to consolidate all
                        Top Secret documents for the June 1988 inventory. It is also possible
                        that in its June 1988 inventory, ACDA failed to record these documents
                        on the logs. This is plausible given other mistakes made on the June
                        1988 inventory. For example, in February 1989, ACDA determined that
                        there were 71 duplicate entries on the June 1988 inventory.

                        During its October 1989 inventory of its designated security containers,
                        A~DA  did not report any uncontrolled Top Secret or codeword documents,
                        suggesting that it had made some improvements in controlling its classi-
                        fied documents. However, because ACDA did not perform spot inspections
                        of the several hundred security containers designated for documents
                        classified below Top Secret, it did not have adequate assurances that
                        Top Secret, codeword, or other sensitive documents were properly
                        stored and accounted for. Before ACDA'S June 1988 inventory, ACDA
                        offices indiscriminately stored Top Secret documents in security con-
                        tainers located throughout the agency. As noted in our prior report,
                        many Top Secret documents were not controlled.


Inaccuracies Found in   In response to our prior recommendation, ACDA designated a Top Secret
Geneva Records          control officer and developed document control procedures in Geneva.
                        Under ACDA'S new procedures, the executive secretary for each arms
                        control delegation is responsible for controlling Top Secret documents
                        retained by the negotiating group. These procedures require delegation
                        staff to immediately report Top Secret documents to the control officer
                        and store them in a vault.

                        In 1988 and 1989, ACDA officials reported that ACDA did not have any Top
                        Secret documents in Geneva. This was based on a review of the one des-
                        ignated security container in the mission’s vault. However, during a
                        Geneva visit by ACDA Washington officials in November 1989, a spot


                        Page 10                                GAO/N&ID-90-240   Arms Control   and Dissrmsment   Agency
      .

  7



                          Appendix      I
                          The Arms      Control and MS armament    Agency
                          Has Made      Progrew in Protecting
                          Cla~~siflcd    Infornubtion




                          inspection revealed 46 uncontrolled and improperly stored Top Secret
                          documents in two locations. The findings of these limited surveys of
                          only a few security containers indicate that delegation staff are not com-
                          plying with ACDA'S security regulations and new procedures for control-
                          ling and storing Top Secret documents.


Security Violations Not   ACDA  regulations state that each employee is responsible for becoming
Issued                    familiar with and adhering to all security regulations. Specifically, all
                          personnel must immediately take Top Secret documents to the control
                          officer for proper registration in the logs and ensure they are stored as
                          required.

                          A security violation occurs when classified material is not properly safe-
                          guarded, according to ACDA regulations. When a violation is identified,
                          the security officer must submit a written report to the security official
                          at the next higher level. Security officials must investigate reports of
                          violations to determine the possibility of compromise and to identify the
                          person(s) responsible for the violation. .&DA'S Office of Security adjudi-
                          cates the violation. The agency may take disciplinary action, ranging
                          from a written warning to dismissal.

                          In Washington, the ACDA Security Director did not report any violations
                          in 1988 and 1989 for uncontrolled Top Secret documents because he
                          gave staff a grace period to transfer previously uncontrolled Top Secret
                          documents to designated security containers. This grace period expired
                          in December 1989 when the Security Director required each Washington
                          ACDA employee to certify in writing that he or she did not have any Top
                          Secret documents other than those on ACDA'S inventory. According to the
                          Security Director, since the staff members have signed these certificates,
                          if they do not report Top Secret documents to the control officer, he will
                          report a security violation.

                          For the Geneva security infractions, the ACDA Security Director verbally
                          reported the uncontrolled documents to the Department of State
                          regional security officer. According to ACDA'S Security Director, ACDA did
                          not cite violations for the uncontrolled documents because the regional
                          security officer is responsible for investigating violations. ACIMstated
                          that the documents were archival materials and had apparently been
                          stored in their locations for some time, Therefore, ACDA officials stated,
                          it was difficult to determine who was responsible for the documents,
                          and it was unlikely that a former official would acknowledge
                          responsibility.


                          Page 11                                 GAO/NSIAD-W-240   Arms Control   and Dhmuunent   Agency
                        Appendix I
                        The Arms Control   and Disarmament    Agency
                        HasMadeProgressinProtecting
                        Cla.mslfiedInfoPiilation




                        Although it may not have been obvious who was responsible for the
                        uncontrolled, improperly stored documents, sound security practices
                        would indicate a need for formal notification of the violation to the State
                        Department regional security officer. One aspect of an investigation
                        would have been to determine, if possible, who was responsible for the
                        documents. However, contrary to regulations, ACDA'S Security Director
                        did not write a report and the regional security officer did not conduct
                        an investigation.


Missing Documents Are   If an agency knows that classified information has been lost or possibly
Not Reported to         compromised, Directive 1 requires the agency to notify the originator of
                        the material. The originating agency can then assess the extent to which
Originating Agency      national security has been damaged.

                        ACDA  has found or otherwise accounted for 53 of the 86 Top Secret docu-
                        ments that were identified as unaccounted for during our prior audit
                        work. As of May 1990, ACDA had investigated 3 of the remaining 33 doc-
                        uments but could not account for them and was investigating the other
                        30 documents. After conducting Top Secret document inventories and
                        subsequent investigations, ACDA officials believed that they had
                        accounted for all but three of the missing documents. In December 1989,
                        we informed ACDA that other documents on the list of 86 were not
                        accounted for. ACDA subsequently initiated an investigation of these
                        additional documents. According to the Security Director, upon comple-
                        tion of the investigation, he would notify the originating agencies of any
                        unaccounted for documents.

                        ACDA  has not yet complied with the requirement to notify originating
                        agencies of missing documents. Prompt reporting would allow those
                        agencies to conduct a damage assessment and take appropriate mea-
                        sures to minimize any adverse effect. ACDA had an obligation to notify
                        the agencies 2 years ago when it initially discovered that documents
                        were missing. As of May 1990, ACDA had not established any firm dead-
                        line for reporting the other 30 unaccounted for documents to the
                        originating agencies.




                        Page 12                              GAO/NSIAD-90.240   Arms control and Disarmament   Agency
  ,


                        Appendix     I
                        The Arms     Control and Disarmament    Agency
                        Has Made     Progress in Protecting
                        Classified   Information




                                records on its security containers were inaccurate, but it began
ACDA Has Not            ACDA'S
                        correcting them at the time of our review. After our physical inventory
Accounted for Missing   in January and February 1990,49 of the 62 security containers identi-
Security Containers     fied as missing in our prior report remained unaccounted for.
but Is Working to       A~DA'S  Office of Administration has conducted three inventories of
Develop Accurate        security containers since our prior review-in December 1988, and
Inventory Records       November and December 1989. However, on the most recent inventory
                        list, some security containers were not included and some of those on
                        the list did not qualify as security containers because they were barlock
                        cabinets without padlocks. The number of containers on ACDA'S invento-
                        ries ranged from 303 in November 1989 to 377 in December 1989. Our
                        1988 report indicated that ACDA had 3 11 security containers.

                        The results of our own physical inventory conducted in January and
                        February 1990 differed from ACDA'S records and our prior report. Of the
                        security containers on ACDA'S list, we located 346 containers during our
                        inventory and were told that 1 additional security container was at the
                        Director’s home. We did not include 24 containers on ACDA'S list that
                        were barlock cabinets without padlocks. We could not locate 20 of the
                        containers on ACDA'S December 1989 inventory list and found 15 con-
                        tainers that were not on the list. We subsequently discovered that 3 of
                        the 20 missing containers from ACDA'S December 1989 inventory list had
                        been sent to excess storage in early 1989.

                        According to the Security Director, ACDA staff move security containers
                        between offices without notifying the Office of Security. In one case, an
                        ACDA employee exchanged three security containers for State Depart-
                        ment security containers that he considered cosmetically more attrac-
                        tive than ACDA security containers. He did not report the exchange to the
                        Office of Security. According to ACDA regulations, office moves must be
                        coordinated with the Office of Security. In January 1990, ACDA'S Office
                        of Administration agreed to obtain approval from the Office of Security
                        before moving security containers. Under this agreement, the Security
                        Director expects to maintain accurate records on the number and loca-
                        tion of ACDA'S security containers. He plans to keep a list separate from
                        that of the Office of Administration. According to ACDA, to ensure accu-
                        racy, the Office of Security will cross-check the number and location of
                        security containers on its list with the Office of Administration’s prop-
                        erty inventory.

                        A~DA may not be able to locate the missing security containers identified
                        by padlock numbers because ACDA does not keep records on the padlocks


                        Page 13                                GAO/N&W-90-240   Arms Control   and Disarmament   Agency
                             Appendix     I
                             The Arms     Control and Die armament    Agency
                             Haa Made     Progrem ln Protecting
                             Claaelfled    Information




                             when they are taken out of service, according to the Security Director.
                             In addition, we discovered that ACDA had placed some security con-
                             tainers in excess storage without recording the control numbers. If any
                             of these containers are among those listed as missing, the Security Office
                             may be unable to locate the container.


                             XDA is not changing security container combinations as frequently as
ACDA Has Made                required and employees are not always conducting security checks at
Limited ImprOVemeIJtS        the close of business. However, ACDA is now having all the combinations
in Physical Security         changed, and indications are that, compared to our previous review,
                             more employees are conducting close-of-business checks.


Security Container           ACDA  regulations state that combinations should be changed (1) when an
Combinations Not             employee knowing the combination terminates employment or no longer
                             requires access, (2) when it is known or suspected that an unauthorized
Changed as Frequently as     person knows the combination, or (3) at least once every 12 months. We
Required                     reviewed combination cards only to determine if ACDA met the minimum
                             requirement of changing combinations at least every 12 months.

                             According to our review, ACDA has not been changing combinations as
                             frequently as required, although it has made some improvements since
                             our previous review. During our 1988 review, ACDA officials told us that
                             they were unaware of the annual requirement. The current Security
                             Director, however, is aware of the regulations and stated that he is
                             having the combinations on all security containers changed.

                             The 303 combination cards we examined in December 1989 indicate that
                             ACDA  had not changed the combinations on 131 (43 percent) of the con-
                             tainers for more than 1 year; 24 of the 131 had not been changed for
                             more than 2 years. There were no cards for 54 of the 347 security con-
                             tainers we identified during our recent inventory. Combination cards for
                             13 of these containers are kept in the sensitive compartmented informa-
                             tion facility, and the contractor responsible for physically changing the
                             combinations had the other 41 cards, according to the Security Director.


Security Checks Not          ACDAstill does not consistently follow regulations requiring that check
Consistently Ln-tplemented   sheets be affixed to each security container and that employees indicate
                             the date and time the security container was opened, closed, and
                             checked at the close of business. On over 80 percent of ACDA’S security
                             containers in Washington, employees have signed check sheets when


                             Page 14                                 GAO/NSIAD-90-240   Arma Control   and Disarmament   Agency
                      Appendix1
                      The Anna Control and Diearmament Agency
                      Hae Made Progress in Protecting
                      Claesifled Information




                      opening and closing security containers. However, about 40 percent of
                      the check sheets showed no indication that ACDA staff had conducted the
                      required close-of-business security check. This is an improvement over
                      the 56 percent we found in our prior review.


                            has been slow to respond to the Oversight Office’s recommenda-
ACDA Starting to      ACDA
                      tions. However, in December 1989 and January 1990, ACDA started
Respondto Oversight   implementing two recommendations.
Office                ACM had not implemented a number of the Oversight Office’s recom-
Recommendations       mendations dating as far back as 1986, according to the Office’s report
                      of its August and September 1988 inspection. The Office found ACDA’S
                      lack of responsiveness disturbing and repeated its recommendations
                      from previous reviews. Furthermore, the Office found ACDA'S failure to
                      implement its recommendation on security training particularly trouble-
                      some because, on at least three occasions, it had provided ACDA copies of
                      security briefing material.

                      The Office recommended in 1986 and again in 1987 that ACDA develop a
                      plan of self inspections, including a checklist, and submit a copy for its
                      review. According to the Office, ACDA'S earlier plan for self inspections
                      was inadequate. Also, ACDA had not developed a systematic checklist for
                      conducting the security checks and did not regularly review classified
                      material to determine whether it was properly classified and marked.

                      ACDA  has started implementing two recommendations. In January 1990,
                      ACDA  began mandatory security briefings using three Oversight Office
                      videotapes on classification, marking, and safeguarding classified mater-
                      ials. Also, ACDA submitted a new plan for self inspections in December
                      1989, including a check sheet for security self inspections and a
                      schedule for quarterly reviews. At the time of our review, the Oversight
                      Office had not commented on the adequacy of ACDA'S self inspection
                      plan.

                      In January 1990, the ACDA Security Director conducted a trial inspection
                      and examined 60 documents for adherence to classification regulations.
                      According to ACDA, the purpose was to establish a baseline for future
                      inspections and enable ACDA to determine the effect of the recent
                      security briefings. ACDA found that compliance with classification
                      requirements has improved since the Oversight Office’s 1988 inspection.




                      Page 15                        GAO/NSIAIMO-240 Arms Control and Dis armament Agency
Appendix II

Objectives,Scope,and Methodology


              Our objective was to determine the extent to which ACDA has imple-
              mented our November 1988 recommendations on its national security
              information program in Washington, D.C., and Geneva, Switzerland.

              We interviewed the Director, the Advisor on Internal Affairs (formerly
              the Deputy Director and Acting Director), and officials in the Offices of
              Security and Administration in ACDA; an ACDA consultant; and the State
              Department regional security officer in Geneva. We asked these officials
              to describe how ACDA had responded to our recommendations and
              requested documentation to verify ACDA'S responses. We reviewed pre-
              vious internal and external reports on ACDA security procedures,
              including reports by the Information Security Oversight Office, the State
              Department Inspector General, and ACDA'S Advisor on Internal Affairs.

              To determine if ACDA had located missing Top Secret documents identi-
              fied in our prior review, we examined the agency’s records of three Top
              Secret document surveys it conducted in Washington in June 1988 and
              in February and October 1989. We also reviewed ACDA memorandums on
              Top Secret document holdings in Geneva in 1988 and 1989.

              We examined ACDA'S records of three inventories on the number and
              location of security containers in Washington to see whether ACDA had
              located the 62 missing security containers and developed and main-
              tained accurate records on its security containers. We also conducted
              our own physical inventory of security containers. We reviewed check
              sheets on the containers to determine whether employees had followed
              regulations for signing check sheets when they opened and closed
              security containers and at the close of business. We also reviewed ACDA'S
              records to determine when combinations for security containers had
              been changed.

              To evaluate the extent to which ACDA had responded to the Oversight
              Office’s recommendations, we interviewed the senior program analyst
              who conducted recent reviews of ACDA'S information security program,
              and attended ACTDA'S mandatory security briefing. We examined ACDA'S
              written responses to the Oversight Office, its self inspection plan, and its
              reports on the results of two inspections.

              Due to time and resource constraints, we did not (1) physically review
              security practices or interview officials in Geneva, (2) examine Top
              Secret documents to verify the accuracy of the inventories and the clas-
              sification markings in Washington and Geneva, or (3) examine the con-
              tents of security container drawers in Washington and Geneva.


              Page 16                     GAO/NSIAD-90-240   Arms Control   and Disarmament   Agency
Appendix   II
Obhctives, &kope, and Methodology




Our work was conducted from October 1989 to May 1990 in accordance
with generally accepted government auditing standards.




Page 17                             GAO/NSIAD-90-240   Arma Control   and Disammm ent Agency
Appendix III

Major Contributors to This Report


                        Louis H. Zanardi, Assistant Director
National Security and   Mary K. Quinlan, Evaluator-in-Charge
International Affairs   Kathleen J. Hancock, Evaluator
Division, Washington,
D.C.




(467348)                Page 18                   GAO/NSIAD-W-240 Arm Control and Disarmament Agency
:   _,....__
          ..-._^_
               I.__-..---_---___--l-l_l.ll_“_I_-I-   _..._
                                                        “__..--. -_-                ---                         _------             --




                                                     1i.S. Gewral Awounting           Offiw
                                                     Post Offi<rt* 130x 6015
                                                     (;ait.htwburg,   Maryland        20877

                                                     ‘I’t+3phont~ 202-275-6241

                                                     ‘l’ht~ first, fiw   twpiw   of each report, are free. Actttit.ional   copies are
                                                     .y;z.oo wch.

                                                     ‘l%t~rt~ is a 25% tliscounl    on orders for 100 or more copies mailed to a
                                                     single address.

                                                     Ortttbrs must be prepaid by cash or by check or money order made
                                                     oul 1.0 1he Sit~)t~rilit,t~ncient of Document~s.
l         F




    .-.