United States General Accounting Office GAO Report to the Committee on National Security, House of Representatives September 1997 DEPARTMENT OF ENERGY DOE Needs to Improve Controls Over Foreign Visitors to Weapons Laboratories GAO/RCED-97-229 United States GAO General Accounting Office Washington, D.C. 20548 Resources, Community, and Economic Development Division B-277671 September 25, 1997 The Honorable Floyd D. Spence Chairman The Honorable Ronald V. Dellums Ranking Minority Member Committee on National Security House of Representatives As directed by the Committee in House Report No. 104-563, this report addresses the Department of Energy’s (DOE) controls over foreign visitors to its three nuclear weapons laboratories. Specifically, the report discusses DOE’s (1) procedures for reviewing the backgrounds of foreign visitors and for controlling the dissemination of sensitive information to such visitors, (2) security controls for limiting foreign visitors’ access to areas and information within its laboratories, and (3) counterintelligence programs for mitigating the potential threat posed by foreign visitors. As arranged, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this letter. At that time, we will provide copies of the report to the Secretary of Energy; the Director, Office of Management and Budget; and other interested parties. We will also make copies available to others upon request. Please call me on (202) 512-3841 if you or your staffs have any questions. Major contributors to this report are listed in appendix V. Victor S. Rezendes Director, Energy, Resources, and Science Issues Executive Summary With the end of the Cold War, the Department of Energy’s (DOE) weapons Purpose laboratories are moving away from secret nuclear weapons research toward unclassified cooperative research involving a variety of nations and an increasing number of foreign visitors. This openness greatly benefits DOE and the United States by stimulating the exchange of ideas, promoting cooperation, and enhancing research efforts. However, while foreign visitors are providing benefits to DOE’s programs, the weapons laboratories are key targets of foreign intelligence interest, according to counterintelligence experts, thus raising concerns about possible espionage efforts against those laboratories, including industrial espionage. To guard against foreign nationals’ obtaining information that would be detrimental to U.S. security or business interests, DOE has established various controls to minimize the risk of foreign espionage. However, past work done by GAO in 1988 and more recently by elements of the U.S. intelligence community has shown problems with DOE’s controls over foreign visitors to its laboratories.1 Moreover, because the number of foreign visitors to the laboratories increased over 50 percent from the late-1980s to the mid-1990s, additional burdens have been placed on the controls DOE has in place to manage foreign visits. The high number of foreign visitors, as well as some recent investigative cases involving foreign nationals at DOE’s laboratories, have increased concerns that the laboratories are targets of foreign espionage. Because of these concerns, the House Committee on National Security, in a May 1996 report, directed GAO to determine how well DOE has been managing foreign visits to the weapons laboratories. Accordingly, GAO assessed DOE’s (1) procedures for reviewing the backgrounds of foreign visitors and for controlling the dissemination of sensitive information to them, (2) security controls for limiting foreign visitors’ access to areas and information within its laboratories, and (3) counterintelligence programs for mitigating the potential threat posed by foreign visitors. Historically, the Lawrence Livermore National Laboratory, the Los Alamos Background National Laboratory, and the Sandia National Laboratories have been responsible for conducting research and development for DOE’s nuclear weapons program. The laboratories are also world-leading centers of research in many technologies and scientific disciplines and conduct a 1 Nuclear Nonproliferation: Major Weaknesses in Foreign Visitor Controls at Weapons Laboratories (GAO/RCED-89-31, Oct. 11, 1988). Page 2 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Executive Summary broad range of nonnuclear research activities in such areas as biomedicine, high-performance computers, and environmental restoration. DOE’s policy encourages international cooperation in unclassified energy and science programs to obtain the benefits of scientific and technical advances from other countries and to minimize research costs. Consequently, each year thousands of foreign nationals visit these three laboratories to participate in cooperative research or laboratory programs. DOE Order 1240.2b establishes controls over unclassified foreign visits (stays of up to 30 days) and assignments (extended stays of up to 2 years).2 Among other things, this order requires that DOE obtain background information on certain proposed visitors from sensitive countries— countries considered to be a risk to security or nuclear proliferation. The order also requires that DOE review and approve visits involving information that, although unclassified, is considered sensitive for such reasons as its potential to enhance nuclear weapons capability, lead to nuclear proliferation, reveal advance technologies, or have “dual-use” applications (technologies that have both peaceful and military uses). In addition, each weapons laboratory has security procedures for controlling foreign nationals’ access to its facilities. Furthermore, DOE has established counterintelligence programs at headquarters and the laboratories to mitigate the risk of foreign espionage, increase employee awareness, and brief and debrief employees serving as hosts to foreign visitors. Counterintelligence programs have become more important as the number of foreign visitors has increased. DOE’s procedures for obtaining background checks and controlling the Results in Brief dissemination of sensitive information are not fully effective. DOE has procedures that require obtaining background checks, but these procedures are not being enforced. At two of the laboratories, background checks are conducted on only about 5 percent of the foreign visitors from countries that DOE views as sensitive. GAO’s review of available data from DOE and the Federal Bureau of Investigation showed that some of the individuals without background checks had suspected foreign intelligence connections. Furthermore, DOE’s procedures lack clear criteria for identifying visits that involve sensitive subjects and process controls to help ensure that these visits are identified. As a result, sensitive subjects may have been discussed with foreign nationals without DOE’s knowledge and approval. 2 For purposes of this report, we use “visit” as a generic term for both short-term visits or long-term assignments. However, we do make distinctions between visits (or visitors) and assignments (or assignees) in situations where such distinctions are significant. Page 3 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Executive Summary DOE’s security controls, such as access restrictions, in the areas most visited by foreign nationals do not preclude their obtaining access to sensitive information, and problems with the control of this information—such as sensitive information being left in an open hallway accessible to foreign visitors—have occurred at the laboratories. Furthermore, DOE has not evaluated the effectiveness of the security controls over this information in those areas most frequented by foreign visitors. The DOE headquarters and laboratory counterintelligence programs are key activities for identifying and mitigating foreign intelligence efforts, but these programs have lacked comprehensive threat assessments, which identify likely facilities, technologies, and programs targeted by foreign intelligence. Such assessments are needed as a critical component of a more sophisticated security strategy that is consistent with the laboratories’ more open missions. Furthermore, DOE could use these assessments to develop the performance measures needed to guide the laboratories’ counterintelligence programs and to gauge their effectiveness. Currently, DOE has not developed such performance measures or evaluated the effectiveness of its counterintelligence programs. Principal Findings Procedures Are Not DOE Order 1240.2b requires the laboratories to submit information to DOE Effectively Implemented for background checks for all foreign visitors from sensitive countries and to obtain these checks in advance for those who are on assignment at the laboratories. Consistent with these requirements, Livermore obtained background checks on 44 percent of its visitors from sensitive countries. However, to reduce costs and processing backlogs, the Los Alamos and Sandia laboratories implemented in 1994 a partial exception that DOE had granted to the order that largely avoided the background check process. Since then, DOE has obtained background checks on about 5 percent of the visitors from sensitive countries to these two laboratories. GAO’s review of available data from DOE and the Federal Bureau of Investigation showed that, as a result of obtaining fewer background checks for foreign visitors to these laboratories, questionable visitors, including suspected foreign intelligence agents, had access to the laboratories without DOE and/or laboratory officials’ advance knowledge of the visitors’ backgrounds. Page 4 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Executive Summary DOE’s existing procedures for identifying sensitive subjects lack clear criteria for determining which subjects are sensitive and process controls to help ensure that proposed visits involving potentially sensitive subjects are reviewed by officials at DOE headquarters. Consequently, although the laboratories identified 72 visits involving sensitive subjects during the 1994 to 1996 timeframe, GAO identified other visits that occurred without DOE’s review and approval and that may have involved sensitive subjects, such as inertial confinement fusion (a technology with both energy and nuclear weapons applications) and the detection of nuclear weapons testing. Although DOE and laboratory officials have recognized problems with identifying sensitive subjects and are taking actions to better identify them, their actions are not yet completed. Security Controls Leave The controls in the areas of the laboratories that are most often visited by Vulnerabilities foreign nationals do not preclude their access to sensitive information. Foreign visitors are generally allowed into “property protection,” or controlled areas. These areas have lower levels of controls than do security areas in which classified work is conducted. For example, in contrast to the controls in place in security areas, foreign visitors are, in some cases, allowed unescorted, 24-hour access to facilities in controlled areas. Security problems and vulnerabilities involving foreign visitors and sensitive—and in some cases even classified—information have occurred or been identified by the laboratories. For example, at one laboratory, several boxes marked “sensitive materials” were left in a hallway accessible to foreign visitors. At another laboratory, classified information was included in a newsletter sent to 11 foreign nationals. Thorough assessments and surveys of the controls over foreign visitors’ access to sensitive information have not been conducted. Although some security assessments of limited scope done by the laboratories have demonstrated the vulnerability of sensitive information to being compromised, these assessments have generally examined specific buildings or programs and have not focused on controls over sensitive information in the areas most accessed by foreign visitors. Likewise, DOE’s broader security surveys of its weapons laboratories have not assessed the effectiveness of the controls over sensitive information, either in general or in relation to foreign visitors. Counterintelligence DOE’s counterintelligence programs have not been based on a Programs Could Be comprehensive threat assessment that examines the nature and extent of Improved foreign espionage activities. Such an assessment would analyze the Page 5 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Executive Summary countries of concern and identify for the entire Department the technologies, information, and programs likely to be targeted by these countries. Counterintelligence officials at both DOE and the Federal Bureau of Investigation believe this assessment is needed as a basis for guiding DOE’s counterintelligence programs and ensuring that their efforts are properly focused; however, DOE has not conducted such an assessment because of programmatic priorities and the lack of sufficient analytical expertise. Furthermore, DOE has not provided detailed oversight of the laboratories’ counterintelligence programs. In this regard, DOE has not developed expectations and performance measures for those programs or periodically evaluated them. DOE is now taking steps to improve its counterintelligence programs. The Congress provided DOE with an additional $5 million in fiscal year 1997 to expand counterintelligence activities; DOE is using about half of these funds for the counterintelligence programs at the three nuclear weapons laboratories. Also, DOE and the laboratories are undertaking various initiatives to improve their counterintelligence efforts, such as developing more thorough threat assessments. Although implementation of these improvements is scheduled for the end of fiscal year 1997, DOE counterintelligence officials raised concerns that the Department may not fully implement these improvements in light of its historical lack of support for its counterintelligence program. GAO is making several recommendations to the Secretary of Energy that Recommendations are designed to (1) obtain background checks on more of the foreign visitors to the Department’s weapons laboratories, (2) improve the identification and review of visits by foreign nationals that involve sensitive subjects, (3) more thoroughly assess the adequacy of security procedures in unclassified areas of the weapons laboratories, and (4) enhance the effectiveness of counterintelligence programs at DOE’s headquarters and laboratories. GAO provided a draft of this report to DOE for its review and comment. In its Agency Comments written response, DOE had no comments on the general nature of the facts presented in the draft report and concurred with all the recommendations. DOE believes, however, that the report overstates the value of background checks on foreign visitors. GAO recognizes that background checks are but one factor to be considered in approving foreign visits and recommends only that DOE obtain background checks in accordance with its foreign Page 6 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Executive Summary visit and assignment order. DOE also suggested that GAO revise the language for one recommendation regarding an assessment of security procedures at each laboratory. Although DOE suggested that GAO specify that a certain type of assessment be conducted, GAO did not revise the recommendation in order to avoid being overly prescriptive in how such assessments are performed. Finally, as DOE suggested, GAO clarified the recommendation to focus more clearly on protecting sensitive information. DOE’sresponse also detailed a number of initiatives it has taken or plans to undertake that address the recommendations. DOE’s comments and GAO’s evaluation are included at the end of chapter 5; the full text of DOE’s comments are included as appendix IV. Page 7 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Contents Executive Summary 2 Chapter 1 10 DOE’s Weapons Laboratories 10 Introduction Controls Over Foreign Visits to the Weapons Laboratories 16 Concerns Exist About the Potential Compromise of Sensitive 19 Information Objectives, Scope, and Methodology 21 Chapter 2 24 DOE Has Little Advance Knowledge About the Backgrounds of 24 Foreign Visitor Many Visitors From Sensitive Countries Procedures Have Not DOE Has Not Adequately Ensured That Visits Involving Sensitive 28 Subjects Are Identified and Reviewed Been Effectively Implemented Chapter 3 33 Security Requirements in Controlled Areas 33 Security Controls May Security Vulnerabilities and Problems Have Involved Foreign 36 Not Adequately Visitors Protection of Sensitive Information in Controlled Areas Has Not 37 Protect Sensitive Been Fully Assessed Information From Foreign Visitors Chapter 4 40 DOE’s Headquarters and Laboratory Counterintelligence 40 DOE’s Programs Counterintelligence DOE Has Not Clearly Defined the Threat Posed by Foreign 42 Visitors to Its Laboratories Efforts Can Be DOE Has Not Effectively Overseen the Laboratories’ 43 Improved Counterintelligence Programs DOE Is Taking Steps to Strengthen Its Counterintelligence 45 Program Chapter 5 47 Recommendations 48 Conclusions and DOE’s Comments and Our Response 49 Recommendations Page 8 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Contents Appendixes Appendix I: DOE’s List of Sensitive Countries 52 Appendix II: DOE’s List of Sensitive Subjects 53 Appendix III: Number and Percentage of Background Checks 55 Obtained for Foreign Visitors From Sensitive Countries to DOE’s Nuclear Weapons Laboratories, 1994-96 Appendix IV: Comments From the Department of Energy 56 Appendix V: Major Contributors to This Report 63 Table Table 2.1: Background Checks That Were Obtained on 26 Sensitive-Country Visitors to DOE Weapons Laboratories, 1994-1996 Figures Figure 1.1: Lawrence Livermore National Laboratory 11 Figure 1.2: Los Alamos National Laboratory 13 Figure 1.3: Sandia National Laboratories 15 Figure 1.4: Unclassified Foreign Visits to DOE’s Weapons 17 Laboratories, 1994-96 Abbreviations CIA Central Intelligence Agency DOE Department of Energy FBI Federal Bureau of Investigation GAO General Accounting Office OPSEC operations security Page 9 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Although the Cold War has ended, the threat of foreign espionage to the nation still exists from a variety of countries, and recent revelations of intelligence activities against the United States involving Russia, China, and South Korea have raised concerns that such activities are on the increase. The Department of Energy (DOE) and its facilities, especially its nuclear weapons laboratories, are key targets of foreign intelligence interest. Not only do these laboratories conduct activities related to the design, construction, and maintenance of nuclear weapons—a long-standing target of foreign espionage—but they also conduct research into many areas of high technology, such as laser fusion, high-performance computers, and microelectronics. Their research is often done in collaboration with industry, and sometimes foreign countries, to develop new technologies for commercial applications. Accordingly, their work is of interest to other countries, and thousands of foreign nationals visit these laboratories each year to participate in such research. The high number of foreign visitors, as well as some recent investigative cases involving foreign nationals at DOE’s laboratories, have increased concerns that these laboratories are targets of foreign espionage efforts. DOE’s nuclear weapons laboratories—the Lawrence Livermore National DOE’s Weapons Laboratory in California and the Los Alamos National Laboratory and Laboratories Sandia National Laboratories in New Mexico—have been the cornerstones of the U.S. weapons program for over 40 years. In this regard, they are unique among DOE’s laboratories.1 Government-owned and contractor-operated, these three laboratories have been assigned specific missions for nuclear weapons development as well as other programmatic responsibilities. Over time, the laboratories have increasingly expanded their responsibilities in nondefense research areas. The Lawrence Livermore National Laboratory is operated by the University of California for DOE. Established in 1952, the laboratory occupies 1-square mile in Livermore, California. The laboratory’s major missions include nuclear weapons research and development to ensure the safety, security, and reliability of the U.S. nuclear weapons stockpile; other weapons and defense-related activities for DOE and the Department of Defense; inertial confinement fusion (a technology that has both energy and nuclear weapons testing applications); and nuclear nonproliferation. 1 DOE has 9 multiprogram and approximately 21 specialized laboratories. Page 10 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Figure 1.1: Lawrence Livermore National Laboratory Source: Lawrence Livermore National Laboratory. The Los Alamos National Laboratory, also operated by the University of California for DOE, was established in 1943 as part of the Manhattan Project that developed the first nuclear weapons. Located approximately 35 miles from Santa Fe, New Mexico, the laboratory covers an area of Page 11 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction approximately 43 square miles. The laboratory conducts an array of classified and unclassified activities, including all phases of nuclear weapons research, design, and testing; other weapons-related research for DOE; and management of special nuclear materials, such as plutonium. Recently, Los Alamos was given responsibility for the production of certain weapons components. Page 12 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Figure 1.2: Los Alamos National Laboratory Source: DOE. Page 13 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction The Sandia National Laboratories are operated for DOE by the Lockheed Martin Corporation. Sandia, established in 1949, is located in Albuquerque, New Mexico, and works in conjunction with Livermore and Los Alamos to design and develop nuclear weapons.2 Sandia conducts research, development, and engineering on all facets of weapons design and development except the nuclear explosive components. Sandia also produces some of the nonnuclear components, such as neutron generators, that are needed for nuclear weapons. 2 Sandia also has a facility located adjacent to the Livermore laboratory in California. Page 14 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Figure 1.3: Sandia National Laboratories Source: DOE. Although the Livermore, Los Alamos, and Sandia laboratories are involved in research and development activities related to nuclear weapons, in recent years many of their efforts have expanded beyond issues strictly related to defense or national security. The laboratories are now involved in such areas as high-performance computers, lasers, and microelectronics. Furthermore, they perform research in such diverse Page 15 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction areas as biomedicine, environmental restoration, and global climate change. In addition, the laboratories are working with industry to develop new technologies and products for the commercial market. Such activities include work on advanced automobile propulsion systems, medical applications, and waste management. Furthermore, each laboratory conducts basic scientific research in areas of its own choosing—termed Laboratory Directed Research and Development. This research involves such subjects as astrophysics and space science, particle physics, materials science, and chemistry. Because the Livermore, Los Alamos, and Sandia laboratories are Controls Over Foreign world-leading centers of research in many technologies and scientific Visits to the Weapons disciplines, many foreign scientists are attracted to them and invited to Laboratories come there to exchange information or participate in research activities. DOE’s policy supports an active program of unclassified visits to these laboratories for the benefit of its programs.3 In fact, DOE and the laboratories have cooperative activities with certain countries to exchange scientists and information and to collaborate on research in selected scientific areas. With the easing of global tensions since the breakup of the Soviet Union and the changing missions of the weapons laboratories, the number of unclassified foreign visits to the laboratories has increased significantly. The average annual number of visits by foreign nationals to the laboratories has increased over 50 percent from the late-1980s to the mid-1990s. Furthermore, this increase in foreign visitors is continuing. As shown in figure 1.4, the number of unclassified foreign visits to the laboratories has increased each of the last 3 years, to a level of about 7,000 visits in 1996. This represents a significant portion of the 20,000 or more unclassified foreign visits estimated by DOE to have occurred at all of its laboratories during 1996. 3 DOE allows classified foreign visits that relate to information on nuclear weapons; however, according to DOE, visits involving classified information are limited mainly to foreign nationals from the United Kingdom and countries in the North Atlantic Treaty Organization. Page 16 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Figure 1.4: Unclassified Foreign Visits to DOE’s Weapons Laboratories, 10000 Number of visits 1994-96 8000 6998 6212 5983 6000 4000 2826 2811 2404 2392 2555 2542 2000 1278 1361 1024 0 Sandia Livermore Los Alamos Total 1994 1995 1996 Source: GAO’s analysis of data from DOE and its laboratories. Allowing foreign nationals to visit the weapons laboratories and participate in their unclassified activities provides valuable benefits to the laboratories and the country, such as using the visitors’ skills to increase the chances of making significant scientific advancements. However, because such visits are not without risk, DOE Order 1240.2b—Unclassified Visits and Assignments by Foreign Nationals, September 3, 1992—establishes responsibilities and policies and prescribes administrative procedures for controlling unclassified visits and assignments to DOE’s facilities. Until recently, the foreign visitor program was principally administered by the Office of Policy and International Affairs, but in March 1997 this responsibility was transferred to the Office of Resource Management in the Office of Nonproliferation and National Security. Other principal organizations involved in administering and controlling unclassified foreign visits include the Nuclear Transfer and Supplier Policy Division, Office of Arms Control and Nonproliferation; the Page 17 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction Office of Safeguards and Security, Office of Security Affairs; the Counterintelligence Division, Office of Energy Intelligence; the appropriate headquarters program office that is sponsoring the visit; DOE field offices; and laboratory management. As defined by the order, visits are short-term stays of 30 days or less for the purposes of orientation, technical discussions, observation of projects or experiments, training, or discussion of collaboration on topics of mutual interest. Assignments are long-term stays of more than 30 days (within a 12-month period) to actively participate in the work of a facility or contribute to its projects. Assignments are limited to 2 years but may be extended. Assignees may include foreign nationals who are employees, as well as those who are guests or consultants.4 According to DOE’s estimates, over 25 percent of the foreign visitors to its weapons laboratories are assignees. DOE’s foreign visit and assignment order identifies several requirements for reviewing, approving, and documenting foreign nationals’ access to its nuclear weapons laboratories. Although the order, in general, allows most foreign nationals access with little oversight by DOE, the Department views some visits and assignments to be of potential concern. These include visits from countries DOE considers sensitive for reasons of national security, nuclear nonproliferation, regional instability, or terrorism support (see app. I for a list of these countries). Data from DOE and the laboratories show that almost 30 percent of the visitors to its weapons laboratories are from sensitive countries. DOE is also concerned about visits involving subjects which, although unclassified, are considered sensitive because they have the potential to enhance nuclear weapons capability, lead to nuclear proliferation, divulge militarily critical technologies, or reveal other advanced technologies (see app. II for a list of these subjects) as well as visits to areas located within the laboratories where special nuclear material and/or classified information and equipment are located. Certain requirements must be met if a foreign visit or assignment involves a sensitive country, a sensitive subject, or a security facility where classified work is conducted. According to the foreign visits and assignments order, all assignments and visits involving sensitive subjects or security facilities where classified work is conducted must be reviewed and approved by DOE. Furthermore, before an assignment involving a 4 For purposes of this report, we use “visit” as a generic term for both short-term visits or long-term assignments. However, we do make distinctions between visits (or visitors) and assignments (or assignees) in situations where such distinctions are significant. Page 18 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction visitor from a sensitive country begins, a national security background check must be completed to determine if appropriate U.S. government agencies have derogatory information, such as an intelligence affiliation, about that individual. DOE also has security procedures that control the access of foreign visitors to the weapons laboratories. All foreign visitors—whether on a visit or an assignment—must wear an appropriate badge to obtain entry to various parts of a weapons laboratory. Furthermore, depending upon the facility involved, the days of the week and the hours during which the foreign national can actually be on site are restricted. Finally, guards and other security countermeasures are used to control access to those parts of the laboratories where classified work is conducted. Security forces and other countermeasures are also used to monitor and control access to the less protected, controlled areas known as property protection areas—which are not open to the general public and which may contain unclassified sensitive information—to ensure that this information is not compromised. As an added line of defense, DOE and its laboratories operate counterintelligence programs to identify and mitigate the risk that sensitive information could be divulged to foreign countries. Among other things, the counterintelligence personnel conduct awareness programs to keep employees aware of the risk of foreign intelligence-gathering activities, brief and debrief employees who host foreign visitors, conduct assessments of foreign visitor activity, and disseminate relevant information throughout the DOE community. However, they have no approval authority for foreign visitors. The laboratories’ counterintelligence programs do not conduct counterintelligence “operations,” such as surveillance activities. Situations of concern are referred to the Federal Bureau of Investigation (FBI), which performs counterintelligence operations or investigations as necessary. The risk that classified or sensitive information may be compromised Concerns Exist About through foreign espionage is real and has been long-standing. Espionage the Potential against the weapons laboratories occurred as long ago as the 1940s when Compromise of the Manhattan Project was developing the nation’s first nuclear weapons. As documented in a 1996 Central Intelligence Agency (CIA) report that Sensitive Information detailed recently declassified documents, key information on nuclear weapons was obtained from Los Alamos by the Soviet Union. In the 1980s and 1990s, there have been other espionage activities against DOE’s Page 19 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction laboratories, but information on these incidents remains classified. DOE, laboratory, and other agency counterintelligence professionals briefed us on them, which included recent cases involving the possible theft or compromise of sensitive information in which foreign nationals at DOE’s laboratories played a prominent role. The large and increasing number of foreign nationals visiting DOE’s laboratories has raised concerns about the potential compromise of classified information or other sensitive or proprietary information at these facilities. Counterintelligence professionals point out that (1) the laboratories have desirable assets in the form of classified information and unclassified but sensitive information; (2) access by foreign nationals, even for a short time, can provide the opportunity to identify and target laboratory information; and (3) repeated and long-term contact between laboratory personnel and foreign nationals can create relationships that foreign countries can use to obtain information. They add that the threat has become more complex because not only is information on nuclear weapons desirable to some foreign countries, but information and technology of economic benefit is of great importance to all countries. Consequently, the laboratories face the risk of economic espionage by enemies and allies alike. Past unclassified work done by GAO and classified work by others have shown the risks of foreign visits and DOE’s problems in controlling foreign visitors’ presence at its laboratories. In 1988, we reported that major weaknesses existed in DOE’s foreign visitor program and, as a result, suspected foreign intelligence agents and individuals from facilities suspected of conducting nuclear weapons activities had obtained access to the laboratories without DOE’s prior knowledge.5 More recently, classified reports—in 1992 by an intelligence community interagency working group and in 1997 by the FBI—have pointed out basic problems with DOE’s counterintelligence efforts regarding the presence of foreign nationals at DOE’s laboratories. DOE itself is concerned about the number of foreign visitors to its facilities and the potential threat of espionage they pose and has obtained additional funding to help its counterintelligence programs respond to this potential threat. Counterintelligence funding for headquarters program direction and field activities in fiscal year 1996 totaled about $3.2 million. DOE was appropriated an additional $5 million in fiscal year 1997 to expand 5 Nuclear Nonproliferation: Major Weaknesses in Foreign Visitor Controls at Weapons Laboratories (GAO/RCED-89-31, Oct. 11, 1988). Page 20 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction counterintelligence programs at its nuclear weapons laboratories and other high-risk facilities. A May 7, 1996, report of the House Committee on National Security Objectives, Scope, directed GAO to determine how well DOE is controlling foreign visits to and Methodology DOE’s three weapons laboratories and to determine whether these visits raise security or nuclear proliferation concerns. Since that time, we have issued to the Committee a Statement for the Record describing the number of foreign visitors to these laboratories and a report discussing the distribution of the fiscal year 1997 counterintelligence funds provided to DOE.6 This report completes our work on DOE’s controls over foreign visitors and, as agreed with Committee staff, addresses DOE’s (1) procedures for reviewing the backgrounds of foreign visitors and for controlling the dissemination of sensitive information to them, (2) security controls for limiting foreign visitors’ access to areas and information within its laboratories, and (3) counterintelligence programs for mitigating the potential threat posed by foreign visitors. To obtain an overall perspective on DOE’s foreign visitor procedures, security controls, and counterintelligence efforts, we obtained and reviewed pertinent DOE and laboratory orders, documents, and other materials. We also met with and interviewed DOE headquarters, field office, and contractor officials, including officials from DOE’s Offices of Defense Programs, Nonproliferation and National Security, and Policy and International Affairs in Washington, D.C., and in Germantown, Maryland, as well as officials at DOE’s field locations in Albuquerque and Los Alamos, New Mexico, and in Livermore, California. We also met with contractor officials at the Lawrence Livermore National Laboratory in Livermore, California; the Los Alamos National Laboratory in Los Alamos, New Mexico; and the Sandia National Laboratories in Albuquerque, New Mexico. Furthermore, we met with officials from the FBI to obtain their views on the risk of, and control over, foreign visitors to DOE’s laboratories. In reviewing procedures on background checks for foreign visitors, we reviewed data on visits that occurred between January 1994 and December 1996. We examined records on visits and background checks contained in (1) DOE’s centralized computer database on foreign visitors, 6 DOE Security: Information on Foreign Visitors to the Weapons Laboratories (GAO/T-RCED-96-260, Sept. 26, 1996) and Department of Energy: Information on the Distribution of Funds for Counterintelligence Programs and the Resulting Expansion of These Programs (GAO/RCED-97-128R, Apr. 25, 1997). Page 21 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction (2) the laboratories’ badging office and local foreign visitor databases, and (3) DOE’s centralized counterintelligence database. We did not independently verify the accuracy of the information in these databases; however, we did obtain additional verification of visit information as necessary to complete our review. In particular, our analysis focused on the adequacy of DOE’s controls related to high-risk visitors (i.e., visitors from sensitive countries who potentially could have derogatory national security information on file). In this regard, we tracked information on such visitors by examining DOE’s records on background checks and by independently obtaining some background checks from the FBI. To examine the process used for identifying sensitive subjects and controlling the dissemination of such information to foreign visitors, we obtained and analyzed pertinent guidance on sensitive subjects and discussed with DOE and contractor officials (including some who had hosted foreign visitors) the methods by which visits involving sensitive subjects are identified. We examined records on several hundred visits that occurred from January 1994 through December 1996. We judgmentally selected for further analysis over 150 visits that were not identified as involving sensitive subjects and compared the visits’ purpose and/or subject with those identified on DOE’s sensitive subject list. We discussed these visits with DOE officials in its Nuclear Transfer and Supplier Policy Division, which is responsible for reviewing visits that involve sensitive subjects, to obtain their perspectives on the accuracy of the identification of sensitive subjects. Additionally, we followed up with researchers and managers at these laboratories who frequently host foreign visitors concerning whether individual research projects that involved foreign nationals involved sensitive subjects. To assess the security controls associated with foreign visitors’ access to certain areas and information within DOE’s laboratories, we obtained and examined security procedures, plans, surveys, and statements of threat. Our work included a review of laboratory security infractions, violations, and occurrences, as well as laboratory counterintelligence contact/incident reports. Additionally, we obtained unclassified program and building security assessments that identified problems and vulnerabilities. While touring laboratory facilities with security personnel, we observed the security controls in place for both classified and unclassified sensitive research. To review the counterintelligence programs, we interviewed DOE, laboratory, and FBI counterintelligence officials and obtained pertinent Page 22 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 1 Introduction documentation regarding the potential threat posed by foreign visitors to the weapons laboratories and DOE’s activities to counter this threat. In particular, we attended a classified counterintelligence briefing that was held for staff of DOE’s Albuquerque Operations Office, which discussed the foreign visitor threat. We also examined the laboratories’ counterintelligence contact/incident reports and observed the capabilities of DOE’s centralized counterintelligence database. In addition, we obtained and reviewed assessments of DOE’s counterintelligence programs that had been conducted by other organizations in the U.S. intelligence community. We encountered two limitations in our attempts to examine DOE’s controls over foreign visitors to its laboratories. First, our request to the CIA for access to data on the backgrounds of foreign visitors was denied on grounds of the sensitivity of the data. As a result, we were unable to review background information from the CIA that was on file at DOE or to independently obtain background data from the CIA. Second, we requested from the FBI specific information on possible espionage or other illegal activities at the laboratories. However, FBI officials told us that disclosure of such information is contrary to FBI policy; consequently, the requested information was not provided to us. We provided a draft of this report to DOE for its review and comment. DOE’s comments and our response are included at the end of chapter 5; the full text of DOE’s comments are included in appendix IV. Our work was conducted from July 1996 through September 1997 in accordance with generally accepted government auditing standards. Major contributors to this report are listed in appendix V. Page 23 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented Although foreign visitors provide many benefits to DOE’s programs, every one of their visits to a nuclear weapons laboratory poses a risk that sensitive information might be inadvertently or intentionally compromised. To minimize this risk, DOE’s foreign visitor order specifies several procedures that should be conducted before foreign nationals are allowed access to its laboratories. DOE has not effectively implemented two of the key procedures at the three laboratories we reviewed. More specifically: • Few national security background checks are being performed on visitors from sensitive countries. As a result, foreign nationals suspected by the U.S. counterintelligence community of having foreign intelligence affiliations have been permitted access to the laboratories without the advance knowledge of appropriate officials. • Because of unclear criteria regarding what constitutes sensitive subjects and the lack of an independent review process to examine the subjects to be discussed during visits, foreign visits involving potentially sensitive subjects—such as inertial confinement fusion, hydrodynamics codes,1 and the detection of nuclear weapons tests—are occurring without DOE’s knowledge. Without adequate knowledge about the foreign nationals who plan to visit its laboratories and the subjects to be discussed during those visits, DOE cannot take appropriate action to ensure that their visits are properly controlled. This heightens the risk that such visitors may obtain, either directly through active intelligence efforts or indirectly through involvement in laboratory activities, information whose disclosure to certain countries would be detrimental to the United States. Background checks can provide DOE and its weapons laboratories advance DOE Has Little warning of possible problems or concerns with a foreign visitor, and DOE’s Advance Knowledge foreign visitor order contains requirements for obtaining background About the checks for visitors from sensitive countries. However, DOE granted two laboratories—Los Alamos and Sandia—a partial exception from Backgrounds of Many complying with its requirements. As a result, few background checks have Visitors From been initiated for foreign visitors to those two facilities. Sensitive Countries 1 Among other things, hydrodynamics codes are used for computer simulations to model the dynamic processes that occur in a nuclear weapon. Page 24 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented Background Checks Are As part of its process to approve foreign visitors, DOE requires that national Intended to Help DOE security background checks (termed indices checks by DOE) be conducted Mitigate the Risks of Visits on certain foreign visitors to its laboratories. Under DOE’s order, background checks are required for all sensitive-country assignees (those whose visits will exceed 30 days). Additionally, background checks must be proposed by the laboratories to DOE’s Counterintelligence Division for short-term visitors from sensitive countries, but the division has the discretion to determine whether the background check should be done. For example, the Counterintelligence Division may choose to request background checks on sensitive-country visitors who will be entering security areas or discussing sensitive subjects. The checks are obtained from government intelligence and investigative agencies, such as the CIA and the FBI. At DOE’s request, these agencies review their files and report to DOE whether intelligence information of a derogatory nature exists about a particular visitor (e.g., that the visitor is suspected of having ties to a foreign intelligence service or terrorist group). DOE’s order also requires that some background checks—those considered necessary to approve a visit or assignment—be completed before the visit or assignment begins. Many other checks done on visitors need not be completed before the visit begins—these are checks considered needed for counterintelligence research purposes only. Although DOE uses the results of these background checks to approve proposed visits and to help mitigate any risks related to them, the existence of derogatory information about a foreign visitor does not preclude a visit from occurring. According to DOE officials, if a background check reveals derogatory information about a foreign visitor, the visit is rarely denied. Instead, DOE allows the visit to occur but, depending on the results of the check and other factors, may increase the stringency of escort requirements or may restrict the length of the visit, the buildings to be accessed, or the subjects to be discussed. Thus, the background check serves as means to forewarn DOE and laboratory officials of possible national security concerns so they may devise appropriate countermeasures where needed. Few Background Checks Few background checks are performed for visitors to DOE’s Los Alamos Are Performed on and Sandia laboratories. In August 1994, these laboratories implemented a Sensitive-Country Visitors partial exception from the foreign visitor order that was granted by DOE. Under the terms of this exception, the two laboratories are required to to the Los Alamos and request background checks only on those foreign visitors planning to enter Sandia Laboratories a security area at the laboratory or to discuss sensitive subjects. According Page 25 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented to DOE and laboratory officials, the partial exception for Los Alamos and Sandia was granted because of the high volume of foreign nationals desiring to visit these weapons laboratories, which contributed to processing backlogs, and the costs associated with processing paperwork for foreign visitors. Laboratory officials said the processing backlogs caused delays that resulted in some visits having to be canceled because of uncompleted background checks. The partial exception has limited the number of requests for background checks on visitors to Los Alamos and Sandia. As a result, DOE obtains relatively few background checks on visitors to those laboratories, particularly in comparison to Livermore, which did not request an exception from the order’s requirements. Our review of DOE’s records of foreign visitors showed that, during the 3-year period from 1994 through 1996, background checks were obtained on only 5 percent of the visitors from sensitive countries to Los Alamos and Sandia. In contrast, Livermore requested checks on many more names during that timeframe, and background checks were obtained on 44 percent of the visitors from sensitive countries to this laboratory.2 Table 2.1 compares the number of background checks obtained on sensitive-country visitors for the three laboratories. Table 2.1: Background Checks That Were Obtained on Sensitive-Country Number of Visitors to DOE Weapons background Laboratories, 1994-1996 Facility Number of visits checks Percent checked Los Alamos 2,714 139 5 Livermore 1,602 700 44 Sandia 1,156 53 5 Total 5,472 892 16 Source: Compiled by GAO from DOE and laboratory data. Data on foreign visitors from individual sensitive countries also showed significant differences among the laboratories. For example, 46 percent of the Russian visitors to Livermore were checked during that 3-year period, compared to 10 and 7 percent, respectively, for Los Alamos and Sandia. Furthermore, 39 percent of the Chinese visitors to Livermore were checked, compared to 2 and 1 percent, respectively, for Los Alamos and Sandia. (See app. III for numbers and percentages for all sensitive countries.) 2 In addition, some names reported to headquarters did not result in checks because previous check results were on file at DOE headquarters and still current. Page 26 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented By checking the backgrounds of so few visitors from sensitive countries, particularly to Los Alamos and Sandia, DOE limits the collection of basic counterintelligence data and may be unknowingly allowing significant numbers of visitors with questionable backgrounds into its weapons laboratories. According to FBI counterintelligence officials, the low percentage of background checks conducted on Russian and Chinese visitors to Los Alamos and Sandia does not constitute effective use of the background check process. Statistics on the results of background checks DOE did request support this. Of all the background checks DOE obtained on visitors from sensitive countries to the weapons laboratories during the 1994 through 1996 timeframe, about 4 percent of the checks that DOE received indicated the existence of derogatory information. Moreover, we noted during our review that people with suspected foreign intelligence connections were let into the laboratories without background checks.3 We were able to document 13 instances where persons with suspected foreign intelligence connections were allowed access without background checks—8 visitors went to Los Alamos and 5 went to Sandia—during the 1994 through 1996 period.4 Available records also indicated that 8 other persons with suspected connections to foreign intelligence services were approved for access to Sandia during the period; however, DOE and Sandia lacked adequate records to confirm whether the persons actually accessed the facility. Although we could not confirm that any of these visits compromised U.S. security, at a minimum, the lack of a background check did not provide DOE the opportunity to implement countermeasures to mitigate the potential risk posed by these visits. Also, all of these instances occurred at the two weapons laboratories that had been granted a partial exception to DOE’s foreign visitor order. DOE’srequirements for national security background checks represent a continuing problem that we previously identified in a 1988 GAO report5 and about which elements of the U.S. intelligence community have also expressed concern. In discussing this problem, DOE and laboratory counterintelligence officials said that they recognize that the number of background checks obtained on foreign visitors has been limited, especially at Los Alamos and Sandia, and that these checks should be 3 Despite the restrictions on our access to information, as discussed in chapter 1, we verified through the U.S. counterintelligence community that several of these visitors had known or suspected connections with foreign intelligence services. 4 We also identified instances of persons with suspected intelligence connections obtaining laboratory access before background checks were completed. 5 GAO/RCED-89-31, Oct. 11, 1988. Page 27 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented routinely requested for visitors from sensitive countries. They added that although data from a background check—even derogatory data—is rarely used to deny a visitor access to a laboratory, obtaining such information is beneficial in identifying individuals known to be a risk. DOE headquarters counterintelligence officials said their long-term goal is to obtain background checks on all foreign nationals from sensitive countries that seek to visit any of these three laboratories. In the interim, according to a Sandia counterintelligence official, that laboratory is now reporting data on all sensitive country visitors to DOE headquarters for potential background checks. DOE has little assurance that all visits during which sensitive, but DOE Has Not unclassified, subjects will be discussed are identified and brought to the Adequately Ensured attention of DOE officials. According to DOE’s order, DOE officials are to That Visits Involving review and approve visits by foreign nationals that involve sensitive subjects. But DOE and laboratory personnel alike are unclear about what Sensitive Subjects Are constitutes a sensitive subject, and little or no independent review takes Identified and place to assess subjects within the context of the planned visit (e.g., taking into account the purpose of the visit, the particular aspects of the subject Reviewed to be discussed, and the foreign country and individuals involved). As a result, sensitive information could be discussed or otherwise disclosed to foreign nationals without DOE’s knowledge and approval. DOE Requires the To minimize the risk of inappropriate subjects being discussed with Identification, Review, and foreign nationals, DOE’s order requires that its laboratories identify any Approval of Visits visit involving a sensitive subject for review and approval by DOE. The order defines sensitive subjects as unclassified subjects involving Involving Sensitive information, activities, or technologies relevant to national security. To Subjects facilitate their identification, the order contains a list of sensitive subjects, including nuclear weapons production and supporting technologies, nuclear explosion detection, inertial confinement fusion, production and handling of plutonium, and fuel fabrication. Additionally, the order contains three criteria for identifying other subjects that may be sensitive. Subjects are considered sensitive if they relate to technologies under export control, “dual-use” technologies that have both peaceful and military applications, or rapidly advancing technologies that may become classified or placed under export control. Subjects in these categories include computer systems, component development, and software specifically designed for military applications; extremely high-energy, Page 28 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented high-brightness lasers and particle beams; and high energy density batteries and fuel cells. The responsibility for reviewing visits involving sensitive subjects rests with DOE’s Nuclear Transfer and Supplier Policy Division in the Office of Arms Control and Nonproliferation. This division also reviews private-sector exports of information and technology that could be useful to a foreign nuclear or nuclear weapons-related program. According to division officials, while the discussion of a sensitive subject with a foreign national is not necessarily prohibited, DOE needs to be aware of any such discussions to ensure their consistency with U.S. policy regarding the transfer of that information to the foreign national’s home country. The officials added that the need for DOE’s review and approval of the discussion of a sensitive subject is not dependent on the visitor’s home country—the discussion of any sensitive subject with a foreign visitor from even a nonsensitive country still requires DOE’s review and approval. Identification of Visits That DOE’s three weapons laboratories have not adequately identified visits Involve Sensitive Subjects involving sensitive subjects. Between January 1994 and July 1996, they Has Not Been Adequate identified a total of 72 visits involving sensitive subjects; the majority of these visits were related to areas specified as sensitive in DOE’s order. For example, 5 Russian citizens visited Los Alamos in 1994 for a 3-day visit involving nuclear materials control, accounting, physical protection, security, export control, and critical assembly facilities; 13 Russian nationals visited Los Alamos in 1995 for a 1-day workshop on plutonium stabilization, storage, and disposition; and 30 French nationals visited Livermore in 1995 for 1- to 2-year assignments to work on inertial confinement fusion. However, our review of records on 167 other visits found numerous cases that pertained to subjects that were either specified as sensitive in DOE’s order or were potentially sensitive but were not identified as such by the laboratories. For example: • Sixteen visits and assignments to Livermore involved inertial confinement fusion, a technology specifically listed as sensitive in DOE’s order. These visits included foreign visitors who were participating in a formal bilateral cooperative effort, including the transfer of proprietary data, between the United States and France on subjects related to inertial confinement fusion. On other occasions, Livermore has identified this type of visit as involving a sensitive subject. Page 29 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented • A Canadian citizen was on an assignment to Livermore to discuss equation of state measurements6 using laser-generated shock-waves—work that was acknowledged to be important to the inertial confinement fusion program, a sensitive subject area. • An Indian citizen from a defense-related facility in India was on an assignment to Los Alamos that involved the structure of beryllium compounds. Beryllium metal is used in nuclear weapons. • An Indian citizen was on assignment to Los Alamos for work related to pattern recognition/anomaly detection algorithms. This work was acknowledged to be dual use in nature, with applications related to national security, such as nonproliferation and satellite image processing, as well as to nondefense projects. • A Russian visit to Los Alamos involved collaboration on processes related to detecting unsanctioned nuclear weapons tests. Nuclear explosion detection is specifically identified as a sensitive subject in DOE’s order. • A citizen of the United Kingdom was assigned to Livermore for 3-dimensional hydrodynamic simulations for implosions. Hydrodynamics and 3-dimensional calculations are important to simulating nuclear weapons tests, particularly in light of the ban on nuclear testing. We reviewed copies of the documentation on these visits and discussed them with officials in DOE’s Nuclear Transfer and Supplier Policy Division to obtain their perspectives on whether they may have involved sensitive subjects. They said that it was not possible to fully ascertain whether these visits did or did not involve sensitive subjects; however, they pointed out that many of them appeared to involve subjects that are specifically identified as sensitive subjects in DOE’s order and that others appeared to have some weapons or dual-use applications. The export control officials said that, according to the stated purpose of the visits described in their documentation, they involved subjects that should have been sent for their review. Problems Hindering the DOE’s weapons laboratories have had problems identifying visits involving Identification of Visits sensitive subjects largely for two reasons—confusion over how to apply Involving Sensitive the sensitive subject criteria and the lack of an independent technical review of proposed foreign visits to identify those involving sensitive Subjects subjects. According to laboratory program managers and hosts of foreign visitors, DOE’scriteria for identifying sensitive subjects are very broad and do not 6 Equation of state measurements are used to assess how materials interact with their surroundings. Page 30 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented clearly define which activities are covered. The laboratory managers added that the current list of sensitive subjects is outdated, incomplete, and does not establish reasonable parameters within which they could reasonably gauge a subject’s sensitivity. As an example of the difficulty in applying the criteria, they noted that while inertial confinement fusion is listed as a sensitive subject because of its relationship to nuclear weapons testing, most aspects of this technology are unclassified and widely researched throughout the world and that the laboratory’s unclassified inertial confinement fusion work is published and freely disseminated. They added that without more specific criteria from DOE, they generally view activities in inertial confinement fusion and other areas that are unclassified, already published, or will ultimately be published, to be nonsensitive. DOE officials with the Nuclear Transfer and Supplier Policy Division acknowledged that although there are difficulties in identifying sensitive subjects, the laboratories are interpreting the order’s criteria too narrowly. They said that the sensitivity of a subject may at times be subjective and it often depends on the country to which the information will be divulged, the state of that country’s technology and research efforts, and other information on that country’s needs and intentions regarding the use of the technology. However, they added that hosts are not in a position to know that information and/or whether it is consistent with U.S. government policy to provide that information to the country in question. The list of sensitive subjects serves as a guideline to identify such visits for scrutiny by DOE officials who possess the necessary expertise to determine whether it is appropriate to discuss a particular subject with a foreign visitor from a specific country. A second problem hindering the identification of visits involving sensitive subjects is the lack of an independent review of proposed visits by individuals with technical expertise to help ensure sensitive subjects are properly identified. During the period of our review, DOE and the weapons laboratories relied upon the host—the laboratory employee sponsoring the foreign visitor—to accurately identify sensitive subject visits. Such visits were approved by the appropriate laboratory division management and by officials in the foreign visits and assignments office at each laboratory. However, little or no independent review of the subject of those visits had been conducted to ensure that sensitive subjects were not involved. At Sandia and Los Alamos, officials in the foreign visits and assignments office review requests for foreign visitor access; however, those individuals do not have a technical background or expertise to judge if a Page 31 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 2 Foreign Visitor Procedures Have Not Been Effectively Implemented sensitive subject is involved. At Livermore, visit requests are reviewed in the office of the laboratory director, as well as at the DOE operations office; however, this laboratory’s review has at times been delegated to individuals from the foreign visits and assignments office. Laboratory personnel from the foreign visits and assignments offices told us that they are not fully knowledgeable on activities that could be sensitive and that they generally rely on the host to determine whether a visit would involve a sensitive subject. DOE and Laboratories DOE and the weapons laboratories have recognized problems with Recognize Problems With identifying visits involving sensitive subjects and have begun actions to Identifying Visits Involving address them. In the fall of 1996, DOE initiated a multiissue effort to revise its foreign visit and assignment order. This effort will include examining Sensitive Subjects the controls over foreign visits involving sensitive subjects and developing a better process and/or criteria by which to identify them. According to officials in DOE’s Counterintelligence Division, which is involved in the effort, the revised order is expected to be issued by the end of 1997. However, because revision of the criteria for identifying sensitive subjects has not yet gotten underway and does not have a timetable for completion, they do not know if changes to clarify DOE’s criteria for identifying visits involving sensitive subjects will be included in the revised order. During our review, two of the three laboratories established interim local processes to examine requests for foreign visitors to better ensure that their visits do not involve discussions of sensitive subjects. In August 1996, Livermore began requiring that all visits involving foreign nationals from sensitive countries be reviewed by an official in its Arms Control and Treaty Verification Program who has had experience with nuclear weapons and associated technologies. These reviews are specifically to assess the technology involved and identify those requests that involve sensitive subjects. According to the Livermore official conducting these reviews, although most visits have not involved sensitive subjects, he has identified some visits of concern, for which actions were taken to help ensure that sensitive subjects would not be involved. In December 1996 Sandia began requiring that all requests for foreign visitors be reviewed by a Sandia official involved in export control to better ensure visits involving sensitive subjects are adequately identified. Page 32 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors Effective security controls can greatly mitigate the risk inherent with the presence of foreign visitors at DOE’s weapons laboratories. However, the security controls that exist in the laboratories’ controlled areas—the areas most often visited by foreign nationals—may not provide effective protection. The controlled areas contain unclassified, but sensitive information, and although security measures are used to control access, these measures are less stringent than those used in classified areas and their implementation varies among the laboratories. Security problems and vulnerabilities involving foreign nationals show that classified and/or sensitive information has been, or potentially could be, compromised by foreign nationals in the controlled areas. Nevertheless, DOE has not fully assessed the effectiveness of its security measures to protect sensitive information in controlled areas. To protect information from unauthorized disclosure or compromise, DOE Security and its laboratories use various levels of security that permit access for Requirements in authorized individuals to certain areas. Although some foreign visitors are Controlled Areas allowed access to the more restrictive security areas where classified work is conducted, most foreign visits occur in designated controlled areas—often termed property protection areas—which may contain unclassified sensitive information. A lower level of security is provided in these areas, and the controls used vary among the laboratories. Most Foreign Visitors Work DOE and the laboratories use a multilevel, graded security approach to limit in Controlled Areas access and protect information at their facilities. Open areas, which include locations on laboratory property to which the general public is allowed access, receive a low level of protection. Open areas can include cafeterias, visitors centers, and museums. Controlled areas, which receive a higher level of protection, can include small areas, such as an individual building, as well as larger areas, such as building complexes. Access to these areas is controlled because of the presence of valuable property or unclassified sensitive information, but no classified work is conducted in these locations. Unclassified sensitive information includes information that has been designated Official Use Only, proprietary, export controlled, Privacy Act, and Unclassified Controlled Nuclear Information. An even higher level of protection and stricter access limitations are maintained for security areas containing classified information and technologies or in which nuclear weapons or other classified research is conducted. These areas are closely monitored and patrolled, and controls Page 33 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors traditionally include guns, guards, and gates. Specific security plans must be developed and approved before any foreign visitor is allowed access to these areas and the visitor must be escorted at all times. Most foreign visitors to the weapons laboratories are granted access to the controlled areas. Laboratory records show that on average only about 5 to 10 percent of all foreign visitors are permitted into security areas where classified work is performed, and according to DOE and laboratory officials, such access is usually for a short period of time. The remaining visitors are either allowed into the controlled areas or meet with laboratory employees in open areas. DOE and laboratory officials were not able to identify the percentage of those visitors that went to controlled areas, but stated that most were allowed into these locations. Security Controls Vary Because valuable property and information that is unclassified, but Among the Laboratories sensitive, is located in controlled areas, DOE requires the laboratories to protect these areas through the use of a variety of security controls. Controls used to reduce the risks posed by foreign nationals in controlled areas include the following: • A distinctive identification badge must be worn by foreign visitors at all times. • Access is controlled by automated devices or by receptionist staff and manual visitor logs. Automated devices include equipment that reads encoded access cards and/or requires passwords. • Standard or “generic” security plans are drafted for controlling foreign visits in the area. • A host is designated, who is a laboratory employee responsible for the activities of the foreign national while at the laboratory. A visitor or assignee is not permitted to be a host. • Random searches are conducted on vehicles or hand-carried items entering or leaving the area. Among the three laboratories, however, the security controls associated with foreign visitors in controlled areas are not consistently applied. In particular, each of the laboratories has different requirements for allowing foreign visitors after-hours access. At Livermore, foreign visitors are not allowed unescorted after-hours access to controlled areas without the specific written approval of laboratory security officials and the concurrence of the local DOE field office. According to Livermore security officials, while they have granted such access for some foreign visitors, Page 34 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors they do not approve unescorted after-hours access for visitors from sensitive countries. At both Los Alamos and Sandia, unescorted after-hours access to controlled areas has been permitted. These laboratories have required the host to monitor the foreign visitor—that is, be aware of the foreign visitor’s location and activities—but not necessarily be physically present. Recently, Sandia revised its after-hours access policy. In November 1996, Sandia no longer allowed foreign nationals to have unescorted after-hours access to controlled areas without the approval of its counterintelligence office. According to Sandia and DOE officials, this change was made because of the potential for security problems that could result from unescorted access. Los Alamos, however, continues to allow unescorted after-hours access to preserve what one official described as an open “campus atmosphere” for researchers at its facilities. Laboratory policies also vary regarding random searches in controlled areas and the appearance of foreign visitor identification badges. While all of the laboratories officially permit random searches in controlled areas, at one of the laboratories such searches are discouraged during normal work hours. Additionally, the distinctive color and wording of badges for foreign visitors differ among the laboratories. For example, at Livermore those badges are white (for visits) or red (for assignments), at Los Alamos badges for foreign visitors are red, and at Sandia those badges are gray. Furthermore, unlike the badges at the other laboratories, Sandia’s badges contain no wording pertaining to the visitors’ countries of citizenship or indicating that the wearers are not U.S. citizens. Finally, neither Los Alamos nor Sandia has developed security plans—even generic ones—for foreign nationals who will be in controlled areas. The DOE order governing unclassified foreign visits and assignments identifies security plans as the basic means by which vital information is protected and requires they be developed. However, DOE and laboratory officials told us that because of the exception granted by DOE to these two laboratories—which also streamlined requirements for background checks and visit approvals—security plans are no longer required for visits to controlled areas. Livermore has not sought such an exception and requires a generic security plan for all foreign visitors to its controlled areas. Page 35 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors Available data from the weapons laboratories showed that the sensitive Security information in controlled areas has been vulnerable to compromise. Vulnerabilities and Between 1991 and 1997, laboratory security assessments and records Problems Have identified vulnerabilities and problems involving foreign visitors, and in buildings and programs to which those visitors had access. Records of Involved Foreign vulnerabilities and problems included improper releases of information Visitors and failures to follow security controls and requirements. Improper Releases of Assessments and records from all three laboratories indicated Information vulnerabilities and problems involving the improper release of unclassified sensitive information and classified information in unclassified settings. In most of these cases, the information was actually or potentially available to foreign visitors. Whether or not a laboratory employee personally hosts a foreign visitor, all laboratory employees must adequately protect classified or unclassified sensitive information and not disclose it unless authorized. However, examples of improper releases included the following: • Unclassified sensitive documents and materials had been improperly discarded in trash, recycling bins, or hallways. At one of the laboratories, six boxes of papers marked “sensitive material” in red letters on the outside were left in an open hallway in an area accessible to foreign visitors. • At one of the laboratories, a division’s open-access newsletter, which was accessible to the foreign visitors it was hosting, provided information on corporate and laboratory research agreements, the development of certain computer codes, and DOE’s nuclear program. • Classified information had been inadvertently divulged by laboratory employees during unclassified workshops or conferences to foreign visitors, some of whom were from sensitive countries. • A departmental newsletter containing classified information was sent to 24 uncleared individuals, 11 of whom were foreign visitors. Some of the foreign visitors were from a sensitive country. Failures to Follow Security Vulnerabilities and problems associated with employees’ failures to follow Requirements and Controls security requirements and controls were also identified in the laboratories’ records. The following are several examples: • In one case, a laboratory employee in a building to which foreign visitors had access failed to question the unauthorized removal, by members of a security assessment team during a test exercise, of a complete computer Page 36 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors system from a controlled area. The employee did not challenge the team’s activities despite the fact that its members were not wearing identification badges and were openly discussing plans to remove additional machines and equipment in an effort to appear suspicious. • On 10 separate occasions, a laboratory employee hosted visitors from sensitive countries without following visit approval requirements or gaining appropriate authorizations prior to those visits. Another host at the same laboratory met foreign visitors off-site without proper approval after a laboratory official advised him that he could “receive a reprimand, but it would not jeopardize his security clearance.” • In another case, a host, when confronted with a requirement to limit after-hours laboratory access of certain sensitive country assignees assisting him with his research, moved the visitors and his research to an off-laboratory location. • On several occasions, there were miscellaneous failures to follow security procedures, including computers left on and unattended without password protection, improper escorting of foreign visitors who required such oversight, and unauthorized back door entry to controlled areas where many foreign visitors had access. DOE and laboratory security officials told us that they are concerned about, but not surprised by, vulnerabilities and problems in controlled areas. The openness under which unclassified research programs operate poses a dilemma in an age of economic competitiveness. DOE’s own security awareness literature states that although many employees realize the importance of protecting classified information, few are aware of the significance of unclassified sensitive and proprietary information. Furthermore, DOE and laboratory security officials told us that the security consciousness of employees working in controlled areas is more relaxed than in security areas where classified research is conducted. While some security officials said that they would like to see a stronger emphasis on security in controlled areas at the laboratories, others said that some technical and research staff do not place a high priority on security and actually see it as an impediment to their work. Neither the laboratories nor DOE has fully assessed the controls over Protection of unclassified, but sensitive information. At the laboratories, operations Sensitive Information security (OPSEC) assessments are performed to identify vulnerabilities. in Controlled Areas However, only at Sandia has there been an assessment that specifically focused on controls over unclassified sensitive information in controlled Has Not Been Fully areas to which foreign visitors have access. Furthermore, while DOE has Assessed assessed overall laboratory security operations on a regular basis, its Page 37 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors assessments have not addressed the protection of unclassified sensitive information in controlled areas. DOE requires the use of OPSEC techniques and measures to help protect information and activities related to national security and government interests. The purpose of OPSEC is to disrupt or defeat the ability of foreign intelligence or other adversaries to acquire sensitive or classified information and to prevent the unauthorized disclosure of such information. Each of the laboratories has an OPSEC program and uses OPSEC assessments to identify security vulnerabilities associated with specific laboratory facilities or programs. To identify vulnerabilities, OPSEC personnel assess various practices, including physical security and access controls; visitor log and escort procedures; availability of sensitive information on bulletin boards, in meeting rooms, and in offices; document disposal and destruction methods; and computer access protections. While all three laboratories have performed OPSEC assessments, only Sandia has conducted an assessment specifically focused on controls over unclassified sensitive information in controlled areas to which foreign visitors have access. Sandia’s assessment was completed in March 1997, and although it found no indication that the laboratory had allowed foreign visitors to compromise proprietary or sensitive information, it concluded that Sandia needed to define a policy concerning areas and information sources to which foreign nationals should have access. Subsequently, Sandia changed the process for controlling foreign visitors’ access to, and work in, controlled areas. Foreign nationals visiting Sandia for more than 30 days now work in “export controlled zones”—locations within controlled areas where they can work with their respective project teams but are restricted from unauthorized access to research in the surrounding area. OPSEC assessments at Livermore or Los Alamos have not yet examined foreign visitors’ access to sensitive information. Livermore’s past OPSEC assessments have dealt with visitors in general, but have not specifically addressed foreign visitors and the potential for them to access sensitive information. Livermore’s OPSEC manager said that the laboratory plans to conduct two such assessments before the end of 1997. Similarly, Los Alamos’ OPSEC assessments have included some issues related to foreign visitors, such as their access to open and secure areas, but they have not focused on assessing whether foreign visitors could obtain sensitive information. Page 38 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 3 Security Controls May Not Adequately Protect Sensitive Information From Foreign Visitors In addition to the laboratories’ OPSEC assessments, DOE does broader periodic surveys of their security operations, including visits and assignments involving foreign nationals that are intended to be comprehensive assessments of each laboratory’s security operations. Generally, DOE’s surveys are performed every year or two, depending on the findings of the previous survey for a specific laboratory. The most recent surveys at Los Alamos and Sandia were completed in March and April of 1997, respectively. The most recent survey of Livermore’s program was completed in August 1996. In these surveys, each of the laboratory’s foreign visits and assignments program was rated satisfactory. However, the primary focus of these surveys was on the program’s organization, management, and operations, and not on information protection. As a part of DOE’s past surveys, each laboratory’s program was evaluated by conducting interviews, reviewing documentation, and testing performance. The surveys did not address protection of unclassified sensitive information in controlled areas—in general or in association with foreign visitors. For example, while several sections in the survey report on security at Livermore addressed the effectiveness of its controls over classified information, none addressed the adequacy of protections for unclassified sensitive information. Page 39 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved DOE’s headquarters and field counterintelligence programs are an important part of its defense against foreign espionage efforts at the nuclear weapons laboratories. Foreign visitors to these laboratories have open, often long-term, access to personnel with detailed knowledge and expertise in classified and/or sensitive matters. Although this situation is viewed by counterintelligence experts as an ideal opportunity for foreign intelligence-gathering efforts, DOE has not comprehensively assessed the threat of foreign intelligence against the laboratories. A thorough assessment that identifies countries of concern, the technologies and the information these countries are seeking, and the programs that are likely to be targets of foreign intelligence, is important for DOE and its laboratories to understand and reduce the dangers posed by foreign visitors. Furthermore, DOE has not developed any meaningful programmatic measures by which to evaluate the effectiveness of the laboratories’ counterintelligence programs nor has it periodically evaluated them. Recently, DOE initiated several actions to strengthen the counterintelligence programs, both at headquarters and at the laboratories. The mission of DOE’s counterintelligence programs is to implement DOE’s Headquarters effective defensive efforts departmentwide to deter and neutralize foreign and Laboratory government or industrial intelligence activities in the United States Counterintelligence directed at or involving DOE. DOE’s headquarters Counterintelligence Division, within the Office of Energy Intelligence, has overall Programs responsibility for this mission and counterintelligence activities throughout DOE. Staffed with seven DOE employees and seven contract employees, DOE’s Counterintelligence Division is responsible for such activities as conducting various threat assessments and identifying foreign intelligence activities directed against DOE as well as overseeing each laboratory’s counterintelligence program. DOE’s threat assessments can vary from a comprehensive threat assessment DOE-wide to a narrowly focused threat assessment that examines a specific issue, such as a particular foreign country’s interest in DOE’s assets. DOE’s Counterintelligence Division is responsible for implementing counterintelligence policies and procedures throughout DOE. This responsibility includes (1) developing and implementing methods, techniques, standards, and procedures for DOE’s counterintelligence activities; (2) establishing a briefing and debriefing program for foreign Page 40 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved travel and contacts; and (3) monitoring visits and assignments of foreign visitors to all of DOE’s facilities.1 Each laboratory has its own counterintelligence program, which is conducted in compliance with DOE’s requirements, and laboratory counterintelligence officers report directly to laboratory management. The laboratories’ programs emphasize employee briefings and debriefings as well increasing employees’ awareness and knowledge about counterintelligence. Briefings and debriefings of employees take place prior to and/or after an event (e.g., when hosting a foreign visitor or when taking a foreign trip). In briefings, counterintelligence officers provide information to employees on such concerns as the types of subjects to avoid discussing with foreign visitors. In debriefings, these officers obtain information from the employees that can help DOE determine if there are indications that intelligence services are trying to target that laboratory or its staff.2 Additionally, counterintelligence activities at each laboratory include initial investigations of possible foreign intelligence efforts to determine if referral to appropriate federal agencies would be warranted, liaison with federal agencies, and gathering and recording such basic counterintelligence information as foreign visitors’ activities at a laboratory and persons contacted. DOE officials estimate that operating the headquarters counterintelligence program costs about $1.8 million annually. For fiscal year 1996, DOE’s three weapons laboratories had a total counterintelligence program funding of $905,000 and 9.4 counterintelligence staff years—funding of $552,000 and 5.5 staff years at Livermore, funding of $100,000 and 1.1 staff years at Los Alamos, and funding of $253,000 and 2.8 staff years at Sandia.3 1 In addition, DOE field offices have counterintelligence program managers who are responsible for conducting a counterintelligence awareness program and providing briefings and debriefings related to foreign visitors and foreign travel. 2 Briefings and debriefings are not conducted for all events; counterintelligence officers judgmentally sample from the universe of events, according to such factors as the visitor’s country of origin or the subjects to be discussed. 3 Numbers for Sandia include its laboratories in New Mexico and California. Page 41 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved To understand the dangers posed by foreign visitors, DOE needs to perform DOE Has Not Clearly a comprehensive assessment of the threat to its laboratories by foreign Defined the Threat intelligence services. According to DOE and the FBI, the operation of an Posed by Foreign effective counterintelligence program is predicated upon a realistic and comprehensive examination of the foreign intelligence and insider threats. Visitors to Its For example, according to the FBI, only a comprehensive threat Laboratories assessment can address the issue of whether foreign intelligence services are making a concerted effort to target DOE laboratories, and if so, how they can work together to counter the threat. This threat assessment can also provide senior managers with an analysis of the global threat and the information and technologies at DOE and the laboratories that are most at risk. Specific assessments, which are targeted studies that focus on country-specific issues, and annual foreign visitor statistical studies are also important because they can inform the laboratories about items of counterintelligence concern. This information can then be used by counterintelligence officers at each laboratory to mitigate the potential risk to that laboratory and its employees. For instance, information contained in these studies can be used to alert a laboratory’s senior management and staff during briefings. While DOE officials recognize the importance of both types of assessments, DOE headquarters’ counterintelligence analysis has focused on the specific-type assessments and has not addressed the overall threat to its facilities. In recent years, DOE has done about 25 specific assessments, which have examined specific threats or, in some cases, have been statistical studies. For example, DOE has assessed the threat of Russian organized crime to DOE and Pakistan’s access to DOE’s resources. In many cases, such studies were based on the work of other agencies, such as the CIA or FBI, or were contracted out. While these studies can be useful in identifying a threat on a single issue, they do not relate the global foreign intelligence threat to the local situation at a specific weapons laboratory. DOE counterintelligence officials at headquarters said that they need to do a comprehensive threat assessment that relates the global foreign intelligence threat to the laboratories, but they have been limited in their ability to do so. They said that specific threat assessments have had a higher priority because these studies meet the more immediate needs of the laboratories. Moreover, DOE’s Counterintelligence Division has not had the staffing or analytical expertise required for this effort. In this regard, Page 42 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved DOE’scounterintelligence officials said that they will need to rely on information from other agencies to do a comprehensive threat assessment. Recognizing the need for a comprehensive threat assessment, in the fall of 1996 the then Deputy Secretary of Energy directed each of the weapons laboratories to conduct its own threat assessment, which DOE would then use to develop an overall, comprehensive threat assessment. Although the laboratories are in the process of completing their site threat assessments, according to a DOE counterintelligence official, the Department may not be able to develop a comprehensive assessment unless its priorities change and DOE receives assistance from the U.S. intelligence agencies in obtaining the sensitive intelligence information that is critical to develop this assessment. Oversight of the laboratories’ counterintelligence programs and their DOE Has Not activities—particularly setting expectations for program performance and Effectively Overseen periodically evaluating it—is one of the major responsibilities of DOE’s the Laboratories’ Counterintelligence Division. However, DOE has not developed meaningful performance measures or expectations for the laboratories’ Counterintelligence counterintelligence programs or conducted periodic evaluations of them. Programs DOE’s oversight, however, has been hampered, in part, because the funding for their programs has been through laboratory overhead accounts instead of directly from DOE. Meaningful performance measures for the laboratories’ counterintelligence programs are important because they would help gauge whether or not those programs are achieving their intended purposes. According to DOE Order 5670.3, Counterintelligence Program, DOE is responsible for developing and implementing performance measures for counterintelligence activities throughout the Department. However, according to a counterintelligence official at headquarters, DOE has not developed any performance measures or expectations to evaluate the laboratories’ counterintelligence programs because DOE’s contracts with the laboratories do not obligate their counterintelligence programs to follow any such measures DOE may develop. According to this official, DOE is considering both amending those contracts to address this problem and issuing guidance and policy to define performance measures and expectations for the laboratories to follow and be evaluated against. This will be done after DOE completes its comprehensive threat assessment. Page 43 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved DOE’s periodic evaluations of the laboratories’ counterintelligence programs are also important because they help provide assistance to each laboratory as well as determine the effectiveness of their programs. DOE’s counterintelligence order requires that the headquarters Counterintelligence Division oversee the implementation of counterintelligence policy and procedures at the laboratories. However, officials from that division could identify only one review it has conducted at the weapons laboratories, which occurred in 1996 in the form of a “staff assistance visit” conducted at Los Alamos. DOE concluded from this visit that because of inadequate staffing, Los Alamos’ counterintelligence program was not comprehensive and only minimally accomplished the requirements of DOE’s counterintelligence order. At that time, Los Alamos had one counterintelligence officer. Livermore and Sandia have not had their counterintelligence programs reviewed by DOE headquarters. According to a DOE official, evaluations at Livermore and Sandia have not occurred because of other higher-priority work, such as the specific type of threat assessments mentioned earlier. In addition, they said that DOE cannot require its laboratories to implement any recommendations that might result from such evaluations. Without periodic evaluations of all their counterintelligence programs, assessing their effectiveness and objectively comparing one program with another will be difficult. One factor that makes control by DOE headquarters over the laboratories difficult is that the counterintelligence programs are not funded directly by DOE’s Counterintelligence Division. Until recently, each laboratory’s program has been funded entirely from that laboratory’s funds and, consequently, each laboratory operated its program autonomously. Accordingly, each laboratory’s commitment to its program has differed, as illustrated by the difference in staffing levels. For example, while Livermore’s counterintelligence program had 5.5 staff years in 1996, Los Alamos’ program had only 1.1 staff years, despite having almost twice as many visitors from sensitive countries.4 According to the FBI, which has examined DOE’s counterintelligence program, the structure of DOE and its relationship with contractor-operated laboratories have resulted in their having assumed a high degree of autonomy. This has resulted in a gap between authority and responsibility, particularly when national interests compete with the specialized interests 4 Although both laboratories had equivalent numbers of foreign visitors (about 2,800), Los Alamos had nearly 1,000 visitors from sensitive countries, while Livermore had about 550 such visitors. Page 44 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved of the academic or corporate management that operate the laboratories. Furthermore, the FBI found that this autonomy has made national guidance, oversight, and accountability of the laboratories’ counterintelligence programs arduous and inefficient. Moreover, DOE’s Counterintelligence Division lacks direct management oversight and control to ensure the laboratories comply with its policies. This frequently puts the each laboratory’s counterintelligence staff in an awkward, if not difficult, situation of dividing their loyalties between the interests of the laboratory in pursuing cutting-edge research and development and the need to safeguard U.S. national security interests. DOE has recently recognized that its counterintelligence program has been DOE Is Taking Steps inadequate and has taken steps to strengthen it. The Congress to Strengthen Its appropriated $5 million to DOE in counterintelligence funding for fiscal Counterintelligence year 1997 in addition to its budget request, and DOE has used much of these funds to support the counterintelligence programs at the weapons Program laboratories.5 In November 1996, DOE’s Deputy Secretary expressed concerns about the presence of foreign visitors at the laboratories, and as a result, several departmentwide corrective actions are now underway. In the spring of 1996, the director of DOE’s Office of Energy Intelligence briefed the staff of several congressional committees about the concerns raised by the increasing number of foreign visitors to its laboratories and the threat they posed. In the fall of that year, the Congress provided DOE with an additional $5 million for fiscal year 1997 to expand counterintelligence activities at its weapons laboratories and other high-risk facilities. Of the $5 million, about half—$2.47 million—went to the three nuclear weapons laboratories.6 The additional funds were used to increase the number of counterintelligence staff at those laboratories and for counterintelligence-related analyses. As a result, DOE has increased the counterintelligence staff at the weapons laboratories. On November 21, 1996, the then Deputy Secretary of Energy initiated several corrective measures to improve DOE’s foreign visitors program. The Deputy Secretary met with officials of five DOE facilities: the three 5 On April 25, 1997, we reported to the Committee about DOE’s use of the $5 million. Department of Energy: Information on the Distribution of Funds for Counterintelligence Programs and the Resulting Expansion of These Programs, GAO/RCED-97-128R. 6 An additional $1.27 million went to five other facilities; the remainder ($1.26 million) was spent on counterintelligence analysis and assessment studies. When the $5 million was made available, however, some facilities reduced or eliminated the funding they had previously provided for counterintelligence and over $1 million was allocated to facilitywide support costs. Page 45 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 4 DOE’s Counterintelligence Efforts Can Be Improved weapons laboratories, the Oak Ridge National Laboratory, and the Pacific Northwest Laboratory. Among the corrective measures the Deputy Secretary and these officials agreed to complete during fiscal year 1997 were the following: • Develop training in export control and provide that training to laboratory staff at those five facilities. • Develop new guidance on unclassified, but sensitive, subjects (i.e., matters unsuitable for discussion with a foreign visitor). • Develop laboratory threat assessments of foreign visits and assignments. • Develop a DOE-wide comprehensive threat assessment of foreign visits and assignments. However, counterintelligence officials at headquarters expressed concerns about DOE’s ability to complete these initiatives because DOE has historically given its counterintelligence program a low priority and the tendency for the laboratories to resist headquarters management. They said that they are hopeful that DOE’s current Secretary will support these initiatives in the counterintelligence program. Page 46 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 5 Conclusions and Recommendations With the end of the Cold War, DOE’s nuclear weapons laboratories have been moving away from secret research toward more open and cooperative research with a variety of nations and an increasing number of foreign nationals. Open collaboration can greatly benefit DOE and the United States by stimulating the exchange of ideas and promoting cooperation. This in turn can lead to more efficient research and increase the likelihood of important scientific discoveries. While recognizing that such cooperation is beneficial, it is important to note that foreign espionage efforts against DOE’s weapons laboratories may be more active than ever. Furthermore, these efforts may have expanded to include industrial espionage. All of this puts new burdens on DOE’s security. To respond to these challenges, DOE cannot entirely rely on systems left over from the Cold War. For a long time, DOE’s security controls have emphasized “guns, guards, and gates,” as well as strict control over anyone, including foreign visitors, allowed to enter the weapons laboratories. Where visitors went, whom they talked to, and what they saw were more carefully controlled than they are today. These controls, while still necessary in some places, cannot be expected to work in locations where openness, collaboration, and free access to information and ideas are encouraged. In these places, DOE needs a more sophisticated security strategy that is consistent with the laboratories’ more open missions and includes a greater role played by DOE and laboratory counterintelligence programs. Now more than ever, effective counterintelligence efforts must be central to DOE’s security strategy. Greater counterintelligence program effectiveness can be achieved through the development of a comprehensive threat assessment to determine the nature, extent, and targets of foreign espionage efforts against DOE’s weapons laboratories. Such an assessment could also form the basis for developing counterintelligence program performance measures as well as periodic headquarters evaluations of each laboratory’s performance. These evaluations would determine how effectively each laboratory is addressing the established performance measures and how their counterintelligence programs can be improved. In addition to establishing performance measures for DOE’s counterintelligence program, other parts of the overall strategy could be improved by clarifying what constitute sensitive subjects, tightening procedures for background checks, and reassessing procedures for foreign visits to controlled areas. For example, clarifying what subjects are Page 47 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 5 Conclusions and Recommendations sensitive and requiring an independent review by technically qualified personnel of all subjects proposed for discussion during a visit would help ensure that researchers, program managers, and DOE headquarters officials would have the same understanding of what needs to be protected so discussions of sensitive subjects would not occur without the knowledge of DOE. DOE and laboratory officials recognize the problems with identifying sensitive subjects and have established internal review processes to better focus on those foreign visits that involve sensitive subjects. However, without a clear understanding of what information DOE considers sensitive, these improved review processes cannot provide adequate assurance that foreign visits involving sensitive subjects are appropriately identified and reviewed. Increasing the number of background checks on foreign visitors from sensitive countries will enable DOE to better assess individual situations from a security point of view. When necessary, actions can then be taken to mitigate the risks of a particular visit. While background checks cannot identify all foreign visitors who pose a risk, they are a valuable tool for alerting DOE and the laboratories of situations that may warrant more attention and control. DOE’s current foreign visitor order contains requirements that would increase the number of background checks obtained; enforcing those requirements at the laboratories, especially at Los Alamos and Sandia, should enable DOE to expand its advance knowledge of risks associated with the visits and, if necessary, mitigate those risks. Finally, a specific assessment of vulnerabilities related access to unclassified, but sensitive information in controlled areas is needed. This assessment will help ensure that procedures for these areas are consistent from laboratory to laboratory and security vulnerabilities and/or problems are identified and corrected. In addition, this assessment could identify best practices that DOE could disseminate for use to all laboratories for improving the protection of sensitive information that may be exposed to foreign visitors. We recommend that the Secretary of Energy: Recommendations • Direct DOE’s Counterintelligence Division to perform a comprehensive assessment of the espionage threat against DOE and the weapons laboratories to serve as the basis for determining appropriate countermeasures and resource levels for laboratory counterintelligence Page 48 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 5 Conclusions and Recommendations programs. To the extent possible, this assessment should include the laboratories as well as other agencies with appropriate expertise, such as the FBI and CIA. • Establish appropriate program performance measures and expectations for the laboratories’ counterintelligence activities and require periodic performance reviews to help determine if their activities are effectively preventing foreign espionage. • Revise DOE’s foreign visitor order to (1) clarify to all DOE and laboratory contractor personnel the specific types of unclassified, but sensitive, subjects that require protection from compromise by foreign nationals and (2) require that the subjects of visits be independently reviewed by experts with appropriate technical backgrounds—such as laboratory individuals involved in export control issues—to verify that visits involving sensitive subjects are adequately identified for DOE’s review. • Require that DOE and the weapons laboratories comply with the current foreign visitor order by obtaining background checks on all assignees from sensitive countries. Further, require the laboratories to inform headquarters of the names of all other proposed foreign visitors from sensitive countries so DOE’s Counterintelligence Division can obtain additional background checks at its discretion. • Require that security measures at each laboratory’s controlled areas—those most accessible to foreign visitors—be assessed to ensure that the controls over persons and information in these areas are effective. This assessment should also identify the best practices at each laboratory to improve protection of sensitive information that may be exposed to foreign visitors. DOE had no comments on the general nature of the facts in the report and DOE’s Comments and concurred with our recommendations. The Department, however, believes Our Response that the report overstates the value of background checks on foreign visitors. DOE believes that foreign intelligence services increasingly rely on “non-official collectors”—who would have clear background checks—instead of intelligence officers. We do not believe we are overvaluing background checks. We recognize that these checks are but one factor DOE considers in approving foreign visits. Nevertheless, the information obtained through background checks can be of importance in determining if additional risk is associated with a foreign visitor. Consequently, we are recommending that DOE complete background checks in accordance with its foreign visits and assignments order. Page 49 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Chapter 5 Conclusions and Recommendations DOE also suggested that we revise our recommendation on the assessments of information security in controlled areas. A key point in DOE’s suggested revision was to have the recommendation specify that an operations security assessment be done of each laboratory’s controlled areas, whereas we recommended only that an assessment be done. We did not revise our recommendation to specify this type of assessment because, while we believe that operations security principles and personnel must be part of any assessment of the laboratories’ controlled areas, other elements of DOE’s security programs can also provide value in an assessment. We do not want to be overly prescriptive on how and/or by whom these assessments be done. DOE also suggested that the wording of the recommendation more clearly focus on protecting sensitive information. We revised the recommendation to clarify that the assessments should identify the best practices to improve the protection of sensitive information. Finally, DOE’s response detailed a number of actions it has taken or plans to take to address the recommendations. We did not address these actions as part of our work. The full text of DOE’s comments are included in appendix IV. Page 50 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Page 51 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix I DOE’s List of Sensitive Countries Algeria Armenia Azerbaijan Belarus China Cuba Georgia (Republic of) India Iran Iraq Israel Kazakhstan Kyrgyzstan Libya Moldova North Korea Pakistan Russia Sudan Syria Taiwan Tajikistan Turkmenistan Ukraine Uzbekistan Page 52 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix II DOE’s List of Sensitive Subjects Page 53 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix II DOE’s List of Sensitive Subjects Page 54 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix III Number and Percentage of Background Checks Obtained for Foreign Visitors From Sensitive Countries to DOE’s Nuclear Weapons Laboratories, 1994-96 Countrya Livermore Los Alamos Sandia Visits Checks Percent Visits Checks Percent Visits Checks Percent Algeria 8 7 88 6 0 0 2 0 0 Armenia 1 0 0 6 0 0 1 0 0 b Azerbaijan 0 1 1 0 0 0 0 • Belarus 12 7 58 13 0 0 15 0 0 China 474 185 39 746 12 2 244 2 1 Cuba 4 1 25 0 0 • 0 0 • Georgia (Republic of) 0 0 • 0 0 • 4 0 0 India 193 85 44 407 5 1 214 7 3 Iran 26 11 42 20 0 0 19 0 0 Iraq 2 1 50 3 0 0 4 0 0 Israel 60 27 45 114 0 0 58 2 3 Kazakhstan 8 2 25 37 0 0 15 2 13 Kyrgyzstan 0 0 • 1 0 0 0 0 • Libya 2 0 0 0 0 • 0 0 • Moldova 0 0 • 3 0 0 0 0 • Pakistan 6 2 33 8 1 13 16 0 0 Russia 653 302 46 1,110 116 10 474 33 7 b Syria 2 3 5 0 0 0 0 • Taiwan 65 33 51 97 3 3 43 1 2 Turkmenistan 0 0 • 0 0 • 7 0 0 Ukraine 47 22 47 69 0 0 38 1 3 b Uzbekistan 0 1 0 0 • 2 0 0 a The following countries that changed status from sensitive to nonsensitive during 1994 are not included in this table: Argentina, Brazil, Bulgaria, Burma, Cambodia, Chile, El Salvador, Ethiopia, Romania, South Africa, South Korea, Vietnam, and Yugoslavia. b According to DOE, background checks outnumbered visits for Azerbaijan, Syria, and Uzbekistan because checks may have been obtained for planned visits that were later canceled. Source: GAO’s analysis of data from DOE and the weapons laboratories. Page 55 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 56 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 57 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 58 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 59 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 60 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 61 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix IV Comments From the Department of Energy Page 62 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Appendix V Major Contributors to This Report Gary L. Jones, Associate Director Resources, William F. Fenzel, Assistant Director Community, and Dave Brack Economic John R. Schulze Development Division Washington, D.C. James C. Charlifue Denver Regional Frank B. Waterous Office (141002) Page 63 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with "info" in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov PRINTED ON RECYCLED PAPER United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested
Department of Energy: DOE Needs to Improve Controls Over Foreign Visitors to Weapons Laboratories
Published by the Government Accountability Office on 1997-09-25.
Below is a raw (and likely hideous) rendition of the original report. (PDF)