oversight

Department of Energy: DOE Needs to Improve Controls Over Foreign Visitors to Weapons Laboratories

Published by the Government Accountability Office on 1997-09-25.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                  United States General Accounting Office

GAO               Report to the Committee on National
                  Security, House of Representatives



September 1997
                  DEPARTMENT OF
                  ENERGY
                  DOE Needs to Improve
                  Controls Over Foreign
                  Visitors to Weapons
                  Laboratories




GAO/RCED-97-229
      United States
GAO   General Accounting Office
      Washington, D.C. 20548

      Resources, Community, and
      Economic Development Division

      B-277671

      September 25, 1997

      The Honorable Floyd D. Spence
      Chairman
      The Honorable Ronald V. Dellums
      Ranking Minority Member
      Committee on National Security
      House of Representatives

      As directed by the Committee in House Report No. 104-563, this report addresses the
      Department of Energy’s (DOE) controls over foreign visitors to its three nuclear weapons
      laboratories. Specifically, the report discusses DOE’s (1) procedures for reviewing the
      backgrounds of foreign visitors and for controlling the dissemination of sensitive information to
      such visitors, (2) security controls for limiting foreign visitors’ access to areas and information
      within its laboratories, and (3) counterintelligence programs for mitigating the potential threat
      posed by foreign visitors.

      As arranged, unless you publicly announce its contents earlier, we plan no further distribution
      of this report until 30 days after the date of this letter. At that time, we will provide copies of the
      report to the Secretary of Energy; the Director, Office of Management and Budget; and other
      interested parties. We will also make copies available to others upon request.

      Please call me on (202) 512-3841 if you or your staffs have any questions. Major contributors to
      this report are listed in appendix V.




      Victor S. Rezendes
      Director, Energy, Resources,
        and Science Issues
Executive Summary


             With the end of the Cold War, the Department of Energy’s (DOE) weapons
Purpose      laboratories are moving away from secret nuclear weapons research
             toward unclassified cooperative research involving a variety of nations
             and an increasing number of foreign visitors. This openness greatly
             benefits DOE and the United States by stimulating the exchange of ideas,
             promoting cooperation, and enhancing research efforts. However, while
             foreign visitors are providing benefits to DOE’s programs, the weapons
             laboratories are key targets of foreign intelligence interest, according to
             counterintelligence experts, thus raising concerns about possible
             espionage efforts against those laboratories, including industrial
             espionage.

             To guard against foreign nationals’ obtaining information that would be
             detrimental to U.S. security or business interests, DOE has established
             various controls to minimize the risk of foreign espionage. However, past
             work done by GAO in 1988 and more recently by elements of the U.S.
             intelligence community has shown problems with DOE’s controls over
             foreign visitors to its laboratories.1 Moreover, because the number of
             foreign visitors to the laboratories increased over 50 percent from the
             late-1980s to the mid-1990s, additional burdens have been placed on the
             controls DOE has in place to manage foreign visits. The high number of
             foreign visitors, as well as some recent investigative cases involving
             foreign nationals at DOE’s laboratories, have increased concerns that the
             laboratories are targets of foreign espionage.

             Because of these concerns, the House Committee on National Security, in
             a May 1996 report, directed GAO to determine how well DOE has been
             managing foreign visits to the weapons laboratories. Accordingly, GAO
             assessed DOE’s (1) procedures for reviewing the backgrounds of foreign
             visitors and for controlling the dissemination of sensitive information to
             them, (2) security controls for limiting foreign visitors’ access to areas and
             information within its laboratories, and (3) counterintelligence programs
             for mitigating the potential threat posed by foreign visitors.


             Historically, the Lawrence Livermore National Laboratory, the Los Alamos
Background   National Laboratory, and the Sandia National Laboratories have been
             responsible for conducting research and development for DOE’s nuclear
             weapons program. The laboratories are also world-leading centers of
             research in many technologies and scientific disciplines and conduct a

             1
              Nuclear Nonproliferation: Major Weaknesses in Foreign Visitor Controls at Weapons Laboratories
             (GAO/RCED-89-31, Oct. 11, 1988).



             Page 2              GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                   Executive Summary




                   broad range of nonnuclear research activities in such areas as
                   biomedicine, high-performance computers, and environmental restoration.
                   DOE’s policy encourages international cooperation in unclassified energy
                   and science programs to obtain the benefits of scientific and technical
                   advances from other countries and to minimize research costs.
                   Consequently, each year thousands of foreign nationals visit these three
                   laboratories to participate in cooperative research or laboratory programs.

                   DOE  Order 1240.2b establishes controls over unclassified foreign visits
                   (stays of up to 30 days) and assignments (extended stays of up to 2 years).2
                    Among other things, this order requires that DOE obtain background
                   information on certain proposed visitors from sensitive countries—
                   countries considered to be a risk to security or nuclear proliferation. The
                   order also requires that DOE review and approve visits involving
                   information that, although unclassified, is considered sensitive for such
                   reasons as its potential to enhance nuclear weapons capability, lead to
                   nuclear proliferation, reveal advance technologies, or have “dual-use”
                   applications (technologies that have both peaceful and military uses). In
                   addition, each weapons laboratory has security procedures for controlling
                   foreign nationals’ access to its facilities. Furthermore, DOE has established
                   counterintelligence programs at headquarters and the laboratories to
                   mitigate the risk of foreign espionage, increase employee awareness, and
                   brief and debrief employees serving as hosts to foreign visitors.
                   Counterintelligence programs have become more important as the number
                   of foreign visitors has increased.


                   DOE’s procedures for obtaining background checks and controlling the
Results in Brief   dissemination of sensitive information are not fully effective. DOE has
                   procedures that require obtaining background checks, but these
                   procedures are not being enforced. At two of the laboratories, background
                   checks are conducted on only about 5 percent of the foreign visitors from
                   countries that DOE views as sensitive. GAO’s review of available data from
                   DOE and the Federal Bureau of Investigation showed that some of the
                   individuals without background checks had suspected foreign intelligence
                   connections. Furthermore, DOE’s procedures lack clear criteria for
                   identifying visits that involve sensitive subjects and process controls to
                   help ensure that these visits are identified. As a result, sensitive subjects
                   may have been discussed with foreign nationals without DOE’s knowledge
                   and approval.

                   2
                    For purposes of this report, we use “visit” as a generic term for both short-term visits or long-term
                   assignments. However, we do make distinctions between visits (or visitors) and assignments (or
                   assignees) in situations where such distinctions are significant.



                   Page 3                GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                          Executive Summary




                          DOE’s security controls, such as access restrictions, in the areas most
                          visited by foreign nationals do not preclude their obtaining access to
                          sensitive information, and problems with the control of this
                          information—such as sensitive information being left in an open hallway
                          accessible to foreign visitors—have occurred at the laboratories.
                          Furthermore, DOE has not evaluated the effectiveness of the security
                          controls over this information in those areas most frequented by foreign
                          visitors.

                          The DOE headquarters and laboratory counterintelligence programs are key
                          activities for identifying and mitigating foreign intelligence efforts, but
                          these programs have lacked comprehensive threat assessments, which
                          identify likely facilities, technologies, and programs targeted by foreign
                          intelligence. Such assessments are needed as a critical component of a
                          more sophisticated security strategy that is consistent with the
                          laboratories’ more open missions. Furthermore, DOE could use these
                          assessments to develop the performance measures needed to guide the
                          laboratories’ counterintelligence programs and to gauge their
                          effectiveness. Currently, DOE has not developed such performance
                          measures or evaluated the effectiveness of its counterintelligence
                          programs.



Principal Findings

Procedures Are Not        DOE  Order 1240.2b requires the laboratories to submit information to DOE
Effectively Implemented   for background checks for all foreign visitors from sensitive countries and
                          to obtain these checks in advance for those who are on assignment at the
                          laboratories. Consistent with these requirements, Livermore obtained
                          background checks on 44 percent of its visitors from sensitive countries.
                          However, to reduce costs and processing backlogs, the Los Alamos and
                          Sandia laboratories implemented in 1994 a partial exception that DOE had
                          granted to the order that largely avoided the background check process.
                          Since then, DOE has obtained background checks on about 5 percent of the
                          visitors from sensitive countries to these two laboratories. GAO’s review of
                          available data from DOE and the Federal Bureau of Investigation showed
                          that, as a result of obtaining fewer background checks for foreign visitors
                          to these laboratories, questionable visitors, including suspected foreign
                          intelligence agents, had access to the laboratories without DOE and/or
                          laboratory officials’ advance knowledge of the visitors’ backgrounds.




                          Page 4          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                          Executive Summary




                          DOE’s existing procedures for identifying sensitive subjects lack clear
                          criteria for determining which subjects are sensitive and process controls
                          to help ensure that proposed visits involving potentially sensitive subjects
                          are reviewed by officials at DOE headquarters. Consequently, although the
                          laboratories identified 72 visits involving sensitive subjects during the 1994
                          to 1996 timeframe, GAO identified other visits that occurred without DOE’s
                          review and approval and that may have involved sensitive subjects, such
                          as inertial confinement fusion (a technology with both energy and nuclear
                          weapons applications) and the detection of nuclear weapons testing.
                          Although DOE and laboratory officials have recognized problems with
                          identifying sensitive subjects and are taking actions to better identify
                          them, their actions are not yet completed.


Security Controls Leave   The controls in the areas of the laboratories that are most often visited by
Vulnerabilities           foreign nationals do not preclude their access to sensitive information.
                          Foreign visitors are generally allowed into “property protection,” or
                          controlled areas. These areas have lower levels of controls than do
                          security areas in which classified work is conducted. For example, in
                          contrast to the controls in place in security areas, foreign visitors are, in
                          some cases, allowed unescorted, 24-hour access to facilities in controlled
                          areas. Security problems and vulnerabilities involving foreign visitors and
                          sensitive—and in some cases even classified—information have occurred
                          or been identified by the laboratories. For example, at one laboratory,
                          several boxes marked “sensitive materials” were left in a hallway
                          accessible to foreign visitors. At another laboratory, classified information
                          was included in a newsletter sent to 11 foreign nationals.

                          Thorough assessments and surveys of the controls over foreign visitors’
                          access to sensitive information have not been conducted. Although some
                          security assessments of limited scope done by the laboratories have
                          demonstrated the vulnerability of sensitive information to being
                          compromised, these assessments have generally examined specific
                          buildings or programs and have not focused on controls over sensitive
                          information in the areas most accessed by foreign visitors. Likewise, DOE’s
                          broader security surveys of its weapons laboratories have not assessed the
                          effectiveness of the controls over sensitive information, either in general
                          or in relation to foreign visitors.


Counterintelligence       DOE’s counterintelligence programs have not been based on a
Programs Could Be         comprehensive threat assessment that examines the nature and extent of
Improved                  foreign espionage activities. Such an assessment would analyze the


                          Page 5          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                  Executive Summary




                  countries of concern and identify for the entire Department the
                  technologies, information, and programs likely to be targeted by these
                  countries. Counterintelligence officials at both DOE and the Federal Bureau
                  of Investigation believe this assessment is needed as a basis for guiding
                  DOE’s counterintelligence programs and ensuring that their efforts are
                  properly focused; however, DOE has not conducted such an assessment
                  because of programmatic priorities and the lack of sufficient analytical
                  expertise. Furthermore, DOE has not provided detailed oversight of the
                  laboratories’ counterintelligence programs. In this regard, DOE has not
                  developed expectations and performance measures for those programs or
                  periodically evaluated them.

                  DOE  is now taking steps to improve its counterintelligence programs. The
                  Congress provided DOE with an additional $5 million in fiscal year 1997 to
                  expand counterintelligence activities; DOE is using about half of these
                  funds for the counterintelligence programs at the three nuclear weapons
                  laboratories. Also, DOE and the laboratories are undertaking various
                  initiatives to improve their counterintelligence efforts, such as developing
                  more thorough threat assessments. Although implementation of these
                  improvements is scheduled for the end of fiscal year 1997, DOE
                  counterintelligence officials raised concerns that the Department may not
                  fully implement these improvements in light of its historical lack of
                  support for its counterintelligence program.


                  GAO  is making several recommendations to the Secretary of Energy that
Recommendations   are designed to (1) obtain background checks on more of the foreign
                  visitors to the Department’s weapons laboratories, (2) improve the
                  identification and review of visits by foreign nationals that involve
                  sensitive subjects, (3) more thoroughly assess the adequacy of security
                  procedures in unclassified areas of the weapons laboratories, and
                  (4) enhance the effectiveness of counterintelligence programs at DOE’s
                  headquarters and laboratories.


                  GAO provided a draft of this report to DOE for its review and comment. In its
Agency Comments   written response, DOE had no comments on the general nature of the facts
                  presented in the draft report and concurred with all the recommendations.
                  DOE believes, however, that the report overstates the value of background
                  checks on foreign visitors. GAO recognizes that background checks are but
                  one factor to be considered in approving foreign visits and recommends
                  only that DOE obtain background checks in accordance with its foreign



                  Page 6          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Executive Summary




visit and assignment order. DOE also suggested that GAO revise the language
for one recommendation regarding an assessment of security procedures
at each laboratory. Although DOE suggested that GAO specify that a certain
type of assessment be conducted, GAO did not revise the recommendation
in order to avoid being overly prescriptive in how such assessments are
performed. Finally, as DOE suggested, GAO clarified the recommendation to
focus more clearly on protecting sensitive information.

DOE’sresponse also detailed a number of initiatives it has taken or plans to
undertake that address the recommendations. DOE’s comments and GAO’s
evaluation are included at the end of chapter 5; the full text of DOE’s
comments are included as appendix IV.




Page 7          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Contents



Executive Summary                                                                                       2


Chapter 1                                                                                              10
                        DOE’s Weapons Laboratories                                                     10
Introduction            Controls Over Foreign Visits to the Weapons Laboratories                       16
                        Concerns Exist About the Potential Compromise of Sensitive                     19
                          Information
                        Objectives, Scope, and Methodology                                             21

Chapter 2                                                                                              24
                        DOE Has Little Advance Knowledge About the Backgrounds of                      24
Foreign Visitor           Many Visitors From Sensitive Countries
Procedures Have Not     DOE Has Not Adequately Ensured That Visits Involving Sensitive                 28
                          Subjects Are Identified and Reviewed
Been Effectively
Implemented
Chapter 3                                                                                              33
                        Security Requirements in Controlled Areas                                      33
Security Controls May   Security Vulnerabilities and Problems Have Involved Foreign                    36
Not Adequately            Visitors
                        Protection of Sensitive Information in Controlled Areas Has Not                37
Protect Sensitive         Been Fully Assessed
Information From
Foreign Visitors
Chapter 4                                                                                              40
                        DOE’s Headquarters and Laboratory Counterintelligence                          40
DOE’s                     Programs
Counterintelligence     DOE Has Not Clearly Defined the Threat Posed by Foreign                        42
                          Visitors to Its Laboratories
Efforts Can Be          DOE Has Not Effectively Overseen the Laboratories’                             43
Improved                  Counterintelligence Programs
                        DOE Is Taking Steps to Strengthen Its Counterintelligence                      45
                          Program

Chapter 5                                                                                              47
                        Recommendations                                                                48
Conclusions and         DOE’s Comments and Our Response                                                49
Recommendations


                        Page 8         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
             Contents




Appendixes   Appendix I: DOE’s List of Sensitive Countries                                   52
             Appendix II: DOE’s List of Sensitive Subjects                                   53
             Appendix III: Number and Percentage of Background Checks                        55
               Obtained for Foreign Visitors From Sensitive Countries to DOE’s
               Nuclear Weapons Laboratories, 1994-96
             Appendix IV: Comments From the Department of Energy                             56
             Appendix V: Major Contributors to This Report                                   63

Table        Table 2.1: Background Checks That Were Obtained on                              26
               Sensitive-Country Visitors to DOE Weapons Laboratories,
               1994-1996

Figures      Figure 1.1: Lawrence Livermore National Laboratory                              11
             Figure 1.2: Los Alamos National Laboratory                                      13
             Figure 1.3: Sandia National Laboratories                                        15
             Figure 1.4: Unclassified Foreign Visits to DOE’s Weapons                        17
               Laboratories, 1994-96




             Abbreviations

             CIA        Central Intelligence Agency
             DOE        Department of Energy
             FBI        Federal Bureau of Investigation
             GAO        General Accounting Office
             OPSEC      operations security


             Page 9          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1

Introduction


                Although the Cold War has ended, the threat of foreign espionage to the
                nation still exists from a variety of countries, and recent revelations of
                intelligence activities against the United States involving Russia, China,
                and South Korea have raised concerns that such activities are on the
                increase. The Department of Energy (DOE) and its facilities, especially its
                nuclear weapons laboratories, are key targets of foreign intelligence
                interest. Not only do these laboratories conduct activities related to the
                design, construction, and maintenance of nuclear weapons—a
                long-standing target of foreign espionage—but they also conduct research
                into many areas of high technology, such as laser fusion, high-performance
                computers, and microelectronics. Their research is often done in
                collaboration with industry, and sometimes foreign countries, to develop
                new technologies for commercial applications. Accordingly, their work is
                of interest to other countries, and thousands of foreign nationals visit
                these laboratories each year to participate in such research. The high
                number of foreign visitors, as well as some recent investigative cases
                involving foreign nationals at DOE’s laboratories, have increased concerns
                that these laboratories are targets of foreign espionage efforts.


                DOE’s nuclear weapons laboratories—the Lawrence Livermore National
DOE’s Weapons   Laboratory in California and the Los Alamos National Laboratory and
Laboratories    Sandia National Laboratories in New Mexico—have been the cornerstones
                of the U.S. weapons program for over 40 years. In this regard, they are
                unique among DOE’s laboratories.1 Government-owned and
                contractor-operated, these three laboratories have been assigned specific
                missions for nuclear weapons development as well as other programmatic
                responsibilities. Over time, the laboratories have increasingly expanded
                their responsibilities in nondefense research areas.

                The Lawrence Livermore National Laboratory is operated by the
                University of California for DOE. Established in 1952, the laboratory
                occupies 1-square mile in Livermore, California. The laboratory’s major
                missions include nuclear weapons research and development to ensure
                the safety, security, and reliability of the U.S. nuclear weapons stockpile;
                other weapons and defense-related activities for DOE and the Department
                of Defense; inertial confinement fusion (a technology that has both energy
                and nuclear weapons testing applications); and nuclear nonproliferation.




                1
                 DOE has 9 multiprogram and approximately 21 specialized laboratories.



                Page 10              GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                         Chapter 1
                                         Introduction




Figure 1.1: Lawrence Livermore National Laboratory




                                         Source: Lawrence Livermore National Laboratory.




                                         The Los Alamos National Laboratory, also operated by the University of
                                         California for DOE, was established in 1943 as part of the Manhattan
                                         Project that developed the first nuclear weapons. Located approximately
                                         35 miles from Santa Fe, New Mexico, the laboratory covers an area of




                                         Page 11             GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




approximately 43 square miles. The laboratory conducts an array of
classified and unclassified activities, including all phases of nuclear
weapons research, design, and testing; other weapons-related research for
DOE; and management of special nuclear materials, such as plutonium.
Recently, Los Alamos was given responsibility for the production of
certain weapons components.




Page 12        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                         Chapter 1
                                         Introduction




Figure 1.2: Los Alamos National Laboratory




                                         Source: DOE.




                                         Page 13        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




The Sandia National Laboratories are operated for DOE by the Lockheed
Martin Corporation. Sandia, established in 1949, is located in Albuquerque,
New Mexico, and works in conjunction with Livermore and Los Alamos to
design and develop nuclear weapons.2 Sandia conducts research,
development, and engineering on all facets of weapons design and
development except the nuclear explosive components. Sandia also
produces some of the nonnuclear components, such as neutron
generators, that are needed for nuclear weapons.




2
 Sandia also has a facility located adjacent to the Livermore laboratory in California.



Page 14               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                           Chapter 1
                                           Introduction




Figure 1.3: Sandia National Laboratories




                                           Source: DOE.




                                           Although the Livermore, Los Alamos, and Sandia laboratories are involved
                                           in research and development activities related to nuclear weapons, in
                                           recent years many of their efforts have expanded beyond issues strictly
                                           related to defense or national security. The laboratories are now involved
                                           in such areas as high-performance computers, lasers, and
                                           microelectronics. Furthermore, they perform research in such diverse




                                           Page 15        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                        Chapter 1
                        Introduction




                        areas as biomedicine, environmental restoration, and global climate
                        change. In addition, the laboratories are working with industry to develop
                        new technologies and products for the commercial market. Such activities
                        include work on advanced automobile propulsion systems, medical
                        applications, and waste management. Furthermore, each laboratory
                        conducts basic scientific research in areas of its own choosing—termed
                        Laboratory Directed Research and Development. This research involves
                        such subjects as astrophysics and space science, particle physics,
                        materials science, and chemistry.


                        Because the Livermore, Los Alamos, and Sandia laboratories are
Controls Over Foreign   world-leading centers of research in many technologies and scientific
Visits to the Weapons   disciplines, many foreign scientists are attracted to them and invited to
Laboratories            come there to exchange information or participate in research activities.
                        DOE’s policy supports an active program of unclassified visits to these
                        laboratories for the benefit of its programs.3 In fact, DOE and the
                        laboratories have cooperative activities with certain countries to exchange
                        scientists and information and to collaborate on research in selected
                        scientific areas.

                        With the easing of global tensions since the breakup of the Soviet Union
                        and the changing missions of the weapons laboratories, the number of
                        unclassified foreign visits to the laboratories has increased significantly.
                        The average annual number of visits by foreign nationals to the
                        laboratories has increased over 50 percent from the late-1980s to the
                        mid-1990s. Furthermore, this increase in foreign visitors is continuing. As
                        shown in figure 1.4, the number of unclassified foreign visits to the
                        laboratories has increased each of the last 3 years, to a level of about 7,000
                        visits in 1996. This represents a significant portion of the 20,000 or more
                        unclassified foreign visits estimated by DOE to have occurred at all of its
                        laboratories during 1996.




                        3
                         DOE allows classified foreign visits that relate to information on nuclear weapons; however,
                        according to DOE, visits involving classified information are limited mainly to foreign nationals from
                        the United Kingdom and countries in the North Atlantic Treaty Organization.



                        Page 16               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                          Chapter 1
                                          Introduction




Figure 1.4: Unclassified Foreign Visits
to DOE’s Weapons Laboratories,            10000     Number of visits
1994-96

                                           8000
                                                                                                                            6998

                                                                                                                     6212
                                                                                                              5983
                                           6000




                                           4000

                                                                                    2826               2811
                                                                        2404 2392          2555 2542

                                           2000
                                                           1278 1361
                                                    1024


                                              0

                                                      Sandia              Livermore         Los Alamos         Total



                                                                 1994

                                                                 1995

                                                                 1996



                                          Source: GAO’s analysis of data from DOE and its laboratories.




                                          Allowing foreign nationals to visit the weapons laboratories and
                                          participate in their unclassified activities provides valuable benefits to the
                                          laboratories and the country, such as using the visitors’ skills to increase
                                          the chances of making significant scientific advancements. However,
                                          because such visits are not without risk, DOE Order 1240.2b—Unclassified
                                          Visits and Assignments by Foreign Nationals, September 3,
                                          1992—establishes responsibilities and policies and prescribes
                                          administrative procedures for controlling unclassified visits and
                                          assignments to DOE’s facilities. Until recently, the foreign visitor program
                                          was principally administered by the Office of Policy and International
                                          Affairs, but in March 1997 this responsibility was transferred to the Office
                                          of Resource Management in the Office of Nonproliferation and National
                                          Security. Other principal organizations involved in administering and
                                          controlling unclassified foreign visits include the Nuclear Transfer and
                                          Supplier Policy Division, Office of Arms Control and Nonproliferation; the



                                          Page 17                  GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




Office of Safeguards and Security, Office of Security Affairs; the
Counterintelligence Division, Office of Energy Intelligence; the
appropriate headquarters program office that is sponsoring the visit; DOE
field offices; and laboratory management.

As defined by the order, visits are short-term stays of 30 days or less for
the purposes of orientation, technical discussions, observation of projects
or experiments, training, or discussion of collaboration on topics of
mutual interest. Assignments are long-term stays of more than 30 days
(within a 12-month period) to actively participate in the work of a facility
or contribute to its projects. Assignments are limited to 2 years but may be
extended. Assignees may include foreign nationals who are employees, as
well as those who are guests or consultants.4 According to DOE’s estimates,
over 25 percent of the foreign visitors to its weapons laboratories are
assignees.

DOE’s  foreign visit and assignment order identifies several requirements for
reviewing, approving, and documenting foreign nationals’ access to its
nuclear weapons laboratories. Although the order, in general, allows most
foreign nationals access with little oversight by DOE, the Department views
some visits and assignments to be of potential concern. These include
visits from countries DOE considers sensitive for reasons of national
security, nuclear nonproliferation, regional instability, or terrorism
support (see app. I for a list of these countries). Data from DOE and the
laboratories show that almost 30 percent of the visitors to its weapons
laboratories are from sensitive countries. DOE is also concerned about
visits involving subjects which, although unclassified, are considered
sensitive because they have the potential to enhance nuclear weapons
capability, lead to nuclear proliferation, divulge militarily critical
technologies, or reveal other advanced technologies (see app. II for a list
of these subjects) as well as visits to areas located within the laboratories
where special nuclear material and/or classified information and
equipment are located.

Certain requirements must be met if a foreign visit or assignment involves
a sensitive country, a sensitive subject, or a security facility where
classified work is conducted. According to the foreign visits and
assignments order, all assignments and visits involving sensitive subjects
or security facilities where classified work is conducted must be reviewed
and approved by DOE. Furthermore, before an assignment involving a

4
 For purposes of this report, we use “visit” as a generic term for both short-term visits or long-term
assignments. However, we do make distinctions between visits (or visitors) and assignments (or
assignees) in situations where such distinctions are significant.



Page 18               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                        Chapter 1
                        Introduction




                        visitor from a sensitive country begins, a national security background
                        check must be completed to determine if appropriate U.S. government
                        agencies have derogatory information, such as an intelligence affiliation,
                        about that individual.

                        DOE  also has security procedures that control the access of foreign visitors
                        to the weapons laboratories. All foreign visitors—whether on a visit or an
                        assignment—must wear an appropriate badge to obtain entry to various
                        parts of a weapons laboratory. Furthermore, depending upon the facility
                        involved, the days of the week and the hours during which the foreign
                        national can actually be on site are restricted. Finally, guards and other
                        security countermeasures are used to control access to those parts of the
                        laboratories where classified work is conducted. Security forces and other
                        countermeasures are also used to monitor and control access to the less
                        protected, controlled areas known as property protection areas—which
                        are not open to the general public and which may contain unclassified
                        sensitive information—to ensure that this information is not
                        compromised.

                        As an added line of defense, DOE and its laboratories operate
                        counterintelligence programs to identify and mitigate the risk that
                        sensitive information could be divulged to foreign countries. Among other
                        things, the counterintelligence personnel conduct awareness programs to
                        keep employees aware of the risk of foreign intelligence-gathering
                        activities, brief and debrief employees who host foreign visitors, conduct
                        assessments of foreign visitor activity, and disseminate relevant
                        information throughout the DOE community. However, they have no
                        approval authority for foreign visitors. The laboratories’
                        counterintelligence programs do not conduct counterintelligence
                        “operations,” such as surveillance activities. Situations of concern are
                        referred to the Federal Bureau of Investigation (FBI), which performs
                        counterintelligence operations or investigations as necessary.


                        The risk that classified or sensitive information may be compromised
Concerns Exist About    through foreign espionage is real and has been long-standing. Espionage
the Potential           against the weapons laboratories occurred as long ago as the 1940s when
Compromise of           the Manhattan Project was developing the nation’s first nuclear weapons.
                        As documented in a 1996 Central Intelligence Agency (CIA) report that
Sensitive Information   detailed recently declassified documents, key information on nuclear
                        weapons was obtained from Los Alamos by the Soviet Union. In the 1980s
                        and 1990s, there have been other espionage activities against DOE’s



                        Page 19         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




laboratories, but information on these incidents remains classified. DOE,
laboratory, and other agency counterintelligence professionals briefed us
on them, which included recent cases involving the possible theft or
compromise of sensitive information in which foreign nationals at DOE’s
laboratories played a prominent role.

The large and increasing number of foreign nationals visiting DOE’s
laboratories has raised concerns about the potential compromise of
classified information or other sensitive or proprietary information at
these facilities. Counterintelligence professionals point out that (1) the
laboratories have desirable assets in the form of classified information and
unclassified but sensitive information; (2) access by foreign nationals,
even for a short time, can provide the opportunity to identify and target
laboratory information; and (3) repeated and long-term contact between
laboratory personnel and foreign nationals can create relationships that
foreign countries can use to obtain information. They add that the threat
has become more complex because not only is information on nuclear
weapons desirable to some foreign countries, but information and
technology of economic benefit is of great importance to all countries.
Consequently, the laboratories face the risk of economic espionage by
enemies and allies alike.

Past unclassified work done by GAO and classified work by others have
shown the risks of foreign visits and DOE’s problems in controlling foreign
visitors’ presence at its laboratories. In 1988, we reported that major
weaknesses existed in DOE’s foreign visitor program and, as a result,
suspected foreign intelligence agents and individuals from facilities
suspected of conducting nuclear weapons activities had obtained access
to the laboratories without DOE’s prior knowledge.5 More recently,
classified reports—in 1992 by an intelligence community interagency
working group and in 1997 by the FBI—have pointed out basic problems
with DOE’s counterintelligence efforts regarding the presence of foreign
nationals at DOE’s laboratories.

DOE itself is concerned about the number of foreign visitors to its facilities
and the potential threat of espionage they pose and has obtained
additional funding to help its counterintelligence programs respond to this
potential threat. Counterintelligence funding for headquarters program
direction and field activities in fiscal year 1996 totaled about $3.2 million.
DOE was appropriated an additional $5 million in fiscal year 1997 to expand


5
 Nuclear Nonproliferation: Major Weaknesses in Foreign Visitor Controls at Weapons Laboratories
(GAO/RCED-89-31, Oct. 11, 1988).



Page 20             GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                     Chapter 1
                     Introduction




                     counterintelligence programs at its nuclear weapons laboratories and
                     other high-risk facilities.


                     A May 7, 1996, report of the House Committee on National Security
Objectives, Scope,   directed GAO to determine how well DOE is controlling foreign visits to
and Methodology      DOE’s three weapons laboratories and to determine whether these visits
                     raise security or nuclear proliferation concerns. Since that time, we have
                     issued to the Committee a Statement for the Record describing the
                     number of foreign visitors to these laboratories and a report discussing the
                     distribution of the fiscal year 1997 counterintelligence funds provided to
                     DOE.6 This report completes our work on DOE’s controls over foreign
                     visitors and, as agreed with Committee staff, addresses DOE’s
                     (1) procedures for reviewing the backgrounds of foreign visitors and for
                     controlling the dissemination of sensitive information to them, (2) security
                     controls for limiting foreign visitors’ access to areas and information
                     within its laboratories, and (3) counterintelligence programs for mitigating
                     the potential threat posed by foreign visitors.

                     To obtain an overall perspective on DOE’s foreign visitor procedures,
                     security controls, and counterintelligence efforts, we obtained and
                     reviewed pertinent DOE and laboratory orders, documents, and other
                     materials. We also met with and interviewed DOE headquarters, field office,
                     and contractor officials, including officials from DOE’s Offices of Defense
                     Programs, Nonproliferation and National Security, and Policy and
                     International Affairs in Washington, D.C., and in Germantown, Maryland,
                     as well as officials at DOE’s field locations in Albuquerque and Los Alamos,
                     New Mexico, and in Livermore, California. We also met with contractor
                     officials at the Lawrence Livermore National Laboratory in Livermore,
                     California; the Los Alamos National Laboratory in Los Alamos, New
                     Mexico; and the Sandia National Laboratories in Albuquerque, New
                     Mexico. Furthermore, we met with officials from the FBI to obtain their
                     views on the risk of, and control over, foreign visitors to DOE’s
                     laboratories.

                     In reviewing procedures on background checks for foreign visitors, we
                     reviewed data on visits that occurred between January 1994 and
                     December 1996. We examined records on visits and background checks
                     contained in (1) DOE’s centralized computer database on foreign visitors,

                     6
                      DOE Security: Information on Foreign Visitors to the Weapons Laboratories (GAO/T-RCED-96-260,
                     Sept. 26, 1996) and Department of Energy: Information on the Distribution of Funds for
                     Counterintelligence Programs and the Resulting Expansion of These Programs (GAO/RCED-97-128R,
                     Apr. 25, 1997).



                     Page 21             GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




(2) the laboratories’ badging office and local foreign visitor databases, and
(3) DOE’s centralized counterintelligence database. We did not
independently verify the accuracy of the information in these databases;
however, we did obtain additional verification of visit information as
necessary to complete our review. In particular, our analysis focused on
the adequacy of DOE’s controls related to high-risk visitors (i.e., visitors
from sensitive countries who potentially could have derogatory national
security information on file). In this regard, we tracked information on
such visitors by examining DOE’s records on background checks and by
independently obtaining some background checks from the FBI.

To examine the process used for identifying sensitive subjects and
controlling the dissemination of such information to foreign visitors, we
obtained and analyzed pertinent guidance on sensitive subjects and
discussed with DOE and contractor officials (including some who had
hosted foreign visitors) the methods by which visits involving sensitive
subjects are identified. We examined records on several hundred visits
that occurred from January 1994 through December 1996. We judgmentally
selected for further analysis over 150 visits that were not identified as
involving sensitive subjects and compared the visits’ purpose and/or
subject with those identified on DOE’s sensitive subject list. We discussed
these visits with DOE officials in its Nuclear Transfer and Supplier Policy
Division, which is responsible for reviewing visits that involve sensitive
subjects, to obtain their perspectives on the accuracy of the identification
of sensitive subjects. Additionally, we followed up with researchers and
managers at these laboratories who frequently host foreign visitors
concerning whether individual research projects that involved foreign
nationals involved sensitive subjects.

To assess the security controls associated with foreign visitors’ access to
certain areas and information within DOE’s laboratories, we obtained and
examined security procedures, plans, surveys, and statements of threat.
Our work included a review of laboratory security infractions, violations,
and occurrences, as well as laboratory counterintelligence
contact/incident reports. Additionally, we obtained unclassified program
and building security assessments that identified problems and
vulnerabilities. While touring laboratory facilities with security personnel,
we observed the security controls in place for both classified and
unclassified sensitive research.

To review the counterintelligence programs, we interviewed DOE,
laboratory, and FBI counterintelligence officials and obtained pertinent



Page 22         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 1
Introduction




documentation regarding the potential threat posed by foreign visitors to
the weapons laboratories and DOE’s activities to counter this threat. In
particular, we attended a classified counterintelligence briefing that was
held for staff of DOE’s Albuquerque Operations Office, which discussed the
foreign visitor threat. We also examined the laboratories’
counterintelligence contact/incident reports and observed the capabilities
of DOE’s centralized counterintelligence database. In addition, we obtained
and reviewed assessments of DOE’s counterintelligence programs that had
been conducted by other organizations in the U.S. intelligence community.

We encountered two limitations in our attempts to examine DOE’s controls
over foreign visitors to its laboratories. First, our request to the CIA for
access to data on the backgrounds of foreign visitors was denied on
grounds of the sensitivity of the data. As a result, we were unable to
review background information from the CIA that was on file at DOE or to
independently obtain background data from the CIA. Second, we requested
from the FBI specific information on possible espionage or other illegal
activities at the laboratories. However, FBI officials told us that disclosure
of such information is contrary to FBI policy; consequently, the requested
information was not provided to us.

We provided a draft of this report to DOE for its review and comment. DOE’s
comments and our response are included at the end of chapter 5; the full
text of DOE’s comments are included in appendix IV. Our work was
conducted from July 1996 through September 1997 in accordance with
generally accepted government auditing standards. Major contributors to
this report are listed in appendix V.




Page 23         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 2

Foreign Visitor Procedures Have Not Been
Effectively Implemented

                          Although foreign visitors provide many benefits to DOE’s programs, every
                          one of their visits to a nuclear weapons laboratory poses a risk that
                          sensitive information might be inadvertently or intentionally
                          compromised. To minimize this risk, DOE’s foreign visitor order specifies
                          several procedures that should be conducted before foreign nationals are
                          allowed access to its laboratories. DOE has not effectively implemented
                          two of the key procedures at the three laboratories we reviewed. More
                          specifically:

                      •   Few national security background checks are being performed on visitors
                          from sensitive countries. As a result, foreign nationals suspected by the
                          U.S. counterintelligence community of having foreign intelligence
                          affiliations have been permitted access to the laboratories without the
                          advance knowledge of appropriate officials.
                      •   Because of unclear criteria regarding what constitutes sensitive subjects
                          and the lack of an independent review process to examine the subjects to
                          be discussed during visits, foreign visits involving potentially sensitive
                          subjects—such as inertial confinement fusion, hydrodynamics codes,1 and
                          the detection of nuclear weapons tests—are occurring without DOE’s
                          knowledge.

                          Without adequate knowledge about the foreign nationals who plan to visit
                          its laboratories and the subjects to be discussed during those visits, DOE
                          cannot take appropriate action to ensure that their visits are properly
                          controlled. This heightens the risk that such visitors may obtain, either
                          directly through active intelligence efforts or indirectly through
                          involvement in laboratory activities, information whose disclosure to
                          certain countries would be detrimental to the United States.


                          Background checks can provide DOE and its weapons laboratories advance
DOE Has Little            warning of possible problems or concerns with a foreign visitor, and DOE’s
Advance Knowledge         foreign visitor order contains requirements for obtaining background
About the                 checks for visitors from sensitive countries. However, DOE granted two
                          laboratories—Los Alamos and Sandia—a partial exception from
Backgrounds of Many       complying with its requirements. As a result, few background checks have
Visitors From             been initiated for foreign visitors to those two facilities.
Sensitive Countries


                          1
                           Among other things, hydrodynamics codes are used for computer simulations to model the dynamic
                          processes that occur in a nuclear weapon.



                          Page 24             GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                               Chapter 2
                               Foreign Visitor Procedures Have Not Been
                               Effectively Implemented




Background Checks Are          As part of its process to approve foreign visitors, DOE requires that national
Intended to Help DOE           security background checks (termed indices checks by DOE) be conducted
Mitigate the Risks of Visits   on certain foreign visitors to its laboratories. Under DOE’s order,
                               background checks are required for all sensitive-country assignees (those
                               whose visits will exceed 30 days). Additionally, background checks must
                               be proposed by the laboratories to DOE’s Counterintelligence Division for
                               short-term visitors from sensitive countries, but the division has the
                               discretion to determine whether the background check should be done.
                               For example, the Counterintelligence Division may choose to request
                               background checks on sensitive-country visitors who will be entering
                               security areas or discussing sensitive subjects. The checks are obtained
                               from government intelligence and investigative agencies, such as the CIA
                               and the FBI. At DOE’s request, these agencies review their files and report to
                               DOE whether intelligence information of a derogatory nature exists about a
                               particular visitor (e.g., that the visitor is suspected of having ties to a
                               foreign intelligence service or terrorist group). DOE’s order also requires
                               that some background checks—those considered necessary to approve a
                               visit or assignment—be completed before the visit or assignment begins.
                               Many other checks done on visitors need not be completed before the visit
                               begins—these are checks considered needed for counterintelligence
                               research purposes only.

                               Although DOE uses the results of these background checks to approve
                               proposed visits and to help mitigate any risks related to them, the
                               existence of derogatory information about a foreign visitor does not
                               preclude a visit from occurring. According to DOE officials, if a background
                               check reveals derogatory information about a foreign visitor, the visit is
                               rarely denied. Instead, DOE allows the visit to occur but, depending on the
                               results of the check and other factors, may increase the stringency of
                               escort requirements or may restrict the length of the visit, the buildings to
                               be accessed, or the subjects to be discussed. Thus, the background check
                               serves as means to forewarn DOE and laboratory officials of possible
                               national security concerns so they may devise appropriate
                               countermeasures where needed.


Few Background Checks          Few background checks are performed for visitors to DOE’s Los Alamos
Are Performed on               and Sandia laboratories. In August 1994, these laboratories implemented a
Sensitive-Country Visitors     partial exception from the foreign visitor order that was granted by DOE.
                               Under the terms of this exception, the two laboratories are required to
to the Los Alamos and          request background checks only on those foreign visitors planning to enter
Sandia Laboratories            a security area at the laboratory or to discuss sensitive subjects. According



                               Page 25           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                     Chapter 2
                                     Foreign Visitor Procedures Have Not Been
                                     Effectively Implemented




                                     to DOE and laboratory officials, the partial exception for Los Alamos and
                                     Sandia was granted because of the high volume of foreign nationals
                                     desiring to visit these weapons laboratories, which contributed to
                                     processing backlogs, and the costs associated with processing paperwork
                                     for foreign visitors. Laboratory officials said the processing backlogs
                                     caused delays that resulted in some visits having to be canceled because of
                                     uncompleted background checks.

                                     The partial exception has limited the number of requests for background
                                     checks on visitors to Los Alamos and Sandia. As a result, DOE obtains
                                     relatively few background checks on visitors to those laboratories,
                                     particularly in comparison to Livermore, which did not request an
                                     exception from the order’s requirements. Our review of DOE’s records of
                                     foreign visitors showed that, during the 3-year period from 1994 through
                                     1996, background checks were obtained on only 5 percent of the visitors
                                     from sensitive countries to Los Alamos and Sandia. In contrast, Livermore
                                     requested checks on many more names during that timeframe, and
                                     background checks were obtained on 44 percent of the visitors from
                                     sensitive countries to this laboratory.2 Table 2.1 compares the number of
                                     background checks obtained on sensitive-country visitors for the three
                                     laboratories.

Table 2.1: Background Checks That
Were Obtained on Sensitive-Country                                                                  Number of
Visitors to DOE Weapons                                                                            background
Laboratories, 1994-1996              Facility                          Number of visits                checks        Percent checked
                                     Los Alamos                                     2,714                     139                         5
                                     Livermore                                      1,602                     700                        44
                                     Sandia                                         1,156                      53                         5
                                     Total                                          5,472                     892                        16
                                     Source: Compiled by GAO from DOE and laboratory data.



                                     Data on foreign visitors from individual sensitive countries also showed
                                     significant differences among the laboratories. For example, 46 percent of
                                     the Russian visitors to Livermore were checked during that 3-year period,
                                     compared to 10 and 7 percent, respectively, for Los Alamos and Sandia.
                                     Furthermore, 39 percent of the Chinese visitors to Livermore were
                                     checked, compared to 2 and 1 percent, respectively, for Los Alamos and
                                     Sandia. (See app. III for numbers and percentages for all sensitive
                                     countries.)

                                     2
                                      In addition, some names reported to headquarters did not result in checks because previous check
                                     results were on file at DOE headquarters and still current.



                                     Page 26              GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 2
Foreign Visitor Procedures Have Not Been
Effectively Implemented




By checking the backgrounds of so few visitors from sensitive countries,
particularly to Los Alamos and Sandia, DOE limits the collection of basic
counterintelligence data and may be unknowingly allowing significant
numbers of visitors with questionable backgrounds into its weapons
laboratories. According to FBI counterintelligence officials, the low
percentage of background checks conducted on Russian and Chinese
visitors to Los Alamos and Sandia does not constitute effective use of the
background check process. Statistics on the results of background checks
DOE did request support this. Of all the background checks DOE obtained
on visitors from sensitive countries to the weapons laboratories during the
1994 through 1996 timeframe, about 4 percent of the checks that DOE
received indicated the existence of derogatory information.

Moreover, we noted during our review that people with suspected foreign
intelligence connections were let into the laboratories without background
checks.3 We were able to document 13 instances where persons with
suspected foreign intelligence connections were allowed access without
background checks—8 visitors went to Los Alamos and 5 went to
Sandia—during the 1994 through 1996 period.4 Available records also
indicated that 8 other persons with suspected connections to foreign
intelligence services were approved for access to Sandia during the period;
however, DOE and Sandia lacked adequate records to confirm whether the
persons actually accessed the facility. Although we could not confirm that
any of these visits compromised U.S. security, at a minimum, the lack of a
background check did not provide DOE the opportunity to implement
countermeasures to mitigate the potential risk posed by these visits. Also,
all of these instances occurred at the two weapons laboratories that had
been granted a partial exception to DOE’s foreign visitor order.

DOE’srequirements for national security background checks represent a
continuing problem that we previously identified in a 1988 GAO report5 and
about which elements of the U.S. intelligence community have also
expressed concern. In discussing this problem, DOE and laboratory
counterintelligence officials said that they recognize that the number of
background checks obtained on foreign visitors has been limited,
especially at Los Alamos and Sandia, and that these checks should be

3
 Despite the restrictions on our access to information, as discussed in chapter 1, we verified through
the U.S. counterintelligence community that several of these visitors had known or suspected
connections with foreign intelligence services.
4
 We also identified instances of persons with suspected intelligence connections obtaining laboratory
access before background checks were completed.
5
 GAO/RCED-89-31, Oct. 11, 1988.



Page 27               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                              Chapter 2
                              Foreign Visitor Procedures Have Not Been
                              Effectively Implemented




                              routinely requested for visitors from sensitive countries. They added that
                              although data from a background check—even derogatory data—is rarely
                              used to deny a visitor access to a laboratory, obtaining such information is
                              beneficial in identifying individuals known to be a risk. DOE headquarters
                              counterintelligence officials said their long-term goal is to obtain
                              background checks on all foreign nationals from sensitive countries that
                              seek to visit any of these three laboratories. In the interim, according to a
                              Sandia counterintelligence official, that laboratory is now reporting data
                              on all sensitive country visitors to DOE headquarters for potential
                              background checks.


                              DOE has little assurance that all visits during which sensitive, but
DOE Has Not                   unclassified, subjects will be discussed are identified and brought to the
Adequately Ensured            attention of DOE officials. According to DOE’s order, DOE officials are to
That Visits Involving         review and approve visits by foreign nationals that involve sensitive
                              subjects. But DOE and laboratory personnel alike are unclear about what
Sensitive Subjects Are        constitutes a sensitive subject, and little or no independent review takes
Identified and                place to assess subjects within the context of the planned visit (e.g., taking
                              into account the purpose of the visit, the particular aspects of the subject
Reviewed                      to be discussed, and the foreign country and individuals involved). As a
                              result, sensitive information could be discussed or otherwise disclosed to
                              foreign nationals without DOE’s knowledge and approval.


DOE Requires the              To minimize the risk of inappropriate subjects being discussed with
Identification, Review, and   foreign nationals, DOE’s order requires that its laboratories identify any
Approval of Visits            visit involving a sensitive subject for review and approval by DOE. The
                              order defines sensitive subjects as unclassified subjects involving
Involving Sensitive           information, activities, or technologies relevant to national security. To
Subjects                      facilitate their identification, the order contains a list of sensitive subjects,
                              including nuclear weapons production and supporting technologies,
                              nuclear explosion detection, inertial confinement fusion, production and
                              handling of plutonium, and fuel fabrication. Additionally, the order
                              contains three criteria for identifying other subjects that may be sensitive.
                              Subjects are considered sensitive if they relate to technologies under
                              export control, “dual-use” technologies that have both peaceful and
                              military applications, or rapidly advancing technologies that may become
                              classified or placed under export control. Subjects in these categories
                              include computer systems, component development, and software
                              specifically designed for military applications; extremely high-energy,




                              Page 28           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                    Chapter 2
                                    Foreign Visitor Procedures Have Not Been
                                    Effectively Implemented




                                    high-brightness lasers and particle beams; and high energy density
                                    batteries and fuel cells.

                                    The responsibility for reviewing visits involving sensitive subjects rests
                                    with DOE’s Nuclear Transfer and Supplier Policy Division in the Office of
                                    Arms Control and Nonproliferation. This division also reviews
                                    private-sector exports of information and technology that could be useful
                                    to a foreign nuclear or nuclear weapons-related program. According to
                                    division officials, while the discussion of a sensitive subject with a foreign
                                    national is not necessarily prohibited, DOE needs to be aware of any such
                                    discussions to ensure their consistency with U.S. policy regarding the
                                    transfer of that information to the foreign national’s home country. The
                                    officials added that the need for DOE’s review and approval of the
                                    discussion of a sensitive subject is not dependent on the visitor’s home
                                    country—the discussion of any sensitive subject with a foreign visitor
                                    from even a nonsensitive country still requires DOE’s review and approval.


Identification of Visits That       DOE’s three weapons laboratories have not adequately identified visits
Involve Sensitive Subjects          involving sensitive subjects. Between January 1994 and July 1996, they
Has Not Been Adequate               identified a total of 72 visits involving sensitive subjects; the majority of
                                    these visits were related to areas specified as sensitive in DOE’s order. For
                                    example, 5 Russian citizens visited Los Alamos in 1994 for a 3-day visit
                                    involving nuclear materials control, accounting, physical protection,
                                    security, export control, and critical assembly facilities; 13 Russian
                                    nationals visited Los Alamos in 1995 for a 1-day workshop on plutonium
                                    stabilization, storage, and disposition; and 30 French nationals visited
                                    Livermore in 1995 for 1- to 2-year assignments to work on inertial
                                    confinement fusion.

                                    However, our review of records on 167 other visits found numerous cases
                                    that pertained to subjects that were either specified as sensitive in DOE’s
                                    order or were potentially sensitive but were not identified as such by the
                                    laboratories. For example:

                                •   Sixteen visits and assignments to Livermore involved inertial confinement
                                    fusion, a technology specifically listed as sensitive in DOE’s order. These
                                    visits included foreign visitors who were participating in a formal bilateral
                                    cooperative effort, including the transfer of proprietary data, between the
                                    United States and France on subjects related to inertial confinement
                                    fusion. On other occasions, Livermore has identified this type of visit as
                                    involving a sensitive subject.



                                    Page 29           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                               Chapter 2
                               Foreign Visitor Procedures Have Not Been
                               Effectively Implemented




                           •   A Canadian citizen was on an assignment to Livermore to discuss equation
                               of state measurements6 using laser-generated shock-waves—work that
                               was acknowledged to be important to the inertial confinement fusion
                               program, a sensitive subject area.
                           •   An Indian citizen from a defense-related facility in India was on an
                               assignment to Los Alamos that involved the structure of beryllium
                               compounds. Beryllium metal is used in nuclear weapons.
                           •   An Indian citizen was on assignment to Los Alamos for work related to
                               pattern recognition/anomaly detection algorithms. This work was
                               acknowledged to be dual use in nature, with applications related to
                               national security, such as nonproliferation and satellite image processing,
                               as well as to nondefense projects.
                           •   A Russian visit to Los Alamos involved collaboration on processes related
                               to detecting unsanctioned nuclear weapons tests. Nuclear explosion
                               detection is specifically identified as a sensitive subject in DOE’s order.
                           •   A citizen of the United Kingdom was assigned to Livermore for
                               3-dimensional hydrodynamic simulations for implosions. Hydrodynamics
                               and 3-dimensional calculations are important to simulating nuclear
                               weapons tests, particularly in light of the ban on nuclear testing.

                               We reviewed copies of the documentation on these visits and discussed
                               them with officials in DOE’s Nuclear Transfer and Supplier Policy Division
                               to obtain their perspectives on whether they may have involved sensitive
                               subjects. They said that it was not possible to fully ascertain whether these
                               visits did or did not involve sensitive subjects; however, they pointed out
                               that many of them appeared to involve subjects that are specifically
                               identified as sensitive subjects in DOE’s order and that others appeared to
                               have some weapons or dual-use applications. The export control officials
                               said that, according to the stated purpose of the visits described in their
                               documentation, they involved subjects that should have been sent for their
                               review.


Problems Hindering the         DOE’s weapons laboratories have had problems identifying visits involving
Identification of Visits       sensitive subjects largely for two reasons—confusion over how to apply
Involving Sensitive            the sensitive subject criteria and the lack of an independent technical
                               review of proposed foreign visits to identify those involving sensitive
Subjects                       subjects.

                               According to laboratory program managers and hosts of foreign visitors,
                               DOE’scriteria for identifying sensitive subjects are very broad and do not

                               6
                                Equation of state measurements are used to assess how materials interact with their surroundings.



                               Page 30              GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 2
Foreign Visitor Procedures Have Not Been
Effectively Implemented




clearly define which activities are covered. The laboratory managers
added that the current list of sensitive subjects is outdated, incomplete,
and does not establish reasonable parameters within which they could
reasonably gauge a subject’s sensitivity. As an example of the difficulty in
applying the criteria, they noted that while inertial confinement fusion is
listed as a sensitive subject because of its relationship to nuclear weapons
testing, most aspects of this technology are unclassified and widely
researched throughout the world and that the laboratory’s unclassified
inertial confinement fusion work is published and freely disseminated.
They added that without more specific criteria from DOE, they generally
view activities in inertial confinement fusion and other areas that are
unclassified, already published, or will ultimately be published, to be
nonsensitive.

DOE   officials with the Nuclear Transfer and Supplier Policy Division
acknowledged that although there are difficulties in identifying sensitive
subjects, the laboratories are interpreting the order’s criteria too narrowly.
They said that the sensitivity of a subject may at times be subjective and it
often depends on the country to which the information will be divulged,
the state of that country’s technology and research efforts, and other
information on that country’s needs and intentions regarding the use of the
technology. However, they added that hosts are not in a position to know
that information and/or whether it is consistent with U.S. government
policy to provide that information to the country in question. The list of
sensitive subjects serves as a guideline to identify such visits for scrutiny
by DOE officials who possess the necessary expertise to determine whether
it is appropriate to discuss a particular subject with a foreign visitor from a
specific country.

A second problem hindering the identification of visits involving sensitive
subjects is the lack of an independent review of proposed visits by
individuals with technical expertise to help ensure sensitive subjects are
properly identified. During the period of our review, DOE and the weapons
laboratories relied upon the host—the laboratory employee sponsoring the
foreign visitor—to accurately identify sensitive subject visits. Such visits
were approved by the appropriate laboratory division management and by
officials in the foreign visits and assignments office at each laboratory.
However, little or no independent review of the subject of those visits had
been conducted to ensure that sensitive subjects were not involved. At
Sandia and Los Alamos, officials in the foreign visits and assignments
office review requests for foreign visitor access; however, those
individuals do not have a technical background or expertise to judge if a



Page 31           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                               Chapter 2
                               Foreign Visitor Procedures Have Not Been
                               Effectively Implemented




                               sensitive subject is involved. At Livermore, visit requests are reviewed in
                               the office of the laboratory director, as well as at the DOE operations office;
                               however, this laboratory’s review has at times been delegated to
                               individuals from the foreign visits and assignments office. Laboratory
                               personnel from the foreign visits and assignments offices told us that they
                               are not fully knowledgeable on activities that could be sensitive and that
                               they generally rely on the host to determine whether a visit would involve
                               a sensitive subject.


DOE and Laboratories           DOE  and the weapons laboratories have recognized problems with
Recognize Problems With        identifying visits involving sensitive subjects and have begun actions to
Identifying Visits Involving   address them. In the fall of 1996, DOE initiated a multiissue effort to revise
                               its foreign visit and assignment order. This effort will include examining
Sensitive Subjects             the controls over foreign visits involving sensitive subjects and developing
                               a better process and/or criteria by which to identify them. According to
                               officials in DOE’s Counterintelligence Division, which is involved in the
                               effort, the revised order is expected to be issued by the end of 1997.
                               However, because revision of the criteria for identifying sensitive subjects
                               has not yet gotten underway and does not have a timetable for completion,
                               they do not know if changes to clarify DOE’s criteria for identifying visits
                               involving sensitive subjects will be included in the revised order.

                               During our review, two of the three laboratories established interim local
                               processes to examine requests for foreign visitors to better ensure that
                               their visits do not involve discussions of sensitive subjects. In August 1996,
                               Livermore began requiring that all visits involving foreign nationals from
                               sensitive countries be reviewed by an official in its Arms Control and
                               Treaty Verification Program who has had experience with nuclear
                               weapons and associated technologies. These reviews are specifically to
                               assess the technology involved and identify those requests that involve
                               sensitive subjects. According to the Livermore official conducting these
                               reviews, although most visits have not involved sensitive subjects, he has
                               identified some visits of concern, for which actions were taken to help
                               ensure that sensitive subjects would not be involved. In December 1996
                               Sandia began requiring that all requests for foreign visitors be reviewed by
                               a Sandia official involved in export control to better ensure visits involving
                               sensitive subjects are adequately identified.




                               Page 32           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 3

Security Controls May Not Adequately
Protect Sensitive Information From Foreign
Visitors
                             Effective security controls can greatly mitigate the risk inherent with the
                             presence of foreign visitors at DOE’s weapons laboratories. However, the
                             security controls that exist in the laboratories’ controlled areas—the areas
                             most often visited by foreign nationals—may not provide effective
                             protection. The controlled areas contain unclassified, but sensitive
                             information, and although security measures are used to control access,
                             these measures are less stringent than those used in classified areas and
                             their implementation varies among the laboratories. Security problems
                             and vulnerabilities involving foreign nationals show that classified and/or
                             sensitive information has been, or potentially could be, compromised by
                             foreign nationals in the controlled areas. Nevertheless, DOE has not fully
                             assessed the effectiveness of its security measures to protect sensitive
                             information in controlled areas.


                             To protect information from unauthorized disclosure or compromise, DOE
Security                     and its laboratories use various levels of security that permit access for
Requirements in              authorized individuals to certain areas. Although some foreign visitors are
Controlled Areas             allowed access to the more restrictive security areas where classified
                             work is conducted, most foreign visits occur in designated controlled
                             areas—often termed property protection areas—which may contain
                             unclassified sensitive information. A lower level of security is provided in
                             these areas, and the controls used vary among the laboratories.


Most Foreign Visitors Work   DOE and the laboratories use a multilevel, graded security approach to limit
in Controlled Areas          access and protect information at their facilities. Open areas, which
                             include locations on laboratory property to which the general public is
                             allowed access, receive a low level of protection. Open areas can include
                             cafeterias, visitors centers, and museums. Controlled areas, which receive
                             a higher level of protection, can include small areas, such as an individual
                             building, as well as larger areas, such as building complexes. Access to
                             these areas is controlled because of the presence of valuable property or
                             unclassified sensitive information, but no classified work is conducted in
                             these locations. Unclassified sensitive information includes information
                             that has been designated Official Use Only, proprietary, export controlled,
                             Privacy Act, and Unclassified Controlled Nuclear Information.

                             An even higher level of protection and stricter access limitations are
                             maintained for security areas containing classified information and
                             technologies or in which nuclear weapons or other classified research is
                             conducted. These areas are closely monitored and patrolled, and controls



                             Page 33         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                             Chapter 3
                             Security Controls May Not Adequately
                             Protect Sensitive Information From Foreign
                             Visitors




                             traditionally include guns, guards, and gates. Specific security plans must
                             be developed and approved before any foreign visitor is allowed access to
                             these areas and the visitor must be escorted at all times.

                             Most foreign visitors to the weapons laboratories are granted access to the
                             controlled areas. Laboratory records show that on average only about 5 to
                             10 percent of all foreign visitors are permitted into security areas where
                             classified work is performed, and according to DOE and laboratory
                             officials, such access is usually for a short period of time. The remaining
                             visitors are either allowed into the controlled areas or meet with
                             laboratory employees in open areas. DOE and laboratory officials were not
                             able to identify the percentage of those visitors that went to controlled
                             areas, but stated that most were allowed into these locations.


Security Controls Vary       Because valuable property and information that is unclassified, but
Among the Laboratories       sensitive, is located in controlled areas, DOE requires the laboratories to
                             protect these areas through the use of a variety of security controls.
                             Controls used to reduce the risks posed by foreign nationals in controlled
                             areas include the following:

                         •   A distinctive identification badge must be worn by foreign visitors at all
                             times.
                         •   Access is controlled by automated devices or by receptionist staff and
                             manual visitor logs. Automated devices include equipment that reads
                             encoded access cards and/or requires passwords.
                         •   Standard or “generic” security plans are drafted for controlling foreign
                             visits in the area.
                         •   A host is designated, who is a laboratory employee responsible for the
                             activities of the foreign national while at the laboratory. A visitor or
                             assignee is not permitted to be a host.
                         •   Random searches are conducted on vehicles or hand-carried items
                             entering or leaving the area.

                             Among the three laboratories, however, the security controls associated
                             with foreign visitors in controlled areas are not consistently applied. In
                             particular, each of the laboratories has different requirements for allowing
                             foreign visitors after-hours access. At Livermore, foreign visitors are not
                             allowed unescorted after-hours access to controlled areas without the
                             specific written approval of laboratory security officials and the
                             concurrence of the local DOE field office. According to Livermore security
                             officials, while they have granted such access for some foreign visitors,



                             Page 34           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 3
Security Controls May Not Adequately
Protect Sensitive Information From Foreign
Visitors




they do not approve unescorted after-hours access for visitors from
sensitive countries.

At both Los Alamos and Sandia, unescorted after-hours access to
controlled areas has been permitted. These laboratories have required the
host to monitor the foreign visitor—that is, be aware of the foreign
visitor’s location and activities—but not necessarily be physically present.
Recently, Sandia revised its after-hours access policy. In November 1996,
Sandia no longer allowed foreign nationals to have unescorted after-hours
access to controlled areas without the approval of its counterintelligence
office. According to Sandia and DOE officials, this change was made
because of the potential for security problems that could result from
unescorted access. Los Alamos, however, continues to allow unescorted
after-hours access to preserve what one official described as an open
“campus atmosphere” for researchers at its facilities.

Laboratory policies also vary regarding random searches in controlled
areas and the appearance of foreign visitor identification badges. While all
of the laboratories officially permit random searches in controlled areas,
at one of the laboratories such searches are discouraged during normal
work hours. Additionally, the distinctive color and wording of badges for
foreign visitors differ among the laboratories. For example, at Livermore
those badges are white (for visits) or red (for assignments), at Los Alamos
badges for foreign visitors are red, and at Sandia those badges are gray.
Furthermore, unlike the badges at the other laboratories, Sandia’s badges
contain no wording pertaining to the visitors’ countries of citizenship or
indicating that the wearers are not U.S. citizens.

Finally, neither Los Alamos nor Sandia has developed security
plans—even generic ones—for foreign nationals who will be in controlled
areas. The DOE order governing unclassified foreign visits and assignments
identifies security plans as the basic means by which vital information is
protected and requires they be developed. However, DOE and laboratory
officials told us that because of the exception granted by DOE to these two
laboratories—which also streamlined requirements for background
checks and visit approvals—security plans are no longer required for visits
to controlled areas. Livermore has not sought such an exception and
requires a generic security plan for all foreign visitors to its controlled
areas.




Page 35           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                                  Chapter 3
                                  Security Controls May Not Adequately
                                  Protect Sensitive Information From Foreign
                                  Visitors




                                  Available data from the weapons laboratories showed that the sensitive
Security                          information in controlled areas has been vulnerable to compromise.
Vulnerabilities and               Between 1991 and 1997, laboratory security assessments and records
Problems Have                     identified vulnerabilities and problems involving foreign visitors, and in
                                  buildings and programs to which those visitors had access. Records of
Involved Foreign                  vulnerabilities and problems included improper releases of information
Visitors                          and failures to follow security controls and requirements.

Improper Releases of              Assessments and records from all three laboratories indicated
Information                       vulnerabilities and problems involving the improper release of unclassified
                                  sensitive information and classified information in unclassified settings. In
                                  most of these cases, the information was actually or potentially available
                                  to foreign visitors. Whether or not a laboratory employee personally hosts
                                  a foreign visitor, all laboratory employees must adequately protect
                                  classified or unclassified sensitive information and not disclose it unless
                                  authorized. However, examples of improper releases included the
                                  following:

                              •   Unclassified sensitive documents and materials had been improperly
                                  discarded in trash, recycling bins, or hallways. At one of the laboratories,
                                  six boxes of papers marked “sensitive material” in red letters on the
                                  outside were left in an open hallway in an area accessible to foreign
                                  visitors.
                              •   At one of the laboratories, a division’s open-access newsletter, which was
                                  accessible to the foreign visitors it was hosting, provided information on
                                  corporate and laboratory research agreements, the development of certain
                                  computer codes, and DOE’s nuclear program.
                              •   Classified information had been inadvertently divulged by laboratory
                                  employees during unclassified workshops or conferences to foreign
                                  visitors, some of whom were from sensitive countries.
                              •   A departmental newsletter containing classified information was sent to 24
                                  uncleared individuals, 11 of whom were foreign visitors. Some of the
                                  foreign visitors were from a sensitive country.


Failures to Follow Security       Vulnerabilities and problems associated with employees’ failures to follow
Requirements and Controls         security requirements and controls were also identified in the laboratories’
                                  records. The following are several examples:

                              •   In one case, a laboratory employee in a building to which foreign visitors
                                  had access failed to question the unauthorized removal, by members of a
                                  security assessment team during a test exercise, of a complete computer



                                  Page 36           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                            Chapter 3
                            Security Controls May Not Adequately
                            Protect Sensitive Information From Foreign
                            Visitors




                            system from a controlled area. The employee did not challenge the team’s
                            activities despite the fact that its members were not wearing identification
                            badges and were openly discussing plans to remove additional machines
                            and equipment in an effort to appear suspicious.
                        •   On 10 separate occasions, a laboratory employee hosted visitors from
                            sensitive countries without following visit approval requirements or
                            gaining appropriate authorizations prior to those visits. Another host at the
                            same laboratory met foreign visitors off-site without proper approval after
                            a laboratory official advised him that he could “receive a reprimand, but it
                            would not jeopardize his security clearance.”
                        •   In another case, a host, when confronted with a requirement to limit
                            after-hours laboratory access of certain sensitive country assignees
                            assisting him with his research, moved the visitors and his research to an
                            off-laboratory location.
                        •   On several occasions, there were miscellaneous failures to follow security
                            procedures, including computers left on and unattended without password
                            protection, improper escorting of foreign visitors who required such
                            oversight, and unauthorized back door entry to controlled areas where
                            many foreign visitors had access.

                            DOE and laboratory security officials told us that they are concerned about,
                            but not surprised by, vulnerabilities and problems in controlled areas. The
                            openness under which unclassified research programs operate poses a
                            dilemma in an age of economic competitiveness. DOE’s own security
                            awareness literature states that although many employees realize the
                            importance of protecting classified information, few are aware of the
                            significance of unclassified sensitive and proprietary information.
                            Furthermore, DOE and laboratory security officials told us that the security
                            consciousness of employees working in controlled areas is more relaxed
                            than in security areas where classified research is conducted. While some
                            security officials said that they would like to see a stronger emphasis on
                            security in controlled areas at the laboratories, others said that some
                            technical and research staff do not place a high priority on security and
                            actually see it as an impediment to their work.


                            Neither the laboratories nor DOE has fully assessed the controls over
Protection of               unclassified, but sensitive information. At the laboratories, operations
Sensitive Information       security (OPSEC) assessments are performed to identify vulnerabilities.
in Controlled Areas         However, only at Sandia has there been an assessment that specifically
                            focused on controls over unclassified sensitive information in controlled
Has Not Been Fully          areas to which foreign visitors have access. Furthermore, while DOE has
Assessed                    assessed overall laboratory security operations on a regular basis, its


                            Page 37           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 3
Security Controls May Not Adequately
Protect Sensitive Information From Foreign
Visitors




assessments have not addressed the protection of unclassified sensitive
information in controlled areas.

DOE  requires the use of OPSEC techniques and measures to help protect
information and activities related to national security and government
interests. The purpose of OPSEC is to disrupt or defeat the ability of foreign
intelligence or other adversaries to acquire sensitive or classified
information and to prevent the unauthorized disclosure of such
information. Each of the laboratories has an OPSEC program and uses OPSEC
assessments to identify security vulnerabilities associated with specific
laboratory facilities or programs. To identify vulnerabilities, OPSEC
personnel assess various practices, including physical security and access
controls; visitor log and escort procedures; availability of sensitive
information on bulletin boards, in meeting rooms, and in offices;
document disposal and destruction methods; and computer access
protections.

While all three laboratories have performed OPSEC assessments, only
Sandia has conducted an assessment specifically focused on controls over
unclassified sensitive information in controlled areas to which foreign
visitors have access. Sandia’s assessment was completed in March 1997,
and although it found no indication that the laboratory had allowed foreign
visitors to compromise proprietary or sensitive information, it concluded
that Sandia needed to define a policy concerning areas and information
sources to which foreign nationals should have access. Subsequently,
Sandia changed the process for controlling foreign visitors’ access to, and
work in, controlled areas. Foreign nationals visiting Sandia for more than
30 days now work in “export controlled zones”—locations within
controlled areas where they can work with their respective project teams
but are restricted from unauthorized access to research in the surrounding
area.

OPSEC  assessments at Livermore or Los Alamos have not yet examined
foreign visitors’ access to sensitive information. Livermore’s past OPSEC
assessments have dealt with visitors in general, but have not specifically
addressed foreign visitors and the potential for them to access sensitive
information. Livermore’s OPSEC manager said that the laboratory plans to
conduct two such assessments before the end of 1997. Similarly, Los
Alamos’ OPSEC assessments have included some issues related to foreign
visitors, such as their access to open and secure areas, but they have not
focused on assessing whether foreign visitors could obtain sensitive
information.



Page 38           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 3
Security Controls May Not Adequately
Protect Sensitive Information From Foreign
Visitors




In addition to the laboratories’ OPSEC assessments, DOE does broader
periodic surveys of their security operations, including visits and
assignments involving foreign nationals that are intended to be
comprehensive assessments of each laboratory’s security operations.
Generally, DOE’s surveys are performed every year or two, depending on
the findings of the previous survey for a specific laboratory. The most
recent surveys at Los Alamos and Sandia were completed in March and
April of 1997, respectively. The most recent survey of Livermore’s program
was completed in August 1996. In these surveys, each of the laboratory’s
foreign visits and assignments program was rated satisfactory. However,
the primary focus of these surveys was on the program’s organization,
management, and operations, and not on information protection. As a part
of DOE’s past surveys, each laboratory’s program was evaluated by
conducting interviews, reviewing documentation, and testing
performance. The surveys did not address protection of unclassified
sensitive information in controlled areas—in general or in association with
foreign visitors. For example, while several sections in the survey report
on security at Livermore addressed the effectiveness of its controls over
classified information, none addressed the adequacy of protections for
unclassified sensitive information.




Page 39           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 4

DOE’s Counterintelligence Efforts Can Be
Improved

                      DOE’s  headquarters and field counterintelligence programs are an
                      important part of its defense against foreign espionage efforts at the
                      nuclear weapons laboratories. Foreign visitors to these laboratories have
                      open, often long-term, access to personnel with detailed knowledge and
                      expertise in classified and/or sensitive matters. Although this situation is
                      viewed by counterintelligence experts as an ideal opportunity for foreign
                      intelligence-gathering efforts, DOE has not comprehensively assessed the
                      threat of foreign intelligence against the laboratories. A thorough
                      assessment that identifies countries of concern, the technologies and the
                      information these countries are seeking, and the programs that are likely
                      to be targets of foreign intelligence, is important for DOE and its
                      laboratories to understand and reduce the dangers posed by foreign
                      visitors. Furthermore, DOE has not developed any meaningful
                      programmatic measures by which to evaluate the effectiveness of the
                      laboratories’ counterintelligence programs nor has it periodically
                      evaluated them. Recently, DOE initiated several actions to strengthen the
                      counterintelligence programs, both at headquarters and at the
                      laboratories.


                      The mission of DOE’s counterintelligence programs is to implement
DOE’s Headquarters    effective defensive efforts departmentwide to deter and neutralize foreign
and Laboratory        government or industrial intelligence activities in the United States
Counterintelligence   directed at or involving DOE. DOE’s headquarters Counterintelligence
                      Division, within the Office of Energy Intelligence, has overall
Programs              responsibility for this mission and counterintelligence activities
                      throughout DOE. Staffed with seven DOE employees and seven contract
                      employees, DOE’s Counterintelligence Division is responsible for such
                      activities as conducting various threat assessments and identifying foreign
                      intelligence activities directed against DOE as well as overseeing each
                      laboratory’s counterintelligence program. DOE’s threat assessments can
                      vary from a comprehensive threat assessment DOE-wide to a narrowly
                      focused threat assessment that examines a specific issue, such as a
                      particular foreign country’s interest in DOE’s assets. DOE’s
                      Counterintelligence Division is responsible for implementing
                      counterintelligence policies and procedures throughout DOE. This
                      responsibility includes (1) developing and implementing methods,
                      techniques, standards, and procedures for DOE’s counterintelligence
                      activities; (2) establishing a briefing and debriefing program for foreign




                      Page 40         GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 4
DOE’s Counterintelligence Efforts Can Be
Improved




travel and contacts; and (3) monitoring visits and assignments of foreign
visitors to all of DOE’s facilities.1

Each laboratory has its own counterintelligence program, which is
conducted in compliance with DOE’s requirements, and laboratory
counterintelligence officers report directly to laboratory management. The
laboratories’ programs emphasize employee briefings and debriefings as
well increasing employees’ awareness and knowledge about
counterintelligence. Briefings and debriefings of employees take place
prior to and/or after an event (e.g., when hosting a foreign visitor or when
taking a foreign trip). In briefings, counterintelligence officers provide
information to employees on such concerns as the types of subjects to
avoid discussing with foreign visitors. In debriefings, these officers obtain
information from the employees that can help DOE determine if there are
indications that intelligence services are trying to target that laboratory or
its staff.2 Additionally, counterintelligence activities at each laboratory
include initial investigations of possible foreign intelligence efforts to
determine if referral to appropriate federal agencies would be warranted,
liaison with federal agencies, and gathering and recording such basic
counterintelligence information as foreign visitors’ activities at a
laboratory and persons contacted.

DOE  officials estimate that operating the headquarters counterintelligence
program costs about $1.8 million annually. For fiscal year 1996, DOE’s three
weapons laboratories had a total counterintelligence program funding of
$905,000 and 9.4 counterintelligence staff years—funding of $552,000 and
5.5 staff years at Livermore, funding of $100,000 and 1.1 staff years at Los
Alamos, and funding of $253,000 and 2.8 staff years at Sandia.3




1
 In addition, DOE field offices have counterintelligence program managers who are responsible for
conducting a counterintelligence awareness program and providing briefings and debriefings related to
foreign visitors and foreign travel.
2
 Briefings and debriefings are not conducted for all events; counterintelligence officers judgmentally
sample from the universe of events, according to such factors as the visitor’s country of origin or the
subjects to be discussed.
3
 Numbers for Sandia include its laboratories in New Mexico and California.



Page 41               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                      Chapter 4
                      DOE’s Counterintelligence Efforts Can Be
                      Improved




                      To understand the dangers posed by foreign visitors, DOE needs to perform
DOE Has Not Clearly   a comprehensive assessment of the threat to its laboratories by foreign
Defined the Threat    intelligence services. According to DOE and the FBI, the operation of an
Posed by Foreign      effective counterintelligence program is predicated upon a realistic and
                      comprehensive examination of the foreign intelligence and insider threats.
Visitors to Its       For example, according to the FBI, only a comprehensive threat
Laboratories          assessment can address the issue of whether foreign intelligence services
                      are making a concerted effort to target DOE laboratories, and if so, how
                      they can work together to counter the threat. This threat assessment can
                      also provide senior managers with an analysis of the global threat and the
                      information and technologies at DOE and the laboratories that are most at
                      risk.

                      Specific assessments, which are targeted studies that focus on
                      country-specific issues, and annual foreign visitor statistical studies are
                      also important because they can inform the laboratories about items of
                      counterintelligence concern. This information can then be used by
                      counterintelligence officers at each laboratory to mitigate the potential
                      risk to that laboratory and its employees. For instance, information
                      contained in these studies can be used to alert a laboratory’s senior
                      management and staff during briefings.

                      While DOE officials recognize the importance of both types of assessments,
                      DOE headquarters’ counterintelligence analysis has focused on the
                      specific-type assessments and has not addressed the overall threat to its
                      facilities. In recent years, DOE has done about 25 specific assessments,
                      which have examined specific threats or, in some cases, have been
                      statistical studies. For example, DOE has assessed the threat of Russian
                      organized crime to DOE and Pakistan’s access to DOE’s resources. In many
                      cases, such studies were based on the work of other agencies, such as the
                      CIA or FBI, or were contracted out. While these studies can be useful in
                      identifying a threat on a single issue, they do not relate the global foreign
                      intelligence threat to the local situation at a specific weapons laboratory.

                      DOE  counterintelligence officials at headquarters said that they need to do
                      a comprehensive threat assessment that relates the global foreign
                      intelligence threat to the laboratories, but they have been limited in their
                      ability to do so. They said that specific threat assessments have had a
                      higher priority because these studies meet the more immediate needs of
                      the laboratories. Moreover, DOE’s Counterintelligence Division has not had
                      the staffing or analytical expertise required for this effort. In this regard,




                      Page 42           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                       Chapter 4
                       DOE’s Counterintelligence Efforts Can Be
                       Improved




                       DOE’scounterintelligence officials said that they will need to rely on
                       information from other agencies to do a comprehensive threat assessment.

                       Recognizing the need for a comprehensive threat assessment, in the fall of
                       1996 the then Deputy Secretary of Energy directed each of the weapons
                       laboratories to conduct its own threat assessment, which DOE would then
                       use to develop an overall, comprehensive threat assessment. Although the
                       laboratories are in the process of completing their site threat assessments,
                       according to a DOE counterintelligence official, the Department may not be
                       able to develop a comprehensive assessment unless its priorities change
                       and DOE receives assistance from the U.S. intelligence agencies in
                       obtaining the sensitive intelligence information that is critical to develop
                       this assessment.


                       Oversight of the laboratories’ counterintelligence programs and their
DOE Has Not            activities—particularly setting expectations for program performance and
Effectively Overseen   periodically evaluating it—is one of the major responsibilities of DOE’s
the Laboratories’      Counterintelligence Division. However, DOE has not developed meaningful
                       performance measures or expectations for the laboratories’
Counterintelligence    counterintelligence programs or conducted periodic evaluations of them.
Programs               DOE’s oversight, however, has been hampered, in part, because the funding
                       for their programs has been through laboratory overhead accounts instead
                       of directly from DOE.

                       Meaningful performance measures for the laboratories’
                       counterintelligence programs are important because they would help
                       gauge whether or not those programs are achieving their intended
                       purposes. According to DOE Order 5670.3, Counterintelligence Program,
                       DOE is responsible for developing and implementing performance
                       measures for counterintelligence activities throughout the Department.
                       However, according to a counterintelligence official at headquarters, DOE
                       has not developed any performance measures or expectations to evaluate
                       the laboratories’ counterintelligence programs because DOE’s contracts
                       with the laboratories do not obligate their counterintelligence programs to
                       follow any such measures DOE may develop. According to this official, DOE
                       is considering both amending those contracts to address this problem and
                       issuing guidance and policy to define performance measures and
                       expectations for the laboratories to follow and be evaluated against. This
                       will be done after DOE completes its comprehensive threat assessment.




                       Page 43           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 4
DOE’s Counterintelligence Efforts Can Be
Improved




DOE’s periodic evaluations of the laboratories’ counterintelligence
programs are also important because they help provide assistance to each
laboratory as well as determine the effectiveness of their programs. DOE’s
counterintelligence order requires that the headquarters
Counterintelligence Division oversee the implementation of
counterintelligence policy and procedures at the laboratories. However,
officials from that division could identify only one review it has conducted
at the weapons laboratories, which occurred in 1996 in the form of a “staff
assistance visit” conducted at Los Alamos. DOE concluded from this visit
that because of inadequate staffing, Los Alamos’ counterintelligence
program was not comprehensive and only minimally accomplished the
requirements of DOE’s counterintelligence order. At that time, Los Alamos
had one counterintelligence officer.

Livermore and Sandia have not had their counterintelligence programs
reviewed by DOE headquarters. According to a DOE official, evaluations at
Livermore and Sandia have not occurred because of other higher-priority
work, such as the specific type of threat assessments mentioned earlier. In
addition, they said that DOE cannot require its laboratories to implement
any recommendations that might result from such evaluations. Without
periodic evaluations of all their counterintelligence programs, assessing
their effectiveness and objectively comparing one program with another
will be difficult.

One factor that makes control by DOE headquarters over the laboratories
difficult is that the counterintelligence programs are not funded directly by
DOE’s Counterintelligence Division. Until recently, each laboratory’s
program has been funded entirely from that laboratory’s funds and,
consequently, each laboratory operated its program autonomously.
Accordingly, each laboratory’s commitment to its program has differed, as
illustrated by the difference in staffing levels. For example, while
Livermore’s counterintelligence program had 5.5 staff years in 1996, Los
Alamos’ program had only 1.1 staff years, despite having almost twice as
many visitors from sensitive countries.4

According to the FBI, which has examined DOE’s counterintelligence
program, the structure of DOE and its relationship with contractor-operated
laboratories have resulted in their having assumed a high degree of
autonomy. This has resulted in a gap between authority and responsibility,
particularly when national interests compete with the specialized interests

4
 Although both laboratories had equivalent numbers of foreign visitors (about 2,800), Los Alamos had
nearly 1,000 visitors from sensitive countries, while Livermore had about 550 such visitors.



Page 44              GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                      Chapter 4
                      DOE’s Counterintelligence Efforts Can Be
                      Improved




                      of the academic or corporate management that operate the laboratories.
                      Furthermore, the FBI found that this autonomy has made national
                      guidance, oversight, and accountability of the laboratories’
                      counterintelligence programs arduous and inefficient. Moreover, DOE’s
                      Counterintelligence Division lacks direct management oversight and
                      control to ensure the laboratories comply with its policies. This frequently
                      puts the each laboratory’s counterintelligence staff in an awkward, if not
                      difficult, situation of dividing their loyalties between the interests of the
                      laboratory in pursuing cutting-edge research and development and the
                      need to safeguard U.S. national security interests.


                      DOE has recently recognized that its counterintelligence program has been
DOE Is Taking Steps   inadequate and has taken steps to strengthen it. The Congress
to Strengthen Its     appropriated $5 million to DOE in counterintelligence funding for fiscal
Counterintelligence   year 1997 in addition to its budget request, and DOE has used much of these
                      funds to support the counterintelligence programs at the weapons
Program               laboratories.5 In November 1996, DOE’s Deputy Secretary expressed
                      concerns about the presence of foreign visitors at the laboratories, and as
                      a result, several departmentwide corrective actions are now underway.

                      In the spring of 1996, the director of DOE’s Office of Energy Intelligence
                      briefed the staff of several congressional committees about the concerns
                      raised by the increasing number of foreign visitors to its laboratories and
                      the threat they posed. In the fall of that year, the Congress provided DOE
                      with an additional $5 million for fiscal year 1997 to expand
                      counterintelligence activities at its weapons laboratories and other
                      high-risk facilities. Of the $5 million, about half—$2.47 million—went to
                      the three nuclear weapons laboratories.6 The additional funds were used
                      to increase the number of counterintelligence staff at those laboratories
                      and for counterintelligence-related analyses. As a result, DOE has increased
                      the counterintelligence staff at the weapons laboratories.

                      On November 21, 1996, the then Deputy Secretary of Energy initiated
                      several corrective measures to improve DOE’s foreign visitors program. The
                      Deputy Secretary met with officials of five DOE facilities: the three

                      5
                      On April 25, 1997, we reported to the Committee about DOE’s use of the $5 million. Department of
                      Energy: Information on the Distribution of Funds for Counterintelligence Programs and the Resulting
                      Expansion of These Programs, GAO/RCED-97-128R.
                      6
                       An additional $1.27 million went to five other facilities; the remainder ($1.26 million) was spent on
                      counterintelligence analysis and assessment studies. When the $5 million was made available,
                      however, some facilities reduced or eliminated the funding they had previously provided for
                      counterintelligence and over $1 million was allocated to facilitywide support costs.



                      Page 45               GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
    Chapter 4
    DOE’s Counterintelligence Efforts Can Be
    Improved




    weapons laboratories, the Oak Ridge National Laboratory, and the Pacific
    Northwest Laboratory. Among the corrective measures the Deputy
    Secretary and these officials agreed to complete during fiscal year 1997
    were the following:

•   Develop training in export control and provide that training to laboratory
    staff at those five facilities.
•   Develop new guidance on unclassified, but sensitive, subjects (i.e., matters
    unsuitable for discussion with a foreign visitor).
•   Develop laboratory threat assessments of foreign visits and assignments.
•   Develop a DOE-wide comprehensive threat assessment of foreign visits and
    assignments.

    However, counterintelligence officials at headquarters expressed concerns
    about DOE’s ability to complete these initiatives because DOE has
    historically given its counterintelligence program a low priority and the
    tendency for the laboratories to resist headquarters management. They
    said that they are hopeful that DOE’s current Secretary will support these
    initiatives in the counterintelligence program.




    Page 46           GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 5

Conclusions and Recommendations


             With the end of the Cold War, DOE’s nuclear weapons laboratories have
             been moving away from secret research toward more open and
             cooperative research with a variety of nations and an increasing number of
             foreign nationals. Open collaboration can greatly benefit DOE and the
             United States by stimulating the exchange of ideas and promoting
             cooperation. This in turn can lead to more efficient research and increase
             the likelihood of important scientific discoveries. While recognizing that
             such cooperation is beneficial, it is important to note that foreign
             espionage efforts against DOE’s weapons laboratories may be more active
             than ever. Furthermore, these efforts may have expanded to include
             industrial espionage. All of this puts new burdens on DOE’s security.

             To respond to these challenges, DOE cannot entirely rely on systems left
             over from the Cold War. For a long time, DOE’s security controls have
             emphasized “guns, guards, and gates,” as well as strict control over
             anyone, including foreign visitors, allowed to enter the weapons
             laboratories. Where visitors went, whom they talked to, and what they saw
             were more carefully controlled than they are today. These controls, while
             still necessary in some places, cannot be expected to work in locations
             where openness, collaboration, and free access to information and ideas
             are encouraged. In these places, DOE needs a more sophisticated security
             strategy that is consistent with the laboratories’ more open missions and
             includes a greater role played by DOE and laboratory counterintelligence
             programs.

             Now more than ever, effective counterintelligence efforts must be central
             to DOE’s security strategy. Greater counterintelligence program
             effectiveness can be achieved through the development of a
             comprehensive threat assessment to determine the nature, extent, and
             targets of foreign espionage efforts against DOE’s weapons laboratories.
             Such an assessment could also form the basis for developing
             counterintelligence program performance measures as well as periodic
             headquarters evaluations of each laboratory’s performance. These
             evaluations would determine how effectively each laboratory is addressing
             the established performance measures and how their counterintelligence
             programs can be improved.

             In addition to establishing performance measures for DOE’s
             counterintelligence program, other parts of the overall strategy could be
             improved by clarifying what constitute sensitive subjects, tightening
             procedures for background checks, and reassessing procedures for foreign
             visits to controlled areas. For example, clarifying what subjects are



             Page 47        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                      Chapter 5
                      Conclusions and Recommendations




                      sensitive and requiring an independent review by technically qualified
                      personnel of all subjects proposed for discussion during a visit would help
                      ensure that researchers, program managers, and DOE headquarters officials
                      would have the same understanding of what needs to be protected so
                      discussions of sensitive subjects would not occur without the knowledge
                      of DOE. DOE and laboratory officials recognize the problems with
                      identifying sensitive subjects and have established internal review
                      processes to better focus on those foreign visits that involve sensitive
                      subjects. However, without a clear understanding of what information DOE
                      considers sensitive, these improved review processes cannot provide
                      adequate assurance that foreign visits involving sensitive subjects are
                      appropriately identified and reviewed.

                      Increasing the number of background checks on foreign visitors from
                      sensitive countries will enable DOE to better assess individual situations
                      from a security point of view. When necessary, actions can then be taken
                      to mitigate the risks of a particular visit. While background checks cannot
                      identify all foreign visitors who pose a risk, they are a valuable tool for
                      alerting DOE and the laboratories of situations that may warrant more
                      attention and control. DOE’s current foreign visitor order contains
                      requirements that would increase the number of background checks
                      obtained; enforcing those requirements at the laboratories, especially at
                      Los Alamos and Sandia, should enable DOE to expand its advance
                      knowledge of risks associated with the visits and, if necessary, mitigate
                      those risks.

                      Finally, a specific assessment of vulnerabilities related access to
                      unclassified, but sensitive information in controlled areas is needed. This
                      assessment will help ensure that procedures for these areas are consistent
                      from laboratory to laboratory and security vulnerabilities and/or problems
                      are identified and corrected. In addition, this assessment could identify
                      best practices that DOE could disseminate for use to all laboratories for
                      improving the protection of sensitive information that may be exposed to
                      foreign visitors.


                      We recommend that the Secretary of Energy:
Recommendations
                  •   Direct DOE’s Counterintelligence Division to perform a comprehensive
                      assessment of the espionage threat against DOE and the weapons
                      laboratories to serve as the basis for determining appropriate
                      countermeasures and resource levels for laboratory counterintelligence



                      Page 48          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
                         Chapter 5
                         Conclusions and Recommendations




                         programs. To the extent possible, this assessment should include the
                         laboratories as well as other agencies with appropriate expertise, such as
                         the FBI and CIA.
                     •   Establish appropriate program performance measures and expectations
                         for the laboratories’ counterintelligence activities and require periodic
                         performance reviews to help determine if their activities are effectively
                         preventing foreign espionage.
                     •   Revise DOE’s foreign visitor order to (1) clarify to all DOE and laboratory
                         contractor personnel the specific types of unclassified, but sensitive,
                         subjects that require protection from compromise by foreign nationals and
                         (2) require that the subjects of visits be independently reviewed by experts
                         with appropriate technical backgrounds—such as laboratory individuals
                         involved in export control issues—to verify that visits involving sensitive
                         subjects are adequately identified for DOE’s review.
                     •   Require that DOE and the weapons laboratories comply with the current
                         foreign visitor order by obtaining background checks on all assignees from
                         sensitive countries. Further, require the laboratories to inform
                         headquarters of the names of all other proposed foreign visitors from
                         sensitive countries so DOE’s Counterintelligence Division can obtain
                         additional background checks at its discretion.
                     •   Require that security measures at each laboratory’s controlled
                         areas—those most accessible to foreign visitors—be assessed to ensure
                         that the controls over persons and information in these areas are effective.
                         This assessment should also identify the best practices at each laboratory
                         to improve protection of sensitive information that may be exposed to
                         foreign visitors.


                         DOE  had no comments on the general nature of the facts in the report and
DOE’s Comments and       concurred with our recommendations. The Department, however, believes
Our Response             that the report overstates the value of background checks on foreign
                         visitors. DOE believes that foreign intelligence services increasingly rely on
                         “non-official collectors”—who would have clear background
                         checks—instead of intelligence officers. We do not believe we are
                         overvaluing background checks. We recognize that these checks are but
                         one factor DOE considers in approving foreign visits. Nevertheless, the
                         information obtained through background checks can be of importance in
                         determining if additional risk is associated with a foreign visitor.
                         Consequently, we are recommending that DOE complete background
                         checks in accordance with its foreign visits and assignments order.




                         Page 49          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Chapter 5
Conclusions and Recommendations




DOE  also suggested that we revise our recommendation on the assessments
of information security in controlled areas. A key point in DOE’s suggested
revision was to have the recommendation specify that an operations
security assessment be done of each laboratory’s controlled areas,
whereas we recommended only that an assessment be done. We did not
revise our recommendation to specify this type of assessment because,
while we believe that operations security principles and personnel must be
part of any assessment of the laboratories’ controlled areas, other
elements of DOE’s security programs can also provide value in an
assessment. We do not want to be overly prescriptive on how and/or by
whom these assessments be done. DOE also suggested that the wording of
the recommendation more clearly focus on protecting sensitive
information. We revised the recommendation to clarify that the
assessments should identify the best practices to improve the protection
of sensitive information. Finally, DOE’s response detailed a number of
actions it has taken or plans to take to address the recommendations. We
did not address these actions as part of our work. The full text of DOE’s
comments are included in appendix IV.




Page 50          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Page 51   GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix I

DOE’s List of Sensitive Countries


               Algeria
               Armenia
               Azerbaijan
               Belarus
               China
               Cuba
               Georgia (Republic of)
               India
               Iran
               Iraq
               Israel
               Kazakhstan
               Kyrgyzstan
               Libya
               Moldova
               North Korea
               Pakistan
               Russia
               Sudan
               Syria
               Taiwan
               Tajikistan
               Turkmenistan
               Ukraine
               Uzbekistan




               Page 52        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix II

DOE’s List of Sensitive Subjects




               Page 53   GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix II
DOE’s List of Sensitive Subjects




Page 54            GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix III

Number and Percentage of Background
Checks Obtained for Foreign Visitors From
Sensitive Countries to DOE’s Nuclear
Weapons Laboratories, 1994-96
           Countrya              Livermore                               Los Alamos                               Sandia
                        Visits     Checks      Percent          Visits     Checks      Percent         Visits       Checks       Percent
Algeria                     8             7          88             6             0            0             2              0              0
Armenia                     1             0            0            6             0            0             1              0              0
                                                        b
Azerbaijan                  0             1                         1             0            0             0              0              •
Belarus                    12             7          58            13             0            0           15               0              0
China                     474           185          39           746           12             2          244               2              1
Cuba                        4             1          25             0             0            •             0              0              •
Georgia (Republic of)       0             0            •            0             0            •             4              0              0
India                     193            85          44           407             5            1          214               7              3
Iran                       26            11          42            20             0            0           19               0              0
Iraq                        2             1          50             3             0            0             4              0              0
Israel                     60            27          45           114             0            0           58               2              3
Kazakhstan                  8             2          25            37             0            0           15               2             13
Kyrgyzstan                  0             0            •            1             0            0             0              0              •
Libya                       2             0            0            0             0            •             0              0              •
Moldova                     0             0            •            3             0            0             0              0              •
Pakistan                    6             2          33             8             1           13           16               0              0
Russia                    653           302          46         1,110          116            10          474             33               7
                                                        b
Syria                       2             3                         5             0            0             0              0              •
Taiwan                     65            33          51            97             3            3           43               1              2
Turkmenistan                0             0            •            0             0            •             7              0              0
Ukraine                    47            22          47            69             0            0           38               1              3
                                                        b
Uzbekistan                  0             1                         0             0            •             2              0              0
                                    a
                                     The following countries that changed status from sensitive to nonsensitive during 1994 are not
                                    included in this table: Argentina, Brazil, Bulgaria, Burma, Cambodia, Chile, El Salvador, Ethiopia,
                                    Romania, South Africa, South Korea, Vietnam, and Yugoslavia.
                                    b
                                     According to DOE, background checks outnumbered visits for Azerbaijan, Syria, and Uzbekistan
                                    because checks may have been obtained for planned visits that were later canceled.

                                    Source: GAO’s analysis of data from DOE and the weapons laboratories.




                                    Page 55                 GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV

Comments From the Department of Energy




              Page 56   GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 57          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 58          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 59          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 60          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 61          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix IV
Comments From the Department of Energy




Page 62          GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Appendix V

Major Contributors to This Report


                       Gary L. Jones, Associate Director
Resources,             William F. Fenzel, Assistant Director
Community, and         Dave Brack
Economic               John R. Schulze

Development Division
Washington, D.C.
                       James C. Charlifue
Denver Regional        Frank B. Waterous
Office




(141002)               Page 63        GAO/RCED-97-229 DOE Needs to Improve Controls Over Foreign Visitors
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested