FOR IMMEDIATE RELEASE
May 11, 1999
Richardson Unveils Security Reform Package
Includes Security Management & Oversight Overhaul,
New Counterintelligence & Cyber-Security Measures,
Cyber-Threat Training and Zero-Tolerance Security Policy
U.S. Secretary of Energy Bill Richardson today unveiled the largest, most sweeping reform of security programs in the department's history. The announcement includes the creation of a new high-level Office of Security and Emergency Operations and improved oversight, increased nuclear materials inventory accountability, additional cyber-security improvements, a zero-tolerance security policy, new counterintelligence measures, accelerated safeguard and security improvement goals, more physical upgrades, cyber-threat training, and an extension of the executive order on automatic declassification. Richardson's initiative is aimed at correcting long-standing bureaucratic problems and resource deficiencies and brings more accountability to the Department of Energy's (DOE) security programs.
"This security reform plan gives DOE the tools and authority we need to detect security infractions, correct institutional problems and protect America's nuclear secrets," said Secretary Richardson. "Coupled with previous counterintelligence and security measures we have already implemented, we are bringing more responsibility and accountability and high-level attention to these important matters."
Richardson's plan is as follows:
1. New Office of Security and Emergency Operations
A key component of Richardson's plan is a comprehensive security reorganization at the Department of Energy and its national laboratories. The plan calls for the creation of a new office, the Office of Security and Emergency Operations. It will be responsible for all safeguards and security policy, cyber-security, and emergency operations functions throughout the DOE complex.
The new office will oversee all security-related functions which previously were handled by different DOE program offices. Unfortunately, due to other demands placed on the program offices, security did not always receive the high-level consideration and focus it requires.
"By creating a consolidated security budget, where security funds are clearly separated from program funds, we ensure that security needs and priorities will not be compromised because of competing program requirements," said Secretary Richardson. "This new office which will report directly to me will strengthen and consolidate the management of our various security programs and will ensure the proper implementation of the many new counterintelligence and security measures I have ordered."
This new office will be compromised of several important components including:
- Office of Security Affairs
The Office of Security Affairs is responsible for directing department-wide safeguards and security and classification/declassification programs. This existing office establishes overall security policy for the DOE, including physical and personnel security, information security and nuclear material control and accountability. It has two existing subordinate operating arms, the Office of Safeguards and Security, and the Office of Declassification. The Office of Declassification is redesignated as the Office of Nuclear and National Security Information under today's reorganization. In addition, the two new offices established under the reorganization, described below, the Office of Foreign Visits and Assignments Policy and the Office of Plutonium, Uranium and Special Material Inventory, will also be part of the Office of Security Affairs.
- Chief Information Officer (CIO)
For the first time, all classified and unclassified cyber-security functions formerly performed by individual program offices will come under the authority of the department's Chief Information Officer. The CIO's office will be transferred to this new organization. It will develop policy and oversee the budget for all DOE cyber-security.
- Office of Foreign Visits and Assignments Policy
This new office will act as a central accounting center to track and analyze the details of all foreign visits and assignments for all DOE facilities to ensure that these are conducted in a secure manner. It will ensure that all visitors from outside the United States have appropriate checks and approvals for visiting all DOE facilities as well as for non-U.S. citizens working on contract to the department. Creation of this office was mandated as part of Presidential Decision Directive (PDD) 61 signed by
President Clinton in February 1998.
- Office of Plutonium, Uranium and Special Material Inventory
The Richardson plan calls for the creation of a new Office of Plutonium, Uranium and Special Material Inventory to enhance the tracking and accounting process for all special nuclear material throughout the entire Department of Energy complex. The office will provide regular reports to the Secretary on all special nuclear material accounting. The office will provide reliable and complete information on the most sensitive DOE fissile material in the domestic inventory as well as material transferred abroad.
2. Office of Independent Oversight and Performance Assurance
Richardson is creating a new office to independently evaluate security and emergency operations functions throughout the department. This new Office of Independent Oversight and Performance Assurance will provide independent analysis of the performance of safeguards and security and other critical functions from across the department. The new office will report directly to the Office of the Secretary.
As the case with other security-related issues, while security oversight has been an important departmental function, it was not the primary purpose of its umbrella office. By elevating and expanding the oversight functions for safeguards and security, special nuclear materials accountability, and other related areas to one new independent office, the department will ensure that any security problems can be quickly raised at the highest levels.
3. Cyber-security improvement
Richardson will ask Congress for an additional $50 million over the next two fiscal years (2000 and 2001) to support additional cyber-security improvements. The funding will implement additional upgrades in electronic and physical protection to ensure the continual monitoring of DOE computers for unauthorized and non-secure use. The enhanced program also will include random audits of individual computer users to ensure compliance with property security procedures. New requirements will be established that place stringent controls on computers and workstations, including controls on removable media, removable drives, and other devices that could be used to download files. The new funding request is in addition to the $8 million in cyber-security funds Richardson announced on March 17.
4. Zero-Tolerance Security Policy
The Richardson plan establishes a "Zero Tolerance Security Policy." Under this new policy, he is sending a signal that no security infractions are acceptable. Penalties will be strengthened, including immediate suspension for verified breaches that risk a significant national security compromise, or display a willful disregard for security procedures.
5. Counterintelligence Measures
Richardson also detailed several new security related measures to continue to strengthen the department's improved counterintelligence program.
- The department will end the backlog of all DOE background investigations. By the end of 1999, DOE will have initiated all outstanding re-investigations.
- The department will mandate the use of 'banners' across the complex which will alert users logging onto a system that they are operating on a government system which is subject to search and review at the government's discretion. In addition, security experts will now more easily be able to log e-mail and search computers.
- A special counterintelligence vulnerability assessment group called the "Red Team" will be established to evaluate espionage threat and vulnerability and conduct tests of the counterintelligence and security program.
- All DOE facilities will be required to use intrusion detection tools and report all intrusions to the department's Office of Counterintelligence and to the FBI's National Infrastructure Protection Center for investigation and analysis.
- The department and the FBI have signed a memorandum of agreement which ensures better coordination between DOE security and counterintelligence operations and FBI espionage investigations.
- DOE officials responsible for maintaining Q clearances and the Office of Counterintelligence must be notified of any issue that might impact the issuance and maintenance of such a clearance, even when such issues fail to rise to the level of a criminal charge.
- New security requirements are in place for all DOE and contractor employees requiring mandatory reporting when employees have contact with foreign nationals from sensitive countries.
These measures are in addition to a 46-point plan Richardson approved for implementation in the fall of 1998. The recommendations were created as a result of President Clinton's signing of Presidential Decision Directive (PDD) 61 in February 1998.
6. Strengthen the Security Management Board
The administration will submit to the Congress legislation that will strengthen the charter of the Security Management Board that oversees the Department of Energy's safeguards and security. The board is comprised of Department of Defense, Central Intelligence Agency and Federal Bureau of Investigation security experts that will continuously review DOE's safeguards and security.
7. Accelerate 'Goal Posts Plan'
To improve security at the Department of Energy nuclear sites, the Richardson plan accelerates the "Goal Posts Plan." The "Goal Posts Plan" is a statement of those specific actions that must be taken by DOE nuclear sites to remedy less than satisfactory ratings that were reported in the 1997/1998 Annual Report to the President on Safeguards and Security at Defense Nuclear Facilities. By the end of this calendar year, under the accelerated plan, the laboratories and facilities should have taken the corrective actions necessary for them to meet the highest security ratings.
8. Accelerate Upgrades to Physical Safeguards and Security
The department will seek significantly increased funding to ensure the physical safeguard and security of DOE nuclear sites. The plan also calls for the application of new technologies and capabilities, including the installation of explosive detection devices and chem-bio protection capabilities at sensitive laboratories.
9. Cyber-Security Training Program
The plan establishes an aggressive department-wide cyber-security training program using
mobile training teams. By the end of this year, 1,000 computer security and system
administrators from across the DOE complex will be trained in the use of cutting-edge cyber-security tools and procedures. The managers will be briefed on specific cyber-security threats, their responsibility to defend against it, and countermeasures available for implementation.
10. Declassification Deadline Extension
At Richardson's request, President Clinton will extend by 18 months the automatic declassification deadline of Executive Order 12958. Under the existing Executive Order, all classified documents over 25 years old will be automatically declassified in April 2000. The Department of Energy will use the 18-month extension to ensure that all documents released by the Executive Order will have been properly declassified and searched for inadvertently commingled nuclear design information. This step will help ensure the administration's openness initiatives don't jeopardize security concerns.
"It is clear that over the past several decades, security and counterintelligence at the nuclear weapons laboratories has not been given the necessary priority and attention," explained Secretary Richardson. "Senior officials at DOE did not do enough to counteract the lab culture which tended to resist adequate security efforts."
"As a result of work by DOE and FBI investigations, it became clear by the summer of 1997 that there were systemic problems that required an aggressive and systematic response," added Richardson. "This culminated in PDD-61 (issued in February 1998) which we are now aggressively implementing with priority on appropriate oversight and accountability."
[Fact Sheets and an Organization Chart that describe and illustrate the Secretary Richardson's security and oversight reforms accompany this news release. Additional information can be located on the World Wide Web (the URL address is http://www.doe.gov).]
- DOE -
R-99-111
Department of Energy Security Reform Package
Status of DOE Counterintelligence Plan Implementation (PDD-61)
Six Further Enhancements to DOE Cyber Security
Seven Counterintelligence Measures
Organization Chart
Department of Energy Security Reform Package
Safeguards and Security, Oversight, Cyber-Security,
Counterintelligence, Counterterrorism
1. Create a New Office of Security and Emergency Operations to oversee
Safeguards and Security, Cyber-Security, and Emergency Operations functions.
- Consolidates and rationalizes the Safeguards and Security and the Emergency
response and operations functions from throughout the entire Department of
Energy Complex under a new Security Czar.
- Brings classified and unclassified cyber-security functions from across the entire
Department of Energy complex under the CIO. Transfers the CIO into the new
organization.
- Resolves budget trade-off disputes by establishing a crosscut safeguards and
security budget. This new office will develop and oversee the budget for the entirety
of safeguards and security in the Department of Energy complex.
- Creates new Office of Foreign Visits and Assignments (FV&A) Policy to track and
monitor all FV&A, to ensure all FV&A are done in a secure manner, and to issue
regular reports to the Secretary on all visits.
2. Will create a new Office Of Independent Oversight and Performance
Assurance which will report directly to the Office of the Secretary
- The new office will provide independent analysis of the performance of safeguards
and security and other critical functions (Emergency Management, nuclear
materials accounting, etc.) across the department.
- Elevates and aligns the Department of Energy Independent Oversight and
Performance Assurance Functions to ensure that potential safeguards and security
deficiencies receive appropriate senior management attention and priority.
3. Establish new Office of Plutonium, Uranium and Special Material Inventory.
- Ensures constant tracking and accountability of all SNM on the entire Department
of Energy complex.
- Provides regular reports on all SNM accounting to the Secretary.
- Real-time, reliable and complete information on the most sensitive DOE fissile
material (plutonium, enriched uranium, uranium-233 and alternate nuclear
materials) on inventory domestically as well as transferred abroad.
- Support broad nuclear material information needs of the government and public
and assist in departmental decision-making.
4. Cyber-security improvements supported by a significant budget increase.
5. Establish a "Zero Tolerance Security Policy." That sets the standard that no
security infractions are acceptable.
- Strengthen penalties, including immediate suspensions for verified intentional or
reckless breaches that create a significant risk of a national security compromise, or that
display a willful disregard for security procedures.
6. Counterintelligence Improvements. Secretary Richardson has already
significantly rebuilt the DOE CI program. To ensure it is as effective as possible,
DOE is undertaking seven new initiatives.
- End the backlog of DOE background investigations. By the end of calendar 1999,
DOE will have initiated all pending re-investigations.
- DOE will mandate the use of "banners" across the complex which will apprise
users logging onto a system that it is subject to audit.
- New vulnerability "red teams" to certify the departments security and
counterintelligence capabilities.
7. Strengthen the "Security Management Board" that oversees the Department's
Safeguards and Security. (This is a board of DOD, CIA, FBI security experts that
review DOE's safeguards and security.)
- Propose legislation to strengthen this group's charter.
8. Accelerate the "Goal Posts Plan" to improve security at the Department of
Energy nuclear sites, so that by the end of this calendar year, they meet the
highest security ratings.
9. Accelerate Upgrades to Physical Safeguards and Security.
- Significantly increase funding to ensure security of the Department of Energy
nuclear complex.
- Apply new technologies and capabilities including: installation of explosive and
human detection devices and chem-bio protection capabilities at sensitive labs.
10. Establish an Aggressive Department-wide cyber-security training program
using mobile training teams.
- Train 1000 Computer security and system administrators from across the DOE
complex with cutting edge cyber-security tools and procedures. To be completed
by the end of this calendar year.
- Brief all managers of the specific cyber-security threats, their responsibility to
defend against it, and countermeasures available to do so.
11. Extend the automatic declassification deadline of Executive Order 12958 by
18 months.
Status of DOE Counterintelligence Plan
Implementation (PDD-61)
To enhance counterintelligence capabilities at DOE, President Clinton directed in
February, 1998 a major reorganization and reform of the DOE Counterintelligence
Program. A key element of the President's directive was the establishment of an
independent Office of Counterintelligence at the DOE that reports directly to the
Secretary of Energy.
The new Director of the Office of Counterintelligence was also directed to prepare a
strategic plan, with recommendations for strengthening counterintelligence at DOE and
its laboratories. That plan was approved by the Secretary in November 1998, and the
following recommendations have been implemented to date:
- The Director of the Office of Counterintelligence (OCI) is a senior executive from
the Federal Bureau of Investigation (FBI) who reports directly to the Secretary of
Energy. The Director also has direct access to the Director of Central Intelligence
(DCI) and the Director, FBI.
- The lab directors are now directly accountable to the Secretary of Energy for the
performance of the Counterintelligence Program at their locations. The Director,
OCI has assigned experienced Counterintelligence Officers (CIOs) at the five
weapons laboratories.
- The Director, OCI as the program manager for CI, has submitted a consolidated
budget request encompassing all CI activities, including personnel in DOE and the
laboratories. Henceforth, all DOE CI activities will be programmed and funded
directly by OCI.
- CIOs are monitoring all instances of close and continuing contact between DOE
personnel and foreign nationals from sensitive countries.
- The Director, OCI has established an internal inspection function to review
compliance with Presidential Decision Directive/NSC-61 (PDD-61) and evaluate
the performance of CIOs at DOE.
- The OCI Analysis Program has completed a threat assessment regarding two
countries of proliferation concern, and is working on the second in what will be a
series of threat assessments and other products designed to aid DOE's CI
professionals in better targeting their resources.
- The screening and adjudicative authority for the high-risk population has been
transferred to OCI. The OCI has created a Personnel Security Program which will
manage the CI-Scope Polygraph Program, an expanded financial disclosure
program, and forensic financial investigations.
- The Director, OCI has created a CI-Cyber Program, which is working in
coordination with the larger DOE Critical Infrastructure Protection effort, as
mandated by PDD-63.
- OCI has established formal procedures for referrals to the FBI mandated by
Section 811 of the Intelligence Authorization Act of 1995. OCI is directly involved in
the referral process.
- OCI has requested that FBI Headquarters recruit and station Special Agents with
counterintelligence experience in the five nuclear laboratory jurisdictions.
- Local CIOs have established formal procedures for liaison with their local FBI
counterparts. The efficacy of these procedures will be assessed in the inspection
process.
- OCI's Training Program is ensuring that CI and Security Awareness briefings are
better targeted to the audience, allowing for tailored presentations to various
segments of the laboratory community.
- CIOs are entering into the Counterintelligence Analytical Research Data System
(CARDS) sensitive country visit/assignment and foreign travel data that produces
CI relevant information.
- The Director, OCI is now a member of the DOE Special Access Program
Oversight Committee (SAPOC), and as such has been granted access to DOE
Special Access Programs in order to contribute to the development of heretofore
non-existent CI Plans required in the Security Program Manual.
- CIOs are requesting indices checks on all foreign national visitors and assignees
from sensitive countries, and on those non-sensitive country foreign nationals who
will have access to sensitive technologies and/or security areas.
- CIOs are contacting, either orally or in writing, all DOE employees having
interaction with foreign nationals from sensitive countries in any fora. Both OCI
personnel and CIOs are developing close and cooperative relationships with DOE
international scientific and non-proliferation exchanges for pre-briefing and
debriefing purposes.
Recommendations to be Implemented by August 31, 1999
- The current DOE Policy and DOE Order on Unclassified Foreign visits and
Assignments (to include all exemptions and waivers) will have been rescinded and
a new policy will have been issued by the Secretary of Energy. This new Policy will
reflect those CI recommendations regarding Foreign Visits and Assignments.
- All OCI federal employees, and volunteering OCI contractor employees, will have
taken the CI-scope polygraph. The "rule-making" procedures for applying the
CI-scope polygraph of all contractors in "high-risk" positions will also be in
progress.
- Each Laboratory Director will have developed an unclassified sensitive
technologies list for his/her facility and provided it to OCI.
- OCI's Analysis Program will have requested the CIA's assistance in filling critical
substantive gaps by assigning analysts on a rotational detail to OCI.
SIX FURTHER ENHANCEMENTS TO DOE CYBER SECURITY
DOE will take the following near-term actions to further enhance cyber security:
1)DOE sites will establish a program to continually monitor computer systems
for security
- Audits will be conducted of security and content, and system administrators will be
accountable for performance.
- Continual testing will ensure that vulnerabilities are not introduced when new
computers systems are added or configurations changed.
2) DOE will establish an aggressive Department-wide cyber-security training
program using mobile training teams.
- Train 1000 Computer security and system administrators from across the DOE
complex with cutting edge cyber-security tools and procedures. To be completed
by the end of this calendar year.
- Brief all managers of the specific cyber-security threats, their responsibility to
defend against it, and countermeasures available to do so
3)DOE will conduct random audits of individual computer users to ensure
compliance with proper security procedures
- Audit program will provide a significant deterrence to unauthorized activity
- Will include various tools and methods, such as e-mail and file sniffers, random file
audits, random supervisor checks, logging file access, and increased "logging" of
file transfers and print jobs.
4) The New Office of Oversight and Performance Assurance will establish a
program of continuous independent oversight of cyber security with support
from the Office of Counterintelligence
- Conduct a detailed assessment of cyber security at all three weapons laboratories
(Los Alamos, Lawrence Livermore, and Sandia) to verify the implementation and
effectiveness of recent cyber security enhancements.
- Establish a program to include unannounced inspections, remote testing for
network vulnerabilities, and attempts to penetrate computer systems using
techniques similar to those used by hackers.
- Establish a process to track corrective actions in response to independent
oversight findings
5) DOE sites will make better use of technology to combat the hacker and
espionage threats.
- Includes more stringent logging, controlling printed output, and establishing controls
to prevent coded and/or encrypted messages from leaving the DOE sites.
6) DOE orders regulating downloads from classified computer systems will be
enforced and compliance will be verified
- Ensure DOE orders in place to prohibit individuals from downloading classified
files to any removable media or printed matter without specific authorization.
- Establish requirements that place stringent controls on computers and
workstations, including controls on removable media, removable drives, devices,
printers, lap-link cables, and ports that could be used to download files.
Seven Counterintelligence Measures
To ensure that the Department of Energy's improved counterintelligence program is as
effective as possible, Secretary Richardson is implementing several new security related
measures, to include:
1. Ask the FBI to conduct all DOE "Q clearance" background investigations. End the
backlog of DOE background reinvestigations.
- Increase the DOE background check basic budget by $5M in 2000 ($30M to
$35M).
- By the end of calendar year 1999, DOE will have initiated all necessary
reinvestigations to end the current backlog.
- DOE is recommending to the FBI that the FBI conduct all background
investigations for DOE "Q" clearances.
2. Make necessary changes to regulations to allow auditing of all official government
computers across the DOE complex. Mandate the use of "banners."
- Banners will apprise users logging onto a system that the computers are for
government use only and the user may be monitored.
- DOE security and counterintelligence offices will now more easily be able to
log e-mail and search government computers within the National
Laboratories and nuclear weapons plants, as well as investigate
unauthorized activity/users on DOE systems
- DOE security and counterintelligence investigations and audits will increase
scrutiny of email traffic and other government computer use
3. Establish a counterintelligence vulnerability assessment group reporting to the
Department of Energy Office of Counterintelligence
- Analysis and "Red Team" groups to evaluate the threat and vulnerability of
DOE and the National Laboratories to espionage
- "Red Teams" would conduct classified operational tests of lab
counterintelligence and security program.
4. Require all DOE Facilities to use intrusion detection tools, and to report all
intrusions (root-level compromise) to the DOE Office of Counterintelligence and the
FBI's National Infrastructure Protection Center for investigation and analysis.
5. DOE and FBI have signed a Memorandum of Understanding which ensures better
coordination between the DOE Office of Counterintelligence and the FBI National
Security Division.
- Under new MOU, FBI and DOE are compelled to rapidly share information
about any potential espionage issues and investigations.
6. Positive Reporting Requirement for counterintelligence threats.
- Require all DOE Office of Counterintelligence employees, National
Laboratory Counterintelligence Officers, and all other supervisors of DOE
and DOE contract employees to notify the DOE official responsible for
maintaining Q clearances (the Office of Security Affairs) and the Department
of Energy Office of Counterintelligence of any issues that might impact
issuance and maintenance of such a clearance, even when such issues fail to
rise to the level of an indictment.
7. Create a special set of Security and Counterintelligence requirements for all DOE
and DOE contractor employees who have access to nuclear information. To
include:
- Mandatory reporting by all DOE employees of any substantive contact with
foreign nationals from sensitive countries
- Consolidation of two existing personnel security reliability programs into one
improved program
