DOE Inspector General Report on Security Self-Assessments at Los Alamos National Lab

FAS | Government Secrecy | Other Gov Docs ||| Index | Search | Join FAS

DOE/IG-0471

U.S. DEPARTMENT OF ENERGY
OFFICE OF INSPECTOR GENERAL
OFFICE OF INSPECTIONS

SUMMARY REPORT ON
INSPECTION OF ALLEGATIONS
RELATING TO THE
ALBUQUERQUE OPERATIONS OFFICE
SECURITY SURVEY PROCESS
AND THE SECURITY OPERATIONS’
SELF-ASSESSMENTS AT
LOS ALAMOS NATIONAL LABORATORY
MAY 2000

Department of Energy
Washington, DC 20585
May 30, 2000
MEMORANDUM FOR THE SECRETARY
FROM:
Gregory H. Friedman (signed)
Inspector General
SUBJECT:
INFORMATION: Summary Report on “Inspection of Allegations Relating to the Albuquerque Operations Office Security Survey Process and the Security Operations’ Self-Assessments at Los Alamos National Laboratory"
BACKGROUND
The Office of Inspector General received allegations regarding the conduct of security reviews at the Department of Energy’s (DOE) Los Alamos National Laboratory (LANL). Specifically, it was alleged that DOE Albuquerque Operations Office (Albuquerque) management changed the ratings of annual Security Surveys of LANL security operations after members of the Albuquerque Security Survey team completed the survey. It was also alleged that LANL Security Operations Division personnel were pressured by their managers to change or mitigate findings in LANL Self-Assessment reports.
RESULTS OF INSPECTION
Regarding the Albuquerque Security Surveys of LANL Security Operations, we found that:

Albuquerque management changed ratings for the 1998 and 1999 surveys without providing a documented rationale for the changes;

Albuquerque management did not fully address concerns about a compromise of force-on-force exercise during the 1998 Albuquerque Security Survey at LANL; and

The 1997 and some 1998 Albuquerque Security Survey work papers were destroyed contrary to Albuquerque policy on the destruction of records. As a result, there was no complete record to show how ratings were developed by the survey teams.
Regarding the LANL Security Operations’ Self-Assessments reports, we found that:

Approximately 30 percent of the LANL Security Operations Division personnel interviewed, who had been involved in the conduct of self-assessments, believed they had been pressured to change or “mitigate" security self-assessments;

Some security self-assessments required by LANL procedures were not being conducted; and

DOE’s Los Alamos Area Office security staff was not performing all of the oversight responsibilities associated with the LANL Security Operations Division programs.
We concluded that the processes used to develop the Albuquerque security surveys of the LANL security operations and the LANL self-assessments were inadequate. As a result, there are legitimate concerns that the overall security condition at LANL, specifically for Fiscal Years 1998 and 1999, was not being accurately reported.
We provided management with a number of recommendations that, if implemented, would improve the effectiveness of Albuquerque security surveys and LANL self-assessments.
MANAGEMENT REACTION
Albuquerque management stated that the facts presented and the conclusions reached were accurate, and that the recommendations were appropriate. Albuquerque management stated that they would take corrective action.
Due to the concerns identified during our inspection, we recommended that the Department review these operations at other facilities. Specifically, we requested that the Director, Office of Security and Emergency Operations evaluate self-assessment programs at other DOE facilities to determine if they have been fully implemented and adequately represent security conditions. The Director agreed to this recommendation.
Attachment
cc: Deputy Secretary
Under Secretary
Acting Under Secretary for Nuclear Security/Administrator for Nuclear Security
Director, Office of Security and Emergency Operations
Manager, Albuquerque Operations Office
SUMMARY REPORT ON INSPECTION OF ALLEGATIONS RELATING TO THE ALBUQUERQUE OPERATIONS OFFICE SECURITY SURVEY PROCESS AND THE SECURITY OPERATIONS’ SELF-ASSESSMENTS AT LOS ALAMOS NATIONAL LABORATORY
TABLE OF CONTENTS
Overview
Introduction and Objectives
Observations and Conclusions
Details of Findings
Changes to Security Survey Ratings
Management Rationale for Rating Changes
Compromise of Force-on-Force Exercise
Destruction of Records
LANL Self-Assessments
Los Alamos Area Office Oversight
Recommendations
Management Reaction and Inspector Comments
Appendices
A. Scope and Methodology
B. DOE Survey Requirements
C. 1998 Security Survey Rating Changes
D. 1999 Security Survey Rating Changes

Overview
Introduction and Objectives
The Office of the Inspector General received information from two complainants relating to security reviews at the Department of Energy’s (DOE) Los Alamos National Laboratory (LANL). LANL is operated by the University of California under contract with DOE. One complainant alleged that managers of DOE’s Albuquerque Operations Office (Albuquerque) Safeguards and Security Division, changed the ratings of periodic (annual) Security Surveys of LANL security operations after members of the Albuquerque Security Survey team completed the survey. Specifically, it was alleged that the Security Division managers upgraded survey ratings that were “Marginal" or “Unsatisfactory" as a result of “deals struck" between Albuquerque and LANL management officials. The second complainant alleged that LANL Security Operations Division personnel were pressured by their managers to change or mitigate self-assessment findings in LANL Self-Assessment reports. Both complainants alleged that the Albuquerque Security Survey reports at LANL and the LANL Self-Assessment reports did not clearly reflect the overall security conditions found by the survey field reviewers.
The objectives of our inspection were to determine: 1) if Albuquerque Security managers changed Albuquerque Security Survey ratings of LANL Security Operations; 2) if there was a basis for these changes; and, 3) if LANL Security Operations Division management had pressured its staff to alter self-assessment reports. This inspection did not include an evaluation of the overall security conditions at LANL.
During the course of this inspection, a number of individuals requested confidentiality. They indicated they feared retaliation for disclosing information to the Office of Inspector General (OIG).
Observations and Conclusions
We concluded that the processes used to develop the Albuquerque Security Surveys of the LANL Security Operations and the LANL Self-Assessments have raised legitimate concerns that the overall security condition at LANL was not being accurately reported.

Details of Findings
In order to ensure compliance with DOE requirements,¹ the Albuquerque Safeguards and Security Division conducts annual security surveys of LANL Security Operations. The topical areas evaluated during these surveys include: Program Management, Protection Program Operations, Information Security, Nuclear Materials Control and Accountability, and Personnel Security. Each topical area also has several sub-topical areas. The Albuquerque Operations Office assigns ratings of “unsatisfactory," “marginal," or “satisfactory" based on conditions existing at the end of survey activities. A complete listing of the topical and sub-topical areas is provided at Appendix C.
¹ The DOE requirements are specifically addressed at Appendix B.
Changes to Security Survey Ratings
Our inspection found that Albuquerque management changed ratings for the 1998 and 1999 Albuquerque Security Surveys of LANL Security Operations after the Survey Teams had assigned them. During the 1998 Albuquerque Security Survey at LANL, Albuquerque management upgraded several topic area survey ratings, and most importantly, the overall composite rating.² The OIG was told that had Albuquerque management not upgraded the topical and sub-topical ratings in the Nuclear Materials Control and Accountability topical area, and had management allowed the inclusion of a compromised force-on-force exercise, the overall composite LANL Security Survey rating would have been “Unsatisfactory."³ During the 1999 Albuquerque Security Survey at LANL, the overall composite rating was downgraded from “Satisfactory" to “Marginal" as were two sub-topical ratings and one topical rating. ⁴ The Survey Team initially rated LANL as “Satisfactory" based on the results of the 1999 Albuquerque Security Survey at LANL. However, during a final review, Albuquerque management determined that because the “23 rd Annual Report to the President on the Status of Safeguards and Security at Domestic Nuclear Weapons Facilities," dated Jan 1997/Dec 1998, contained an issue concerning storage of classified parts, a “Satisfactory" rating would be the wrong message to send to the contractor. Therefore, the composite rating was downgraded from “Satisfactory" to “Marginal." Albuquerque management said that the composite ratings needed to closely reflect the results of other DOE reviews that had recently been conducted at LANL.
² The 1998 rating changes are detailed at Appendix C. It should be noted that three of the seven ratings upgraded by Albuquerque management were the same as those ratings initially recommended by the Team Lead but subsequently downgraded by the “murder board."
³ According to DOE Order 470.1, when a Survey has a composite rating of “Unsatisfactory" and the rating indicates a significant vulnerability, the Operations Office Manager shall coordinate with the cognizant Program Secretarial Officer within 24 hours to: 1) take action to shutdown/suspend operations of the facility or activity, pending remedial action, or 2) apprise the cognizant Secretarial Officer and the Office of Safeguards and Security of the rationale for continuing this critical operation and identify immediate interim corrective actions being undertaken to mitigate identified risks or vulnerabilities.
⁴ The 1999 rating changes are detailed at Appendix D. Team Lead ratings were not found for the 1999 survey.
Management Rationale for Rating Changes
Although we found no evidence to support allegations of collusion or “deal making" between Albuquerque and LANL regarding the changes to the survey ratings, we did find that the survey reports did not contain any record of the rationale used by Albuquerque management for changing survey ratings. Albuquerque managers said that although Security Specialists conduct the surveys and propose recommended ratings for the sub-topic and topic areas, Albuquerque managers reserve “the right to take a look at what the survey team has developed" and decide what “message" should be sent to the contractor. Albuquerque management said that the rating process was “subjective" and that ratings remain “fluid" until a final report is issued. Contrary to the process identified in the Albuquerque Security Survey Procedural Guide, the Albuquerque managers said that they view it as a mistake to have the Security Specialists assign ratings because they do not have the overall LANL security program perspective prior to assigning final ratings and issuing the final security survey report. Further, in pursuing this matter, we found no other source which could provide the documented basis to support the Albuquerque management position concerning rating assignments or changes.
1999 Albuquerque Survey Team
The Albuquerque security survey team that conducted the 1999 Security Survey at LANL was composed of some inspectors and support service personnel who had never been assigned to a survey team previously and several who had not attended survey team training. Albuquerque management said that the 1999 Survey Team was short on staff because they had difficulty hiring qualified people to fill positions that had been vacated by retirements and other turnover. Two survey team members and two previous Survey Team Leads said they had questioned Albuquerque management about the appropriateness of the 1999 survey team’s experience and the sufficiency of the number of inspectors staffed to conduct the 1999 survey.
Compromise of Force-on-Force Exercise⁵
The OIG also found that Albuquerque management did not fully assess concerns about a compromise of a force-on-force exercise during the 1998 Albuquerque Security Survey at LANL. The OIG found that Albuquerque management refused to allow the survey team to include a finding concerning a compromise of a force-on-force exercise in the survey report, and did so without adequately investigating the alleged compromise. A Security Force-on-Force Exercise Specialist told us there were major concerns raised regarding the Guard Force response, that the exercise had not gone well, and that the concerns had been appropriately raised to Albuquerque management. Albuquerque management said they had been made aware of the concerns, however, there was no evidence of “cheating" and that “the losers always complain that the winner cheated." A Security Specialist said that, had the compromise of the force-on-force exercise been included in the 1998 Albuquerque Security Survey report, the composite rating would have been “unsatisfactory." Instead, LANL was given a “marginal" rating.
⁵ A force-on-force exercise is conducted as a performance evaluation to assess the capability of the safeguards and security system to meet performance objectives in response to an outside group referred to as an Adversary Force.
Destruction of Records
During our inspection we noted that the 1997 and some 1998 Albuquerque Security Survey work papers were destroyed contrary to Albuquerque’s policy on the destruction of records. The OIG also noted that some 1998 and 1999 work papers were either missing, not organized, or did not contain adequate summarization to support the ratings in the survey reports. As a result, there was no complete record to show how the survey teams developed the ratings.
LANL Self-Assessments
Since the inception of the LANL security self-assessment process ⁶ in 1996, LANL has had a history of not meeting all of its established self-assessment requirements. Specifically, the LANL Fiscal Years 1997 and 1998 Tier III Self-Assessment End-of-Year Reports indicate that some required Tier I and II self-assessments were not completed and that the process was not consistently implemented.⁷ During our inspection, LANL officials confirmed weaknesses in the Tier I and Tier II self-assessment processes. The OIG found that in one LANL division, Tier I reviews were not being completed because the Tier I security responsibilities were assigned on a part-time basis and other responsibilities held a higher priority. In another LANL division, the OIG found that there had been no Tier II self-assessments completed since March 1998 because staffing was not adequate given other priority work.
⁶ The LANL self-assessment process is described at Appendix B.
⁷ At the time of our report, the LANL FY-99 Tier III Self-Assessment End-of-Year Report had not been issued.
In addition to finding that some self-assessments were not conducted, the OIG also found an instance where a self-assessment report was written without a self-assessment review being conducted. The OIG was provided a copy of a Tier II Self-Assessment Report that was generated in 1999 to support a Tier II review that was never performed. The OIG was told that this report, prepared at the direction of a LANL manager, was provided to an Albuquerque Security Survey Team to represent a completed Tier II review. The LANL manager who was identified as directing the preparation of the report denied having knowledge of any such report being prepared.
Pressure to Change Or Mitigate Issues
Regarding LANL Self-Assessments, the OIG found that 8 of the 28 LANL Security Operations Division personnel interviewed (approximately 30 percent) who had conducted self-assessments believed they had been pressured to change or “mitigate" security self-assessments. Several of these individuals said LANL management appeared to be more concerned about making LANL and the Security Operations Division “look good" than reporting the actual security condition at LANL. The OIG was informed of two instances where LANL management became so upset with issues ⁸ raised by the initially assigned reviewers, that management reassigned other reviewers who subsequently determined that there were no issues to be raised and that the organizations were satisfactory.
⁸ LANL has developed their own definition for issues, concerns and observations. Issues are deficiencies discovered during an internal self-assessment that require a corrective action plan. Concerns and observations are suggestions that may require improvement and may be mentioned in the text of a report, but they do not require a corrective action plan.
In addition, the OIG was provided information which showed that LANL management downgraded 40 issues and four concerns initially identified in a self-assessment draft report to six concerns and six observations which appeared in the final report. When interviewed, a LANL manager said that the reviewer had raised some issues that could not be validated, other issues that were unsupportable, and that there appeared to be a personality conflict between the reviewer and the organization being reviewed.⁹ A senior LANL manager indicated that, given the number of self-assessment findings identified since 1995, there was no concerted effort to avoid or mitigate findings.
⁹ It should be noted that the reviewer had conducted self-assessments in the same organization for three years prior to this review and had no difficulties in reporting issues developed during the prior self-assessments.
Los Alamos Area Office Oversight (LAAO)
The OIG determined that DOE’s Los Alamos Area Office security staff was not performing all of the oversight responsibilities associated with the LANL Security Operations Division programs. Several DOE personnel told us that LAAO security was understaffed and did not have the technical expertise required to conduct all their oversight responsibilities. An Albuquerque manager confirmed that LAAO is understaffed and that the present staff has not had the necessary training to conduct the tasks required by their assignments. The manager told us there has been a reduction in full time equivalent positions at LAAO, and Albuquerque has not been able to replace staff that retire or leave for other positions. The Albuquerque manager said the two staff members that remain at LAAO’s Office of Security have the responsibility for oversight but they do not have the technical expertise in all areas for which they are responsible. As a result, the manager said Albuquerque has taken responsibility for the security areas for which the LAAO staff does not have the technical expertise. It should be noted that our review did not independently evaluate the staffing levels and experience of the LAAO staff.
Energy’s Office of Independent Oversight and Performance Assurance
The Department of Energy’s Office of Independent Oversight and Performance Assurance reviewed LANL security operations during 1999 and issued a report on August 27, 1999, titled, “Independent Safeguards and Security Inspection of Los Alamos National Laboratory." The OIG is providing our findings to the Office of Independent Oversight and Performance Assurance for its consideration.

Recommendations
We recommend that the Manager, Albuquerque Operations Office:
1. Ensure that the supporting rationale for changing survey ratings after they have been assigned by the Survey Team is documented, and that the justification and the rationale for the factors responsible for the composite facility rating are included in the survey report.
2. Ensure that Security Survey Team Personnel possess the requisite expertise and skill necessary to perform the survey and that team members have sufficient experience in the topical areas being reviewed.
3. Update the Albuquerque Security Survey Procedural Guide to comply with the Albuquerque Records Information Destruction Schedule with regard to the destruction of all survey and inspection files.
4. Ensure that LANL’s self-assessment program is fully implemented at all three-tier levels.
5. Review and assess staffing levels for security personnel at the Los Alamos Area Office, and ensure that the Area Office has adequate staff with the necessary technical expertise to carry out its security oversight responsibilities.
The OIG recommends the Director, Office of Security and Emergency Operations:
6. Evaluate self-assessment programs at other facilities to determine if these programs have been fully implemented and adequately represent the actual security conditions at the facilities.

Management Reaction and Inspector Comments
Management Reaction
In their response to the draft report, Albuquerque management stated that the facts presented and the conclusions reached were accurate, and that the recommendations were appropriate. Albuquerque management stated that they would take corrective action.
The Director, Office of Security and Emergency Operations agreed to evaluate self-assessment programs at DOE facilities, given the concerns identified during the inspection.
Inspector Comments
The actions planned and taken by the DOE Office of Security and Emergency Operations and the Albuquerque Operations Office were responsive to the recommendations.

Appendix A
Scope and Methodology
The OIG conducted this inspection at Los Alamos National Laboratory (LANL), Los Alamos Area Office (LAAO), and the Albuquerque Operations Office (Albuquerque) from April through November 1999. To accomplish our review objectives, the OIG:

Reviewed DOE O 470.1, “Safeguards and Security Program," and DOE O 471.2A, “Information Security Program;"
Reviewed the Albuquerque Security Survey Procedural Guide;
Interviewed Albuquerque, LAAO, and LANL personnel;
Reviewed documentation relating to security surveys and self-assessments;
Reviewed the Albuquerque Management Review Division report titled “Manipulation of Security Survey Results" dated July 9, 1999;
Reviewed the House Select Committee Report referred to as the “Cox Report" dated January 1999; and the President’s Foreign Intelligence Advisory Board’s report dated June 1999;
Reviewed self-assessment reports issued by the LANL Security Operations Division and Security Survey reports issued by the Albuquerque Operations Office; and
Reviewed the Office of Independent Oversight and Performance Assurance’s Independent Safeguards and Security Inspection of LANL dated August 27, 1999.
This inspection involved a review of the Albuquerque Security Surveys of LANL Security Operations and LANL’s Self-Assessment Program for Fiscal Years 1997, 1998, and 1999.
This inspection was conducted in accordance with “Quality Standards for Inspections" issued by the President’s Council on Integrity and Efficiency.

Appendix B
DOE Survey Requirements
The Department has mandated a “Safeguards and Security Program" through the issuance of DOE Order 470.1, SAFEGUARDS AND SECURITY PROGRAM. The purpose of this order is to ensure appropriate levels of security protection consistent with DOE standards to prevent unacceptable, adverse impacts to national security.
DOE Order 470.1 establishes that the responsible Operations Office assign ratings of “unsatisfactory," “marginal," or “satisfactory" based on conditions existing at the end of survey activities; and that survey reports include a justification and rationale for the overall composite facility rating. The order specifically states that these ratings are not to be based upon future or planned corrective actions. Additionally, the order establishes that the survey team personnel who conduct the Security Surveys are to possess qualifications, experience, and training (basic survey and team leader training) sufficient to accomplish effective and thorough surveys.
Albuquerque Security Survey Requirements
To assist in Albuquerque security survey reviews, the Albuquerque Safeguards and Security Division developed a Security Survey Procedural Guide dated May 22, 1997, which identifies the responsibilities of the Survey Team Lead, the Assistant Survey Team Lead, and the survey team members during each phase of the survey. This Guide outlines the survey team process. Specifically, the guide states that the DOE Team Lead is to conduct a “murder board" during which Topic Team Leads ¹⁰ support rating rationale/justification and assign final ratings. Survey team members also provide comments and clarifications for ratings assigned. The finalized information is then given to the report coordinator for inclusion in the survey report.
¹⁰ A “Topic Team Lead" is the individual assigned to head the team that reviews one of the five topic areas as identified in Appendix C.
Self-Assessment Requirements
DOE Order 470.1, Chapter X, SELF-ASSESSMENT PROGRAM, establishes the requirement for self-assessment programs at contractor facilities. It requires that self-assessment programs be conducted and documented for all cleared facilities and that the self-assessments be performed between the security surveys, which are conducted by the responsible Operations Office.
The LANL Safeguards and Security Self-Assessment Program is also mandated by the terms of the Department’s contract with the University of California, contract modification No. W-7405-ENG-36. This contact modification requires that “… the University will conduct an ongoing self-assessment process including self-assessments performed at the Laboratory as the principal means by which to evaluate compliance with the performance measures … against which [the] University’s overall performance of obligations under the contract will be determined."
The University of California, in compliance with contract requirements, has implemented a self-assessment program that is defined in a LANL Safeguards and Security Assurance Manual dated June 1996. This manual establishes a three tiered self-assessment process with a primary objective of ensuring the effective and efficient implementation of the LANL Safeguards and Security program.
The formalized safeguards and security self-assessment program includes a plan for each applicable topical and sub-topical area. The self-assessment process consists of a three-tier process. At Tier I, each LANL Division is required to conduct a self-assessment within the division. This is accomplished by the organizational safeguards and security officer, utilizing a checklist format, covering areas such as computer security, information security, property protection, and Nuclear Material Control and Accountability. At Tier II, each section within the LANL Security Division is required to conduct a self-assessment in their functional area(s). At Tier III, a LANL self-assessment is conducted by a team of Subject Matter Experts (SMEs) under the direction of LANL Security Division Program Integration Group.

Appendix C: 1998 Security Survey Rating Changes

Appendix D: 1999 Security Survey Rating Changes