DEPARTMENT OF DEFENSE
OFFICE OF THE INSPECTOR GENERAL
REPORT OF INVESTIGATION AUG 28 2000
ALLEGATIONS OF BREACHES OF SECURITY:
DR. JOHN M. DEUTCH, FORMER DEPUTY SECRETARY OF DEFENSE
AND
FORMER UNDER SECRETARY OF DEFENSE FOR
ACQUISITION AND TECHNOLOGY
ALLEGATIONS OF BREACHES OF SECURITY
BY
DR. JOHN M. DEUTCH,
FORMER DEPUTY SECRETARY OF DEFENSE
AND
FORMER UNDER SECRETARY OF DEFENSE
FOR
ACQUISITION AND TECHNOLOGY
On February 9, 2000, the Secretary of Defense requested the Deputy Inspector General and the Acting General Counsel, Department of Defense (DoD), conduct a review of material obtained by the Office of Inspector General, Central Intelligence Agency (OIG, CIA), during its investigation into allegations of breaches of security by Dr. John M. Deutch. Specifically, the Secretary of Defense requested that we review a journal that Dr. Deutch maintained on a computer while he served as the Under Secretary of Defense (Acquisition and Technology) (USD(A&T)), the Deputy Secretary of Defense (DEPSECDEF) and the Director, Central Intelligence (DCI). The Secretary of Defense also requested that we obtain from the CIA any other information or documents relating to potential matters of concern to the DoD.
Subsequently, the former DEPSECDEF, Dr. John Hamre directed the Assistant Secretary of Defense (Command, Control, Communications and Intelligence) (ASD(C3I)) to conduct a damage assessment of Dr. Deutch's journal as well as of any other potentially classified material maintained by Dr. Deutch on unclassified computers or computer media during his tenure with the DoD. A complete analysis of that information and final damage assessment will be reported by the ASD(C3I).1
-
1 During the course of our inquiry, the President's Foreign
Intelligence and Advisory Board (PFIAB) and the Department of Justice
(DOJ) also initiated separate inquiries into the actions of Dr. Deutch.
Upon request, the Deputy Inspector General, DoD, briefed the PFIAB on
two occasions concerning the scope of our inquiry and provided
preliminary findings. In May 2000, the PFIAB completed their work
and provided their report to the President. The review by the DOJ
is not yet complete.
- determine the disposition of computers used by Dr. Deutch
during his tenure as the USD(A&T) and as the DEPSECDEF;
- determine what information Dr. Deutch stored on computers
while he served as the USD(A&T) and the DEPSECDEF; and,
- recover all information and documents relating to potential matters of concern to the DoD.
We find his conduct in this regard particularly egregious in light of existing DoD policy directives addressing the safeguarding of classified information. This situation was exacerbated because Dr. Deutch, while serving as the DEPSECDEF, declined departmental requests that he allow security systems to be installed in his residence. Dr. Deutch, the second highest-ranking individual in the Department, personally addressed the need to properly safeguard information in a memorandum he signed in February 1995. In part, the memorandum states that only "properly reviewed and cleared" information be placed on electronic systems accessible to the public. The evidence we obtained clearly establishes that Dr. Deutch failed to follow even the most basic security precautions.
There are also several other concerns that warrant comment. For example, accurate property accountability practices and procedures for the disposition of computers were lacking within the Office of the Secretary of Defense (OSD). During our inquiry we identified computers that Dr. Deutch used or could have used during his time with the Department. Several of the computers that we recovered contained a significant amount of DoD information. These computers were either donated or sold to private entities through the reutilization process. Security personnel at the ASD(C3I) have determined that none of the information remaining on the hard drives of these computers was classified. This determination, however, does not negate the Department's potential exposure to the improper release and use of classified or sensitive information. Several witnesses told us that they believed that the Department had an existing policy which required that the hard drives used to process classified information must be removed from the computer and destroyed. However, the witnesses were not able to produce and we were unable to document such a policy. Current policy on what is required to dispose of these types of hard drives is not clear. We recommend that the Department implement policy that requires the destruction of all computer hard drives, classified and unclassified, before the computer is disposed of outside the DoD.
II. SUMMARY
Although poor property accountability practices within OSD hindered our investigation, we were able to identify the computers used by Dr. Deutch. Specifically, we found that during his tenure as the USD(A&T) and DEPSECDEF, Dr. Deutch used at least seven different Government-owned computers, all of which were Macintosh. He used a Quadra 800, two Quadra 650s, a Power PC 7100 and three Powerbook laptops: a 180, a 180c, and a 540c. We believe the Quadra 800 and the 180 laptop were later sent to the Defense Reutilization and Marketing Office (DRMO), for destruction as scrap. Our review indicates that after he left the DoD one of the Quadra 650s was reissued and eventually excessed and sent to the DRMO. We could not determine the final disposition of the other Quadra 650. There are indications however, the CIA may have recovered it from Dr. Deutch's residence in [deleted] in 1995. The Power PC 7100 was transferred to the CIA when Dr. Deutch became the DCI. The 180c and 540c Powerbook laptops were eventually excessed by the DoD and transferred to Florida A&M University as part of the Educational Institutions Partnership Program. We recovered both of these laptops from Florida A&M and sent them to the National Security Agency (NSA) and the Defense Computer Forensics Laboratory (DCFL) for data recovery.
We also found that during Dr. Deutch's tenure with the Department his email, including "dial-in" access, was processed by a Macintosh Quadra 800 and backed-up by a Macintosh 8150. When Dr. Deutch left his position as the DEPSECDEF to become the DCI, personnel at the CIA made arrangements with DoD personnel which allowed Dr. Deutch to obtain "dial-in" access to the OSD electronic mail (email) server which he used from May 10, 1995, until January 27, 1996. Media analysis of the hard drive of the backup server resulted in the recovery of 1,089 pages of email. Personnel from the ASD(C3I) have determined that none of the emails contained classified information. A description of the DoD computers that were issued to Dr. Deutch during his tenure as the USD(A&T) and as the DEPSECDEF and the disposition of those computers is attached.
III. BACKGROUND
Dr. Deutch served as the USD(A&T) from April 2, 1993, to March 11, 1994, at which time he became the DEPSECDEF. He served in that capacity until May 10, 1995, when he became the DCI, a position he held until December 16, 1996. While in the USD(A&T) position, Dr. Deutch received computer support from USD(A&T) Executive Support, Information Technology Branch (ITB). Contractor personnel from Advanced Systems Development, Incorporated of Shirlington, Virginia, augmented the permanent ITB staff. [Deleted] was an employee of this firm and a key witness in this matter. [Deleted] provided support to Dr. Deutch while he was the USD(A&T) and, on occasion, after Dr. Deutch became the DEPSECDEF. In June 1995, [deleted] became a member of a computer support group at the CIA and continued to provide computer support to Dr. Deutch.
IV. SCOPE
During our inquiry, Special Agents of the Defense Criminal Investigative Service (DCIS), the criminal investigative arm of this office, interviewed several former and current OSD employees and DoD contractors that we believed were knowledgeable of Dr. Deutch's use of computers while with the DoD. We attempted to interview Dr. Deutch during the course of our review, however, based on the advice of his counsel, he declined. The DCIS Special Agents also reviewed pertinent procurement and other inventory records at the Washington Headquarters Services (WHS), the DRMO, the Defense Supply Service-Washington (DSS-W), and the Defense Information Systems Agency (DISA).
We conducted extensive coordination with the OIG, CIA, and the ASD(C3I) to ensure that all documents relating to potential matters of concern to the DoD, including Dr. Deutch's journal, were reviewed. We also coordinated with the NSA and the DCFL to facilitate analysis of the recovered computers we believe Dr. Deutch used while he served as the USD(A&T) and DEPSECDEF.
While conducting our fieldwork we recognized that our findings, to a large extent, would be based primarily on the recollection of witnesses about property transfers that occurred five to six years earlier. In addition, some property transfer and procurement records within the OSD at the time that Dr. Deutch served as the USD(A&T) and the DEPSECDEF (1993-1995) were already destroyed when we initiated our inquiry and the few existing records were often inaccurate or incomplete.
The findings in Section V (below) provide details concerning the computers that we believe were used by Dr. Deutch. We also expended substantial investigative resources in an attempt to identify, locate, and recover other computers within the offices of the USD(A&T) and the DEPSECDEF. As a result of this investigative approach, we identified several additional computers that Dr. Deutch could reasonably have used and we recovered them accordingly for analysis.
The following sets forth the results of our inquiry:
V. FINDINGS
A. What computers did Dr. Deutch use during his tenure as the USD(A&T) and where were those computers located?
-
Computers that Dr. Deutch used in his USD(A&T) office
Based on witness interviews and the limited documents available, we established that on April 1, 1993, Dr. Deutch received a Macintosh Quadra 800 computer for his office use. The computer was one of two such computers (serial numbers F33080NRCC7 and XB403H0X2D6) assigned to the USD(A&T) front office. No records were retained as to the specific assignment of each computer.2 During the course of our inquiry, we interviewed the Chief, USD(A&T) Executive Support, and three contractor personnel that were hired to provide support for Macintosh computers within USD(A&T). All of these witnesses told us that, to the best of their recollection, none of the computers in question were of the type designated to process or store classified information. Dr. Deutch used the Quadra 800 computer as a desktop workstation. The other Quadra 800 computer was used as a file server for the USD(A&T) front office.
-
2 Two witnesses told us that Dr. Deutch could have received a Quadra 800, an 840 or an 840AV, but they were not positive. Several other witnesses told us that although they could not recall the exact model of the 800 series that Dr. Deutch used, they were certain it was a "tower configuration." Meaning, that the size of the computer's case was large and upright which would indicate that this computer was a Quadra 800. In addition, we found no inventory records indicating that the USD(A&T) received the 840 or the 840AV when Dr. Deutch became the USD (A&T).
We could not establish with any degree of certainty the final disposition of either Quadra 800 computer. However, inasmuch as both computers were deleted from the USD(A&T) inventory at the same time in 1998, it appears that both were sent to the DRMO for disposal. Records indicate that one of the computers was sent to the DRMO at Fort Belvoir, Virginia, and later sent to the DRMO in Williamsburg, Virginia, for final disposal. During our fieldwork, we identified a contractor, Port Royal Metals, Inc., from Sheldon, South Carolina, who was the exclusive contractor for electronic scrap disposal during the period that the Quadra 800s would have been sent to the DRMO.3
-
3 Because Port Royal Metals, Inc., had the DRMO contract for electronic scrap, computers were initially sent to the DRMO at Fort Belvoir and then sent to the DRMO-Williamsburg for final disposal.
"...the DRMO Williamsburg demolished any equipment we picked up prior to loading. [Deleted] the crane operator was most diligent in destroying any material so that it would not have any commercial use except for scrap recovery. In fact, they so destroyed the material that we complained that their destruction of material made it most difficult to process at our plant."
-
Computers that Dr. Deutch used in his residence during his tenure as USD(A&T)
-
4 Several witnesses told us that Dr. Deutch's first laptop computer was a 180c. However, based on a combination of other witness statements and documents we believe that Dr. Deutch's first computer as the OSD(A&T) was a 180. [Deleted] told us that he destroyed the main board of the 180. His statement to us was corroborated by another contractor and we were able to track the 180 through disposal records. Of greater significance is that any data that was on the 180 at the time the main board was damaged would have been transferred to the 180c which we ultimately retrieved from Florida A&M University.
[Deleted] also told us that in January 1994 when the USD(A&T) front office began to receive the Quadra 650 computers, he installed a Quadra 650 in Dr. Deutch's personal residence in [deleted]. This computer was in addition to the computer that Dr. Deutch used in the office.
B. What computers did Dr. Deutch use during his tenure as DEPSECDEF and where were the computers located?
-
Computers used by Dr. Deutch in his office
-
Disposition of computers Dr. Deutch used at his DEPSECDEF office
We found no documentation reflecting the exact disposition of the Quadra 650. However, a witness told us that the subject Quadra 650 was "wiped" of data, applications reloaded and reissued within OSD. No records were located to confirm or refute this witness's statement. In the summer of 1998, the 180c and the 540c that Dr. Deutch used were transferred to Florida A&M under the Educational Institutions Partnership Program. We subsequently recovered those computers and sent them to NSA and DCFL for data recovery.
-
Disposition of computers that Dr. Deutch used at his residence while DEPSECDEF
As mentioned previously, in January 1994, Dr. Deutch, while still USD(A&T), was issued a Quadra 650 for use at his residence. In January 1995, Dr. Deutch was issued a Macintosh Power PC 7100 serial number FC452lW944H, for use at his personal residence. When Dr. Deutch left his DEPSECDEF position to become the DCI, the Power PC 7100 remained at his residence. Property records maintained by the WHS reflect that the DoD transferred ownership of the Power PC 7100 to the CIA in March 1996. [Deleted] told us that in September 1995, after Dr. Deutch became the DCI, he was at Dr. Deutch's residence performing computer maintenance on the Power PC 7100 when Dr. Deutch [deleted] asked him to remove the "old system" because Dr. Deutch no longer used it. [Deleted] told us that he believes that the "old system" was actually the DoD-purchased Quadra 650 that he installed in Dr. Deutch's residence in January 1994. [Deleted] told us that he distinctly recalls retrieving the computer, taking it to the CIA computer storage room, and labeling it as belonging to Dr. Deutch. This statement however is inconsistent with information provided by the Chief, USD(A&T) Executive Support, ITB. The Chief told us that he did not recall a Quadra 650 ever being installed in Dr. Deutch's residence. We were unable to resolve this discrepancy and determine whether a DoD-owned Quadra 650 was or was not installed in Dr. Deutch's residence.
C. Did Dr. Deutch store classified information on unclassified computers while serving as the USD(A&T) or as the DEPSECDEF?
In this section we address the storage media used by Dr. Deutch while with the Department and as the DCI, the procedures that were in place to ensure that sensitive or classified data were not inadvertently released; and whether the NSA and the DCFL recovered data from the computers he used.
Several witnesses told us that none of the computers that Dr. Deutch used during his tenure with the Department were designated to store classified data. Witnesses also told us that Dr. Deutch kept a detailed journal of his daily activities during his tenure with the DoD. This journal formed the basis for several issues previously investigated by the OIG, CIA and was found to contain classified information. While Dr. Deutch was the USD(A&T) and the DEPSECDEF, he maintained the journal on floppy disks. As mentioned previously Dr. Deutch was known to transport these floppy disks in his shirt pocket. [Deleted] told us that while Dr. Deutch was still with the DoD he began to experience a number of disk "problems." As a result, after he became the DCI, Dr. Deutch changed from using floppy disks to store his journal to using Personal Computer Memory Card International Association (PCMCIA) cards that were provided to him by the CIA. The OIG, CIA, investigation revealed that Dr. Deutch had four PCMCIA cards that contained nearly 100,000 pages of information, including the daily journal covering the period of Dr. Deutch's service as the USD (A&T), DEPSECDEF, and the DCI.
During his OIG, CIA, interview Dr. Deutch said that he became accustomed to exclusively using unclassified Macintosh computers while serving in the DoD. He also acknowledged that before becoming the DCI, he was aware of the security principle requiring physical separation of classified and unclassified computers. However, he also told the OIG, CIA, that he believed that when a file or document was deleted (i.e., placed in the trash folder) the information no longer resided on the magnetic media, nor was it recoverable. Dr. Deutch also said during his interview that it was his usual practice to create a document on his desktop computers, copy the document to an external storage device (i.e., floppy disk) and then delete the initial document.
Computer experts have advised us that each time the journal was updated the computer automatically created a temporary file that would be stored on the hard drive of the computer in use. Of particular concern is the fact that the OIG, CIA, discovered that Dr. Deutch accessed the Internet via his America Online (AOL) account using the same computer at his home that he used to update his journal.5 Therefore, it is feasible that a computer "hacker" could have gained access to Dr. Deutch's computer and the information stored in temporary files on the hard drive, including the journal.
-
5 During his interview with the OIG, CIA, Dr. Deutch said that [deleted] used the Government-owned computer in their [deleted] residence, as did [deleted].
According to [deleted] Dr. Deutch used the 180c and the 540c to store his journal. We recovered these computers from Florida A&M and interviewed the professor that ultimately received them for his use. The professor told us that the hard drive of the 180c did not work and therefore he never used the computer. However, he did turn on the 540c, but could not get his email program to work on this computer. He then simply put the computer on a shelf, and never used it again.
The Compromise and Computer Forensics Counterintelligence Services of the NSA and the DCFL performed forensic recovery examination of the hard drives of these two computers to determine whether the hard drives contained any data placed on them by Dr. Deutch. Both the NSA and the DCFL were able to recover a substantial amount of DoD information. Data analysis by the ASD(C3I) of the information recovered determined that the information was not classified. The ASD(C3I) will separately report his findings. The OIG, CIA, has advised us that Dr. Deutch processed classified information on the Power PC 7100 that they recovered from his residence during their investigation.
In addition to the aforementioned computers, we identified several other computers to which Dr. Deutch may have had access. Based on existing property accountability records, personnel within WHS generated a list of computers that Dr. Deutch may have used . All of these computers were found to have been sent to the DRMO for disposal. Subsequently, a private company, Olson Electronics of Baltimore, Maryland, purchased these and other DoD computers from the DRMO. Because the computers were purchased as "scrap," serial numbers were not always recorded as part of the transaction. However, we were able to trace and recover some of them. Contrary to the earlier practice of demolishing all computer hardware, the DRMOs at the time were selling computers intact.
We found that one Quadra 650 had been resold to a computer store in Crofton, Maryland, while five other Quadra 650s were resold to a Mennonite School in Ephrata, Pennsylvania. Two of the Quadra 650s at the school did not have hard drives in them. Also located at the school were six loose hard drives, of which two came from the two Quadra 650s mentioned above.6 We retrieved all of the computers and the loose hard drives, which we sent to the DCFL for analyses. The DCFL has advised us that only one of the six hard drives that we recovered contains DoD-related information, and that information was not attributable to Dr. Deutch. The ASD(C3I) has determined that this information is not classified.
-
6 We noted that inventory records for these computers were highly inaccurate.
The overall standard for information security is DoD 5200.1-R. That regulation requires that classified information be destroyed so that it cannot be reconstructed. The ADP Security Manual, DoD 5200.28-M provides a number of ways to remove such classified information, depending on the medium and the condition of the equipment. Those methods include overwriting a minimum of three times, exposure to a permanent magnet, and setting the memory locations alternately to ones and zeros for 1000 cycles.
The Defense Material Disposal Manual, DoD 4160.21-M, provides that before material is accepted for disposal by a DRMO, an accountable officer must certify that any information remaining on the computer is unclassified or has been declassified and that the material does not contain data unauthorized for release. That certification is to ensure that classified media has been declassified under procedures in the ADP Security Manual and that any information exempt from release under FOIA (e.g., proprietary, criminal investigation reports and personal data) has been removed. We found no certification documents for any of the computers used by Dr. Deutch during his tenure with the DoD.
D. Did Dr. Deutch have access to an OSD email server during his tenure as the USD(A&T) and DEPSECDEF and which computers did he use?
We found that in April 1993 the Chief, Information Technology Division, OSD, assisted Dr. Deutch in establishing what is referred to as "dial-up" scripts. According to this witness, he established three such "dial-up" scripts for Dr. Deutch which could be used on both office and home computers. One script enabled Dr. Deutch to have access to the Internet service provider at the Massachusetts Institute of Technology. The second script allowed Dr. Deutch "dial-up" service to [deleted] with respect to his personal banking services. The third script was for the Pentagon's dial-up service which allowed Dr. Deutch to "dial into" the OSD email server to receive and send email. Dr. Deutch's access continued during his tenure as the DEPSECDEF and was terminated on May 10, 1995, the day prior to becoming the DCI. As described later in this report, Dr. Deutch's access to the DoD email server was reinstated and continued until January 1996 when the CIA established "dial-in" capability to the CIA email server.
-
The computers that Dr. Deutch used as an email/fileserver during his tenure as the USD(A&T) and DEPSECDEF
We determined that the primary 800 email/fileserver supported the Macintosh computers within OSD. The 800 automatically retained a copy of all email traffic from the DEPSECDEF email accounts. The 800 continued to support OSD until OSD converted from using Macintosh computers to a Microsoft based email system.
The 8150 created incremental backups of the email/fileserver. There were three copies of email traffic, with the oldest copy being overwritten each time a backup was made. A witness told us that after the Microsoft based email system was in place for some time he deleted the archive of emails in order to free space on the hard drive of the 8150. In 1998, OIG, CIA, as part of their investigation, requested that the Department recover any data remaining on the hard drive of the 8150 which may have contained archived emails sent or received by Dr. Deutch while the DCI. As part of their investigation, the OIG, CIA, request focused on the 8150 because by this time the Quadra 800s had already been sent to the DRMO. During the resulting analysis, approximately 1,089 pages of email were recovered. Information recovered from the 8150 was subsequently copied onto several disks and retained. The server itself was also retained for about eight months and then, ultimately turned in to WHS for disposal. The computer disks containing the email information were turned over to ASD(C3I) security personnel for review. We have been advised that none of the recovered email documents were classified.
During our inquiry, it was determined that WHS had not disposed of the 8150. The 8150 was recovered and provided to the NSA and subsequently to the DCFL to determine whether any additional data remained on the hard drive. The NSA advised us that no additional data could be recovered from the 8l50 as it had been properly "clean-swiped."
E. Did Dr. Deutch have access to the OSD email/fileserver after he became the DCI and which file server did he use?
When Dr. Deutch transferred to the CIA, his access was terminated to the OSD email/fileserver. However, the next day, May 11, 1995, Dr. Deutch asked [deleted] who, by this time was a CIA employee, to restore his access. [Deleted] coordinated Dr. Deutch's request with the Chief, OSD Computer Support Branch and Dr. Deutch's access was reinstated. His access to the OSD email/fileserver continued until January 1996 when the CIA established "dial-in" capability for the CIA email server.7 According to [deleted] Dr. Deutch only used the OSD email server and did not have access to other files.
-
7 There is a conflict between two witnesses regarding the dates that Dr. Deutch was granted access to the OSD email server. One witness believes that Dr. Deutch was granted access the day after he became the DCI. Another witness believes that Dr. Deutch did not receive access until several months after he became the DCI. We do not view this discrepancy as significant as the issue is whether Dr. Deutch transmitted classified information using the OSD email server at any time during his tenure with the Department.
A. Dr. Deutch used at least seven different Government-owned Macintosh computers while with the DoD. He used a Quadra 800, two Quadra 650s, and a Power PC 7100. He also used three Macintosh Powerbook laptops: a 180, a 180c, and 540c. The Power PC 7100 was transferred to the CIA when Dr. Deutch became the DCI.
B. Dr. Deutch processed his journal that contained classified information on unclassified computers both at his residence and his office.
C. Dr. Deutch obtained access to and used the OSD email server after he left the Department.
D. Dr. Deutch's Government-owned computers were used by Dr. Deutch and his family to access his AOL account.
E. Several computers used by Dr. Deutch while he was with the Department were not adequately "clean-swiped.
VII. RECOMMENDATIONS
A. Implement policy requiring that all hard drives of computers to be disposed of outside the DoD be destroyed.
B. Reemphasize the prohibitions of placing classified material on computers not designated to store such information.
C Reissue warnings advising DoD personnel of the dangers of using the Internet while operating Government computers.
D. Examine property accountability practices for computers within OSD including computer hardware and software applications.
E. Review the procedures for granting access to the OSD email server to ensure that such access is granted to only those personnel that have a requirement to conduct departmental business.