Computer thefts prompt Los Alamos security review
- 19 February, 2009 09:46
The Los Alamos National Laboratories has launched a month-long project aimed at ensuring that offsite computer systems fully comply the institution's information security policies. Los Alamos officials are also conducting a full review of its policies and its procedures governing the use of official computers at home by employees of the laboratory.
The moves come after last month's theft of three computers from the home of an employee and the subsequent disclosure several dozen more systems are currently listed as missing from the top US nuclear weapons laboratory.
Jeffrey Berger, director of the communications at the Los Alamos, N.M. facility, office at the laboratory said that lab officials are taking the issue of the missing computers "very seriously." He noted that only one of the computers that was stolen from the employee's home was authorized for home use.
Berger did say that none of the missing systems held classified data. "It is true that [the Los Alamos lab], like any large organization that uses computers, has had computers go missing or get stolen," Berger said in an e-mail. But he insisted that despite apparent thefts, the lab has "consistently earned some of the highest ratings for property accountability" within the US Department of Energy's National Nuclear Security Administration (NNSA).
The latest apparent security breach at the Los Alamos lab follows a DOE move in July 2007 to fine the lab for an October 2006 breach that exposed classified data. In that case, a contract worker illegally downloaded and removed hundreds of pages of classified data from the lab via USB thumb drives.
Barely a month earlier, lawmakers slammed the Los Alamos lab after it was discovered that several Los Alamos officials had used unprotected e-mail networks to share highly classified information. And in June 2000, several computer disks containing classified information on how to disarm Russian and American nuclear devices were found to be missing from a secure storage area.
News of the missing computers was disclosed earlier this month by the Project on Government Oversight, or POGO. The watchdog group posted a memo on its site from the NNSA expressing concern over the theft of the three computers from the home of a Los Alamos National Security LLC (LANS) employee in January. LANS runs the facility for the US.
In addition to the missing computers, POGO also disclosed, that a LANL employee had lost a lab-owned BlackBerry in a "sensitive" but undisclosed foreign nation.
Page BreakThe NNSA letter, dated February 3, criticized the lab's response to the missing systems, and the apparent lack of controls aimed at preventing such incidents. The letter noted that follow-up inquiries about the January incident revealed that as many as 67 Los Alamos lab computers were currently listed as "missing" from the lab, including 13 that were known to be lost or stolen.
The memo chastised lab officials for treating the lost computers as purely a property management issue, and not informing the DOE immediately after the problem was discovered. The memo said that the DOE concluded that there are significant security weaknesses, as well as configuration management and accountability issues the lab. It also cited uncertainty about the "magnitude of exposure and risk" resulting from such losses.
Berger, however, contended that POGO and some news reports on the missing computers have "distorted the situation." He noted that Los Alamos employees and on-site subcontractors use about 40,000 computers and related equipment, including desktops, laptops, servers, printers, PDAs and other handheld devices.
Under NNSA requirements, The Los Alamos lab must account "for at least 98.7 percent" of its bar-coded property, including computer equipment, Berger said. "Over the past several years [Los Alamos] has consistently exceeded that requirement, accounting for 99.5 percent or more of its bar-coded property. The results of these annual inventories are independently validated by the NNSA's Service Center in Albuquerque as part of its annual assessment of LANL's property management system."
Berger said that during 2008, the lab deactivated 80 bar-coded pieces of computer equipment that were reported missing or stolen from the lab, Berger said. He said that 67 of the items were reported missing and 13 as stolen, he said. Eleven missing items, and one stolen piece of equipment have been recovered, Berger added.