Journal North:  Home | Sports | Opinion | Obits | Entertainment

          Front Page  paperboy  text  north

Tuesday, April 29, 2003

LANL Zinged on Computer Security

By Adam Rankin
Journal Staff Writer
    Los Alamos National Laboratory is criticized in a new report for a lack of adequate property controls over its 35,000 computers, including laptop computers with classified and proprietary information.
    The Department of Energy Office of the Inspector General issued the report Monday. It is the sixth report since January from the Inspector General's Office critical of LANL security, management and accountability processes.
    "We do not believe that Los Alamos can provide adequate assurance that classified, sensitive, or proprietary information is appropriately protected," DOE Inspector General Gregory Friedman wrote in a memo accompanying the report.
    The review found several problems with five laptop computers used to process classified information. Four computers were not on LANL's Office of Cyber Security's list of single-user, stand-alone computers; two were not approved to process classified information; and four were never entered into LANL's property database tracking system.
    LANL spokesman James Fallin said lab managers contest the report findings, arguing DOE investigators did not assess all the systems designed to protect classified information and computers. He did acknowledge that paperwork accounting for one layer of protection was incorrect.
    "The lab has maintained full accountability of all classified computers at all times," he said. "Further, we have determined that at no time was there any threat to the security of classified information or the protection of classified laptop computers."
    He said LANL has 2,400 classified computers, of which 160 are laptop computers.
    Fallin explained that LANL cyber security and computer information specialists built in redundancy in the lab's computer tracking systems to protect classified computers.
    "Even if a computer wasn't on the cyber security list doesn't mean our computer information office wasn't tracking the computer and its use," he said.
    Monday's report was issued just two days before Energy Secretary Spencer Abraham is expected to announce his decision on whether to allow University of California to continue operating the lab.
    The report focused on LANL accountability of its 5,000 laptop computers. A broader survey of controls over laptop and desktop computers will be included in a subsequent review.
    Aside from inadequate controls on classified computers, Monday's report found that "unlocated" computers were written off of the lab's property inventory without a formal inquiry, lab employees were never held financially accountable for lost or stolen computers and that laptop thefts were not always reported to LANL's Office of Security Inquiry, responsible for such investigations.
    It also found that of 1,093 new computers bought with purchase cards between 2001 and 2002, only about 30 percent, or 331 computers, were entered into the property management system.
    "The fact is every issue raised in the Inspector General's report has been or is being addressed under the laboratory's ongoing business improvement program that has been in place since January 2003," Fallin said.
    "Prior to receiving this audit, the laboratory had already instituted a rigorous approval review and tracking system for all computer acquisitions using the purchase card mechanism."
    The DOE Inspector General report strongly echoes a March 2002 memo by Glenn Walp, former head of LANL's Office of Security Inquiries, who was fired last fall by LANL's then-deputy director Joe Salgado.
    In that widely disseminated internal lab memo, which included a list of more than 250 computers listed as lost or stolen from 1999-2001, Walp wrote: "As I view it, reporting a desktop computer as lost, as in the case of the 2001 report where 33 were reported lost, is parallel to my spouse telling me she just lost the refrigerator."
    Now, Walp said he finds vindication in the many reviews that support his findings, which cost him his job and led him to become a government whistle-blower.
    "This DOE IG report ... confirms everything I have been saying since spring 2002," he said, especially that LANL security and investigations needs to be separate from LANL management.
    House Witnesses
    The U.S. House Energy and Commerce Committee released a tentative list of witnesses expected to testify at Thursday's hearing on the contract to run Los Alamos National Laboratory.
    The witnesses include Kyle McSlarrow, DOE's deputy secretary; Linton Brooks, undersecretary for nuclear security and acting head of the NNSA; DOE Inspector General Gregory Friedman; Richard Atkinson, UC's president; Bruce Darling, UC's acting vice president of lab management; Patrick Reed, UC's auditor; and Anne Broome, UC vice president for financial management.