Los Alamos National Lab missing 67
computers
One security incident involves
BlackBerry loss in 'sensitive' foreign nation
February 12, 2009 (Computerworld) New Mexico-based Los Alamos National Laboratory (LANL), the
nation's leading nuclear weapons lab, once again finds itself the focus of
concerns about potentially serious cybersecurity lapses.
The Project on Government Oversight (POGO), a
watchdog group, yesterday released a memo from the Department of Energy's
National Nuclear Security Administration (NNSA) expressing concern over the
theft of three computers from the home of an employee at Los Alamos National
Security LLC (LANS) in January.
LANS is a limited liability company comprising the University of California at Oakland, Bechtel National Inc. and two other firms that
have been managing LANL since 2006.
The Feb. 3 NNSA letter expressed frustration at
LANS's lackadaisical response to the theft and the apparent lack of controls
aimed at preventing such incidents in the first place. It noted that follow-up
inquiries about the January incident revealed that as many as 67 LANS computers
are currently "missing" from the lab, including 13 that are known to
have been lost or stolen. It is not clear yet whether any of the computers
contained classified or sensitive information.
The memo noted that LANS originally treated the
January thefts as a "property management issue." As a result, the DOE
did not learn of the missing hardware right away, limiting its ability to
respond quickly to the potential loss of sensitive information, the DOE said in
its letter. The agency also hit "significant weaknesses in individual
controls," configuration management and accountability, and said it is
still unsure about the "magnitude of exposure and risk."
Citing an internal memo, POGO last week also disclosed that in a
separate incident, a LANL employee had lost an official BlackBerry in a "sensitive" but
undisclosed foreign nation.
Ingrid Drake, an investigator for the
Washington-based POGO, said the NNSA memo shows that it feels "it has been
kept out of the loop" regarding potential security lapses at LANS. It is
also significant that there is continuing uncertainty whether the missing
computers contained sensitive or classified data, she said.
"They say, at best, there is no sensitive information,"
Drake said. That suggests that no system is in place for knowing what kind of
information is contained on computers used at the laboratory, or if there is
one, that it isn't functioning as it should, she said.
A spokesman for the NNSA referred a request for
comment on the missing computers to LANS officials, who did not immediately
respond to a request for comment.
The latest revelations highlight LANL's continuing
cybersecurity woes. In July 2007, the DOE proposed levying a record $3 million fine on the University of
California and a separate $300,000 fine on LANS for alleged failures to protect
classified information in an October 2006 security breach. The formal
enforcement actions against both organizations followed months of investigation
into the breach, in which a contract worker at LANL illegally downloaded and
removed hundreds of pages of classified data from the site via USB thumb drives.
Barely a month earlier, the laboratory was the subject of scathing criticism by lawmakers
after it was discovered that several LANS officials used unprotected e-mail
networks to share highly classified information related to the characteristics
of materials used in nuclear weapons.
In June 2000, several computer disks containing
classified information on how to disarm Russian and American nuclear devices
were found to be missing from a secure storage area.
In addition to those problems, LANL on Jan. 28 warned nearly 1,900 employees and visitors about possible exposure to beryllium based on recently discovered beryllium contamination at one of the lab's technical areas. Beryllium is a non-radioactive but hazardous material with many applications in electronics, aerospace and weapons work, the laboratory noted.