[House Hearing, 110 Congress]
[From the U.S. Government Publishing Office]
63-238 PDF
2010__
2010
A REVIEW OF CONTINUING SECURITY CONCERNS AT DOE'S NATIONAL LABORATORIES
=======================================================================
HEARING
BEFORE THE
SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS
OF THE
COMMITTEE ON ENERGY AND COMMERCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED TENTH CONGRESS
SECOND SESSION
__________
SEPTEMBER 25, 2008
__________
Serial No. 110-152
Printed for the use of the Committee on Energy and Commerce
energycommerce.house.gov
?
U.S. GOVERNMENT PRINTING OFFICE
63-238 WASHINGTON : 2010
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected].
COMMITTEE ON ENERGY AND COMMERCE
JOHN D. DINGELL, Michigan, JOE BARTON, Texas
Chairman Ranking Member
HENRY A. WAXMAN, California RALPH M. HALL, Texas
EDWARD J. MARKEY, Massachusetts FRED UPTON, Michigan
RICK BOUCHER, Virginia CLIFF STEARNS, Florida
EDOLPHUS TOWNS, New York NATHAN DEAL, Georgia
FRANK PALLONE, Jr., New Jersey ED WHITFIELD, Kentucky
BART GORDON, Tennessee BARBARA CUBIN, Wyoming
BOBBY L. RUSH, Illinois JOHN SHIMKUS, Illinois
ANNA G. ESHOO, California HEATHER WILSON, New Mexico
BART STUPAK, Michigan JOHN SHADEGG, Arizona
ELIOT L. ENGEL, New York CHARLES W. ``CHIP'' PICKERING,
GENE GREEN, Texas Mississippi
DIANA DeGETTE, Colorado VITO FOSSELLA, New York
Vice Chair ROY BLUNT, Missouri
LOIS CAPPS, California STEVE BUYER, Indiana
MIKE DOYLE, Pennsylvania GEORGE RADANOVICH, California
JANE HARMAN, California JOSEPH R. PITTS, Pennsylvania
TOM ALLEN, Maine MARY BONO MACK, California
JAN SCHAKOWSKY, Illinois GREG WALDEN, Oregon
HILDA L. SOLIS, California LEE TERRY, Nebraska
CHARLES A. GONZALEZ, Texas MIKE FERGUSON, New Jersey
JAY INSLEE, Washington MIKE ROGERS, Michigan
TAMMY BALDWIN, Wisconsin SUE WILKINS MYRICK, North Carolina
MIKE ROSS, Arkansas JOHN SULLIVAN, Oklahoma
DARLENE HOOLEY, Oregon TIM MURPHY, Pennsylvania
ANTHONY D. WEINER, New York MICHAEL C. BURGESS, Texas
JIM MATHESON, Utah MARSHA BLACKBURN, Tennessee
G.K. BUTTERFIELD, North Carolina
CHARLIE MELANCON, Louisiana
JOHN BARROW, Georgia
BARON P. HILL, Indiana
DORIS O. MATSUI, California
_________________________________________________________________
Professional Staff
Dennis B. Fitzgibbons, Chief of
Staff
Gregg A. Rothschild, Chief Counsel
Sharon E. Davis, Chief Clerk
David L. Cavicke, Minority Staff
Director
7________________________________________________________________
Subcommittee on Oversight and Investigations
BART STUPAK, Michigan, Chairman
DIANA DeGETTE, Colorado JOHN SHIMKUS, Illinois
CHARLIE MELANCON, Louisiana Ranking Member
Vice Chairman ED WHITFIELD, Kentucky
HENRY A. WAXMAN, California GREG WALDEN, Oregon
GENE GREEN, Texas TIM MURPHY, Pennsylvania
MIKE DOYLE, Pennsylvania MICHAEL C. BURGESS, Texas
JAN SCHAKOWSKY, Illinois MARSHA BLACKBURN, Tennessee
JAY INSLEE, Washington JOE BARTON, Texas (ex officio)
JOHN D. DINGELL, Michigan (ex
officio)
C O N T E N T S
----------
Page
Hon. Bart Stupak, a Representative in Congress from the State of
Michigan, opening statement.................................... 1
Hon. John Shimkus, a Representative in Congress from the State of
Illinois, opening statement.................................... 3
Hon. Gene Green, a Representative in Congress from the State of
Texas, opening statement....................................... 5
Hon. Marsha Blackburn, a Representative in Congress from the
State of Tennessee, opening statement.......................... 5
Hon. John D. Dingell, a Representative in Congress from the State
of Michigan, opening statement................................. 6
Prepared statement........................................... 8
Hon. Michael C. Burgess, a Representative in Congress from the
State of Texas, opening statement.............................. 9
Witnesses
Gregory H. Friedman, Inspector General, U.S. Department of Energy 11
Prepared statement........................................... 13
Glenn S. Podonsky, Chief Health, Safety, and Security Officer,
U.S. Department of Energy...................................... 15
Prepared statement........................................... 18
Gregory C. Wilshusen, Director, Information Security Issues;
Accompanied by Allison Bowden, Senior Auditor, Government
Accountability Office.......................................... 33
Prepared statement........................................... 35
Bradley A. Peterson, Chief and Associate Director, Defense
Nuclear Security, National Security Administration............. 72
Prepared statement........................................... 75
Thomas N. Pyke, Jr., Chief Information Officer, U.S. Department
of Energy...................................................... 90
Prepared statement........................................... 92
Linda R. Wilbanks, Ph.D., Chief Information Officer, National
Nuclear Security Administration, U.S. Department of Energy..... 96
Prepared statement........................................... 75
Stanley J. Borgia, Deputy Director for Counterintelligence,
Office of Intelligence and Counterintelligence, U.S. Department
of Energy...................................................... 97
Prepared statement........................................... 100
Michael R. Anastasio, Ph.D., Director, Los Alamos National
Laboratory..................................................... 104
Prepared statement........................................... 106
George H. Miller, Ph.D., Director, Lawrence Livermore National
Lab............................................................ 131
Prepared statement........................................... 132
Thomas O. Hunter, Ph.D., President and Laboratories Director,
Sandia National Laboratory..................................... 138
Prepared statement........................................... 141
Submitted Material
Letter of September 1, 2008, from Terry D. Turchie to Mr. Dingell 165
Letter of September 28, 2007, from Thomas P. D'Agostino to Mr.
Turchie........................................................ 169
Article, ``Scientist accused of selling rocket data to China,''
The Associated Press........................................... 170
Chart entitled ``Total DOE Foreign National
Assignees,''``Scientist accused of selling rocket data to
China,'' The Associated Press.................................. 171
CRS Report, July 28, 2008........................................ 186
A REVIEW OF CONTINUING SECURITY CONCERNS AT DOE'S NATIONAL LABORATORIES
----------
THURSDAY, SEPTEMBER 25, 2008
House of Representatives,
Subcommittee on Oversight and Investigations,
Committee on Energy and Commerce,
Washington, D.C.
The subcommittee met, pursuant to call, at 10:09 a.m., in
room 2123, Rayburn House Office Building, Hon. Bart Stupak
(chairman of the subcommittee) presiding.
Present: Representatives Stupak, Green, Inslee, DeGette,
Dingell (ex officio), Shimkus, Burgess, and Blackburn.
Staff Present: Scott Schloegel, John Sopko, Chris Knauer,
Steve Futrowsky, Joanne Royce, Kyle Chapman, Alan Slobodin,
Peter Spencer, and Whitney Drew.
OPENING STATEMENT OF HON. BART STUPAK, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF MICHIGAN
Mr. Stupak. This meeting will come to order. Today we have
a hearing entitled, ``A Review of Continuing Security Concerns
at Department of Energy's National Labs.'' We'll start with
opening statements. I'll begin.
Today we'll hear from several independent sources about
security problems that continue to plague the Department of
Energy's nuclear weapons labs. We'll also hear from DOE
officials responsible for the operations of the labs and then
we'll hear from the lab directors who will tell us what they're
doing to address the shortcomings.
The Department of Energy's nuclear weapons labs are home to
some of the country's most sensitive secrets and the country's
most dangerous nuclear materials. These labs--Sandia, Los
Alamos, and Lawrence Livermore--employ the world's most
brilliant scientific minds, but they've also been home to some
very serious security breaches.
Los Alamos has historically been our most challenged of the
three labs. This is the 14th hearing our subcommittee has held
into security problems at Los Alamos over the past 8 years.
We've also requested numerous Government Accountability Office
investigations, which have resulted in countless
recommendations for improvements at Los Alamos. Thankfully, the
LANL has implemented several changes that appear to be
improving the physical security posture. Our staff was
encouraged by many of the changes they saw at the lab with
regard to physical security, and these views appear to be
echoed by the GAO and the Office of Independent Oversight
Reports. We remain optimistic, but guarded, that Los Alamos
will continue to improve.
Unfortunately, at the same time that physical security at
Los Alamos was improving, Lawrence Livermore National Lab was
actually regressing. Earlier this year the Department of
Energy's Office of Independent Oversight conducted a force-on-
force exercise at Lawrence Livermore which, according to GAO
testimony, resulted in the lab receiving, and I quote, ``the
lowest possible ratings for protective force performance and
for physical protection of classified resources,'' end of
quote. While we are told by lab officials that they have made
numerous changes to their security force and procedures to
correct the problems, we expect to learn exactly why or what
led to the failures and what corrective measures have been put
in place to ensure that they will not occur again.
Physical security is just one component to keeping our
nuclear secrets safe. The most recent vulnerability is that a
host of unauthorized sources are trying to exploit our lab's
cyber networks. The Department of Energy's cyber networks are
attacked millions of times each month by individuals ranging
from a high school kid looking for a challenge, to the most
sophisticated adversaries who are seeking very specific
information.
Today, we will hear concerns about the Department of
Energy's cyber security posture from three government entities.
First, the Government Accountability Office will discuss
their report detailing shortcomings of the unclassified
computer network at Los Alamos National Lab. Moreover, they
will document how highly sensitive--but unclassified--
information on the Department's network may possibly be pieced
together and could become classified information which would be
``a valuable target for foreign governments, terrorists and
industrial spies.''
Second, DOE's Office of Independent Oversight will tell us
about how a small team of their cyber attack experts, known as
a ``Red Team,'' were able to hack into and gain full
administrative control over two of the Department of Energy's
science lab computer systems. This same team was also able to
gain a foothold into part of the weapons labs computer systems.
Third, we will hear from the DOE's Inspector General, who
will discuss their recent report outlining the vulnerabilities
in the Department's unclassified cyber security program and its
need to improve management and controls. They will document
that ``since the end of fiscal year 2007, the Department has
experienced a 45 percent increase in reported cyber security
incidents.'' In addition, we will hear from the DOE's Associate
Director of Counterintelligence that DOE networks have picked
up an increased tempo of potential adversarial activity, and in
some cases, sensors have documented ``well over 400 million
such indicators of hostile activity every month.''
Make no mistake about it, cyber security at our Nation's
energy labs should be of paramount concern to Congress and the
American public. The sophistication of our adversaries when it
comes to cyber attack is significant. But if the Department of
Energy, and all the Federal Government for that matter, does
not heed the warning set forth by these independent reports, we
will put our Nation further at risk. Much is being done to
protect our sensitive information but much more needs to be
done.
We began this Congress by holding a hearing into the
security concerns at Los Alamos National Lab. We're ending this
Congress with yet another hearing into security concerns at the
Department of Energy's labs.
All too often we find that security improves at the DOE
while Congress, the GAO and the inspector general or the Office
of Independent Oversight is shining a light on them. However,
far too often labs slip back into their own ways and have yet
another security relapse.
The Department can be sure that as long as I am chairman of
this subcommittee there will be a constant light shining on
them to ensure they are doing all they can to protect our
Nation's nuclear materials and secrets.
That is the end of my opening statement. I next turn to Mr.
Shimkus, the ranking member, for his opening statement, please.
OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF ILLINOIS
Mr. Shimkus. Thank you, Mr. Chairman. I recognize your
valiant effort to fight this cold and turning from a baritone
to a bass, it really is Chairman Stupak, and I'll testify to
that. But thanks for soldiering on, and thanks for this
hearing.
There are few topics the subcommittee will examine as
important to our national security as those concerning the
security of our national weapons labs. And although I am new to
this committee, the Oversight and Investigation Subcommittee
has done it for years, and the committee's responsibility has
been well noted. And there are few topics where we have been as
frustrated as those that concern the security at the labs.
Today's hearing serves as a progress report on work
requested by the bipartisan committee and subcommittee
leadership. Our requests were prompted by a series of physical
and cyber security debacles at Los Alamos National Laboratory
and poor performance at Lawrence Livermore National Laboratory
in an April 2008 DOE physical security evaluation.
We will hear from the Government Accountability Office this
morning on two topics, one concerning physical security and the
other one concerning cyber security on the unclassified
computer network. The GAO details areas of accomplishment, but
also identifies continued significant concerns. Of these
concerns, the most troubling involve the cyber threats to what
is called the ``yellow network,'' the lab's protected
unclassified network. The yellow network serves as a backbone
for lab operation and its research mission. However, both the
GAO and DOE Independent Office of Health, Safety and Security
have identified particular vulnerabilities with the security of
the yellow network.
Action is needed to improve the security of the yellow
network, but what corrective actions is to take place is based
on a risk assessment and risk management. Do DOE and NNSA know
or will they know soon exactly what information is on the
yellow network? Will DOE and NNSA be willing to identify
information that needs special protection? And will they be
able or willing to implement corrective actions?
Are there any recommendations or corrective actions that
they believe would be too costly, time consuming or disruptive
to implement? If so, what evidence supports that belief? And
does it outweigh the cost to national security? Striking that
balance is a challenging task.
There are about 13,000 users of the network at Los Alamos,
including cleared foreign nationals, some from sensitive
nations of concern for security officials. We will hear this
morning that the network fire walls deflect more than 10
million cyber probes every month and that threats to cyber
defenses are rapidly escalating in number, sophistication and
complexity.
And what is the information on this network? It is not
classified, but it is sensitive and can have an impact on
national security. Panelists will detail some of the categories
for us which, GAO reports, presents a valuable target for
foreign governments, terrorists and industrial spies.
How robust is network security especially when probed by
the most sophisticated adversaries? Have any of the probes
succeeded? And if they have, what has been lost? What may be
lost? These critical questions underscore the findings of GAO
that more needs to be done to protect the network. And if we
cannot be satisfied that network protections can safeguard
fully the information of these ever-more sophisticated attacks
and soon, what other options can we pursue for information
security? The answer to this will not be easy, and it involves
striking the balance between mission and security, but we have
to find an answer.
This GAO testimony provides just the starting point for the
security issues we will discuss this morning. When coupled with
the government audits and evaluations, the testimony raises
important questions that apply not only to the overall security
posture at Los Alamos, but at Lawrence Livermore National
Laboratory and Sandia National Laboratories as well as labs
overseen in Washington.
I look forward to hearing the perspective of the lab
directors with us on the second panel, as well as from DOE and
the National Nuclear Security Administration officials also on
the second panel. I will want to hear their answers to the
questions I pose about enhancing the security of the yellow
network.
We should identify measures and indicators for progress on
improving security going forward as rapidly as possible. We
also have to ensure that any measures for security can be
sustained for the long term with sufficient flexibility to
respond to emerging threats.
And finally we have to recognize the human factor at work
here; this means the researchers, the security people and the
management. I understand there appear to be two cultures at the
lab with different priorities, the research academic culture
and the security culture. These solutions need to reflect that
reality as well as reconcile the differences.
Thank you, Mr. Chairman.
Mr. Stupak. Thank you, Mr. Shimkus.
Mr. Green for an opening statement, please.
OPENING STATEMENT OF HON. GENE GREEN, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF TEXAS
Mr. Green. Thank you, Mr. Chairman. And I'll make my
statement relatively brief.
I hate to sound like a broken record over these last few
years, but it's the subcommittee's 14th hearing on security
issues facing the Department of Energy's national labs. I hope
that today we can finally show some progress towards securing
the critical infrastructure and information of our weapons
labs. With the emerging threats facing our Nation, we cannot
afford more empty promises of change.
Los Alamos, Livermore and Sandia house America's most
sensitive and top secret weapons development programs. The only
thing not secret about these labs is that there are security
vulnerabilities.
In September 2006, the subcommittee learned how simple it
was for a contract employee to remove a USB ThumbDrive
containing hundreds of pages of classified documents. Just this
year, after a mock terrorist attack by DOE at Livermore, we
learned how easily lab security could be compromised through
their ill-trained workforce and protective strategy.
Sometimes I think we have to say enough is enough. I do not
want to sit through future congressional hearings where we must
piece together how a perpetrator gained access to classified
nuclear weapons design information from our labs because we did
not have the resolve to correct the lab security deficiencies
today.
The testimony from this morning's hearing will show that
some progress has been made. For example, Los Alamos National
Lab has drastically reduced the number of removable electronic
media and eliminated thousands of classified nuclear weapons
parts and reduced the number of bulk-type rooms and areas
containing special nuclear material. These efforts should be
commended. But when we are protecting information critical to
the national security of the United States, incremental action
is notable but not sufficient.
We in Congress owe it to the American people to ensure that
weapons labs are safe and secure. And if the Department of
Energy or their labs are not up to the task of providing the
highest level of protection, Congress must be willing to make
the tough choices to protect our national interests.
And again I thank you, Mr. Chairman, for continuing these
hearings. I look forward to the testimony, and I yield back my
time.
Mr. Stupak. Thanks, Mr. Green.
Mr. Stupak. Ms. Blackburn for an opening statement, please.
OPENING STATEMENT OF HON. MARSHA BLACKBURN, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF TENNESSEE
Ms. Blackburn. Thank you, Mr. Chairman. As has been stated,
we have had several hearings on the issue of problems with the
national labs, and with the accountability or the lack thereof
with the labs. It is frustrating to us to see a reticence to
make any changes. And I think it is also frustrating to our
constituents because now more than ever they are paying close
attention to energy issues, to how the Department of Energy is
working, to security issues or lack thereof of security.
And I think that today, as you come before us and as we
hold this hearing, and as we are in the midst of this financial
crisis, many people are very concerned about a proposed plan to
give the Secretary of the Treasury a blank check to bail out
Wall Street. And what we're hearing is, they don't trust
government. And we know that that lack of trust is going to,
therefore, be reflected onto each and every department and
agency of the Federal Government. And I think that it amplifies
some of the lack of accountability and the hesitancy that we
have seen from some of our government agencies and from you.
And the problems with these labs are more--they're just
more symptoms of what many people believe to be an incompetence
of the bureaucracy in the Federal Government, that you have
gotten too big and too unwieldy and too out of control for your
own good and definitely for the taxpayers' good.
If these government-run labs cannot protect classified and
sensitive information and material, then Congress must begin to
discuss alternatives to the current operating procedures that
will solve the problems. It would be interesting to know what
your best practices are and what your timeline is for meeting
those best practices.
Mr. Chairman, I think that protecting that classified
material and that sensitive data is one of the key
responsibilities of government. And if it does not, then our
Nation faces serious risk in the area of breaches of security.
Congress should put forward initiatives. We are going to
take the lead on this. If you cannot and will not, then we
will. We'll take the lead that will increase transparency, that
will demand accountability on behalf of the taxpayers that are
footing the bill for this.
And it's not only for you. It is for the entire Federal
Government. So as my grandmother would have said, You are on my
last nerve; and I hope that you're going to be willing to work
with us and increase some accountability and some transparency.
And Mr. Chairman, I will yield back the balance of my time.
Mr. Stupak. I thank the gentlewoman.
Mr. Dingell, chairman of the full committee, for an opening
statement, please.
OPENING STATEMENT OF HON. JOHN D. DINGELL, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF MICHIGAN
Mr. Dingell. Mr. Chairman, good morning. And thank you for
your vigorous leadership in the matters before us. And I want
to thank you also for holding another important hearing on the
distressing state of security at our Nation's weapons labs.
This will be the 14th hearing we've held on this topic over
the last 8 years. It was the topic of our first oversight
hearing in the 110th Congress and today it may well be one of
the last of this Congress.
I feel a little bit like Sisyphus or like Heracles when he
was confronted with the Augean Stables. We have before us an
agency which has been totally incapable of addressing problems.
Back in the days when I was chairman of the Subcommittee on
Oversight and Investigations 20-some years ago, we had
hearings. We found a huge problem with regard to security at
our Nation's labs. We found that they turned off the sprinkler
systems because they didn't want to wet their computer systems.
We found they had vehicles, emergency vehicles, that would not
start.
We found them with employees in charge of security who did
not have the ability physically to participate in the
suppression of penetration of those facilities. We found that
the tests and the efforts to assure that the Agency could
respond to security challenges were carefully cooked by
informing the people beforehand what was going to happen so
that the drill could take place in the most favorable of
circumstances. And we found, curious enough, they still were
not able to do the job that had to be done.
We found that there were stings with regard to controlled
substances which were suppressed. We found dissipation of
public resources and scientific equipment amounting to millions
of dollars. We found losses of equipment. And we found
inability to keep track of government property.
We found the Agency had to go lightly on their drills
because employees charged with security were having heart
attacks as a result of having to defend these facilities. It
was a situation worthy of the Grand Duchy of Graustark. And it
was indeed a situation which would have been humorous were it
not for the fact that it was so sad and so dangerous.
I will not burden my colleagues with further details of the
events that this committee has had the distressful experience
of disclosing over the years. But classified information has
disappeared. Drug users have obtained clearances. Sensitive
information is being uncovered in drug raids. And promises are
made and continually broken to improve security by every
administration that has been before this committee.
After our last hearing this hearing asked the Government
Accountability Office to conduct a comprehensive review of
ongoing security issues at Los Alamos National Lab. Today we're
going to hear the results of that work as a result, as well as
the results of a number of audits and studies by the Department
of Energy's inspector general and its Office of Independent
Oversight.
These conclusions are mixed, and I must say that I achieve
a small measure of comfort by finding that they're mixed. And
at least they are not, for a change, all bad. While GAO found a
number of ongoing concerns at Los Alamos National Laboratory
that deserved the attention of the committee, they also found
some evidence of improvement for which we rejoice, enough to
make me slightly optimistic that the lab's security is in some
way improving.
This improvement must be tempered, however, by GAO's
warning that security at DOE labs appears to be cyclical. I'm
not quite sure what that means, but it may relate to the fact
that from time to time this committee has hearings to find out
how the matter progresses. Indeed, however, it is not clear to
me or, I suspect, anybody else how Los Alamos intends to ensure
that these problems will not reoccur.
Unfortunately, we will also learn today that while Los
Alamos has improved security, another critically important DOE
weapons lab, Lawrence Livermore National Laboratory, has not.
In April of 2008, DOE's Office of Independent Oversight
completed an evaluation review of security at Livermore. The
results, quite frankly, were shocking and sufficiently serious
that we can only discuss the specific details in our closed
session this afternoon.
I'd like to observe that we have before us identified major
problems with key aspects of Livermore's protective strategy,
including malfunctioning equipment, inadequate staffing,
insufficient training of the protective workforce. And while we
understand that many of these shortcomings are being addressed,
or at least we're so informed, the OIO findings are so
troubling that we must learn more about how DOE allowed this to
happen and what they're doing to prevent a recurrence.
Lastly, today, we will hear from an even bigger problem
facing these labs and DOE as a whole. And that is the threat
from cyber attacks, a new and increasingly serious danger. At
our request, GAO conducted a comprehensive review of Los
Alamos's unclassified cyber network; and the results of the
review highlight the need for significant security improvements
to protect sensitive information on Los Alamos's unclassified
network.
As noted by the GAO, the information on this network
presents a valuable target for foreign governments, terrorists
and industrial spies. And it's an interesting thing that this
kind of threat enables people to do the kind of penetration of
our national security simply sitting in their living room,
working with their computers.
This problem, however, is not unique to Los Alamos. All of
DOE's labs are facing cyber security challenges. We're going to
hear testimony that the labs are virtually naked to concerted
cyber attacks, especially by assault from persistent or funded
and dedicated assailants right in there, terrorists or foreign
governments.
Given the sensitivity of these facilities and the people
who work there, we need to learn how DOE is working to correct
this problem and when we may expect that it will, in fact, be
corrected.
Mr. Chairman, under your leadership I know that this
committee is going to continue its examination into cyber
security in the next Congress and to broaden it to include all
departments and agencies within our jurisdiction. Because the
potential consequences of this situation are very, very
serious, I expect that this will be one of our most important
oversight priorities next year.
And I want to thank you for the work and the leadership
that you have done and shown, and express my hope that I will
be able to work with you again on this very important matter.
Thank you, Mr. Chairman.
Mr. Stupak. Thank you, Mr. Dingell.
[The prepared statement of Mr. Dingell follows:]
Prepared Statement of Hon. John D. Dingell
Mr. Chairman, thank you once again for holding another
important hearing on the state of security at our Nation's
weapons labs. This will be the fourteenth hearing we have held
on this subject over the last eight years. It was the topic of
our first oversight hearing for the 110th Congress, and today
it may conclude this Subcommittee's hearings for this Congress.
I will not bore my colleagues with all the gory details of
security misadventure and mishap that this Committee has
uncovered over those 8 years-of classified information
disappearing, of drug users obtaining clearances, of sensitive
information being uncovered in drug raids, and of promises made
and continually broken to improve security.
Rather, after our last hearing, this Committee asked the
Government Accountability Office (GAO) to conduct a
comprehensive review of ongoing security issues at Los Alamos
National Lab. Today we will hear the results of that work as
well as the results of a number of audits and studies by the
Department of Energy's Inspector General and its Office of
Independent Oversight.
Their conclusions are mixed. While GAO found a number of
ongoing concerns at Los Alamos National Laboratory that deserve
our attention, they also found evidence of some improvement-
enough to make me cautiously optimistic that lab security is in
some ways improving. However, this improvement must be tempered
by GAO's warning that security at DOE labs appears cyclical,
and it is not clear how Los Alamos intends to ensure these
problems will not reoccur.
Unfortunately, we will also learn today that while Los
Alamos has improved security at another critically important
DOE weapons lab--Lawrence Livermore National Laboratory--has
not.
In April 2008, DOE's Office of Independent Oversight (OIO)
completed an evaluation and review of Livermore's security
posture. The results were shocking and so serious that we can
only discuss the specific details in our closed session this
afternoon.
Let me just say that they identified major problems with
key aspects of Livermore's protective strategy, including
malfunctioning equipment, inadequate staffing, and insufficient
training of its protective workforce. While we understand that
many of these shortcomings are being addressed, the OIO
findings are troubling, and we must learn how DOE allowed this
to happen and what they are doing to prevent a reoccurrence.
Lastly, today we will hear of an even bigger problem facing
these labs, and DOE as a whole, and that is the threat from
cyber attacks. At our request, GAO conducted a comprehensive
review of Los Alamos' unclassified cyber network, and the
results of this review highlight the need for significant
security improvements to protect sensitive information on Los
Alamos' unclassified network. As noted by GAO, the information
on this network presents ``a valuable target for foreign
governments, terrorists, and industrial spies.''
Unfortunately, this problem is not unique to Los Alamos.
All of the DOE labs are facing cyber-security challenges. We
will hear testimony that the labs are virtually naked to
concerted cyber attacks-especially by assault from persistent,
well-funded, and dedicated assailants. Given the sensitivity of
these facilities and the people who work there, we need to
learn how DOE is going to correct this problem.
I would urge this Subcommittee to continue its examination
into cyber security in the next Congress and broaden it to
include all departments and agencies within our jurisdiction. I
expect this may be one of our most important oversight
priorities next year and look forward to working with you on
this matter.
----------
Mr. Stupak. Mr. Burgess for an opening statement, please.
OPENING STATEMENT OF HON. MICHAEL C. BURGESS, A REPRESENTATIVE
IN CONGRESS FROM THE STATE OF TEXAS
Mr. Burgess. Thank you, Mr. Chairman. This does seem like
deja vu all over again, doesn't it?
We've had hearings in the past and we've established some
serious lapses in security and managerial oversight at Los
Alamos National Laboratory. Indeed, we went through an entire
process with those Requests for Proposals as to whether or not
the management of the lab should change.
I took a trip out to Los Alamos in July of 2005. I just
wanted to see for myself on the ground. I have got to say, I
was impressed by the work being done; I was impressed by the
dedication of the employees. But as we continued to hear after
that, even after the evaluation and even though there was no
management change, but there was promise of some changes, we
still heard the reports of things that weren't quite right.
Through all of those hearings, we always heard that things
at Sandia, things at Lawrence Livermore were the gold standard,
and that's what we should aspire to. But now we have got a GAO
report that say significant problems exist in physical and
electronic security at Lawrence Livermore as well. So the
security of these agencies may have made some progress in
strengthening some of the security weaknesses at Los Alamos--
and I think that's still in question.
The NNSA needs to be more consistent with their progress in
other facilities. Gaps in the physical protection of classified
documents, but especially the electronic uses of both
classified and unclassified, but sensitive; this committee
should maintain persistent oversight until these problems are
corrected.
I am concerned with the cyber security weaknesses and lab
policies towards the physical protection of computers, portable
storage devices and other sensitive areas in the labs. It seems
like we've been through this before at Los Alamos, and I guess
I have to wonder why we're not learning the lessons as they're
given to us.
It's taken for granted that almost any enterprise
undertaken in life will involve a computer, a cell phone, a
BlackBerry or some other electronic device. It's also a near
certitude that an ill-meaning person or persons can attempt to
illegally access electronic systems and devices for a variety
of reasons, none of which are good. The rapid advancements in
technology make the nature of the threat to our electronic
systems one that is constantly evolving, therefore we need to
be flexible on the committee, but we need to be vigilant.
In 2002, Congress passed the Federal Information Security
Management Act to protect our critical information
infrastructure. This was before I was elected. And I do wonder
if our Federal agencies, particularly the Department of Energy,
are in compliance with this important law. It's a dangerous
time. Our national security secrets should be closely held,
closely guarded; and they should stay our national secrets.
The Office of Inspector General has noted that our nuclear
labs and Department of Energy work information systems are
compromised. I will look forward to working with the chairman
of this subcommittee and the chairman of the full committee to
ensure that our nuclear secrets do not fall into the wrong
hands.
And I will yield back the balance of my time.
Mr. Stupak. I thank the gentleman. We have our first panel
before us. Let me introduce them if I may:
Mr. Gregory Wilshusen, who is the Director of Information
Security Issues at the U.S. Government Accountability Office.
And you're accompanied by Ms. Allison Bowden of the GAO. And
you are senior auditor, correct? OK. Mr. Glenn Podonsky, who is
the Chief Health, Safety and Security Officer in the Office of
Health Safety and Security of the Department of Energy; and the
Honorable Gregory Friedman, who is the Inspector General at the
Department of Energy.
Welcome to all of our witnesses.
It's the policy of this committee to take all testimony
under oath. Please be advised you have a right by the Rules of
the House to be advised by counsel during your testimony. Do
any of you wish to be advised by counsel during your testimony?
Everybody indicating ``no.'' Therefore, I will ask you to
stand, raise your right hand and take the oath.
[Witnesses sworn.]
Mr. Stupak. Let the record reflect that the witnesses have
answered in the affirmative to the oath. They are now under
oath.
Mr. Stupak. We will begin with opening statements.
Mr. Friedman, let's start with you. If you don't mind, pull
that mic up. And you are recognized for 5 minutes. If you have
a longer statement, it will be submitted for the record. So if
you would begin, please.
STATEMENT OF GREGORY H. FRIEDMAN, INSPECTOR GENERAL, U.S.
DEPARTMENT OF ENERGY
Mr. Friedman. Thank you, Mr. Chairman and members of the
subcommittee. I'm pleased to be here today at your request to
testify on matters relating to security at the Department of
Energy's national defense laboratories. These laboratories,
which are part of the National Nuclear Security Administration,
process some of the Department's most sensitive information,
information which is critical to the Nation's defense.
Since 2002, the Office of Inspector General has categorized
information security as one of the Department's most
significant management challenges. In April of 2007, I
testified before this subcommittee on the special inquiry
conducted by my office regarding a diversion of classified data
from the Los Alamos National Laboratory, an event made possible
in large part by cyber security-related weaknesses.
The Office of Inspector General has continued its efforts
in this area by conducting a number of cyber security reviews
throughout the Department, including NNSA and its national
defense laboratories. Early this year we conducted an extensive
review of the process to certify and accredit classified
national security information systems. Simply stated,
certification and accreditation is a critical management tool
used to recognize and address risks by ensuring that cyber
security controls are in place.
Our findings relative to the NNSA and its laboratories
revealed a number of weaknesses. In particular, we found,
first, critical security functions had not been adequately
segregated, providing the opportunity for systems security
officers to gain access and modify systems without review or
approval.
Secondly, risks associated with classified and unclassified
systems operating in the same environment had not always been
adequately evaluated.
Third, the system security plans omitted information on
hardware such as servers, network printers, and scanners, a
condition paralleling one of our concerns relating to the
diversion of classified material at Los Alamos.
And finally, contingency plans outlining actions necessary
to resume operations in the event of a disaster were not always
developed or they were incomplete.
These weaknesses occurred, in part, because the NNSA had
not been fully successful in ensuring its laboratories
implemented the Department's updated cyber security
requirements. For example, two laboratories completed their
certification and accreditation process using outdated
requirements, leaving a number of systems vulnerable to control
weaknesses. In addition, headquarters and field site officials
had not effectively reviewed security plans to ensure that they
were accurate and adequately addressed system risks.
In our recently issued Federal Information Security
Management Act evaluation, we identified a number of weaknesses
that exposed unclassified systems to an increased risk of
compromise.
We found, first, two of the three defense labs had not yet
completed certification accreditation of certain business
systems, a deficiency first reported in 2006.
Mandatory security controls were not included in systems
security plans at one laboratory.
All three laboratories had not completed implementation of
the federally mandated standard desktop configuration.
Computer incident reports did not always include
information needed for implementing--needed for reporting to
law enforcement and for subsequent analysis for trending.
And at one laboratory vulnerabilities were identified that
may have allowed unsupervised foreign visitors to
inappropriately access the site's intranet.
We found that NNSA had not in a timely manner incorporated
Federal and departmental cyber security requirements into its
policies and guidance. In addition, NNSA also had not
effectively completed reviews and performance monitoring,
activities essential for evaluating the adequacy of cyber
security operations.
Our evaluations reveal a mixed picture. The Department and
NNSA have improved their cyber security efforts, yet weaknesses
still exist. Additional action is necessary to protect systems
and the information they contain from increasingly
sophisticated and persistent attacks.
Since the end of fiscal year 2007, as has been referred to
earlier in the opening statements, the Department has
experienced a 45 percent increase in reported cyber security
incidents. This significant increase demonstrates the need for
sustained action in securing the Department's information
systems.
Our work suggests that there are some recurring challenges
that NNSA should consider as it moves forward. Specifically,
NNSA should implement in a timely manner all relevant Federal
departmental cyber security requirements, strengthen the
management and review process by better monitoring field sites
to ensure adequacy of cyber security program performance and,
finally, ensure that all outstanding cyber security weaknesses
are corrected in a timely manner.
The Office of Inspector General recognizes well the
importance of cyber and physical security and we are committed
to continuing our work in these areas.
Mr. Chairman, this concludes my statement. I would be
pleased to answer any questions you may have.
Mr. Stupak. Thank you Mr. Friedman.
[The prepared statement of Mr. Friedman follows:]
Statement of Gregory H. Friedman
Summary
Since 2002, the Office of Inspector General (OIG)
has categorized information security as one of the Department
of Energy's (Department) most significant management
challenges. While incremental improvements have been made to
improve security and reduce risks to systems and data,
additional work needs to be done.
The OIG recently issued a report on the
certification and accreditation of the Department's national
security information systems. Our review disclosed that
weaknesses exist in the areas of risk management, security
planning, and contingency planning. In addition, the National
Nuclear Security Administration (NNSA) had not been fully
successful in ensuring that its laboratories implemented the
Department's updated, strengthened policies designed to protect
national security information systems.
A Fiscal Year 2008 review of the Department's
unclassified cyber security program identified opportunities
for improvements in areas such as certification and
accreditation of systems, systems inventory, contingency
planning and segregation of duties.
The problems identified occurred because NNSA had
not revised and implemented, in a timely manner, policies and
guidance incorporating Federal and Departmental cyber security
requirements. NNSA also had not effectively completed review
and performance monitoring activities essential for evaluating
the adequacy of cyber security operations.
Since the end of Fiscal Year 2007, the Department
has experienced a 45 percent increase in reported cyber
security incidents. This significant increase demonstrates the
need for sustained action in securing the Department's
information systems.
Statement
Mr. Chairman and members of the Subcommittee, I am pleased
to be here at your request to testify on matters relating to
cyber security at the Department of Energy's (Department)
national defense laboratories. These laboratories, which are
part of the National Nuclear Security Administration (NNSA),
possess and process some of the Department's most sensitive
information; information which is critical to the Nation's
defense.
Background
The Office of Inspector General (OIG) has a long-standing,
proactive program to assess the effectiveness of the Department
of Energy's cyber security strategy. Since 2002, the OIG has
categorized information security as one of the Department's
most significant management challenges. In April of 2007, I
testified before this Subcommittee on the special inquiry
conducted by my office regarding a diversion of classified data
from the Los Alamos National Laboratory; an event made
possible, in large part, by cyber security related weaknesses.
The OIG has continued its efforts in this area by conducting a
number of cyber security reviews throughout the Department,
including NNSA and its national defense laboratories - Los
Alamos, Lawrence Livermore, and Sandia.
Review of National Security Information Systems
In response to our special inquiry on the diversion of
classified data at Los Alamos, the Department initiated a wide
range of actions to address cyber security weaknesses related
to classified systems. For instance, the Department updated and
strengthened its national security information systems policy
for segregation of duties and system access techniques.
Earlier this year, we conducted an extensive review of the
process to certify and accredit classified national security
information systems at the NNSA laboratories. Certification and
accreditation (C&A) is a critical part of the risk management
process and is vital to understanding and mitigating cyber-
related vulnerabilities. This process is designed to ensure
that systems are secure prior to beginning operation and that
they remain so throughout their lifecycle. It includes formal
steps to: (1) recognize and address risks, (2) determine
whether system security controls are in place and operating
effectively, and (3) ensure that changes to systems are
adequately tested and approved. Our findings relevant to the
NNSA and its national defense laboratories revealed that:
Critical security functions had not been
adequately segregated, providing the opportunity for system
security officers to gain access and modify systems without
review or approval, creating an environment in which controls
could be manually overridden;
Risks associated with classified and unclassified
systems operating in the same environment had not always been
adequately evaluated. This weakness - exacerbated by the lack
of segregation of duties - increased the risk that classified
information could be transferred to unclassified systems;
Users at one laboratory were allowed to manually
change passwords, a practice specifically prohibited by the
Department and one which rendered passwords on classified
systems more susceptible to compromise;
At the same laboratory, a number of security plans
were not reviewed and approved by a Federal official, depriving
NNSA of the opportunity to ensure that all risks to the systems
were addressed;
System security plans omitted information on
hardware such as servers, network printers and scanners, the
presence of which could have created a security vulnerability
and enabled the unauthorized processing, diversion or theft of
classified material. This condition paralleled one of our
concerns related to the diversion of classified information at
Los Alamos; and,
Contingency plans outlining actions necessary to
resume operations in the event of a disaster were not always
developed or were incomplete.
The Department had strengthened policies designed to
protect national security information systems in response to
our recommendations following the Los Alamos incident. However,
NNSA had not been fully successful in ensuring that its
laboratories implemented these updated and stronger
requirements. For example, two laboratories completed their C&A
process using outdated requirements, leaving a number of
systems vulnerable to control weaknesses such as the lack of
segregation of duties and strong authentication techniques. In
addition, Headquarters and field site officials had not
effectively reviewed security plans to ensure that they were
accurate and that they adequately addressed system risks.
Review of Unclassified Systems
The OIG has also devoted substantial resources to
evaluating security measures designed to protect the
Department's unclassified information systems and data. The
Federal Information Security Management Act requires that
agency Inspectors General conduct an annual independent
evaluation of their Department's unclassified cyber security
program and practices. Our recently issued Fiscal Year (FY)
2008 evaluation revealed a mixed-picture: on one hand, the
Department had made incremental improvements in its
unclassified cyber security program. For example, various sites
had taken action to address weaknesses we identified during our
FY 2007 evaluation by strengthening configuration management,
updating policy, and incorporating cyber security performance
requirements into management and operating contracts. However,
a number of weaknesses that exposed systems to an increased
risk of compromise still existed within the Department. This
specifically included NNSA and its national defense
laboratories. In particular:
Two of the three defense laboratories had not yet
completed certification and accreditation of certain business
systems, a deficiency we first reported in FY 2006;
System security plans at one laboratory did not
include mandatory security controls. Such information is
necessary for management to determine that all system risks
have been fully considered and that mitigating controls are in
place;
At one laboratory, unneeded computer services had
not been disabled on over 40 servers that hosted publicly
accessible websites. These services, which in a number of
instances could be accessed without the use of passwords or
other authentication techniques, increased the risk of
malicious damage to the servers and the networks on which they
operated;
All three laboratories had not yet completed the
deployment of the Federally-mandated standard desktop
configuration, an action that when implemented is intended to
significantly enhance cyber-related controls;
Computer incident reports did not always include
information needed for reporting to law enforcement and for
subsequent analysis for trending. Further, reported information
was not always shared with other Department elements; and,
At one laboratory, vulnerabilities were identified
that may have allowed unsupervised foreign visitors to
inappropriately access the site's intranet. Such practices, if
exploited, could have permitted those individuals to probe the
laboratory's network for vulnerabilities, implant malicious
code, or remove data without authorization.
Issues Requiring Continuing Attention
While NNSA has taken steps to address a number of
weaknesses identified in the past, additional action is
necessary to protect systems and the information they contain
from increasingly sophisticated and persistent attacks. Since
the end of FY 2007, the Department has experienced a 45 percent
increase in reported cyber security incidents. This significant
increase demonstrates the need for sustained action in securing
the Department's information systems.
Our work suggests that there are some recurring challenges
that NNSA should consider as it moves forward. Specifically,
NNSA should:
1. Implement, in a timely manner, all relevant Federal and
Departmental cyber security requirements;
2. Strengthen the management review process by better
monitoring field sites to ensure the adequacy of cyber security
program performance; and,
3. Ensure that all outstanding cyber security weaknesses
are corrected in a timely manner.
To achieve the recommended reforms as promptly as possible,
NNSA should establish firm schedules with specific
implementation timeframes and benchmarks.
Ongoing Inspector General Efforts
Both cyber and physical security continue to be pressing
management challenges. For that reason, the Office of Inspector
General has ongoing activities to examine information
technology and systems security, implementation of physical
security technology upgrades, protection of sensitive
unclassified information, and accounting for nuclear materials
in the hands of domestic licensees.
Mr. Chairman, this concludes my statement and I would be
pleased to answer any questions you may have.
----------
Mr. Stupak. Mr. Podonsky, please, for your opening
statement.
STATEMENT OF GLENN S. PODONSKY, CHIEF HEALTH, SAFETY AND
SECURITY OFFICER, U.S. DEPARTMENT OF ENERGY
Mr. Podonsky. Chairman Stupak, Ranking Member Shimkus and
members of the subcommittee, I want to thank you for inviting
me to testify today on the status of the security and cyber
security programs at the Department of Energy's three weapons
laboratories.
As the Department's Chief Health, Safety and Security
Officer, my office and I have a direct interest in the levels
of rigor and effectiveness at which these laboratories and all
DOE sites implement the Department's security requirements.
In the area of physical protection and the protection of
special nuclear material, the HSS Office of Independent
Oversight conducted a comprehensive security inspection this
past spring at Lawrence Livermore National Laboratory and just
recently completed an inspection at Los Alamos National
Laboratory. While there were a number of identified weaknesses,
most notably at Lawrence Livermore, reports of progress
indicate that they are aggressively addressing identified
deficiencies. We will validate the effectiveness of these
corrective actions when we conduct a follow-up inspection in
the spring.
The results of our evaluations indicate that the systems in
place to protect classified matter at these laboratories are
generally adequate and in compliance with expectations, but
there are residual issues that must be addressed. In the area
of cyber security, threats to DOE and NNSA cyber security
defenses continue to escalate both in terms of the number of
attacks and in the sophistication and complexity of those
attacks.
Mr. Chairman, DOE, along with many other government
agencies and corporate organizations, are experiencing a broad
range of cyber security threats that we must protect against on
a continuous basis. Our interconnected society and dependency
on the rapid exchange of vast quantities of electronic
information exposes all of us to cyber threats similar to those
faced by DOE and NNSA. I believe the entire U.S. Government is
at a crossroads on how we protect sensitive information.
Our independent oversight inspections have identified
numerous positive attributes of the classified cyber security
programs at each of the weapons laboratories, and while there
are some deficiencies that need to be addressed, the classified
cyber security program throughout DOE remains strong.
Unclassified cyber security presents a different challenge.
The primary threats to our unclassified networks used to be
directed at our perimeter defenses, and as a result, the
Department directed significant effort toward strengthening its
network perimeter through implementation of fire walls and
intrusion detection systems. However, as external network's
defenses have grown stronger, our adversaries have shifted
strategies and most attacks today are less direct.
Many new network penetrations now occur as a result of an
authorized user activating malicious software program commonly
used known as a Trojan horse or some form of social
engineering. Once a user activates a malicious program, a
communication channel is established to the adversary system,
essentially ignoring the otherwise effective fire wall.
In January of 2005, my office added to our existing
inspection program an unannounced network testing process
commonly referred to as ``red teaming'' to provide a more
rigorous evaluation of this new threat environment. Red teaming
evaluates the strengths and weaknesses and security controls,
as well as the Department's ability to detect and disseminate
information about attacks and how it addresses the attacks.
Our most recent red team activity, conducted with only six
cyber specialists and in under 90 days, resulted in our ability
to take full control of two site networks and one small site
office network. Our red team was able to download a very large
quantity of data in gigabytes, 40,000 documents, some of which
were sensitive without being detected.
Additionally, with this access, we installed our own
malicious programs on a number of laptop computers. As these
laptops were legitimately connected to other networks through
authorized accounts, we were able to see these networks and to
browse the information on them, thus demonstrating our ability
to migrate through the Department into sensitive networks.
While there has been moderate improvement in the
unclassified cyber security arena, including better
segmentation of computer networks and improved vulnerability
scanning, we continue to identify problems in fully
implementing some fundamental security controls at DOE and NNSA
sites. For example, while some sites within NNSA have improved
their process for controlling outbound network connections,
many other sites have not fully implemented mechanisms to
prevent malicious software programs from sending sensitive
unclassified information to sources outside their networks.
The DOE Chief Information Officer and the Under Secretaries
have made progress in recent years with respect to developing
new policy and governance model to implement these new
policies. This governance model essentially enables each Under
Secretary to determine how they will implement departmental
requirements through their programmed cyber security plans. Our
inspections, however, have continued to demonstrate that some
fundamental cyber security requirements are not consistently
implemented throughout the Department.
We don't want to underestimate the work that has already
taken place. Some sites, especially within NNSA, have addressed
many of these issues. However, the Department continues to
identify successful penetrations of our networks.
To protect sensitive information more effectively, we need
to enhance certain aspects of departmental policy to include
requiring encryption of sensitive information stored on all
computers, implementing a more robust program cyber security
plan and review process by the DOE's Office of the CIO to
ensure that the plans are meeting expectations and revisiting
some of the risk decisions that have been made with particular
emphasis on the evolving threat environment.
Additionally, we need to continue to educate our users
regarding the threats involved with opening attachments and
running programs from untrusted sources. We should implement
authenticated gateways for all outbound Internet access to
reduce the ability for automated programs to establish pathways
to external systems, as we did with our red team. We should
also more efficiently analyze suspicious activities across the
network. Finally, we need to do a better job of keeping
attackers who manage to gain access to sensitive information on
our systems from sending that data outside our network
perimeters as well as limit their ability to migrate to other
areas of the site's network.
Mr. Chairman, my office and I believe this subcommittee and
DOE share the same goal of ensuring that our national security
assets are well protected and also share the concern when the
protection effectiveness falls below our standards. However,
the Department and the laboratories have additional work to do
to ensure that protection of the classified information they
possess in both physical and electronic form.
I cannot stress strongly enough our belief that we need to
get back to the basics of risk management to identify which
information needs special protection, to determine appropriate
protection measures to apply to that information, and then we
need to ensure that the protection measures are actually
implemented.
Thank you, Mr. Chairman.
Mr. Stupak. Thank you, Mr. Podonsky.
[The prepared statement of Mr. Podonsky follows:]
[GRAPHIC] [TIFF OMITTED] T3238.001
[GRAPHIC] [TIFF OMITTED] T3238.002
[GRAPHIC] [TIFF OMITTED] T3238.003
[GRAPHIC] [TIFF OMITTED] T3238.004
[GRAPHIC] [TIFF OMITTED] T3238.005
[GRAPHIC] [TIFF OMITTED] T3238.006
[GRAPHIC] [TIFF OMITTED] T3238.007
[GRAPHIC] [TIFF OMITTED] T3238.008
[GRAPHIC] [TIFF OMITTED] T3238.009
[GRAPHIC] [TIFF OMITTED] T3238.010
[GRAPHIC] [TIFF OMITTED] T3238.011
[GRAPHIC] [TIFF OMITTED] T3238.012
[GRAPHIC] [TIFF OMITTED] T3238.013
[GRAPHIC] [TIFF OMITTED] T3238.014
[GRAPHIC] [TIFF OMITTED] T3238.015
Mr. Stupak. Mr. Wilshusen, your opening statement, please,
sir.
STATEMENT OF GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION
SECURITY ISSUES; ACCOMPANIED BY ALLISON BOWDEN, SENIOR AUDITOR,
GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Wilshusen. Chairman Stupak, Ranking Member Shimkus and
members of the subcommittee.
Mr. Stupak. Is your mic on, sir? Just pull it up a little
bit, if you don't mind.
Mr. Wilshusen. Can you hear me now? OK.
Chairman Stupak, Ranking Member Shimkus and members of the
subcommittee, I am pleased to be here today to testify on
physical and cyber security at the Los Alamos National
Laboratory or LANL, one of three national laboratories operated
by the National Nuclear Security Administration that designs
and develops nuclear weapons for the U.S. stockpile. I am
joined by Allison Bowden, a GAO senior analyst specializing in
physical security.
A basic management objective for any organization is to
protect the assets and resources that support its critical
operations from theft, unauthorized access, use, modification,
destruction or disruption. It is especially critical for
national laboratories, such as LANL, that possess and process
special nuclear material, nuclear weapons parts and highly
sensitive and classified information.
A successful physical or cyber attack on LANL could have
devastating consequences for the site, its surrounding
communities and the Nation's security. Because of these risks,
LANL needs effective physical and cyber security programs.
Today I will summarize our recently completed work on physical
and cyber security at Los Alamos and share our preliminary
observations on physical security at the Lawrence Livermore
National Laboratory.
Mr. Chairman, LANL is improving its physical security. It
is implementing over two dozen initiatives to reduce,
consolidate and better protect its classified assets. It has
reduced the physical footprint of the laboratory by closing
unneeded facilities, although this initiative is focused more
on reducing maintenance costs than addressing facility
security.
Other challenges remain. Significant physical security
problems related to nuclear weapon part storage, inadequate
self-assessments and complete corrective action plans have been
fully addressed--or have not been fully addressed at the time
of our review.
In addition, LANL's ability to sustain security
improvements over the long term is unproven because its
approach is for sustaining progress contained weaknesses in the
early stages of development. For example, a system intended to
track long-term improvements would not be fully completed for 3
to 4 years.
Furthermore, the Los Alamos site office, which is
responsible for overseeing security at LANL, may not have
enough staff or the proper training to provide effective
security oversight.
To help strengthen LANL's physical security program, GAO
recommended, among other things, that LANL develop a
comprehensive strategic plan for addressing identified
weaknesses and improving program effectiveness.
At Lawrence Livermore our preliminary observations on
physical security indicate that its self-assessment and
performance-assurance testing programs need improvement and
that NNSA and the Livermore site office have not always
provided effective security oversight. Both Livermore and the
site office have actions under way that are intended to improve
these deficiencies. However, similar to LANL, sustaining
improvements may be a continuing challenge.
Turning to cyber security--and in reports being released
today, Mr. Chairman, we note that Los Alamos has implemented
numerous measures to enhance cyber security, but weaknesses
remain that impair the laboratory's ability to sufficiently
protect the confidentiality, integrity and availability of
sensitive information on the unclassified network. At the time
of our site visits, LANL had vulnerabilities in several
critical areas, including, identifying and authenticating users
of the networks, encrypting certain sensitive information,
monitoring compliance with security policies, implementing and
testing software patches, and planning for contingencies when
the network services are disrupted. A key reason for these
weaknesses is that the laboratory had not fully implemented its
cyber security program to ensure that controls were effectively
established and maintained.
In addition, the number of foreign nationals who have
access to the unclassified network, including about 300, as of
May 2008, from DOE's designated sensitive countries, had raised
concerns amongst some laboratory and NNSA officials because of
the sensitive information contained on the network.
To enhance cyber security over the unclassified network, we
are making a total of 52 recommendations to improve LANL's
program activities, correct specific control weaknesses, and
ensure a clear and consistent strategy for determining resource
requirements based on risk.
In summary, LANL has taken steps to improve its physical
and cyber security programs, but more remains to be done. Until
known deficiencies are adequately addressed and improvements
sustained over the long term, sensitive and classified
resources will remain at increased and unnecessary risk.
Mr. Chairman, we'd be happy to answer any questions.
Mr. Stupak. Thank you.
[The prepared statement of Mr. Wilshusen follows:]
[GRAPHIC] [TIFF OMITTED] T3238.016
[GRAPHIC] [TIFF OMITTED] T3238.017
[GRAPHIC] [TIFF OMITTED] T3238.018
[GRAPHIC] [TIFF OMITTED] T3238.019
[GRAPHIC] [TIFF OMITTED] T3238.020
[GRAPHIC] [TIFF OMITTED] T3238.021
[GRAPHIC] [TIFF OMITTED] T3238.022
[GRAPHIC] [TIFF OMITTED] T3238.023
[GRAPHIC] [TIFF OMITTED] T3238.024
[GRAPHIC] [TIFF OMITTED] T3238.025
[GRAPHIC] [TIFF OMITTED] T3238.026
[GRAPHIC] [TIFF OMITTED] T3238.027
[GRAPHIC] [TIFF OMITTED] T3238.028
[GRAPHIC] [TIFF OMITTED] T3238.029
[GRAPHIC] [TIFF OMITTED] T3238.030
[GRAPHIC] [TIFF OMITTED] T3238.031
[GRAPHIC] [TIFF OMITTED] T3238.032
[GRAPHIC] [TIFF OMITTED] T3238.033
Mr. Stupak. Ms. Bowden, would you care to make an opening
statement?
Ms. Bowden. No, sir.
Mr. Stupak. OK. Let's begin our questioning then. Let's go
10 minutes and move it along.
Mr. Wilshusen, let me ask you this: I'm glad to hear that
Los Alamos is doing better. This committee has really been on
their case, because we have had so many hearings concerning
their physical security. So we're pleased to see that.
We've asked in the past that GAO take a look at the need
for a Los Alamos. In other words, there's a lot of redundancy
in our labs. Is it necessary to keep that--is that
investigation or report by GAO ongoing, looking at the physical
assets of Los Alamos and is it needed?
Ms. Bowden. Yes, Mr. Chairman. We have finished the first
part of that review, which was the report that was issued on
physical security in June 2008. And we are just beginning the
second phase of that review, which will take a comparative look
at infrastructure across the nuclear weapons complex.
Mr. Stupak. OK. Thanks.
Well, let me ask you this, Ms. Bowden, if I may. One of the
concerns you raised in reporting on Los Alamos' physical
security structure, that it seemed to be cyclical in nature.
I'm glad to see that they're improving. But the labs appear to
improve when we've had a mishap and they know they're under
scrutiny.
How do we make sure there are improvements in the physical
security, whether it's cyber or just physical security, unless
this committee or--unless there's an incident, it seems like
they regress. How do we break the cyclical nature of this?
Ms. Bowden. In our June 2008 report, we've recommended
specifically that NNSA effectively incentivize financially,
through newly established performance-based contracts,
effective incentives for physical security performance. They
get beyond compliance-oriented measures, but really look at the
effectiveness of the security programs at Los Alamos.
In addition, we believe that effective security oversight
through the NNSA site office will help address the
sustainability of improvements in security at the laboratory.
Mr. Wilshusen. Regarding cyber security, it will take
several things to make that happen. One, of course, is first
getting the current control situation up to snuff in terms of--
in particular, like implementing our recommendations over the
weaknesses in its present controls. But that's only as a point
certain.
It's also imperative that the Agency develop the processes
and the structure to ensure that these controls and its risks
are adequately assessed over time because the computing
environment changes. The cyber security environment is very
dynamic. There are constantly new threats, new technologies and
new business processes and functionality that are being added
to the unclassified networks and to any network, speaking
generally. And so it requires that the Agency sets up the
processes and effectively implements them over time.
Mr. Stupak. Well, let me ask you this: To the extent that
you can testify, you or Mr. Podonsky, in open session here,
what is the level of sophistication of these cyber attacks? And
I take it they're increasing in capability.
It's getting much more sophisticated these cyber attacks,
is it fair to say?
Mr. Wilshusen. Definitely, they're becoming more
sophisticated and they're also becoming more targeted. In the
past, many of the attacks were just through hackers or virus
writers that might throw out a virus across the Internet and
see what they might be able to infiltrate. Now attackers--and
they come from a variety of sources--more specifically target
their--well, they more specifically try to target their more
particular systems or individuals that they want to attack; and
they tailor that attack to try to encourage an individual to
open up an e-mail attachment or to provide sensitive
information, like personally identifiable information, or to go
to a Web site to which can then be downloaded malicious
software which can provide the opening to the attacker.
Mr. Stupak. Mr. Podonsky, I think you actually said in your
testimony that before instead of a straight-in attack, now they
use a different method or go through someone who will already
have access to it, get them to open an e-mail or whatever, and
then make the attack.
Mr. Podonsky. In my opening statement I did talk about the
sophistication of these attacks. And I'm sure in the closed
session we'll be able to talk with greater granularity.
However, I want to emphasize again, as I said in my opening
statement, while DOE is a target, so is the entire United
States Government.
Mr. Stupak. Sure.
Mr. Podonsky. And we need to be sensitive that these
attacks are very real, not only against our laboratories, but
against all of our agencies.
Mr. Stupak. Well, and in my testimony, I had mentioned that
tens of millions of attacks are taking place each month. Are we
at a point where the number of attacks have outpaced our
ability to defend against them, or to identify them when they
do occur?
Mr. Podonsky. In our opinion, from independent oversight,
we believe that there are things that we can do to help protect
some of the information that we have. But the reality is that
these attacks continue to be, as you point out, more
sophisticated and more numerous. And it's a constant,
continuous struggle for all of us.
Mr. Stupak. But you also mentioned in your testimony your
Red Team and how you're able to penetrate two of the DOE labs
and downloading a very large quantity--gigabytes, you said--of
information.
Can you expound further on what your Red Team did? And what
does this suggest about the capability of the Department of
Energy to thwart cyber attacks?
Mr. Podonsky. What I can say in open session, first, yes, I
would like to explain in greater detail in a closed session
what they actually did and the only reason I can say that is
because we do not want to confirm for hackers out there what
the successful practices are, because we've proven that within
the Department.
But suffice it to say that, as I said, with a very small
group of cyber security specialists, and in under, as I said,
90 days, we were able to take over the network of two of the
sites.
We believe that were we with more people--and I'm not
asking for more, but were we with more people and had we
pursued this for a longer period of time, there would have been
more vulnerabilities that we would have found.
Mr. Stupak. I think, Mr. Wilshusen, and I think, Mr.
Podonsky--I think you both mentioned it--the so-called yellow
network, if you will, or the unclassified network at the labs
is not sensitive enough to warrant major action to protect it.
But yet these unclassified networks can lead you to terribly
sensitive information; is that correct?
Mr. Wilshusen. Yes. Certainly the information on the yellow
network contains very sensitive information, including
unclassified controlled nuclear information, export control
information, and personally identifiable information about LANL
employees. This information has intrinsic value to attackers
and to--of various different types.
It can be--information from a network potentially can aid
our competitors, or provide a competitive advantage to--in the
commercial sector. It can also be a source for intelligence
gathering and possibly disruption for other adversaries.
And so certainly that information has value. And I think
that's indicative, in part, by the number of attempted probes
that occur at that site.
Mr. Stupak. Well, you mentioned maybe the commercial nature
of it. But what about national security? Does the information
contained in the unclassified network pose a danger from an
adversary by going through the yellow network or unclassified
network? Can you get to something where an adversary, from a
national security point of view, could penetrate and then cause
us problems?
Mr. Wilshusen. Well, I would say that the type of
information on that network could certainly aid intelligence
operations from other organizations. It's highly sensitive and
it could potentially lead to that, yes, sir.
Mr. Stupak. Well, what's your opinion? And on the network
access that's been provided to foreign nationals from both
sensitive and nonsensitive countries, do you think that's too
open to foreign nationals?
Mr. Wilshusen. Well, I think the issue relates to--it
really comes down to a risk and benefit decision; you know,
what is the risk of giving these individuals, particularly from
the sensitive countries, access to the unclassified network;
and then what's--first is, what is the benefit of giving them
access to it?
And once it's decided whether or not these individuals
should have access to it, it's incumbent then upon the
organization to ensure that--as it would for any user, to
ensure that the access granted to that individual is based on
the principle of least privilege, and that they're only given
the access that they need to do the job and no more, and that
that access is based on need to know.
Now, we've been informed that the NNSA has decided to
remove the access of all the foreign nationals from sensitive
countries, from the yellow network.
Mr. Stupak. OK. Because isn't it sort of like what we did
in Los Alamos? I mean, I think we had a hearing on it where
foreign nationals had access--many people thought too much--and
then they just pulled back for the foreign national to limit
the access at Los Alamos; am I correct?
Ms. Bowden or--do you know?
Mr. Wilshusen. You mean previously?
Mr. Stupak. Right.
Mr. Wilshusen. That I don't know, sir.
Mr. Stupak. OK.
Mr. Friedman, if I may ask one question. I don't want to
leave you out there. Maybe we'll get around the second time.
In your January 2008 you reported that the Department
failed to adequately address cyber security incidents,
coordinations and communications. In our next panel Dr.
Wilbanks will say just the opposite.
Why is there such a difference of opinion as to the
effectiveness of cyber security incident coordination and
communication? And why is this such a challenging area for the
Department? And who within the Department is really responsible
for collecting, reporting and disseminating cyber incident
information?
In other words, I guess, who is responsible for the
program? Why do we have such diverse views on how effective
they're being on the cyber security?
Mr. Friedman. Well, Mr. Chairman, I can't speak to Ms.
Wilbanks' testimony, and I'm not sure I can completely
understand the distinction.
The Department does have a fairly sophisticated system of
collection, both a NNSA system and a non-NSA system of
collection of these incidents, in part to report to law
enforcement, partially my office and others, and in part to do
trending analysis and best practices and to alert the various
facilities within the Department as to where the problems may
be, and trends they may see that may affect all of the
individuals.
What we found in the past is that these two entities, which
by the way are in the process of being consolidated, at least
in part, that they did not receive--we did not receive from
them all the information that we needed to have a quality
referral to law enforcement and we had to go back and get
additional information.
So the structure is in place along the spectrum. The
question is, is it as complete and comprehensive as it needs to
be and as responsive to the needs of law enforcement and to the
others throughout the Department?
Mr. Stupak. OK. I thank you. Before I yield to Mr. Shimkus,
you know, there has been this report or letter by Mr. Terry
Turchie, and Mr. Dingell brought it up more in his opening
statement. And I am sure you are going to be looking into that,
the comments made in the letter by Mr. Turchie as to
counterintelligence and the intelligence. Will your office be
looking at that?
Mr. Friedman. Is that directed to me?
Mr. Stupak. Yes.
Mr. Friedman. I first saw the letter from Mr. Turchie this
morning at 10 minutes to 8:00 and I hadn't seen it previously.
I had seen the report by the Congressional Research Service
about 5 or 6 months ago, which addresses many of the same
issues. We are certainly looking at it carefully and we will be
considering what the next step should be.
Mr. Stupak. We look forward to working with you on that,
because we are going to look at cybersecurity at all the
agencies under our committee's jurisdiction. So I just wanted
to let you know. Thank you.
Mr. Shimkus for questions, please.
Mr. Shimkus. Thank you, Mr. Chairman. Still being relative
new to the committee and the oversight, having been on the full
committee for a long time, I don't come with the years of
analysis and frustration that many members do in delving into
this.
But current events dictate internationally that if a cyber
red team, given a month and six to seven folks, can do great
mischief, it poses a question, what can a nation state do with
unlimited people and really unlimited dollars? In the
international arena we have seen it with Estonia, we have seen
it most recently in Georgia, not the State but the country.
So it begs the question, if there is information, whether
it is technical in nature or that can be combined on this
yellow network, that is, quote/unquote, sensitive and all these
words are--if it is sensitive, either personal information or
it can then be placed together to create other information,
that is I think a problem.
And also, if in this definition of sensitive information
and that information then runs the risk of--well, let me say it
this way. In a communication environment, as we talked about
before, you have got information available for doing the job,
there is risk entailed. Are we willing to take the risk? Are we
willing to assume the risk? I understand there is an open
green--kind of like a green system which we can go to the
general information on DOE, then the yellow system, and then
the more--the issue that is classified. How do we clean up the
yellow network so that the classified information isn't there
and it is not accessible through the other networks? And let me
go to Mr. Wilshusen first.
Mr. Wilshusen. Well, I think, first of all, with regard to
the information on the yellow network, classified information
is not authorized to be on that network. And so there has to be
a process that goes through to make sure that information that
is on that network is not classified. And so there is some
classification requirements on that to assure--determine
whether or not somebody that is on the yellow network can gain
access to the red network. Is that what you are asking?
Mr. Shimkus. Or green to yellow to red.
Mr. Wilshusen. Right. Well, we are--
Mr. Shimkus. And then is part of that the Trojan Horse part
of thing that you're talking about is accessing in and then
sleeping and then awakening and then moving through aspects?
Mr. Wilshusen. Right. We are, at the request of this
subcommittee and the full committee, reviewing the security
controls over the classified network at Los Alamos, too. So I
can't comment on that at this point in time. Our work is still
premature to make any type of preliminary information or
observations on the security controls over the red network.
However, with regard to the yellow network and the green
network, they were interconnected in the past, and that was one
of the issues that we have identified that weaknesses--even
though our work on this particular engagement focused on the
yellow network, we found that there were paths from the green
network into the yellow network.
Mr. Shimkus. And then I would ask if that was identified,
have those paths then severed that we know of today, that
interconnect--the interconnection, the ability to do that?
Mr. Wilshusen. You mean today is that capability, do those
weaknesses still exist?
Mr. Shimkus. And that is probably a question for Mr.
Friedman and Mr. Podonsky. But, again, I have been on the
telecommunications, the tech committee and stuff, but I think
the only way you can really--information gets compromised in
one or two ways. You either have hackers that can use the
system to move through, so you have to sever the connection. Or
you have actually humans who surreptitiously, illegally, as in
flash drives, grab information. And we know that has happened
in the past, too.
So that for security aspects, one would be sever the
connections on the green network so that it does not have? And
that is what you recommended. And the question would be to Mr.
Podonsky and I guess Mr. Friedman, your analysis. Has that
happened? And can it? Or can you not do the mission if you do
that?
Mr. Podonsky. So far, Congressman, we have never identified
any pathway from the green to yellow network. However, we
strongly believe that the yellow network that we are referring
to, which varies from lab to lab and site to site in terms of
what goes on there, the certification and accreditation process
that is part of the Department, and Mr. Friedman talked about,
is there to make sure that we look at some of this
sensitivities of these networks.
While my colleague from GAO mentioned that there is no
classified, or supposed to be, on the yellow network, the fact
of the matter is we do need a classification process for
classified information.
The labs also do need a sensitive process. We need better
controls. There is no doubt in our minds from the oversight
perspective that while the information is not classified but is
sensitive, that doesn't mean it is not valuable to somebody.
And that is what we are concerned about. But we also believe,
as I said in my opening statement as well as the written
testimony, that we believe there are things that we can do,
like encryption of the information that is on the network.
Mr. Shimkus. The yellow system, can they e-mail outside of
the system? If you are on the yellow network, can you e-mail to
like Berkeley or the country of Georgia? And if you can, is
that then a main pathway of concern?
Mr. Podonsky. Yes, it is. And they can. And one of the
things I mentioned, and I want to reiterate my point in my
opening statement, is that we need to make tighter controls on
making sure that if somebody who is unauthorized into the
yellow network cannot send the information out the way our red
team did. And there are mechanisms that can be used by the
Department to prevent that as best we can.
One of the other problems is at Los Alamos, for example--
and it is not unique to Los Alamos and it is not unique to DOE,
I can emphasize--is that when you have 25,000 individual
laptops or stand-alone computers and these people are cleared
to use those, there is also a trust factor. And we have seen at
all the sites within the Department sometimes that human factor
fails. So what we do need is we need systems in place to put
tighter controls.
Mr. Shimkus. I am just trying to do a comparable to our
systems here. We have the Web sites, we have the e-mails. There
are some firewalls that disallow individuals from e-mailing us
unless they kind of identify that they are from the
constituency, and there is a blocking portion of that. I am not
sure if that is off-the-shelf type--of probably not very--
because we really don't handle sensitive--it might be sensitive
politically or for other purposes, but not to the extent that
this is. This is of a concern.
So I would--that would be where I would follow up, is
trying to make sure that the individuals are well-screened and
we do the background checks. Foreign nationals is a concern.
And the risk, the whole question of risk and reward based upon
the available information and the work that foreign nationals
can do.
So, again, this is my first oversight investigation hearing
on this subject. I know this committee continues to be very
diligent. We have had really bad case scenarios in the past.
And I just pledge my support to the chairman to be engaged with
him as we move forward. And thank you for your time.
Mr. Stupak. I appreciate that. I appreciate the gentleman's
comments.
If I just may. On this yellow that you were talking about,
yellow network. Information out there may be unclassified. But
if I take a piece of yellow unclassified, put it with another
piece of yellow unclassified, put it together, that information
then could become classified. Is that?
Mr. Podonsky. If I can, Mr. Chairman. We call that the
mosaic effect. And I would say it is counterintuitive to think
that there is not a value of the information on the network. It
is speculative for any of us to say that it would actually fit
together and become classified. But irrespective of whether it
is classified, the sensitivity can be of extreme value to
people who mean to do harm to our Nation. It may not be in the
realm of national security information, but let me give you an
example.
We sometimes send things that's password protected. We'll
send a message, and then it will be followed up by another
message that has the password in it. So if--I am not from the
Intelligence Committee, but if somebody is vacuuming up all the
information they can, they can put those two together and get
that password protection. Again, it's not classified, but it's
sensitive enough that we need to have stronger controls in
place.
Mr. Stupak. Mr. Friedman.
Mr. Friedman. Mr. Stupak, first of all, the mosaic effect
is important. And you described it well, I think. But one of
the problems with the yellow network, and it's not--it's
understandable and it's the nature of the contents of the
network, is that--and if you recall, if I might divert you for
a second. In 2005 or 2006, we had the exfiltration of PII,
personally identifiable information, at the Albuquerque Service
Center, I believe.
One of the problems is that this information, while it may
not be classified, if it falls into the hands of the wrong
individual, that individual could conceivably be exploited by
an inappropriate source. So there are--it's sensitive
information that needs to be carefully protected.
Mr. Stupak. Mr. Dingell for questions, please.
Mr. Dingell. Mr. Chairman, I thank you. Mr. Chairman, first
I would like to insert in the record a letter received by me
from Mr. Terry D. Turchie, which pretty much speaks for itself
about the situation with regard to security at the Lawrence
Livermore National Weapons Laboratory. I will have some
questions about that after I finish my first set of questions
and perhaps some later time.
These questions, yes or no. Mr. Podonsky, in your testimony
you mentioned one of your most recent red teams was able to
penetrate the networks of two DOE labs. Is that correct?
Mr. Podonsky. That is correct, sir.
Mr. Dingell. Which were those?
Mr. Podonsky. They were two science labs.
Mr. Dingell. You don't want to identify them by name?
Mr. Podonsky. I am happy to identify those in executive
session, sir.
Mr. Dingell. Thank you. Mr. Podonsky, isn't it true that
your red team was able to download very large quantities; i.e.,
gigabytes, of data, some of which were sensitive, without being
detected by DOE authorities?
Mr. Podonsky. Yes, sir.
Mr. Dingell. Mr. Podonsky, you also indicated that the
level of access your team was able to quickly obtain over the
course of just a few months would have allowed you to change
data or otherwise corrupt a particular lab's cyber network.
Isn't that correct?
Mr. Podonsky. Yes, sir, it is.
Mr. Dingell. Mr. Podonsky, I am gathering what your red
team did to these labs' cyber networks has rather profound
security implications. Is that correct?
Mr. Podonsky. Yes, sir, it does.
Mr. Dingell. Mr. Podonsky, doesn't this suggest that the
DOE does not currently have sufficient capability regarding its
cyber defenses.
Mr. Podonsky. No, sir, it does not.
Mr. Dingell. What, in your words, does this exercise
suggest as to the capability of DOE and its labs to thwart
cyber attacks?
Mr. Podonsky. What it tells us, Mr. Dingell, is that we
have some of our sites that are inconsistent in their
application of DOE policies. We have some sites that perform
better. But, overall, the Department of Energy as the rest of
the government has to strengthen our cybersecurity networks.
Mr. Dingell. Mr. Podonsky, isn't it true that the addition
to the access your team gained at these two sites, by
installing your own malicious programs on a number of their
laptop computers your red team was able to make important
footholds into the networks of other facilities after these
laptops were legitimately connected to their respective
networks?
Mr. Podonsky. Yes, sir. That is correct.
Mr. Dingell. Mr. Podonsky, moreover, didn't additional
activity conducted by your red team demonstrate your team's
ability to possibly move around throughout a number of DOE
sensitive networks?
Mr. Podonsky. We believe that that would have been the case
if we had continued on with the activity.
Mr. Dingell. What more can you tell about that?
Mr. Podonsky. Well, we terminated our activity because we
were aware that there was actual infiltration in some of the
sites that we were looking at.
Mr. Dingell. Now, Mr. Wilshusen, yes or no again, please.
Some have suggested the information on the yellow unclassified
network at the labs is not sensitive enough to warrant major
action to protect it. This is a question that our chairman has
been raising on this. I gather you don't agree with that
statement.
Mr. Wilshusen. That is correct; I do not agree.
Mr. Dingell. Now, Mr. Wilshusen, in fact your reports say
that the information in the Los Alamos unclassified network
contains such information as Naval propulsion data, personally
identifiable information, unclassified controlled nuclear
information, and a host of other sensitive categories of
information. Is that correct?
Mr. Wilshusen. That would be those categories of
information. Yes.
Mr. Dingell. Could you mention any other categories that
should be addressed?
Mr. Wilshusen. Did you include our unclassified controlled
nuclear information?
Mr. Dingell. Yes.
Mr. Wilshusen. OK.
Mr. Dingell. Mr. Wilshusen, isn't it the case that your
report said that that kind of information a valuable target for
foreign governments, terrorists, and industrial spies?
Mr. Wilshusen. Yes.
Mr. Dingell. Mr. Wilshusen, I gather that GAO does not
believe, given your findings at the labs, the DOE as a whole is
sufficiently prepared for cyber attacks or cyber intrusions. Is
that correct?
Mr. Wilshusen. I would say that they are at increased risk.
Yes.
Mr. Dingell. And that would be a substantial risk?
Mr. Wilshusen. It could be. Yes, sir.
Mr. Dingell. Now, Mr. Podonsky again. Let's talk about--
let's talk about this. The Director of Los Alamos remarks in
his testimony that your offices draft audit report for August/
September recognizes that Los Alamos National Laboratory is
making progress in many security areas. Is that correct?
Mr. Podonsky. That is correct. They are making improvements
that we have not seen in 20 years.
Mr. Dingell. But I gather, however, that the lab is still
not out of the woods when it comes to physical security. Is
that correct?
Mr. Podonsky. There are areas that they need to improve
upon, but they have made quantum leaps from our last
inspection.
Mr. Dingell. Ms. Bowden, isn't it true that DOE's Office of
Independent Oversight found major concerns regarding Lawrence
Livermore's security capability in April of this year?
Ms. Bowden. Yes, sir.
Mr. Dingell. Ms. Bowden, in your testimony you say
concerning the exercise that, and I quote, ``Livermore received
the lowest possible rating for protective force performance and
protection of classified resources.'' Isn't that correct?
Ms. Bowden. Yes. That is what the Office of Independent
Oversight found.
Mr. Dingell. And, GAO, to the extent that you can identify
this in an unclassified setting, how did Lawrence Livermore get
into this position and what are the root causes?
Ms. Bowden. Well, in a general sense, and based on our
preliminary observations, because this work is ongoing, we
discussed that question with officials at the laboratory and
with officials--Federal officials at the site office. And there
are a number of factors that may have contributed, though we
will continue to work on this.
Those included focus--a focus shift on contract transition,
the declaration of the site as non-enduring for Category I
special nuclear material. And, in addition, frequent security
policy changes over the different design basis threats that had
been issued over a period of time.
Mr. Dingell. Thank you.
Mr. Podonsky, it was your claim that GAO referred to in
their testimony as doing the physical red teaming of Lawrence
Livermore. Is that correct?
Mr. Podonsky. Yes, sir.
Mr. Dingell. Mr. Podonsky, I have limited time so I know
you will speak quickly. But tell us how you believe Lawrence
Livermore got into the posture where it has performed so
poorly.
Mr. Podonsky. It's a mystery to us, Mr. Dingell, because we
have seen in our last inspection before the spring that they
were performing well. We do believe that a great contributor
is, as the GAO just mentioned, having to do with the contract
change-out.
Mr. Dingell. Ms. Bowden again, if you please. One of the
concerns you have raised in your report about Los Alamos's
physical security posture is the cyclical nature. What--that
is, the labs appear to improve when they have had a mishap and
know that they are under scrutiny. Is that correct?
Ms. Bowden. Yes, sir.
Mr. Dingell. Ms. Bowden again. What explains the root cause
of the cyclical nature of the security at the labs, and how can
we prevent this?
Ms. Bowden. In our report we have made several
recommendations that we think will address sustaining
improvements over time, the first of which is providing better
financial incentive for effective security performance in the
contract determinations for the award fees at the end of each
fiscal year. In addition, we feel it's important to ensure
adequate NNSA site office oversight of security on a consistent
basis at the laboratory.
Mr. Dingell. Mr. Chairman, because of the limited amount of
time, I request that this letter be inserted in the record, and
I would ask that our witnesses give us their comments on the
findings and the statements made in the letter, and I would ask
that the record be kept open so that that may be inserted into
the record at the appropriate fashion in time.
Mr. Stupak. Without objection. I would also note that it's
in our binder. So it will be made part of the record, Mr.
Chairman.
[The information appears at the conclusion of the hearing.]
Mr. Dingell. Thank you, Mr. Chairman.
This to Mr. Friedman. The Federal Information Security
Management Act requires that the Office of the Inspector
General conduct an independent annual evaluation to determine
whether the Department's unclassified cybersecurity program
properly protects its information systems. Is that correct?
Mr. Friedman. That is correct.
Mr. Dingell. Mr. Friedman, in 2008, your evaluation report
of the Department's unclassified security program states: The
Department continues to make, quote, incremental improvements
in this program. Yet, isn't it true that you have continued to
find ongoing concerns with DOE's cyber defense capability?
Mr. Friedman. That is correct.
Mr. Dingell. Mr. Friedman, in fact, isn't it correct that
your latest reports found the following over the past few
years: Unsolved issues surrounding risk assessments and
adequacy of security controls? Yes or no?
Mr. Friedman. You are correct, sir.
Mr. Dingell. Lack of centralized department-wide inventory
of information systems.
Mr. Friedman. That is correct.
Mr. Dingell. That is a fairly simple to do, isn't it, to
perform that particular act?
A failure of some sites to complete contingency disaster
plans.
Mr. Friedman. Correct.
Mr. Dingell. Failure of Department officials to implement
Federal and Department security requirements in a timely
manner.
Mr. Friedman. That is correct.
Mr. Dingell. Mr. Friedman, in your opinion, do these
weaknesses continue to exist?
Mr. Friedman. They--our reports are current. And the answer
to your question, Mr. Chairman, is that until we do another
review and see that they are not in effect, we will continue to
believe that they exist. Yes.
Mr. Dingell. Now, why do these security questions and
weaknesses continue to exist?
Mr. Friedman. That is one of the most perplexing questions
that I deal with every day, Mr. Chairman.
Mr. Dingell. It seems to be a leadership problem. Doesn't
it?
Mr. Friedman. Well, I would say this. The conclusions that
we reach after thinking about this over a great deal of time is
that the Department lacks the ability to close the game, in the
sense that a lot of good actions are initiated but they don't
get completed and implemented. And that seems to be a problem.
Mr. Dingell. Thank you.
Mr. Chairman, I appreciate your courtesy. Thank you.
Mr. Stupak. Thank you, Mr. Chairman.
Mr. Burgess for questions.
Mr. Burgess. Thank you, Mr. Chairman.
Let me ask a question to the GAO related to the management
of the money available for security. How much money have we
allocated for overseeing that security's implemented and
followed?
Ms. Bowden. In fiscal year 2007, it was about $188 million.
Mr. Burgess. And so that is not a huge sum by Washington
standards, but a significant sum, and the problems persist.
What sum is it going to take so that we get to the place we
want to be?
Mr. Wilshusen. That is a very difficult question to answer,
and I don't know if I can point to say this is the sum that is
needed. I think what I can say, though, is that the agency
needs to properly assess its risks and determine what policies
and procedures that they need to implement to cost effectively
reduce those risks to an acceptable level.
We have to remember that security is a risk management
problem; it's not a risk elimination or risk avoidance problem.
Because you can throw so much money at security and you can
lock down everything, but at the same time the costs would be
prohibitive as well as it will probably take a major hit on
productivity. So it's really a balancing act to determine how
much is necessary to secure the systems based on risk.
Ms. Bowden. And if I may clarify, the dollar figure was for
Los Alamos.
Mr. Burgess. But we are going to have--it will be budget
time again before we know it, and we are going to have to be
thinking through these things. At some point we are going to
need some advice from people like you as to whether or not we
are doing our job in providing you the resources; i.e., the
funds that you need to hire the personnel, to purchase the
software, to run the red teams, to make sure that things happen
the way that they are supposed to happen.
Mr. Wilshusen. Well, certainly what I will say, too, is
that for many of the recommendations that we are making in our
reports that are being released today, much of that would not
necessarily require additional acquisition of software devices.
It's more of a management issue, taking the security controls,
the devices that are presently there, and configuring them in
such a manner to make them more secure.
Mr. Burgess. We may come back to the management question in
just a moment. But is it also a matter of time?
Mr. Wilshusen. Yes, sir. Time is of--in our view, time is
of the essence in terms of taking the corrective actions to
improve the security over the unclassified network at Los
Alamos, because of the sensitive information it contains and
because of the risks associated with the weaknesses that we
have identified.
Mr. Burgess. Well, giving you more time may increase the
risk. Providing you more money, if you can do it in a shorter
period of time, in my mind at least, would be a reduction of
risk. I am just not sure how much. I am not sure how much
flexibility we should be willing to give on time for
implementation just because of the risk that is out there. I
mean, and it's not just you, but certainly your area is--it's
such a significant vulnerability that we really can't overlook
it.
A question, Mr. Podonsky, about the number of laptops. What
was the number that you told us, the number of laptops that may
move around?
Mr. Podonsky. I misstated. I was meaning the stand-alone
sets of computers, which I said were 25,000 users at Los
Alamos. And I used that example to answer Chairman Stupak's
questions about the vulnerability of the yellow network.
Mr. Burgess. What would be the correct figure for the
number of laptops that may move around in so-called trusted
circles within the lab?
Mr. Podonsky. I don't have that number. I would have to get
that number and get it back to you.
Mr. Wilshusen. One of the things that we've identified on
our review was that there are about 13,000 users. Now, this is
just on the unclassified networks, so I can't comment on all of
the networks at Los Alamos. But just for a scope. There are
about 13,000, a little bit over 13,000 users on the
unclassified network, and that network contained about 25,000
devices. And so those would include work stations, but also
routers, switches, and other types of devices.
Mr. Burgess. But as we have seen from these reports and
other areas, a misplaced laptop is a source of great
vulnerability. And all of us, you and us, are under great
scrutiny in that regard to make certain that these very
powerful and very useful devices--they can certainly increase
productivity but they really expose a great deal of
vulnerability if we are not careful. So I just wonder if we
shouldn't be a little bit more circumspect about the number of
devices that are actually out there with information.
I think it was on this panel that we heard about the
purchase of some of the equipment, which is proprietary
equipment, with USB ports that might be vulnerable to access.
And we sealed them up with JB Weld--which is a good Texas
product, so I am glad but we used J Weld, but it just seemed
like a significant oversight in the purchase of that equipment
to lead us to that degree of vulnerability. And then laptops
that can move around so easily and be left somewhere or stolen
or lifted, or even if someone did have an idea to do something
that they shouldn't be doing, it just makes it that much easier
for the person who has a criminal intent.
I guess, Mr. Podonsky, this is for you. On the issue of--I
think we've talked about this before on this subcommittee,
about this issue of encryption and sequestration. How is that
project going? Where are we with that? Can you develop that a
little bit for us on the sequestration and the equipment side?
Mr. Podonsky. What I can tell you--first, I am sure the
second panel can give you more clarity on how far they have
gone in that arena. But from our inspection process, we don't
feel that enough of the sites are encrypting the information
that needs to be encrypted. There is--
Mr. Burgess. Why is that?
Mr. Podonsky. Well, because the policy says it is preferred
that the information be encrypted. And we have learned over
time that unless there is a regimented language that says you
shall encrypt it, then using the word ``preferred'' becomes
accounting option. And we find that a little disturbing.
Mr. Burgess. Too much flexibility, in other words?
Mr. Podonsky. That is what we believe.
Mr. Burgess. Now, is there any problem with obtaining the
software or the type of software that is available? Is there a
satisfactory program that is out there that you all are using
for the encryption?
Mr. Podonsky. I believe the software is out there; but I
also understand that the process would be a little bit less
convenient when doing business.
Mr. Burgess. And what about the sequestration aspect of it?
Mr. Podonsky. I will have to defer to the CIOs.
Mr. Burgess. And I think it was your testimony where you
said the attacks were becoming more sophisticated, more
targeted. Are they also becoming more frequent?
Mr. Podonsky. Yes, sir, they are.
Mr. Burgess. And do we have a general idea of where they
are coming from?
Mr. Podonsky. I think that is a question that really should
be answered in the executive session.
Mr. Burgess. Fair enough. We will do that.
A question was asked about what caused the lower security
level at Livermore, and I think you answered, Mr. Podonsky. But
Ms.Bowden, do you have an opinion on that as well through your
study?
Ms. Bowden. I think we both agree that there was a shift in
focus to the contract, the management and operating contract
transition.
Mr. Burgess. And that is at Livermore?
Ms. Bowden. Yes.
Mr. Burgess. Because at Los Alamos, we had the contract
evaluation but we didn't change the contract. Correct? Do I
remember that correctly?
Ms. Bowden. The contractor was changed in 2006.
Mr. Burgess. At Los Alamos?
Ms. Bowden. Um-hmm.
Mr. Burgess. So when we talked about some of the leadership
problems as that, do you think that has been dealt with
satisfactorily?
Mr. Podonsky. Sir, I would like to answer that, having
inspected Los Alamos for the last 24 years. The answer is
absolutely we see a sea change that we haven't seen there
before. I just came back from the Los Alamos inspection
closeout for my independent oversight, and we have seen a lot
of improvements. We have seen commitments that we don't think
were just pabulum. And we believe it's because of the
accountability. We know that they are watching our enforcement
actions and compliance orders. We know that they are paying
attention to the inspections.
Mr. Burgess. And do you think that there's going to be a
way to extrapolate those successes to, say, the Livermore
facility?
Mr. Podonsky. I am sorry?
Mr. Burgess. Is there going to be a way to extrapolate
those successes to other facilities where we've fallen behind?
Mr. Podonsky. Based on the aggressiveness by which the
Livermore folks are addressing our very serious concerns from
the spring inspection, we are hopeful. But, again, the
sustainability is going to be an issue that we are going to be
watching.
Mr. Burgess. Very good.
Thank you, Mr. Chairman. I'll yield back.
Mr. Stupak. I thank the gentleman.
Ms. DeGette for questions.
Ms. DeGette. Thank you very much, Mr. Chairman.
I would like to follow up on some of the questions that Mr.
Dingell was asking. The first one being, on this yellow
network, the unclassified network, there is still sensitive
information. And everybody has agreed with that here today. And
the question is, what dangers do we have if people can access
that information? Because even though it's not classified, it
still is important. Mr. Dingell mentioned a couple of the
nuclear issues, but I just want to go through the list that the
GAO listed in their report because it's really kind of
shocking.
Business proprietary information. The nuclear information
he talked about. Export control information. The military
critical technology list. Confidential foreign government
information. And personally identifiable information, including
names, aliases, Social Security numbers, and biometric records
of employees, contractors, and visitors.
Now, a lot of this information if someone were to access it
would be criminal and even worse. This is not just completely
neutral information. And so I have some follow-up questions on
what is happening to try to preserve that information.
I guess my first question would be maybe to you, Mr.
Podonsky, is do you think that the labs or the DOE have the
technical expertise and resources to protect this information
that is currently residing on the unclassified networks?
Mr. Podonsky. Congresswoman DeGette, we do believe that the
technical expertise exists within the laboratory community as
well as with the rest of the Department. We do also believe
that the sensitivity--we share your concerns about the
sensitivity that is on the yellow network. That is why I have
said in my testimony and in my opening statement we do believe
tighter controls are necessary.
Ms. DeGette. Well.
Mr. Podonsky. If I might continue. As exemplified by our
red teaming effort, and we are not the most sophisticated red
teaming hackers in the world, but given our capabilities and
what we were able to do, that should give us all pause as to
what we need to do.
Ms. DeGette. I was going to ask that question in a minute,
because unlike my friend, our ranking member, I have been on
this committee for 12 years and I have been to Los Alamos and I
have been in these hearings and we have you guys down all the
time. And every time you come in, you say, you know, we have
these risks, we have these problems. It's always cropping up
some other place. So if we have got the expertise and
capability to do it, here's my simple question to you, why
aren't they doing it? Because you are right, it's not just the
yellow information, it's the red information.
Mr. Podonsky. I can give you an opinion from oversight as
to why the Department is not doing it.
Ms. DeGette. I would love that opinion.
Mr. Podonsky. And our opinion is it's not always been the
highest of priorities from different administration to
different administrations. I would also say--
Ms. DeGette. But we have had this administration now--do
you mean Washington administration or lab administration?
Mr. Podonsky. No. Washington administration.
Ms. DeGette. Well, we have had this administration 8 years.
Mr. Podonsky. In 2000, ma'am, we came to the floor of this
hearing room and gave a demonstration, a live demonstration of
how we could crack codes of passwords.
Ms. DeGette. I remember it. I was there.
Mr. Podonsky. So we know that these problems exist.
Ms. DeGette. So why--we have had this administration 8
years. Is your testimony today that it has been a low priority
for this administration? Yes or no?
Mr. Podonsky. No, ma'am.
Ms. DeGette. Then why haven't we done it?
Mr. Podonsky. I don't have a complete answer for you
because I am not within the CIO's office. That is in the next
panel. But from our perspective, we have written reports on
this very subject multiple times.
Ms. DeGette. I am frankly, with all due respect, I am not
particularly interested in the written reports. I am interested
in when are we going to do this. If we have got the technical
ability to do it, if we've identified the problem, then how
quickly could we solve the problem if appropriate attention
were given? Anybody can answer that if you know the answer.
Mr. Podonsky. I don't know what my colleagues on the panel
think, but I think this is a problem that can be solved.
Ms. DeGette. No. How soon can it be solved?
Mr. Podonsky. As soon as the resources are applied.
Ms. DeGette. OK. So it's a resource question. That goes
back to Dr. Burgess' question, which is, what kind of resources
are we talking about here?
Mr. Podonsky. We're talking about dedicated people within
the cyber community to solve the problems.
Ms. DeGette. How many dedicated people? How much money?
Mr. Podonsky. I would have to--without just giving it off
the top of my head, I couldn't tell you that. But I think that
we have--
Ms. DeGette. Do you know that?
Mr. Podonsky. I believe we have it in the Department. We
have the technical intellectual capabilities and we have the
resource capability to make the changes.
Ms. DeGette. All right. So if you could supplement your
answer within 30 days, I would appreciate it, telling us what
kind of resources we would need to give to this.
Now, let me ask another question. And again if other people
know, please chime in. Do we, if we have got the ability to do
it and it's just a matter of resources and priorities, do we
have a full inventory of all the information that is residing
on these unclassified networks?
Mr. Podonsky. I don't believe that we have a complete
inventory on what resides.
Ms. DeGette. Is that something we would need to do?
Mr. Podonsky. That would be a major undertaking for
millions and millions of documents. And I am not so sure,
Congresswoman DeGette, that that is the best use of the monies.
The best use of the monies is to protect the information from
going out, and protect the information from having access by
hackers.
Ms. DeGette. It would probably also be worth reviewing
categories of information to see if we really do need to have
that on our networks then if we can remove it. Correct?
Mr. Podonsky. Yes, ma'am. And that would be up to the
individual program offices as to what types of information they
are allowing their folks to put on the network.
Ms. DeGette. Well, maybe not. Because for some of these
types of information, you could probably make a decision from
the top whether you needed to have that information on
certainly unclassified yellow networks. Information like
aliases and Social Security numbers and biometric records of
employees. It's hard to see how you would need to have that on
some kind of a network. What do you think?
Mr. Podonsky. Well, I don't know how they use all the
information, but I do know they use that network to conduct
business. And they separate that from the classified.
Ms. DeGette. See, what I worry about, though, is if you are
leaving it up to each individual department head, that then you
have no overall standard by which they could weigh it. So if
you had an overall standard, then they could come in and ask
for an extension if they had a need to put that on the network.
Mr. Podonsky. And the CIO when he came on board in 2005, I
believe, or 2006 put together with the three undersecretaries a
governance model of federalizing the federation of policy that
has the overarch policy, and then NNSA, Science, and Energy are
able to tailor that to what their individual missions are.
Ms. DeGette. Now, Mr. Podonsky, do you think that the DOE
lab should consider removing certain information on the
unclassified network or increase its level of classification?
Mr. Podonsky. As I said, Congresswoman DeGette, the
laboratories need to take a good look, and the Department, in
making sure that there are stronger protections of that
information. Some of that information may need to be removed.
But one of the problems is, where do you put it? If you put it
on the classified net, you have now redefined what classified
is.
So I again go back to our oversight perspective, is we need
to keep people out of it, and we need to make sure that we have
a rigorous process to make sure that anybody that might get in
it cannot send information off the net.
Ms. DeGette. What is your opinion on that, Mr. Wilshusen?
Mr. Wilshusen. Well, I think I would also agree to the
point that the information on that yellow network, whether or
not that should be upgraded, if you will, and then reclassified
and then put on the red network is a decision that is whether
or not that information is classified or not. And that is
something that needs to be done, and it probably has already
been done, you know, it's been determined to be sensitive but
unclassified. That is why it's on the yellow network.
But I agree with Mr. Podonsky, that the first thing that
needs to be done is to better protect the information that is
on that network by--
Ms. DeGette. I want to ask you one more question. Do you
think there is some argument to be made about maybe making an
intermediate network between the yellow and red networks for
some of this unclassified information? You don't want to be
calling things, as Mr. Podonsky rightly says, you don't want to
be calling things classified if they are not. On the other
hand, there is things that might be sensitive, like employees'
Social Security numbers that are not necessarily classified
information.
Mr. Wilshusen. Right. And because of that, such as
personally identifiable information needs to be protected. But
should that be on a different network? That is what the yellow
network is for; it's the unclassified protected network.
Ms. DeGette. So your view is we need to protect that
network better.
Mr. Wilshusen. Yes, ma'am. And--
Ms. DeGette. I just want to say, I know you folks can't
make the rules, you can only make the recommendations. And I am
sure that--you don't have to answer this, I am sure that many
days you are just as frustrated as we are; you keep identifying
these problems but yet no progress is made. So I want to thank
you for your commitment to these issues. They are very
important.
Mr. Wilshusen. Thank you.
Mr. Stupak. Mr. Shimkus has a quick question, and then we
will go on to Mr. Inslee.
Mr. Shimkus. And I will be brief. One thing I wanted to
follow up with what I didn't was just an overall assessment of
the corporate culture, or the culture of these labs and this
whole issue. I agree with Chairman Dingell that it's
leadership, and its leadership goes from the top and then the
director of the lab, the director of the sub environments.
Has the corporate--let me, Mr.Wilshusen first. Has the
corporate--did you evaluate the culture of the labs? And with
respect to my colleagues who have been on this issue for a long
time, which again which I haven't, has the culture changed
positively in the security environment for the labs?
Mr. Wilshusen. Well, related to just the cybersecurity
portion of it, and I will defer to Ms. Bowden on the physical
security, we have just completed our review, and that is our
first review that we have done reviewing cybersecurity out at
Los Alamos. We have noted that some of their technical folks in
terms of technical security individuals are among some of the
better ones within the Federal Government. And, indeed, they
implemented many innovative techniques to try to secure their
unclassified network. However, we also found though that there
were still a number of very significant vulnerabilities that
impaired their ability to adequately protect that information
on their network.
But in terms of the culture, I think there has been a
change over the last year from what we have seen during the
course of our audit. It seems like they are more concerned
about the cybersecurity. But whether that is in response to our
initial field site visits and how long that remains, of course,
remains to be seen.
Mr. Shimkus. Mr. Friedman, can you respond to that?
Mr. Friedman. Yes. In all fairness, while we still find
problems and there are still concerns, and lot of them are
serious, I don't think there is any question that the results
of our work suggests, and our interactions with the laboratory
personnel, that there has been a change in mindset, much more
aggressive in the area of security. It may be beyond their
capability to fix all the problems, but I think--and I have
been observing this, sir, for three decades--there is a change.
There is no question about that.
Mr. Shimkus. Thank you. And I would just hope that the
position would be--I am not going to ask Mr. Podonsky to follow
up, but I would just say, if there is a positive change in the
culture, we need to push hard to sustain that change.
Thank you, Mr. Chairman.
Mr. Stupak. Thank you.
Mr. Inslee for questions, please. 10 minutes.
Mr. Inslee. Thank you. There has previously been a letter
entered into the record from Mr. Terry Turchie that discloses
very significant concerns by him. He's formerly with the FBI
and he served as senior counterintelligence officer at Lawrence
Livermore Nuclear Weapons Laboratory. This letter is dated
September 1, 2008. And basically the letter is intended to
alert Congress, it's a letter to Chairman Dingell, of what he
considers very serious failures to focus on
counterintelligence.
He describes there being a significant change from an
emphasis or at least a significant commitment to
counterintelligence to simply what he considers intelligence
gathering. And he outlines in his letter quite a number of
occurrences that would suggest there has been, at least in his
view, a significant reduction in counterintelligence as he
would define that activity. That, to me, is a significant
issue, and I just would ask for the comment of any of you to
respond to those concerns.
I want to note, too, that there are many people that are
disgruntled with Federal activity. This is a gentleman who
seems to have credibility, his resume is pretty outstanding,
and I think his concerns ought to be ones that we would
investigate. So I would ask for any of your response, I don't
know if you have seen the letter, could respond to the general
issue he has raised. His letter in general discusses a lack of
financial and organizational commitment to counterintelligence
as opposed to just what he would consider intelligence
gathering. I just would ask for your comments, if you can
provide them.
Mr. Podonsky. The only thing, Congressman, that I can tell
you is that, number one, I have not seen the letter. We do work
with the intelligence and counterintelligence office, and I
could not give you any informed answer to your question based
on our interaction with the intelligence/counterintelligence.
But I would also defer to the second panel where the director
of the counterintelligence is going to be a witness.
Mr. Inslee. Well, I would ask the panel to take a look at
it and provide us your review, if you can do so. I do think it
brings up some significant issues which would suggest there has
been a real change of emphasis, and we would appreciate your
further comments. Thank you.
I yield back.
Mr. Stupak. The gentleman yields back. Let me thank and ask
this panel--that's all the questions we are going to ask you in
open session; as you referred to once or twice, we will go to
closed session after the next panel. So I would ask that you
just stay in the vicinity, not necessarily have to sit in the
hearing room because we are going to do the next panel which
has eight witnesses. It will take us some time, but we are
going to go into closed session. We will invite you back for
closed session. Thank you.
I am going to ask our next panel to come forward, please.
On our second panel we have Dr. Michael Anastasio, the
Director of the Los Alamos National Laboratory; Dr. George
Miller, who is the Director of Lawrence Livermore Laboratory;
Dr. Thomas Hunter, who is the President and Laboratory Director
at Sandia National Laboratories; Mr. Thomas Pyke, Jr., who is
the Chief Information Officer at the Department of Energy; Dr.
Linda Wilbanks, who is the CIO, Chief Information Officer, at
the National Nuclear Security Administration within the
Department of Energy; Mr. Bradley Peterson, who is the Chief
and Associate Administer for the Defense Nuclear Security at
the National Nuclear Security Administration within the
Department of Energy; and Mr. Stanley Borgia, who is the Deputy
Director for Counterintelligence in the Office of Intelligence
and Counterintelligence at the Department of Energy.
Have we got everybody? We are missing Dr. Wilbanks. We will
have to wait for Dr. Wilbanks here for a minute. It will be
just a second. And it looks like Mr. Peterson, too.
[Brief recess.]
Mr. Stupak. It is the policy of this subcommittee to take
all testimony under oath. Please be advised that witnesses have
the right under the rules of the House to be advised by
counsel. Do any of you wish to be advised by counsel? Everyone
shook their head no. So we will do the oath.
Do you swear or affirm that the testimony you are about to
give will be the truth, the whole truth, and nothing but the
truth in the matter pending before this subcommittee?
[Witnesses sworn.]
Mr. Stupak. Let the record reflect all of our witnesses
took the oath. You are now under oath. We will start with 5-
minute opening statements.
I understand, Mr. Peterson, you wish to go first. So we
will accommodate that request for your opening statement,
please.
STATEMENT OF BRADLEY A. PETERSON, CHIEF AND ASSOCIATE
ADMINISTRATOR, DEFENSE NUCLEAR SECURITY, NATIONAL NUCLEAR
SECURITY ADMINISTRATION
Mr. Peterson. Good morning, Chairman Stupak, Ranking Member
Shimkus, members of the subcommittee. My name is Brad Peterson.
I was recently appointed Chief Defense Nuclear for the National
Security Administration, the NNSA. Prior to this appointment, I
was the Director of the Office of Independent Oversight within
DOE's Office of Health Safety and Security. It gives me a
unique perspective into the issues to be discussed today. In my
new role, I have overall responsibility for physical and
cybersecurity within NNSA.
Following my remarks, Dr. Linda Wilbanks, the NNSA Chief
Information Officer with operational responsibility for
cybersecurity, will provide her opening comments.
While the NNSA faces many challenges and it has significant
room to improve, we continue to make enhancements in our
physical and cybersecurity postures to maintain strong and
robust security. NNSA operates some of the most secure
facilities in the world and generally maintains effective
physical security programs. Over the last 2 years, while there
have been some issues, we see overall progress in improving
performance at the NNSA weapons laboratories.
Earlier this year, the Office of Independent Oversight
conducted a safeguard security inspection of Lawrence Livermore
National Laboratory and identified significant weaknesses in
protective force operations, based in part on poor performance
during force-on-force training exercises.
Immediately after the inspection results were known, the
Office of Defense Nuclear Security within NNSA devoted
considerable attention to understanding the issues and
providing subject matter expertise from across NNSA. While the
NNSA was not pleased with their results from the Livermore
inspection, I can attest to the fact that the Office of Defense
Nuclear Security Livermore site office and laboratory have
taken the issues very seriously and worked aggressively to
implement corrective actions.
Livermore launched a comprehensive recovery plan, and today
we see the results of their efforts taking hold. Protection
force capability at Livermore is much improved and there are
more changes in progress.
Upon assuming my new position in June, the NNSA
Administrator directed me to dispatch a team of senior NNSA
security professionals to conduct an onsite review of the Los
Alamos National Laboratory Protective Force operation to
determine if they had similar issues. The NNSA team found that
the Los Alamos Protective Force had a strong and rigorous
performance testing program and was performing effectively.
This assessment of Los Alamos was reinforced by preliminary
positive results from the recently completed independent
oversight inspection.
Seeking to build sustainable security programs, I intend to
look across the NNSA for examples of where we are getting it
right. We are also engaging in efforts to improve the flow of
information across the NNSA security community through our
security leadership coalition. The coalition has been actively
engaged in evaluating the underlying causes of security and
management issues that we face and developing standardized
solutions. The objective of this effort is to break down
organizational stovepipes and turn a previously reactive
approach to security problems into a proactive approach.
NNSA is making real and fundamental changes to our security
program. These changes seek to reduce the opportunity for human
error by relying on engineered controls. We are also focused on
making our security challenges easier by reducing our
classified footprint. We have emphasized the need for strong
contractor assurance programs designed to spot problem areas
quickly and resolve them before they turn into real security
issues.
Finally, we need to continue to develop a strong Federal
security staff that is technically capable. We need to ensure
that our Federal oversight program takes advantage of the tools
at our disposal, including substantial deductions of award fee
for poor performance and fines provided under 10 CFR 824 when
appropriate. We also need to ensure that we are appropriately
incentivizing and rewarding the right behaviors to drive needed
improvements.
In closing, since taking over as the Chief Defense Nuclear
Security, I have seen a renewed sense of commitment across the
NNSA security community to improve performance through the
sharing of lessons learned and working collectively to address
significant challenges. Security activities at our national
labs are large and complex. The security professionals within
NNSA are working together today to reduce the opportunities for
error and react quickly to any problems that do occur.
Mr. Peterson. I am confident in our ability to continue to
grow and I look forward to the continued challenge.
That concludes my opening comments. I would be pleased to
answer any questions after other opening statements.
Mr. Stupak. Thank you, Mr. Peterson.
[The prepared statement of Mr. Peterson follows:]
[GRAPHIC] [TIFF OMITTED] T3238.039
[GRAPHIC] [TIFF OMITTED] T3238.040
[GRAPHIC] [TIFF OMITTED] T3238.041
[GRAPHIC] [TIFF OMITTED] T3238.042
[GRAPHIC] [TIFF OMITTED] T3238.043
[GRAPHIC] [TIFF OMITTED] T3238.044
[GRAPHIC] [TIFF OMITTED] T3238.045
[GRAPHIC] [TIFF OMITTED] T3238.046
[GRAPHIC] [TIFF OMITTED] T3238.047
[GRAPHIC] [TIFF OMITTED] T3238.048
[GRAPHIC] [TIFF OMITTED] T3238.049
[GRAPHIC] [TIFF OMITTED] T3238.050
[GRAPHIC] [TIFF OMITTED] T3238.051
[GRAPHIC] [TIFF OMITTED] T3238.052
[GRAPHIC] [TIFF OMITTED] T3238.053
Mr. Stupak. Mr. Pyke, let's start with you. We'll go right
down the line. And your opening statement, please, for 5
minutes. If you have a longer statement, it will be submitted
for the record.
STATEMENT OF THOMAS N. PYKE, JR., CHIEF INFORMATION OFFICER,
U.S. DEPARTMENT OF ENERGY
Mr. Pyke. Good afternoon, Chairman Stupak, Ranking Member
Shimkus, members of the subcommittee. My name is Tom Pyke. I am
Chief Information Officer of the Department of Energy.
Over the past 3 years the Department has undertaken a major
effort to improve its cyber security posture. DOE has a
comprehensive cyber security program that includes
establishment of DOE-wide policy, a senior-level governance
structure, cyber security awareness and specialized cyber
security training, improved cyber security incident management
and compliance monitoring.
The program is governed according to a cyber security
management order issued in December 2006. This order directs
the use of a risk-based approach to cyber security management,
and it establishes a governance structure within the Department
that assigns primary responsibility for implementation of cyber
security to the Under Secretary and other senior leaders. These
senior leaders determine and assess program-unique threats and
risks and they issue direction for implementing cyber security
within their respective organizations.
DOE-wide cyber security direction, including direction for
special protection of sensitive unclassified information,
builds on government-wide guidance from the Office of
Management and Budget as well as Federal information processing
standards and other cyber security guidance issued by the
National Institute of Standards and Technology. We also follow
applicable guidance issued by the Department of Defense.
Employing a risk-based approach, DOE senior management,
including NNSA, has given special attention during the past
year to the graded protection of DOE systems and data, taking
into account threat and risk and the sensitivity of the data.
Under our cyber security governance structure, each part of the
Department reviews the sensitivity of the data under its
jurisdiction relative to the strength of the controls that are
in place to protect the data and takes action to strengthen
those controls if needed.
The management of cyber security incidents is an integral
part of cyber security management, including providing timely
alerts to the entire Department of known threats, detecting
cyber attacks as they occur or as soon as possible afterward
and responding to such attacks. The response includes reporting
all cyber security incidents to the US-CERT, which is the
Federal Government's cyber incident handling center. It also
includes mitigating the potential adverse impact of each
incident at the site at which it was detected and elsewhere in
the complex, determining the impact of the incident and
repairing any damage or disruption resulting from the incident.
Cyber attacks are increasing in complexity and frequency
and are becoming more aggressive. DOE is attacked over 10
million times each day in a wide variety of ways, and DOE has
in-depth protection mechanisms in place throughout the complex.
Even with this protection, some of the most sophisticated
attacks against DOE have, on occasion, been able to penetrate
our unclassified systems and networks.
DOE has an in-depth cyber security defense based on
industry and government best practices. And we continually
improve our defenses, including our ability to detect attacks.
However, some cyber attacks continue to evolve to avoid
detection by these defenses.
Within the Department, the Office of the Chief Information
Officer and NNSA cooperate in the reporting of cyber incidents
and support tour sites as they handle each incident. The Office
of the CIO and NNSA have recently signed an agreement to
improve further the way we work together to respond to cyber
incidents. Our office also works in partnership with the
Department's Office of Intelligence and Counterintelligence as
we prepare for future cyber attacks and respond to them.
Counterintelligence data analysis associated with activities
that may have a foreign nexus provides useful input to the
cyber security incident management process led by the Office of
the CIO.
I would be pleased to respond to any questions you may
have, Mr. Chairman.
Mr. Stupak. Thank you, Mr. Pyke.
[The prepared statement of Mr. Pyke follows:]
[GRAPHIC] [TIFF OMITTED] T3238.054
[GRAPHIC] [TIFF OMITTED] T3238.055
[GRAPHIC] [TIFF OMITTED] T3238.056
[GRAPHIC] [TIFF OMITTED] T3238.057
Mr. Stupak. Dr. Wilbanks, your opening statement, please.
STATEMENT OF LINDA R. WILBANKS, PH.D., CHIEF INFORMATION
OFFICER, NATIONAL NUCLEAR SECURITY ADMINISTRATION, U.S.
DEPARTMENT OF ENERGY
Ms. Wilbanks. Chairman Stupak and members of the
subcommittee, I am Dr. Linda Wilbanks, Chief Information
Officer for the National Nuclear Security Administration. Thank
you for the opportunity to appear before you today regarding
the NNSA's cyber security program. As the CIO, I am responsible
to ensure the protection of electronic classified and
unclassified information.
The cyber threats to the Department of Energy and NNSA are
similar to those faced by the Federal Government, every public
and private enterprise, and every individual. NNSA's facilities
are targeted, over 1 million cyber attacks every day of varying
sophistication, ranging from relatively harmless curiosity
seekers to sophisticated hackers to corporate thieves and
national state and belief-based espionage.
In response to these threats, NNSA has established a robust
technical operational managerial-based approach to cyber
security of unclassified, controlled unclassified and
classified information. We believe our approach, which is
continually improving, is sound and provides effective security
for our unclassified and classified networks.
Even with a wide range of threats, I can say very
confidently that our classified networks, which protect our
crown jewels are extremely well protected. We operate separate
networks for our classified information, which are air-gapped
from our unclassified networks. We've implemented a diskless
workstation initiative across the complex to manage the
movement of data within the classified networks.
We also have a wide range of technical and administrative
controls to manage access to the data that resides on our
controlled unclassified networks, which, while not classified,
may include important information. This information requires
added protection, including encryption during transmission and
at rest, the use of two-factor authentication for remote
access.
We continue to assess other controls, collaborating with
our peers in government, leveraging the results of the
assessments to find even better ways to protect our
unclassified networks. Other defense and depth tools we use for
cyber protection are multiple firewalls and monitoring systems
to check for incoming, outgoing and internal unclassified
network traffic to ensure it is authorized and there are no
anomalies.
When our systems detect unusual activities, we quickly
terminate the communication pathways, and when necessary,
selectively isolate portions of our network to quarantine any
potentially harmful activities. Once a harmful activity is
isolated, we deploy our exceptional forensics capabilities to
eradicate the threat, restore the systems to secure operations.
Policy and standards are an important part of establishing
an effective cyber security program, and in May 2008 NNSA's
cyber security policy was issued, addressing many previous
recommendations and findings. This policy was developed in
collaboration with our sites, incorporates the recently issued
DOE National Security Manual and many of their requirements,
such as security plans and certification and accreditation
procedures have already been implemented.
We also have established strong and effective cyber
security incident response capabilities. The DOE and NNSA have
partnered to implement a state-of-the-art facility in Las
Vegas, Nevada. This facility monitors DOE and NNSA networks and
coordinates the response to incidents by utilizing extensive
communications and collaboration among DOE/NNSA sites, other
Federal agencies, law enforcements, intelligence, and
counterintelligence.
In summary, NNSA has a robust technical, operational and
management-based approach to cyber security of the
unclassified, the controlled unclassified and the classified
information. However, we acknowledge the need for continual
improvement. We believe our approach is fundamentally sound,
but the nature of the threat changes daily. We must keep pace
with the adversary and continue to improve the collaboration
between our sites, DOE counterintelligence and the cyber
security experts across the government and industry to succeed
in the future.
This concludes my opening statement. And I'm pleased to
answer questions at the end.
Mr. Stupak. Thank you.
[The statement of Ms. Wilbanks is included with the
statement of Mr. Peterson.]
Mr. Borgia, your opening statement, please.
STATEMENT OF STANLEY J. BORGIA, DEPUTY DIRECTOR FOR
COUNTERINTELLIGENCE, OFFICE OF INTELLIGENCE AND
COUNTERINTELLIGENCE, U.S. DEPARTMENT OF ENERGY
Mr. Borgia. Thank you, Mr. Chairman.
Mr. Stupak. You may want to pull that a little closer. It
doesn't pick up very well.
Mr. Borgia. Chairman Stupak, Ranking Member Shimkus and
distinguished members of the committee, thank you for the
invitation to appear before you on a subject of importance, the
cyber threat.
I'm addressing you today as the Deputy Director of
Counterintelligence in the Department of Energy's Office of
Intelligence and Counterintelligence. However, sir, I would
like to go just a little further in my introduction, because
there is a letter that is controversial, and explain to you
that I am also a Deputy Assistant Director in the FBI, assigned
by Director Mueller to the Secretary of Energy to run the
counterintelligence program. I have been here for over 2 years,
since July of 2006, and I will continue.
We and DOE counterintelligence are both a producer of
intelligence information and a consumer of intelligence
information. We develop and facilitate the transfer of DOE-
unique information to the United States Intelligence Community
and convey actionable Intelligence Community threat information
to all departmental action offices, including the National
Nuclear Security Administration, NNSA. We appreciate that
physical security is an essential element in the protection of
information, and we participate in the National Joint Terrorism
Task Force, National Counterterrorism Center, to enhance the
protection of DOE equities.
Likewise, we are a very active member of the FBI-led
National Cyber Investigative Joint Task Force, or NCIJTF, which
allows us to provide unique DOE and NNSA information to the
cyber investigations community and collaborate at national
initiatives. Membership also provides DOE with invaluable
current cyber-based threat information relevant to our
departmental assets and critical energy infrastructure.
DOE's Counterintelligence Office performs a broad range of
cyber-related functions, including analysis of cyber security
incidents with a foreign nexus. Our work is closely coordinated
with the DOE Office of the Chief Information Officer and the
NNSA's Office of the Chief Information Officer with which we've
maintained a strong and mutually supportive relationship in the
cyber security team.
The nature of the cyber threat to the DOE complex is
constantly evolving. DOE sensors, monitoring attacks on the DOE
networks, have picked up an increased tempo of potential
adversarial activity, including network reconnaissance,
scanning for potential attack vectors and outright cyber
attacks. In 3 of the past 6 months sensors have documented well
over 400 million such indicators of hostile activity every
month.
Further, we have seen thousands of socially engineered e-
mails. They may appear to come from known associates or support
an interesting subject line, but they contain malicious
computer code designed to infect the recipient's computer,
steal and transmit information it contains, and eventually
spread to the rest of the network. A single mouse click by a
single user can contaminate large numbers of networked
computers.
In order to generate counterintelligence investigative
leads from all this activity, I have directed expanded use of
cyber techniques at DOE and NNSA. The results have been
dramatic. In particular, cyber tools developed under this
initiative have enabled investigators at the intelligence and
military organizations to make strides toward attribution for
ongoing computer intrusions directed against DOE and other
United States Government computer networks, a major
accomplishment for DOE, that has demonstrated the value of
these cyber tools for CI analysis.
The counterintelligence cyber program has developed
professional working relationships with the Defense Information
Systems Agency, the Military Service Information Operation
Centers, the military service Criminal Investigation Divisions
and the Joint Information Operations Warfare Analysis Center in
San Antonio, Texas. These are comprehensive information-sharing
relationships as well as expanded partnerships for information
and cyber data exchange. They serve to increase awareness of
the operational methods being employed by individuals and
state-sponsored entities engaged in unauthorized computer
intrusions into DOE computer networks.
DOE in collaboration with the Intelligence Community
partners, DOE national laboratories, chief information officers
and DOE cyber security use data integration tools and intrusion
detection sensors to uncover, investigate and mitigate
suspicious cyber events with a foreign nexus.
In closing, Mr. Chairman, the attacks we see place
virtually every computer connected to the Internet at risk of
compromise, including those of the U.S. Government and our
critical energy infrastructure. Moreover, an attacker has a
significant advantage over the protect-and-defend cyber
security community. DOE's Office of Intelligence and
Counterintelligence will continue to pursue all available
lawful means to detect, investigate and mitigate the pervasive
cyber threats we as a nation now face.
Thank you, Mr. Chairman.
Mr. Stupak. Thank you.
[The prepared statement of Mr. Borgia follows:]
[GRAPHIC] [TIFF OMITTED] T3238.058
[GRAPHIC] [TIFF OMITTED] T3238.059
[GRAPHIC] [TIFF OMITTED] T3238.060
[GRAPHIC] [TIFF OMITTED] T3238.061
Mr. Stupak. Dr. Anastasio, please, for your opening.
STATEMENT OF MICHAEL R. ANASTASIO, PH.D., DIRECTOR, LOS ALAMOS
NATIONAL LABORATORY
Mr. Anastasio. Thank you, Mr. Chairman and Ranking Member
Shimkus. I'm Dr. Michael Anastasio, Director of the Los Alamos
National Laboratory. Thank you for the opportunity to discuss
the lab's continuing efforts to improve and sustain security.
For my first appearance before this subcommittee in January
of 2007, I clearly understood the message from the Members:
Continued security issues at Los Alamos were not going to be
tolerated. I'm pleased to report that at Los Alamos we now have
a record of successes in both physical security and cyber
security. We've taken concrete actions to reduce risk, clarify
policy, establish roles and responsibilities and develop
solutions to continuously improve the security posture at our
site.
These measures are working. Over the past year the
laboratory has reduced potential unauthorized disclosures of
information by two-thirds, and that number continues to
improve.
My written statement details our progress, but there are
three points I'd like to make here now. First, I am especially
proud that the improvements made at the laboratory link
directly to the actions and attitudes of our employees. Members
of our workforce have very little tolerance for any of their
coworkers who are not security conscience. The workforce
understands that the Nation must trust them to handle our most
sensitive secrets, and our actions have helped justify that
trust.
Second, the changes by the employees of Los Alamos have
been coupled with an aggressive security improvement program.
For example, we've reduced the number of vault-type rooms by
one-quarter. We've reduced our classified accountable,
removable electronic media from 12,000 items to fewer than
4,000. We've designed and opened the first supervault-type
rooms and are planning for more. We've converted 94 percent of
our targeted classified workstations to diskless operation.
We've destroyed more than 40,000 classified nuclear weapon
parts and more than 3 million pages of classified documents.
We're implementing a further segregation of our
unclassified cyber network that will provide foreign national
employees access only to the information that they require for
their jobs.
And, third, in anticipation of how the cyber threat will
continue to evolve, we're developing new approaches and
technologies so that we can get ahead of the game to better
protect our unclassified networks.
I'm encouraged that the three recent assessments in the
testimony we heard on the previous panel by our external
reviewers from GAO and HSS have validated our significant
progress. However, these reports also clearly demonstrate that
we need to make further improvements. I agree, and we're moving
aggressively to address them.
Continuous security improvement is essential, and nowhere
is this more evident than in cyber security. As I expressed in
my last appearance before you, the cyber threat remains my most
great concern. This is an ever-increasing, evolving threat from
adversaries who are relentless and technically skilled.
Protecting our classified resources is my highest priority, but
further securing our unclassified yellow network is essential.
This network is the backbone of our operation. It's crucial
that we develop solutions that manage risk and allow users to
access the information they need to do their jobs. One example
is something we call ``glove box computing.'' With this
technology, a user can access, create and manipulate
information, but has no ability to remove it, similar to how we
handle nuclear material.
The cyber threat is one faced by the entire Nation. It's
something that requires a coordinated national response using
our country's combined assets, skills and experience. The
unique cyber capabilities of the national laboratories can be a
valuable resource, building on the integration efforts that are
already under way among all three of our laboratories and with
NNSA and DOE.
In conclusion, Mr. Chairman, Los Alamos is making
significant progress improving our security posture, and we are
committed to continuous improvement to stay ahead of the
evolving threat. I would like to invite you and other members
of the committee to come visit the lab and see how we're doing.
And with that, I'll thank you and be ready to take your
questions.
[The prepared statement of Mr. Anastasio follows:]
[GRAPHIC] [TIFF OMITTED] T3238.062
[GRAPHIC] [TIFF OMITTED] T3238.063
[GRAPHIC] [TIFF OMITTED] T3238.064
[GRAPHIC] [TIFF OMITTED] T3238.065
[GRAPHIC] [TIFF OMITTED] T3238.066
[GRAPHIC] [TIFF OMITTED] T3238.067
[GRAPHIC] [TIFF OMITTED] T3238.068
[GRAPHIC] [TIFF OMITTED] T3238.069
[GRAPHIC] [TIFF OMITTED] T3238.070
[GRAPHIC] [TIFF OMITTED] T3238.071
[GRAPHIC] [TIFF OMITTED] T3238.072
[GRAPHIC] [TIFF OMITTED] T3238.073
[GRAPHIC] [TIFF OMITTED] T3238.074
[GRAPHIC] [TIFF OMITTED] T3238.075
[GRAPHIC] [TIFF OMITTED] T3238.076
[GRAPHIC] [TIFF OMITTED] T3238.077
[GRAPHIC] [TIFF OMITTED] T3238.078
[GRAPHIC] [TIFF OMITTED] T3238.079
[GRAPHIC] [TIFF OMITTED] T3238.080
[GRAPHIC] [TIFF OMITTED] T3238.081
[GRAPHIC] [TIFF OMITTED] T3238.082
[GRAPHIC] [TIFF OMITTED] T3238.083
[GRAPHIC] [TIFF OMITTED] T3238.084
[GRAPHIC] [TIFF OMITTED] T3238.085
[GRAPHIC] [TIFF OMITTED] T3238.086
Mr. Stupak. Well, thank you. And I know the staff was just
there, and unfortunately they didn't get a chance to meet with
you. But hopefully there will be another time, and hopefully
it's not when we're there looking at a lapse or something.
But I think we all know that there have been improvements
at Los Alamos.
Mr. Anastasio. Thank you. I appreciate that.
Mr. Stupak. Dr. Miller, your opening statement, please.
STATEMENT OF GEORGE H. MILLER, PH.D., DIRECTOR, LAWRENCE
LIVERMORE NATIONAL LAB
Dr. Miller. Mr. Chairman, members of the committee, thank
you for the opportunity to provide you my perspective on the
security challenges we face together.
As the director of a national security laboratory, I am
very familiar with the threats to our Nation and take very
seriously our special responsibilities to protect special
nuclear materials and some of the Nation's most sensitive
secrets. Safety and security are my highest priorities, and
they are integrated into a single culture at the laboratory.
Particularly in the cyber security area, threats are
rapidly evolving, continue to grow more sophisticated. My
approach involves anticipation, prevention, detection, response
and sustainment through continuous improvement.
The laboratory uses a variety of techniques to assess both
physical and cyber security, and they are an integral part of
our continuous improvement efforts. These include GAO audits,
ongoing site inspections by DOE's Office of Health Safety and
Security, local site surveys and our own self-assessments.
The HSS inspection this last spring was instrumental in
helping us identify deficiencies in our security readiness. In
summary, the HSS, as you have heard, found significant
weaknesses in two areas, protective force and classified matter
protection. We've made significant progress in addressing these
inspection findings.
I led a thorough review of our actions and decisions to
identify the root cause of what was an unacceptable decline in
our protective force's level of posture demonstrated just 16
months earlier. I'm pleased to report that these actions have
significantly improved the readiness of our protective force as
demonstrated through a security incident response of a fully
integrated force-on-force with an external adversary just 8
weeks ago. This exercise was monitored both by NNSA and HSS,
and the Office of the Chief of Defense Nuclear Security
concluded that the lab's effort has resulted in a posture of
robust protection. Let me tell you how we achieved this.
In short, our analysis revealed that restrictions on and
postponement of comprehensive robust exercises due to safety
considerations had a detrimental effect on the protective force
readiness. We have addressed those safety issues and resumed
frequent exercises while ensuring the safety of our employees.
My written testimony details some of these corrective actions.
I'm committed to sustaining that performance and that level of
progress, and we have scheduled future robust exercises
quarterly to ensure that.
I believe that maintaining adequate cyber security requires
constant attention, utilizing counterintelligence experts and
information technology professionals to anticipate, develop and
deploy effective defensive systems and quickly respond to
emerging threats to assure appropriate protection.
Over the last 2 decades Livermore has hosted and staffed
the Department of Energy's computer incident advisory
capability. This staff of highly trained computer scientists
have provided support for the entire complex with forward-
looking cyber analysis assessments, best practices and
training. In this regard, HSS concluded that the lab faces
significant challenges in this area, but has the teams,
technologies and methods needed for success to effectively
deliver and address cyber security.
Protecting classified information from compromise is my
highest priority. That's why our classified network is air-
gapped from the rest of the laboratory.
We also maintain a separate unclassified network to handle
our unclassified and our business information. Within this
yellow network, different functions are segregated and
isolated. It is used for programmatic activities that are
essential for the laboratory.
These functions require external communication. It is,
therefore, connected to the Internet. But it is protected by a
firewall. And again, as I said, within that network it is
segregated--different functions are segregated. Constant daily
vigilance is required to protect the network, and we use a
comprehensive site-wide risk assessment methodology along with
shared information from my colleagues at the other laboratories
and across the Federal Government to focus our cyber security
efforts on emerging threats.
As an element of our continuous improvement, the lab has
developed a blue network to provide appropriate computer access
for essential mission work by the lab's foreign nationals and
our external collaborators. Technical controls separate that
from the yellow network.
As another example of our continuous improvement and
further segmentation of important data, last year I invested in
the building of and the commissioning of a consolidated data
center for unclassified data. This provides uniform physical
protection, appropriate backup, enhanced reliability and, most
important, state-of-the-art cyber protection.
In conclusion, Mr. Chairman, taking personal and collective
responsibility for safety and security is a fundamental value
of the laboratory and an expectation of all employees. I can
assure you that I am committed to provide the security that you
and your colleagues expect from Lawrence Livermore Laboratory.
I appreciate the opportunity to testify and welcome your
questions.
Mr. Stupak. Thank you, Dr. Miller.
[The prepared statement of Dr. Miller follows:]
Statement of George H. Miller
Opening Remarks
Mr. Chairman and Members of the Committee, thank you for
the opportunity to provide my perspective on the security
challenges facing the Lawrence Livermore National Laboratory
(LLNL) and the other NNSA laboratories. I am George Miller,
Director of LLNL and President of Lawrence Livermore National
Security (LLNS), which has been managing the Laboratory for
almost one year. I started at LLNL in 1972 as a research
physicist in the nuclear weapons program. In my career I have
had responsibilities at every level of management at LLNL. As a
national security laboratory, we are very familiar with the
threats to our nation and take very seriously the special
responsibilities entrusted to us to protect special nuclear
materials (SNM) and some of the nation's most sensitive
secrets. Particularly in the cyber area, threats are rapidly
evolving and continue to grow more sophisticated. Vigilance and
continuous improvement are required.
The Laboratory's approach to both physical and cyber
security employs a multi-layered, defense-in-depth strategy
with opportunities for regular feedback, assessment, and
improvement. This process draws on both internal and external
assessments and I will report on the aggressive actions LLNL is
taking to continue to strengthen both physical and cyber
security. Recently, DOE's Office of Health, Safety, and
Security (HSS) conducted an inspection of LLNL Safeguards and
Security and Cyber Security, and found areas of effective
performance, areas needing improvement, and some areas of
significant weakness. We took immediate action to respond to
these findings and have made significant progress. Recently the
NNSA Office of the Chief of Defense Nuclear Security stated
that improvements made in LLNL Protective Force response
capabilities since the HSS inspection ``have resulted in a
robust protection strategy.'' In the area of cyber security,
the HSS report concluded that the Laboratory faces challenges
but ``.has the teams, technologies, and methods needed for
success to effectively address cyber security program needs.''
We are drawing on those capabilities to expeditiously make
necessary improvements.
Laboratory Security and the Recent HSS Inspection
I can assure you that LLNL is committed to the safe and
secure fulfillment of its mission responsibilities. The
Laboratory takes an integrated approach to safety and security
with a commitment to continuous improvement. Safety and
security are the most important considerations in day-to-day
operations. A fundamental value of the Laboratory is for all
employees to take personal and collective responsibility for
providing for a safe and secure work environment.
An extensive security infrastructure is in place at the
Laboratory, and continual improvements are made to address new
threats and arising concerns. LLNL uses a defense-in-depth
approach to physical security that includes fences, buildings,
doors, repositories, and vaults with various levels of access
control in addition to aggressive armed defense and response
capabilities protecting the Superblock Facility, the special
area where work with SNM is conducted.
Cyber security is a growing and rapidly evolving defense
challenge for all government entities, including the NNSA
laboratories. Cyber attacks are a serious national security
threat that require interagency attention, cooperation, and
investment to improve protection. Recognizing the public trust
placed in the Laboratory to protect some of the nation's most
sensitive secrets, LLNL takes its cyber security
responsibilities very seriously. The Laboratory employs an
integrated management approach to protect its cyber resources
in an ever changing threat environment. LLNL leverages
expertise in security management, counterintelligence, and
information technology to identify and quickly respond to
emerging threats and proactively develop and deploy protective
measures. Most importantly, classified information at LLNL is
secure. It is confined to networks that are isolated and
segmented to ensure need-to-know access and well protected by
technical processes that provide both system and information
security.
Unclassified computing at LLNL is separated into
individually protected, NNSA accredited, network segments that
include a Green network, a Yellow network, and a new Blue
network. Through the use of firewalls, authorization codes, and
other means of security, this segmentation allows for greater
control and increasing levels of hardware and data protection
depending on the types of data and applications that are on
each of the networks. The Yellow network, which is subsequently
discussed in more detail, is the main unclassified network for
desktop computers, applications and databases, unclassified
programmatic activities, internal communications, and business
services. Employees receive and send email, fill out their time
card, do their on-line training, work on technical data and
information, and access benefits and other employment
information on this network. It does contain sensitive
unclassified information such as business proprietary and
personnel information that is segregated within the Yellow
network with additional access controls. The Yellow network is
restricted to Laboratory employees and collaborators. Connected
to the Internet, this network is protected by a robust firewall
and network segments that must be diligently maintained in the
face of ever more sophisticated threats.
The Blue network has recently been piloted and is now
approved for expansion. Its purpose is to provide controlled
access to assets necessary for our foreign national employees
and collaborators to do their work, but at the same time
restrict their access to resources on the Yellow network. The
Green network is lightly firewalled and provides public access
to general LLNL information including job postings.
The Laboratory utilizes a variety of tools to continually
assess and test both physical and cyber security. These include
Government Accountability Office (GAO) audits, on-site
inspections by DOE's HSS, local NNSA site office surveys, self-
assessments, risk assessments, vulnerability scanning, and
system testing conducted by the LLNL cyber security program.
These assessments provide valuable input and are an integral
component of LLNL's continuous improvement process to sustain
the Laboratory's security in an evolving threat environment.
In early March 2008, DOE HSS initiated an inspection of
LLNL Safeguards and Security and Cyber Security. Over a six-
week period, 86 auditors participated in a comprehensive
evaluation of eight security elements. The inspection was
conducted with a high level of professionalism. For example,
the composite adversary team that conducted the force-on-force
exercise was very experienced and innovative in their approach,
and they conducted the force-on-force exercise in a manner to
test LLNL's Superblock Facility security posture to specific
criteria. We value the approach taken by HSS in all facets of
its inspection and the receipt of in-depth feedback to improve
our security posture.
In summary, the HHS inspection found LLNL to have effective
performance in Classification and Information Control,
Personnel Security, and Material Control and Accountability.
HSS found that the Laboratory needed improvement in Physical
Security Systems, Protection Program Management, and certain
aspects of Cyber Security not related to technical controls.
HSS found significant weakness in LLNL's Protective Force and
its Classified Matter Protection and Control.
The Laboratory took immediate steps to address weaknesses
identified in the HSS inspection. In addition, LLNL developed a
comprehensive set of corrective action plans. HSS reviewed the
Laboratory's draft corrective action plans and HSS comments
have been incorporated into the plans. These draft plans
contain 254 milestones to correct and sustain LLNL's progress
toward ensuring a long-term, strengthened security posture.
Aggressive efforts to sustain NNSA site security compliance
requirements have resulted in the completion of one-third of
the milestones to date.
The results of the HSS force-on-force exercise were
disappointing to me and my team. The Laboratory's Protective
Force had performed well in the prior HSS force-on-force
exercise only 16 months earlier (December 2006), and I was
determined to identify the root cause leading to the decline in
the Laboratory's Protective Force readiness. I immediately
ordered a thorough review of our actions and decision making to
identify and correct the root cause. In short, the analysis
revealed that restrictions on and postponements of robust
exercises had a detrimental effect on Protective Force
readiness as well as our ability to conduct the full-scale
exercises that are necessary to appropriately practice team
tactics and fully assess performance. The lack of a robust
exercise environment inhibited the Laboratory's ability to
obtain the necessary feedback to assess our performance.
Safety considerations and attrition in LLNL's Protective
Force were some of the most influential factors that placed
limitations on exercises. For example, the Laboratory's
initiative in 2006 to improve ladder safety practices resulted
in the suspension of force-on-force exercises on the roofs in
the Superblock. In addition, NNSA's prohibition on the use of
smoke due to health concerns prevented us from utilizing this
tool in our training. Other concerns regarding Superblock
employee health and safety further restricted the ability of
our Protective Force officers to engage in realistic exercises
inside Superblock facilities.
Another contributing factor was attrition in the
Laboratory's Protective Force, which has averaged about 10
percent per annum, FY 2006 through FY 2008. Force-on-force
exercises in the Superblock are labor intensive, requiring
sufficient Protective Force personnel to participate in
defensive and offensive teams, help conduct the exercise, and
to provide a stand-alone force to protect the area during the
exercise. With high attrition and a two-year training regiment
for new officers, shortfalls in staffing required careful
workload balancing and significant overtime to provide defense,
train, and exercise.
The limitations emanating from these considerations
resulted in Protective Force exercises that were insufficient
in scope and degree of realism to identify weaknesses in
equipment performance and team tactics.
We took actions to address this root cause. First, we
devoted special attention to expeditiously resolve safety
concerns by, for example, marking and providing guide
structures on roofs for safe access and providing ventilation
within hallways so that blank ammunition can be used. Once we
resolved these concerns, we resumed robust exercises in the
Superblock, and will conduct robust force-on-force exercises on
a quarterly basis. Second, we reinvigorated our physical
security self-assessment program and assigned a seasoned
security professional to a newly created position as the
Security Organization Program Performance Assurance Manager.
Finally, we took away valuable lessons from each of the factors
that contributed to decisions that had self-limited exercises
and assessments.
We have applied the lessons learned from all facets of the
HSS inspection. Working closely with NNSA and utilizing
expertise accessible through reachback to LLNS parent
organizations, LLNL has significantly strengthened its security
posture over the last several months. Highlights are discussed
below in the areas of Protective Force, Classified Matter
Protection and Control, and Cyber Security. In addition, the
Laboratory has implemented management changes to clarify roles
and responsibilities through an integrated chain of command
that incorporates expertise in SNM research, safety, and
security. Vulnerability assessments are being updated to
include the recent protective force, physical security, and
cyber security enhancements.
Protective Force Improvements
LLNL has implemented improvements to its manpower
deployment and training, to its defensive equipment, to its
command and control systems, and continues to implement
improvements to its hardened fighting positions in the
Superblock. These improvements were guided in part by the
lessons learned during a period of intensive activity in May
and June 2008 when over 25 scrimmages, limited-scope
performance tests, and 12 force-on-force exercises against a
variety of adversary teams were conducted in the Superblock
Facility exercising all LLNL Protective Force shifts. The
Laboratory's integrated plan ensures a high-quality training
environment with the appropriate equipment resources to
continually challenge and test the responsiveness of its
Protective Force. LLNL has implemented Protective Force
improvements in four areas: Personnel, Equipment, Team Tactics,
and Training Environment.
Personnel. The HSS Inspection found that LLNL's Protective
Force security officers were individually well trained and
capable as demonstrated by their high test scores. This is due
in part to LLNL adopting the newly proposed Tactical Response
Force (TRF) Standards as part of its training. LLNL is
currently the only site in the complex to qualify all of its
Level 2 and 3 Protective Force officers in this weapons and
physical fitness proficiency standard.
Lessons learned from HSS force-on-force exercise, and the
subsequent force-on-force exercises, resulted in the addition
of Protective Force officers in the Superblock Facility on each
shift, and the addition of a Sergeant to each shift to engage
exclusively in Command and Control. Both of these actions have
been completed and are incorporated into the Security Incident
Response Plan (SIRP).
Equipment. LLNL utilizes Dillon gatling guns, integrated
into Mobile Weapon Platforms (MWP), as part of the security
posture for the Superblock Facility. Since the HSS inspection,
LLNL has developed a robust security incident response plan
that utilizes a MWP deployment strategy that does not rely upon
all vehicles being deployed at all times. This plan allows LLNL
to deploy some or all of the vehicles and maintains a high
level of protection by augmenting and re-deploying forces
within the Superblock in towers, bullet-resistant enclosures,
hardened-fighting positions, or as ground-based strike teams.
Consequently, this plan protects the SNM and provides for
cycling vehicles out of the Superblock Facility for necessary
vehicle service, vehicles to conduct training, and the ability
to upgrade vehicle systems without degrading LLNL's protection
effectiveness. In addition, it forces an adversary to develop a
plan and commit resources to address multiple protection
strategies-a much bigger task for an adversary than would be
required to deal with a static protection configuration.
We have upgraded the defensive equipment used by our
officers to protect the Superblock including improvements to
the MWP that mitigate maintenance and reliability issues. In
addition, the operability of the MWPs is verified each shift.
Team Tactics. Daily and nightly training began and has
continued since April to ensure effective implementation of the
SIRP and verify compliance of the Protective Force officers
with it. These training exercises and Limited Scope Performance
Tests involve individual, small unit, and full team movement
and tactics. Refinements to command and control protocols have
been developed based on these exercises, as well as actions to
address security officer vulnerabilities identified during the
exercises.
Training Environment. In order to facilitate more realistic
training, LLNL engages in force-on-force activities in the
Superblock Facility and indoors with realistic Multiple
Integrated Laser Engagement System (MILES) gear on a routine
basis. During the first week of August 2008, a fully integrated
force-on-force exercise was conducted by an adversary force
from Idaho National Laboratory. This force-on-force exercise
was attended by representatives of the Office of the Chief of
Defense Nuclear Security, NNSA Field Security professionals,
and observers from DOE HSS. The force-on-force exercises were
particularly challenging, designed to test the changes to our
SIRP and the additional training of our security force. LLNL's
security incident response was very successful. The Office of
the Chief of Defense Nuclear Security asserts, ``The results of
the exercises demonstrate that activities completed as part of
the site recovery plans, along with the planned configuration,
have resulted in a robust protection strategy.''
Improvements in Physical Security Systems and Classified Material
Protection & Control
LLNL's security construct is based on a series of defensive
layers-a graded approach that provides increasing barriers that
correspond to the increasing security value of critical
Laboratory assets. Classified information resides in
``limited'' areas and is stored in repositories and/or vault-
type rooms (VTRs). Some of LLNL's VTRs were found to be
deficient in sensor protection by the HSS inspection, and the
necessary additional sensors were immediately installed.
In addition to enhancing the VTRs, LLNL formalized roles
and responsibilities, and improved VTR configuration
management. The Laboratory is consolidating databases that
document the location of classified repositories into a master
database and has established a policy and verification
procedures for configuration control of classified repositories
and VTRs. In addition, procedures for logging and inventory of
failed classified computer hard drives now address concerns
raised by the HSS inspection. LLNL has upgraded the lighting
and video coverage in the Superblock.
Cyber Security Improvements
As an integral component of LLNL's security organization,
the Laboratory's cyber security program proactively develops
and deploys effective defensive systems and quickly responds to
emerging threats to ensure appropriate protection. The cyber
security program takes an integrated approach, strongly
engaging counterintelligence experts and information technology
professionals. The Laboratory has established centralized
policies and procedures for managing cyber security, and it has
in place many effective technical processes and tools for
providing protection. These include perimeter and internal
firewalls, vulnerability scanning, and intrusion detection
systems. In addition, the Laboratory has developed and utilizes
an effective system for user identification, authentication,
and access control to enforce security standards and ensure
appropriate configuration management of software and hardware
systems.
The HSS inspection rated LLNL's cyber security technical
controls ``effective'' and found that the cyber security
program ``has taken an aggressive stance to ensure that when
issues are recognized, corrective action plans and plans of
action and milestones are developed.'' In response to
deficiencies identified in the HSS report, LLNL is
strengthening its cyber security controls for planning,
acquisition, certification, and accreditation of systems to
reduce overall risk. The Laboratory is updating its cyber
security plans to reflect the most up-to-date directives and
include more detailed operational protocols in order to better
test, certify, and accredit systems.
Classified information at LLNL resides on separate networks
for Secret/Restricted Data and Secret/National Security
Information, a practice HSS found ``commendable.'' Their report
concludes that, ``Strong identification and authentication
controls for access to applications and effective segmentation
to ensure need-to-know boundaries, as well as effective
vulnerability scanning and patching, are key factors in the
classified environment being almost totally devoid of
vulnerabilities.''
As mentioned earlier, the Yellow network at the Laboratory
is the main unclassified network for desktop computers,
applications, and databases. This network contains access-
controlled sensitive unclassified information that is required
by most Laboratory employees and collaborators to conduct their
mission responsibilities. It is the backbone for unclassified
programmatic activities, internal communications, and all
business services. Laboratory research, business functions, and
operations require external communications; hence, the Yellow
network is connected to the Internet and protected by a
firewall and network segments.
Vigilance is required to protect Yellow network systems and
data. LLNL first completed a comprehensive sitewide
unclassified risk assessment in 2005. Updated annually and as
new risks are identified, the assessment includes an analysis
of systemic conditions and threats, probabilities of
occurrence, and impact. Consideration of the risks guides
strategies for vulnerability scanning and patching as well as
the implementation of additional measures to limit inward and
outward flows through the firewall. The Laboratory is working
to fully implement effective risk management processes to
identify risks at the system-specific level.
One notable step LLNL is taking to minimize risks is the
development of a Blue network. To be used by foreign nationals
whose collaboration is necessary for LLNL to meet mission
responsibilities, the network was established to provide even
greater assurance that access restrictions to LLNL information
systems are enforced based on need-to-know. The Blue network
segment is separated from the Yellow network through technical
controls. Users have access only to approved resources on the
Yellow network and that access is only permitted with controls
enforced by firewall policy. This prevents foreign nationals
from having the ability to ``knock on doors'' and gain access
to Yellow network resources on an uncontrolled basis. They are
not able to search the Yellow network or monitor activities on
it. The Blue network is being piloted in one of the
Laboratory's directorates and is planned for site-wide
implementation in Fiscal Year 2009.
Closing Remarks
The Laboratory requires annual training for every LLNL
employee to ensure that each understands the importance of
protecting the classified information and materials at the
Laboratory and their individual and collective security
responsibilities. Security is an obligation that we take
extremely seriously. The adversarial threats we face are
growing more sophisticated and defense requires vigilance. When
deficiencies are uncovered or an emerging threat is identified,
we act as promptly and effectively as we can to fix the
specifically identified issue as well as address the root
causes. That is why the Office of the Chief of Defense Nuclear
Security was able to assert that LLNL's concerted efforts
``.have resulted in a robust protection strategy'' after
shortcomings were uncovered by HSS only several months earlier.
I have confidence in LLNL's Protective Force and the
effectiveness of the Security Incident Response Plan.
Cyber security is a challenge facing all government
entities, including LLNL. I agree with the HSS report that
concluded ``the laboratory has the teams, technologies, and
methods needed for success to effectively address cyber
security program needs.'' LLNL welcomes the opportunity to
share some of the lessons we have learned-and to learn from
others-through broader, more concerted, and effectively-
integrated DOE and interagency efforts to cope with this very
serious national security threat.
Lawrence Livermore National Laboratory's Security Posture-Summary
(Attachment)
Lawrence Livermore National Laboratory (LLNL) is committed
to the safe and secure fulfillment of its mission
responsibilities. A fundamental LLNL value is that all
employees must take personal and collective responsibility for
providing for a safe and secure work environment. An extensive
security structure is in place at LLNL, and we are taking
aggressive actions to address arising security threats and
concerns. Particularly, in the cyber area, threats are rapidly
evolving, continuing to grow more sophisticated and vigilance
is required.
The Laboratory benefits from both internal and external
assessments to identify weakness and areas for improvement.
Recently, DOE's Office of Health, Safety, and Security (HSS)
held an inspection of LLNL Safeguards and Security and Cyber
Security that provided valuable feedback. We took immediate
steps to address the identified weaknesses. We conducted a
thorough review to identify the root cause of the disappointing
results of the force-on-force exercise and took corrective
actions. Restrictions on and postponements of robust exercises
had a detrimental effect on Protective Force readiness and
inhibited the Laboratory's ability to obtain essential feedback
on our performance. We resumed the conduct of realistic force-
on-force exercises in the Superblock, and we will conduct
future comprehensive force-on-force exercises on a quarterly
basis. We have also upgraded the defensive equipment used in
the Superblock. Following a fully integrated force-on-force
exercise in August 2008, the NNSA Office of the Chief of
Defense Nuclear Security, improvements made in LLNL Protective
Force response capabilities ``have resulted in a robust
protection strategy.''
In the area of cyber security, the HSS report concluded
that ``the classified environment [at LLNL is] almost totally
void of vulnerabilities.'' LLNL's (unclassified) Yellow network
faces challenges, but it is well protected and the HSS report
states that LLNL ``has the teams, technologies, and methods
needed for success to effectively address cyber security
program needs.'' We are drawing on those capabilities to
expeditiously make improvements, including the development of a
new Blue network for use by foreign national employees and
collaborators.
----------
Mr. Stupak. Dr. Hunter, your opening statement, please,
sir.
Dr. Hunter. Thank you, Mr. Chairman.
Mr. Stupak. You're going to need the mic there. Thanks.
STATEMENT OF THOMAS O. HUNTER, PH.D., PRESIDENT AND
LABORATORIES DIRECTOR, SANDIA NATIONAL LABORATORIES
Dr. Hunter. Thank you, Mr. Chairman, Ranking Member and
distinguished members of the committee. I am Tom Hunter,
President of Sandia Corporation and Director of Sandia National
Laboratories. It's a pleasure to appear before you and talk
about this extremely important matter.
Sandia, as you know, is a national security laboratory and
part of the NNSA; and we develop and support the nonnuclear
parts of the nuclear term, but we also are, further, involved
in research and development across a wide range of national
security areas. I provided written testimony at some length,
but I would like to emphasize just a few points.
First, I would like to talk about our commitment and my
personal commitment to security.
We can only serve the Nation in so many sensitive areas,
and we do place security at the very top of our value system. I
should also be clear that I do not support the view that
science in our world and security should be in conflict or can
be in conflict. I believe that science in the national interest
must embrace effective security.
It is a matter of great personal pride that the Nation has
entrusted us with this most sensitive information. I and my
entire organization are committed to always honor that trust.
We can all live up to our security responsibilities if we're
ever vigilant and constantly aware of the threat facing us and
any vulnerability that may occur. We have decades of experience
evaluating the threats to our nuclear deterrent, and we've
applied that experience to the cyber world as well.
The second point I would like to make is, this Nation's
made a great investment in its classification system, both of
information and materials. We see great value in that system
and we use it as the foundation, the very core, of our security
systems. And this allows us to place the most emphasis on our
security systems in the right places where there's the most
sensitivity.
We believe we have made great progress in the last few
years in our protective systems for physical security. We've
reduced our vulnerability to attack by limiting all discrete
Category I and Category II nuclear material at our site. We did
that just recently and ahead of schedule.
Last year we received the highest possible rating on all
seven major areas of physical security in the evaluation done
by DOE's Office of Independent Oversight. Yet we do not
believe, and it's my strong conviction, that we can rest on any
of our accomplishments. The challenge will always be greater
and our expectation will always be higher.
We're acutely aware of the threat of malicious insiders and
have an active counterintelligence program and one that is
acknowledged to be uniquely effective because of the strong
integration we have because of counterintelligence and our
cyber and physical security programs.
As the committee has so well noted, there is one area,
though, that we, like the majority of the Nation's
institutions, must be even more vigilant. We are part, and a
fundamental part, of the Nation's cyber system. We find that
modern information systems are essential to manage and operate
an enterprise such as ours. But with this great enabler comes a
great risk.
There have rarely been threats to the very core of our
Nation's infrastructure as pervasive and as asymmetrical as a
cyber threat. We have acted aggressively to address the cyber
threat. We have three separate networks for cyber information.
Each system has been uniquely designed for the security
provisions of the information there. All are controlled and
monitored centrally by the laboratory.
When I sign on to my personal computer, it reminds me every
time, like every employee, that I will be subject to
observation and should expect no privacy from our monitoring
systems. We block over 80 percent of our incoming e-mail. We
save and evaluate all cyber traffic at the laboratory by expert
and electronic means. If any user on our system does not
conform to our security requirements, we'll promptly terminate
access from the system.
We maintain a complete registration of all devices on our
system, deploy encryption for sensitive transmissions and
require common operating environment for all desktops. Each
network is subdivided into segments that have separate
monitoring and separate need-to-know protection.
We have close ties with the other institutions in the
Federal Government and the other laboratories in the DOE. When
an attack occurs, there is a direct and effective communication
between Sandia, other laboratories and the DOE.
Finally, I would like to close my comments with emphasis on
one point that I think is most central to the path forward for
the cyber-secure world of the future, and that's people. I've
had the opportunity to witness the dedicated professionals who
defend our cyber systems. I've come to admire and respect their
talent, their expertise and their dedication. Each day--and in
most cases, very long days--they face an adversary that is more
creative and better equipped than the day before. And any day
they may be called upon to scan enormous files and spot
anomalies that could easily allude most trained observers. They
may be called on to go to another laboratory to help sort out
an ongoing attack.
Why do they do it? It is not a matter of compliance. It is
not a matter of administrative requirement. It is not even a
matter of compensation or reward. And it's certainly not
because they could not work anyplace else. It is, in my
judgment, because they are individually committed to serve this
country, to defeat this pervasive threat.
I'm thankful each day they're there with us, and I believe
they're examples of the country's principal hope in the coming
escalation of cyber attacks--talented people surrounded by
talented people and equipped with unique experiences and assets
who devote their careers to this conflict. If we could do only
one thing in the whole world of cyber security, it will be to
apply our Nation's best minds to the problem, train them, hire
them, support them, and empower them.
And I now urge the committee, with all of us, to do
whatever we can to help create an environment where these
people have the opportunity to commit, to excel and to prevail.
Thank you, Mr. Chairman; and I would be pleased to answer
any questions.
Mr. Stupak. Thank you, Dr. Hunter.
[The prepared statement of Dr. Hunter follows:]
[GRAPHIC] [TIFF OMITTED] T3238.087
[GRAPHIC] [TIFF OMITTED] T3238.088
[GRAPHIC] [TIFF OMITTED] T3238.089
[GRAPHIC] [TIFF OMITTED] T3238.090
[GRAPHIC] [TIFF OMITTED] T3238.091
[GRAPHIC] [TIFF OMITTED] T3238.092
[GRAPHIC] [TIFF OMITTED] T3238.093
[GRAPHIC] [TIFF OMITTED] T3238.094
[GRAPHIC] [TIFF OMITTED] T3238.095
[GRAPHIC] [TIFF OMITTED] T3238.096
[GRAPHIC] [TIFF OMITTED] T3238.097
[GRAPHIC] [TIFF OMITTED] T3238.098
[GRAPHIC] [TIFF OMITTED] T3238.099
[GRAPHIC] [TIFF OMITTED] T3238.100
Mr. Stupak. That concludes the opening statements. We'll go
to questions. We're going to go 10 minutes.
I think we'll have votes coming up; maybe we can get our
questions in before that.
Dr. Anastasio, if I may, GAO testified on the first panel
that Los Alamos pulled the access to foreign nationals to the
yellow network. Is that correct?
Mr. Anastasio. No, that's not correct.
Mr. Stupak. It's not?
Mr. Anastasio. Foreign nationals do have access to our
yellow network.
But we have a number of protections in place to ensure that
proper care is taken. We do counterintelligence assessment of
every individual. We have security plans and a very significant
process we go through.
Mr. Stupak. Do you have encryption on some of the more
sensitive parts that are on your yellow?
Mr. Anastasio. We have some encryption on the more
sensitive parts that are on the yellow network, and we have
segmentation that we've put in place and we're further
proceeding with that.
Mr. Stupak. All right.
Dr. Miller, do foreign nationals have access to the yellow
information? The yellow network, I'm sorry.
Dr. Miller. Yes, sir. Just like Dr. Anastasio, we currently
do have foreign nationals on our network. As I indicated in my
testimony, we are in the process of creating another network.
It was just--we did a pilot last year. It was just credited by
NNSA about a week ago. So this fiscal year we will be creating
a separate network for all of our foreign nationals that is
separate from the yellow network.
Mr. Stupak. All right. Would some of the information on
your yellow network go on this new network you're--
Dr. Miller. Yes, sir. I mean, for instance, all of the
training requirements that are completely unclassified are
required by--the foreign nationals require access to the
training requirements. So the training courses, things like
that that they require access to, will be on the blue network.
So there will be some information that is transmitted.
Mr. Stupak. Dr. Hunter, how about yourself, the foreign
nationals on your yellow network?
Dr. Hunter. On our yellow network we have about 11 foreign
nationals that have some access in the appropriate areas, but
none are from sensitive countries and I think the DOE
requirement for the future is about sensitive countries.
Mr. Stupak. Let me ask this question, if I may--Dr.
Wilbanks, if I may.
The Director of Los Alamos noted in his opening statement
that cyber threat is the greatest security concern. Would you
agree that this is perhaps the greatest security concern facing
DOE labs at this point in time?
Ms. Wilbanks. I can only speak from the cyber perspective.
But, yes, sir, I would agree that it's a very high threat.
Mr. Stupak. Well, let me ask you--to point that to the
point that you can in open session here--what's the level of
sophistication of these attacks? Are they increasing in
capability?
Ms. Wilbanks. Yes, sir. I would be happy to elaborate in a
closed session, sir.
Mr. Stupak. Mr. Borgia, Ms. DeGette asked the question
earlier--let me ask you this if I can.
Has a full inventory of the information residing on the
unclassified networks of DOE national labs been inventoried?
Mr. Borgia. No, not that I know of.
Mr. Stupak. The other panel didn't necessarily think it was
necessarily a wise choice. Do you it would be?
Mr. Borgia. I think that I would defer to that answer.
I think the most important thing to do with this
information is to be able to stop the intrusion, if it's
possible. But to be able to catalog that information would be--
that would be a tremendous library of cataloging we would be
responsible for doing in the Department, and it would be
overwhelming.
Mr. Stupak. Let me ask you this question, if I may.
You testified that your work is closely coordinated with
DOE's Office of Chief Information Officer and NNSA's Office of
Chief Information Officer, and that you maintain strong,
mutually supportive relationships in the cyber security. Yet
for the past 3 years the Office of Inspector General has
reported that the Department has failed to adequately address
cyber security coordination and communication.
From a counterintelligence point of view, are you satisfied
with the coordination and communication between the
Counterintelligence and Information Technology Divisions in the
DOE complex regarding the reporting of cyber incidents? And
what, if anything, can be done to improve coordination and
communication?
Mr. Borgia. Yes. Thank you, Mr. Chairman.
I would have to say the answer to that is yes. There has
been a substantial increase in the communication between my
office and the chief information officers in cyber security.
We--in the 2 years I've been here, we've had increasing contact
with these offices--daily contact, weekly meetings, sometimes
twice weekly meetings where we sit down and review matters of
classified concern.
And there is continuing contact at the executive levels in
each of these offices too. Dr. Wilbanks and Mr. Pyke and myself
and their executive management staffs and mine are very, very
familiar with one another, and we talk very frequently.
Mr. Stupak. Let me ask this question, if you can answer it
or if we have to go to a closed session, just let me know.
Mr. Podonsky and his group said they're not very
sophisticated in cyber security, but yet they're able to get in
with his Red Team and take control of--I don't want to say take
``control,'' but have pretty good access in two science labs.
And everyone is telling me today it is more sophisticated. It's
a great concern.
Is it possible that there have been breaches of our cyber
security that we don't know about? Is the sophistication--the
level of sophistication--in other words, like when I play
basketball, are you above the rim or not?
I'm below the rim, believe me. But are there teams above
that rim that we possibly don't even know about?
Mr. Borgia. Yes.
Mr. Stupak. OK. I have more questions, but I'm going to ask
those in closed session on that aspect of it.
Let me ask this. We've talked a little bit about this
yellow network. And let me--in light of that answer, Mr.
Borgia, what is NNSA's opinion on the network access that's
been provided to foreign nationals? What control does, like,
let's say, Los Alamos have in place to ensure that foreign
nationals have a need-to-know for the access they have been
provided with on the network?
Mr. Borgia. Sir, perhaps the lab director or NNSA would be
better to answer that question.
Mr. Stupak. OK.
Dr. Wilbanks, do you want to add anything to that question?
Ms. Wilbanks. The labs have done a great job in segregating
various components within their yellow network that allows
their foreign nationals on there.
Excuse me. As you heard, Lawrence Livermore is building a
separate network for the foreign nationals. They take great
strides to limit the access of the foreign nationals to
specific areas of information, and then to limit their access
within the network itself.
Mr. Stupak. My concern--I guess I brought it up earlier in
the first panel--was that mosaic approach. You take something
that doesn't seem real sensitive. It's on the yellow. So I take
a piece here, take a piece there, put it together, does it
become then sensitive, that we should have greater
restrictions?
Do you care to comment on that, Dr. Anastasio?
Mr. Anastasio. Let me indicate that before we have any
foreign national on our network, we go through a very extensive
review, including a counterintelligence review of those
individuals before we allow them on. We're essentially moving
to do the same thing Lawrence Livermore is doing in their blue
network to have a separate network that's segregated in a way
that allows the foreign national to have access only to the
information they need, as I said in my testimony.
And the other thing is that the yellow network has many
protections on it. It's segregated in a sense already to be the
network we use for information that's beyond what would be
revealed to the general public. Before we put any information
on that network, we go through an extensive classification
review before that information is allowed to be on the network.
But then, beyond that, the mosaic issue is always a
challenge. And it's something they watch out for as we go and
do our reviews of the information and as we look at any issues
that may arise.
But, yeah, I think we are very vigilant about these issues.
Dr. Miller. Mr. Chairman, if I could just add a slight
amplification of that in the sense of an example.
Personally identifiable information is obviously something
we're all very sensitive to. That information is separately
segregated and protected on the yellow network. So, for
instance, I do not have access to the PII of all of the
employees at the laboratory; it is separately segregated. The
number of people who have access to it is limited to a very
small number who actually are required to be able to do that in
concert with their job.
An example of why somebody might want to have access to it
is, if an employee were taken to the medical facility in an
emergency, the medical people need to be able to get access to
personal information about what drugs, whatever. So there are
specific circumstances under which people could get access, but
generally the information is very tightly segregated, based
upon the function and based upon the need to know of the rest
of the people.
Mr. Stupak. But you don't--on your yellow networks you
don't have anything where you catalog what foreign nationals
are looking at or working on, do you?
Mr. Anastasio. We're very--we keep--as Dr. Hunter said, we
keep a full record of all the in-going and out-coming traffic
on our network and we watch that and search it. And we have
sensors deployed to look at the traffic that's going on. And we
periodically do scans, as well as do scrubs of the information
that's moving around, to ensure ourselves that the proper
behavior is going on on the network.
Mr. Stupak. OK.
Dr. Wilbanks, let me ask you one more question, if I may.
If information was being exfiltrated from any of the DOE labs,
would this be detectable? In other words, does DOE have the
ability to fully understand whether information is being lost
from any of the DOE labs' networks?
How would they know this?
Ms. Wilbanks. DOE, NNSA and the site offices themselves
have many sensors that monitor the outgoing traffic. And there
are techniques, technologies to determine what information is
being exfiltrated. I'd be happy to elaborate, sir, in a closed
session.
Mr. Stupak. But it's possible the sensors don't pick up
what's being exfiltrated, right? It just depends on--
Ms. Wilbanks. Yes, sir. That's always a possibility we
face.
Mr. Anastasio. Excuse me, Mr. Chairman. Just to amplify on
that, we do have layers of defense, though. I think that's
important.
Although no layer is perfect, we have sensors that we use
inside the laboratories. We have--NNSA has a set of techniques
that they use, DOE and then even the broader national security
community. So we rely on all those layers to allow us to know
what's going on, and if we have a problem, how we can react.
Mr. Stupak. Sure. I agree with that. But the attacks are
becoming more and more sophisticated. And if we're playing
above the rim, you're not going to know.
Mr. Anastasio. But our job as a national laboratory is to
have the innovation and creativity to stay ahead of the game,
to be leading the world on these activities and to draw on the
full resources of all the elements of the government to do our
job.
So we're very conscious, and Dr. Hunter, I thought, was
very eloquent about the people, that that is a key issue for us
to make sure we have those people that can be at the state of
the art, ahead of the state of the art.
Mr. Stupak. I don't disagree with any of that. But then
when we see reports from other offices indicating that our
cyber security is sort of lacking, and if this is our 14th
hearing over the last 8 years, when it comes to security, I'm
very concerned--not just the physical, but maybe more so the
cyber security which has taken on greater significance.
And if our enemy is getting more sophisticated--well, I
hope we're above the backboard, not above the rim. I'm not real
confident we are at this point in time.
Dr. Hunter, and then I'm going to go to Mr. Shimkus.
Ms. Wilbanks. Mr. Chairman, if I may elaborate, please,
sir.
One of the things I mentioned in my opening statement was
the fact that DOE and NNSA have now combined in their incident
management, incident handling and identification to help keep
us above the backboard, sir.
Mr. Stupak. Right.
Dr. Hunter.
Dr. Hunter. Thank you, Mr. Chairman.
Mr. Stupak. Turn that mic on, please. I'm sorry.
Dr. Hunter. Mr. Chairman, we've all acknowledged the
rightful concern about the cyber issue, as you just stated.
One point I would like to add to what he just said: The
laboratories and the DOE are working very closely together so
they pool their expertise. If there's any evidence, as we watch
very carefully, of things that might have been or could be
exfiltrated, these people call each other and quickly analyze
and try to understand the situation. In a way--so it's like a
big team. When you address one place, you get the team of the
other place that's quickly providing the benefit of their
experience to try to understand what is happening and to
respond to it.
Mr. Stupak. I agree you're doing all that. I hope it works,
but when I get figures like 400 million attacks a month, that's
almost impossible to keep on top of. So I hope those sensors
and filters really are doing their job.
Mr. Shimkus.
Mr. Shimkus. Thank you, Mr. Chairman.
I think you can continue to hear from Members of Congress,
hope that security is improving; but you also hear great
skepticism over the years of Members being involved in some
pretty big breaches.
Let me ask the three directors of the labs, because, Dr.
Miller, you mentioned a blue network. Or the--all labs being
unique, as I understand, Dr. Anastasio, Dr. Hunter, are you
developing blue networks? Are there best practices? Do you
communicate and share information to make you all better?
Mr. Anastasio. Yes, sir, very much.
And so at Los Alamos we--as I said, we're building a
further segmented element of our segmented network on our
yellow network. That's conceptually equivalent to what Lawrence
Livermore is doing with their blue network. We haven't given it
a name of a color; it's essentially the same thing. But--we're
using slightly different approaches to accommodate the
differences we have, but it's really the same thing.
But as far as sharing goes, absolutely we share--we, the
three of us, talk together. We've talked about this issue for
years amongst ourselves, about how to approach it. Even more
important, our technical staff is in constant contact with each
other.
When we had a concern about a penetration of the yellow
network, we had, in fact, people from Sandia to come up to Los
Alamos to actually work in our team. So it's an example of how
we're working together.
Mr. Shimkus. The other thing is time frame. When we're
talking about sensitive information and--yeah, good lessons
learned; you're sharing information--time.
Dr. Anastasio, I'm going to come back to you. But let me
finish with Dr. Miller and Dr. Hunter. And then I'm going to
come back to Los Alamos.
Dr. Miller. Yes. I think the question you raise is a very
important one. And as Dr. Anastasio said, we work very, very
hard. We're very cognizant of the technical approaches that
both Los Alamos and Sandia have taken. They have developments
that--we are watching very carefully; when those developments
mature to the point where they can be adequately assessed, we
will frequently move those across from one laboratory to the
other.
We share people. We share information. So there's a very,
very tight coupling between the three of us and again, as we
have said before, with the NNSA/DOE and the much broader
Federal community in this area.
Dr. Hunter. Thank you. I think I commented on the sharing
and the working together. I will comment on your specific
question about the best practices.
The existence of a three-level network--the unclassified,
the yellow network, as we just described and the classified--
is, in fact, a best practice developed by the laboratories,
which we feel is somewhat unique and important.
Secondly, we have not decided to go to a blue network at
this point. But what we have decided to do is much like what
Mike Anastasio said, emphasize stronger segmentation of the
yellow network to really be sure the need-to-know controls are
in place, and emphasize then monitoring of information coming
and going into that network.
And then finally to really look at this question of what do
foreign nationals particularly need in terms of their
requirements to work at the laboratory, say, on broad science?
Sometimes it's limited to things like payroll and benefit
information, which you can really segment very strongly.
So the combination of those things, we think, will lead us
to the proper decision.
Mr. Shimkus. And let me follow up.
We don't want to get too--you know, just put all the burden
on the foreign national debate, because a lot of our security
breaches would--you know, are nationals--you know, born U.S.
citizens. But, you know--and we--you know, this list is public
on some of these. But the vetting process for those, I mean,
they're still citizens of countries that we have identified as
sensitive or nonsensitive. So the vetting has to be as good as
we do when we give our security clearances, I would assume.
Let me go to Mr. Borgia to respond to the vetting process
of the individuals who are hired, both alien, visitors and
citizens.
Mr. Borgia. Sir, there is a vetting process that
counterintelligence uses to look at foreign nationals who are
coming into the complex.
However, I think it would be better to talk about that in a
classified setting, to give you a more detailed understanding
of what we do. The security program is responsible for
conducting backgrounds of other persons who are hired, you
know--
Mr. Shimkus. And that's fine. We'll have that opportunity.
So thank you.
Let me go to Dr. Anastasio because you're the one who
obviously was the subject of the most recent report. And I
think our position is, anyone who's been, you know, in an
executive position and you--and the inspector general comes
down or--in the military, a former Army officer or someone from
the corporate headquarters, who is doing that same thing,
they've identified numerous deficiencies.
I guess this thing was finally left in December. So then
the compilation of the report, their analysis, finished just a
month ago; and then this is a very recent--you know, a
publication of September 2008.
So if we would go through it, you know, starting on page--
although a risk assessment was completed, it was not
comprehensive. Are we now able to say that the risk assessment
is now comprehensive?
Mr. Anastasio. Yes, we are. As part of our process to get
accreditation and verification with the process we have with
NNSA, we have gone through a very formal set of risk
assessments, and we are--for all our networks and all our
activities on the yellow network, as well, of course, as the
classified network. And we are just now completing that. We'll
be done in December, and we'll finish the full accreditation
and certification of all our systems.
But we've gone and taken other steps in response to the
GAO.
Mr. Shimkus. I'll just keep following, because that's what
you hear by Members, you know, guidelines. You know, if I was
the--you know, the Secretary of Energy, I would say not good.
These are the deficiencies. When will they be resolved? And I
think that's where Members are.
So the other one is policies and procedures have
shortcomings. Have the shortcomings been addressed?
Mr. Anastasio. Yes, sir, they have. Again, we've done a
comprehensive look for all the issues that are--at least in the
draft report. Since the final just came out today, I haven't
seen the final, but we have certainly seen the draft report,
and we are already responding to all of the issues that have
been raised in that report, including more stringent
protections, reducing the number of ports that are active, more
robust cyber detection. We've changed our policies and made
them more clear, as I said in my--and comprehensive--in my
opening statement. And we're just addressing all those things.
Mr. Shimkus. OK. Because my time's short and there are
going to be votes, so you understand the point. I would then
just turn to the other directors. And it would make common
sense for you all to review the report from that position and
relook at your own processes and procedures.
Quickly, if you'd like to, sir.
Dr. Miller. Yes. Again, we certainly are aware, have read
the draft report and have reflected it on ourselves. We will do
the same thing with the final report that just came out.
Mr. Shimkus. The primary job, other than passing the laws
of the land--and we are justly criticized for not doing a good
job in oversight. This is our job; this is what we're supposed
to be doing. And so that's why we're continuing to be on this.
Sir, do you want to add?
Dr. Hunter. Yes, sir.
I just agree. We share the same challenges, and we'll
derive the same lessons learned from every activity.
Mr. Shimkus. You all were out with the rest of the folks
when the first panel was being asked, and we did spend a lot of
time on the yellow network. I did talk about e-mails and
attachments and the Trojan horses and all these things that
some of us are just getting to understand and those types.
A lot of the responses were that we monitor what is--my
impression, just trying to pay attention, was, we monitor
what's being sent out. We grab it, and we segregate it. We hold
onto it.
So it just led me to the question, if we grab and hold onto
it, do we grab and hold onto it before it gets out to the
system, or it's going out the door, so we at least know what we
lost?
Who wants to respond to that question? We know what we
lost. Is that really what we're talking about?
Mr. Pyke. Mr. Shimkus, in quite a number of cases we are
able to actually block the outgoing transmission before it
takes place. There are occasions where we learn about it after
the fact or block it when it's partway out. But we are able,
through the collaboration that's been discussed by various
members of the panel; and through an active collaboration with
the counterintelligence folks, we are able to work together not
just week by week, but in near real time, to use the
information we have to block outgoing attempted exfiltration of
information.
Mr. Shimkus. And Mr. Chairman, if I may, I just want to end
up with--the inspector general testified about incomplete
certification and accreditation. We're kind of raising some of
that at the labs about incomplete implementation by the
Department of Federal cyber security policies, especially for
DOE and for NNSA.
What's your response to these findings?
Ms. Wilbanks. NNSA has implemented new policy as of May
2008 that completely strengthens the certification and
accreditation process. It also strengthens some of the
requirements and restrictions on the yellow network. And the
labs are in the process of implementing this policy at this
time.
Mr. Shimkus. Go ahead.
Mr. Pyke. Mr. Shimkus, if I may, we have a comprehensive
set of requirements DOE-wide in the cyber security area;
always, of course, looking to improve them and to add to them,
but they are in place.
And it's my understanding in working with Dr. Wilbanks and
her staff and my personal observations that NNSA not only
follows these requirements, but given the nature of the mission
of NNSA, they frequently strengthen them to provide protection
against the special risks faced by NNSA programs.
Mr. Shimkus. You know, the inspector general recommends
time frames and benchmarks. I mean, would you agree with his
recommendation? And if you do, do you have them? And if you do,
would you supply those to the committee?
Ms. Wilbanks. Yes, sir. We do agree. Yes, sir. We do have
them. And yes, sir, we will supply them.
Mr. Shimkus. Thanks. Thanks, Mr. Chairman.
Mr. Stupak. Thank you, Mr. Shimkus.
Mr. Borgia, if I may, we had some questions of the first
panel--Mr. Friedman, in particular--about the letter that was
sent to Mr. Dingell by a former senior counterintelligence
officer at Lawrence Livermore.
Are you familiar with that letter at all?
Mr. Borgia. Yes, Mr. Chairman, I am.
Mr. Stupak. What's your reaction to it, especially when
they say that as a result of the changes, vulnerability of DOE
personnel and facilities to hostile intelligence entities has
increased exponentially?
Mr. Borgia. I couldn't hear the first part of the--
Mr. Stupak. That as a result of the changes at DOE, the
vulnerability of DOE personnel and facilities to hostile
intelligence entities has increased exponentially.
Mr. Borgia. That would be wrong, Mr. Chairman.
Mr. Stupak. That would be wrong?
Mr. Borgia. Yes.
Mr. Stupak. And the letter cites about five different
examples.
Mr. Borgia. Sir, I can give you in a classified hearing
great examples of the success that this program is experiencing
right now that collectively have not been experienced
throughout the rest of the 10 years of the program.
We have an extraordinary marriage with the FBI. The FBI is
dedicated, as I mentioned myself, but also 20 other special
agents who are agents in the labs included--including agents in
the weapons labs.
There has been--there's been extraordinary connection with
the Intelligence Community. And this program today has a much
bigger profile in the Intelligence Community. The national
counterintelligence executive has identified this as one of the
top four programs. He'd always talked about this in briefings
on the Hill as the ``top three programs.''
Now he says the top four programs. That's DOE's
counterintelligence program. There is a great new confidence in
the counterintelligence program that is identified and
experienced not only outside in the intelligence community, but
I believe my colleagues in the Department as well as the
Secretary and the NNSA Administrator would agree.
Mr. Stupak. So you wouldn't agree that, if I can summarize
what this individual who had 29 years experience with the FBI
in this area, that the counterintelligence aspect of our
security has been diminished while the intelligence gathering
has increased at the expense of counterintelligence and DOE?
Mr. Wilshusen. Yes. That would be wrong.
Mr. Stupak. That would be wrong?
Mr. Wilshusen. Yes. And, sir, I have almost 25 years in the
FBI, worked counterintelligence, counterterrorism, and criminal
investigative programs. I could sit, and I would be very happy
to sit and talk about and give you the details in a classified
setting about what the accomplishments of this program are.
Mr. Stupak. Well, I wanted to raise it, and I am glad you
are familiar with it because it probably will come up in our
closed session, which we are going to go into soon.
Mr. Shimkus, questions, please.
Mr. Shimkus. Just a unanimous consent request for these two
documents. I think the staff shared them with you. The one's a
Foreign National Assignments with computer access. It just has
a listing of all that. And another one, just to highlight the
fact that we have U.S. citizens that are not good citizens
also. There is a story today, an AP story: Scientist Accused of
Selling Rocket Data to China, an AP story about that. I am
asking unanimous consent to accept those.
Mr. Stupak. Without objection, then--I'm looking for the
date on this one here. Today's date, Scientist Accused of
Selling Rocket Data to China, that will be made part of the
record, that AP news story. And Foreign National Assignees With
Computer Access, dated September 12, 2008, will also be made
part of the record.
[The information appears at the conclusion of the hearing.]
Mr. Stupak. That is going to conclude the open part of our
hearing. We are going to have a couple votes on the floor, so
why don't we do this: Instead of reconvening in 10 minutes, I
think, let's shoot for 2:00. We have got at least three votes
on the floor; they are going to call them here in a second, and
then we can meet in 2218. So let's meet in Room 2218 of the
Rayburn Building at 2:00. And only those individuals who have
appropriate Top Secret/Q level clearances that have been
previously sent to the committee clerk and the House security
will be admitted. So I will dismiss this panel then.
And before we close this portion of the hearing, I ask
unanimous consent that the hearing record will remain open for
30 days for additional questions for the record. Without
objection, the record will be open.
I ask unanimous consent that Tabs 1 through 7 and Tabs 25
and 26, those nonofficial use only exhibits of our document
binder, be entered into the record. Without objection, the
documents will be entered into the record.
Mr. Stupak. That concludes the open portion of this
hearing. We will recess until 2:00 and reconvene in Room 2218
of the Rayburn Building for our closed portion of this hearing.
[Whereupon, at 1:13 p.m., the subcommittee recessed to
proceed in closed session at 2:00 p.m. the same day.]
[GRAPHIC] [TIFF OMITTED] T3238.034
[GRAPHIC] [TIFF OMITTED] T3238.035
[GRAPHIC] [TIFF OMITTED] T3238.036
[GRAPHIC] [TIFF OMITTED] T3238.037
[GRAPHIC] [TIFF OMITTED] T3238.038
[GRAPHIC] [TIFF OMITTED] T3238.101
[GRAPHIC] [TIFF OMITTED] T3238.102
[GRAPHIC] [TIFF OMITTED] T3238.103
[GRAPHIC] [TIFF OMITTED] T3238.104
[GRAPHIC] [TIFF OMITTED] T3238.105
[GRAPHIC] [TIFF OMITTED] T3238.106
[GRAPHIC] [TIFF OMITTED] T3238.107
[GRAPHIC] [TIFF OMITTED] T3238.108
[GRAPHIC] [TIFF OMITTED] T3238.109
[GRAPHIC] [TIFF OMITTED] T3238.110
[GRAPHIC] [TIFF OMITTED] T3238.111
[GRAPHIC] [TIFF OMITTED] T3238.112
[GRAPHIC] [TIFF OMITTED] T3238.113
[GRAPHIC] [TIFF OMITTED] T3238.114
[GRAPHIC] [TIFF OMITTED] T3238.115
[GRAPHIC] [TIFF OMITTED] T3238.116
[GRAPHIC] [TIFF OMITTED] T3238.117
[GRAPHIC] [TIFF OMITTED] T3238.118
[GRAPHIC] [TIFF OMITTED] T3238.119
[GRAPHIC] [TIFF OMITTED] T3238.120
[GRAPHIC] [TIFF OMITTED] T3238.121
[GRAPHIC] [TIFF OMITTED] T3238.122
[GRAPHIC] [TIFF OMITTED] T3238.123
[GRAPHIC] [TIFF OMITTED] T3238.124
[GRAPHIC] [TIFF OMITTED] T3238.125
[GRAPHIC] [TIFF OMITTED] T3238.126
[GRAPHIC] [TIFF OMITTED] T3238.127
[GRAPHIC] [TIFF OMITTED] T3238.128
[GRAPHIC] [TIFF OMITTED] T3238.129
[GRAPHIC] [TIFF OMITTED] T3238.130
[GRAPHIC] [TIFF OMITTED] T3238.131
[GRAPHIC] [TIFF OMITTED] T3238.132
[GRAPHIC] [TIFF OMITTED] T3238.133
[GRAPHIC] [TIFF OMITTED] T3238.134
[GRAPHIC] [TIFF OMITTED] T3238.135
[GRAPHIC] [TIFF OMITTED] T3238.136
[GRAPHIC] [TIFF OMITTED] T3238.137
[GRAPHIC] [TIFF OMITTED] T3238.138
[GRAPHIC] [TIFF OMITTED] T3238.139
[GRAPHIC] [TIFF OMITTED] T3238.140
[GRAPHIC] [TIFF OMITTED] T3238.141
[GRAPHIC] [TIFF OMITTED] T3238.142
[GRAPHIC] [TIFF OMITTED] T3238.143
[GRAPHIC] [TIFF OMITTED] T3238.144