    Department of Energy: DOE Needs to Improve Controls Over Foreign Visitors
    to Weapons Laboratories (Chapter Report, 09/25/97, GAO/RCED-97-229).

    With the end of the Cold War, secret weapons research at the Energy
    Department's weapons laboratories has waned while unclassified
    cooperative research with various nations is rising.  With this research
    has come an increase in the number of foreign visitors at the
    laboratories.  DOE has various controls to minimize the risk of foreign
    espionage, but earlier work by GAO and the U.S. intelligence community
    has cited shortcomings in these controls.  This report discusses (1)
    DOE's procedures for background checks on foreign visitors and
    controlling the dissemination of sensitive information to them, (2)
    security controls over foreign visitor's access to sensitive areas and
    information within the laboratories, and (3) counterintelligence
    programs for mitigating the potential threat posed by foreign visitors.

    --------------------------- Indexing Terms -----------------------------

     REPORTNUM:  RCED-97-229
         TITLE:  Department of Energy: DOE Needs to Improve Controls Over
                 Foreign Visitors to Weapons Laboratories
          DATE:  09/25/97
       SUBJECT:  Security clearances
                 Nuclear weapons plant security
                 Domestic intelligence
                 Aliens
                 Weapons research
                 Laboratories
                 Foreign governments
                 Atomic energy defense activities
                 Classified information
                 Information leaking

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO report.  Delineations within the text indicating chapter **
    ** titles, headings, and bullets are preserved.  Major          **
    ** divisions and subdivisions of the text, such as Chapters,    **
    ** Sections, and Appendixes, are identified by double and       **
    ** single lines.  The numbers on the right end of these lines   **
    ** indicate the position of each of the subsections in the      **
    ** document outline.  These numbers do NOT correspond with the  **
    ** page numbers of the printed product.                         **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ** A printed copy of this report may be obtained from the GAO   **
    ** Document Distribution Center.  For further details, please   **
    ** send an e-mail message to:                                   **
    **                                                              **
    **                                            **
    **                                                              **
    ** with the message 'info' in the body.                         **
    ******************************************************************

    Cover
    ================================================================ COVER

    Report to the Committee on National Security, House of
    Representatives

    September 1997

    DEPARTMENT OF ENERGY - DOE NEEDS
    TO IMPROVE CONTROLS OVER FOREIGN
    VISITORS TO WEAPONS LABORATORIES

    GAO/RCED-97-229

    DOE Needs to Improve Controls Over Foreign Visitors

    (141002)

    Abbreviations
    =============================================================== ABBREV

      CIA - Central Intelligence Agency
      DOE - Department of Energy
      FBI - Federal Bureau of Investigation
      GAO - General Accounting Office
      OPSEC - operations security

    Letter
    =============================================================== LETTER

    B-277671

    September 25, 1997

    The Honorable Floyd D.  Spence
    Chairman
    The Honorable Ronald V.  Dellums
    Ranking Minority Member
    Committee on National Security
    House of Representatives

    As directed by the Committee in House Report No.  104-563, this
    report addresses the Department of Energy's (DOE) controls over
    foreign visitors to its three nuclear weapons laboratories.
    Specifically, the report discusses DOE's (1) procedures for reviewing
    the backgrounds of foreign visitors and for controlling the
    dissemination of sensitive information to such visitors, (2) security
    controls for limiting foreign visitors' access to areas and
    information within its laboratories, and (3) counterintelligence
    programs for mitigating the potential threat posed by foreign
    visitors.

    As arranged, unless you publicly announce its contents earlier, we
    plan no further distribution of this report until 30 days after the
    date of this letter.  At that time, we will provide copies of the
    report to the Secretary of Energy; the Director, Office of Management
    and Budget; and other interested parties.  We will also make copies
    available to others upon request.

    Please call me on (202) 512-3841 if you or your staffs have any
    questions.  Major contributors to this report are listed in appendix
    V.

    Victor S.  Rezendes
    Director, Energy, Resources,
     and Science Issues

    EXECUTIVE SUMMARY
    ============================================================ Chapter 0

       PURPOSE
    ---------------------------------------------------------- Chapter 0:1

    With the end of the Cold War, the Department of Energy's (DOE)
    weapons laboratories are moving away from secret nuclear weapons
    research toward unclassified cooperative research involving a variety
    of nations and an increasing number of foreign visitors.  This
    openness greatly benefits DOE and the United States by stimulating
    the exchange of ideas, promoting cooperation, and enhancing research
    efforts.  However, while foreign visitors are providing benefits to
    DOE's programs, the weapons laboratories are key targets of foreign
    intelligence interest, according to counterintelligence experts, thus
    raising concerns about possible espionage efforts against those
    laboratories, including industrial espionage.

    To guard against foreign nationals' obtaining information that would
    be detrimental to U.S.  security or business interests, DOE has
    established various controls to minimize the risk of foreign
    espionage.  However, past work done by GAO in 1988 and more recently
    by elements of the U.S.  intelligence community has shown problems
    with DOE's controls over foreign visitors to its laboratories.\1
    Moreover, because the number of foreign visitors to the laboratories
    increased over 50 percent from the late-1980s to the mid-1990s,
    additional burdens have been placed on the controls DOE has in place
    to manage foreign visits.  The high number of foreign visitors, as
    well as some recent investigative cases involving foreign nationals
    at DOE's laboratories, have increased concerns that the laboratories
    are targets of foreign espionage.

    Because of these concerns, the House Committee on National Security,
    in a May 1996 report, directed GAO to determine how well DOE has been
    managing foreign visits to the weapons laboratories.  Accordingly,
    GAO assessed DOE's (1) procedures for reviewing the backgrounds of
    foreign visitors and for controlling the dissemination of sensitive
    information to them, (2) security controls for limiting foreign
    visitors' access to areas and information within its laboratories,
    and (3) counterintelligence programs for mitigating the potential
    threat posed by foreign visitors.

    --------------------
    \1 Nuclear Nonproliferation:  Major Weaknesses in Foreign Visitor
    Controls at Weapons Laboratories (GAO/RCED-89-31, Oct.  11, 1988).

       BACKGROUND
    ---------------------------------------------------------- Chapter 0:2

    Historically, the Lawrence Livermore National Laboratory, the Los
    Alamos National Laboratory, and the Sandia National Laboratories have
    been responsible for conducting research and development for DOE's
    nuclear weapons program.  The laboratories are also world-leading
    centers of research in many technologies and scientific disciplines
    and conduct a broad range of nonnuclear research activities in such
    areas as biomedicine, high-performance computers, and environmental
    restoration.  DOE's policy encourages international cooperation in
    unclassified energy and science programs to obtain the benefits of
    scientific and technical advances from other countries and to
    minimize research costs.  Consequently, each year thousands of
    foreign nationals visit these three laboratories to participate in
    cooperative research or laboratory programs.

    DOE Order 1240.2b establishes controls over unclassified foreign
    visits (stays of up to 30 days) and assignments (extended stays of up
    to 2 years).\2 Among other things, this order requires that DOE
    obtain background information on certain proposed visitors from
    sensitive countries--
    countries considered to be a risk to security or nuclear
    proliferation.  The order also requires that DOE review and approve
    visits involving information that, although unclassified, is
    considered sensitive for such reasons as its potential to enhance
    nuclear weapons capability, lead to nuclear proliferation, reveal
    advance technologies, or have "dual-use" applications (technologies
    that have both peaceful and military uses).  In addition, each
    weapons laboratory has security procedures for controlling foreign
    nationals' access to its facilities.  Furthermore, DOE has
    established counterintelligence programs at headquarters and the
    laboratories to mitigate the risk of foreign espionage, increase
    employee awareness, and brief and debrief employees serving as hosts
    to foreign visitors.  Counterintelligence programs have become more
    important as the number of foreign visitors has increased.

    --------------------
    \2 For purposes of this report, we use "visit" as a generic term for
    both short-term visits or long-term assignments.  However, we do make
    distinctions between visits (or visitors) and assignments (or
    assignees) in situations where such distinctions are significant.

       RESULTS IN BRIEF
    ---------------------------------------------------------- Chapter 0:3

    DOE's procedures for obtaining background checks and controlling the
    dissemination of sensitive information are not fully effective.  DOE
    has procedures that require obtaining background checks, but these
    procedures are not being enforced.  At two of the laboratories,
    background checks are conducted on only about 5 percent of the
    foreign visitors from countries that DOE views as sensitive.  GAO's
    review of available data from DOE and the Federal Bureau of
    Investigation showed that some of the individuals without background
    checks had suspected foreign intelligence connections.  Furthermore,
    DOE's procedures lack clear criteria for identifying visits that
    involve sensitive subjects and process controls to help ensure that
    these visits are identified.  As a result, sensitive subjects may
    have been discussed with foreign nationals without DOE's knowledge
    and approval.

    DOE's security controls, such as access restrictions, in the areas
    most visited by foreign nationals do not preclude their obtaining
    access to sensitive information, and problems with the control of
    this information--such as sensitive information being left in an open
    hallway accessible to foreign visitors--have occurred at the
    laboratories.  Furthermore, DOE has not evaluated the effectiveness
    of the security controls over this information in those areas most
    frequented by foreign visitors.

    The DOE headquarters and laboratory counterintelligence programs are
    key activities for identifying and mitigating foreign intelligence
    efforts, but these programs have lacked comprehensive threat
    assessments, which identify likely facilities, technologies, and
    programs targeted by foreign intelligence.  Such assessments are
    needed as a critical component of a more sophisticated security
    strategy that is consistent with the laboratories' more open
    missions.  Furthermore, DOE could use these assessments to develop
    the performance measures needed to guide the laboratories'
    counterintelligence programs and to gauge their effectiveness.
    Currently, DOE has not developed such performance measures or
    evaluated the effectiveness of its counterintelligence programs.

       PRINCIPAL FINDINGS
    ---------------------------------------------------------- Chapter 0:4

          PROCEDURES ARE NOT
          EFFECTIVELY IMPLEMENTED
    -------------------------------------------------------- Chapter 0:4.1

    DOE Order 1240.2b requires the laboratories to submit information to
    DOE for background checks for all foreign visitors from sensitive
    countries and to obtain these checks in advance for those who are on
    assignment at the laboratories.  Consistent with these requirements,
    Livermore obtained background checks on 44 percent of its visitors
    from sensitive countries.  However, to reduce costs and processing
    backlogs, the Los Alamos and Sandia laboratories implemented in 1994
    a partial exception that DOE had granted to the order that largely
    avoided the background check process.  Since then, DOE has obtained
    background checks on about 5 percent of the visitors from sensitive
    countries to these two laboratories.  GAO's review of available data
    from DOE and the Federal Bureau of Investigation showed that, as a
    result of obtaining fewer background checks for foreign visitors to
    these laboratories, questionable visitors, including suspected
    foreign intelligence agents, had access to the laboratories without
    DOE and/or laboratory officials' advance knowledge of the visitors'
    backgrounds.

    DOE's existing procedures for identifying sensitive subjects lack
    clear criteria for determining which subjects are sensitive and
    process controls to help ensure that proposed visits involving
    potentially sensitive subjects are reviewed by officials at DOE
    headquarters.  Consequently, although the laboratories identified 72
    visits involving sensitive subjects during the 1994 to 1996
    timeframe, GAO identified other visits that occurred without DOE's
    review and approval and that may have involved sensitive subjects,
    such as inertial confinement fusion (a technology with both energy
    and nuclear weapons applications) and the detection of nuclear
    weapons testing.  Although DOE and laboratory officials have
    recognized problems with identifying sensitive subjects and are
    taking actions to better identify them, their actions are not yet
    completed.

          SECURITY CONTROLS LEAVE
          VULNERABILITIES
    -------------------------------------------------------- Chapter 0:4.2

    The controls in the areas of the laboratories that are most often
    visited by foreign nationals do not preclude their access to
    sensitive information.  Foreign visitors are generally allowed into
    "property protection," or controlled areas.  These areas have lower
    levels of controls than do security areas in which classified work is
    conducted.  For example, in contrast to the controls in place in
    security areas, foreign visitors are, in some cases, allowed
    unescorted, 24-hour access to facilities in controlled areas.
    Security problems and vulnerabilities involving foreign visitors and
    sensitive--and in some cases even classified--information have
    occurred or been identified by the laboratories.  For example, at one
    laboratory, several boxes marked "sensitive materials" were left in a
    hallway accessible to foreign visitors.  At another laboratory,
    classified information was included in a newsletter sent to 11
    foreign nationals.

    Thorough assessments and surveys of the controls over foreign
    visitors' access to sensitive information have not been conducted.
    Although some security assessments of limited scope done by the
    laboratories have demonstrated the vulnerability of sensitive
    information to being compromised, these assessments have generally
    examined specific buildings or programs and have not focused on
    controls over sensitive information in the areas most accessed by
    foreign visitors.  Likewise, DOE's broader security surveys of its
    weapons laboratories have not assessed the effectiveness of the
    controls over sensitive information, either in general or in relation
    to foreign visitors.

          COUNTERINTELLIGENCE PROGRAMS
          COULD BE IMPROVED
    -------------------------------------------------------- Chapter 0:4.3

    DOE's counterintelligence programs have not been based on a
    comprehensive threat assessment that examines the nature and extent
    of foreign espionage activities.  Such an assessment would analyze
    the countries of concern and identify for the entire Department the
    technologies, information, and programs likely to be targeted by
    these countries.  Counterintelligence officials at both DOE and the
    Federal Bureau of Investigation believe this assessment is needed as
    a basis for guiding DOE's counterintelligence programs and ensuring
    that their efforts are properly focused; however, DOE has not
    conducted such an assessment because of programmatic priorities and
    the lack of sufficient analytical expertise.  Furthermore, DOE has
    not provided detailed oversight of the laboratories'
    counterintelligence programs.  In this regard, DOE has not developed
    expectations and performance measures for those programs or
    periodically evaluated them.

    DOE is now taking steps to improve its counterintelligence programs.
    The Congress provided DOE with an additional $5 million in fiscal
    year 1997 to expand counterintelligence activities; DOE is using
    about half of these funds for the counterintelligence programs at the
    three nuclear weapons laboratories.  Also, DOE and the laboratories
    are undertaking various initiatives to improve their
    counterintelligence efforts, such as developing more thorough threat
    assessments.  Although implementation of these improvements is
    scheduled for the end of fiscal year 1997, DOE counterintelligence
    officials raised concerns that the Department may not fully implement
    these improvements in light of its historical lack of support for its
    counterintelligence program.

       RECOMMENDATIONS
    ---------------------------------------------------------- Chapter 0:5

    GAO is making several recommendations to the Secretary of Energy that
    are designed to (1) obtain background checks on more of the foreign
    visitors to the Department's weapons laboratories, (2) improve the
    identification and review of visits by foreign nationals that involve
    sensitive subjects, (3) more thoroughly assess the adequacy of
    security procedures in unclassified areas of the weapons
    laboratories, and (4) enhance the effectiveness of
    counterintelligence programs at DOE's headquarters and laboratories.

       AGENCY COMMENTS
    ---------------------------------------------------------- Chapter 0:6

    GAO provided a draft of this report to DOE for its review and
    comment.  In its written response, DOE had no comments on the general
    nature of the facts presented in the draft report and concurred with
    all the recommendations.  DOE believes, however, that the report
    overstates the value of background checks on foreign visitors.  GAO
    recognizes that background checks are but one factor to be considered
    in approving foreign visits and recommends only that DOE obtain
    background checks in accordance with its foreign visit and assignment
    order.  DOE also suggested that GAO revise the language for one
    recommendation regarding an assessment of security procedures at each
    laboratory.  Although DOE suggested that GAO specify that a certain
    type of assessment be conducted, GAO did not revise the
    recommendation in order to avoid being overly prescriptive in how
    such assessments are performed.  Finally, as DOE suggested, GAO
    clarified the recommendation to focus more clearly on protecting
    sensitive information.

    DOE's response also detailed a number of initiatives it has taken or
    plans to undertake that address the recommendations.  DOE's comments
    and GAO's evaluation are included at the end of chapter 5; the full
    text of DOE's comments are included as appendix IV.

    INTRODUCTION
    ============================================================ Chapter 1

    Although the Cold War has ended, the threat of foreign espionage to
    the nation still exists from a variety of countries, and recent
    revelations of intelligence activities against the United States
    involving Russia, China, and South Korea have raised concerns that
    such activities are on the increase.  The Department of Energy (DOE)
    and its facilities, especially its nuclear weapons laboratories, are
    key targets of foreign intelligence interest.  Not only do these
    laboratories conduct activities related to the design, construction,
    and maintenance of nuclear weapons--a long-standing target of foreign
    espionage--but they also conduct research into many areas of high
    technology, such as laser fusion, high-performance computers, and
    microelectronics.  Their research is often done in collaboration with
    industry, and sometimes foreign countries, to develop new
    technologies for commercial applications.  Accordingly, their work is
    of interest to other countries, and thousands of foreign nationals
    visit these laboratories each year to participate in such research.
    The high number of foreign visitors, as well as some recent
    investigative cases involving foreign nationals at DOE's
    laboratories, have increased concerns that these laboratories are
    targets of foreign espionage efforts.

       DOE'S WEAPONS LABORATORIES
    ---------------------------------------------------------- Chapter 1:1

    DOE's nuclear weapons laboratories--the Lawrence Livermore National
    Laboratory in California and the Los Alamos National Laboratory and
    Sandia National Laboratories in New Mexico--have been the
    cornerstones of the U.S.  weapons program for over 40 years.  In this
    regard, they are unique among DOE's laboratories.\1 Government-owned
    and contractor-operated, these three laboratories have been assigned
    specific missions for nuclear weapons development as well as other
    programmatic responsibilities.  Over time, the laboratories have
    increasingly expanded their responsibilities in nondefense research
    areas.

    The Lawrence Livermore National Laboratory is operated by the
    University of California for DOE.  Established in 1952, the
    laboratory occupies 1-square mile in Livermore, California.  The
    laboratory's major missions include nuclear weapons research and
    development to ensure the safety, security, and reliability of the
    U.S.  nuclear weapons stockpile; other weapons and defense-related
    activities for DOE and the Department of Defense; inertial
    confinement fusion (a technology that has both energy and nuclear
    weapons testing applications); and nuclear nonproliferation.

       Figure 1.1:  Lawrence Livermore
       National Laboratory

       (See figure in printed
       edition.)

       Source:  Lawrence Livermore
       National Laboratory.

       (See figure in printed
       edition.)

    The Los Alamos National Laboratory, also operated by the University
    of California for DOE, was established in 1943 as part of the
    Manhattan Project that developed the first nuclear weapons.  Located
    approximately 35 miles from Santa Fe, New Mexico, the laboratory
    covers an area of approximately 43 square miles.  The laboratory
    conducts an array of classified and unclassified activities,
    including all phases of nuclear weapons research, design, and
    testing; other weapons-related research for DOE; and management of
    special nuclear materials, such as plutonium.  Recently, Los Alamos
    was given responsibility for the production of certain weapons
    components.

       Figure 1.2:  Los Alamos
       National Laboratory

       (See figure in printed
       edition.)

       Source:  DOE.

       (See figure in printed
       edition.)

    The Sandia National Laboratories are operated for DOE by the Lockheed
    Martin Corporation.  Sandia, established in 1949, is located in
    Albuquerque, New Mexico, and works in conjunction with Livermore and
    Los Alamos to design and develop nuclear weapons.\2 Sandia conducts
    research, development, and engineering on all facets of weapons
    design and development except the nuclear explosive components.
    Sandia also produces some of the nonnuclear components, such as
    neutron generators, that are needed for nuclear weapons.

       Figure 1.3:  Sandia National
       Laboratories

       (See figure in printed
       edition.)

       Source:  DOE.

       (See figure in printed
       edition.)

    Although the Livermore, Los Alamos, and Sandia laboratories are
    involved in research and development activities related to nuclear
    weapons, in recent years many of their efforts have expanded beyond
    issues strictly related to defense or national security.  The
    laboratories are now involved in such areas as high-performance
    computers, lasers, and microelectronics.  Furthermore, they perform
    research in such diverse areas as biomedicine, environmental
    restoration, and global climate change.  In addition, the
    laboratories are working with industry to develop new technologies
    and products for the commercial market.  Such activities include work
    on advanced automobile propulsion systems, medical applications, and
    waste management.  Furthermore, each laboratory conducts basic
    scientific research in areas of its own choosing--termed Laboratory
    Directed Research and Development.  This research involves such
    subjects as astrophysics and space science, particle physics,
    materials science, and chemistry.

    --------------------
    \1 DOE has 9 multiprogram and approximately 21 specialized
    laboratories.

    \2 Sandia also has a facility located adjacent to the Livermore
    laboratory in California.

       CONTROLS OVER FOREIGN VISITS TO
       THE WEAPONS LABORATORIES
    ---------------------------------------------------------- Chapter 1:2

    Because the Livermore, Los Alamos, and Sandia laboratories are
    world-leading centers of research in many technologies and scientific
    disciplines, many foreign scientists are attracted to them and
    invited to come there to exchange information or participate in
    research activities.  DOE's policy supports an active program of
    unclassified visits to these laboratories for the benefit of its
    programs.\3 In fact, DOE and the laboratories have cooperative
    activities with certain countries to exchange scientists and
    information and to collaborate on research in selected scientific
    areas.

    With the easing of global tensions since the breakup of the Soviet
    Union and the changing missions of the weapons laboratories, the
    number of unclassified foreign visits to the laboratories has
    increased significantly.  The average annual number of visits by
    foreign nationals to the laboratories has increased over 50 percent
    from the late-1980s to the mid-1990s.  Furthermore, this increase in
    foreign visitors is continuing.  As shown in figure 1.4, the number
    of unclassified foreign visits to the laboratories has increased each
    of the last 3 years, to a level of about 7,000 visits in 1996.  This
    represents a significant portion of the 20,000 or more unclassified
    foreign visits estimated by DOE to have occurred at all of its
    laboratories during 1996.

       Figure 1.4:  Unclassified
       Foreign Visits to DOE's Weapons
       Laboratories, 1994-96

       (See figure in printed
       edition.)

    Source:  GAO's analysis of data from DOE and its laboratories.

    Allowing foreign nationals to visit the weapons laboratories and
    participate in their unclassified activities provides valuable
    benefits to the laboratories and the country, such as using the
    visitors' skills to increase the chances of making significant
    scientific advancements.  However, because such visits are not
    without risk, DOE Order 1240.2b--Unclassified Visits and Assignments
    by Foreign Nationals, September 3, 1992--establishes responsibilities
    and policies and prescribes administrative procedures for controlling
    unclassified visits and assignments to DOE's facilities.  Until
    recently, the foreign visitor program was principally administered by
    the Office of Policy and International Affairs, but in March 1997
    this responsibility was transferred to the Office of Resource
    Management in the Office of Nonproliferation and National Security.
    Other principal organizations involved in administering and
    controlling unclassified foreign visits include the Nuclear Transfer
    and Supplier Policy Division, Office of Arms Control and
    Nonproliferation; the Office of Safeguards and Security, Office of
    Security Affairs; the Counterintelligence Division, Office of Energy
    Intelligence; the appropriate headquarters program office that is
    sponsoring the visit; DOE field offices; and laboratory management.

    As defined by the order, visits are short-term stays of 30 days or
    less for the purposes of orientation, technical discussions,
    observation of projects or experiments, training, or discussion of
    collaboration on topics of mutual interest.  Assignments are
    long-term stays of more than 30 days (within a 12-month period) to
    actively participate in the work of a facility or contribute to its
    projects.  Assignments are limited to 2 years but may be extended.
    Assignees may include foreign nationals who are employees, as well as
    those who are guests or consultants.\4 According to DOE's estimates,
    over 25 percent of the foreign visitors to its weapons laboratories
    are assignees.

    DOE's foreign visit and assignment order identifies several
    requirements for reviewing, approving, and documenting foreign
    nationals' access to its nuclear weapons laboratories.  Although the
    order, in general, allows most foreign nationals access with little
    oversight by DOE, the Department views some visits and assignments to
    be of potential concern.  These include visits from countries DOE
    considers sensitive for reasons of national security, nuclear
    nonproliferation, regional instability, or terrorism support (see
    app.  I for a list of these countries).  Data from DOE and the
    laboratories show that almost 30 percent of the visitors to its
    weapons laboratories are from sensitive countries.  DOE is also
    concerned about visits involving subjects which, although
    unclassified, are considered sensitive because they have the
    potential to enhance nuclear weapons capability, lead to nuclear
    proliferation, divulge militarily critical technologies, or reveal
    other advanced technologies (see app.  II for a list of these
    subjects) as well as visits to areas located within the laboratories
    where special nuclear material and/or classified information and
    equipment are located.

    Certain requirements must be met if a foreign visit or assignment
    involves a sensitive country, a sensitive subject, or a security
    facility where classified work is conducted.  According to the
    foreign visits and assignments order, all assignments and visits
    involving sensitive subjects or security facilities where classified
    work is conducted must be reviewed and approved by DOE.  Furthermore,
    before an assignment involving a visitor from a sensitive country
    begins, a national security background check must be completed to
    determine if appropriate U.S.  government agencies have derogatory
    information, such as an intelligence affiliation, about that
    individual.

    DOE also has security procedures that control the access of foreign
    visitors to the weapons laboratories.  All foreign visitors--whether
    on a visit or an assignment--must wear an appropriate badge to obtain
    entry to various parts of a weapons laboratory.  Furthermore,
    depending upon the facility involved, the days of the week and the
    hours during which the foreign national can actually be on site are
    restricted.  Finally, guards and other security countermeasures are
    used to control access to those parts of the laboratories where
    classified work is conducted.  Security forces and other
    countermeasures are also used to monitor and control access to the
    less protected, controlled areas known as property protection
    areas--which are not open to the general public and which may contain
    unclassified sensitive information--to ensure that this information
    is not compromised.

    As an added line of defense, DOE and its laboratories operate
    counterintelligence programs to identify and mitigate the risk that
    sensitive information could be divulged to foreign countries.  Among
    other things, the counterintelligence personnel conduct awareness
    programs to keep employees aware of the risk of foreign
    intelligence-gathering activities, brief and debrief employees who
    host foreign visitors, conduct assessments of foreign visitor
    activity, and disseminate relevant information throughout the DOE
    community.  However, they have no approval authority for foreign
    visitors.  The laboratories' counterintelligence programs do not
    conduct counterintelligence "operations," such as surveillance
    activities.  Situations of concern are referred to the Federal Bureau
    of Investigation (FBI), which performs counterintelligence operations
    or investigations as necessary.

    --------------------
    \3 DOE allows classified foreign visits that relate to information on
    nuclear weapons; however, according to DOE, visits involving
    classified information are limited mainly to foreign nationals from
    the United Kingdom and countries in the North Atlantic Treaty
    Organization.

    \4 For purposes of this report, we use "visit" as a generic term for
    both short-term visits or long-term assignments.  However, we do make
    distinctions between visits (or visitors) and assignments (or
    assignees) in situations where such distinctions are significant.

       CONCERNS EXIST ABOUT THE
       POTENTIAL COMPROMISE OF
       SENSITIVE INFORMATION
    ---------------------------------------------------------- Chapter 1:3

    The risk that classified or sensitive information may be compromised
    through foreign espionage is real and has been long-standing.
    Espionage against the weapons laboratories occurred as long ago as
    the 1940s when the Manhattan Project was developing the nation's
    first nuclear weapons.  As documented in a 1996 Central Intelligence
    Agency (CIA) report that detailed recently declassified documents,
    key information on nuclear weapons was obtained from Los Alamos by
    the Soviet Union.  In the 1980s and 1990s, there have been other
    espionage activities against DOE's laboratories, but information on
    these incidents remains classified.  DOE, laboratory, and other
    agency counterintelligence professionals briefed us on them, which
    included recent cases involving the possible theft or compromise of
    sensitive information in which foreign nationals at DOE's
    laboratories played a prominent role.

    The large and increasing number of foreign nationals visiting DOE's
    laboratories has raised concerns about the potential compromise of
    classified information or other sensitive or proprietary information
    at these facilities.  Counterintelligence professionals point out
    that (1) the laboratories have desirable assets in the form of
    classified information and unclassified but sensitive information;
    (2) access by foreign nationals, even for a short time, can provide
    the opportunity to identify and target laboratory information; and
    (3) repeated and long-term contact between laboratory personnel and
    foreign nationals can create relationships that foreign countries can
    use to obtain information.  They add that the threat has become more
    complex because not only is information on nuclear weapons desirable
    to some foreign countries, but information and technology of economic
    benefit is of great importance to all countries.  Consequently, the
    laboratories face the risk of economic espionage by enemies and
    allies alike.

    Past unclassified work done by GAO and classified work by others have
    shown the risks of foreign visits and DOE's problems in controlling
    foreign visitors' presence at its laboratories.  In 1988, we reported
    that major weaknesses existed in DOE's foreign visitor program and,
    as a result, suspected foreign intelligence agents and individuals
    from facilities suspected of conducting nuclear weapons activities
    had obtained access to the laboratories without DOE's prior
    knowledge.\5 More recently, classified reports--in 1992 by an
    intelligence community interagency working group and in 1997 by the
    FBI--have pointed out basic problems with DOE's counterintelligence
    efforts regarding the presence of foreign nationals at DOE's
    laboratories.

    DOE itself is concerned about the number of foreign visitors to its
    facilities and the potential threat of espionage they pose and has
    obtained additional funding to help its counterintelligence programs
    respond to this potential threat.  Counterintelligence funding for
    headquarters program direction and field activities in fiscal year
    1996 totaled about $3.2 million.  DOE was appropriated an additional
    $5 million in fiscal year 1997 to expand counterintelligence programs
    at its nuclear weapons laboratories and other high-risk facilities.

    --------------------
    \5 Nuclear Nonproliferation:  Major Weaknesses in Foreign Visitor
    Controls at Weapons Laboratories (GAO/RCED-89-31, Oct.  11, 1988).

       OBJECTIVES, SCOPE, AND
       METHODOLOGY
    ---------------------------------------------------------- Chapter 1:4

    A May 7, 1996, report of the House Committee on National Security
    directed GAO to determine how well DOE is controlling foreign visits
    to DOE's three weapons laboratories and to determine whether these
    visits raise security or nuclear proliferation concerns.  Since that
    time, we have issued to the Committee a Statement for the Record
    describing the number of foreign visitors to these laboratories and a
    report discussing the distribution of the fiscal year 1997
    counterintelligence funds provided to DOE.\6 This report completes
    our work on DOE's controls over foreign visitors and, as agreed with
    Committee staff, addresses DOE's (1) procedures for reviewing the
    backgrounds of foreign visitors and for controlling the dissemination
    of sensitive information to them, (2) security controls for limiting
    foreign visitors' access to areas and information within its
    laboratories, and (3) counterintelligence programs for mitigating the
    potential threat posed by foreign visitors.

    To obtain an overall perspective on DOE's foreign visitor procedures,
    security controls, and counterintelligence efforts, we obtained and
    reviewed pertinent DOE and laboratory orders, documents, and other
    materials.  We also met with and interviewed DOE headquarters, field
    office, and contractor officials, including officials from DOE's
    Offices of Defense Programs, Nonproliferation and National Security,
    and Policy and International Affairs in Washington, D.C., and in
    Germantown, Maryland, as well as officials at DOE's field locations
    in Albuquerque and Los Alamos, New Mexico, and in Livermore,
    California.  We also met with contractor officials at the Lawrence
    Livermore National Laboratory in Livermore, California; the Los
    Alamos National Laboratory in Los Alamos, New Mexico; and the Sandia
    National Laboratories in Albuquerque, New Mexico.  Furthermore, we
    met with officials from the FBI to obtain their views on the risk of,
    and control over, foreign visitors to DOE's laboratories.

    In reviewing procedures on background checks for foreign visitors, we
    reviewed data on visits that occurred between January 1994 and
    December 1996.  We examined records on visits and background checks
    contained in (1) DOE's centralized computer database on foreign
    visitors, (2) the laboratories' badging office and local foreign
    visitor databases, and (3) DOE's centralized counterintelligence
    database.  We did not independently verify the accuracy of the
    information in these databases; however, we did obtain additional
    verification of visit information as necessary to complete our
    review.  In particular, our analysis focused on the adequacy of DOE's
    controls related to high-risk visitors (i.e., visitors from sensitive
    countries who potentially could have derogatory national security
    information on file).  In this regard, we tracked information on such
    visitors by examining DOE's records on background checks and by
    independently obtaining some background checks from the FBI.

    To examine the process used for identifying sensitive subjects and
    controlling the dissemination of such information to foreign
    visitors, we obtained and analyzed pertinent guidance on sensitive
    subjects and discussed with DOE and contractor officials (including
    some who had hosted foreign visitors) the methods by which visits
    involving sensitive subjects are identified.  We examined records on
    several hundred visits that occurred from January 1994 through
    December 1996.  We judgmentally selected for further analysis over
    150 visits that were not identified as involving sensitive subjects
    and compared the visits' purpose and/or subject with those identified
    on DOE's sensitive subject list.  We discussed these visits with DOE
    officials in its Nuclear Transfer and Supplier Policy Division, which
    is responsible for reviewing visits that involve sensitive subjects,
    to obtain their perspectives on the accuracy of the identification of
    sensitive subjects.  Additionally, we followed up with researchers
    and managers at these laboratories who frequently host foreign
    visitors concerning whether individual research projects that
    involved foreign nationals involved sensitive subjects.

    To assess the security controls associated with foreign visitors'
    access to certain areas and information within DOE's laboratories, we
    obtained and examined security procedures, plans, surveys, and
    statements of threat.  Our work included a review of laboratory
    security infractions, violations, and occurrences, as well as
    laboratory counterintelligence contact/incident reports.
    Additionally, we obtained unclassified program and building security
    assessments that identified problems and vulnerabilities.  While
    touring laboratory facilities with security personnel, we observed
    the security controls in place for both classified and unclassified
    sensitive research.

    To review the counterintelligence programs, we interviewed DOE,
    laboratory, and FBI counterintelligence officials and obtained
    pertinent documentation regarding the potential threat posed by
    foreign visitors to the weapons laboratories and DOE's activities to
    counter this threat.  In particular, we attended a classified
    counterintelligence briefing that was held for staff of DOE's
    Albuquerque Operations Office, which discussed the foreign visitor
    threat.  We also examined the laboratories' counterintelligence
    contact/incident reports and observed the capabilities of DOE's
    centralized counterintelligence database.  In addition, we obtained
    and reviewed assessments of DOE's counterintelligence programs that
    had been conducted by other organizations in the U.S.  intelligence
    community.

    We encountered two limitations in our attempts to examine DOE's
    controls over foreign visitors to its laboratories.  First, our
    request to the CIA for access to data on the backgrounds of foreign
    visitors was denied on grounds of the sensitivity of the data.  As a
    result, we were unable to review background information from the CIA
    that was on file at DOE or to independently obtain background data
    from the CIA.  Second, we requested from the FBI specific information
    on possible espionage or other illegal activities at the
    laboratories.  However, FBI officials told us that disclosure of such
    information is contrary to FBI policy; consequently, the requested
    information was not provided to us.

    We provided a draft of this report to DOE for its review and comment.
    DOE's comments and our response are included at the end of chapter 5;
    the full text of DOE's comments are included in appendix IV.  Our
    work was conducted from July 1996 through September 1997 in
    accordance with generally accepted government auditing standards.
    Major contributors to this report are listed in appendix V.

    --------------------
    \6 DOE Security:  Information on Foreign Visitors to the Weapons
    Laboratories (GAO/T-RCED-96-260, Sept.  26, 1996) and Department of
    Energy:  Information on the Distribution of Funds for
    Counterintelligence Programs and the Resulting Expansion of These
    Programs (GAO/RCED-97-128R, Apr.  25, 1997).

    FOREIGN VISITOR PROCEDURES HAVE
    NOT BEEN EFFECTIVELY IMPLEMENTED
    ============================================================ Chapter 2

    Although foreign visitors provide many benefits to DOE's programs,
    every one of their visits to a nuclear weapons laboratory poses a
    risk that sensitive information might be inadvertently or
    intentionally compromised.  To minimize this risk, DOE's foreign
    visitor order specifies several procedures that should be conducted
    before foreign nationals are allowed access to its laboratories.  DOE
    has not effectively implemented two of the key procedures at the
    three laboratories we reviewed.  More specifically:

      -- Few national security background checks are being performed on
         visitors from sensitive countries.  As a result, foreign
         nationals suspected by the U.S.  counterintelligence community
         of having foreign intelligence affiliations have been permitted
         access to the laboratories without the advance knowledge of
         appropriate officials.

      -- Because of unclear criteria regarding what constitutes sensitive
         subjects and the lack of an independent review process to
         examine the subjects to be discussed during visits, foreign
         visits involving potentially sensitive subjects--such as
         inertial confinement fusion, hydrodynamics codes,\1 and the
         detection of nuclear weapons tests--are occurring without DOE's
         knowledge.

    Without adequate knowledge about the foreign nationals who plan to
    visit its laboratories and the subjects to be discussed during those
    visits, DOE cannot take appropriate action to ensure that their
    visits are properly controlled.  This heightens the risk that such
    visitors may obtain, either directly through active intelligence
    efforts or indirectly through involvement in laboratory activities,
    information whose disclosure to certain countries would be
    detrimental to the United States.

    --------------------
    \1 Among other things, hydrodynamics codes are used for computer
    simulations to model the dynamic processes that occur in a nuclear
    weapon.

       DOE HAS LITTLE ADVANCE
       KNOWLEDGE ABOUT THE BACKGROUNDS
       OF MANY VISITORS FROM SENSITIVE
       COUNTRIES
    ---------------------------------------------------------- Chapter 2:1

    Background checks can provide DOE and its weapons laboratories
    advance warning of possible problems or concerns with a foreign
    visitor, and DOE's foreign visitor order contains requirements for
    obtaining background checks for visitors from sensitive countries.
    However, DOE granted two laboratories--Los Alamos and Sandia--a
    partial exception from complying with its requirements.  As a result,
    few background checks have been initiated for foreign visitors to
    those two facilities.

          BACKGROUND CHECKS ARE
          INTENDED TO HELP DOE
          MITIGATE THE RISKS OF VISITS
    -------------------------------------------------------- Chapter 2:1.1

    As part of its process to approve foreign visitors, DOE requires that
    national security background checks (termed indices checks by DOE) be
    conducted on certain foreign visitors to its laboratories.  Under
    DOE's order, background checks are required for all sensitive-country
    assignees (those whose visits will exceed 30 days).  Additionally,
    background checks must be proposed by the laboratories to DOE's
    Counterintelligence Division for short-term visitors from sensitive
    countries, but the division has the discretion to determine whether
    the background check should be done.  For example, the
    Counterintelligence Division may choose to request background checks
    on sensitive-country visitors who will be entering security areas or
    discussing sensitive subjects.  The checks are obtained from
    government intelligence and investigative agencies, such as the CIA
    and the FBI.  At DOE's request, these agencies review their files and
    report to DOE whether intelligence information of a derogatory nature
    exists about a particular visitor (e.g., that the visitor is
    suspected of having ties to a foreign intelligence service or
    terrorist group).  DOE's order also requires that some background
    checks--those considered necessary to approve a visit or
    assignment--be completed before the visit or assignment begins.  Many
    other checks done on visitors need not be completed before the visit
    begins--these are checks considered needed for counterintelligence
    research purposes only.

    Although DOE uses the results of these background checks to approve
    proposed visits and to help mitigate any risks related to them, the
    existence of derogatory information about a foreign visitor does not
    preclude a visit from occurring.  According to DOE officials, if a
    background check reveals derogatory information about a foreign
    visitor, the visit is rarely denied.  Instead, DOE allows the visit
    to occur but, depending on the results of the check and other
    factors, may increase the stringency of escort requirements or may
    restrict the length of the visit, the buildings to be accessed, or
    the subjects to be discussed.  Thus, the background check serves as
    means to forewarn DOE and laboratory officials of possible national
    security concerns so they may devise appropriate countermeasures
    where needed.

          FEW BACKGROUND CHECKS ARE
          PERFORMED ON
          SENSITIVE-COUNTRY VISITORS
          TO THE LOS ALAMOS AND SANDIA
          LABORATORIES
    -------------------------------------------------------- Chapter 2:1.2

    Few background checks are performed for visitors to DOE's Los Alamos
    and Sandia laboratories.  In August 1994, these laboratories
    implemented a partial exception from the foreign visitor order that
    was granted by DOE.  Under the terms of this exception, the two
    laboratories are required to request background checks only on those
    foreign visitors planning to enter a security area at the laboratory
    or to discuss sensitive subjects.  According to DOE and laboratory
    officials, the partial exception for Los Alamos and Sandia was
    granted because of the high volume of foreign nationals desiring to
    visit these weapons laboratories, which contributed to processing
    backlogs, and the costs associated with processing paperwork for
    foreign visitors.  Laboratory officials said the processing backlogs
    caused delays that resulted in some visits having to be canceled
    because of uncompleted background checks.

    The partial exception has limited the number of requests for
    background checks on visitors to Los Alamos and Sandia.  As a result,
    DOE obtains relatively few background checks on visitors to those
    laboratories, particularly in comparison to Livermore, which did not
    request an exception from the order's requirements.  Our review of
    DOE's records of foreign visitors showed that, during the 3-year
    period from 1994 through 1996, background checks were obtained on
    only 5 percent of the visitors from sensitive countries to Los Alamos
    and Sandia.  In contrast, Livermore requested checks on many more
    names during that timeframe, and background checks were obtained on
    44 percent of the visitors from sensitive countries to this
    laboratory.\2 Table 2.1 compares the number of background checks
    obtained on sensitive-country visitors for the three laboratories.

                                   Table 2.1

                    Background Checks That Were Obtained on
                       Sensitive-Country Visitors to DOE
                        Weapons Laboratories, 1994-1996

                                                   Number of
                                     Number of    background       Percent
    Facility                            visits        checks       checked
    ----------------------------  ------------  ------------  ------------
    Los Alamos                           2,714           139             5
    Livermore                            1,602           700            44
    Sandia                               1,156            53             5
    ======================================================================
    Total                                5,472           892            16
    ----------------------------------------------------------------------
    Source:  Compiled by GAO from DOE and laboratory data.

    Data on foreign visitors from individual sensitive countries also
    showed significant differences among the laboratories.  For example,
    46 percent of the Russian visitors to Livermore were checked during
    that 3-year period, compared to 10 and 7 percent, respectively, for
    Los Alamos and Sandia.  Furthermore, 39 percent of the Chinese
    visitors to Livermore were checked, compared to 2 and 1 percent,
    respectively, for Los Alamos and Sandia.  (See app.  III for numbers
    and percentages for all sensitive countries.)

    By checking the backgrounds of so few visitors from sensitive
    countries, particularly to Los Alamos and Sandia, DOE limits the
    collection of basic counterintelligence data and may be unknowingly
    allowing significant numbers of visitors with questionable
    backgrounds into its weapons laboratories.  According to FBI
    counterintelligence officials, the low percentage of background
    checks conducted on Russian and Chinese visitors to Los Alamos and
    Sandia does not constitute effective use of the background check
    process.  Statistics on the results of background checks DOE did
    request support this.  Of all the background checks DOE obtained on
    visitors from sensitive countries to the weapons laboratories during
    the 1994 through 1996 timeframe, about 4 percent of the checks that
    DOE received indicated the existence of derogatory information.

    Moreover, we noted during our review that people with suspected
    foreign intelligence connections were let into the laboratories
    without background checks.\3 We were able to document 13 instances
    where persons with suspected foreign intelligence connections were
    allowed access without background checks--8 visitors went to Los
    Alamos and 5 went to Sandia--during the 1994 through 1996 period.\4
    Available records also indicated that 8 other persons with suspected
    connections to foreign intelligence services were approved for access
    to Sandia during the period; however, DOE and Sandia lacked adequate
    records to confirm whether the persons actually accessed the
    facility.  Although we could not confirm that any of these visits
    compromised U.S.  security, at a minimum, the lack of a background
    check did not provide DOE the opportunity to implement
    countermeasures to mitigate the potential risk posed by these visits.
    Also, all of these instances occurred at the two weapons laboratories
    that had been granted a partial exception to DOE's foreign visitor
    order.

    DOE's requirements for national security background checks represent
    a continuing problem that we previously identified in a 1988 GAO
    report\5 and about which elements of the U.S.  intelligence community
    have also expressed concern.  In discussing this problem, DOE and
    laboratory counterintelligence officials said that they recognize
    that the number of background checks obtained on foreign visitors has
    been limited, especially at Los Alamos and Sandia, and that these
    checks should be routinely requested for visitors from sensitive
    countries.  They added that although data from a background
    check--even derogatory data--is rarely used to deny a visitor access
    to a laboratory, obtaining such information is beneficial in
    identifying individuals known to be a risk.  DOE headquarters
    counterintelligence officials said their long-term goal is to obtain
    background checks on all foreign nationals from sensitive countries
    that seek to visit any of these three laboratories.  In the interim,
    according to a Sandia counterintelligence official, that laboratory
    is now reporting data on all sensitive country visitors to DOE
    headquarters for potential background checks.

    --------------------
    \2 In addition, some names reported to headquarters did not result in
    checks because previous check results were on file at DOE
    headquarters and still current.

    \3 Despite the restrictions on our access to information, as
    discussed in chapter 1, we verified through the U.S.
    counterintelligence community that several of these visitors had
    known or suspected connections with foreign intelligence services.

    \4 We also identified instances of persons with suspected
    intelligence connections obtaining laboratory access before
    background checks were completed.

    \5 GAO/RCED-89-31, Oct.  11, 1988.

       DOE HAS NOT ADEQUATELY ENSURED
       THAT VISITS INVOLVING SENSITIVE
       SUBJECTS ARE IDENTIFIED AND
       REVIEWED
    ---------------------------------------------------------- Chapter 2:2

    DOE has little assurance that all visits during which sensitive, but
    unclassified, subjects will be discussed are identified and brought
    to the attention of DOE officials.  According to DOE's order, DOE
    officials are to review and approve visits by foreign nationals that
    involve sensitive subjects.  But DOE and laboratory personnel alike
    are unclear about what constitutes a sensitive subject, and little or
    no independent review takes place to assess subjects within the
    context of the planned visit (e.g., taking into account the purpose
    of the visit, the particular aspects of the subject to be discussed,
    and the foreign country and individuals involved).  As a result,
    sensitive information could be discussed or otherwise disclosed to
    foreign nationals without DOE's knowledge and approval.

          DOE REQUIRES THE
          IDENTIFICATION, REVIEW, AND
          APPROVAL OF VISITS INVOLVING
          SENSITIVE SUBJECTS
    -------------------------------------------------------- Chapter 2:2.1

    To minimize the risk of inappropriate subjects being discussed with
    foreign nationals, DOE's order requires that its laboratories
    identify any visit involving a sensitive subject for review and
    approval by DOE.  The order defines sensitive subjects as
    unclassified subjects involving information, activities, or
    technologies relevant to national security.  To facilitate their
    identification, the order contains a list of sensitive subjects,
    including nuclear weapons production and supporting technologies,
    nuclear explosion detection, inertial confinement fusion, production
    and handling of plutonium, and fuel fabrication.  Additionally, the
    order contains three criteria for identifying other subjects that may
    be sensitive.  Subjects are considered sensitive if they relate to
    technologies under export control, "dual-use" technologies that have
    both peaceful and military applications, or rapidly advancing
    technologies that may become classified or placed under export
    control.  Subjects in these categories include computer systems,
    component development, and software specifically designed for
    military applications; extremely high-energy, high-brightness lasers
    and particle beams; and high energy density batteries and fuel cells.

    The responsibility for reviewing visits involving sensitive subjects
    rests with DOE's Nuclear Transfer and Supplier Policy Division in the
    Office of Arms Control and Nonproliferation.  This division also
    reviews private-sector exports of information and technology that
    could be useful to a foreign nuclear or nuclear weapons-related
    program.  According to division officials, while the discussion of a
    sensitive subject with a foreign national is not necessarily
    prohibited, DOE needs to be aware of any such discussions to ensure
    their consistency with U.S.  policy regarding the transfer of that
    information to the foreign national's home country.  The officials
    added that the need for DOE's review and approval of the discussion
    of a sensitive subject is not dependent on the visitor's home
    country--the discussion of any sensitive subject with a foreign
    visitor from even a nonsensitive country still requires DOE's review
    and approval.

          IDENTIFICATION OF VISITS
          THAT INVOLVE SENSITIVE
          SUBJECTS HAS NOT BEEN
          ADEQUATE
    -------------------------------------------------------- Chapter 2:2.2

    DOE's three weapons laboratories have not adequately identified
    visits involving sensitive subjects.  Between January 1994 and July
    1996, they identified a total of 72 visits involving sensitive
    subjects; the majority of these visits were related to areas
    specified as sensitive in DOE's order.  For example, 5 Russian
    citizens visited Los Alamos in 1994 for a 3-day visit involving
    nuclear materials control, accounting, physical protection, security,
    export control, and critical assembly facilities; 13 Russian
    nationals visited Los Alamos in 1995 for a 1-day workshop on
    plutonium stabilization, storage, and disposition; and 30 French
    nationals visited Livermore in 1995 for 1- to 2-year assignments to
    work on inertial confinement fusion.

    However, our review of records on 167 other visits found numerous
    cases that pertained to subjects that were either specified as
    sensitive in DOE's order or were potentially sensitive but were not
    identified as such by the laboratories.  For example:

      -- Sixteen visits and assignments to Livermore involved inertial
         confinement fusion, a technology specifically listed as
         sensitive in DOE's order.  These visits included foreign
         visitors who were participating in a formal bilateral
         cooperative effort, including the transfer of proprietary data,
         between the United States and France on subjects related to
         inertial confinement fusion.  On other occasions, Livermore has
         identified this type of visit as involving a sensitive subject.

      -- A Canadian citizen was on an assignment to Livermore to discuss
         equation of state measurements\6 using laser-generated
         shock-waves--work that was acknowledged to be important to the
         inertial confinement fusion program, a sensitive subject area.

      -- An Indian citizen from a defense-related facility in India was
         on an assignment to Los Alamos that involved the structure of
         beryllium compounds.  Beryllium metal is used in nuclear
         weapons.

      -- An Indian citizen was on assignment to Los Alamos for work
         related to pattern recognition/anomaly detection algorithms.
         This work was acknowledged to be dual use in nature, with
         applications related to national security, such as
         nonproliferation and satellite image processing, as well as to
         nondefense projects.

      -- A Russian visit to Los Alamos involved collaboration on
         processes related to detecting unsanctioned nuclear weapons
         tests.  Nuclear explosion detection is specifically identified
         as a sensitive subject in DOE's order.

      -- A citizen of the United Kingdom was assigned to Livermore for
         3-dimensional hydrodynamic simulations for implosions.
         Hydrodynamics and 3-dimensional calculations are important to
         simulating nuclear weapons tests, particularly in light of the
         ban on nuclear testing.

    We reviewed copies of the documentation on these visits and discussed
    them with officials in DOE's Nuclear Transfer and Supplier Policy
    Division to obtain their perspectives on whether they may have
    involved sensitive subjects.  They said that it was not possible to
    fully ascertain whether these visits did or did not involve sensitive
    subjects; however, they pointed out that many of them appeared to
    involve subjects that are specifically identified as sensitive
    subjects in DOE's order and that others appeared to have some weapons
    or dual-use applications.  The export control officials said that,
    according to the stated purpose of the visits described in their
    documentation, they involved subjects that should have been sent for
    their review.

    --------------------
    \6 Equation of state measurements are used to assess how materials
    interact with their surroundings.

          PROBLEMS HINDERING THE
          IDENTIFICATION OF VISITS
          INVOLVING SENSITIVE SUBJECTS
    -------------------------------------------------------- Chapter 2:2.3

    DOE's weapons laboratories have had problems identifying visits
    involving sensitive subjects largely for two reasons--confusion over
    how to apply the sensitive subject criteria and the lack of an
    independent technical review of proposed foreign visits to identify
    those involving sensitive subjects.

    According to laboratory program managers and hosts of foreign
    visitors, DOE's criteria for identifying sensitive subjects are very
    broad and do not clearly define which activities are covered.  The
    laboratory managers added that the current list of sensitive subjects
    is outdated, incomplete, and does not establish reasonable parameters
    within which they could reasonably gauge a subject's sensitivity.  As
    an example of the difficulty in applying the criteria, they noted
    that while inertial confinement fusion is listed as a sensitive
    subject because of its relationship to nuclear weapons testing, most
    aspects of this technology are unclassified and widely researched
    throughout the world and that the laboratory's unclassified inertial
    confinement fusion work is published and freely disseminated.  They
    added that without more specific criteria from DOE, they generally
    view activities in inertial confinement fusion and other areas that
    are unclassified, already published, or will ultimately be published,
    to be nonsensitive.

    DOE officials with the Nuclear Transfer and Supplier Policy Division
    acknowledged that although there are difficulties in identifying
    sensitive subjects, the laboratories are interpreting the order's
    criteria too narrowly.  They said that the sensitivity of a subject
    may at times be subjective and it often depends on the country to
    which the information will be divulged, the state of that country's
    technology and research efforts, and other information on that
    country's needs and intentions regarding the use of the technology.
    However, they added that hosts are not in a position to know that
    information and/or whether it is consistent with U.S.  government
    policy to provide that information to the country in question.  The
    list of sensitive subjects serves as a guideline to identify such
    visits for scrutiny by DOE officials who possess the necessary
    expertise to determine whether it is appropriate to discuss a
    particular subject with a foreign visitor from a specific country.

    A second problem hindering the identification of visits involving
    sensitive subjects is the lack of an independent review of proposed
    visits by individuals with technical expertise to help ensure
    sensitive subjects are properly identified.  During the period of our
    review, DOE and the weapons laboratories relied upon the host--the
    laboratory employee sponsoring the foreign visitor--to accurately
    identify sensitive subject visits.  Such visits were approved by the
    appropriate laboratory division management and by officials in the
    foreign visits and assignments office at each laboratory.  However,
    little or no independent review of the subject of those visits had
    been conducted to ensure that sensitive subjects were not involved.
    At Sandia and Los Alamos, officials in the foreign visits and
    assignments office review requests for foreign visitor access;
    however, those individuals do not have a technical background or
    expertise to judge if a sensitive subject is involved.  At Livermore,
    visit requests are reviewed in the office of the laboratory director,
    as well as at the DOE operations office; however, this laboratory's
    review has at times been delegated to individuals from the foreign
    visits and assignments office.  Laboratory personnel from the foreign
    visits and assignments offices told us that they are not fully
    knowledgeable on activities that could be sensitive and that they
    generally rely on the host to determine whether a visit would involve
    a sensitive subject.

          DOE AND LABORATORIES
          RECOGNIZE PROBLEMS WITH
          IDENTIFYING VISITS INVOLVING
          SENSITIVE SUBJECTS
    -------------------------------------------------------- Chapter 2:2.4

    DOE and the weapons laboratories have recognized problems with
    identifying visits involving sensitive subjects and have begun
    actions to address them.  In the fall of 1996, DOE initiated a
    multiissue effort to revise its foreign visit and assignment order.
    This effort will include examining the controls over foreign visits
    involving sensitive subjects and developing a better process and/or
    criteria by which to identify them.  According to officials in DOE's
    Counterintelligence Division, which is involved in the effort, the
    revised order is expected to be issued by the end of 1997.  However,
    because revision of the criteria for identifying sensitive subjects
    has not yet gotten underway and does not have a timetable for
    completion, they do not know if changes to clarify DOE's criteria for
    identifying visits involving sensitive subjects will be included in
    the revised order.

    During our review, two of the three laboratories established interim
    local processes to examine requests for foreign visitors to better
    ensure that their visits do not involve discussions of sensitive
    subjects.  In August 1996, Livermore began requiring that all visits
    involving foreign nationals from sensitive countries be reviewed by
    an official in its Arms Control and Treaty Verification Program who
    has had experience with nuclear weapons and associated technologies.
    These reviews are specifically to assess the technology involved and
    identify those requests that involve sensitive subjects.  According
    to the Livermore official conducting these reviews, although most
    visits have not involved sensitive subjects, he has identified some
    visits of concern, for which actions were taken to help ensure that
    sensitive subjects would not be involved.  In December 1996 Sandia
    began requiring that all requests for foreign visitors be reviewed by
    a Sandia official involved in export control to better ensure visits
    involving sensitive subjects are adequately identified.

    SECURITY CONTROLS MAY NOT
    ADEQUATELY PROTECT SENSITIVE
    INFORMATION FROM FOREIGN VISITORS
    ============================================================ Chapter 3

    Effective security controls can greatly mitigate the risk inherent
    with the presence of foreign visitors at DOE's weapons laboratories.
    However, the security controls that exist in the laboratories'
    controlled areas--the areas most often visited by foreign
    nationals--may not provide effective protection.  The controlled
    areas contain unclassified, but sensitive information, and although
    security measures are used to control access, these measures are less
    stringent than those used in classified areas and their
    implementation varies among the laboratories.  Security problems and
    vulnerabilities involving foreign nationals show that classified
    and/or sensitive information has been, or potentially could be,
    compromised by foreign nationals in the controlled areas.
    Nevertheless, DOE has not fully assessed the effectiveness of its
    security measures to protect sensitive information in controlled
    areas.

       SECURITY REQUIREMENTS IN
       CONTROLLED AREAS
    ---------------------------------------------------------- Chapter 3:1

    To protect information from unauthorized disclosure or compromise,
    DOE and its laboratories use various levels of security that permit
    access for authorized individuals to certain areas.  Although some
    foreign visitors are allowed access to the more restrictive security
    areas where classified work is conducted, most foreign visits occur
    in designated controlled areas--often termed property protection
    areas--which may contain unclassified sensitive information.  A lower
    level of security is provided in these areas, and the controls used
    vary among the laboratories.

          MOST FOREIGN VISITORS WORK
          IN CONTROLLED AREAS
    -------------------------------------------------------- Chapter 3:1.1

    DOE and the laboratories use a multilevel, graded security approach
    to limit access and protect information at their facilities.  Open
    areas, which include locations on laboratory property to which the
    general public is allowed access, receive a low level of protection.
    Open areas can include cafeterias, visitors centers, and museums.
    Controlled areas, which receive a higher level of protection, can
    include small areas, such as an individual building, as well as
    larger areas, such as building complexes.  Access to these areas is
    controlled because of the presence of valuable property or
    unclassified sensitive information, but no classified work is
    conducted in these locations.  Unclassified sensitive information
    includes information that has been designated Official Use Only,
    proprietary, export controlled, Privacy Act, and Unclassified
    Controlled Nuclear Information.

    An even higher level of protection and stricter access limitations
    are maintained for security areas containing classified information
    and technologies or in which nuclear weapons or other classified
    research is conducted.  These areas are closely monitored and
    patrolled, and controls traditionally include guns, guards, and
    gates.  Specific security plans must be developed and approved before
    any foreign visitor is allowed access to these areas and the visitor
    must be escorted at all times.

    Most foreign visitors to the weapons laboratories are granted access
    to the controlled areas.  Laboratory records show that on average
    only about 5 to 10 percent of all foreign visitors are permitted into
    security areas where classified work is performed, and according to
    DOE and laboratory officials, such access is usually for a short
    period of time.  The remaining visitors are either allowed into the
    controlled areas or meet with laboratory employees in open areas.
    DOE and laboratory officials were not able to identify the percentage
    of those visitors that went to controlled areas, but stated that most
    were allowed into these locations.

          SECURITY CONTROLS VARY AMONG
          THE LABORATORIES
    -------------------------------------------------------- Chapter 3:1.2

    Because valuable property and information that is unclassified, but
    sensitive, is located in controlled areas, DOE requires the
    laboratories to protect these areas through the use of a variety of
    security controls.  Controls used to reduce the risks posed by
    foreign nationals in controlled areas include the following:

      -- A distinctive identification badge must be worn by foreign
         visitors at all times.

      -- Access is controlled by automated devices or by receptionist
         staff and manual visitor logs.  Automated devices include
         equipment that reads encoded access cards and/or requires
         passwords.

      -- Standard or "generic" security plans are drafted for controlling
         foreign visits in the area.

      -- A host is designated, who is a laboratory employee responsible
         for the activities of the foreign national while at the
         laboratory.  A visitor or assignee is not permitted to be a
         host.

      -- Random searches are conducted on vehicles or hand-carried items
         entering or leaving the area.

    Among the three laboratories, however, the security controls
    associated with foreign visitors in controlled areas are not
    consistently applied.  In particular, each of the laboratories has
    different requirements for allowing foreign visitors after-hours
    access.  At Livermore, foreign visitors are not allowed unescorted
    after-hours access to controlled areas without the specific written
    approval of laboratory security officials and the concurrence of the
    local DOE field office.  According to Livermore security officials,
    while they have granted such access for some foreign visitors, they
    do not approve unescorted after-hours access for visitors from
    sensitive countries.

    At both Los Alamos and Sandia, unescorted after-hours access to
    controlled areas has been permitted.  These laboratories have
    required the host to monitor the foreign visitor--that is, be aware
    of the foreign visitor's location and activities--but not necessarily
    be physically present.  Recently, Sandia revised its after-hours
    access policy.  In November 1996, Sandia no longer allowed foreign
    nationals to have unescorted after-hours access to controlled areas
    without the approval of its counterintelligence office.  According to
    Sandia and DOE officials, this change was made because of the
    potential for security problems that could result from unescorted
    access.  Los Alamos, however, continues to allow unescorted
    after-hours access to preserve what one official described as an open
    "campus atmosphere" for researchers at its facilities.

    Laboratory policies also vary regarding random searches in controlled
    areas and the appearance of foreign visitor identification badges.
    While all of the laboratories officially permit random searches in
    controlled areas, at one of the laboratories such searches are
    discouraged during normal work hours.  Additionally, the distinctive
    color and wording of badges for foreign visitors differ among the
    laboratories.  For example, at Livermore those badges are white (for
    visits) or red (for assignments), at Los Alamos badges for foreign
    visitors are red, and at Sandia those badges are gray.  Furthermore,
    unlike the badges at the other laboratories, Sandia's badges contain
    no wording pertaining to the visitors' countries of citizenship or
    indicating that the wearers are not U.S.  citizens.

    Finally, neither Los Alamos nor Sandia has developed security
    plans--even generic ones--for foreign nationals who will be in
    controlled areas.  The DOE order governing unclassified foreign
    visits and assignments identifies security plans as the basic means
    by which vital information is protected and requires they be
    developed.  However, DOE and laboratory officials told us that
    because of the exception granted by DOE to these two
    laboratories--which also streamlined requirements for background
    checks and visit approvals--security plans are no longer required for
    visits to controlled areas.  Livermore has not sought such an
    exception and requires a generic security plan for all foreign
    visitors to its controlled areas.

       SECURITY VULNERABILITIES AND
       PROBLEMS HAVE INVOLVED FOREIGN
       VISITORS
    ---------------------------------------------------------- Chapter 3:2

    Available data from the weapons laboratories showed that the
    sensitive information in controlled areas has been vulnerable to
    compromise.  Between 1991 and 1997, laboratory security assessments
    and records identified vulnerabilities and problems involving foreign
    visitors, and in buildings and programs to which those visitors had
    access.  Records of vulnerabilities and problems included improper
    releases of information and failures to follow security controls and
    requirements.

          IMPROPER RELEASES OF
          INFORMATION
    -------------------------------------------------------- Chapter 3:2.1

    Assessments and records from all three laboratories indicated
    vulnerabilities and problems involving the improper release of
    unclassified sensitive information and classified information in
    unclassified settings.  In most of these cases, the information was
    actually or potentially available to foreign visitors.  Whether or
    not a laboratory employee personally hosts a foreign visitor, all
    laboratory employees must adequately protect classified or
    unclassified sensitive information and not disclose it unless
    authorized.  However, examples of improper releases included the
    following:

      -- Unclassified sensitive documents and materials had been
         improperly discarded in trash, recycling bins, or hallways.  At
         one of the laboratories, six boxes of papers marked "sensitive
         material" in red letters on the outside were left in an open
         hallway in an area accessible to foreign visitors.

      -- At one of the laboratories, a division's open-access newsletter,
         which was accessible to the foreign visitors it was hosting,
         provided information on corporate and laboratory research
         agreements, the development of certain computer codes, and DOE's
         nuclear program.

      -- Classified information had been inadvertently divulged by
         laboratory employees during unclassified workshops or
         conferences to foreign visitors, some of whom were from
         sensitive countries.

      -- A departmental newsletter containing classified information was
         sent to 24 uncleared individuals, 11 of whom were foreign
         visitors.  Some of the foreign visitors were from a sensitive
         country.

          FAILURES TO FOLLOW SECURITY
          REQUIREMENTS AND CONTROLS
    -------------------------------------------------------- Chapter 3:2.2

    Vulnerabilities and problems associated with employees' failures to
    follow security requirements and controls were also identified in the
    laboratories' records.  The following are several examples:

      -- In one case, a laboratory employee in a building to which
         foreign visitors had access failed to question the unauthorized
         removal, by members of a security assessment team during a test
         exercise, of a complete computer system from a controlled area.
         The employee did not challenge the team's activities despite the
         fact that its members were not wearing identification badges and
         were openly discussing plans to remove additional machines and
         equipment in an effort to appear suspicious.

      -- On 10 separate occasions, a laboratory employee hosted visitors
         from sensitive countries without following visit approval
         requirements or gaining appropriate authorizations prior to
         those visits.  Another host at the same laboratory met foreign
         visitors off-site without proper approval after a laboratory
         official advised him that he could "receive a reprimand, but it
         would not jeopardize his security clearance."

      -- In another case, a host, when confronted with a requirement to
         limit after-hours laboratory access of certain sensitive country
         assignees assisting him with his research, moved the visitors
         and his research to an off-laboratory location.

      -- On several occasions, there were miscellaneous failures to
         follow security procedures, including computers left on and
         unattended without password protection, improper escorting of
         foreign visitors who required such oversight, and unauthorized
         back door entry to controlled areas where many foreign visitors
         had access.

    DOE and laboratory security officials told us that they are concerned
    about, but not surprised by, vulnerabilities and problems in
    controlled areas.  The openness under which unclassified research
    programs operate poses a dilemma in an age of economic
    competitiveness.  DOE's own security awareness literature states that
    although many employees realize the importance of protecting
    classified information, few are aware of the significance of
    unclassified sensitive and proprietary information.  Furthermore, DOE
    and laboratory security officials told us that the security
    consciousness of employees working in controlled areas is more
    relaxed than in security areas where classified research is
    conducted.  While some security officials said that they would like
    to see a stronger emphasis on security in controlled areas at the
    laboratories, others said that some technical and research staff do
    not place a high priority on security and actually see it as an
    impediment to their work.

       PROTECTION OF SENSITIVE
       INFORMATION IN CONTROLLED AREAS
       HAS NOT BEEN FULLY ASSESSED
    ---------------------------------------------------------- Chapter 3:3

    Neither the laboratories nor DOE has fully assessed the controls over
    unclassified, but sensitive information.  At the laboratories,
    operations security (OPSEC) assessments are performed to identify
    vulnerabilities.  However, only at Sandia has there been an
    assessment that specifically focused on controls over unclassified
    sensitive information in controlled areas to which foreign visitors
    have access.  Furthermore, while DOE has assessed overall laboratory
    security operations on a regular basis, its assessments have not
    addressed the protection of unclassified sensitive information in
    controlled areas.

    DOE requires the use of OPSEC techniques and measures to help protect
    information and activities related to national security and
    government interests.  The purpose of OPSEC is to disrupt or defeat
    the ability of foreign intelligence or other adversaries to acquire
    sensitive or classified information and to prevent the unauthorized
    disclosure of such information.  Each of the laboratories has an
    OPSEC program and uses OPSEC assessments to identify security
    vulnerabilities associated with specific laboratory facilities or
    programs.  To identify vulnerabilities, OPSEC personnel assess
    various practices, including physical security and access controls;
    visitor log and escort procedures; availability of sensitive
    information on bulletin boards, in meeting rooms, and in offices;
    document disposal and destruction methods; and computer access
    protections.

    While all three laboratories have performed OPSEC assessments, only
    Sandia has conducted an assessment specifically focused on controls
    over unclassified sensitive information in controlled areas to which
    foreign visitors have access.  Sandia's assessment was completed in
    March 1997, and although it found no indication that the laboratory
    had allowed foreign visitors to compromise proprietary or sensitive
    information, it concluded that Sandia needed to define a policy
    concerning areas and information sources to which foreign nationals
    should have access.  Subsequently, Sandia changed the process for
    controlling foreign visitors' access to, and work in, controlled
    areas.  Foreign nationals visiting Sandia for more than 30 days now
    work in "export controlled zones"--locations within controlled areas
    where they can work with their respective project teams but are
    restricted from unauthorized access to research in the surrounding
    area.

    OPSEC assessments at Livermore or Los Alamos have not yet examined
    foreign visitors' access to sensitive information.  Livermore's past
    OPSEC assessments have dealt with visitors in general, but have not
    specifically addressed foreign visitors and the potential for them to
    access sensitive information.  Livermore's OPSEC manager said that
    the laboratory plans to conduct two such assessments before the end
    of 1997.  Similarly, Los Alamos' OPSEC assessments have included some
    issues related to foreign visitors, such as their access to open and
    secure areas, but they have not focused on assessing whether foreign
    visitors could obtain sensitive information.

    In addition to the laboratories' OPSEC assessments, DOE does broader
    periodic surveys of their security operations, including visits and
    assignments involving foreign nationals that are intended to be
    comprehensive assessments of each laboratory's security operations.
    Generally, DOE's surveys are performed every year or two, depending
    on the findings of the previous survey for a specific laboratory.
    The most recent surveys at Los Alamos and Sandia were completed in
    March and April of 1997, respectively.  The most recent survey of
    Livermore's program was completed in August 1996.  In these surveys,
    each of the laboratory's foreign visits and assignments program was
    rated satisfactory.  However, the primary focus of these surveys was
    on the program's organization, management, and operations, and not on
    information protection.  As a part of DOE's past surveys, each
    laboratory's program was evaluated by conducting interviews,
    reviewing documentation, and testing performance.  The surveys did
    not address protection of unclassified sensitive information in
    controlled areas--in general or in association with foreign visitors.
    For example, while several sections in the survey report on security
    at Livermore addressed the effectiveness of its controls over
    classified information, none addressed the adequacy of protections
    for unclassified sensitive information.

    DOE'S COUNTERINTELLIGENCE EFFORTS
    CAN BE IMPROVED
    ============================================================ Chapter 4

    DOE's headquarters and field counterintelligence programs are an
    important part of its defense against foreign espionage efforts at
    the nuclear weapons laboratories.  Foreign visitors to these
    laboratories have open, often long-term, access to personnel with
    detailed knowledge and expertise in classified and/or sensitive
    matters.  Although this situation is viewed by counterintelligence
    experts as an ideal opportunity for foreign intelligence-gathering
    efforts, DOE has not comprehensively assessed the threat of foreign
    intelligence against the laboratories.  A thorough assessment that
    identifies countries of concern, the technologies and the information
    these countries are seeking, and the programs that are likely to be
    targets of foreign intelligence, is important for DOE and its
    laboratories to understand and reduce the dangers posed by foreign
    visitors.  Furthermore, DOE has not developed any meaningful
    programmatic measures by which to evaluate the effectiveness of the
    laboratories' counterintelligence programs nor has it periodically
    evaluated them.  Recently, DOE initiated several actions to
    strengthen the counterintelligence programs, both at headquarters and
    at the laboratories.

       DOE'S HEADQUARTERS AND
       LABORATORY COUNTERINTELLIGENCE
       PROGRAMS
    ---------------------------------------------------------- Chapter 4:1

    The mission of DOE's counterintelligence programs is to implement
    effective defensive efforts departmentwide to deter and neutralize
    foreign government or industrial intelligence activities in the
    United States directed at or involving DOE.  DOE's headquarters
    Counterintelligence Division, within the Office of Energy
    Intelligence, has overall responsibility for this mission and
    counterintelligence activities throughout DOE.  Staffed with seven
    DOE employees and seven contract employees, DOE's Counterintelligence
    Division is responsible for such activities as conducting various
    threat assessments and identifying foreign intelligence activities
    directed against DOE as well as overseeing each laboratory's
    counterintelligence program.  DOE's threat assessments can vary from
    a comprehensive threat assessment DOE-wide to a narrowly focused
    threat assessment that examines a specific issue, such as a
    particular foreign country's interest in DOE's assets.  DOE's
    Counterintelligence Division is responsible for implementing
    counterintelligence policies and procedures throughout DOE.  This
    responsibility includes (1) developing and implementing methods,
    techniques, standards, and procedures for DOE's counterintelligence
    activities; (2) establishing a briefing and debriefing program for
    foreign travel and contacts; and (3) monitoring visits and
    assignments of foreign visitors to all of DOE's facilities.\1

    Each laboratory has its own counterintelligence program, which is
    conducted in compliance with DOE's requirements, and laboratory
    counterintelligence officers report directly to laboratory
    management.  The laboratories' programs emphasize employee briefings
    and debriefings as well increasing employees' awareness and knowledge
    about counterintelligence.  Briefings and debriefings of employees
    take place prior to and/or after an event (e.g., when hosting a
    foreign visitor or when taking a foreign trip).  In briefings,
    counterintelligence officers provide information to employees on such
    concerns as the types of subjects to avoid discussing with foreign
    visitors.  In debriefings, these officers obtain information from the
    employees that can help DOE determine if there are indications that
    intelligence services are trying to target that laboratory or its
    staff.\2 Additionally, counterintelligence activities at each
    laboratory include initial investigations of possible foreign
    intelligence efforts to determine if referral to appropriate federal
    agencies would be warranted, liaison with federal agencies, and
    gathering and recording such basic counterintelligence information as
    foreign visitors' activities at a laboratory and persons contacted.

    DOE officials estimate that operating the headquarters
    counterintelligence program costs about $1.8 million annually.  For
    fiscal year 1996, DOE's three weapons laboratories had a total
    counterintelligence program funding of $905,000 and 9.4
    counterintelligence staff years--funding of $552,000 and 5.5 staff
    years at Livermore, funding of $100,000 and 1.1 staff years at Los
    Alamos, and funding of $253,000 and 2.8 staff years at Sandia.\3

    --------------------
    \1 In addition, DOE field offices have counterintelligence program
    managers who are responsible for conducting a counterintelligence
    awareness program and providing briefings and debriefings related to
    foreign visitors and foreign travel.

    \2 Briefings and debriefings are not conducted for all events;
    counterintelligence officers judgmentally sample from the universe of
    events, according to such factors as the visitor's country of origin
    or the subjects to be discussed.

    \3 Numbers for Sandia include its laboratories in New Mexico and
    California.

       DOE HAS NOT CLEARLY DEFINED THE
       THREAT POSED BY FOREIGN
       VISITORS TO ITS LABORATORIES
    ---------------------------------------------------------- Chapter 4:2

    To understand the dangers posed by foreign visitors, DOE needs to
    perform a comprehensive assessment of the threat to its laboratories
    by foreign intelligence services.  According to DOE and the FBI, the
    operation of an effective counterintelligence program is predicated
    upon a realistic and comprehensive examination of the foreign
    intelligence and insider threats.  For example, according to the FBI,
    only a comprehensive threat assessment can address the issue of
    whether foreign intelligence services are making a concerted effort
    to target DOE laboratories, and if so, how they can work together to
    counter the threat.  This threat assessment can also provide senior
    managers with an analysis of the global threat and the information
    and technologies at DOE and the laboratories that are most at risk.

    Specific assessments, which are targeted studies that focus on
    country-specific issues, and annual foreign visitor statistical
    studies are also important because they can inform the laboratories
    about items of counterintelligence concern.  This information can
    then be used by counterintelligence officers at each laboratory to
    mitigate the potential risk to that laboratory and its employees.
    For instance, information contained in these studies can be used to
    alert a laboratory's senior management and staff during briefings.

    While DOE officials recognize the importance of both types of
    assessments, DOE headquarters' counterintelligence analysis has
    focused on the specific-type assessments and has not addressed the
    overall threat to its facilities.  In recent years, DOE has done
    about 25 specific assessments, which have examined specific threats
    or, in some cases, have been statistical studies.  For example, DOE
    has assessed the threat of Russian organized crime to DOE and
    Pakistan's access to DOE's resources.  In many cases, such studies
    were based on the work of other agencies, such as the CIA or FBI, or
    were contracted out.  While these studies can be useful in
    identifying a threat on a single issue, they do not relate the global
    foreign intelligence threat to the local situation at a specific
    weapons laboratory.

    DOE counterintelligence officials at headquarters said that they need
    to do a comprehensive threat assessment that relates the global
    foreign intelligence threat to the laboratories, but they have been
    limited in their ability to do so.  They said that specific threat
    assessments have had a higher priority because these studies meet the
    more immediate needs of the laboratories.  Moreover, DOE's
    Counterintelligence Division has not had the staffing or analytical
    expertise required for this effort.  In this regard, DOE's
    counterintelligence officials said that they will need to rely on
    information from other agencies to do a comprehensive threat
    assessment.

    Recognizing the need for a comprehensive threat assessment, in the
    fall of 1996 the then Deputy Secretary of Energy directed each of the
    weapons laboratories to conduct its own threat assessment, which DOE
    would then use to develop an overall, comprehensive threat
    assessment.  Although the laboratories are in the process of
    completing their site threat assessments, according to a DOE
    counterintelligence official, the Department may not be able to
    develop a comprehensive assessment unless its priorities change and
    DOE receives assistance from the U.S.  intelligence agencies in
    obtaining the sensitive intelligence information that is critical to
    develop this assessment.

       DOE HAS NOT EFFECTIVELY
       OVERSEEN THE LABORATORIES'
       COUNTERINTELLIGENCE PROGRAMS
    ---------------------------------------------------------- Chapter 4:3

    Oversight of the laboratories' counterintelligence programs and their
    activities--particularly setting expectations for program performance
    and periodically evaluating it--is one of the major responsibilities
    of DOE's Counterintelligence Division.  However, DOE has not
    developed meaningful performance measures or expectations for the
    laboratories' counterintelligence programs or conducted periodic
    evaluations of them.  DOE's oversight, however, has been hampered, in
    part, because the funding for their programs has been through
    laboratory overhead accounts instead of directly from DOE.

    Meaningful performance measures for the laboratories'
    counterintelligence programs are important because they would help
    gauge whether or not those programs are achieving their intended
    purposes.  According to DOE Order 5670.3, Counterintelligence
    Program, DOE is responsible for developing and implementing
    performance measures for counterintelligence activities throughout
    the Department.  However, according to a counterintelligence official
    at headquarters, DOE has not developed any performance measures or
    expectations to evaluate the laboratories' counterintelligence
    programs because DOE's contracts with the laboratories do not
    obligate their counterintelligence programs to follow any such
    measures DOE may develop.  According to this official, DOE is
    considering both amending those contracts to address this problem and
    issuing guidance and policy to define performance measures and
    expectations for the laboratories to follow and be evaluated against.
    This will be done after DOE completes its comprehensive threat
    assessment.

    DOE's periodic evaluations of the laboratories' counterintelligence
    programs are also important because they help provide assistance to
    each laboratory as well as determine the effectiveness of their
    programs.  DOE's counterintelligence order requires that the
    headquarters Counterintelligence Division oversee the implementation
    of counterintelligence policy and procedures at the laboratories.
    However, officials from that division could identify only one review
    it has conducted at the weapons laboratories, which occurred in 1996
    in the form of a "staff assistance visit" conducted at Los Alamos.
    DOE concluded from this visit that because of inadequate staffing,
    Los Alamos' counterintelligence program was not comprehensive and
    only minimally accomplished the requirements of DOE's
    counterintelligence order.  At that time, Los Alamos had one
    counterintelligence officer.

    Livermore and Sandia have not had their counterintelligence programs
    reviewed by DOE headquarters.  According to a DOE official,
    evaluations at Livermore and Sandia have not occurred because of
    other higher-priority work, such as the specific type of threat
    assessments mentioned earlier.  In addition, they said that DOE
    cannot require its laboratories to implement any recommendations that
    might result from such evaluations.  Without periodic evaluations of
    all their counterintelligence programs, assessing their effectiveness
    and objectively comparing one program with another will be difficult.

    One factor that makes control by DOE headquarters over the
    laboratories difficult is that the counterintelligence programs are
    not funded directly by DOE's Counterintelligence Division.  Until
    recently, each laboratory's program has been funded entirely from
    that laboratory's funds and, consequently, each laboratory operated
    its program autonomously.  Accordingly, each laboratory's commitment
    to its program has differed, as illustrated by the difference in
    staffing levels.  For example, while Livermore's counterintelligence
    program had 5.5 staff years in 1996, Los Alamos' program had only 1.1
    staff years, despite having almost twice as many visitors from
    sensitive countries.\4

    According to the FBI, which has examined DOE's counterintelligence
    program, the structure of DOE and its relationship with
    contractor-operated laboratories have resulted in their having
    assumed a high degree of autonomy.  This has resulted in a gap
    between authority and responsibility, particularly when national
    interests compete with the specialized interests of the academic or
    corporate management that operate the laboratories.  Furthermore, the
    FBI found that this autonomy has made national guidance, oversight,
    and accountability of the laboratories' counterintelligence programs
    arduous and inefficient.  Moreover, DOE's Counterintelligence
    Division lacks direct management oversight and control to ensure the
    laboratories comply with its policies.  This frequently puts the each
    laboratory's counterintelligence staff in an awkward, if not
    difficult, situation of dividing their loyalties between the
    interests of the laboratory in pursuing cutting-edge research and
    development and the need to safeguard U.S.  national security
    interests.

    --------------------
    \4 Although both laboratories had equivalent numbers of foreign
    visitors (about 2,800), Los Alamos had nearly 1,000 visitors from
    sensitive countries, while Livermore had about 550 such visitors.

       DOE IS TAKING STEPS TO
       STRENGTHEN ITS
       COUNTERINTELLIGENCE PROGRAM
    ---------------------------------------------------------- Chapter 4:4

    DOE has recently recognized that its counterintelligence program has
    been inadequate and has taken steps to strengthen it.  The Congress
    appropriated $5 million to DOE in counterintelligence funding for
    fiscal year 1997 in addition to its budget request, and DOE has used
    much of these funds to support the counterintelligence programs at
    the weapons laboratories.\5 In November 1996, DOE's Deputy Secretary
    expressed concerns about the presence of foreign visitors at the
    laboratories, and as a result, several departmentwide corrective
    actions are now underway.

    In the spring of 1996, the director of DOE's Office of Energy
    Intelligence briefed the staff of several congressional committees
    about the concerns raised by the increasing number of foreign
    visitors to its laboratories and the threat they posed.  In the fall
    of that year, the Congress provided DOE with an additional $5 million
    for fiscal year 1997 to expand counterintelligence activities at its
    weapons laboratories and other high-risk facilities.  Of the $5
    million, about half--$2.47 million--went to the three nuclear weapons
    laboratories.\6 The additional funds were used to increase the number
    of counterintelligence staff at those laboratories and for
    counterintelligence-related analyses.  As a result, DOE has increased
    the counterintelligence staff at the weapons laboratories.

    On November 21, 1996, the then Deputy Secretary of Energy initiated
    several corrective measures to improve DOE's foreign visitors
    program.  The Deputy Secretary met with officials of five DOE
    facilities:  the three weapons laboratories, the Oak Ridge National
    Laboratory, and the Pacific Northwest Laboratory.  Among the
    corrective measures the Deputy Secretary and these officials agreed
    to complete during fiscal year 1997 were the following:

      -- Develop training in export control and provide that training to
         laboratory staff at those five facilities.

      -- Develop new guidance on unclassified, but sensitive, subjects
         (i.e., matters unsuitable for discussion with a foreign
         visitor).

      -- Develop laboratory threat assessments of foreign visits and
         assignments.

      -- Develop a DOE-wide comprehensive threat assessment of foreign
         visits and assignments.

    However, counterintelligence officials at headquarters expressed
    concerns about DOE's ability to complete these initiatives because
    DOE has historically given its counterintelligence program a low
    priority and the tendency for the laboratories to resist headquarters
    management.  They said that they are hopeful that DOE's current
    Secretary will support these initiatives in the counterintelligence
    program.

    --------------------
    \5 On April 25, 1997, we reported to the Committee about DOE's use of
    the $5 million.  Department of Energy:  Information on the
    Distribution of Funds for Counterintelligence Programs and the
    Resulting Expansion of These Programs, GAO/RCED-97-128R.

    \6 An additional $1.27 million went to five other facilities; the
    remainder ($1.26 million) was spent on counterintelligence analysis
    and assessment studies.  When the $5 million was made available,
    however, some facilities reduced or eliminated the funding they had
    previously provided for counterintelligence and over $1 million was
    allocated to facilitywide support costs.

    CONCLUSIONS AND RECOMMENDATIONS
    ============================================================ Chapter 5

    With the end of the Cold War, DOE's nuclear weapons laboratories have
    been moving away from secret research toward more open and
    cooperative research with a variety of nations and an increasing
    number of foreign nationals.  Open collaboration can greatly benefit
    DOE and the United States by stimulating the exchange of ideas and
    promoting cooperation.  This in turn can lead to more efficient
    research and increase the likelihood of important scientific
    discoveries.  While recognizing that such cooperation is beneficial,
    it is important to note that foreign espionage efforts against DOE's
    weapons laboratories may be more active than ever.  Furthermore,
    these efforts may have expanded to include industrial espionage.  All
    of this puts new burdens on DOE's security.

    To respond to these challenges, DOE cannot entirely rely on systems
    left over from the Cold War.  For a long time, DOE's security
    controls have emphasized "guns, guards, and gates," as well as strict
    control over anyone, including foreign visitors, allowed to enter the
    weapons laboratories.  Where visitors went, whom they talked to, and
    what they saw were more carefully controlled than they are today.
    These controls, while still necessary in some places, cannot be
    expected to work in locations where openness, collaboration, and free
    access to information and ideas are encouraged.  In these places, DOE
    needs a more sophisticated security strategy that is consistent with
    the laboratories' more open missions and includes a greater role
    played by DOE and laboratory counterintelligence programs.

    Now more than ever, effective counterintelligence efforts must be
    central to DOE's security strategy.  Greater counterintelligence
    program effectiveness can be achieved through the development of a
    comprehensive threat assessment to determine the nature, extent, and
    targets of foreign espionage efforts against DOE's weapons
    laboratories.  Such an assessment could also form the basis for
    developing counterintelligence program performance measures as well
    as periodic headquarters evaluations of each laboratory's
    performance.  These evaluations would determine how effectively each
    laboratory is addressing the established performance measures and how
    their counterintelligence programs can be improved.

    In addition to establishing performance measures for DOE's
    counterintelligence program, other parts of the overall strategy
    could be improved by clarifying what constitute sensitive subjects,
    tightening procedures for background checks, and reassessing
    procedures for foreign visits to controlled areas.  For example,
    clarifying what subjects are sensitive and requiring an independent
    review by technically qualified personnel of all subjects proposed
    for discussion during a visit would help ensure that researchers,
    program managers, and DOE headquarters officials would have the same
    understanding of what needs to be protected so discussions of
    sensitive subjects would not occur without the knowledge of DOE.  DOE
    and laboratory officials recognize the problems with identifying
    sensitive subjects and have established internal review processes to
    better focus on those foreign visits that involve sensitive subjects.
    However, without a clear understanding of what information DOE
    considers sensitive, these improved review processes cannot provide
    adequate assurance that foreign visits involving sensitive subjects
    are appropriately identified and reviewed.

    Increasing the number of background checks on foreign visitors from
    sensitive countries will enable DOE to better assess individual
    situations from a security point of view.  When necessary, actions
    can then be taken to mitigate the risks of a particular visit.  While
    background checks cannot identify all foreign visitors who pose a
    risk, they are a valuable tool for alerting DOE and the laboratories
    of situations that may warrant more attention and control.  DOE's
    current foreign visitor order contains requirements that would
    increase the number of background checks obtained; enforcing those
    requirements at the laboratories, especially at Los Alamos and
    Sandia, should enable DOE to expand its advance knowledge of risks
    associated with the visits and, if necessary, mitigate those risks.

    Finally, a specific assessment of vulnerabilities related access to
    unclassified, but sensitive information in controlled areas is
    needed.  This assessment will help ensure that procedures for these
    areas are consistent from laboratory to laboratory and security
    vulnerabilities and/or problems are identified and corrected.  In
    addition, this assessment could identify best practices that DOE
    could disseminate for use to all laboratories for improving the
    protection of sensitive information that may be exposed to foreign
    visitors.

       RECOMMENDATIONS
    ---------------------------------------------------------- Chapter 5:1

    We recommend that the Secretary of Energy:

      -- Direct DOE's Counterintelligence Division to perform a
         comprehensive assessment of the espionage threat against DOE and
         the weapons laboratories to serve as the basis for determining
         appropriate countermeasures and resource levels for laboratory
         counterintelligence programs.  To the extent possible, this
         assessment should include the laboratories as well as other
         agencies with appropriate expertise, such as the FBI and CIA.

      -- Establish appropriate program performance measures and
         expectations for the laboratories' counterintelligence
         activities and require periodic performance reviews to help
         determine if their activities are effectively preventing foreign
         espionage.

      -- Revise DOE's foreign visitor order to (1) clarify to all DOE and
         laboratory contractor personnel the specific types of
         unclassified, but sensitive, subjects that require protection
         from compromise by foreign nationals and (2) require that the
         subjects of visits be independently reviewed by experts with
         appropriate technical backgrounds--such as laboratory
         individuals involved in export control issues--to verify that
         visits involving sensitive subjects are adequately identified
         for DOE's review.

      -- Require that DOE and the weapons laboratories comply with the
         current foreign visitor order by obtaining background checks on
         all assignees from sensitive countries.  Further, require the
         laboratories to inform headquarters of the names of all other
         proposed foreign visitors from sensitive countries so DOE's
         Counterintelligence Division can obtain additional background
         checks at its discretion.

      -- Require that security measures at each laboratory's controlled
         areas--those most accessible to foreign visitors--be assessed to
         ensure that the controls over persons and information in these
         areas are effective.  This assessment should also identify the
         best practices at each laboratory to improve protection of
         sensitive information that may be exposed to foreign visitors.

       DOE'S COMMENTS AND OUR RESPONSE
    ---------------------------------------------------------- Chapter 5:2

    DOE had no comments on the general nature of the facts in the report
    and concurred with our recommendations.  The Department, however,
    believes that the report overstates the value of background checks on
    foreign visitors.  DOE believes that foreign intelligence services
    increasingly rely on "non-official collectors"--who would have clear
    background checks--instead of intelligence officers.  We do not
    believe we are overvaluing background checks.  We recognize that
    these checks are but one factor DOE considers in approving foreign
    visits.  Nevertheless, the information obtained through background
    checks can be of importance in determining if additional risk is
    associated with a foreign visitor.  Consequently, we are recommending
    that DOE complete background checks in accordance with its foreign
    visits and assignments order.

    DOE also suggested that we revise our recommendation on the
    assessments of information security in controlled areas.  A key point
    in DOE's suggested revision was to have the recommendation specify
    that an operations security assessment be done of each laboratory's
    controlled areas, whereas we recommended only that an assessment be
    done.  We did not revise our recommendation to specify this type of
    assessment because, while we believe that operations security
    principles and personnel must be part of any assessment of the
    laboratories' controlled areas, other elements of DOE's security
    programs can also provide value in an assessment.  We do not want to
    be overly prescriptive on how and/or by whom these assessments be
    done.  DOE also suggested that the wording of the recommendation more
    clearly focus on protecting sensitive information.  We revised the
    recommendation to clarify that the assessments should identify the
    best practices to improve the protection of sensitive information.
    Finally, DOE's response detailed a number of actions it has taken or
    plans to take to address the recommendations.  We did not address
    these actions as part of our work.  The full text of DOE's comments
    are included in appendix IV.

    DOE'S LIST OF SENSITIVE COUNTRIES
    =========================================================== Appendix I

    Algeria
    Armenia
    Azerbaijan
    Belarus
    China
    Cuba
    Georgia (Republic of)
    India
    Iran
    Iraq
    Israel
    Kazakhstan
    Kyrgyzstan
    Libya
    Moldova
    North Korea
    Pakistan
    Russia
    Sudan
    Syria
    Taiwan
    Tajikistan
    Turkmenistan
    Ukraine
    Uzbekistan

    (See figure in printed edition.)Appendix II
    DOE'S LIST OF SENSITIVE SUBJECTS
    =========================================================== Appendix I

    (See figure in printed edition.)

    NUMBER AND PERCENTAGE OF
    BACKGROUND CHECKS OBTAINED FOR
    FOREIGN VISITORS FROM SENSITIVE
    COUNTRIES TO DOE'S NUCLEAR WEAPONS
    LABORATORIES, 1994-96
    ========================================================= Appendix III

        Country\a            Livermore               Los Alamos                     Sandia
    -----------------  ----------------------  ----------------------  ---------------------------------
                                       Percen                  Percen                             Percen
                       Visits  Checks       t  Visits  Checks       t  Visits       Checks             t
    -----------------  ------  ------  ------  ------  ------  ------  ------  -----------------  ------
    Algeria                 8       7      88       6       0       0       2          0               0
    Armenia                 1       0       0       6       0       0       1          0               0
    Azerbaijan              0       1      \b       1       0       0       0          0               -
    Belarus                12       7      58      13       0       0      15          0               0
    China                 474     185      39     746      12       2     244          2               1
    Cuba                    4       1      25       0       0       -       0          0               -
    Georgia (Republic       0       0       -       0       0       -       4          0               0
     of)
    India                 193      85      44     407       5       1     214          7               3
    Iran                   26      11      42      20       0       0      19          0               0
    Iraq                    2       1      50       3       0       0       4          0               0
    Israel                 60      27      45     114       0       0      58          2               3
    Kazakhstan              8       2      25      37       0       0      15          2              13
    Kyrgyzstan              0       0       -       1       0       0       0          0               -
    Libya                   2       0       0       0       0       -       0          0               -
    Moldova                 0       0       -       3       0       0       0          0               -
    Pakistan                6       2      33       8       1      13      16          0               0
    Russia                653     302      46   1,110     116      10     474         33               7
    Syria                   2       3      \b       5       0       0       0          0               -
    Taiwan                 65      33      51      97       3       3      43          1               2
    Turkmenistan            0       0       -       0       0       -       7          0               0
    Ukraine                47      22      47      69       0       0      38          1               3
    Uzbekistan              0       1      \b       0       0       -       2          0               0
    ----------------------------------------------------------------------------------------------------
    \a The following countries that changed status from sensitive to
    nonsensitive during 1994 are not included in this table:  Argentina,
    Brazil, Bulgaria, Burma, Cambodia, Chile, El Salvador, Ethiopia,
    Romania, South Africa, South Korea, Vietnam, and Yugoslavia.

    \b According to DOE, background checks outnumbered visits for
    Azerbaijan, Syria, and Uzbekistan because checks may have been
    obtained for planned visits that were later canceled.

    Source:  GAO's analysis of data from DOE and the weapons
    laboratories.

    (See figure in printed edition.)Appendix IV
    COMMENTS FROM THE DEPARTMENT OF
    ENERGY
    ========================================================= Appendix III

    (See figure in printed edition.)

    (See figure in printed edition.)

    (See figure in printed edition.)

    (See figure in printed edition.)

    (See figure in printed edition.)

    (See figure in printed edition.)

    MAJOR CONTRIBUTORS TO THIS REPORT
    =========================================================== Appendix V

    RESOURCES, COMMUNITY, AND ECONOMIC
    DEVELOPMENT DIVISION WASHINGTON,
    D.C.

    Gary L.  Jones, Associate Director
    William F.  Fenzel, Assistant Director
    Dave Brack
    John R.  Schulze

    DENVER REGIONAL OFFICE

    James C.  Charlifue
    Frank B.  Waterous

    *** End of document. ***