Nuclear Security: Information on DOE's Requirements for Protecting and
Controlling Classified Documents (Testimony, 07/11/2000,
GAO/T-RCED-00-247).
Pursuant to a congressional request, GAO discussed the Department of
Energy's (DOE) requirements for protecting and controlling classified
documents.
GAO noted that: (1) DOE has numerous procedures designed to protect
classified documents; (2) the requirements vary depending on the type of
document being protected and the nature of the protection provided where
the document is stored; (3) GAO found that many requirements for
protecting and controlling secret and top secret documents stored in
protected areas were discontinued in the 1990s; (4) for example, the
requirement to inventory secret documents every 3 years was discontinued
in 1992 with other controls over secret documents; and (5) in regard to
top secret documents, many requirements, such as a top secret control
officer, were eliminated in 1998.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: T-RCED-00-247
TITLE: Nuclear Security: Information on DOE's Requirements for
Protecting and Controlling Classified Documents
DATE: 07/11/2000
SUBJECT: Classified information
Internal controls
Larceny
Records management
Accountability
Inventory control systems
IDENTIFIER: DOE Classified Matter Protection and Control Program
DOE Graded Protection System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO/T-RCED-00-247
United States General Accounting Office
GAO
Testimony
Before the Subcommittee on Oversight and Investigations,
Committee on Commerce, House of Representatives
For Release on Delivery
Expected at
9:30 a.m. EDT
Tuesday
July 11, 2000
NUCLEAR SECURITY
Information on DOE's Requirements for Protecting and Controlling Classified
Documents
Statement of Jim Wells,
Director, Energy, Resources, and Science Issues,
Resources, Community, and Economic
Development Division
EMBED Word.Picture.8 GAO/T-RCED-00 247
Mr. Chairman and Members of the Subcommittee:
We are pleased to be here today to provide information on the Department of
Energy's (DOE) requirements for protecting and controlling classified
documents. DOE's requirements are designed to protect classified documents
from their inception to their destruction. At the Subcommittee's request, we
have begun an evaluation, which is still underway, of DOE's classified
matter protection and control program. During the past few weeks, we briefed
your staff on DOE's requirements for controlling classified documents. At
your request, we are testifying today on changes in DOE's requirements since
1988, when complete accountability was required for Secret and Top Secret
documents. You also asked us to testify on the extent to which sign-out
sheets have been required to provide a record of who removed a classified
document from storage and when it was removed.
I would like to emphasize that the requirements we address today are DOE's
minimum requirements. The contractors who operate DOE's facilities may
require additional controls and procedures to protect and control classified
documents. We are providing information on the requirements for controlling
both Secret and Top Secret documents in protected areas. Protected areas
have physical barriers and also have controlled access. Secret and Top
Secret documents stored outside of these areas require additional protective
measures.
In summary, DOE has numerous procedures designed to protect classified
documents. The requirements vary depending on the type of document being
protected and the nature of the protection provided where the document is
stored. We found that many requirements for protecting and controlling
Secret and Top Secret documents stored in protected areas were discontinued
in the 1990s. For example, the requirement to inventory Secret documents
every 3 years was discontinued in 1992 with other controls over Secret
documents. In regard to Top Secret documents, many requirements, such as a
Top Secret Control Officer, were eliminated in 1998.
Background
DOE is responsible for administering a security program that protects
classified documents from loss or theft. DOE's memoranda, orders, and
manuals set forth the requirements for protecting and controlling classified
documents at DOE facilities. DOE's strategy for protecting classified
documents involves a "graded protection" system. Under such a system, the
level of protection for a classified document is commensurate with the
threat to the document, the vulnerability of the document, the value of the
document, and the level of risk to the document that DOE is willing to
accept. Not all items are protected to the same degree; furthermore,
locations on a DOE site may be protected differently. Protection is provided
by various means, such as physically protecting classified documents with
guards, buildings, vaults, and locks; limiting access to classified
documents to personnel with proper security clearances and a legitimate need
to have the information; and the processes and procedures known as
classified matter protection and control.
DOE's classified matter protection and control program has included a wide
variety of requirements. These requirements have included conducting
inventories of classified documents and maintaining an accountability record
for each classified document. The accountability record can include a
description of the document, date, classification level and category. DOE
has also required that each classified document be assigned a unique
identification number--to allow the identification and tracking of the
document--and a copy and series designation--to provide information on how
many copies exist. Additionally, DOE has required the use of receipts for
internal and external distribution to provide a record of dissemination of a
classified document within a facility and outside a facility, respectively.
Finally, DOE has required certain procedures for maintaining receipts and
destruction records and obtaining approval for the reproduction of a
classified document. Other requirements could also be used, such as
maintaining a sign-out sheet to provide a record of who removed a classified
document from storage and when it was removed.
DOE has also required additional controls for Top Secret documents. These
have included assigning a Top Secret Control Officer, who has ultimate
responsibility for Top Secret documents; conducting a verification to
certify that all Top Secret documents have been returned to storage at the
end of each work day; and maintaining a Top Secret access record that lists
all persons who are authorized access to Top Secret documents.
Changes to DOE's Requirements Over the Past 12 Years
In general, over the past 12 years, many requirements for Secret and Top
Secret classified matter protection and control have been discontinued.
Specifically, requirements for maintaining records and receipting and
reproducing classified documents were discontinued. According to DOE
classified matter protection and control officials, these changes were
implemented to promote governmentwide uniformity among contractors and to
account for technological changes, such as computers, copiers, and faxes, in
the processing and storage of classified information. In our ongoing
evaluation, we will be looking at how other agencies protect and control
classified documents.
The following tables show the requirements, or lack of requirements, for
certain classified matter protection and control procedures. Several points
in time were selected to demonstrate the changes in requirements from 1988
to 1998. The 1988 requirements are used as a baseline because, in that year,
DOE required accountability procedures and receipting and reproduction
requirements that applied to all Secret and Top Secret documents. The
requirements for Secret documents for 1992 are shown because in that year
DOE modified accountability requirements for Secret documents. The 1992
requirements for protecting and controlling Secret documents have not
changed.
Table 1 shows that many requirements for controlling Secret documents that
were required in 1988 were discontinued in 1992. Among those discontinued
were DOE's requirement to conduct inventories, maintain an accountability
record, assign a unique identification number and copy and series to each
Secret document, use receipts for the dissemination of Secret documents
within a facility, and obtain approval from the document's originator before
reproducing a Secret document. The requirements for retaining receipts and
destruction documentation did not change. DOE has not and does not require a
sign-out sheet for Secret documents.
Table 1: Changes in Minimum Requirements for Controlling Secret Documents
Control requirements 1988 1992
Frequency of inventories Every 3 Requirement
years discontinued
Accountability record Required Requirement
discontinued
Unique identification Requirement
number Required discontinued
Copy and series Requirement
designation Required discontinued
Receipts for internal Requirement
distribution Required discontinued
Receipts for external
distribution Required Required
Retention of receipts 2 years 2 years
Retention of destruction
records 2 years 2 years
Approval for Requirement
reproduction Required discontinued
Sign-out sheets Not Not specified
specified
Source: Prepared by GAO on the basis of DOE documents.
Table 2 shows DOE's requirements for safeguarding Top Secret documents in
1995 and 1998 in addition to the 1988 baseline requirements. The
requirements in 1995 are included because DOE revised its classified matter
protection and control manual, changing several inventory and accountability
requirements. DOE decreased the frequency of inventories from semiannually
to annually. DOE had also discontinued the requirements for assigning a copy
and series designation to each document and the requirement for verifying
that all Top Secret documents had been returned to storage at the end of the
work day.
DOE's minimum requirements for 1998 are included because DOE again revised
its classified matter protection and control manual to eliminate additional
accountability requirements for Top Secret documents. In 1998, DOE
eliminated requirements for performing annual inventories, maintaining an
accountability record, assigning a unique identification number to each
document, assigning a Control Officer, maintaining an access record, using
receipts for the dissemination of Top Secret documents within a facility,
and obtaining approval before reproducing a document. The requirements for
using receipts for dissemination of Top Secret documents to recipients
outside the facility and retaining receipts and destruction documentation
did not change. DOE has not and does not require a sign-out sheet for Top
Secret documents. The 1998 requirements for protecting and controlling Top
Secret documents have not changed.
Table 2: Changes in Minimum Requirements for Controlling Top Secret
Documents
Control requirements 1988 1995 1998
Frequency of Every 6 Requirement
inventories months Annually discontinued
Accountability record Required Required Requirement
discontinued
Unique identification Requirement
number Required Required discontinued
Copy and series Requirement No change from
designation Required discontinued 1995
Top Secret Control Requirement
Officer Required Required discontinued
End-of-day verification Required Requirement No change from
discontinued 1995
Access record Required Required Requirement
discontinued
Receipts for internal Requirement
distribution Required Required discontinued
Receipts for external
distribution Required Required Required
Retention of receipts 5 years 5 years 5 years
Retention of
destruction records 5 years 5 years 5 years
Approval for Requirement
reproduction Required Required discontinued
Sign-out sheets Not Not specified Not specified
specified
Source: Prepared by GAO on the basis of DOE documents.
While we were asked to discuss document protection and control within DOE
protected areas, it should be noted that Secret and Top Secret documents
stored outside of these areas require additional protective measures. In
addition, these requirements have not been discontinued for some specific
types of Secret and Top Secret classified documents. These include
classified documents related to special access programs, cryptographic
information, and NATO classified information.
I would like to reiterate that the requirements we address today are DOE's
minimum requirements. The contractors who operate DOE's facilities may
require additional controls and procedures to protect and control classified
documents. In addition, as you know, we have recently begun our work for the
Subcommittee related to accountability for classified documents and will be
doing further work on these issues.
- - - - -
We discussed the information related to classified matter protection and
control requirements with DOE's Office of Safeguards and Security and Office
of Independent Oversight and Performance Assurance officials, who agreed
with its factual accuracy.
Mr. Chairman, this concludes our formal statement. We would be happy to
respond to any questions that you or Members of the Subcommittee may have.
Contact and Acknowledgements
For future contacts regarding this testimony, please contact Jim Wells at
(202) 512-3841. Individuals making key contributions to this testimony
include William F. Fenzel, Kenneth E. Lightner, Jr., and Ilene M. Pollack.
(141450)
*** End of document. ***