DOE supplements its order with DOE M 471.2-1C, Classified Matter Protection and Control Manual. The manual provides requirements for the protection and control of classified matter and applies to contractors with access to classified matter, including the contractors operating the national weapons laboratories. In June 2000, DOE discovered that two computer disks containing sensitive weapons information were missing. Laboratories Have Implemented DOE's Access Controls and Need-to-Know Requirements, but These Requirements Could Permit Unnecessary Access

Our review at the Sandia and Los Alamos National Laboratories indicates that existing DOE access controls and need-to-know requirements for both vaults and classified computer systems are being carried out in practice and the laboratories have implemented the Secretary's six security enhancements. Another part of the enhancement covered highly classified information on other computer operating systems. DOE and the Sandia and Los Alamos National Laboratories require managers to determine that an individual's work requires a need to know the classified information before the individual is granted access to the information. DOE Needs to Further Enhance Security for Top Secret Information and Expedite Implementation of Classified Information Security Upgrades

DOE is upgrading its protection and control of classified information. DOE has issued a revision of its classified matter protection and control requirements to increase security and accountability for top secret information. In addition, DOE has worked with the Department of Defense and is revising an order to increase security for compilations of the most sensitive classified information, to be designated "Sigma 16." In January 1997, DOE recommended more stringent security measures be implemented for the protection of 137 classified information topics that had been identified as the most sensitive. Conclusions

Although the Sandia and Los Alamos National Laboratories have implemented DOE's requirements for access and need to know for vaults and classified computer networks, DOE does not have requirements for documenting need-to-know determinations. During our visits to the laboratories, we inspected and observed operating procedures for vaults containing the most sensitive classified information, as determined by laboratory officials. GAO Comments

1.
Why GAO Did This Study

The Department of Energy (DOE) maintains millions of classified documents containing highly sensitive nuclear weapons design and production information. Allegations that the Peoples Republic of China obtained nuclear warhead designs from an employee of DOE's Los Alamos National Laboratory, as well as the disappearance of two computer hard drives containing highly sensitive weapons information from that same laboratory, have raised concerns about how effectively DOE protects classified information, particularly the most sensitive classified information that is contained in vaults and computer systems. DOE's security program consists of many strategies for protecting and controlling classified information, such as controlling access to classified information through physical and administrative barriers and determining whether a person's work requires a "need to know" the information. DOE has recently increased protection for top-secret documents by revising its Classified Matter Protection and Control Manual, which provides detailed requirements for the protection and control of classified matter. This report reviews the (1) extent to which DOE's Sandia and Los Alamos National Laboratories have implemented DOE's established access controls and need-to-know requirements for classified vaults and computer systems containing the most sensitive classified information as well as the adequacy of these requirements and (2) steps DOE is taking to upgrade the protection of its classified information.

What GAO Found

GAO found that the Los Alamos and Sandia National Laboratories have implemented DOE's access controls and need-to-know requirements for both vaults and classified computer systems containing the most sensitive classified information. However, DOE's requirements for documenting need to know lack specificity, allowing laboratory managers wide variations in interpretation and implementation and. DOE has recently taken, and continues to take, steps to upgrade protection and control over its classified information, but additional steps are needed.