Security concerns and problems have existed since these facilities were created. These reports have included nearly 50 recommendations for improving programs for controlling foreign visitor access, protecting classified and sensitive information, maintaining physical security over facilities and property, ensuring the trustworthiness of employees, and accounting for nuclear materials. While DOE has often agreed to take corrective actions, we have found that the implementation has often not been successful and that problems recur over the years. Consequently, DOE has had procedures to control these visits as well as other lines of defense—such as access controls and counterintelligence programs—to protect its information and technology from loss to foreign visitors. These programs lacked comprehensive threat assessments, which are needed to identify the threats against DOE and the facilities most at risk, and lacked performance measures to gauge the effectiveness of these programs in neutralizing or deterring foreign espionage efforts. Physical Security

Physical security controls involve the protection, primarily through security personnel and fences, of facilities and property. Personnel Security

DOE’s personnel security clearance program is intended to provide assurance that personnel with access to classified material and information are trustworthy. Key Factors Contributing to Security Problems

As you can see, Mr. Chairman, our work over the years has identified a wide variety of specific security problems at DOE facilities. While each individual security problem is a concern, when looked at collectively over an extended period of time, a more serious situation becomes apparent that stems from systemic causes. In our view, there are two overall systemic causes of the security problems. Second, and probably most importantly, there is a serious lack of accountability among DOE and its contractors for their actions. Lack of Attention and Priority to Security

The lack of attention and priority given by DOE management and its contractors to security matters can be seen in many areas. . . .” DOE’s Laboratory Operations Board also reported in 1997 on DOE’s organizational problems, noting that there were inefficiencies due to DOE’s complicated management structure. Department of Energy: Poor Management of Nuclear Materials Tracking System Makes Success Unlikely (GAO/AIMD-95-165, Aug. 3, 1995).
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed its past work involving security at Department of Energy's (DOE) facilities.

What GAO Found

GAO noted that: (1) GAO's work has identified security-related problems with controlling foreign visitors, protecting classified and sensitive information, maintaining physical security over facilities and property, ensuring the trustworthiness of employees, and accounting for nuclear materials; (2) these problems include: (a) ineffective controls over foreign visitors to DOE's most sensitive facilities; (b) weaknesses in efforts to control and protect classified and sensitive information; (c) lax physical security controls, such as security personnel and fences, to protect facilities and property; (d) ineffective management of personnel security clearance programs; and (e) weaknesses in DOE's ability to track and control nuclear materials; (3) the recent revelations about espionage bring to light how ingrained security problems are at DOE; (4) although each individual security problem is a concern, when these problems are looked at collectively over time, a more serious situation becomes apparent; (5) while a number of investigations are under way to determine the status of these security problems, GAO has found that DOE has often agreed to take corrective action but the implementation has not been successful and the problems reoccur; (6) there are two overall systemic causes for this situation; (7) DOE managers and contractors have shown a lack of attention and priority to security matters; (8) there is a serious lack of accountability at DOE; (9) efforts to address security problems have languished for years without resolution or repercussions to those organizations responsible; (10) security in today's environment is even more challenging, given the greater openness that now exists at DOE's facilities and the international cooperation associated with some of DOE's research; (11) even when more stringent security measures were in place than there are today, problems have arisen and secrets can be, and were, lost; and (12) consequently, continual vigilance, as well as more sophisticated security strategies, will be needed to meet the threats that exist today.