The Department of Energy (DOE) and its facilities, especially its nuclear weapons laboratories, are key targets of foreign intelligence interest. Situations of concern are referred to the Federal Bureau of Investigation (FBI), which performs counterintelligence operations or investigations as necessary. This report completes our work on DOE’s controls over foreign visitors and, as agreed with Committee staff, addresses DOE’s (1) procedures for reviewing the backgrounds of foreign visitors and for controlling the dissemination of sensitive information to them, (2) security controls for limiting foreign visitors’ access to areas and information within its laboratories, and (3) counterintelligence programs for mitigating the potential threat posed by foreign visitors. DOE has not effectively implemented two of the key procedures at the three laboratories we reviewed. Background Checks Are Intended to Help DOE Mitigate the Risks of Visits

As part of its process to approve foreign visitors, DOE requires that national security background checks (termed indices checks by DOE) be conducted on certain foreign visitors to its laboratories. Our review of DOE’s records of foreign visitors showed that, during the 3-year period from 1994 through 1996, background checks were obtained on only 5 percent of the visitors from sensitive countries to Los Alamos and Sandia. As a result, sensitive information could be discussed or otherwise disclosed to foreign nationals without DOE’s knowledge and approval. However, the security controls that exist in the laboratories’ controlled areas—the areas most often visited by foreign nationals—may not provide effective protection. Protection of Sensitive Information in Controlled Areas Has Not Been Fully Assessed

Neither the laboratories nor DOE has fully assessed the controls over unclassified, but sensitive information. However, according to a counterintelligence official at headquarters, DOE has not developed any performance measures or expectations to evaluate the laboratories’ counterintelligence programs because DOE’s contracts with the laboratories do not obligate their counterintelligence programs to follow any such measures DOE may develop. In these places, DOE needs a more sophisticated security strategy that is consistent with the laboratories’ more open missions and includes a greater role played by DOE and laboratory counterintelligence programs. This assessment will help ensure that procedures for these areas are consistent from laboratory to laboratory and security vulnerabilities and/or problems are identified and corrected. Revise DOE’s foreign visitor order to (1) clarify to all DOE and laboratory contractor personnel the specific types of unclassified, but sensitive, subjects that require protection from compromise by foreign nationals and (2) require that the subjects of visits be independently reviewed by experts with appropriate technical backgrounds—such as laboratory individuals involved in export control issues—to verify that visits involving sensitive subjects are adequately identified for DOE’s review.
Why GAO Did This Study

Pursuant to a congressional request, GAO provided information on the Department of Energy's (DOE) controls over foreign visitors to its three nuclear weapons laboratories, focusing on DOE's: (1) procedures for reviewing the backgrounds of foreign visitors and for controlling the dissemination of sensitive information to such visitors; (2) security controls for limiting foreign visitors' access to areas and information within its laboratories; and (3) counterintelligence programs for mitigating the potential threat posed by foreign visitors.

What GAO Found

GAO noted that: (1) DOE's procedures for obtaining background checks and controlling the dissemination of sensitive information are not fully effective; (2) DOE has procedures that require obtaining background checks, but these procedures are not being enforced; (3) at two of the laboratories, background checks are conducted on only about 5 percent of the foreign visitors from countries that DOE views as sensitive; (4) GAO's review of available data from DOE and the Federal Bureau of Investigation (FBI) showed that some of the individuals without background checks have suspected foreign intelligence connections; (5) furthermore, DOE's procedures lack clear criteria for identifying visits that involve sensitive subjects and process controls to help ensure that these visits are identified; (6) as a result, sensitive subjects may have been discussed with foreign nationals without DOE's knowledge and approval; (7) DOE's security controls, such as access restrictions, in the areas most visited by foreign nationals do not preclude their obtaining access to sensitive information, and problems with the control of this information--such as sensitive information being left in an open hallway accessible to foreign visitors--have occurred at the laboratories; (8) furthermore, DOE has not evaluated the effectiveness of the security controls over this information in those areas most frequented by foreign visitors; (9) the DOE headquarters and laboratory counterintelligence programs are key activities for identifying and mitigating foreign intelligence efforts, but these programs have lacked comprehensive threat assessments, which identify likely facilities, technologies, and programs targeted by foreign intelligence; (10) such assessments are needed as a critical component of a more sophisticated security strategy that is consistent with the laboratories' more open missions; (11) furthermore, DOE could use these assessments to develop the performance measures needed to guide the laboratories' counterintelligence programs and to gauge their effectiveness; and (12) currently, DOE has not developed such performance measures or evaluated the effectiveness of its counterintelligence programs.