DOE officials detail security concerns at labs

The Department of Energy’s top counterintelligence official dismissed assertions by the former counterintelligence chief at Lawrence Livermore National Laboratory (LLNL) that a 2007 restructuring of DOE’s security programs has left the nuclear weapons complex more vulnerable to spying. But he and other DOE officials testifying at a recent House hearing warned of a growing risk to DOE’s labs and other weapons assets from cyberattacks, which are increasing in number and sophistication. Directors of the weapons laboratories conceded that further protections should be made to their computer networks.

Stanley Borgia, the highest ranking of 21 Federal Bureau of Investigation agents who are detailed to counterintelligence posts in the DOE complex, told the House Committee on Energy and Commerce that former LLNL official Terry Turchie was “wrong” to warn that the congressionally mandated merger of the intelligence and counterintelligence offices at DOE could hinder detection of espionage at LLNL and other weapons facilities. Turchie, who retired in 2007 as the counterintelligence chief at LLNL, wrote to committee chairman John Dingell (D-MI) in September, warning that “the vulnerability of DOE personnel and facilities to hostile intelligence activities has increased exponentially” because of the DOE reorganization. Turchie was not among the witnesses testifying at a 25 September hearing of the committee’s oversight and investigations subcommittee, and the committee issued a statement afterward dismissing his concerns.

The merger reversed a 1999 congressional directive for the establishment of a separate counterintelligence function within DOE. That elevation came in the wake of allegations that China had stolen nuclear secrets from the labs.

Cyberattacks increasing

DOE officials also reported that malicious attempts to penetrate the computer networks at the labs and other DOE facilities are on the rise. Dingell charged that the labs “are virtually naked to concerted cyberattacks, especially by assault from persistent, well-funded, and dedicated assailants.” Attacks numbered more than 400 million in each of three recent months, Borgia said. DOE inspector general Gregory Friedman said the frequency of attacks has jumped 45% over the past year. Hackers range from relatively harmless curiosity seekers to those originating from “nation-state and belief-based espionage,” said Linda Wilbanks, the chief information officer for DOE’s National Nuclear Security Administration. Asked whether some breaches in cybersecurity may have gone undetected, Borgia answered simply “yes” and left further elaboration to a closed hearing that followed the public session.

Lab directors reassured lawmakers that classified information isn’t at risk in cyberattacks. That top-secret material is kept on secured internal networks that are “air gapped,” or physically separated from, internet connections. A second, “yellow” network restricted to the labs and their collaborators does contain sensitive but unclassified data such as personnel records, business proprietary information, and information relating to naval reactors and other nuclear facilities. Though protected by firewalls, the yellow network is accessible from the internet to a number of foreign nationals who have security clearance and to others. That network presents “a valuable target for foreign governments, terrorists, and spies,” warned Gene Aloise, director of natural resources and environment at the Government Accountability Office (GAO), who noted that 13 000 users at Los Alamos National Laboratory have access.

Friedman, who has authored numerous reviews urging DOE to upgrade its cybersecurity, said the ongoing concern “is one of the most perplexing issues I deal with.” The department has failed to follow through on numerous cybersecurity measures it has initiated, he said.

Wilbanks and Bradley Peterson, DOE’s chief of nuclear security, said cybersecurity upgrades are under way. More than half of the recommendations contained in a recent GAO report will be implemented by December, and the remainder will be in place by the end of 2009, they said in their joint testimony.

Mock terror attack

The hearing also covered concerns over the state of LLNL’s physical security; committee members pointed out that the lab’s protective force had failed to repel a mock terrorist assault last April. The DOE Office of Independent Oversight found the guards’ performance lapses during the exercise “shocking and so serious” that they couldn’t be discussed in an open hearing, Dingell said. Glenn Podonsky, DOE’s chief health, safety, and security officer, said “key equipment malfunctions” and “some difficulty in implementing response actions” were to blame. Among other problems, the lab’s security force was unable to deploy a key element of its defenses—an enormous truck-mounted Gatling-type machine gun capable of firing 4000 rounds per minute and with a kill range of more than a mile.

LLNL director George Miller said that health and safety considerations limited the guard force’s options in response to the simulated terrorist attack. Officers, for example, were not allowed to use ladders to climb onto the roof of the “superblock,” the highly secured warehouse in the lab complex where fissile materials are kept. They were also prohibited from using smoke and engaging in “realistic exercises” inside the facility. Guards performed far better during a mock terrorist attack held in August, and a DOE review of that drill said the lab now has “a robust protection strategy,” according to Miller.