Brian Bradley
NS&D Monitor
8/7/2015
The National Nuclear Security Administration fined Los Alamos National Security $192,500 for multiple violations of Energy Department classified information security requirements, according to a July 28 letter from NNSA Administrator Frank Klotz to Los Alamos National Laboratory Director Charlie McMillan. A DOE investigation found in 2012 that LANS, the contract operator of LANL in New Mexico, did not properly control sensitive information associated with a classified shipment. In December 2012, LANS employees working at the Nevada National Security Site identified inconsistencies in a “Secret/Restricted Data Weapons Data” item documented as having been shipped from LANL to NNSS in 2007, according to the NNSA final notice of violation. LANS personnel at NNSS determined the contents of the 2007 shipment did not match all of the documentation that accompanied the material and concluded that the security event item had not been shipped from LANL in 2007.
It was 14 months before LANS recognized that an item (which NNSA’s final notice refers to as the “security event item”) had been downgraded from a highly secure “material access area” to a “limited area,” the final notice states. “Since LANS did not recognize the downgraded security posture of the security event item location, LANS did not consider the change in detection capabilities and the increased likelihood of undetected removal through this credible, lower-security pathway in concluding the possibility for compromise,” the final notice states.
As outlined in the preliminary notice of violation, the infractions included two “Severity Level I” violations of DOE’s Safeguards and Security Program Planning and Management and Information Security rules, as well as one “Severity Level II” violation of DOE classified information security requirements, the final notice states. In its response to NNSA’s preliminary notice, LANS challenged the agency’s planned fine, argued the originally proposed civil penalties were excessive, and said the two most serious violations should not have been designated as Severity Level I. LANS also said it did not violate requirements to conduct an adequate “incident of security concern” inquiry, but NNSA found no merit in this argument, the final notice states. LANS said it should not be held accountable for another violation because the security item was “unaccountable classified matter,” according to the final notice. NNSA countered that: “LANS is required to protect and control all classified matter, formally accountable or not, throughout its lifecycle from loss, theft, espionage, unauthorized access, or compromise.” The “fate” of that security event item remains unknown, the final notice states.
DOE had proposed a $247,500 penalty for the violations in the May 27 preliminary notice, but announced a $55,000 reduction in the final notice, removing the “per-day penalty” for a continuing violation, Klotz wrote. The final notice says NNSA removed that penalty after “further evaluation and consideration” of LANS’ corrective actions to address “shortcomings in its work control processes for classified shipping activities,” along with LANS’ revision of material control and accountability procedures and training. NNSA recognized this particular violation as a nonrecurring issue.
The final notice and penalty is based on DOE’s investigation and an evaluation of evidence that LANS provided the department, including the contractor’s final inquiry report, corrective actions, information provided at an August 2014 enforcement conference, and LANS’ June 29 reply to the preliminary notice.
“LANS failed to recognize the apparent discrepancies between assembled shipping papers and transfer documents relative to a classified shipment, and lacked knowledge of the contents of the shipping container, as well as the physical characteristics of the contents, which demonstrated a significant shortcoming in LANS’ processes for controlling classified matter throughout its lifecycle,” Klotz’s letter states. “Furthermore, LANS’ inquiry did not accurately reconstruct this security event and therefore, the basis for its conclusion on the possibility for compromise was not based on facts and circumstances surrounding this security event.”
