U S Department of Energy Office of Inspector General Office of Inspections and Special Inquiries Inspection Report Badge Retrieval and Security Clearance Termination at Sandia National LaboratoryNew Mexico DOE IG-0724 April 2006 Department of Energy Washington DC 20585 April 18 2006 I MEMORANDUM FOR TH BSECRETARY FROM Gregory me man Inspector General SUBJECT INFORMATION Inspection Report on Badge Retrieval and Security Clearance Termination at Sandia National Laboratory-New Mexico BACKGROUND The Department of Energy s Sandia National Laboratory-New Mexico Sandia is involved in a variety of research and development programs to enhance national security through technology Sandia which employs about 8 500 people is one of the Department s most sensitive facilities According to Sandia personnel records 2 174 Sandia and subcontractor employees with personnel security clearances terminated employment at the Laboratory between March 1 2002 and February 28 2005 Of ce of Inspector General reviews at other Department sites including at Los Alamos National Laboratory and Lawrence Livermore National Laboratory identi ed weaknesses in the internal controls designed to ensure that individuals who terminated employment at these sites had their security badges collected at the time of their departure and their security clearances terminated in a timely manner Therefore the objective of this inspection was to determine if Sandia s internal controls were adequate to ensure that in accordance with applicable policies and procedures 1 security badges assigned to terminating Sandia and subcontractor employees were retrieved at the time of their departure and 2 security clearances of departing Sandia and subcontractor employees were terminated in a timely manner RESULTS OF INSPECTION Similar to the results of our reviews at Los Alamos and Lawrence Livermore National Laboratories we concluded that Sandia s internal controls were not adequate to ensure that in accordance with applicable policies and procedures security badges assigned to terminating Sandia and subcontractor employees were retrieved at the time of departure or that security clearances of terminating Sandia and subcontractor employees were terminated in a timely manner Speci cally we found that 0 Of the 2 174 cleared Sandia and subcontractor employees who terminated employment between March 1 2002 and February 28 2005 38 did not turn in their badges Further the Sandia Personnel Security database listed an additional 20 badges as reconciled when in fact there was no record the badges were turned in or destroyed Printed With soy ink on recycled paper  From a sample of 182 Sandia and subcontractor employees 16 did not have their clearances terminated in a timely manner Of particular significance 2 of the 16 clearances were still active at the time of our fieldwork even though the employees had terminated over 2 years previously We brought this to the attention of personnel security officials who subsequently ensured termination of the clearances  From the same sample of 182 employees 47 did not have complete Security Termination Statements as required Thus there was no assurance these individuals had received the required Security Termination Briefing at the time of their termination and  From a sample of 39 Sandia students 29 did not have their clearances terminated in a timely manner even after a 12-month variance to the regular termination procedures had lapsed Further 2 individuals we originally thought were students but who turned out to be summer faculty employees to whom the variance did not apply retained their clearances for over 27 months after their terminations We also found that 2 of the 52 Sandia and subcontractor employees holding Sensitive Compartmented Information SCI access authorizations who terminated between March 1 2002 and February 28 2005 retained their SCI access authorizations for approximately 1 year after their security clearances were terminated In addition for the same 52 people we found that 22 did not sign an SCI Debriefing Acknowledgement document so there was no assurance that prior to departure they received the required SCI debriefing Further from an additional sample of terminating Sandia employees we found that about 40 percent had not completed separation checkout sheets Consequently Badge Office and Personnel Security officials frequently did not receive timely notification that employees were terminating This may have contributed to the issues we identified In our report we made several recommendations to Department management to address our specific findings at Sandia However given the similarity of our findings at the three National Laboratories we reviewed we believe senior Department management should consider taking broader action within the Department to ensure that all Department sites are adequately addressing the areas of badge retrieval and security clearance termination These areas are critical to the Department’s program to control access to sensitive and classified information and facilities MANAGEMENT REACTION In responding to a draft of this report management agreed with our recommendations and identified corrective actions to address them Management’s comments which are provided in their entirety in Appendix C of the report were responsive to our recommendations Attachment 2 cc Deputy Secretary Administrator National Nuclear Security Administration Under Secretary for Energy Science and Environment Chief of Staff Director Of ce of Security and Safety Performance Assurance Manager Sandia Site Of ce Director Policy and Internal Controls Management NA-66 Director Of ce of Internal Review CF-1 2 BADGE RETRIEVAL AND SECURITY CLEARANCE TERMINATION AT SANDIA NATIONAL LABORATORYNEW MEXICO TABLE OF CONTENTS OVERVIEW Introduction and Objectives 1 Observations and Conclusions 1 DETAILS OF FINDINGS Security Badges 4 Security Clearance Terminations 4 Security Termination Statements 5 Student Variances 6 Subcontractor Debriefings and Security Files 6 Sensitive Compartmented Information 7 Out-Processing Procedures 8 RECOMMENDATIONS 9 MANAGEMENT COMMENTS 10 INSPECTOR COMMENTS 10 APPENDICES A Scope and Methodology 11 B Related Reports 12 C Management Comments 13 Overview INTRODUCTION AND OBJECTIVES The Department of Energy’s DOE’s Sandia National LaboratoryNew Mexico Sandia is involved in a variety of research and development programs to enhance national security through technology Sandia develops technologies to sustain modernize and protect the nuclear arsenal of the U S prevent the spread of weapons of mass destruction defend against terrorism protect national infrastructure ensure stable energy and water supplies and provide new capabilities to the armed forces Sandia is administered by the National Nuclear Security Administration NNSA and is operated for NNSA by Sandia Corporation a subsidiary of Lockheed Martin Corporation Sandia employs about 8 500 people According to Sandia personnel records 2 174 Sandia employees including students and consultants and subcontractor employees with personnel security clearances terminated employment at the Laboratory between March 1 2002 and February 28 2005 Office of Inspector General OIG reviews at other DOE sites have identified weaknesses in the internal controls designed to ensure that individuals who terminated employment at these sites had their security badges collected at the time of their departure and their security clearances terminated in a timely manner A list of the associated reports is contained at Appendix B The objective of this inspection was to determine if Sandia’s internal controls were adequate to ensure that in accordance with applicable policies and procedures 1 security badges assigned to terminating Sandia and subcontractor employees were retrieved at the time of their departure and 2 security clearances of departing Sandia and subcontractor employees were terminated in a timely manner To achieve this objective we conducted sampling from databases related to Sandia and subcontractor employee out-processing to include badge retrieval and security clearance termination OBSERVATIONS AND CONCLUSIONS We concluded that Sandia’s internal controls were not adequate to ensure that in accordance with applicable policies and procedures security badges assigned to terminating Sandia and subcontractor employees were retrieved at the time of departure or that security clearances of terminating Sandia and subcontractor employees were terminated in a timely manner Specifically we found that  Page 1 Of the 2 174 cleared Sandia and subcontractor employees who terminated employment between March 1 2002 and Badge Retrieval and Security Clearance Termination at Sandia National Laboratory-New Mexico February 28 2005 38 did not turn in their badges Further the Sandia Personnel Security database listed an additional 20 badges as reconciled when in fact there was no record the badges were turned in or destroyed  From a sample of 182 Sandia and subcontractor employees who terminated between March 1 2002 and February 28 2005 16 did not have their clearances terminated in a timely manner The 16 employees did not include students who are addressed separately because of a variance granted to the normal termination procedures Of particular significance 2 of the 16 clearances were still active at the time of our fieldwork even though the employees had terminated over 2 years previously We brought this to the attention of personnel security officials who subsequently ensured termination of the clearances  From the same sample of 182 Sandia and subcontractor employees 47 did not have complete Security Termination Statements as required and thus there was no assurance these individuals had received the required Security Termination Briefing at the time of their termination We also found that Sandia Personnel Security staff members changed the termination dates on Security Termination Statements for 21 subcontractor employees in the sample and that this may have been done to avoid non-compliance with DOE requirements resulting from late submission of the forms by subcontractors  From a sample of 39 Sandia students 29 did not have their clearances terminated in a timely manner after a 12-month variance to the regular termination procedures had lapsed Further 2 individuals we originally thought were students but who turned out to be summer faculty employees to whom the variance did not apply retained their clearances for over 27 months after their terminations and  Subcontractor employees performing personnel security duties were not conducting adequate security debriefings or retaining all required documentation in personnel security files of departing employees We also found that 2 of the 52 Sandia and subcontractor employees holding SCI access authorizations who terminated between March 1 2002 and February 28 2005 retained their SCI access authorizations for approximately 1 year after their security clearances were terminated In addition for the same 52 people Page 2 Observations and Conclusions we found that 7 Sandia and 15 subcontractor employees did not sign an SCI Debriefing Acknowledgement document so there was no assurance that prior to departure they received the required SCI debriefing In addition Sandia Human Resources retains terminating employees’ separation checkout sheets for 12 months so we reviewed a judgmental sample of 581 Sandia employees out of the 1 189 who departed the Laboratory from May 1 2004 to April 30 2005 We found that 230 of the 581 terminated Sandia employees did not complete separation checkout sheets Consequently Badge Office and Personnel Security officials frequently did not receive timely notification that employees were terminating This may have contributed to the issues we identified We noted that in November 2004 Sandia revised its internal reporting procedures regarding employees terminating from the Laboratory Specifically Sandia established a process to provide daily notification of terminating students to the Personnel Security Office and of terminating Sandia employees to the Special Security Officer in charge of the SCI program Based on our inspection it did not appear that the revised reporting procedures corrected all the problems in these two areas Page 3 Observations and Conclusions Details of Findings SECURITY BADGES We found that of the 2 174 cleared Sandia and subcontractor employees who terminated employment between March 1 2002 and February 28 2005 38 did not turn in their badges Further we identified that the Sandia Personnel Security database listed an additional 20 badges as reconciled when in fact there was no record the badges were turned in or destroyed DOE Manual 473 1-1 “Physical Protection Program Manual ” stated that badges issued must be recovered at the final security checkpoint or earlier when an individual no longer has a valid requirement for access to a DOE facility During our fieldwork we were told that access to Sandia facilities was controlled through electronic means However under certain circumstances access to Sandia facilities could still be gained with a Sandia badge while avoiding electronic access controls In addition Sandia badges allow access to other DOE facilities Therefore a terminated employee who had retained his her badge could potentially access certain Laboratory facilities as well as other DOE sites but there was no practical way for the OIG to readily determine if such access had in fact occurred SECURITY CLEARANCE TERMINATIONS We found that from a sample of 182 Sandia and subcontractor employees who terminated between March 1 2002 and February 28 2005 16 did not have their clearances terminated in a timely manner The 16 employees did not include students who are addressed in a separate section because of a variance granted to the normal termination procedures DOE Manual 472 1-1B “Personnel Security Program Manual ” stated that “Within 2 working days of receipt of a DOE F 5631 29 Security Termination Statement or written notice of termination the cognizant DOE security office must note in the individual’s PSF Personnel Security File the date the access authorization was actually terminated and must enter the appropriate information to the CPCI Central Personnel Clearance Index ” The CPCI is the Department’s official personnel security clearance database We sampled 69 cleared Sandia employees who departed the Laboratory and determined that 11 which included one consultant retained their clearances in the CPCI from 11 days to more than 2 years after their departure Of particular significance two of these clearances were still active at the time of our fieldwork even though the employees had terminated over two years previously We brought this to the attention of personnel security officials who subsequently ensured termination of the clearances Page 4 Details of Findings In addition we sampled 113 cleared Sandia subcontractor employees who departed their subcontractor organizations during the period March 1 2002 to February 28 2005 Of the 113 subcontractor employees we found that 5 security clearances remained active from more than 10 days to 10 months after the employees’ departures SECURITY TERMINATION STATEMENTS We found that from the same sample of 182 Sandia and subcontractor employees 47 did not have complete Security Termination Statements as required and thus there was no assurance these individuals had received the required Security Termination Briefing at the time of their termination DOE Manual 470 1-1 “Safeguards and Security Awareness Program ” states that a Security Termination Briefing is required whenever access authorization has been or will be terminated Security Termination Briefings are used to impress upon the individual his or her continuing responsibility not to disclose classified information This briefing also addresses the individual’s obligation prior to departure to return to appropriate DOE officials all classified documents and materials in the individual’s possession To document the Security Termination Briefing the terminating employee and the Line Manager who conducted the briefing sign DOE Form F 5631 29 Security Termination Statement This form is then used by Sandia to provide the required notification to the cognizant DOE Personnel Security Office of the termination of an employee Based on this form the DOE Personnel Security Office terminates the employee’s security clearance access authorization in DOE’s CPCI system We also found that Sandia Personnel Security staff members changed the termination dates on Security Termination Statements for 21 subcontractor employees in the sample and that this may have been done to avoid non-compliance with DOE requirements resulting from late submission of the forms by subcontractors DOE Order 472 1C “Personnel Security Activities ” Attachment 2 CONTRACTOR REQUIREMENTS DOCUMENT states that verbal notification within 2 working days followed by written confirmation within the next 10 working days shall be provided through established channels to the cognizant DOE office when the contractor restricts or withdraws an employee’s access to classified matter without DOE direction Page 5 Details of Findings During our fieldwork we were told by a Sandia staff member that they changed the termination dates on the forms in order to make Sandia’s notification of subcontractor employee terminations to the cognizant DOE office appear more timely In comments on a draft of this report Sandia told us that Sandia staff members were actually changing the dates in response to a process improvement recommendation by Pacific Northwest National Laboratories We noted that the Security Termination Statement clearly specifies that the “Date of Termination” is to be provided therefore we believe it is inappropriate and potentially misleading to provide any date except the employee’s termination date STUDENT VARIANCES We found that from a sample of 39 students 29 did not have their clearances terminated in a timely manner after a 12-month variance to the regular termination procedures had lapsed The Director of the NNSA Service Center signed a memorandum subject “Sandia National Laboratories SNL Variance Request OSS-SNL-04-001 Retaining Student Employee Clearances ” that approved a Sandia request for a variance to DOE policy on student clearances This variance authorized retention of a student intern’s security clearance for up to 12 months after his her official departure date We selected a judgmental sample of 116 employees and established that 39 of them were students We reviewed the clearance status of the 39 students and determined that 29 of their security clearances remained active from more than 10 days to 14 months after the end of the approved 12-month variance In addition we noted that contrary to Sandia policy 1 student retained his badge during the entire 12-month variance period Further 2 individuals we originally thought were students but who turned out to be summer faculty employees to whom the variance did not apply retained their clearances for over 27 months after their terminations SUBCONTRACTOR DEBRIEFINGS AND SECURITY FILES We found that subcontractor employees performing personnel security duties were not conducting adequate security debriefings or retaining all required documentation in personnel security files of departing employees We determined that subcontractor employees performing personnel security duties were not knowledgeable of all DOE requirements for the conduct of security debriefings and the retention of personnel security files DOE Manual 470 1-1 requires that termination briefings include the information contained in items 1 through 6 of the Security Termination Statement DOE F 5631 29 and items 3 4 5 7 and 8 of the Classified Information Nondisclosure Agreement that Page 6 Details of Findings individuals sign when they are granted a clearance In addition the Manual requires that the termination briefing include penalties for unauthorized disclosure of classified information and Unclassified Controlled Nuclear Information as specified in the U S Code Through interviews and documentation reviews we determined that subcontractor employees performing personnel security duties were only addressing items 1 through 6 of the Security Termination Statement which include destruction return of classified materials agreement not to disclose classified information agreement to report to appropriate authorities any attempts by an unauthorized individual to obtain classified information and acknowledgement of penalties associated with unauthorized disclosure of classified information Subcontractor employees were not aware of the other required elements of termination briefings to include the effect of disclosure of classified information restrictions associated with publication of classified information and acknowledgement that classified information is the property of the U S Government In addition subcontractor employees were not aware of the records maintenance requirements for the retention of personnel security files DOE Order 472 1C states that contractors shall maintain current records that reflect by contract number all employees granted access authorizations and copies of correspondence to and from the cognizant DOE office s that reflect access authorization matters for each applicant and employee These records include the request for access authorization notification that access authorization action was effected and access authorization termination actions However subcontractor administrative employees were not maintaining the required records apparently due to their lack of knowledge concerning DOE personnel security requirements SENSITIVE COMPARTMENTED INFORMATION Page 7 We found that 2 of the 52 Sandia and subcontractor employees holding SCI access authorizations who terminated between March 1 2002 and February 28 2005 retained their SCI access authorizations for approximately 1 year after their security clearances were terminated In addition for the same 52 people we found that 7 Sandia and 15 subcontractor employees did not sign an SCI Debriefing Acknowledgement document so there was no assurance that prior to departure they received the required SCI debriefing These individuals’ Debriefing Acknowledgement documents were annotated with the words “Unavailable to Sign ” This practice is commonly referred to as “administrative debriefing ” Details of Findings Sandia’s “5900 Systems Assessment and Research Center Sensitive Compartmented Information Briefing Debriefing Procedures” provides guidance on the Sandia SCI process The SCI debriefing procedures state “Give each participant a debriefing sheet to read Also have them sign the Security Debriefing Acknowledgement ” The SCI debriefing procedures also state “At this time show them their original briefing form s have them sign in the debrief box witness their signature and verify their SS Social Security number ” We were told by an official in DOE’s Office of Intelligence IN that a 1995 memorandum from the then IN Director only authorized a deviation from the debriefing requirements when an individual refused to sign the debriefing document The IN official also said that aside from this specific situation no other written IN policy exists authorizing an administrative debriefing of an individual with SCI access We obtained a copy of the 1995 memorandum and determined it states that “When an individual refuses to participate in a formal debriefing an administrative debriefing is permissible ” We found no evidence that any of the 22 departing employees who were administratively debriefed refused to participate in a formal debriefing or sign the debriefing form In discussing this matter with Sandia we were told that several of the employees were debriefed by telephone and that the Debriefing Acknowledgement was subsequently annotated with the words “Unavailable to Sign ” We noted that the Sandia SCI debriefing procedures made no provision for telephonic debriefings We believe that given the significance of the SCI program and the stringent security policies and procedures applicable to safeguarding SCI information administrative debriefings should be rare At Sandia however this practice appears to be routine We believe that Sandia should discontinue administrative debriefings except in the instance specified under DOE policy OUT-PROCESSING PROCEDURES Page 8 Sandia Human Resources retains terminating employees’ separation checkout sheets for 12 months so we reviewed a judgmental sample of 581 Sandia employees out of the 1 189 who departed the Laboratory from May 1 2004 to April 30 2005 We found that 230 of the 581 terminated Sandia employees did not complete separation checkout sheets Details of Findings Sandia’s “Separation Process Procedures ” which is maintained on its internal web site requires all terminating Sandia employees to complete a “SEPARATION CHECKOUT SHEET – For All Personnel Separating from Sandia ” This checkout sheet is intended to ensure among other things that an employee’s badge and Security Termination Statement are collected at the time of departure Subcontractor employees are out-processed by their organization Because the checkout sheets were not always completed by terminating Sandia employees Badge Office and Personnel Security officials frequently did not receive timely notification that employees were terminating This may have contributed to the issues we identified RECOMMENDATIONS We recommend that the Director IN ensures that 1 Terminating employees who held SCI access authorizations are debriefed and sign the Debriefing Acknowledgement and that the use of administrative debriefings is limited to the circumstances described in DOE policy We recommend that the Manager Sandia Site Office ensures that 2 In accordance with DOE policy Sandia recovers badges of terminating Sandia and subcontractors employees conducts Security Termination Briefings completes Security Termination Statements and makes timely notification to DOE when security clearances and access authorizations should be terminated 3 Sandia reviews the facts and circumstances with respect to employees changing the termination dates on subcontractor employee Security Termination Statements and takes appropriate follow-up action to include disciplinary action if warranted 4 Sandia does not exceed the 12-month variance for terminating student clearances 5 Sandia and subcontractor employee SCI access authorizations are terminated in a timely manner 6 Sandia subcontractor employees performing personnel security duties include all required information in security clearance debriefings Page 9 Recommendations 7 Sandia subcontractors maintain personnel security files in accordance with DOE policy to include records relating to access authorizations and terminations 8 Sandia takes action to ensure that terminating employees follow the applicable out-processing procedures MANAGEMENT COMMENTS In comments on our draft report IN agreed with recommendation 1 and stated that IN will issue clarifying policy regarding the use of administrative debriefings for individuals who have had access to SCI information In comments on our draft report NNSA agreed with recommendations 2 through 8 and stated that “since the inspection internal controls have either been strengthened or developed to ensure that the issues that are raised in this report do not occur ” NNSA agreed to take the corrective actions recommended and noted that a number of corrective actions are nearing completion In addition under separate cover NNSA provided technical data regarding the report and corrective actions that have been implemented INSPECTOR COMMENTS Page 10 We found management’s comments to be responsive to our report In addition we reviewed the technical data provided by management and discussed specifics with Sandia and the report was revised as appropriate Management and Inspector Comments Appendix A SCOPE AND METHODOLOGY We conducted the majority of our inspection fieldwork between March and May 2005 We interviewed Laboratory and subcontractor officials regarding Sandia out-processing badge termination and retrieval and clearance termination procedures We reviewed DOE and Sandia policies procedures and records regarding employee terminations security clearance and access authorization terminations and badge turn-in procedures We also interviewed DOE officials regarding security clearance and access authorization terminations Documents of primary interest were  DOE Manual 470 1-1 “Safeguards and Security Awareness Program ”  DOE Order 472 1C “Personnel Security Activities ”  DOE Manual 472 1-1B “Personnel Security Program Manual ”  DOE Manual 473 1-1 “Physical Protection Program Manual ” This inspection was conducted in accordance with the “Quality Standards for Inspections” issued by the President’s Council on Integrity and Efficiency Page 11 Scope and Methodology Appendix B RELATED REPORTS The following OIG reports involve work similar to this inspection  “Personnel Security Clearances and Badge Access Controls at Department Headquarters” DOE IG-0548 March 2002  “Personnel Security Clearances and Badge Access Controls at Selected Field Locations” DOE IG-0582 January 2003  “Security and Other Issues Related to Out-Processing of Employees at Los Alamos National Laboratory” DOE IG-0677 February 2005 and  “Security Clearance Terminations and Badge Retrieval at Lawrence Livermore National Laboratory” DOE IG0716 January 2006 _____________________________________________________________________________________________ Page 12 Related Reports Appendix Management Comments Appendix continued Management Comments Appendix continued Management Comments IG Report No DOE IG-0724 CUSTOMER RESPONSE FORM The Office of Inspector General has a continuing interest in improving the usefulness of its products We wish to make our reports as responsive as possible to our customers’ requirements and therefore ask that you consider sharing your thoughts with us On the back of this form you may suggest improvements to enhance the effectiveness of future reports Please include answers to the following questions if they are applicable to you 1 What additional background information about the selection scheduling scope or procedures of the inspection would have been helpful to the reader in understanding this report 2 What additional information related to findings and recommendations could have been included in the report to assist management in implementing corrective actions 3 What format stylistic or organizational changes might have made this report’s overall message clearer to the reader 4 What additional actions could the Office of Inspector General have taken on the issues discussed in this report which would have been helpful 5 Please include your name and telephone number so that we may contact you should we have any questions about your comments Name _____________________________ Date ___________________________________ Telephone _________________________ Organization ____________________________ When you have completed this form you may telefax it to the Office of Inspector General at 202 586-0948 or you may mail it to Office of Inspector General IG-1 Department of Energy Washington DC 20585 ATTN Customer Relations If you wish to discuss this report or your comments with a staff member of the Office of Inspector General please contact Judy Garland-Smith at 202 586-7828 The Office of Inspector General wants to make the distribution of its reports as customer friendly and cost effective as possible Therefore this report will be available electronically through the Internet at the following address U S Department of Energy Office of Inspector General Home Page http www ig doe gov Your comments would be appreciated and can be provided on the Customer Response Form attached to the report