The National Nuclear Security Administration last week announced new policies on cyber security and protection of Energy Department nuclear weapons facilities that it says will save tens of millions of dollars through new, more realistic terrorist threat assessments, increased flexibility for sites to develop better protection plans and the elimination of some unneeded controls on computer disks and other electronic media holding certain classified data.
Officials at NNSA, the semi-autonomous DeE agency that operates the department’s nuclear weapons complex, emphasized the new policies would not lower security for sensitive weapons sites or facilities, but rather would enable each site to better customize protection plans for their particular vulnerabilities and physical layout.
The officials said individual sites would be able to modify current “design basis threat” assessments to more accurately pinpoint and address the specific threats they face. Sites also would have more flexibility to determine the optimal mix of guards, physical barriers and new threat or intruder detection systems best suited to protect nuclear materials. In allowing these site-by-site determinations, the officials said they hoped to both save money and make security more effective.
With the new cyber security policy, NNSA officials said they generally are seeking to impose more agency-wide consistency and standards on protection of classified data, which they said now varied somewhat from site to site. However, they also said the new policy allowed for greater efficiencies, particularly in removing some controls deemed no longer necessary.
Most notably, the officials said the new policy eliminated the requirement that NNSA contractors keep track of each individual computer disk, hard drive, thumb drive, laptop computer and other “classified removable electronic media” (CREM) containing less-sensitive information, including information designated as “restricted data.”
Brad Peterson, NNSA’s chief of defense nuclear security, said the elimination of those CREM accountability requirements was warranted because paper records containing the same type of information were not subject to the same tracking requirements. Thus, he said the new policy would ensure more consistency between the two data formats.
In general, the CREM accountability rules–which require lab employees to check disks in and out like library books when they use them–are aimed at making it harder for anybody to smuggle out of NNSA sites very small and portable computer disks or thumb drives that can carry vast amounts of data equivalent to stacks of paper.
The CREM accountability requirements have bedeviled Los Alamos National Laboratory in recent years, with the weapons lab frequently penalized for losing track of computer disks and other CREM. In a particularly embarrassing episode, a lower-level lab worker brought a thumb drive back to her home, where it was discovered by local police during a drug raid.
Largely as a result of the Los Alamos incidents, NNSA in recent years has significantly scaled back its use of CREM by moving to diskless computing systems located in highly secure rooms.
Overall, Peterson said the intent of the new NNSA policies was to make more effective use of taxpayer dollars and pare back requirements that provided no real boost to security.
“It is an expensive program and we are trying to be responsible stewards of the taxpayer dollars,” Peterson told reporters in a teleconference Thursday. “Every dollar should be buying down some risk for the American people.”
He said NNSA could not provide any definitive estimates on savings from the new policies, but added: “We estimate it’s going to be tens of millions of dollars over the next five years. We are going to do the responsible thing and…save as much money as we can.”
At the same time, Peterson said: “I don’t want to characterize any of this as lowering our security requirements. We are not accepting significant new risks…for [protecting] special nuclear material and nuclear weapons. There will be some minor adjustments” to site protection plans.
“There are a lot of threats out there,” he noted. “We have been criticized on both sides of the spectrum. Some people say we are over the top with conservative implementation. Other people say we are not doing enough.
“We tailor the policy to the individual site. Guarding the Device Assembly Facility in the middle of the desert [at the Nevada Test Site] is very different from protecting [Building] 9212 at [the] Y-12 [site]” at Oak Ridge, Tenn.
“An important question is, how much [protection] is good enough?” he added. “We will have a very sound basis for [determining the right size of security guard forces at each site] and what we are defending against.”
The new security policy is an outgrowth of the Graded Security Protection (GSP) policy put in place by the Bush administration in 2008, which allowed more site-specific threat analyses and protection plans.
The GSP was developed because of increasing controversy within DoE and in Congress over the massive growth in security costs at the department’s nuclear sites in the wake of 9/11 terrorist attacks in September 2001. Some critics said threat assessments for some DoE sites were unrealistically high, requiring huge security forces and expenditures that were not warranted. Other critics charged that DoE was too often issuing so-called “dollar-based threat” assessments that low-balled risks so that the department could cut back security spending that ran into the hundreds of millions of dollars every year.
Peterson said NNSA began developing its new policies in June 2009. That is about the same time that Deputy Energy Secretary Daniel Poneman issued a directive to all DoE units asking that they review all safety and security policies to eliminate unnecessary and overly burdensome requirements on DoE site contractors.