Computer thefts prompt Los Alamos security review

Computerworld - The Los Alamos National Laboratory has launched a month-long project aimed at ensuring that off-site computer systems fully comply the institution's information security policies. Los Alamos officials are also conducting a full review of the lab's policies and procedures governing the use of official computers at employees' homes.

The moves come after last month's theft of three computers from the Santa Fe home of an employee and the subsequent disclosure that several dozen more systems are currently listed as missing from the top U.S. nuclear weapons laboratory.

Jeffrey Berger, director of communications at the Los Alamos, N.M., facility, said that lab officials are taking the issue of the missing computers "very seriously." He noted that only one of the computers that was stolen from the employee's home was authorized for home use.

Berger did say that none of the missing systems held classified data. "It is true that [the Los Alamos lab], like any large organization that uses computers, has had computers go missing or get stolen," Berger said in an e-mail. But he insisted that despite apparent thefts, the lab has "consistently earned some of the highest ratings for property accountability" within the U.S. Department of Energy's National Nuclear Security Administration (NNSA).

The latest apparent security breach at the Los Alamos lab follows a DOE move in July 2007 to fine the lab for an October 2006 breach that exposed classified data. In that case, a contract worker illegally downloaded and removed hundreds of pages of classified data from the lab via USB thumb drives.

Barely a month earlier, lawmakers slammed the Los Alamos lab after it was discovered that several Los Alamos officials had used unprotected e-mail networks to share highly classified information. And in June 2000, several computer disks containing classified information on how to disarm Russian and American nuclear devices were found to be missing from a secure storage area.

News of the missing computers was disclosed earlier this month by the Project on Government Oversight, or POGO. The watchdog group posted a memo (download PDF) on its site from the NNSA expressing concern over the theft of the three computers from the home of a Los Alamos National Security LLC (LANS) employee in January. LANS runs the facility for the U.S. government.

In addition to the missing computers, POGO also disclosed that an LANL employee had lost a lab-owned BlackBerry in a "sensitive" but undisclosed foreign nation.

The NNSA letter, dated Feb. 3, criticized the lab's response to the missing systems, and the apparent lack of controls aimed at preventing such incidents. The letter noted that follow-up inquiries about the January incident revealed that as many as 67 Los Alamos lab computers were currently listed as "missing" from the lab, including 13 that were known to be lost or stolen.