UC fined $3 million for Los Alamos security breach

0 Comments | Oakland Tribune, Jul 14, 2007 | by Betsy MasonSTAFF

The University of California was fined $3 million over a security breach discovered in October at Los Alamos National Laboratory after police discovered 1,000 pages and several portable computer drives containing classified information at the home of a subcontractor's employee.

UC gave up direct management of the lab in June 2006, but a Department of Energy investigation found that the incident resulted from poor management practices inherited from UC, which managed the lab for 63 years.

"Had UC implemented adequate management controls, it might have prevented this from happening," said Julianna Smith, spokesperson for the National Nuclear Security Administration, a branch of the DOE that oversees the nuclear weapons complex.

The new manager, Los Alamos National Security LLC, is run by a partnership of UC, Bechtel National Inc., BSX Technologies Inc. and the Washington Group International Inc. The company was also fined $300,000 over the same incident and ordered to make specific changes to security practices.

UC spokesman Chris Harrington issued a statement Friday highlighting the timing of the incident after the lab had changed hands and the fact that the person involved was not a Los Alamos Lab employee.

Harrington also outlined a number of "aggressive steps" taken while the university still had sole control of the lab, including reducing the number of removable drives and other portable electronic media at the lab and a move toward a "diskless/media- less environment."

The DOE's notice of the violation cited "the gravity of the security breach" and "UC's history of prior similar violations" as factors that led to the large fine. The maximum possible penalty is $5.8 million.

The notice stated that UC had failed to implement proper escort oversight and physical checks that would have caught the worker who took the classified items out of the "vault-type room" where they are kept. It said UC "may not escape liability for these deficiencies because an individual subcontractor exploited weaknesses in UC's security management controls shortly after the university's tenure ended."

Harrington said UC will respond with concerns and objections during a formal 30-day period, after which the DOE will decide on a final penalty. UC then has the option to appeal the decision in federal court.

This is the first security violation handed down by the DOE after the regulations for such violations and penalties went into effect last year, and the largest civil penalty of any kind the Department has ever levied.

Previously, the DOE could cite the labs over safety issues, but UC was exempt from paying those fines due to its nonprofit status.

"This is different," Smith said. "This is a security fine, and there are no exemptions."

The lab issued a statement Friday acknowledging the DOE investigation's findings and saying steps have been taken to fix some of the problems.

The management contracts for both Los Alamos and Lawrence Livermore laboratories were put up for bid by the DOE after a string of safety and security lapses brought intense scrutiny from the media and pressure from the federal government.

Teams led by UC and several private companies won the contracts for both labs. The new management is set to take over the Livermore lab in October.

Contact Betsy Mason at bmason@cctimes.com or (925) 847-2158.