Los Alamos National Lab Missing 67 Computers

Via ComputerWorld -

New Mexico-based Los Alamos National Laboratory (LANL), the nation's leading nuclear weapons lab, once again finds itself the focus of concerns about potentially serious cybersecurity lapses.

The Project on Government Oversight (POGO), a watchdog group, yesterday released a memo from the Department of Energy's National Nuclear Security Administration (NNSA) expressing concern over the theft of three computers from the home of an employee at Los Alamos National Security LLC (LANS) in January.

LANS is a limited liability company comprising the University of California at Oakland, Bechtel National Inc. and two other firms that have been managing LANL since 2006.

The Feb. 3 NNSA letter expressed frustration at LANS's lackadaisical response to the theft and the apparent lack of controls aimed at preventing such incidents in the first place. It noted that follow-up inquiries about the January incident revealed that as many as 67 LANS computers are currently "missing" from the lab, including 13 that are known to have been lost or stolen. It is not clear yet whether any of the computers contained classified or sensitive information.

The memo noted that LANS originally treated the January thefts as a "property management issue." As a result, the DOE did not learn of the missing hardware right away, limiting its ability to respond quickly to the potential loss of sensitive information, the DOE said in its letter. The agency also hit "significant weaknesses in individual controls," configuration management and accountability, and said it is still unsure about the "magnitude of exposure and risk."

Citing an internal memo, POGO last week also disclosed that in a separate incident, a LANL employee had lost an official BlackBerry in a "sensitive" but undisclosed foreign nation.

Ingrid Drake, an investigator for the Washington-based POGO, said the NNSA memo shows that it feels "it has been kept out of the loop" regarding potential security lapses at LANS. It is also significant that there is continuing uncertainty whether the missing computers contained sensitive or classified data, she said.

"They say, at best, there is no sensitive information," Drake said. That suggests that no system is in place for knowing what kind of information is contained on computers used at the laboratory, or if there is one, that it isn't functioning as it should, she said.

A spokesman for the NNSA referred a request for comment on the missing computers to LANS officials, who did not immediately respond to a request for comment.