Some programs to ferret out potential insider threats at the Department of Energy are still not in place eight years after they were established, the Government Accountability Office reported Thursday.
DOE established its Insider Threats Program in 2014 but has “not implemented all required measures” for the program, like ensuring employees are trained to identify and report potential threats, according to a Government Accountability Office (GAO) report published on Wednesday. Congress ordered the study in the 2020 National Defense Authorization Act.
“The agency hasn’t clearly defined contractors’ responsibilities for this program,” the GAO found, although various contractors manage the construction, storage and maintenance of nuclear weapons on behalf of the semi-autonomous National Nuclear Security Administration (NNSA).
In comments published along with the report, DOE said it planned some steps this summer to shore up its insider threat program.
These include developing a tracking mechanism for corrective actions to the Insider Threats Program by its designated senior official by June 30. DOE’s Office of Insider Threats is headed by Sabeena Khana, who runs the program on behalf of Office of Environment, Health, Safety and Security Deputy Director of Security John Boulden.
The senior official has launched a strategic review of the program to “identify additional needed process changes” that should be completed by the end of June. DOE also will prepare an annual report on its efforts to weed out insider threats by July 31 and then update it annually.
DOE split responsibilities for policing insider threats between two offices: the internal security office where the agency’s senior insider threats official works and the Office of Counterintelligence, which handles operational control for insider threat incident analysis and response, GAO said. The counterintelligence office independently reports directly to the Secretary of Energy, according to the report.
“Without better integrating insider threat responsibilities between these offices, DOE’s insider threat program will continue to face significant challenges that preclude it from having an effective or fully operational program,” GAO found.
DOE also has not crunched the numbers on how much funding and how many employees it needs to adequately run the insider threats program, GAO found. The department’s budget does not account for all the program’s responsibilities and “DOE’s budget does not include dedicated funding for its contractor-run nuclear weapons production and research sites to carry out their responsibilities for implementing the program,” the report said.
NNSA’s fiscal 2024 budget request includes $84.7 million for International Nuclear Security, which includes funding to “develop strategies, tools, and processes for cybersecurity, insider threat mitigation, and other dynamic nuclear security functional areas.” Funding for insider threat mitigation also is included in the $258 million funding requested for Radiological Security.
GAO made seven recommendations for fixing the DOE’s insider threat program, ranging from consolidating operational control under a single senior official to reporting annually on the program’s progress and better defining the resources needed to implement the program. In a three-page response to the report, DOE officials concurred with each recommended action and said plans were in place to address each.
