Oops'Energy facility fails to wipe data from surplus IT
The Energy Department's Savannah River Site failed to wipe the data from surplus hard drives earmarked for a September 1999 delivery to China, Energy's inspector general reported last month.
Only a few of the 23 hard drives and 17 floppy disks found among surplus equipment tagged for shipment had been properly cleared, IG Gregory H. Friedman noted in a recent report, . Savannah had used the equipment to store executable files, maps, database tables and archived historic information.Investigators from Westinghouse Savannah River Co., a subsidiary of Westinghouse Corp. that manages the Aiken, S.C., site for Energy, found no classified information on the drives, the June report said. Nearly 80 percent of the 16,000 employees at the Energy facility work for Westinghouse. Two percent are department employees and the rest are other contract workers.The IG reported, however, that unclassified but controlled nuclear information and other sensitive information was found on the surplus equipment, purchased for roughly 10 cents per pound by Allied Fabricators and Constructors of Clearwater, S.C.Allied had planned to sell the equipment to a Chinese company but halted the shipment after one of its employees noticed a floppy disk marked 'secret-restricted data.'Allied notified Westinghouse, which prompted a team of Energy officials to visit Allied's facility to look into the matter. The DOE team determined that the disk contained no classified information, the IG report said.But after its own investigation,Westinghouse bought back the equipment for $59,000, Friedman reported. Allied initially had paid $41,000 for the hardware. Ultimately, Westinghouse destroyed it.The IG reported that the company's review found no evidence that classified information or restricted data had been released, but the report pointed out that investigators did not review the disposition of all classified systems disposed of in recent years.There are 147 systems used for classified data at the Savannah River facility, the IG report said.'Since the computer equipment recovered by Westinghouse from Allied was destroyed without further examination, no one can be certain what information, if any, was on the unexamined equipment when it was destroyed,' Friedman said.Friedman said Westinghouse apparently violated the Atomic Energy Act of 1954 and Energy regulations on disposing of high-risk personal property by failing to make certain the drives had been reformatted and wiped of data.Westinghouse officials did not return a reporter's phone calls.The equipment included a Digital Equipment E3S VAX disk drives with a storage capacity of about 300M each and a E3S VAX minicomputer. Besides the destroyed equipment, Westinghouse is unable to account for 30 E3S disk drives sold as surplus, the IG said.Bill Taylor, an Energy spokesman at the Savannah site, said he did not know if anyone was specifically responsible for ensuring that surplus equipment had been wiped of data before being sold. 'We are lucky the information was not harmful to national security,' Taylor said.Westinghouse's digital controls and systems department provides technical assistance on cleansing disk drives, the IG report said. But that help is not always sought, the company's technicians told IG auditors.Before the September incident, Allied had shipped surplus equipment from Savannah River to a Chinese company in July 1999. Allied officials said they do not recall seeing any hard drives, but no records exist detailing the shipment, Friedman said.Energy and Westinghouse officials at the Savannah site also are not certain what was in the shipment, Taylor said.Even before its July shipment, Allied managers were concerned about the surplus equipment they had bought from Westinghouse, Friedman reported. After news reports that nuclear information might have been released to China, Allied managers in June asked their employees to watch for drives and disks that might contain sensitive data, the IG report said. Between June and October, the company returned to Energy 47 hard drives, 63 optical media disks and 41 disks of various sizes, the IG reported.To prevent further problems, Westinghouse in September began destroying all surplus computer equipment at Savannah. It has since put the policy on hold pending a review. Critics called the policy wasteful because even monitors and keyboards were destroyed, the IG reported.
Inspection of Surplus Computer Equipment Management at the Savannah River Site
On alert
By Tony Lee Orr
GCN Staff
The Energy Department's Savannah River Site failed to wipe the data from surplus hard drives earmarked for a September 1999 delivery to China, Energy's inspector general reported last month.
 | Before anyone was aware that sensitive data might still be on the surplus hardware, Allied stored some of it outside. |
Inspection of Surplus Computer Equipment Management at the Savannah River Site
On alert
NEXT STORY: Senator seeks security $$