From: Wallace, Terry C Jr
Sent: Mon Feb 09 09:08:13 2009
Off-Site Computer Recall
On Friday there was a recall of all "off site" computer equipment. The intent of this recall is to physically "touch" all such equipment by LANL property professionals, and then to allow equipment that is required for off-site work to be authorized and moved back to the off-site locations. I realize that this disrupts some work, but the intent is to make this process as simple and timely as possible. Recent events have highlighted some potential issues with off-site equipment; LANL has over 40,000 bar-coded computer related equipment, a fraction of which is off-site. The off-site computer equipment presents a number of risks, including information loss, property loss, and inappropriate use of government resources and equipment.
The Lab wishes to provide an environment that will enable Laboratory employees to perform their work and enable creative contributions after-hours and while on travel in a secure manner. We must be absolutely confident that all off-site equipment is accounted for, and that this equipment is authorized for use considering the risks associated with off-site use. The wall-to-wall inventory of the computer equipment is the first step of our risk mitigation strategy. There are a number of anecdotes I would like to use to highlight the risk: (1) There are a significant number of staff that have multiple computers presently approved for off-site use. For some, multiple computers may be appropriate for the work done, but for many others this may represent unnecessary risk associated with equipment loss or theft; (2) All LANL computers that have "normal" work files including email or proposals may contain sensitive information. This sensitive information could be OUO or even PII. For example, until a few years ago, all NSF proposals required a cover sheet with the PI's name and social security number. Thus, storing a complete proposal on one's lab computer amounts to storing PII (even today many resumes include a social security number). Losing a computer with non-encrypted PII is a security infraction that LANL must report within a day; (3) Although the LANL policy allows for "incidental" personal use, government equipment must never be used for personal gain or for a private business, to visit inappropriate websites, or be used by a third party (including a family member). Off-site computers present the opportunity for forbidden use, and care must be taken to ensure that only LANL work is performed, and stored on these computers.
Early next week LANL will issue clear policy on what is needed to justify off-site computer equipment. Again, we want to have an environment that recognizes that staff are extremely dedicated and creative, and that off-site work is essential to how we function. At the same time we have to recognize the risk, and we will require strong justification for off-site equipment. We will forward the details of the inventory process early next week. There will be some exceptions to the immediate inventory. These include computers that are part of research projects housed at other facilities; computers associated with those of Change of Station and away from the Lab; computers in the LOFT program; Sun Ray and other computing platforms that are strictly media-less (containing no memory or disk storage) and special circumstances approved by Associate Directors. We will make future arrangements for these situations. All other computers need to come in - these computers will be checked, and if reauthorized for off site use, be available for off site use within a day.
I do appreciate that disruption this recall will create. I work on my LANL laptop every night and weekend, and will be similarly impacted. I am also acutely aware of the risk we presently have with our off-site equipment, and it is appropriate to mitigate that risk with a minimal impact on our productivity. Early next week we will also post a FAQ page to address situations that will arise.
Principal Associate Director
Science, Technology and Engineering
Los Alamos National Laboratory