Inspection Letter Report: INS-L-09-06

Security Weaknesses in the Handling of Unclassified Printers and Copiersat the Oak Ridge National Laboratory

Office of Inspector General

May 22, 2009
minute read time

May 22, 2009

Security Weaknesses in the Handling of Unclassified Printers and Copiersat the Oak Ridge National Laboratory

ORNL’s primary mission is to provide technology and expertise to Government agencies in support of national security. Much of the information produced or received by ORNL is sensitive and requires special handling to protect against unauthorized disclosure. The Department’s Oak Ridge Office oversees the management of ORNL by UT-Battelle, LLC. In carrying out its mission, ORNL uses various information technology systems to process or reproduce information, including some printers and copiers containing hard drives capable of storing information. This information may include sensitive, unclassified information, such as official use only, export controlled, and personally identifiable information (e.g., name, social security number and medical history) and requires specific protection as mandated by law, regulation, or policy.

Topic: National Security and Safety

  • ORNL’s primary mission is to provide technology and expertise to Government agencies in support of national security. Much of the information produced or received by ORNL is sensitive and requires special handling to protect against unauthorized disclosure. The Department’s Oak Ridge Office oversees the management of ORNL by UT-Battelle, LLC.
    In carrying out its mission, ORNL uses various information technology systems to process or reproduce information, including some printers and copiers containing hard drives capable of storing information. This information may include sensitive, unclassified information, such as official use only, export controlled, and personally identifiable information (e.g., name, social security number and medical history) and requires specific protection as mandated by law, regulation, or policy. Department policy requires that information storage devices in printers and copiers used to process such information must be cleared, purged, or destroyed
    by approved overwriting software, degaussing, or physical destruction before being excessed, returned to vendors, or internally transferred, so such information is not released to unauthorized personnel.