ACCOUNTING FOR INFORMATION

The introduction of sophisticated technology used to generate, reproduce, and electronically disseminate information, in conjunction with the high cost of records management, culminated in the elimination of accountability a few years ago for most classified matter. The cost of maintaining accountability records was deemed too exorbitant given the fact that insiders or adversaries could quickly download or send the information electronically to any destination. While records management costs for accountability may have been reduced, the costs for lost or compromised information continues to rise. Security professionals are investing a great deal of their work time performing inquiries, completing reports, and trying to recover the information. The exercise of tracking the information can be a daunting task. Without any form of accountability, the recipients of the information can claim no culpability in the loss of the matter. Bar codes can be affixed to the matter, all items scanned into an individual’s inventory, and bar code readers used to perform an annual inventory. Although this will not circumvent the insider threat completely, nor will it deter unauthorized dissemination, this will reinforce the personal accountability of those entrusted with classified matter. The importance of security appears diminished by having no accountability. Custodians are not responsible for the tracking of information that could gravely threaten our national security, while in most organizations the same custodian must account for company equipment and supplies. During the hearings regarding the Wen Ho Lee case in Los Alamos, one of the panel members pointed out the fact that more personal accountability and responsibility is required to check out a library book than to possess a classified document. Individuals who are careless rather than criminal will be reminded of their responsibilities by having to account for the matter. In addition to maintaining improved records for the type of matter stored at a facility, this will assist in completing inquiries and determining the root cause for the loss or compromise. Using these records will provide an audit trail to determine who has had access, and the final disposition of the information to ensure unauthorized access is not provided.