Department of Justice (DOJ) Inspector General Michael E. Horowitz announced today the release of a Management Advisory Memorandum to the Director of the Federal Bureau of Investigation (FBI) identifying concerns with the FBI’s inventory management and disposition procedures for its electronic storage media containing sensitive but unclassified (SBU) information, such as law enforcement sensitive information, as well as classified national security information (NSI), and the physical security over these items at an FBI-secure controlled facility.
The DOJ Office of the Inspector General (OIG) found several areas for improvement in the FBI’s media accountability and disposition efforts, including:
- Electronic Storage Media Containing SBU information or Classified NSI is Not Always Accounted For. We found the FBI does not always account for its loose electronic storage media, including hard drives that were extracted from computers and servers, thumb drives, and floppy disks. For example, the FBI instructs field offices to remove hard drives slated for destruction from Top Secret computers to be couriered separately to save on shipping costs. However, extracted internal hard drives are not tracked, and the FBI does not have the ability to confirm that these hard drives that contained SBU and/or NSI information were properly destroyed. The lack of accountability of these media increases the risk of loss or theft without possibility of detection.
- Electronic Storage Media Extracted from Large Components Are Not Marked with Appropriate Classification. Although classification labels (e.g., Unclassified, Secret, Top Secret) are affixed onto computers and servers, internal electronic storage media pulled from them are not labeled. When extracting internal electronic media for disposal, these internal media become stand-alone assets without any label to identify the level of classification of information they contained or processed. Additionally, we found that the FBI does not label small media flash drives to identify their classification. These practices are not in accordance with FBI and DOJ policies.
- Electronic Storage Media Slated for Disposal Are Not Physically Secured. Non-accountable assets slated for destruction were stored on pallets without sufficient internal physical security for an extended period of time. For example, a pallet containing extracted internal hard drives marked non-accountable had been stored for 21 months and had wrapping that was torn and left open. This facility is shared with other FBI operations, such as logistics, mail, and information technology equipment fulfilment, and had almost 400 persons with access as of May 2024, including 28 task force officers and 63 contractors from at least 17 companies. Both the FBI supervisor and contractor confirmed that they would not be aware if someone was to take hard drives from the pallets because these assets are not accounted for or tracked.
The DOJ OIG made three recommendations to improve the FBI’s management of its inventory and disposition for its electronic storage media. The FBI agreed with all three recommendations.
Large Open Box of Non-accountable Media in the Property Turn-in Area
Source: OIG, date October 23, 2023 (OIG removed commercial brand names in the photo)
Pallet with Open (or Broken) Wrapping in the Facility Shelving Area
View 1 – Electronic storage media exposed
Source: OIG, date October 23, 2023