3 November 2000. Thanks to author and publisher.
Source: The China Threat, Bill Gertz; Regnery, Washington, D.C.; 2000. ISBN 0-89526-281-9.

A selection from several classified and unclassified documents. See other secret documents from the book: http://cryptome.org/tct-docs.htm

Anotation by the author.

[Appendix, pp 207-224.]

Portions of a secret report produced in late 1998 by the U.S. counterintelligence community that highlight the foreign intelligence assault on U.S. nuclear weapons laboratories. (18 pages)

SECRET
NOFORN
ORCON

Foreign Collection Against
the Department of Energy:
________________________
The Threat to US Weapons
and Technology (C NF)

[Emblems:]
National Counterintelligence Center
Central Intelligence Agency
Federal Bureau of Investigation
Department of Energy
National Security Agency
Department of Defense

[Bill Gertz writes that the report is by the National Counterintelligence Center with participation of the other agencies.]

_____________________________________________

Secret
NOFORN-ORCON

Foreign Collection Against the Department of Energy: The Threat to US Weapons and Technology (C NF)

Summary (U)

Information available as of 6 November 1998 was used in this report.

The US Department of Energy (DOE) is under attack by foreign collectors -- intelligence officers, as well as scientists, academics, engineers, and businessmen -- who are aggressively targeting DOE nuclear, sensitive and proprietary, and unclassified information. The losses are extensive and include highly classified nuclear weapon design information to the Chinese. Many foreign collectors find DOE's unclassified and declassified information as valuable as the classified information. They have repeatedly demonstrated the intent and capability, given the opportunity, to collect against DOE's vast holdings of technical knowledge and experience, thus circumventing expensive and time-consuming research and development efforts. Regardless of the collector, the ultimate recipients of the information are the foreign research institutes and defense establishments, which in turn apply this knowledge to advance their own scientific and technological efforts. (S NF)

Foreign collectors rightly view DOE as an inviting, diverse. and soft target that is easy to access and that employs many who are willing to share information. DOE believes that extensive interaction with foreign scientists is essential to maintaining its international scientific leadership. There are significant counterintelligence implications attached to this culture, however, as it offers foreign collectors abundant opportunities to gain access to DOE facilities and personnel, Following are examples of such opportunities:

• Approximately 25,000 foreign scientists visited or were assigned to DOE facilities in the past year; more contacts go unreported because they are not considered extensive.

• DOE's frequent participation in international scientific and academic exchanges and the frequent travel overseas of DOE employees lead to or expand access for foreign collectors. DOE employees are especially vulnerable to foreign collectors trained in elicitation. (S NF)

Foreign collectors are targeting both classified and unclassified DOE information. Whether stolen, elicited, or simply downloaded from the Internet. DOE information is enormously valuable. While we did not conduct a damage assessment of the information lost, individual cases clearly demonstrate that such information has saved other countries substantial time and money and has undercut US policy, security, and competitiveness. (S NF)

[Note: Text in the upper left corner of three pages were apparently obscured during reproduction, indicated below by "obscured."]

[Obscured] surveys the activities of 12 countries that pose significant [obscured] threats to DOE. Thre are other targeting the unique and valuable scientific and technological information held by DOE that still need to [obscured].

China, Russia and India pose the most immediate threat and are dedicating extensive resources in the United States and abroad to gain knowledge of DOE information.

• DOE records show that over 250 known or suspected intelligence officers from 27 countries have visited or been assigned to DOE facilities in recent years.

• Foreign collectors pose a significant -- and growing -- cyberthreat to DOE computer systems. DOE scientists have extensive computer contact with their foreign colleagues and rely heavily on e-mail communications to maintain their dialogue. These interactions, however, allow foreign collectors to elicit information freely and repeatedly. (S NF)

This assessment is a necessary and sound starting point for understanding the dimensions of the threat to DOE's weapons and technology. However, the US Intelligence Community (USIC), working together with DOE, must do more to gain a full understanding of the nature and extent of foreign targeting of DOE's unique scientific knowledge base. The USIC needs to commission follow-on assessments to determine the impact of the loss of scientific and technological knowledge on US national security, regional stability, and economic competitiveness. The USIC also needs to issue specific collection and dissemination requirements to raise the priority of the foreign threat to DOE and to expand the sharing of information within and across agencies. (S NF)

Secret
NOFORN-ORCON

Foreign Collection Against the Department of Energy: The Threat to US Weapons and Technology (C NF)

Introduction (U)

This assessment will focus on the wide range of foreign threats to DOE and the potential loss of classified and sensitive unclassified knowledge of US weapons and technologies. The interigency working group that prepared this assessment reviewed currently available FBI cases and investigations, DOE informaticim as well as CIA and NSA intelligence reporting. as a basis for judgments. The assessment will highlight the evidence of foreign targeting of DOE, discuss the information foreign collectors find of value, and suivey the collection roles of not only foreign intelligence services, but, more important, foreign scientists, academics, engineers, and businessmen. It is organized to examine who the collectors are, what they are collecting. and how they are collecting it. A key portion of this assessment will be its identification of important shortfalls and gaps in our understanding of the foreign threat to DOE and what is required by the USIC to better assess the threat in the future. (C NF)

DOE's reputation as a world leader in science and technology (S&T) makes it a prime target for foreign collection. The working group reviewed several USIC products, including PDD/NSC-35, Intelligence Priorities, NACICs Annual Report to Congress on Foreign Economic Collection and Industrial Espionage, the National Security Threat List, and DOE's Sensitive Country List,¹ to help identify which countries already have demonstrated the opportunity, capability, and the intent to target the United States in other areas. In most cases, these countries almost certainly see DOE, with its vast storehouse of expertise, as a potential target for collection of important intelligence on weapons and technology. (S NF)

_____________________

1 The Sensitive Country List includes Algeria, China, Cuba, former Soviet republics, India, Iran, Israel, Libya, North Korea, Pakistan, Sudan, and Taiwam. (C)

Using these documents as guides, the interagency working group focused on 12 countries and searched available data to assess the specific threat to DOE. These countries are China, Russia, India, Pakistan, Iran, Israel, Taiwan, South Korea, Japan, France, North Korea, and Iraq. The focus on them in this assessment does not mean they are the only countries targeting DOE information. (C NF)

DOE Information Targeted by Foreign Entities (C NF)

The foreign threat is directed at both of DOE's primary areas of responsibility -- information related to US nuclear weapons and other areas where DOE exerts scientific leadership. Within those two broad areas, foreign entities have demonstrated a strong interest in all categories of information: classified, declassified, and unclassihed nuclear information; proprietary information; sensitive unclassified information; and unclassified information. Reporting shows that some countries have used their intelligence services or resources to collect unclassified information. However, due to biases and limitations of intelligence collection and security investigations, we know much more about foreign interest in DOE nuclear information than any other type or classification of information. (S NF)

Nuclear Information -- Classified, Declassified, and Unclassified

Foreign collectors of nuclear information are interested in all facets of US capabilities and in past experience in the design of nuclear explosive devices. While the modern US stockpile has tended to coalesce around a fairly narrow set of technical approaches to weapon design, the vast storehouse of information contained in the storage vaults and in the minds of personnel involved in all phases of the US program represents a lucrative target for collectors. (C NF)

Overview of the Department of Energy (U)

[Obscured] responsibilities:

[Obscured] and reliability of [obscured] stockpile. In a non-[obscured] environment, DOE [obscured] technological areas [obscured] nuclear ignition, as [obscured] simulation. Along with the [obscured] Defense (DoD), DOE develops [obscured] safety and reliability of [obscured] powering US Navy [obscured]

[Obscured] US leadership in world-class [obscured] development in energy resources [obscured] environmental quality. DOE scientists and engineers conduct breakthrough research in high-energy physics, energy siences and technology, superconducting materials, accelerator technologies, materials sciences, and environmental sciences. DOE and its large staff of contractors manage sites and facilities in 35 states. DOE work ranges from highly classified Special Access Programs (SAPs) -- boht jointly with other US Government agencies and unilateral DOE projects -- to sensitive unclassified research and proprietary collaborations with US industry. (S)

DOE Personnel

DOE is operated by 10,500 Federal employees. However, the bulk of the actual workforce is made up of approximately 120.000 personnel working for prime contractors, subcontractors, and those on support service contracts. Of the personnel working for DOE as Federal employees or contractors, 66,000 have "Q" security clearances, meaning they have access to Top Secrer/SCI/Restricted Data material. Restricted Data (RD) concern the design, manufacture, or utilization of atomic weapons; the production of special nuclear material; or the use of special nuclear material in the production of energy. Of the remaining personnel at DOE, 39,000 have "L" security clearances, meaning they have access to Secret/National Security Information, as well as to Confidential/RD material and Secret/Formerly Restricted Data material. (U)

DOE's Visitor/Assignee Programs

The number of foreign scientists with access to DOE facilities has grown significantly in recent years, In 1998, approximately 25,000 foreign scientists will visit or are assigned to DOE facilities.^a This number is just an estimate. as some laboratories have been exempted from the requirement for recordkeeping. Further, as a whole, DOE does not track foreign visitors from countries not on DOE's Sensitive Country List -- some of which are identified in this report as targeting DOE. But where DOE records exist, we know that the number of foreign scientists visiting or assigned to DOE facilities from the list of sensitive countries has increased over 200 percent from the mid-1980s to the mid-1990s. (S NF)

____________________

a Foreign assignments involve periods of more than 30 days and initially are approved for a two-year period. Foreign national visits involve periods of less than 30 days in a given year. Foreign visitors, however, may make several separate visits to a particular laboratory and also may visit several different laboratories during a year. As a result. the access of a foreign visitor may be greater than that of a foreign assignee. (C NF)

Counterintelligence Issues at DOE

DOE's goal of maintaining US technological superiority drives it to constantly seek to improve its world-class research and development efforts. Recognizing that the United States does not have a monopoly on cutting-edge scientific research and development, DOE believes that its continued interaction with international scientists is essential. Further, it is intrinsic to their professions for DOE scientists to want their iqformation to be used and visible in the national and international scientific and academic communities. From a CI perspective, however, this creates an inherent tension between diffusion of DOE knowledge for purely scientific advancement and the protection of classified and sensitive^b unclassified DOE information. (U)

____________________

b A sensitive technology is an unclasitified subject identified by DOE that involves information, activities, and/or technologies that are relevant to national security. Disclosure of sensitive subjects has the potentiol for enhancing nuclear proliferation, divulging militarily critical technologies, or revealing other advanced technologies. Therefore, sensitive subjects require special management oversight, especially prior to release to foreign nationals. Sensitive subjects include nuclear weapons-related information, technologies under export control, certain dual-use technologies, and rapidly advancing technologies judged to how a critical military application. (FOUO)

Historically, the effectiveness of the DOE CI program has been undermined by a series of structrural and systemic problems, including a lack of programmatic accountability and ineffectual centralized control over CI resources in the field. These problems stymied efforts to assess, understand, and reduce the foreign intelligence threat. PDD/NSC-61 was issued to address these issues and resolve many of the underlying structural deficiencies. CI challenges remain at DOE, but with new authorities and resources given to the reorganized Office of Counterintelligence, DOE hopes to make significant strides toward finding the right balance of openness and protection of national security. (C NF)

Countries with advanced nuclear weapons programs -- such as Russia, China, Israel, and France -- are interested in advanced nuclear weapons designs, testing simulation techniques, and data on the long- term viability of nuclear weapons. Such information can enhance the military utility of nuclear stockpiles and reduce the need for nuclear testing. Listed below are a few examples of such targeting:

• During the period 1984 to 1988, China obtained through espionage the design information on a current US warhead. To obtain this information, the United States conducted tens of nuclear tests. Once obtained, the Chinese were able to accelerate their research and advance their nuclear weapons program well beyond indigenous capabilities.

• Starting in 1985 and as late as 1997, Dr. Peter Lee, who once worked at Los Alamos National Laboratory, provided China with classified ipfomation on nuclear weaponry.²

• Over the last 10 years, at least 22 of 103 Israeli visitors to Lawrence Livermore National Labomtory were either associated with Israel's nuclear weapons program or involved in research at Lawrence Livermore that could be applied to nuclear weapons development. Israel also benefits from Lawrence Livermore's unclassified test results. which can be used to validate its codes. (S NF)

____________________

2 Lee, a contract DOE employee at Los Alamos, traveled with a group of scientists to China in 1985 at the invitation of a Chinese visitor to his laboratory. Lee's services were needed to translate for the delegation. During his trip, Lee was approached late one night in his hotel room by two State Science and Technology Commission officials who pitched him and secured his cooperation, appealing to his ethnic/cuftural ties to China. Lee was convicted in 1997 and later admitted to passing information on nuclear weaponry und antisubmarine warfare. (C NF)

Countries with less sophisticated nuclear programs -- such as India and Pakistan -- are equally interested in US capabilities developed much earlier in the US program,³ even though many of the technologies an no longer considered state of the art. These countries target current DOE nuclear-related information and also look to early, declassified US approaches to guide their design and production activities. Such information is significant because it can guide foreign efforts to develop or refine nuclear weapons and may lead to proliferation of these weapons:

• Pakistan's two primary nuclear weapons program entities -- the Khan Research Laboratories (KRL) and the Pakistan Atomic Energy Commission (PAEC) -- may be seeking DOE information. One method is through interaction between KRL and PAEC officials and DOE scientists at international conferences on South Asian arms control and non-proliferation.

• Indian scientists have used unclassified DOE information to advance their understanding of firing system-related technologies. Moreover, Indian nuclear weapons-related technical publications include many references to DOE reports -- some dating as far back as the 1970s -- which describe technologies the United States considers outdated. (S NF)

____________________

3 A study completed by Sandia National Laboratory in mid-1998 examined India's scientific and technical infrastructure to support nuclear weaponization. The report illustrated how Indian scientists have used unclassified DOE information to advance their understanding of nuclear weapon technologies. Examples show the relative ease of obtaining nuclear wespons-related reporting, but also call into question the criteria used for determining which DOE documents am available to the public. The report also suggested that current classification/declassification procedures are inadequate. (S NF)

Prospective nuclear weapons states -- such as Iran, Iraq, and North Korea -- are interested in the basic parameters of first-generation nuclear explosives.⁴ Once again, much -- if not most -- of the information that these countries would find useful is declassified or unclassified:

• In 1996 and 1997, Iranian visitors to Lawrence Livermore were involved in discussions of subjects potentially useful to advancing Tehran's nuclear and biological warfare programs.

• The Iraqi program also benefited directly from unclassified DOE publications detailing fissile material development activities. In particular, the United States listed and abandoned electromagnetic isotope separation as inefficient and expensive; the Iraqis, however, chose this as potentially the fastest method to produce fissile material. We also believe that the Iraqi program bentfited from inadvertent disclosures of information on high explosives by DOE scientists at a symposium.

• During inspections by the International Atomic Energy Agency (IAEA), a copy of an unclassified Sandia publication relating to high-precision detonations was found in Iraq. (S NF)

____________________

4 Topics of potential interest include -- but are not limited to -- shock strengths required for simple spherical implosion geometries, equations-of-state, the function of various components in an implosion system, estimation of explosive yield, preinitiation issues, and fissile materials specifications. (S NF)

Proprietary Information and Sensitive Unclassified Information

Foreign entities also are targeting a wide range of DOE sensitive unclassified⁵ information including proprietary collaborations with US industry. In many cases, foreigners have gained access to DOE facilities through lab-to-lab agreements,⁶ Cooperative Research and Development Agreements⁷ (CRADAs), and government-to-government exchanges and treaties. In some cases, these individuals use their access to acquire other sensitive or proprietary information. For example:

• A French scientist -- granted unescorted, but unclassified, access to Lawrence Livermore in 1995 under a joint agreement between DOE and the French Atomic Energy Commission -- has actively collected technical information outside his area of research.

____________________

5 DOE has several types of sengitive unclassified information, including unclassified controlled nuclear information, official use only, naval nuclear propulsion information. export-controlled information, and proprictary information. (C NF )

6 China and Russia have particularly extensive laboratory-to-laboratory relationships with DOE. (C NF)

7 CRADAs involve joint research on commercially viable technologies that usually involve US companies but also can involve foreign corporations. Moreover, foreign national employees at the DOE laboratories can and do participate in these CRADAs, sometimes without the knowledge of the US corporations that are a party to them. (C NF)

[Paragraph apparently redacted.]

Unclassified Information

Not surprisingly, foreign countries have a voracious appetite for unclassified DOE information From 1990 to 1994, DOE maintained a sensitive country information logging system (SCILS) that attempted to record unsolicited requests from countries on DOE's sensitive country list for information from DOE weapons laboratories. Despite the weakness of the database, including lax and incomplete reporting from various DOE entities, SCILS documented annually over 10,000 of such unsolicited requests. This database is no longer active but with the advent of the information age, DOE suspects the database has largely been superseded by direct requests to US scientists via e-mail. At Pacific Northwest National Laboratory, where unsolicited requests are still being monitored, some 250 arrive each week by e-mail as opposed to 15 that come by mail. Moreover, some of the information that foreign entities may have requested in writing in the past can now be downloaded off the Internet. (S NF)

The systematic and thorough manner in which unclassified information is often collected gives a sense of its substantial value to foreign entities. Following are two examples:

[Paragraph apparently redacted.]

• A Chinese scientist conducting unclassified work on silicon detectors⁸ at Brookhaven National Laboratory was found to be sending dozens of long technical faxes to the Chinese Academy of Sciences (CAS). The information enabled the CAS to duplicate Brookhaven experiments as they were being conducted. (S NF)

____________________

8 Silicon detectors are related to accclerometers, a critical component of ballistic missile guidance systems. (C NF)

Foreign intelligencie collectors derive valuable insights or guidance from unclassified information -- even apart from the obvious technical value of the information. For example, such information:

• Can be used to spot and assess potential sources. Foreign entities can presume that a DOE scientist who authors an unclassified article on a topic with classified applications may have access to sensitive, proprietary, or classified information.

• Can reduce the need for covert or illicit collection as well as help a service reduce the risk of such activities. Instead of haphazardly approaching numerous sources for a particular piece of classified or sensitive information, a foreign intelligence service can, use knowledge of open-source writing, biographies, and collaborations to reasonably ascertain which DOE scientists may have the requisite knowledge or access. (S NF)

The Denial and Deception Angle

While most of the DOE information is targeted for its technical merit, foreign countries also seek the information to enhance their denial and deception (D&D)⁹ programs. [Partial paragraph apparently redacted.] In addition, foreign entities also have demonstrated a strong interest in DOE information on the capabilities and limitations of US intelligence verification and collection programs. (S NF)

____________________

9 Denial operations are aimed at hiding military weapons development or other sensitive activities from hostile spies or reconnaissance. Deception operations involve attempts to provide information in order to intentionally mislead or misdirect intelligence. Of the countries we believe to be a threat to DOE, an earlier National Intelligence Estimate judged that China and Russia have the most effective D&D programs. In addition, Iran, Iraq and North Korea -- and also India and Pakistan -- engage in D&D directed against the United States. (S NF)

DOE Technology and Foreign Denial and Deception (S NF)

Foreign knowledge of how the USIC collects and analyzes information about suspected foreign weapons programs call allow foreign countries to disguise the true nature of their activities. Foreign intelligence collectors appear to have specifically targeted DOE as a prime source for critical information. These examples are among the most significant:

[Paragraph apparently redacted.]

• China has expressed great interest in Los Alamos papers on how to verify compliance with weapons limitations agreements, including "The Strategic Arms Reduction Treaty and Its Verification" and "Criteria for Monitoring a Chemical Arms Treaty: Implications." A variety of different Chinese institutions made at least 47 requests for these two documents.

• India and Pakistan repeatedly have accessed a Sandia document posted on the Inlernet dealing with satellite imagery analysis. The document contains photographs of India's nuclear test site and details verification information that could aid nations attempting to avoid detection. (S NF OC)

[Paragraph apparently redacted.]

Foreign Targeting of DOE Facilities, Personnel, and Technologies (C NF)

There is strong evidence of foreign efforts to collect information on DOE facilities, personnel, and technologies. In addition to using their intelligence and security service to target DOE via classic human and technical intelligence means, foreign countries employ a variety of methods to obtain targeted information and materials, both in the United States and overseas. These methods -- some of which overlap with those or the intelligence and security services --   include the use of scientific, academic, and commercial exchanges; open-source collection via published journals, conference proceedings, and the Internet; front companies and joint ventures; and exploitation of cultural ties. (S NF)

Known Targeting by Foreign Institutes and Foreign Intelligence Services

Our research provided a wide variety of examples of human and technical approaches, tactics, and methods employed by foreign collectors to tap into DOE's knowledge base. Foreign intelligence services are clearly engaged in targeting DOE. Probably even more significant are the individual foreign scientists and other end users who obtain information and provide the results of their efforts directly back to their home institutions. In these cases, intelligence officers may be relegated to supporting roles. In both categories, it is important to recognize that whether the protected DOE information is collected by a foreign intelligence service or a foreign academic institute, its ultimate recipients are foreign research institutes and defense establishments that will apply this knowledge to their own scientific and technological efforts, some times to the detriment of US national security. (S NF)

[Paragraph apparently redacted.]

In several instances, we have knowledge of specific intelligence collection requirements for DOE-related information levied on or by foreign intelligence services:¹⁰

[Paragraph(s) apparently redacted.]

• An undated document sent anonymously in 1993 to the US Embassy in Paris and the press listed specific collection roquirements by French intelligence on US corporations, government agencies, and US national laboratories. Los Alamos and Lawrence Livermore were listed among the service's top collection priorities.

[Paragraph apparently redacted.]

____________________

10 The paucity of hard information about specific tasking does not mean that foreign intelligence services do not consider DOE a significant target. It could indicate that the USIC often may not have sources positioned to report such information or that some foreign services do not compile specific, formal target lists. For example, some Asian intelligence services, most notably those of china and Taiwan, rely on their collectors in the field to decide what information is of greatest value. (SNF)

In addition to evidence of intelligence tasking, our research indicates that some countries place intelligence officers in direct contact with DOE facilities or personnel. This presence represents one of the key components of the threat -- opportunity -- and is an indication of the priority assigned to DOE by foreign intelligence collectors. Significantly, DOE information notes that there have been over 250 known or suspected intelligence officers from 27 countries visiting or assigned to various DOE facilities over the last five years alone. Russia and China had the largest intelligence presence with 141 and 37 officers respectively. (S NF)

Threats From Other Foreign Collectors

The threat posed by traditional foreign intelligence services is only a small portion of the human intelligence threat to DOE. Many others -- including foreign scientists, academics, engineers, and businessmen -- also collect information even though they may not have been trained or tasked by foreign intelligence services. Some Asian countries, particularly China and Japan, are very adept collectors of scientific and technological information, using nonintelligence organizations and personnel.

• Rather than send its intelligence officers out to recruit knowledgeable sources at facilities such as the national laboratories, China prefers to exploit over time the natural scientist-to-scientist relationships. Chinese scientists nurture relationships with national laboratory counterparts, issuing invitations for them to travel to laboratories and conferences in China.

• Japan is targeting DOE national laboratories for sensitive (dual-use) technologies. Through the Japan External Trade Organization (JETRO), an intelligence-gathering arm of the Japanese Government located in the Japanese Ministry of International Trade and Industry, Japan is targeting US critical technologies, including superconductor-related research and development. [Partial paragraph apparently redacted.] (S NF OC)

In other cases, foreign entities are known to engage in S&T collection activity despite the shortage of specific targeting data. We are highly confident that they are focused on DOE:

• A high percentage of the Iranian students studying hard sciences in the United States am doctoral candidates, and many of them are engaged in research programs at US universities that have contractual research agreements with DOE laboratories. While these students may not have direct access to classified material on critical technologies. some of them are in a position to interact with those who do.

• Israel's military and commercial partnerships with the United States provide a wealth of opportunities for the legitimate Israeli presence at cleared US facilities, including DOE laboratories. Israel routinely exploits legitimate access to acquire restricted and/or classified US S&T information.

• South Korea, particularly the Korea Advanced Energy Research Institute, has a long history of involvement with US DOE facilities, and many of South Korea's nuclear experts have participated in US national laboratory programs. (S NF)

[Paragraph apparently redacted.]

(S NF)

Targeting of DOE Personnel Abroad

Indigenous intelligence and security services of all the countries we reviewed pose a serious threat to visiting DOE employees and contractors. Some services are more skilled than others, but most employ similar practices: conducting surveillance, using tour guides, prostitutes, and hosts as access agents; searching hotel rooms and laptop computers; and monitoring communications by telephone, e-mail, and fax. Since 1995, DOE debriefing databases reflect several hundred reports by DOE travelers of incidents of CI significance. The following examples underscore the various methods foreign entities employ:

____________________________________________

Exploiting Cultural Ties (C NF)

USIC reporting confirms that DOE employees of certain cultural or ethnic backgrounds have been targeted by foreign entities. For example, China, India, Iran, Israel, North Korea, Russia, South Korea, and Taiwan have tagjeted US Government and/or DOE emploeeys with cultural ties to those countries. Oftentimes, this cultivation process is very subtle and may take many months or years to fully develop. Sometimes, the process is direct and US citizens willingly support the collection efforts of these countries. Other exmples:

• Seoul has openly attempted to attract ethnic Korean scientists to come to Korea to work on developing indigenous industry.

[Paragraph apparently redacted.]

• India's defense industry organizations and intelligence services target ethnic Indian scientists and professors as well as Indian students attending US universities to assist in S&T collection.

• The Israelis target anyone with access to the classified and sensitive US information they seek, yet they have used common cultural and religious affiliation as a basis to elicit information and also as a basis for potential agent recruitment abroad and in the United States.

• The Peter Lee case, cited earlier in this assessment, stands as a good example of China's use of cultural ties to collect successfully. (S NF OC)

____________________________________________

• The French intelligence services have a history of targeting visiting officials and businessmen for economic, S&T, and commercial information. French intelligence is particularly adept at collecting information from visitors through surreptitious entry operations, often with help from hotel staffs; these techniques have been employed against DOE travelers.

• The Israeli intelligence services are particularly agfressive in dealing with US officials and scientists within Israel -- repeatedly demonstrating their interest in collecting almost any information pertaining to advanced military and civilian technology. DOE personnel who have traveled to Israel have experienced everything from unusual questions to the monitoring of their faxes to outright discovery of surveillance devices in their hotel rooms.

• All US visitors to North Korea are under constant escort and believe all of their faxes are copied. In addition, a DOE scientist reported that his escort asked him to discuss "in private" US and North Korean nuclear weapons complexes.

• Chinese intelligence encourages US scientists to visit China, expediting arrangements to enable Chinese experts to assess and develop these contacts. During the visit, the US target is introduced to several senior officials and receives VIP treatment. The Chinese services' involvement is often not exposed and frequently will not lead to official recruitment of the individual, even though valuable information is obtained. (S NF OC)

DOE has several reports of its personnel being tarseted in third countries. For countries that have limited access to DOE facilities and are rarely visited by DOE employees, international conferences may represent major collection opportunities. In other cases, targeting of DOE scientists at international conferences is only one form of a broader collection program:

• At a conference in Greece, a DOE scientist was approached by an Israeli national who requested any information Lawrence Livermore had concerning radon as an indicator of nuclear activity.

• At a Biological Weapons Convention conference in Vienna in 1995, a Japanese official asked a DOE scientist for information about the capabilities of the Chinese and French to simulate nuclear weapons effects. (S NF)

SIGINT Collection Against DOE

While explicit evidence of foreign SIGINT collection activities against DOE communications is sparse, China, France, India, Israel, Pakistan, Russia, and Taiwan are known to intercept US satellite communications and, in many cases, have extensive capabilities to intercept other communications. The fact that SIGINT is a passive activity that is well protected by its controllers makes it extremely difficult to gather hard evidence about specific foreign SIGINT targets. However, based on the growth of SIGINT activities worldwide and the fact that US technology continues to be a priority target for many intelligence services, we judge that DOE information systems are being intercepted. (S NF)

[One-half page apparently redacted.]

____________________

11 The predecessor of the Internet (U)

Cyberthreat to DOE

The foreign cyberthreat -- employing computers to collect against and/or to attack US information systems -- is a growing problem. DOE's high-performance computers give the national laboratories a greater computational capability than any other facilities in the world. Some visiting foreign nationals have access to these very computers as well as remote access through the Internet. DOE, however. does not have a robust intrusion detection capability or an adequate monitoring capability to audit how such access is used. In addition, DOE scientists have extensive computer contact with their colleagues throughout the world. One laboratory, for example, reports that its e-mail traffic exceeds 1 million messages per month. Since the traffic is virtually unimonitored, DOE is unable to report how much involves contact with sensitive countries or other foreign entities. (S NF)

The increased access to DOE computers coincides with an increased capability of foreign entities to exploit such opportunities. Even technologically and economically backward countries, such as North Korea, are acquiring sophisticated computer and telecommunications technologies. Hacker tools, including password-cracking programs, are widely available at hacker conferences and via the Internet. Moreover, these toots have become increasingly user-friendly over the past five years. Likewise. the capability to use the Internet to access computer systems has been rapidly proliferating. (S NF)

The threat to DOE information system is real. The Computer Incident Advisory Capability, which is DOE's incident response team providing technical assistance and information to sites with computer security incidents, recorded 792 computer security incidents during the period from October 1997 to June 1998. Of these, 324 involved attacks from systems located outside the United States. All of these attacks involved activities intended to gain password files, probes and scans, as well as actual compromises of DOE computer systems where the intruders gained access. Such access included successful root compromise -- giving an unauthorized person complete access and total control to create, view, modify, or execute any and all information stored on the system. (U)

There is ample information indicating that foreign entities are attempting to collect restricted or sensitive informution -- particularly S&T information -- using computer systems. While little of the available information is specific to DOE, we belive that foreign entities likely direct efforts at DOE given the value of its information. Evidience of this targeting includes the following:

[Paragraph apparently redacted.]

• US Amy private Eric Jenott passed information on DoD computer system to a Chinese national who was an exchange student at Oak Ridge. Jenott was arrested in June 1996.

• In the mid-1980s, Russian intelligence used the services of a group of West German hackers to penetrate computers at Lawrence Livermore and Sandai. At Lawrence Berkeley Laboratories, the hackers were able to obtain system-manager privileges.

[Paragraph(s) apparently redacted.]

____________________

12 Foreign activities designed to cause widespread, long-duration damage or denial-of-service to significant portions of critical US information-based infrastrctures. (U)

Foreign efforts to obtain information resident on US computer systems can be greatly aided by "insider" access to the computer systems. Recruited insiders -- those with direct access to data or information systems -- often provide information or access that allows easier access to, and movement within, databases. In most cases, the protections between restricted databases -- if any -- are far less robust than those protections that keep "outsiders" from gaining access. For example, Russian intelligence has attempted to use insiders to gain access to restricted information on foreign computer networks. (S NF OC)

[One-half page blank.]

Appendix A

Foreign Country Threats . . . Unique Approaches, Unique Requirements (C NF)

The following overview highlights the unique approaches of the various threat countries. More detailed examples of the threat posed by these countries are documented in earlier portions of this assessment, and there is additional evidence that supports these findings. (C NF)

China

China represents an acute intelligence threat to DOE. It conducts a "full court press" consisting of massive numbers of collectors of all kinds, in the United States, in China, and elsewhere abroad. The Chinese have successfully employed a combination of open-source collection, all forms of cyber-connections, elicitation, and espionage to obtain information needed to advance their weapons program. China is highly reliant on many different types of technical specialists, scientists, and engineers. China is an advanced nuclear power, yet its nuclear stockpile is deteriorating. As such, China has specifically targeted DOE for the collection of technical intelligence related to the design of nuclear weapons, and seeks information relating to stockpile stewardship and reliability. This effort has been very successful, and Beijing's exploitation of US national laboratories has substantially aided its nuclear weapons program. (S NF)

Russia

Russia presents a formidable intelligence threat to DOE, relying on the legacy of decades of highly calibrated, aggressive, and successful S&T collection against the United States. Russia uses a wide variety of collection methods and has targeted many DOE facilities. Russians count heavily on their intelligence services to obtain US nuclear secrets, and also rely on other technical specialists, scientists. and engineers to target individuals with access to information on DOE projects. DOE specialists and their information especially are at risk while traveling to Russia, where intelligence and security services actively target information they possess. As an advanced nuclear power, Russia primarily seeks US nuclear weapons secrets that involve state-of-the-art technologies. As its general purpose forces have deteriorated, Russia has become even more dependent on nuclear weapons and its nuclear capability to underscore its status as a great power. (S NF)

India

India has emerged as a dangerous intelligence threat. India has a well-developed and aggressive intelligence collection capability to acquire S&T collecting any secret or restricted US Government information -- particularly pertaining to advanced military and civilian technology. (S NF)

Taiwan

Taiwan also is an aggessive collector, and its collection program against DOE is a small-scale version of China's. As such, Taiwan's collection program is characterized by ample persod-to-person contacts and a substantial intelligence presence in the United States. Taiwan focuses its collection against only two countries of critical importance -- the United States and China. Taiwan relies on a diverse and balanced collection effort, with contributions from both intelligence and nonintelligence officials to identify and target DOE sources of S&T information. Taiwan also places significant emphasis on Chinese professional associations in the United States to locate persons and technologies of interest. The DOE national laboratories are targets of Taiwan's S&T collection, with Argonne receiving substantial attention in recent years. (S NF)

South Korea

South Korea has been seeking US S&T and economic information in an increasingly aggressive fashion in the 1990s. Its collection approach features many person-to-person contacts, and the South Koreans also possess a major intelligence presence in the United States. These activities are directed at both US military and civilian targets, and are carried out by a range of South Korean Government entities and private corporations. South Korean intelligence has expanded its role in collection related to nuclear technology during the 1990s. (S NF)

Japan

Japanese collection features the close interaction between business and government and its collection against DOE proceeds accordingly. Unlike the other Asian countries noted in this report, the Japanese do not have a clandestine intelligence collection service. Japan maintains a large, overlapping, assertive information collection program, heavily focused on US S&T and economic information. This program is characterized by collection of massive amounts of open-source information. A portion of this effort appears to be earmarked to collect against DOE technologies. Incidents reported to authorities by cleared US contractors in recent years reveal Japanese intent and opportunities to acquire protected US nuclear information. (S NF)

France

France is a longstanding nontraditional intelligence adversary with a proven record of clandestine collection against US S&T information, both in the United States and in France. The French rely on a wide range of collection approaches. which include many contacts with the national laboratories. France has a record of exploiting legitimate access to US businesses and government institutions to collect against a specifiy target or on a target of opportunity. A common French methodology is to seek information beyond the parameters of joint agreements. (S NF)

North Korea and Iraq

North Korea and Iraq have aggressive intelligence programs that place a priority on S&T collection. They have marginal access to DOE facilities in the United States, with very few opportunities for person-to-person collection. As such, they operate abroad to obtain US nuclear technologies and information related to their needs. (S NF)

North Korea has little opportunity to collect against DOE facilities in view of its negligible access and limited resources in the United States. Nonetheless, North Korea has tried to obtain US nuclear-related information or technology from third-country sources. (S NF)

Iraq remains of CI concern because Iraqi intelligence services have continued to pursue S&T information that can aid in strengthening the country's military capabilities. The Iraqi services traditionally have looked to other countries as places to target US technologies, and they rely increasingly on nonofficial cover. (S NF)

Transcription and HTML by Cryptome.