Return to the USDOJ/OIG Home Page

The Federal Bureau of Investigation's
Control Over Weapons and Laptop Computers

Report No. 02-27
August 2002
Office of the Inspector General



To: Guy K. Zimmerman
Assistant Inspector General for Audit
U.S. Department of Justice
Date 07/11/2002
From: Thomas Bernard Locke (original signed)
Acting Assistant Director
Inspection Division
Subject: The Federal Bureau of Investigation's
Control Over Weapons and Laptop Computers

On 06/26/2002 representatives of your office delivered to the FBI a draft copy of a report titled "The Federal Bureau of Investigation's Control Over Weapons and Laptop Computers." The cover memorandum accompanying the draft report requested the FBI provide comments to you on each of the ten recommendations made within the report. The comments were to be provided no later than 07/11/2002.

Specifically, you requested the FBI to either agree or disagree with each recommendation and, should we agree, to describe actions completed and planned, including dates when corrective action would he achieved. Should the FBI disagree with a stated recommendation you requested we provide an alternative corrective action for your consideration.

Attached to this memorandum are the FBI's responses to each of the ten recommendations set forth in your report. You should note the FBI agreed with each of the recommendations and has provided, in the attached document, the information you requested.

Please contact Kevin L. Perkins. Section chief; Inspection Division, should you have any questions regarding this matter. Mr. Perkins may he reached on 202/324-8518.

Attachment (1)

cc: Vickie Sloan
  Audit Liaison Office
  Room 6316
  U.S. Department of Justice
  950 Pennsylvania Avenue, NW.
  Washington, D.C.
1 - 66F-HQ-A1343477-G


Recommendation #1:

Consider revising FBI policies to establish and enforce criteria by which employees will be disciplined when the employee's negligence results in the loss or theft of a weapon or laptop. This policy should also consider and set forth any circumstances under which employees will be held personally liable for the cost of' the item.

Response: The FBI concurs with this recommendation.

As recognized in the report, the FBI Office of Professional Responsibility (OPR) regularly imposes discipline for failure to adequately safeguard weapons and laptop computers. The basis for such discipline currently rests on violations of specific manual provisions or a reckless/negligent failure to exercise due care, Enactment of specific criteria related solely to weapons and laptop computers may, however, invite inconsistency as other sensitive and valuable property must also be safeguarded from loss and theft. To this end, in June 2002, OPR circulated for comment a draft Schedule of Delegated Disciplinary Offenses and a policy statement addressing property losses. This document provides mandatory disciplinary penalties for failure to provide adequate security resulting in the loss or theft of weapons, laptop computers, and other sensitive and less sensitive property. As noted, the Schedule and related policy are currently being circulated for comment and will be forwarded to the Director for review and approval.

As for holding employees personally liable for the cost of lost or stolen items, the FBI will implement Boards of Survey to review cases of negligence by employees for the loss or theft of capitalized property, jewelry, laptop computers, weapons and other sensitive items. The Finance Division will coordinate policy with the Office of General Counsel and the OPR regarding employees' personal financial responsibility for lost or stolen government property.

Estimated completion 90 days.

Recommendation #2

Strengthen FBI policy regarding the proper storage of FBI property outside the office, in particular as it pertains to storing property at an employee's residence or in vehicles.

Response: The FBI concurs with this recommendation.

The Finance Division will establish policy for the safeguarding of Bureau property outside of FBI office space. The policy will he included in the Accountable Property Manual and the Manual of Administrative Operations.

Estimated completion 60 days.

Recommendation #3:

Establish and adhere to firm deadlines for: (a) employees to report the loss or theft of FBI property to their supervisors; (b) supervisors to report losses or thefts to Headquarters units, including the Firearms Training Unit, the OPR, and the Property Management Unit; (c) OPR to initiate and complete investigations; and (d) designated employees to enter losses into NCTC (when appropriate).

Response: The FBI concurs with this recommendation.

The Finance Division will establish the following policy for the notification of loss or theft of capitalized and sensitive Bureau property: Within five working days of the date of the loss or theft, employees must notify their immediate supervisor and the supervisor is to advise appropriate units at FBIHQ. Each division will he responsible for entering lost or stolen property if appropriate, into NCIC before FBIHQ units are notified. Any property containing sensitive or classified information must have a damage assessment performed and the results submitted to the Security Division within 30 days of the loss or theft.

With respect to item (e) above, the OPR can reasonably set deadlines for the initiation of an investigation, however, due to many factors outside the direct control of OPR, it cannot predict or mandate a specific deadline for completion of an investigation given current resource constraints.

Estimated completion 60 days.

Recommendation #4:

Revise the Form FD-500 to include the date of loss/theft; the date the property was entered into NCIC and the resulting NCIC number; and the individual responsible for pooled property, such as unassigned weapons maintained in the armory.

Response: The FBI concurs with this recommendation.

The Finance Division, Property Management Unit, will coordinate the revision of the FD-500, Report of Lost Or Stolen Property with the Forms Desk. The form will be revised to include the date of loss/theft the date the property, was entered into NCIC the NCIC number and the Property Custodian responsible for property oversight.

Estimated completion 60 days.

Recommendation #5:

Submit complete, accurate and timely response to Semi-Annual {Loss/Theft} reports to Security Emergency Planning Staff (SEPS)

Response: The FBI concurs with this recommendation.

The FBI concurs that it has not always submitted timely or accurate reports of lost or stolen property on a semi-annual basis as required by Department of Justice (DOn Order 2630.2A In a discussion on 07/02/2002 with FBI representatives, Mr.D. Jerry Rubino, DOJ Security Officer, advised the requirement for DOJ components to submit a Semi-Annual Loss/Theft Report to the Security and Emergency Planning Staff (SEPS), as required by DOJ Order 2630.2A, will shortly be rescinded. Therefore, he indicated that an action plan for addressing this recommendation will not be necessary.

Notification of lost or stolen property, i.e., laptop computers and weapons, will continue to be reported to FBIHQ within five working days of the discovery. In the case of a lost computer, notification to the Security Programs Manager, Security Division, will he required.

Recommendation #6:

Ensure completion of future inventories of accountable property every two years.

Response: The FBI concurs with this recommendation.

Executive management of the FBI will ensure that physical inventories are conducted in all divisions and legats every two years.

Recommendation #7:

Annually inventory sensitive items, including weapons and laptop computers.

Response: The FBI concurs with this recommendation.

Current FBI policy requires the physical inventory of weapons, laptop computers and other capitalized equipment every two years. In addition, the Inspection Division conducts inspections of all FBIHQ divisions, field offices, and Legats on a three year cycle. A complete accounting of all laptop computers is conducted by the Inspection Division during the course of each inspection. The FBI also conducts an inventory' of personal property assigned to employees, which includes weapons and laptop computers, during the intervening year between the biannual physical inventory mentioned above. The combined result of each of these inventory procedures ensures that weapons and laptop computers are physically inventoried at least once a year.

Recommendation #8:

Implement policy to reconcile non-capitalized property between the financial and property systems to ensure that the number of items acquired agrees with the number of items placed into the inventory.

Response: The FBI concurs with this recommendation.

The Finance Division Executive Management will coordinate with the Property Management Unit and the Contract Units to strengthen current policies and procedures to ensure that non-capitalized property acquired will be placed on the Property Management Application (PMA).

Estimated completion 60 days.

Recommendation #9:

Strengthen the exit processing for separating employees to ensure that they turn in all issued property or reimburse the Government for any missing property.

Response: The FBI concurs with this recommendation.

The Finance Division will revise the Manual Of Administrative Operations to provide instructions that all divisions will be required to review all PMA charge-out reports for equipment when an employee is separating from the FBI. In addition, divisions will be required to generate reports from the Bureau Personnel Management System, Issued Personal Property Subsystem, to obtain property assigned to a separating employee. Furthermore, all divisions will be instructed to review all manual charge-out records maintained by various program managers and FD-281's, Receipt of Government Property, in an attempt to collect all Bureau property before an employee separates.

The Finance Division will also obtain guidance from the Office of General Counsel as to how reimbursements for lost property should be collected from separating employees. In addition, the Finance Division will coordinate with the Administrative Services Division, Policy Unit, to strengthen the language currently included on the FD-193 (Exit interview form), as it relates to collecting property from employees separating from the FBI.

Estimated completion 60 days.

Recommendation #10

Improve the documentation of the destruction of excess laptop computers and hard drives.

Response: The FBI concurs with this recommendation.

The FBI understands the confidentiality, integrity, and availability of information must be addressed throughout all phases of the information technology (IT) life cycle.

To address these requirements, the Security Division, in collaboration with the Finance, Information Resources, and Inspection Divisions, and OPR, plans to institute policy and procedures on the acquisition, inventory, audit, turn-in, maintenance, decommission, sanitization and destruction of all IT resources. These policies and procedures will provide all stakeholders, including management and system owners, with specific guidance on implementing security procedures for each phase in the IT life cycle process. To augment the oversight of these policies and procedures, the FBI plans to implement an automated method of tracking FBI IT resources throughout the life cycle. The utilization of automated tools are essential to the timely tracking of IT status and ultimately to the assessment of all lost, stolen, and compromised FBI information and devices.

The Integrated Security Training, Awareness, and Education Program being developed by the Security Division is being designed to train all FBI emp1oyees, detailees, and contractors on a recurring basis. This program will include a definition of roles and responsibilities for all stakeholders, the explanation of proper security procedures at each phase of the IT life cycle, and the penalties associated with violating policy and mandated procedures. The FBI estimates the policy and procedures described above can be developed in parallel. This effort is estimated to take four to six months. The development of an automated database to change existing acquisition and inventory processes will take a longer period of time, depending on the cross-divisional requirements.

In regards to training and awareness, the FBI has started to use a wide variety of mechanisms such as e-mail announcements, Intranet bulletins, Conference Presentations, as well as general and specialized security courses. The sensitive issues regarding the sanitization and destruction of automated information systems are being incorporated into the existing security campaigns for New Agent training and for the annual information Technology Conference.