Jan. 25, 2010
Identification of Classified Information in an Unclassified DoD System and an Unsecured DoD Facility (Redacted)
What We Did
The objective of the audit was to determine whether the internal controls over transactions processed through the Deployable Disbursing System (DDS) were adequate to ensure the reliability of the data processed. The audit included financial information processed by disbursing stations supporting the Operation Iraqi Freedom and included the recording of related obligations. In completing this objective, we identified an urgent issue related to the U.S. Army mishandling of classified information.
What We Found
The U.S. Army did not have effective internal controls over the handling of classified information to prevent the:
- processing of 655 transactions containing classified information into DDS and
- submission of at least 40 disbursement vouchers containing unmarked classified information for storage at a vulnerable Defense Finance and Accounting Service (DFAS) Rome facility.
The unauthorized disclosure of classified information in an unclassified system, such as DDS, or at a vulnerable facility could place unsuspecting warfighters or trusted foreign officials in harm’s way and cause damage to national security.
What We Recommend
We recommend that the Assistant Secretary of the U.S. Army (Financial Operations):
- identify DDS disbursement transactions that contain classified information and remove the classified information from the system and
- identify and properly mark the vouchers containing classified information housed at DFAS Rome.
In addition, we recommend that the Director, DFAS:
- identify and remove classified information from DDS databases housed by DFAS, Indianapolis Operations and
- move classified documentation to a secure storage facility.
Management Comments and Our Response
The Deputy Assistant Secretary of the U.S. Army (Financial Operations) and the Director, DFAS Information and Technology, agreed with our recommendations. Management comments were responsive to the recommendations and no additional comments are required.