Report | Jan. 25, 2010

Identification of Classified Information in an Unclassified DoD System and an Unsecured DoD Facility (Redacted)

D-2010-038

What We Did

The objective of the audit was to determine whether the internal controls over transactions processed through the Deployable Disbursing System (DDS) were adequate to ensure the reliability of the data processed. The audit included financial information processed by disbursing stations supporting the Operation Iraqi Freedom and included the recording of related obligations. In completing this objective, we identified an urgent issue related to the U.S. Army mishandling of classified information.

What We Found

The U.S. Army did not have effective internal controls over the handling of classified information to prevent the:

  • processing of 655 transactions containing classified information into DDS and
  • submission of at least 40 disbursement vouchers containing unmarked classified information for storage at a vulnerable Defense Finance and Accounting Service (DFAS) Rome facility.

The unauthorized disclosure of classified information in an unclassified system, such as DDS, or at a vulnerable facility could place unsuspecting warfighters or trusted foreign officials in harm’s way and cause damage to national security.

What We Recommend

We recommend that the Assistant Secretary of the U.S. Army (Financial Operations):

  • identify DDS disbursement transactions  that contain classified information and  remove the classified information from  the system and
  • identify and properly mark the vouchers  containing classified information housed  at DFAS Rome.

In addition, we recommend that the Director, DFAS:

  • identify and remove classified  information from DDS databases housed  by DFAS, Indianapolis Operations and
  • move classified documentation to a  secure storage facility.

Management Comments and Our Response

The Deputy Assistant Secretary of the U.S. Army (Financial Operations) and the Director, DFAS Information and Technology, agreed with our recommendations. Management comments were responsive to the recommendations and no additional comments are required.