FBI Struggles with Storing and Disposing of Confidential and Secret Data Carriers

An audit conducted by the Office of the Inspector General (OIG) of the U.S. Department of Justice has revealed that the FBI faces serious problems with properly labeling, storing, and securing decommissioned electronic media containing confidential and secret information.

According to the OIG report addressed to FBI Director Christopher Wray, the FBI has made significant errors in handling and destroying electronic data carriers seized during investigations. Media containing national security data, information related to the Foreign Intelligence Surveillance Act (FISA), and documents classified as secret are often left unmarked, making them vulnerable to loss or theft.

The OIG report notes that boxes with hard drives and removable media are stored open and left unattended for “several days or even weeks,” and are only sealed after the boxes are filled. As a result, any of the 395 employees and contractors with access to the facility could potentially access them.

To address this issue, the FBI has started installing wire cages to lock up data carriers. In December of last year, the FBI also promised to install a video surveillance system in the evidence destruction storage area. However, as of June 2024, this was still in the paperwork stage.

The audit also found that FBI agents do not track hard drives and removable media sent to headquarters or to storage for destruction. While seized computers are usually labeled for tracking, agents are encouraged to send media—often containing national security information—without their casings to save money. Although there is a rule for labeling removable media, there are no similar requirements for internal hard drives.

“The lack of inventory control over electronic data carriers at the FBI increases the risk of loss or theft of flash drives, disk drives, hard drives, or solid-state drives after they are removed from larger electronic devices such as laptops or servers,” the report states. “Additionally, the FBI does not label electronic media to indicate the classification level of the information stored on these devices. The lack of accountability for these carriers, as well as insufficient internal controls over physical access and inadequate video camera coverage of relevant areas, exposes electronic media to an unreasonable risk of loss or theft without detection.”

After the report attracted media attention, FBI representatives quickly informed journalists that work to strengthen security measures and update procedures had already been completed.

The FBI emphasized that every employee or contractor allowed on the premises has the necessary clearance, and the entire facility is fenced, with “reliable access control and intrusion detection systems.” They also reported that an internal review showed “zero cases of facility compromise and zero cases of unauthorized or unverified personnel accessing the facility.”