Energy Department employees auditing contractors turned to using personal computers for official purposes, putting information at risk of improper disclosure, because of restrictions at the sites on access to USB ports on government-issued laptops, an IG report has said.

The IG was examining the Department of Energy’s Consolidated Audit Program as a follow-up to an earlier one that had found that contractors conducted redundant quality assurance evaluations of commercial laboratories–half were deemed to be redundant–produced inconsistent results, and did not communicate those results as required. The new report found that DoE had taken corrective actions to address those issues.

“However, we identified one area that requires management’s attention.  We found that DOECAP auditors did not always properly handle sensitive unclassified information and used personally owned devices to access, store, and potentially transmit information categorized and marked as official use only (OUO)” because of the restriction on access to USB ports, the IG said.

Officials acknowledged that the use of personally owned devices for official purposes “is an issue throughout the program,” estimating that half of departmental auditors used their own computers in that work.

“Furthermore, officials stated that the use of personal email to transmit OUO information was possible. In fact, we identified multiple instances where information marked OUO was sent to a non-government email address,” the report said. “Using personal email circumvents the department’s automated information system, which is used to transmit and store official email and prevents access to OUO information by persons who do not require the information to perform their jobs or other department-authorized activities.”

Management said it is “evaluating options to avoid the use of personal computers” in that work, the report said.