WASHINGTON — The FBI's most damaging spy left clues over two decades, but lax security and the bureau's reluctance to suspect one of its own helped Robert Hanssen elude detection, according to a harsh Justice Department report.
The investigation by agency Inspector General Glenn A. Fine credits the FBI for undertaking reforms since the counterespionage official's arrest in early 2001 but warns that ongoing security flaws — such as an inability of agents to immediately know if someone reads their sensitive computer files — make the bureau vulnerable.
"We believe that what is needed at the FBI is a wholesale change in mind-set and approach to internal security," the report said. "The defects in the FBI's security program were the product of decades of neglect."
Fine's conclusions are contained in a 31-page summary of a 674-page top-secret report that included extensive interviews with 200 people, including Hanssen and his family and friends, and a review of 360,000 pages of documents. The summary was released Thursday.
The report makes 21 recommendations for change at the FBI.
Justice and FBI officials say the Hanssen case has spurred wholesale change at the FBI, including far more frequent polygraph testing, financial disclosures for employees and a central electronic system to monitor the actions of employees with access to sensitive computer files.
Attorney General John Ashcroft said in a statement that the FBI "has reformed and refined its capabilities to detect and deter those who would betray the United States and endanger the lives of the American people."
Hanssen spied for the Soviet Union and Russia between 1979 and 2001. The report shows he often was reckless in his efforts but went undetected because the bureau lacked deterrents such as intensive financial disclosure rules, frequent polygraph tests or adequate supervision.
"Hanssen escaped detection not because he was extraordinarily clever and crafty, but because of long-standing systemic problems in the FBI's counterintelligence program and a deeply flawed FBI internal security program," the report said.
During his 25-year FBI career, Hanssen never took a polygraph test and underwent only one financial background investigation. For his spying, Moscow paid him with two Rolex watches, $600,000 in cash and diamonds, and made promises of $800,000 more.
Besides giving away U.S. secrets, Hanssen is believed responsible for the deaths of at least three U.S. spies overseas. He pleaded guilty in May 2002 and was sentenced to life in prison.
The report said there were plenty of red flags about his activities:
In 1987, while serving in an FBI Soviet Analytical Unit, Hanssen "committed a serious security breach" by disclosing classified information to a Soviet defector he was debriefing. While colleagues tried informally to begin restricting his access, nothing was documented and no formal action was taken.
In August 1990, Hanssen's brother-in-law, Mark Wauck, also an FBI agent, reported to his superiors in the Chicago FBI office that Hanssen's wife, Bonnie, had found an unexplained $5,000 in his dresser drawer. The supervisor, however, "readily dismissed" Wauck's request for follow-up.
In early 1992, after becoming head of the National Security Threat List Unit dealing with economic espionage, Hanssen hacked into an FBI computer system to access sensitive Soviet documents. After growing nervous, Hanssen reported that he had done it to test the system's security "and no one questioned" the ruse.
Hanssen was sent by the FBI to the State Department in 1995, where he stayed six years until his arrest. He was under virtually no supervision, and no one even knew whether he came to work. At one point, he attempted to install software on his computer to break passwords and was discovered by FBI technicians. Hanssen's explanation was that he was trying to connect a color printer, and again nothing was done.
Some members of Congress say it is clear Hanssen simply took advantage of a lackadaisical FBI attitude toward internal security.
"There's no excuse for Robert Hanssen's treason, but there's also no excuse for the FBI's failure to take seriously his obvious and repeated security violations," said Sen. Charles Grassley, R-Iowa, a senior member of the Senate Judiciary Committee.
The report faults the FBI for placing far too much trust in its agents, underscored by the bureau's eight-year search for a mole in the U.S. government that had compromised U.S. spies and foreign informers, double agent programs and recruitment operations in Russia.
That mole turned out to be Hanssen.
But the FBI was convinced the mole was a CIA officer, so much so that it "lost a measure of objectivity" and failed to consider other possibilities, the report found. The FBI produced a 70-page report urging the Justice Department to bring espionage charges against the CIA officer, but the charges never were brought.
"The FBI trusted that its employees would remain loyal throughout their careers. The Hanssen case shows the danger of that approach," the report said.