Sensitive unclassified NARA information becomes "Controlled" — Our clever leaders have found a helpful way to stay more organized and better protect our nation's many unclassified secrets so they don't fall into the wrong hands. That's why they need to be protected. They are sensitive and may touch on many important national interests. "Protests" that this means anything unclassified could be kept secret would clearly be unfair since at face value the CUI designation explains that it is just to better assist standardization and make sure our national interests are protected.
Please glance over the following heavily redacted version of a press release yesterday that I have EITHER completely made up or can be found in its original, fuller form at the WH. Ask yourself if I am making this up. Ask yourself if you have seen this reported ANYWHERE?
By the way, ISC stands for the Information Sharing Council
dealing with interoperable information related to terrorism.
Designation and Sharing of Controlled Unclassified Information (CUI)
- ... "Controlled Unclassified Information (CUI) [is] the single, categorical designation henceforth throughout the executive branch for ... includ[ing] most information heretofore referred to as "Sensitive But Unclassified" (SBU) in the Information Sharing Environment (ISE), and
- establishes a corresponding new CUI Framework for ... disseminating information ... The memorandum's purpose is to standardize practices ...
... our Nation's entire network of defenders [must] be able to share information more rapidly [but] the United States Government [must] protect sensitive information, information privacy, and other legal rights ...
- Controlled Unclassified Information is a categorical designation that refers to unclassified information that ... [is] pertinent to the national interests of the United States or to the important interests of entities outside the Federal Government, and ... requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination. Henceforth, the designation CUI replaces "Sensitive But Unclassified" (SBU).
CUI Council is a subcommittee of the Information Sharing Council (ISC) ...
CUI Framework refers to the single set of policies and procedures governing the designation, marking, safeguarding, and dissemination of CUI terrorism-related information that originates in departments and agencies ...
CUI Framework Standards Registry (the "CUI Registry") refers to the official list of, and recognized standards for, CUI markings including "safeguarding," and "dissemination" maintained by the Executive Agent.
Departments and Agencies means executive agencies ... but not the Government Accountability Office.
Enhanced Safeguarding ... subject to measures more stringent than those normally required because inadvertent or unauthorized disclosure would create a risk of substantial harm. This requirement is indicated by the marking "Controlled Enhanced."
Executive Agent means the National Archives and Records Administration (NARA).
Information means any communicable knowledge or documentary material, regardless of its physical form or characteristics, that is owned by, is produced by or for, or is under the control of the Federal Government.
Information Sharing Environment means an approach that facilitates the sharing of "terrorism information," ...
Safeguarding means measures and controls that are prescribed to protect controlled unclassified information.
Sensitive But Unclassified refers collectively to the various designations used heretofore within the Federal Government for documents and information that are sufficiently sensitive to warrant some level of protection from disclosure but that do not warrant classification.
Specified Dissemination ... subject to additional instructions governing the extent to which dissemination is permitted.
Standard Dissemination ... authorized to the extent it is reasonably believed that dissemination would further the execution of lawful or official mission purpose, provided that individuals disseminating this information do so within the scope of their assigned duties.
Standard Safeguarding ... subject to baseline safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. This requirement shall be indicated through the use of the marking "Controlled."
Terrorism-Related Information means ... information, as defined by Implementing Recommendations of the 9/11 Commission Act [;] ... homeland security information [; and] ... law enforcement information relating to terrorism.
Policy – The CUI Framework
... All CUI shall be ... categorized [and] indicated through the use of the following corresponding markings:
- Controlled with Standard Dissemination ... standard safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Dissemination is permitted to the extent that it is reasonably believed that it would further the execution of a lawful or official purpose.
- Controlled with Specified Dissemination ... safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Material contains additional instructions on what dissemination is permitted.
- Controlled Enhanced with Specified Dissemination ... safeguarding measures more stringent than those normally required since the inadvertent or unauthorized disclosure would create risk of substantial harm. Material contains additional instructions on what dissemination is permitted.
... Recipients of CUI shall report any unauthorized or inadvertent disclosures to the designating agency.
... Wherever possible, it is expected that departments and agencies will re-mark archived or legacy material when it is incorporated into the ISE.
... CUI markings may inform but do not control the decision of whether to disclose or release the information to the public, such as in response to a request made pursuant to the Freedom of Information Act (FOIA).
... The CUI markings shall be incorporated into ISE-related information technology (IT) projects under development or developed in the future and shall be reflected in plans for new information technologies.
... The CUI markings shall be used regardless of the medium through which the information appears or conveys. Oral communications should be prefaced with a statement describing the controls when necessary to ensure that recipients are aware of the information's status.
... [NARA] shall have the following authorities and responsibilities:
- Develop and issue CUI policy standards and implementation guidance consistent with this memorandum, including appropriate recommendations to State, local, tribal, private sector, and foreign partner entities for implementing the CUI Framework. As appropriate, establish new safeguarding and dissemination controls, and, upon a determination that extraordinary circumstances warrant the use of additional CUI markings, authorize the use of such additional markings;
- Establish and chair the CUI Council;
- Establish, approve, and maintain safeguarding standards and dissemination instructions, including "Specified Dissemination" requirements proposed by the heads of departments and agencies;
- Publish the CUI safeguarding and dissemination standards in the CUI Registry;
- Monitor department and agency compliance with CUI policy, standards, and markings;
- Establish baseline training requirements and develop an ISE-wide CUI training program to be implemented by departments and agencies;
- Provide appropriate information regarding the CUI Framework to the Congress, to State, local, tribal, and private sector entities, and to foreign partners;
- Advise the heads of departments and agencies on the resolution by the CUI Council of complaints and disputes among such departments and agencies concerning the proper designation or marking of CUI; and
- Establish, in consultation with affected departments and agencies, a process that addresses enforcement mechanisms and penalties for improper handling of CUI.
... A CUI Council is hereby established as a subcommittee of the ISC. Its members shall be drawn from the ISC's membership. The CUI Council shall:
- Serve as the primary advisor to the Executive Agent on issues pertaining to the CUI Framework;
- Advise the Executive Agent in developing procedures, guidelines, and standards necessary to establish, implement, and maintain the CUI Framework;
- Ensure coordination among the departments and agencies participating in the CUI Framework;
- Advise the Executive Agent on the resolution of complaints and disputes among departments and agencies about proper designation or marking of CUI; and
- As appropriate, consult with the ISC's State, Local, Tribal, and Private Sector Subcommittee.
... Information shall be designated as CUI and carry an authorized CUI marking if:
- a statute requires or authorizes such a designation; or
- the head of the originating department or agency, through regulations, directives, or other specific guidance to the agency, determines that the information is CUI. Such determination should be based on mission requirements, business prudence, legal privilege, the protection of personal or commercial rights, safety, or security. Such department or agency directives, regulations, or guidance shall be provided to [NARA] for review.
... information shall not be designated as CUI:
(i) conceal violations of law, inefficiency, or administrative error;
(ii) prevent embarrassment to the Federal Government or any Federal official, any organization, or agency;
(iii) improperly or unlawfully interfere with competition in the private sector; or
(iv) prevent or delay the release of information that does not require such protection;
- if it is required to be made available to the public; or
- if it has already been released to the public under proper authority.
... This memorandum:
- shall be implemented in a manner consistent with applicable law, including Federal laws protecting the information privacy rights and other legal rights of Americans, and subject to the availability of appropriations;
- shall be implemented in a manner consistent with the statutory authority of the principal officers of departments and agencies as heads of their respective departments or agencies;
- shall not be construed to impair or otherwise affect the functions of the Director of the Office of Management and Budget relating to budget, administrative, and legislative proposals; and
- is intended only to improve the internal management of the Federal Government and is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity by a party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.