On Friday afternoon, with George Bush in Texas for his daughter's wedding, the White House finally released its new Executive Branch rules for designating and disseminating what used to be known as "sensitive" information. The most common term in the past for such material has been "Sensitive But Unclassified" (SBU), though there was an alphabet soup of competing classifications in various agencies. In part, the new rules create a uniform standard across the Executive by replacing SBU etc. with a new classification, "Controlled Unclassified Information" (CUI).
The Friday memo states that its purpose "is to standardize practices and thereby improve the sharing of information, not to classify or declassify new or additional information." The initial impetus for change came in a December 2005 memo in which Bush called for a new policy for information sharing between agencies. The alphabet soup of "sensitive" designations too often played into the hands of officials who sought to hoard information rather than to share it.
Furthermore, after passage of the Homeland Security Act of 2002 federal agencies had been encouraged to apply the SBU designation to just about anything they didn't feel like releasing to the public. Hyper-classification was out of control.
Initially, SBU was used to denote unclassified national security information that might nonetheless be “useful to an adversary.” Interestingly, when the National Security Agency expanded that usage to encompass “other government interests” back in 1986, Congress objected and the NSA backed off.
The Homeland Security Act authorized DHS to identify and safeguard “sensitive unclassified information” but didn’t define the term...DHS issued an internal directive on May 11, 2004 which it titled “Safeguarding Sensitive but Unclassified Information.” The directive said employees should mark as “For Official Use Only” any “sensitive but unclassified information” the department generated or that was received by DHS from other government and non-governmental sources. The directive was itself labeled For Official Use Only and became public only after the Federation of American Scientists filed an FOIA request.
It defines SBU as information whose “unauthorized disclosure could adversely impact a person's privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.” The definition allows maximum individual discretion...
DHS provides for no internal or external oversight to its document-marking decisions. In contrast, the classification system provides for oversight by an Information Security Oversight Office, which is sometimes quite critical of the process.
There is no time limit on the withholding of this “sensitive” information. By contrast, classification laws provide for declassification, in most cases automatically after 10 years.
So in theory reform in the area of classifying "sensitive" information might be welcome. Indeed some reformers like Steve Aftergood initially held out some hope that in cutting through red tape the new rules, when eventually published, would also make more government information available to the public.
We are even more concerned that the final word on this policy will come from a White House that has hitherto shown no aptitude or inclination for sharing public information with the public, that has rather than decreasing secrecy, steadily increased it throughout its term.
In fact, Friday's memo doesn't even pretend to rein in secrecy. Quite the opposite, it looks like the Bush administration used the crafting of new rules as an opportunity to expand the range of government secrecy.
As the semantic shift in the name change indicates (SBU to CUI), the new rules have policy implications that go beyond mere information-sharing. The new term ('controlled') indicates the intended outcome (i.e. secrecy), whereas the old term ('sensitive') had provided a justification for keeping 'Unclassified' material secret. That suggests immediately that the Bush administration wants the CUI classification to justify itself - to cut off by definition any appeal for publication of a document.
The timing of the rules' publication is the second clue that something more may be at issue than the mere tidying up of terminology. There was a long delay between the time the WH received the draft rules and when they were made public. Already in late December the DoD said it anticipated WH approval of the rules "shortly", and indeed it created a task force to implement the rules. A draft of the rules had been finalized in 2007 by "an interagency panel chaired by Ambassador Thomas McNamara, program manager of the Information Sharing Environment, an office under the Director of National Intelligence." McNamara has always emphasized in testimony to Congress that his goal was to simplify categories of "sensitive" classification so as to permit "the great majority of the information which is now controlled" to be left wholly unrestricted: "that is the system that we are trying to put together, a rational limited set of categories that…can be applied to controllable information, but leave most of it as fully unclassified.”
That may have been McNamara's goal, but it does not really describe the new rules as published on Friday. Instead, the memo rather strikingly creates open-ended grounds for classifying information as "Controlled". Here is its definition of the term CUI (all emphases are mine):
"Controlled Unclassified Information" is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended, but is (i) pertinent to the national interests of the United States or to the important interests of entities outside the Federal Government, and (ii) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination. Henceforth, the designation CUI replaces "Sensitive But Unclassified" (SBU).
"Pertinent" is about as vague as a limitation can get. In any case, Bush declares here that the CUI designation is to be used when his policies "require protection from unauthorized disclosure". It's a big rubber stamp for anything the President wants to keep from anybody, including the public. I can think of any number of obnoxious "policies" that this administration would have reason to believe required protection from disclosure. Later on the memo adds the normal clause stating that classification cannot be used to conceal illegal acts and embarrassing information. Its effect however, as regards the Bush administration, is slight since so many top officials appear to have no sense of shame and anyhow they're quite determined that everything the President orders is legal ipso facto.
The same open-endedness is apparent in the memo's description of when to designate something "Controlled":
(25) Information shall be designated as CUI and carry an authorized CUI marking if:
a. a statute requires or authorizes such a designation; or
b. the head of the originating department or agency, through regulations, directives, or other specific guidance to the agency, determines that the information is CUI. Such determination should be based on mission requirements, business prudence, legal privilege, the protection of personal or commercial rights, safety, or security. Such department or agency directives, regulations, or guidance shall be provided to the Executive Agent [i.e. the National Archives] for review.
Again, "mission requirements", "safety" and "security" are sufficiently vague as to invite all manner of abuses in classifying information. The memo is open-ended not to restrict how much information can be kept secret - there are few limitations placed upon CUI classification, all of them pro forma - but instead to make it easier to keep more information secret. It looks to me as if one of the goals of the new rules is to encourage agencies to classify as CUI as much material as possible. Indeed, the memo appears to acknowledge that.
(28) The CUI Framework shall be used for such information to the maximum extent possible, but shall not affect or interfere with specific regulatory requirements for marking, safeguarding, and disseminating.
And as before with SBU classification, there is no external oversight of the classification process nor limits placed upon it - neither in quantity of documents that may be classified CUI, nor in the length of time they remain so designated. Agency heads are in charge of making the classification decisions, and it's far from clear whether those can be reversed or checked by any regular means. The National Archives is given vague powers to publish CUI standards and monitor their use, but the goal appears to be to reconcile agencies to each other rather than to restrain the use of CUI designations.
Though the material to be regulated is nominally "unclassified", this new system is in fact a much more sweeping program for keeping information secret than the ostensibly higher grades of secrecy for "classified" material. And at the same time, the system for designating "unclassified" information is in significant ways far less regulated than for "classified" information. This new memo represents the opposite of reform.
See also this diary on the memo by philipmerrill