Background

Information sharing is essential to enhance the security of our nation and  is a key element in developing comprehensive and practical approaches to  defending against potential terrorist attacks. Having information on  threats, vulnerabilities, and incidents can help an agency better  understand the risks and determine what preventative measures should be  implemented. The ability to share such terrorism-related information can  also unify the efforts of federal, state, and local government agencies, as  well as the private sector in preventing or minimizing terrorist attacks.
The national commission appointed by members of Congress and the  President after the September 11 terrorist attacks (the 9/11 Commission)  recognized the critical role of information sharing to the reinvigorated  mission to protect the homeland from future attacks. In its final report, the  commission acknowledged the government has vast amounts of  information but a weak system for processing and using it. The  commission called on the President to provide incentives for sharing,  restore a better balance between security and shared knowledge, and lead  a governmentwide effort to address shortcomings in this area.
Since 2001, the President has called for a number of terrorism-related  information-sharing initiatives in response to legislative mandates passed  by Congress. Relatedly, over the past several years, we have identified  potential information-sharing barriers, critical success factors, and other  key management issues, including the processes, procedures, and systems  to facilitate information sharing between and among government entities  and the private sector. Efforts to promote more effective sharing of  terrorism-related information must also balance the need to protect and  secure it. The executive branch has established requirements for  protecting information that is deemed to be critical to our national  security.

		Laws and Executive Orders Have Established Requirements to Improve Information Sharing since 2001

Since the information-sharing weaknesses of September 11, the President  and the Administration have called for a number of terrorism-related  information-sharing initiatives driven predominately by two statutory  mandates—The Homeland Security Act of 2002 and the Intelligence  Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act).  Section 892 of the Homeland Security Act requires that the President,  among other things, prescribe and implement procedures under which  federal agencies can share relevant homeland security information, as  defined in the Homeland Security Act, with other federal agencies,  including DHS, and with appropriate state and local personnel, such as law  enforcement. Congress subsequently mandated a more extensive  information-sharing regimen through section 1016 of the Intelligence  Reform Act, requiring that the President take action to facilitate the  sharing of terrorism information, as defined in the act, by establishing an  Information Sharing Environment (ISE) that will combine policies,  procedures, and technologies that link people, systems, and information  among all appropriate federal, state, local, and tribal entities, and the  private sector. The act also requires the President to, among other things,  appoint a program manager to oversee development of the ISE and  establishes an Information Sharing Council to support the President and  the program manager with advice on developing the policies, procedures,  guidelines, roles, and environment. Together, the mandates call for  initiatives designed to facilitate the sharing of terrorism-related  information—which encompasses both homeland security and terrorism  information—within and among all appropriate federal, state, local, and  tribal entities, and the private sector. These and other actions are  explained in more detail in table 1.

		Our Prior Work Identified Challenges in Information Sharing

In January 2005, GAO designated information sharing for homeland  security as a governmentwide high-risk area because, although it was  receiving increased attention, this area still faced significant challenges.  Since 1998, we have recommended the development of a comprehensive  plan for information sharing to support critical infrastructure protection  efforts. Key elements of our recommendation can be applied to broader  terrorism-related information sharing, including clearly delineating the  roles and responsibilities of federal and nonfederal entities, defining  interim objectives and milestones, and establishing performance metrics.  Over the past several years, we have also issued several reports on  challenges related to information sharing.
In June 2005, we reported that as federal agencies work with state and  local public health agencies to improve the public health infrastructure’s  ability to respond to terrorist threats, including acts of bioterrorism, they  faced several challenges. First, the national health information  technology (IT) strategy and federal health architecture were still being  developed. Second, although federal efforts continue to promote the  adoption of data standards, developing such standards and then  implementing them were challenges for the health care community. Third,  these initiatives involved the need to coordinate among federal, state, and  local public health agencies, but establishing effective coordination among  the large number of disparate agencies would be a major undertaking.
In May 2005, we reported that DHS had undertaken numerous initiatives to  foster partnerships and enhance information sharing with other federal  agencies, state and local governments, and the private sector concerning  cyber attacks, threats, and vulnerabilities, but it still needed to address  underlying barriers to information sharing. At that time, critical  infrastructure sector representatives identified as barriers to sharing  information with the government fear of release of sensitive information,  uncertainty about how the information would be used or protected, lack of  trust in DHS, and inconsistency in the usefulness of the information shared  by DHS. We made recommendations to the Secretary of Homeland  Security to strengthen the department’s ability to implement key  cybersecurity responsibilities by completing critical activities and  resolving underlying challenges.
In September 2004, we reported that nine federal agencies had identified  34 major networks—32 operational and 2 in development—supporting  homeland security functions, including information sharing. The total  cost of the networks for which cost estimates were available was  approximately $1 billion per year for fiscal years 2003 and 2004. Among  the networks identified, DHS’s Homeland Secure Data Network appeared  to be a significant initiative for future sharing of classified homeland  security information among civilian agencies and DOD.
In July 2004, we reported on the status of the information sharing and  analysis centers that were voluntarily created by the private sector owners  of critical infrastructure assets to provide an information-sharing and  analysis capability. The information-sharing center community had  identified a number of challenges, including increasing participation,  building a trusted relationship, and sharing information between the  federal government and the private sector. We recommended that DHS  proceed with the development of an information-sharing plan that, among  other things, defines the roles and responsibilities of the various  stakeholders and establishes criteria for providing the appropriate  incentives to address the challenges.
In October 2001, we identified critical success factors and challenges in  building successful information-sharing relationships. In addition, we  identified practices that could be applied to other entities trying to develop  the means of appropriately sharing information. One of the most difficult  challenges to effective information sharing we identified was overcoming  new entities’ initial reluctance to share. Among the best practices we  identified were (1) establishing trusted relationships with a wide variety of  federal and nonfederal entities that may be in a position to provide  potentially useful information and advice, (2) developing standards and  agreements on how shared information will be used and protected, and   (3) taking steps to ensure that sensitive information is not inappropriately  disseminated.

		The Federal Government Has Established Mechanisms to Protect Sensitive Information

The federal government utilizes a variety of policies and procedures,  whether prescribed by statute, executive order, or other authority, to limit  dissemination and protect against the inadvertent disclosure of sensitive  information. For information the government considers critical to our  national security, the government may take steps to protect such  information by classifying it—for example, Top Secret, Secret, or  Confidential—pursuant to criteria established by executive order. The  executive order prescribes uniform standards for making all classification  decisions across the federal government. Specifically, it prescribes the  categories of information that warrant classification, establishes criteria  for persons with classification authority, limits the duration of  classification decisions, establishes procedures for declassifying or  downgrading classified information, prescribes standards for identifying  and safeguarding classified materials, requires that agencies prepare  classification guides to facilitate proper and uniform classification  decisions, and provides for oversight of agency classification decisions.
Information that does not meet the standards established by executive  order for classified national security information but that an agency  nonetheless considers sufficiently sensitive to warrant restricted  dissemination is generally referred to as sensitive but unclassified. In  designating information this way, agencies determine that the information  they use must therefore be safeguarded from public release. Such  information could include, for example, information at DOJ that is critical  to a criminal prosecution. DOJ would protect this information from  inappropriate dissemination by identifying it with a designation, such as  Law Enforcement Sensitive, and prescribing restricted handling  procedures for information with this designation. Some specific  designations—such as Sensitive Security Information (SSI), used for  certain transportation-related information, and Protected Critical  Infrastructure Information (PCII), used for information that has been  voluntarily submitted to DHS by the private sector and is related to the  security of the nation’s critical infrastructure—have a specific basis in  statute, but many other designations that agencies use do not. For  example, some agencies use the provisions of the Freedom of Information  Act (FOIA), which establishes the public’s legal right of access to  government information but also enables the government to withhold  certain information from public release, as their basis for designating  information sensitive but unclassified. OMB has primary governmentwide  oversight responsibility for information management and information  security.

	The Nation Still Lacks the Governmentwide Policies and Processes Needed to Build an Integrated Terrorism-Related Information-Sharing Road Map, but Smaller-Scale Sharing Initiatives Are Under Way

No governmentwide policies or processes have been established by the  executive branch to date to define how to integrate and manage the  sharing of terrorism-related information across all levels of government  and the private sector despite legislation and executive orders dating back  to September 11. This is due, in part, to the difficulty of the challenge, as  well as the fact that responsibility for creating these policies has shifted  among various executive agencies. Most recently in December 2005, the  President once again tried to better clarify the roles and responsibilities of  the ODNI program manager, Information Sharing Council, DHS, and other  agencies in support of the Information Sharing Environment (ISE). The  program manager is in the early stages of addressing the mandate and  issued an interim implementation plan to Congress in January 2006 that  lays out a number of steps and deadlines for deliverables. However, until  governmentwide policies and processes on sharing are in place, the  federal government will lack a comprehensive road map to improve the  exchange of critical information needed to protect the homeland.

		Chronology of Efforts to Develop Governmentwide Policies and Processes to Facilitate Terrorism- Related Information Sharing Demonstrates a Series of Unfulfilled Initiatives and the Complexity of the Challenge

Following September 11, the White House and OMB first began to work on  information-sharing policies. Following passage of the Homeland Security  Act in November 2002, the presidential responsibility for developing  policies and processes for information sharing under section 892 of the act  was not immediately assigned.
On July 29, 2003, the President issued Executive Order 13311 delegating to  the Secretary of DHS the responsibility to create and implement policies  for sharing sensitive homeland security information, and to report to  Congress by November 2003 on implementation of section 892 of the  Homeland Security Act.
DHS began its efforts, but did not provide the implementation report to  Congress until February 2004. The report primarily discussed several  small-scale efforts within DHS associated with sensitive but unclassified  information. It did not provide recommendations for additional legislative  measures to increase the effectiveness of the sharing of information  between and among federal, state, and local entities. The report concluded  that to avoid uncertainty and confusion, federal agencies must have a  consistent set of policies and procedures for identifying the information to  be shared as well as to be safeguarded, but it did not define those policies  and procedures or DHS’s actions to develop them.
Subsequently, DHS developed a notice of proposed rule making laying out  a proposed policy framework to govern sharing sensitive homeland  security information in response to the mandate, but after internal  Executive Branch review it was not formally transmitted to OMB and,  according to DHS officials, it was never issued.
When the new Secretary assumed leadership of DHS in February 2005, a  reassessment of the proposed rule making was requested in part to assure  harmonization with the related requirements of the more recent  Intelligence Reform Act, according to DHS’s Deputy Director for  Information Sharing and Collaboration.
Then, in response to the December 2004 Intelligence Reform Act, the  President issued a series of directives to better clarify responsibilities and  time frames for achieving a governmentwide road map for information  sharing.
On April 15, 2005, the President designated a program manager  responsible for information sharing across the federal government, as  required by the Intelligence Reform Act.
On June 2, 2005, the President issued a memorandum directing that during  the initial 2-year term of the program manager, the DNI would exercise  authority, direction, and control over the program manager. The  memorandum also directed the DNI to provide the program manager all  personnel, funds, and other resources as assigned. The Intelligence  Reform Act had authorized an appropriation of $20 million for each of  fiscal years 2005 and 2006.
On October 25, 2005, the President issued Executive Order 13388, which  established, among other things, priorities for facilitating the sharing of  terrorism information and an Information Sharing Council, chaired by the  program manager. The order also revoked the President’s earlier direction,  Executive Order 13356, which had addressed similar issues and imposed  similar requirements with respect to—the Director of Central Intelligence,  OMB, and other agencies. The present order, however, calls for the use of  standards and plans developed pursuant to the revoked order.
In November 2005, the new Information Sharing Council, tasked with  planning for and overseeing the establishment of an ISE for sharing  terrorism information, had its first meeting and took over for the former  Information Systems Council that OMB had chaired.
On December 16, 2005, the President issued a memorandum providing  guidance and imposing requirements on the heads of all executive  departments and agencies in support of the development of the ISE. The  memo delineates roles and responsibilities as well as sets deadlines for an  effort to leverage ongoing efforts consistent with establishing the ISE as  required by the Intelligence Reform Act and in accordance with  requirements of the Homeland Security Act and related executive orders.  For example, the memorandum requires the program manager, in  consultation with the council, to conduct and complete, within 90 days of  the memorandum’s issuance, a comprehensive evaluation of existing  resources pertaining to terrorism information sharing employed by  individual or multiple executive departments and agencies. It also tasked  the ODNI with developing the policies, procedures, and architectures  needed to create the ISE by December 16, 2006.

		The ODNI Is in the Early Stages of Addressing the Intelligence Reform Act Mandate, but Establishing the Required Information- Sharing Requirements Will Be a Challenge

ODNI is in the early stages of addressing the mandate under the  Intelligence Reform Act to create an ISE. Soon after the appointment of  the program manager in April 2005, he issued a preliminary report on its  plans to establish the ISE as required by the act. The program manager  later outlined the priorities for his office’s work in establishing the ISE:    clarifying the differing standards among agencies for the designation and  dissemination of terrorism information,   ensuring two-way flow of information from the federal level to the state  and local level as well as from state and local agencies to the federal level,    providing fast-paced, value-added dissemination of information and  informational expertise from the intelligence community,   overcoming the hesitancy of the intelligence community to share    ensuring the protection of information privacy and other legal rights of  identifying and removing impediments to information sharing.
On January 9, 2006, ODNI issued an Information Sharing Environment  Interim Implementation Plan to Congress that lays out a number of steps  and deadlines for deliverables. ODNI noted in the interim plan the need for  more time to develop the final implementation plan because the  Intelligence Reform Act requirements call for detailed answers that can be  provided only after significant coordination between the program manager  and all departments and agencies that are ultimately responsible for  implementing the ISE. In the plan, ODNI acknowledged that it recognizes  the value and challenge in building ownership for the ISE among all of the  federal agencies that have a role in homeland security. The plan also  stated that adding to the complexity of the task is the fact that the needs of  state, local, and tribal governments and private sector entities must also be  taken into account as well. ODNI plans to issue a more comprehensive  implementation plan to Congress in July 2006.
The interim plan noted that while a large amount of terrorism information  is already stored electronically in systems, many users are not connected  to those systems. In addition, there remains an unknown quantity of  relevant information not captured and stored electronically. Thus, the  information about terrorists, their plans, and their activities is  fragmentary. The interim plan states that the ISE will connect disparate  electronic storehouses to take advantage of what already exists.  Additionally, it will provide mechanisms for capturing and providing  access to terrorism information not currently available electronically.  According to the interim plan, ISE implementation will be based on a  three-pronged strategy:  Implementation of the presidential guidelines and requirements.
Support and augmentation for existing information-sharing environments,  such as the National Counterterrorism Center (NCTC). NCTC was selected  to serve as one of the initial information-sharing environments because it  is the primary organization in the U.S. government for analyzing and  integrating all information pertaining to terrorism and counterterrorism.  Moreover, DHS and DOJ will identify one or more environments run by  states and major urban areas for evaluation of the effectiveness of the flow  of terrorism information between federal, state and local governments and  the private sector.
A process for integrating the President’s guidelines and requirements with  the needs of the broader ISE, which includes addressing the overall ISE’s  functions, capabilities, resources, conceptual design, architecture, budget,  and performance management process.
While recognizing that creating a fully functioning ISE will take time, the  interim plan includes a schedule for completing a number of key  milestones. For example, by June 14, 2006, the program manager and the  Director of NCTC are to have conducted a comprehensive review of all  agency missions, roles, and responsibilities related to any aspects of  information sharing, especially sharing with state, local, and private  entities; developed and disseminated information-sharing standards across  the federal, state, local, and private sectors; developed recommendations  for sharing with foreign partners and allies; developed privacy guidelines  to govern sharing; developed guidelines, training, and incentives to hold  personnel accountable for improved information sharing; and developed  the ISE investment strategy, among other things.
As part of its efforts to provide end-user input to the technical  development of the ISE, ODNI plans to continue to expand the use of  information access pilot programs at the state and local levels. Currently,  ODNI has two ongoing information-sharing technology pilot programs  involving the Federal Bureau of Investigation (FBI) and the Department of  Energy (DOE). The FBI’s New York Field Office’s Special Operations  Division is using handheld wireless devices for field operations to  facilitate enhanced communications among counterterrorism personnel by  providing rapid wireless access to sensitive but unclassified data sources.  DOE is sponsoring a pilot project that will apply technical analytic  expertise to intelligence pertaining to nuclear terrorism. The project has  established a core group of nuclear expert analysts, across five national  laboratories, whose focus is on providing both long-term, strategic  analysis of potential sources of nuclear terrorism and better short-term  tactical intelligence on this issue. Central to the success of this effort is the  sharing of all relevant sensitive information with these laboratories.
Despite this progress, when the program manager testified before the  Subcommittee on Intelligence, Information Sharing, and Terrorism Risk  Assessment, Committee on Homeland Security, in November 2005, he  expressed concern about whether he had enough resources to meet the  mandates in the Intelligence Reform Act. For example, he said that for  2006, he did not have a budget line item and was continuing to work with  the DNI on his budget. The Intelligence Reform Act authorized $20 million  for fiscal year 2006, but the program manager said he needed $30 million a  year at a minimum. At the time, the program manager also said that  although he planned to have a staff of 25, he had only 11 federal employees  and 6 contractors on board. On January 26, 2006, the program manager  announced his resignation from his position. At the time of our review, a  new program manager had not yet been appointed. Once a new program  manager is named, it will be important for the DNI to monitor milestones  set in the interim implementation plan; identify any barriers to achieving  the milestones, such as insufficient resources; and recommend to the  oversight committees with jurisdiction any necessary changes to the  organizational structure or approach to the ISE.

		Many Agencies Are Taking Small-Scale Actions to Improve the Sharing of Terrorism-Related Information

Despite the lack of governmentwide policies and procedures for  information sharing, many agencies have their own information-sharing  initiatives under way. The following are examples of agency-based  terrorism-related information-sharing efforts.
The FBI leads Joint Terrorism Task Forces, which are one of the means by  which the FBI shares information with federal, state, and local law  enforcement agencies and officers. At the time of our review, the FBI had  103 Joint Terrorism Task Forces around the country, staffed by bureau  officers as well as state and local law enforcement officers. The mission of  the task forces is to respond to terrorism by combining the national and  international investigative resources of federal agencies with the street- level expertise of state and local law enforcement agencies.
The FBI and DHS also collaborate to circulate sensitive intelligence  information, through bulletins, to state and local officials. These bulletins  are intended to alert state and local governments to information that is  being noted at the federal level. As part of this effort, they have provided  state and local officials guidance about appropriate control and sharing of  this information.
Multiple other mechanisms exist to share terrorism-related information.  For example, through our prior work in 2004 we have identified at least 34  major networks that support homeland security functions. Some of the  major technology systems we identified in this review and in our other  work are described below:    DHS’s Homeland Secure Data Network grew out of a former U.S. Customs  Service system that was consolidated with the DHS IT network when the  department was created. The system is composed of secure network  connections on a data communications framework that connects users to  data centers to allow them to share intelligence and other information  securely. The network is eventually intended to connect 600  geographically dispersed DHS intelligence-gathering units; operational  components; and other federal, state, and local agencies involved in  homeland security activities.
The DOJ Regional Information Sharing System (RISS) links thousands of  local, state, and federal law enforcement agencies throughout the nation,  providing secure communications, information-sharing resources, and  investigative support to combat multijurisdictional crime and terrorist  threats. RISS was integrated with the DOJ Law Enforcement Online  system in 2002 and with the Automated Trusted Information Exchange in  2003, to provide users with access to homeland security, disaster, and  terrorist threat information.
One of the first steps ODNI plans to undertake in developing the ISE is to  perform a review of the existing systems such as these so that it can  leverage what has already been done and find ways to connect existing  systems.

	The Large Number of Sensitive but Unclassified Designations and the Lack of Consistent Policies and Procedures for Their Use Make Sharing Information More Difficult

Federal agencies report that they are using a total of 56 different  designations for information they determined is sensitive but  unclassified, and agencies that account for a large percentage of the  homeland security budget reported using most of these designations.  There are no governmentwide policies or procedures that describe the  basis on which agencies should designate, mark, and handle this  information. In this absence, the agency determines what designations to  apply to its sensitive but unclassified information. Such inconsistency can  lead to challenges in information sharing. In fact, more than half of the  agencies reported encountering challenges in sharing sensitive but  unclassified information. Furthermore, most agencies do not determine  who and how many employees can make such designations, provide them  training on how to do so, or perform periodic reviews of how well their  practices are working, nor are there governmentwide policies that require  such internal control practices. By not providing guidance and monitoring,  there is a probability that the designation will be misapplied, potentially  restricting material unnecessarily or resulting in dissemination of  information that should be restricted.

		Agencies Report Using 56 Different Designations for Sensitive but Unclassified Information

As table 2 shows, agencies reported using 56 different designations to  identify categories of sensitive but unclassified information—including,  for example, For Official Use Only (FOUO) and Protected Critical  Infrastructure Information (PCII). Most of these designations are in use by  agencies that account for a large percentage of the homeland security  budget (those shown in bold in the table). However, other agencies in the  list, such as the Environmental Protection Agency (EPA) and the U.S.  Department of Agriculture (USDA) also have homeland security-related  sensitive but unclassified information. The numerous designations can be  confusing for recipients of this information, such as state and local law  enforcement agencies, which must understand and protect the information  according to each agency’s own rules.
For most of these designations, there are no governmentwide policies or  procedures to guide agency decision making on using the designations,  explaining what they mean across agencies, and assuring that the  information is protected and shared consistently from one agency to  another. Different agencies and departments currently define sensitive but  unclassified information in many different ways in accordance with their  unique missions and authorities.
As a result of the lack of standard criteria for sensitive but unclassified  information, multiple agencies often use the same or similar terms to  designate information, but they define these terms differently. For  example, there are at least 13 agencies that use the designation For  Official Use Only, but there are at least five different definitions of FOUO.  At least seven agencies or agency components use the term Law  Enforcement Sensitive (LES), including the U.S. Marshals Service, the  Department of Homeland Security (DHS); the Department of Commerce,  and the Office of Personnel Management (OPM). These agencies gave  differing definitions for the term. While DHS does not formally define the  designation, the Department of Commerce defines it to include  information pertaining to the protection of senior government officials,  and OPM defines it as unclassified information used by law enforcement  personnel that requires protection against unauthorized disclosure to  protect the sources and methods of investigative activity, evidence, and  the integrity of pretrial investigative reports.
Agencies also use different terminology or restrictive phrases for what is  essentially the same type of information. According to a senior official in  the Delaware Department of Homeland Security, the multiple designations  are a problem. He said that often multiple terms or phrases are used by  different agencies for the same material. For example, information about a  narcotics-smuggling ring that was financing terrorism might be considered  sensitive by the DHS Customs and Border Protection component, which  would mark it as FOUO or LES and require it to be kept in a locked file,  cabinet, or desk when not in use. The same information might be marked  DEA-Sensitive by DOJ’s Drug Enforcement Administration (DEA), which  under its policy, requires a higher level of protection than normally  afforded sensitive but unclassified information. Additionally, the  Department of Defense, the Department of State, the Environmental  Protection Agency, and the U.S. Agency for International Development all  use the categories under FOIA that exempt information from public  disclosure as basic criteria for designating some of its sensitive  information. However, for FOIA-exempt material, DOD uses the term For  Official Use Only, State uses Sensitive But Unclassified, EPA uses FOIA,  and the U.S. Agency for International Development (USAID) uses Sensitive  But Unclassified. Use of multiple designations such as this can hamper  sharing efforts and confuse end users about the information.

		Some Agencies and End Users Reported Challenges in Sharing Sensitive but Unclassified Information

More than half of the agencies reported challenges in sharing sensitive but  unclassified information. For example, 11 of the 26 agencies that we  surveyed said that they had concerns about the ability of other parties to  protect sensitive but unclassified information. These concerns could lead  them to share less information than they could. DHS said that sensitive but  unclassified information disseminated to its state and local partners had,  on occasion, been posted to public Internet sites or otherwise  compromised, potentially revealing possible vulnerabilities to business  competitors. The Department of Transportation (DOT) said that the time it  takes to determine whether other departments’ handling and protection  requirements meet or exceed DOT’s requirements for Sensitive Security  Information represents a challenge. Six agencies said that the lack of  standardized criteria for defining what constitutes sensitive but  unclassified information was a challenge in their efforts to share  information, and DOD said that standardizing the designations and  definitions used by federal agencies for sensitive but unclassified  information might facilitate the handling and safeguarding of the  information, thereby strengthening information-sharing efforts. Four  agencies reported that they struggle with balancing the trade-off between  limited dissemination of sensitive but unclassified information in order to  protect it and broader dissemination to more stakeholders, who could use  it for their efforts. Finally, 3 agencies reported challenges in using their  designations that were not related to identifying, sharing, and safeguarding  sensitive information, and 9 agencies reported no challenges.
First responders reported that the multiplicity of designations and  definitions not only causes confusion but leads to an alternating feast or  famine of information. Lack of clarity on the dissemination rules and lack  of common standards for controlling sensitive but unclassified  information have led to periods of oversharing of information, often  overwhelming end users with the same or similar information from  multiple sources, according to an Illinois State Police Officer.

		Most of the Agencies We Surveyed Do Not Determine Which Employees Can Make Sensitive but Unclassified Designations, nor Do They Provide These Employees with Training

Of the 20 agencies that reported on who is authorized to make sensitive  but unclassified designations at their agency, 13 did not limit which  employees could apply at least one of their sensitive but unclassified  designations. For example, DHS does not limit which employees may  decide whether to designate a document For Official Use Only. At the  Department of State, there are no limits on which personnel can designate  information as sensitive but unclassified. At the National Aeronautics and  Space Administration (NASA), approximately 20,000 civil servants and  80,000 contract employees are authorized to designate information as  sensitive but unclassified using the Administratively Controlled  Information designation of the agency. In addition, 12 of 23 agencies (or 52  percent) reported that they did not have policies or procedures for  specialized training for personnel making sensitive but unclassified  designations.
Several agencies, however, have taken steps to limit the number of  designators or have provided at least some limited training to their  employees. The U.S. Secret Service limits its designation authority solely  to those individuals in the organization with the authority to classify  information at the Confidential level under the National Security  Information program. DOE restricts the application and removal authority  for the Unclassified Controlled Nuclear Information (UCNI) designation to  specially trained UCNI reviewing officials. Also, the Department of State  provides training for its designators, and the Department of the Treasury  provides training for designators and users of one of its designations.

		Very Few Agencies Perform Periodic Reviews of How Well Their Sensitive but Unclassified Practices Are Working or Set Time Limits on the Designations

Eighteen of the 23 agencies that provided us with information do not have  policies or procedures for periodically reviewing how well the agency’s  designation practices are working and how accurately employees are  making these decisions. Without oversight, agencies have no way to know  the level of compliance or the effectiveness of the policies and procedures  they have set.
In addition, only 2 of the agencies that provided information on the issue  of time limits for sensitive but unclassified information set such limits. In  contrast, classified national security information is declassified as  specified by the governing executive order. The U.S. Postal Service (USPS)  set a limit of 5 years, and USDA set a limit of 10 years, after which the  designation would no longer be valid, and the information could become  publicly available. Two agencies, the General Services Administration and  the Department of Commerce, indicated that if it was possible to foresee a  specific event that could remove the need for continued protection of the  information—for example, a document concerning trade negotiations  would be considered sensitive until the negotiations were ended—the  agency marked the document in such a way so that the designation was  removed upon the completion of the event. Documents designated  sensitive but unclassified at the other agencies that did not set time limits  will remain so designated until a review of the document’s status is  triggered by an action such as a FOIA request by a private citizen.  Continued restriction limits access to this information over the long term.
To address the obstacles to information sharing, the Homeland Security  Act required the President to, among other things, develop policies for  sharing homeland security information, including sensitive but  unclassified information, with appropriate state and local personnel. He  delegated this responsibility to the Secretary of the newly created DHS in  July 2003. Later, in his December 2005 memo, the President gave agencies  90 days to inventory their sensitive but unclassified procedures and report  them to ODNI, which in turn is to provide them to the Secretary of DHS  and the Attorney General. Working in coordination with the Secretaries of  State, Defense, and Energy and with the DNI, they have 90 days from when  they receive the inventories to develop recommended procedures that will  provide a more standardized approach for designating homeland security  information, law enforcement information, and terrorism information as  sensitive but unclassified. The memorandum also requires that ODNI, in  coordination and consultation with other agencies, develop  recommendations for standardizing sensitive but unclassified procedures  for all information not addressed by the first set of recommendations.

	Conclusions

In part because of the complexity of the task, shifting responsibilities, and  missed deadlines, more than 4 years after September 11 the federal  government still lacks comprehensive policies and processes to improve  the sharing of information that is critical to protecting our homeland. After  the 9/11 Commission’s recommendation that the sharing and uses of  information be guided by a set of practical policy guidelines, Congress  passed the Intelligence Reform Act and mandated the creation of an  Information Sharing Environment (ISE), to be planned for and overseen by  a program manager. While recognizing that creating a fully functioning ISE  will take time, the program manager’s interim implementation plan  includes a schedule for meeting a number of key deadlines. For example,  by June 14, 2006, the program manager and the Director of NCTC are to  have conducted a comprehensive review of all agency missions, roles, and  responsibilities both as producers and users of terrorism information.  Given that the program manager resigned and, at the time of our review, a  new one had not been appointed, meeting this deadline will be difficult.  When a new program manager is appointed, ensuring the success of this  project will require support and vigilance from ODNI as well as the other  agencies mentioned in the President’s memorandum. It will be essential  that the DNI assess progress toward meeting the milestones in the interim  plan, identify and address any barriers to progress, and recommend to the  congressional oversight committees with jurisdiction any changes  necessary to achieve the goals of the mandates.
The President’s December 2005 memorandum recognizes the need to  standardize procedures for sensitive but unclassified information.  Currently, no governmentwide policies or procedures exist for most  sensitive but unclassified designations. Our work on the policies and  procedures agencies currently use can help validate ODNI’s efforts in this  area. It will be important that the new policies and procedures provide for  consistent application of the designations and consistent handling  requirements. Establishing governmentwide policies and procedures is a  critical first step, but unless agencies, when implementing designations,  ensure employees have the tools they need to use the designations  accurately, and establish a monitoring system for their use, designations  could be misapplied and information might be unnecessarily restricted or  released when it should be protected. In the end, agencies need the  flexibility to use designations that meet their mission needs, but where  feasible using the same designation and handling procedures across  agencies for similar information will provide for more consistent sharing  and protection of sensitive information. Without continued vigilance, there  is danger that there will be further delays in developing a governmentwide  information-sharing policy and in establishing sensitive but unclassified  policies that better enable the sharing of the information critical to the  protection of the homeland.

	Recommendations for Executive Action

To ensure effective implementation of the Intelligence Reform Act, we  recommend that the following six actions be taken:  We recommend that the Director of National Intelligence (1) assess  progress toward the milestones set in its Interim Implementation Plan;   (2) identify any barriers to achieving these milestones, such as insufficient  resources and determine ways to resolve them; and (3) recommend to the  oversight committees with jurisdiction any necessary changes to the  organizational structure or approach to creating the ISE.
In carrying out the President’s December 2005 mandates for standardizing  sensitive but unclassified information, we recommend that the Director of  National Intelligence and the Director of OMB (1) use the results of our  work to validate the inventory of designations that agencies are required  to conduct in accordance with the memo and (2) issue a policy that  consolidates sensitive but unclassified designations where possible and  addresses their consistent application across agencies.
We recommend that the Director of OMB, in his oversight role with  respect to federal information management, work with other agencies to  develop and issue a directive requiring that agencies have in place internal  controls that meet the standards set forth in GAO’s Standards for Internal  Controls in the Federal Government. This directive should include  guidance for employees to use in deciding what information to protect  with sensitive but unclassified designations; provisions for training on  making designations, controlling, and sharing such information with other  entities; and a review process to determine how well the program is  working.

	Agency Comments

We requested comments on a draft of this report from the Director of OMB  and the Director of National Intelligence or their designees. We received  comments from OMB that neither agreed nor disagreed with our findings  and recommendations. OMB commented that once the program manager  and others completed their work to establish governmentwide policies,  procedures, or protocols to guide the sharing of information as it relates to  terrorism and homeland security, they would work with the program  manager and all agencies to determine what additional steps are  necessary, if any. ODNI, however, declined to comment on our draft  report, stating that the review of intelligence activities is beyond GAO’s  purview. We are disappointed by the lack of an ODNI response to our  report on the critical issue of information-sharing efforts in the federal  government. We have placed information sharing for homeland security on  GAO’s high-risk list, in part because federal agencies have not done an  adequate job of sharing critical information in the past and because  success in this area will involve the combined efforts of multiple agencies  and key stakeholders. The President has tasked ODNI with key  coordinating roles in furtherance of this effort.
In declining to comment, ODNI stated that our draft report was “very  broad” and that it “addresses a number of intelligence-related issues,  including a discussion of the management of  and specific  recommendations to the Director of National Intelligence (DNI).” ODNI  then made a general reference to the DOJ having “previously advised”  GAO that “the review of intelligence activities is beyond the GAO’s  purview.” In DOJ’s comments on a 2003 GAO report on information  sharing, DOJ similarly said “the review of intelligence activities is an arena  beyond GAO’s purview.” However, there was no legal analysis attached to  either of these statements.
There is a 1988 DOJ Office of Legal Counsel (OLC) opinion that offers  DOJ’s views on our authority to review intelligence activities in the  context of foreign policy. In the 1988 opinion, OLC asserted that by  enacting the current intelligence oversight framework, codified at 50  U.S.C. § 413, Congress intended the intelligence committees to maintain  exclusive oversight with respect to intelligence activities, foreclosing  reviews by GAO. Although we recognize that section 413 codified  practices to simplify the congressional intelligence oversight process, we  do not agree with DOJ’s view that the intelligence oversight framework  precludes GAO reviews in the intelligence arena. Neither section 413 nor  its legislative history states that the procedures established therein  constitute the exclusive mechanism for congressional oversight of  intelligence activities, to the exclusion of other relevant committees or  GAO. GAO has broad statutory authority to evaluate agency programs and  investigate matters related to the receipt, disbursement, and use of public  money. GAO also has broad authority to inspect and obtain agency  information and records, subject to a few limited exceptions.
In any event, we do not agree with ODNI’s characterization that our review  involved “intelligence activities.” Our review did not involve evaluation of  the conduct of actual intelligence activities. Rather, our review addresses  the procedures in place to facilitate the sharing of a broad range of  information across all levels of government. In our view ODNI’s concept of  “intelligence activities” is overly broad and would extend to  governmentwide information-sharing efforts clearly outside the traditional  intelligence arena—including, for example, procedures for sharing  sensitive but unclassified information unrelated to homeland security. The  use of such a sweeping definition to limit GAO’s work would seriously  impair Congress’s oversight of executive branch information-sharing  activities.
Given the above, we strongly disagree with ODNI’s reasons for declining to  comment on our report. ODNI’s letter is reprinted in appendix III.
As agreed with your offices, unless you publicly release the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. We will then send copies of this report to the Director, Office  of Management and Budget; the Director of National Intelligence; the  Secretaries and heads of the 26 departments and agencies in our review;  and interested congressional committees. In addition, this report will be  available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact either David Powner at 202-512-9286 or pownerd@gao.gov, or  Eileen Larence at 202-512-6510 or larencee@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the status of efforts to  establish governmentwide policies and processes for sharing terrorism- related information between the federal government and its state, local,  and private sector partners and (2) identify the universe of different  sensitive but unclassified designations agencies apply to homeland  security and to other sensitive information and determine the extent to  which these agencies have policies and procedures in place to ensure their  consistent use.
To determine the status of efforts to establish governmentwide policies  and processes for sharing terrorism information,, we reviewed applicable  federal laws, executive orders, presidential directives, memorandums,  reports, and testimony. Because they have roles in cross-government  information sharing, we also interviewed the Deputy Director and Chief of  Staff of the Information Sharing and Collaboration Office at the  Department of Homeland Security and the Chief of the Information Policy  and Technology Branch, Office of Management and Budget, to determine  efforts to date and the current status of required actions. We also  interviewed Congressional Research Service staff who work on  information-sharing issues and a member of the 9/11 Public Discourse  Project, a privately funded continuation of the 9/11 Commission. We  gathered publicly available documents on the establishment of the Office  of the Director of National Intelligence’s (ODNI) on the establishment of  the Information Sharing Council and the Information Sharing  Environment, met informally with a senior ODNI official who provided us  with the interim implementation plan. During the course of our review, we  were negotiating protocols for working with ODNI.
We also surveyed 26 major federal agencies, those that are subject to the  requirements in the Chief Financial Officers Act as well as the Federal  Energy Regulatory Commission and the U.S. Postal Service because our  experience with these two agencies indicated that they used sensitive but  unclassified designations. We obtained information on their sharing  processes for terrorism-related information and for descriptions of any  actions they had taken to encourage or improve the sharing of this  information. We also asked the agencies about challenges pertaining to  identifying, safeguarding, and sharing sensitive but unclassified  information. We queried the agencies on the types of sensitive but  unclassified designations they use; the policies, procedures, and protocols  they have in place for each designation; and the extent to which they  provide controls for protecting and policies for sharing these types of  information. We aggregated the data by agency and sent them back to the  agencies’ responding officials who reviewed the information for  completeness and accuracy.
We collected and reviewed applicable federal laws and regulations,  policies, procedures, and documents related to the sensitive but  unclassified and national security classification processes for federal  agencies. We met with officials at the National Archives and Records  Administration’s Information Security Oversight Office, and discussed  policies and processes for handling, overseeing, and sharing national  security related information as compared with policies and processes for  handling, sharing, and overseeing sensitive but unclassified information.  We also contacted the International Association of Police Chiefs, the  International Association of Fire Chiefs, and the National Governor’s  Association to obtain information from end users such as state and local  law enforcement, first responders, and state-level homeland security and  disaster response agencies, since such organizations are likely to require  access to sensitive but unclassified information.
To determine whether appropriate policies and procedures were in place,  we relied on GAO’s Standards for Internal Control in the Federal  Government for benchmarks and standards against which to assess each  agency’s sensitive but unclassified designation policies and procedures.  We conducted our work from May 2005 through February 2006 in   accordance with generally accepted government auditing standards.

Appendix II: Summary Information on Sensitive But Unclassified Designations by Agency

The following information was provided by the 26 federal agencies that we  surveyed. The agencies were queried on the types of sensitive but  unclassified designations they use; the basis of the designations; and  policies, procedures, and protocols for designating, handling, and sharing  these types of information.  We provided the agencies with the opportunity  to review their summarized information for accuracy and completeness.
Designation: Sensitive Security Information  Basis for designation: Departmental Regulation 3440-2, Control and Protection of Sensitive Security Information  (January 2003)  Definition: The designation is used for unclassified information of a sensitive nature, that if publicly disclosed could be  expected to have a harmful impact on the security of Federal operations or assets, the public health or safety of the  citizens of the United States or its residents, or the nation’s long-term economic prosperity and which describes,  discusses, or reflects  the ability of any element of the critical infrastructure of the United States to resist intrusion, interference,  compromises, theft, or incapacitation by either physical or computer-based attack or other similar conduct that  violates federal, state, or local law; harms interstate or international commerce of the United States; or  threatens public health or safety; any currently viable assessment, projection, or estimate of the security vulnerability of any element of the critical  infrastructure of the United States, specifically including—but not limited to—vulnerability assessment, security  testing, risk evaluation, risk management planning, or risk audit; or any currently applicable operational problem or solution regarding the security of any element of the critical  infrastructure of the United States, specifically including—but not limited to—the repair, recovery, redesign,  reconstruction, relocation, insurance, and continuity of operations of any element.
Department of Commerce (continued)
Department of Defense (continued)
Department of Defense (continued)
Systematic review process: No Designation: For Official Use Only  Basis for designation: FOIA, as amended; Privacy Act of 1974, as amended; Section 208 of the E-Government Act of  2002 (44 U.S.C. § 3501, note); Handbook for Information Technology Security Risk Assessment Procedures OCIO-07  (January 2004); and Handbook for Information Assurance Security OCIO-01 (December 2005)  Definition: The designation is used for information that (1) falls within one or more of the nine exemptions or three  exclusions of the Freedom of Information Act (FOIA), (2) is protected by the Privacy Act of 1974, or (3) is marked by the  Office of the Inspector General to prohibit distribution to unauthorized persons.  Designating authority: The owner of the information.  Policies and procedures for specialized training for designators: No Systematic review process: No Designation: Official Use Only  Basis for designation: DOE Order 471.3 (April 2003)  Definition: Certain unclassified information that may be exempt from public release under the Freedom of Information  Act and has the potential to do damage to governmental, commercial or private interests if disseminated to people  who do not need the information to perform their jobs or other DOE authorized functions.  Designating authority: Any DOE or DOE contractor employee.  Polices or procedures for specialized training for Systematic review process: No designators: No  Designation: Unclassified Controlled Nuclear Information  Basis for designation: Section 148 of the Atomic Energy Act of 1954, as amended (42 U.S.C. § 2168),  10 C.F.R. pt.1017, DOE Order 471.1A (June 2000)  Definition: The designation is used for certain unclassified government information prohibited from unauthorized  dissemination under section 148 of the Atomic Energy Act which concerns atomic energy defense programs which pertains to (i) the design of production or utilization facilities (ii) security measures for the  physical protection of production or utilization facilities or nuclear material contained in these facilities  or in transit (iii) the design, manufacture or utilization of nuclear weapons or components that were  once classified as Restricted Data whose unauthorized dissemination could reasonably be expected to have a significant adverse effect  on the health and safety of the public or the common defense and security by significantly increasing  the likelihood of (i) illegal production of nuclear weapons or (ii) theft, diversion, or sabotage of nuclear  materials, equipment or facilities.

	Department of Health and Human Services

Designation: Sensitive But Unclassified  Basis for designation: Section 201(a) of the Public Health Security and Bioterrorism Preparedness and Response  Act of 2002, (42 U.S.C. § 262a (h)), and 42 C.F.R. pt. 73 (Select Agents and Toxins)   (new policy in draft)
Centers for Disease Control and Prevention (continued)
Designation: Contractor Access Restricted Information  Basis for designation: 41 U.S.C. § 401; Federal Acquisition Regulations 1.102; Executive Order 11222 (May 8,  1965)  (new policy in draft)  Definition: Unclassified information that involves functions reserved to the federal government as vested by the  Constitution as inherent power or as implied power as necessary for the proper performance of its duties.  Designating authority: Not specified  Policies or procedures for specialized training for  designators: No  Systematic review process: No Designation: For Official Use Only  Basis for designation: FOIA, as amended   (new policy in draft)  Definition: This designation is applied to unclassified information that is exempt from mandatory release to the public  under FOIA.   Designating authority:  Not specified  Policies or procedures for specialized training for Systematic review process: No designators: No  Designation: Law Enforcement Sensitive  Basis for designation: Not specified   (new policy in draft)  Definition: The designation is used for law enforcement purposes. Information that could reasonably be expected to  interfere with law enforcement proceedings, would deprive a person of a right to a fair trial or impartial adjudication,  could reasonably be expected to constitute an unwarranted invasion of personal privacy of others, disclose the identity  of a confidential source, disclose investigative techniques and procedures or could reasonably be expected to  endanger the life or physical safety of any individual is to be marked law enforcement sensitive.
Systematic review process: No Designation: Operations Security Protected Information  Basis for designation: National Security Decision Directive 298, (January 1988).   (new policy in draft)  Definition: The designation is applied to unclassified information concerning CDC mission, functions, operations, or  programs that require protection in the national interest, or security of homeland defense.
Centers for Disease Control and Prevention (continued)
Designation: Sensitive Security Information  Basis for designation: Homeland Security Act of 2002 (Pub. L. No.107-296); Maritime Transportation Security Act of  2002 (Pub. L. No. 107-295), 49 U.S.C. § 114(s); 49 C.F.R. pt.1520 (May 2004); Management Directive (MD) 11056  (December 2005).
Department of Homeland Security (continued)

		Agencywide (Justice Management Division)

Department of Justice (continued)
Systematic review process: No Designation: For Official Use Only  Basis for designation: Intelligence Policy Manual (August 2005)  Definition: The designation is used for information that may be exempt from mandatory release to the public under  the Freedom of Information Act (FOIA), 5 U.S.C. 552.  Designating authority: Any FBI employee or contractor in the course of performing assigned duties may designate  information as FOUO.  Policies or procedures for specialized training for Systematic review process: No designators: No  Designation: Law Enforcement Sensitive  Basis for designation: Intelligence Policy Manual (August 2005)  Definition: The designation is used to protect information compiled for law enforcement purposes. LES is a subset of  FOUO.  Designating authority: Any FBI employee or contractor in the course of performing assigned duties may designate  information as LES.  Policies or procedures for specialized training for Systematic review process: No designators: No  Designation: Limited Official Use   Basis for designation: DOJ Order 2620.7, Control and Protection of Limited Official Use Information (September  1982)
Federal Bureau of Investigation (continued)

	Department of Transportation

	Environmental Protection Agency

Environmental Protection Agency (continued)

		National Homeland Security Research Center

Designation: For Official Use Only   Basis For designation: NHSRC-70-01, Rev.0 (November 2004)  Definition: For Official Use Only (FOUO) is applied by the NHSRC as the sole designator for sensitive but  unclassified (SBU) information. The NHRSC uses the following definition of sensitive but unclassified, taken from the  Computer Security Act of 1987, Public Law 100-235, which defines “sensitive information” as “any information, the  loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the  conduct of federal programs, or the privacy to which individuals are entitled under section 552a of Title 5   (Privacy Act) but which has not been specifically authorized under criteria established by an Executive order or an Act  of Congress to be kept secret in the interest of national defense or foreign policy”.  Designating authority: Any National Homeland Security Research Center employee, contractor, subcontractor, or  grantee may designate information FOUO. However, such designations must be certified by a NHSRC Review  Authority (DRA).  Policies or procedures for specialized training for Systematic review process: Yes designators: Yes  Designation: Critical Energy Infrastructure Information  Basis for designation: FOIA, as amended; 18 C.F.R. §§ 388.112-.113; and Commissioner Order Nos. 630, 630-A,  649, and 662.  Definition: Information about proposed or existing critical infrastructure that  relates to the production, generation, transportation, transmission, or distribution of energy;  could be useful to a person in planning an attack on critical infrastructure;  is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. § 552; and does not simply give the location of the critical infrastructure.
Systematic review process: No Designation: Non-Public Information   Basis for designation: FOIA, as amended; 18 C.F.R. §§ 1b.9, 1b.20-.21(c), 385.410, 606, 388.112; 15 U.S.C. §  717g(b), 16 U.S.C. 825(b)  Definition: Any information that is not routinely provided to the public absent a Freedom of Information Act (FOIA)  request, including information that would not be released under the FOIA. Non-Public Information includes, for  example,  information that is submitted to the Commission with a request for non-public treatment under 18 C.F.R.  § 388.112(a), which applies to information the submitter claims is exempt from mandatory disclosure under  the FOIA.  information concerning dispute resolution communications. See 18 C.F.R. § 385.606.  information covered by a protective order. See 18 C.F.R. § 385.410.  information obtained during the course of an investigation. See18 C.F.R. §§ 1b.9, 1b.20.
Information and documents obtained through the Hotline Staff. See 18 C.F.R. § 1b.21(c).  information obtained during the course of examination of books or other accounts. See 15 U.S.C. § 717g(b);  16 U.S.C. § 825(b).  information exempt from disclosure under the FOIA, such as drafts; staff deliberative documents; attorney  work product and attorney-client communications exempt from disclosure under 5 U.S.C. § 552(b)(5).

	General Services Administration

Designation: Sensitive But Unclassified  Basis for designation: Computer Security Act of 1987; Privacy Act, as amended; and NPR 1600.1 (November 2005)  Definition: Unclassified information or material determined to have special protection requirements to preclude  unauthorized disclosure to avoid compromises, risks to facilities, projects, or programs, threat to the security and/or  safety of the source of information, or to meet access restrictions established by laws, directives, or regulations:  ITAR—International Traffic in Arms Regulations
MCTL—Militarily Critical Technologies List
FOIA—Freedom of Information Act
UCNI—Unclassified Controlled Nuclear Information   Scientific and Technical Information (STI)

	National Science Foundation

Designation: Sensitive But Unclassified  Basis for designation: NSF Privacy Regulations (45 C.F.R. § 613), NSF Freedom of Information Act Regulations (45  C.F.R. § 612), NSF Bulletin 05-14 (September 2005)  Definition: The designation is given to information that is defined as sensitive under the Privacy Act.  Designating authority: Not specified in response.  Policies or procedures for specialized training for Systematic review process: No designators: No  Designation: Safeguards Information  Basis for designation:  Section 147 of Atomic Energy Act of 1954, as amended (42 U.S.C. § 2167); 10 C.F.R. § 73- 21; Directive 12.6 (December 1999)   (policy revision in draft)  Definition: Safeguards Information means information, not otherwise classified as National Security Information or  Restricted Data that specifically identifies a licensee’s or applicant’s detailed  control and accounting procedures or security measures (including security plans, procedures, and  equipment) for the physical protection of special nuclear material, by whomever possessed, whether in transit  or at fixed sites, in quantities determined by the Commission to be significant to the public health and safety or  the common defense and security;  security measures (including security plans, procedures, and equipment) for the physical protection of source  material or byproduct material, by whomever possessed, whether in transit or at fixed sites, in quantities  determined by the Commission to be significant to the public health and safety or the common defense and  security; or  security measures (including security plans, procedures, and equipment) for the physical protection of and the  location of certain plant equipment vital to the safety of production or utilization facilities involving nuclear  materials covered by paragraphs (1) and (2) if the unauthorized disclosure of such information could  reasonably be expected to have a significant adverse effect on the health and safety of the public or the  common defense and security by significantly increasing the likelihood of theft, diversion, or sabotage of such  material or such facility.

	Social Security Administration

	United States Agency for International Development

Appendix III: Comments from the Office of the Director of National Intelligence

Appendix IV: GAO Contact and Staff Acknowledgments

	Staff Acknowledgments

In addition to the individual named above, Susan Quinlan, Assistant  Director, Rochelle Burns, Joanne Fiorino, Thomas Lombardi,   Lori Martinez, Vickie Miller, David Plocher, John Stradling, Morgan Walts,  and Marcia Washington made key contributions to this report.

Summary:
Why GAO Did This Study

A number of initiatives to improve information sharing have been called for, including the Homeland Security Act of 2002 and in the Intelligence Reform and Terrorism Prevention Act of 2004. The 2002 act required the development of policies for sharing classified and sensitive but unclassified homeland security information. The 2004 act called for the development of an Information Sharing Environment for terrorism information. This report examines (1) the status of efforts to establish government-wide information sharing policies and processes and (2) the universe of sensitive but unclassified designations used by the 26 agencies that GAO surveyed and their related policies and procedures.

What GAO Found

More than 4 years after September 11, the nation still lacks governmentwide policies and processes to help agencies integrate the myriad of ongoing efforts, including the agency initiatives we identified, to improve the sharing of terrorism-related information that is critical to protecting our homeland. Responsibility for creating these policies and processes shifted initially from the White House to the Office of Management and Budget (OMB), and then to the Department of Homeland Security, but none has yet completed the task. Subsequently, the Intelligence Reform Act called for creation of an Information Sharing Environment, including governing policies and processes for sharing, and a program manager to oversee its development. In December 2005, the President clarified the roles and responsibilities of the program manager, now under the Director of National Intelligence, as well as the new Information Sharing Council and the other agencies in support of creating an Information Sharing Environment by December 2006. At the time of our review, the program manager was in the early stages of addressing this mandate. He issued an interim implementation report with specified tasks and milestones to Congress in January 2006, but soon after announced his resignation. This latest attempt to establish an overall information-sharing road map under the Director of National Intelligence, if it is to succeed once a new manager is appointed, will require the Director's continued vigilance in monitoring progress toward meeting key milestones, identifying any barriers to achieving them, and recommending any necessary changes to the oversight committees. The agencies that GAO reviewed are using 56 different sensitive but unclassified designations (16 of which belong to one agency) to protect information that they deem critical to their missions--for example, sensitive law or drug enforcement information or controlled nuclear information. For most designations there are no governmentwide policies or procedures that describe the basis on which an agency should assign a given designation and ensure that it will be used consistently from one agency to another. Without such policies, each agency determines what designations and associated policies to apply to the sensitive information it develops or shares. More than half the agencies reported challenges in sharing such information. Finally, most of the agencies GAO reviewed have no policies for determining who and how many employees should have authority to make sensitive but unclassified designations, providing them training on how to make these designations, or performing periodic reviews to determine how well their practices are working. The lack of such recommended internal controls increases the risk that the designations will be misapplied. This could result in either unnecessarily restricting materials that could be shared or inadvertently releasing materials that should be restricted.