GAO 

United States Government Accountability Office

Report to the Speaker of the House of 

Representatives 

MANAGING 

SENSITIVE 

INFORMATION 

Actions Needed to 

Prevent Unintended 

Public Disclosures of 

U.S. Nuclear Sites and 

Activities 

December 2009 

GAO-10-251 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

December 2009

MANAGING SENSITIVE INFORMATION

Actions Needed to Prevent Unintended Public 

Disclosures of U.S. Nuclear Sites and Activities

Highlights of GAO-10-251, a report to the 

Speaker of the House of Representatives 

On May 7, 2009, the Government 

Printing Office (GPO) published a 

266-page document on its Web site 

that provided detailed information 

on civilian nuclear sites, locations, 

facilities, and activities in the 

United States. At the request of the 

Speaker of the House, this report 

determines (1) which U.S. agencies 

were responsible for the public 

release of this information and why 

the disclosure occurred, and (2) 

what impact, if any, the release of 

the information has had on U.S. 

national security. In performing 

this work, GAO analyzed policies, 

procedures, and guidance for 

safeguarding sensitive information 

and met with officials from four 

executive branch agencies involved 

in preparing the document, the 

White House, the House of 

Representatives, and GPO. 

What GAO Recommends

GAO recommends, among other 

things, that Commerce, DOE, State, 

and NRC enter into an interagency 

agreement concerning the 

designation, marking, and handling 

of sensitive information in future 

draft declarations and make any 

policy or regulatory changes 

necessary to reach such an 

agreement. DOE, State, and GPO 

agreed, while NRC neither agreed 

nor disagreed, with the 

recommendations. Commerce, 

White House Counsel, and the 

House Offices of the Clerk, 

Security, and Paliamentarian did 

not comment on GAO’s 

recommendations. 

While no single U.S. government agency or office was entirely responsible for 

the public disclosure of the draft declaration, all of the agencies and offices 

involved in preparing and publishing the draft declaration share some 

responsibility for its release. GAO identified several points during the life cycle 

of the draft document where problems in the process occurred. First, none of 

the agencies that prepared the draft declaration—the Departments of Energy 

(DOE) and Commerce, and the Nuclear Regulatory Commission (NRC)—took 

the added precaution of ensuring that the consolidated draft they helped 

prepare had a U.S. security designation on each page of the document. Rather, 

the final version of the document, which they all reviewed, was marked only 

with the International Atomic Energy Agency’s (IAEA) designation—“Highly 

Confidential Safeguards Sensitive.” This marking has no legal significance in 

the United States. Second, the Department of State, which prepared the draft 

declaration for transmittal to the White House, sent a transmittal letter to the 

National Security Council indicating that the contents of the draft declaration 

should be treated as Sensitive but Unclassified (SBU). Not all federal agencies 

use this particular marking and, therefore, the marking created confusion for 

other executive and legislative branch offices that subsequently received the 

draft declaration on whether the information could be published. Third, the 

National Security Council, which reviewed the draft declaration on behalf of the 

White House, did not provide explicit and clear instructions on how to handle 

the draft declaration to the White House Clerk’s Office. Fourth, the legislative 

branch offices which reviewed and then transmitted the document to GPO for 

publication—the House of Representatives’ Parliamentarian and Clerk’s 

Office—determined incorrectly, in GAO’s view, that the document could be 

published. Officials from these congressional offices were not familiar with the 

phrase “Sensitive but Unclassified” and did not know how to safeguard that 

information. Finally, GPO, which proofread and processed the document for 

publication, did not raise any concerns about the document’s sensitivity. GAO 

believes it is important to correct these problems as soon as possible because 

the United States is required to submit a declaration to IAEA annually. 

The public release of the draft declaration of civilian nuclear sites and nuclear 

facilities does not appear to have damaged national security, according to 

officials from DOE, NRC, and Commerce. Commerce, DOE, and NRC did not 

assess the national security implications of the draft declaration’s public 

release because these agencies—plus the Department of Defense—had 

reviewed the list of civilian nuclear facilities and related activities prior to 

transmitting it to the White House and Congress to ensure that information of 

direct national security significance was not included. Information in the 

draft declaration was limited to civilian nuclear activities, and most nuclearrelated information was publicly available on agency Web sites or other 

publicly available documents. However, according to officials from all of the 

agencies responsible for compiling this information, the information 

consolidated in one document made it sensitive and, thus, it should never 

have been posted to GPO’s Web site. 

View GAO-10-251 or key components.

For more information, contact Gene Aloise at 

(202) 512-3841 or aloisee@gao.gov. 
Page i GAO-10-251 

Contents 

Letter 1

Background 4 

Each of the Federal Agencies and Offices Involved in Preparing 

and Publishing the Draft Declaration Shares Some 

Responsibility for Its Release to the Public 7 

Public Release of Draft Declaration Does Not Appear to Have 

Harmed National Security, According to DOE, NRC, and 

Commerce Officials 20 

Conclusions 23 

Recommendations for Executive Action 24 

Agency Comments and Our Evaluation 25 

Appendix I Comments from the Department of Energy 29 

Appendix II Comments from the Department of State 30 

Appendix III Comments from the Government Printing Office 32 

Appendix IV Comments from the Nuclear Regulatory Commission 34 

Appendix V Comments from the House of Representatives’ 

Sergeant at Arms 36 

Appendix VI GAO Contact and Staff Acknowledgments 43 

Figures 

Figure 1: Key Dates in the U.S. Implementation of the Additional 

Protocol 5 

 Managing Sensitive Information
Figure 2: Chronology of Key Events and Involvement of U.S. 

Government Agencies and Offices That Contributed to the 

Inadvertent Public Release of the Draft Declaration 8 

Abbreviations 

APRS U.S. Additional Protocol Reporting System 

CUI Controlled Unclassified Information 

DOE Department of Energy 

FOIA Freedom of Information Act 

GPO Government Printing Office 

IAEA International Atomic Energy Agency 

NPT Treaty on the Non-Proliferation of Nuclear Weapons 

NRC Nuclear Regulatory Commission 

OUO Official Use Only 

SBU Sensitive but Unclassified 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-10-251 Managing Sensitive Information
Page 1 GAO-10-251 

 

United States Government Accountability Office

Washington, DC 20548 

 

December 15, 2009 

The Honorable Nancy Pelosi 

Speaker of the House 

House of Representatives 

Dear Madam Speaker: 

On May 7, 2009, the Government Printing Office (GPO) published a 266-

page document on its Web site that provided detailed information on 

civilian nuclear sites, locations, facilities, and activities in the United 

States.1 The document described, among other things, nuclear activities at 

Department of Energy (DOE) facilities such as Los Alamos, Lawrence 

Livermore, and Oak Ridge National Laboratories.2

 The document also 

included 14 diagrams of buildings or facilities, 2 of which were marked 

Official Use Only (OUO). For example, the document provided the 

building and vault numbers where highly enriched uranium is stored at the 

Y-12 nuclear production facility near Oak Ridge National Laboratory, as 

well as a diagram showing the layout of the part of the building where the 

material is stored.3

 According to DOE officials, this information was 

sensitive because it identified the specific building and vault number, but 

no classified information was revealed because the diagram does not show 

a map of the entire Y-12 facility and information about the storage area at 

Y-12 was already publicly available. 

1

GPO is a legislative branch agency and the federal government’s primary centralized 

resource for gathering, cataloging, producing, providing, and preserving published 

information in all its forms. GPO was directed to publish a presidential message along with 

the document. The message explained that the document would be provided to the 

International Atomic Energy Agency (IAEA) and that the IAEA classification of the 

document was “Highly Confidential Safeguards Sensitive,” but the United States regarded 

the information as “Sensitive but Unclassified” (SBU). 

2

DOE manages the largest laboratory system of its kind in the world. Originally created to 

design and build atomic bombs under the Manhattan Project, these laboratories have since 

expanded to conduct research in many disciplines—from high-energy physics to advanced 

computing facilities throughout the nation. 

3

The Y-12 complex was constructed as part of the World War II Manhattan Project. Y-12’s 

mission includes, among other things, the production/rework of nuclear weapons 

components and the receipt, storage, and protection of special nuclear materials. 

 Managing Sensitive Information
 

The document was a draft of a declaration being prepared pursuant to an 

agreement known as the Additional Protocol with IAEA.4

 The declaration 

supplements information provided pursuant to the U.S. Safeguards 

Agreement with IAEA by providing IAEA with a broader range of 

information on U.S. nuclear and nuclear-related activities. Safeguards 

allow IAEA to independently verify that quantities of nuclear material 

declared to the agency have not been diverted for nuclear weapons uses. 

The Additional Protocol allows IAEA to, among other things, access 

locations containing nuclear material declared by a country. Within the 

United States, the Additional Protocol allows IAEA to access a selected 

number of facilities and locations containing nuclear material. 

This was the first time the United States had prepared and submitted a 

declaration to IAEA, and the United States will now be required to submit 

a declaration to IAEA every year.5

 Sixty days before sending the 

declaration to IAEA, the President is required to send the draft declaration 

to Congress. Congress had received the first draft declaration on May 5, 

2009. On June 1, 2009, the Federation of American Scientists, a nonprofit 

group that reports on scientific and technological security issues, 

discovered the draft declaration on GPO’s Web site and posted it on the 

Federation’s Web site. On June 2, 2009, multiple media outlets began 

reporting that the U.S. government had “accidentally” and “mistakenly” 

posted a list of nuclear sites and a description of their nuclear activities on 

GPO’s Web site. For example, The New York Times reported that a 

security official found the disclosure of the draft declaration “a one-stop 

shop for information on U.S. nuclear programs.” In response to media 

inquiries, GPO temporarily removed the document from its Web site, and 

after consulting with the Clerk of the House of Representatives, 

permanently did so. 

 

4

IAEA, an autonomous international organization affiliated with the United Nations, was 

established in Vienna, Austria, in 1957. The agency has the dual role of promoting the 

peaceful uses of nuclear energy by transferring nuclear science and technology through its 

nuclear science and applications and technical cooperation programs, and verifying, 

through its safeguards program, that nuclear materials subject to safeguards are not 

diverted to nuclear weapons or other proscribed purposes. As of October 2009, 24 nonnuclear weapon states that were parties to the Treaty on the Non-Proliferation of Nuclear 

Weapons (NPT) did not have comprehensive safeguards agreements with IAEA in force. In 

addition, India, Israel, and Pakistan are not parties to the NPT. As a result, they also do not 

have comprehensive safeguards agreements with IAEA. 

5

Beginning in 2010, the United States is required to submit a declaration annually to IAEA 

by May 15. 

Page 2 GAO-10-251 Managing Sensitive Information
 

In addition to posting the draft report on its Web site, GPO printed over 

900 copies of the document and shipped about 240 copies to Congress and 

some federal agencies. GPO recalled these copies and, as of December 2, 

2009, around 670 copies were secured in a safe in its security office. 

However, it is possible that copies were downloaded from various Web 

sites. The location of any such downloaded copies is unknown and cannot 

be accounted for. As of October 2009, copies of the document could still 

be found on a number of Web sites. We brought this matter to the 

attention of State officials and provided them with internet addresses for 

two such sites in late October 2009. A State official subsequently informed 

us that the department was able to get at least one Web site to remove the 

information. 

The disclosure of sensitive information on U.S. nuclear facilities and 

activities raises concerns about procedures to properly handle and 

safeguard such sensitive information. In this context, you asked us to 

determine (1) which U.S. agencies were responsible for the public release 

of this information and why the disclosure occurred, and (2) what impact, 

if any, the release of the information has had on U.S. national security. 

To determine which U.S. agencies were responsible for the disclosure and 

why the disclosure occurred, we analyzed the policies, procedures, and 

guidance for safeguarding sensitive information from the departments of 

Energy and State; the Nuclear Regulatory Commission (NRC); the House 

of Representatives Clerk’s Office; and GPO. We also reviewed transmittal 

sheets prepared by DOE, State, the House of Representatives’ Clerk’s 

Office, and GPO to determine how the document was marked for security 

purposes as it was distributed and prepared for publication. In addition, to 

determine how each of these agencies and offices safeguarded and 

transmitted the document, we interviewed officials from DOE; Commerce; 

State; NRC; GPO (including the Inspector General’s office); and the Clerk’s 

Office, Security Office, and the Office of the Parliamentarian in the House 

of Representatives. In addition, we asked to meet with the officials from 

the White House National Security Council and Executive Clerk’s Office 

who had handled and transmitted the draft declaration to Congress so that 

we could obtain information directly from the individuals responsible for 

reviewing and handling the document. The White House declined to make 

these individuals available to us; instead, attorneys from the White House 

Counsel’s office met with those individuals and then conveyed information 

to us. To determine what impact the release of the information has had on 

U.S. national security interests, we reviewed the draft declaration to 

identify potentially sensitive nuclear sites and activities and then 

interviewed officials from DOE, Commerce, State, and NRC to determine 

Page 3 GAO-10-251 Managing Sensitive Information
 

whether any information of direct national security significance was 

compromised and whether these departments took any actions to enhance 

security at the declared sites, locations, and facilities. 

We conducted our work between June 2009 and November 2009 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 

Under its Safeguards Agreement with IAEA, the United States submitted a 

list of civilian nuclear facilities—primarily civilian nuclear power reactors. 

The Additional Protocol,6

 a separate agreement between the United States 

and IAEA, supplements the United States’ Safeguards Agreement with 

IAEA.7

 Under the Additional Protocol, the United States must provide 

IAEA with a broader range of civilian nuclear and nuclear-related 

information than that required under the Safeguards Agreement, such as 

the manufacturing of key nuclear-related equipment; research and 

development activities related to the nuclear fuel cycle; the use and 

contents of buildings on a nuclear site; and exports of IAEA-specified, 

sensitive nuclear-related equipment. The United States must also provide 

IAEA with access, through on-site inspections, to resolve questions 

relating to the accuracy and completeness of the information. As a nuclear 

weapon state party to the Treaty on the Non-Proliferation of Nuclear 

Weapons, the United States is not obligated by the Treaty to accept IAEA 

safeguards or to implement an Additional Protocol. However, according to 

U.S. officials, voluntarily adopting the Additional Protocol underscores 

U.S support for IAEA’s strengthened safeguards system and makes efforts 

to encourage more countries to adopt the Additional Protocol more 

effective and credible. 

Background 

 

6

The agreement is formally known as The Protocol Additional to the Agreement between 

the United States of America and the International Atomic Energy Agency for the 

Application of Safeguards in the United States of America. As of October 2009, 93 

countries, including the United States, have an Additional Protocol which has entered into 

force and another 33 have signed the agreement. 

7

GAO, Nuclear Nonproliferation: IAEA Has Strengthened Its Safeguards and Nuclear 

Security Programs, but Weaknesses Need to be Addressed, GAO-06-93 (Washington, D.C.: 

Oct. 7, 2005). 

Page 4 GAO-10-251 Managing Sensitive Information
 

Page 5 GAO-10-251 Managing Sensitive Information 

In its act implementing the Additional Protocol, Congress prohibited the 

inclusion of certain information: any classified information; any 

information that would be deemed restricted data under the Atomic 

Energy Act; and any information of direct national security significance 

regarding any location, site, or facility associated with activities of the 

Department of Defense or DOE. The act also provided that information 

collected for the purposes of the Additional Protocol would be exempt 

from disclosure under 5 U.S.C. § 552, which is the Freedom of Information 

Act. Figure 1 shows a timeline of the U.S. implementation of the Additional 

Protocol. 

Figure 1: Key Dates in the U.S. Implementation of the Additional Protocol 

Source: GAO.

1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009

June 12, 1998:

The United States 

signed the 

Additional Protocol.

March 31, 2004:

The Senate 

provided its advice 

and consent for 

ratification.

December 16, 2006:

Congress passed the U.S. Additional Protocol 

Implementation Act, which required the President to 

submit the draft declaration to Congress 60 days 

prior to submitting the declaration to IAEA.

February 4, 2008:

President Bush signed an 

Executive Order to implement the 

Additional Protocol and authorized 

Commerce, DOE, State, and NRC 

to collect information about nuclear 

sites and facilities that would be 

provided to IAEA.

May 3, 2009:

The draft 

declaration was 

submitted to 

Congress for a 

60-day review.

July 3, 2009:

The United States 

sent IAEA the final 

declaration.

May 9, 2002:

The President sent the 

Additional Protocol to 

the Senate for its advice 

and consent for 

ratification.
 

The U.S. government classifies information that it determines could 

damage the national security of the United States if disclosed publicly.8

Beginning in 1940, classified national defense and foreign relations 

information has been created, handled, and safeguarded in accordance 

with a series of executive orders. Executive Order 12958, Classified 

National Security Information, as amended, is the most recent. It 

demarcates different security classification levels, the unauthorized 

disclosure of which could reasonably be expected to cause exceptionally 

grave damage (Top Secret), serious damage (Secret), or damage 

(Confidential). 

Federal agencies also place dissemination restrictions on certain 

unclassified information. Federal agencies use many different designations 

to identify this type of information. For example, DOE uses the designation 

OUO, while State uses SBU. According to a May 2009 presidential 

memorandum, there are more than 107 unique markings and over 130 

different labeling or handling processes and procedures for documents that 

are unclassified, but are considered sensitive. For example, according to 

DOE officials, although OUO information is less sensitive than classified 

information, OUO information may be shared with people lacking security 

clearances provided that officials determine they have a “need to know.” 

These restrictions are used to indicate that the information, if disseminated 

to the public or persons who do not need such information to perform their 

jobs, may cause foreseeable harm to protected governmental, commercial, 

or privacy interests. Such information includes, for example, sensitive 

personnel information, such as Social Security numbers and the floor plans 

for some federal buildings. It may also include information exempted from 

disclosure under the Freedom of Information Act. 

 

8

In Executive Order 12958, as amended, “national security” means the national defense or 

foreign relations of the United States. 

Page 6 GAO-10-251 Managing Sensitive Information
 

While no single U.S. government agency or office was entirely responsible 

for the public disclosure of the draft declaration, all of the agencies and 

offices involved in preparing and publishing the draft declaration share 

some responsibility for its public release. We identified several points 

during the life cycle of the draft document where problems occurred. 

Specifically, we found that opportunities to improve the secure handling of 

the document were missed because of the absence of clear interagency 

guidance, different procedures across the agencies governing the handling 

and marking of sensitive documents, poor decision making, and a lack of 

training and adequate security awareness. These missed opportunities 

occurred between February 2008 and May 2009. Several U.S. government 

agencies played key roles in preparing and making important decisions 

regarding the publication of the draft declaration: DOE, Commerce, State, 

NRC, the White House (the National Security Council and Executive 

Clerk’s Office), the U.S. House of Representatives (Office of the 

Parliamentarian, Office of Security, and the Clerk’s Office), and GPO. 

Figure 2 is a two-page summary of key dates and events that occurred 

during the life cycle of the draft declaration, leading up to its inadvertent 

public release on May 7, 2009. 

Each of the Federal 

Agencies and Offices 

Involved in Preparing 

and Publishing the 

Draft Declaration 

Shares Some 

Responsibility for Its 

Release to the Public 

Page 7 GAO-10-251 Managing Sensitive Information
 

Figure 2: Chronology of Key Events and Involvement of U.S. Government Agencies and Offices That Contributed to the 

Inadvertent Public Release of the Draft Declaration 

Security markings of draft declaration and accompanying documents

OUO OUO

List of nuclear

sites and

activities

April 17, 2009

Transmittal

letter to State

SBU

April 30, 2009

Transmittal 

letter to

National

Security

Council

SBU

One-page

presidential

message

d

s OUO al

tate OUO

Source: GAO.

Highly Confidential

Safeguards Sensitive

Draft declarationa

Highly Confidential

Safeguards Sensitive

Draft declarationa

Highly Confidential

Safeguards Sensitive

Draft declarationa

Agencies responsible for preparing the draft declaration

Department of Energy Department of Commerce Department of State White House

Nuclear Regulatory Commission

OUO

DOE and NRC provided 

nuclear-related information 

to Commerce on January 

15, 2009, and March 18, 

2009, respectively. DOE 

and NRC marked their 

contributions as OUO.

OUO

Commerce consolidated 

all nuclear-related 

information into a draft 

declaration. Transmittal 

letter and compact disc 

from Commerce to State 

identified information in 

draft declaration as OUO.

SBU 

State prepared a transmittal 

letter for the White House’s

National Security Council 

identifying the information in 

the draft declaration as

“Sensitive but Unclassified.”

The National Security 

Council did not provide 

explicit and clear 

instructions to the White 

House Clerk’s Office on 

how to handle information 

in the draft declaration.

SBU 

State drafted a

one-page presidential 

message with language 

in the body that 

explained the contents of the 

draft declaration were 

considered “Highly 

Confidential Safeguards

Sensitive,” but the U.S. would 

regard the information as

“Sensitive but Unclassified.”

National Security Council

Agencies and offices responsible for reviewing and transmitting the draft 

declaration

Page 8 GAO-10-251 Managing Sensitive Information
 

Source: GAO.

Security markings of draft declaration and accompanying documents

SBU

One-page

presidential

message

SBU

One-page

presidential

message

SBU

One-page

presidential

message

SBU

One-page

presidential

message

White House House of Representatives

The Clerk’s Office did not 

provide explicit and clear 

instructions to the House of 

Representatives on how to 

handle information in the 

draft declaration. On May 5, 

2009, the Clerk’s Office sent 

the one-page presidential 

message and draft 

declaration to Congress.

The Parliamentarian read 

the one-page presidential 

message and believed the 

draft declaration could be 

published because it was

unclassified. He sent the 

documents to the Clerk’s

Office to process them for 

publication by GPO.

The Clerk’s Office read 

the documents and 

ordered GPO to print 

them.

May 7, 2009

Draft declaration posted on 

GPO’s Web site.

Clerk’s Office Clerk’s Office

Agency responsible for publishing

draft declaration on its Web site

Government Printing

Office 

Parliamentarian

Executive Communications

Clerk asks the Director of 

the Office of Security, the 

Journal Clerk in Legislative 

Operations Office, the 

White House Clerk’s Office 

and the IAEA whether the 

draft declaration can be 

printed. Based on their 

advice, she decides the 

document can be printed.

May 6, 2009

Transmittal 

letter to GPO

Highly Confidential

Safeguards Sensitive

Draft declarationa

Highly Confidential

Safeguards Sensitive

Draft declarationa

Highly Confidential

Safeguards Sensitive

Draft declarationa

Highly Confidential

Safeguards Sensitive

Draft declarationa

a

The only marking on the draft declaration was IAEA’s designation on the top of the document—

“Highly Confidential Safeguards Sensitive”—which has no legal significance in the United States. 

Page 9 GAO-10-251 Managing Sensitive Information
 

After the President signed an executive order in February 2008 to 

implement the Additional Protocol, DOE, Commerce, and NRC began 

collecting information on nuclear sites, facilities, and activities to be 

included in the draft declaration. DOE collected information from national 

laboratories and nuclear weapons production facilities. NRC, which 

regulates the civilian use of nuclear materials, collected information from 

NRC-licensed nuclear facilities, including four civilian nuclear power 

plants previously selected by IAEA for the application of safeguards.9

 DOE 

and NRC provided nuclear-related information to Commerce on January 

15, 2009, and March 18, 2009, respectively. Commerce collected 

information from private nuclear-related industries not regulated by DOE 

or NRC, such as the location, operational status, and production capacity 

of conventional uranium mines. Commerce then consolidated all nuclearrelated information from its offices, as well as from DOE and NRC, into a 

draft U.S. declaration for final interagency approval and transmittal to 

State. The process for collecting and consolidating this information from 

the three agencies took several months. 

DOE, NRC, and Commerce 

Began Collecting 

Information on Civilian 

Nuclear Sites to Be 

Included in the Draft 

Declaration in Early 2008 

Commerce, in consolidating and formatting the information in the draft 

declaration, did not mark the document with an official U.S. government 

security marking. The only marking on the draft declaration was IAEA’s 

designation on the top of the document—“Highly Confidential Safeguards 

Sensitive”—which has no legal significance in the United States. To 

consolidate and properly format the information, Commerce established 

and managed a central database, known as the U.S. Additional Protocol 

Reporting System (APRS). IAEA provided a software program for this 

database that standardizes the information sent to IAEA by each member 

state and helps IAEA assess the completeness of the information. Before 

transmitting data to Commerce or adding data to the APRS, each agency 

reviewed the information it collected for accuracy, data consistency, and 

national security concerns. Each agency also reviewed the information to 

ensure that no classified information was being disclosed. The agencies 

had agreed that the information in the U.S. declaration would not be 

classified, as required by the U.S. Additional Protocol Implementation Act; 

 

9

The United States, along with four other nuclear weapons states that are parties to the 

NPT (China, France, the Russian Federation, and the United Kingdom) are not obligated by 

the NPT to accept IAEA safeguards. However, each nuclear weapons state, including the 

United States, has voluntarily entered into legally binding safeguards agreements with 

IAEA, and have submitted designated nuclear materials and facilities to IAEA safeguards to 

demonstrate to the non-nuclear weapons states their willingness to share in the 

administrative and commercial costs of safeguards. 

Page 10 GAO-10-251 Managing Sensitive Information
 

that an unclassified database could be used to process the information; 

and that the data were sensitive and would be restricted to authorized 

personnel only. 

When Commerce and NRC added information to APRS, IAEA-supplied 

software automatically marked the top of each page of the draft 

declaration as “Highly Confidential Safeguards Sensitive.” IAEA uses this 

designation to ensure the document’s appropriate handling and control. 

According to IAEA officials, Highly Confidential Safeguards Sensitive 

information is the agency’s highest classification level. This type of 

information, if released, could cause grave damage to IAEA interests. 

When IAEA receives a document from a country with this classification, it 

cannot publicly disclose the information in the document because, in some 

instances, its release could disclose confidential business information, 

create potential security issues, or identify reporting discrepancies 

between countries. Distribution of this information is limited and released 

on a need-to-know basis. Since this IAEA marking has no legal significance 

in the United States, DOE, Commerce, and NRC treated the information as 

OUO. These agencies use OUO markings to provide a warning that 

information in a document is sensitive and is generally only to be released 

to those with a need to know, regardless of their security clearance. 

DOE, NRC, and Commerce took steps to safeguard the information that 

each contributed to the draft declaration. Specifically, before DOE and 

NRC submitted data to Commerce in January and March 2009, 

respectively: 

• DOE marked the top and bottom of each page it submitted to Commerce 

with nuclear information from the national laboratories and production 

facilities as OUO and added a statement that the information may be 

exempt from public release under the Freedom of Information Act. 

• NRC officials hand carried a compact disc containing its nuclear-related 

information to Commerce, rather than electronically sending the 

information. 

Commerce officials also safeguarded the information by password 

protecting APRS and sending State the draft declaration through secure email that included a transmittal letter explaining that the contents were 

considered OUO. In addition, they hand carried a compact disc to State 

that was marked with “For Official Use Only/Not For Public Release/IAEA 

Highly Confidential Safeguards Protected” hand written on the disc. 

Page 11 GAO-10-251 Managing Sensitive Information
 

Although each agency designated the information it contributed as OUO, 

the document—which was produced from each agency’s contributions—

did not have any U.S. government security markings. The agencies 

reviewed the draft declaration multiple times, but no agency marked the 

pages containing information it had contributed to the full draft 

declaration as OUO. Once all the information was consolidated, the 266-

page document was not marked OUO or any other security designation 

recognized in the United States that would have clearly indicated that the 

data were sensitive, restricted to authorized personnel only, and not 

releasable to the public. The only OUO markings were next to site 

diagrams of two DOE facilities found on two different pages of the draft 

declaration. 

According to Commerce officials, while the IAEA software template 

automatically adds the IAEA designation, it does not add a U.S. security 

designation to the top and bottom of each page and does not allow 

Commerce to modify the IAEA designation or add U.S. security markings. 

They stated that the only way to mark the draft document as OUO would 

have been to print out each page, stamp the U.S. designation by hand, and 

then scan the document back in as a new electronic file. Furthermore, 

according to DOE officials, the agencies wanted to submit a draft 

declaration to Congress that was identical to the final declaration 

submitted to IAEA. Providing Congress with a draft declaration that had 

both the IAEA and U.S. security markings would not have been an exact 

representation of the declaration sent to IAEA. However, there were no 

requirements in the U.S. Additional Protocol Implementation Act binding 

U.S. agencies to submit a declaration free of any additional U.S. security 

markings. 

Even after Commerce circulated the draft declaration to DOE, NRC, and 

the Department of Defense for a final interagency review in late March 

2009 to ensure no information of national security significance was 

included in the draft before submission to State, agency officials did not 

raise any concerns about the draft declaration’s lack of a U.S. security 

designation. According to DOE, Commerce, and NRC officials, they 

assumed that the draft declaration would never be publicly released and 

that, once delivered to IAEA, it would be properly safeguarded. As a result, 

they saw no need to add an additional U.S. government security marking. 

Page 12 GAO-10-251 Managing Sensitive Information
 

Commerce sent the consolidated draft declaration to State on April 17, 

2009. State prepared the draft declaration for transmittal to the White 

House. In completing the draft declaration for transmittal, State prepared a 

letter to the National Security Council asking it to treat the contents of the 

draft declaration as SBU. Unlike DOE, Commerce, and NRC, State does 

not use the OUO designation, but rather the SBU designation. State’s 

guidance governing the use and handling of SBU documents is similar to 

that of the other agencies for handling OUO.10 State also prepared a draft 

message from the President to Congress that would accompany the draft 

declaration. In describing the purpose and contents of the document and 

the classification level of the information, State wrote in the draft 

presidential message, “the IAEA classification of the enclosed declaration 

is ‘Highly Confidential Safeguards Sensitive’; however, the United States 

regards this information as ‘Sensitive but Unclassified’.” The two-page 

transmittal letter described the contents of the draft declaration and the 

top and bottom was clearly marked SBU, accompanied by a footnote 

explaining that the draft declaration was exempt from disclosure under 

the Freedom of Information Act. 

In Mid-April 2009, 

Commerce Sent the Draft 

Declaration to State for 

Transmittal to the White 

House 

State completed its review of the draft declaration and accompanying 

transmittal documentation in mid-April 2009 and sent the “package” to the 

Executive Secretary of the National Security Council on April 30, 2009. 

The White House’s 

National Security Council 

and Executive Clerk’s 

Office Did Not Provide 

Explicit and Clear 

Instructions on How to 

Safeguard the Draft 

Declaration When It Sent 

the Document to Congress 

In early May 2009, the National Security Council completed its review of 

the draft declaration and presidential message and provided the 

documents to the Executive Clerk of the White House for transmission to 

Congress. The National Security Council, which reviewed these 

documents on behalf of the White House, did not add explicit and clear 

instructions in the presidential message on how to handle the draft 

declaration, such as whether or not it should be published, when it sent 

the documents to the White House Clerk’s Office, which transmitted the 

documents to Congress. The National Security Council also did not 

include a transmittal letter, as other executive branch agencies had, with 

instructions on how to handle the draft declaration. Attorneys from the 

Office of the White House Counsel provided two reasons why the National 

Security Council did not feel it was necessary to take these additional 

 

10State guidance for classified and sensitive information defines SBU as information that is 

not classified for national security reasons, but that warrants/requires administrative 

control and protection from public or other unauthorized disclosure for other reasons. 

Page 13 GAO-10-251 Managing Sensitive Information
 

measures to protect the document from disclosure. First, counsel stated 

that they did not think Congress would publish the report and the National 

Security Council and the Executive Clerk’s Office followed their standard 

practice for transmitting unclassified documents, which does not involve 

using a transmittal letter or modifying text in the presidential message.11

However, attorneys from the Office of the White House Counsel did not 

provide us with any written guidance on how these offices usually handle 

documents that are unclassified, but are considered sensitive, such as 

those marked SBU, and should not be publicly released. In addition, 

attorneys from the Office of the White House Counsel told us that the 

Executive Clerk’s Office does not have written guidance on how it 

transmits documents to Congress. Second, counsel pointed out that the 

draft declaration was an unusual and unique document because it was the 

first time that the United States had prepared a draft declaration and 

submitted it to Congress. 

After reviewing the draft declaration and presidential message it received 

from State, the National Security Council sent the White House Clerk’s 

Office a final draft of the presidential message and the 266-page draft 

declaration. The last two paragraphs of the presidential message stated: 

“The IAEA classification of the enclosed declaration is ‘Highly Confidential Safeguards 

Sensitive;’ however, the United States regards this information as ‘Sensitive but 

Unclassified.’ Nonetheless, under Public Law 109-401, information reported to, or 

otherwise acquired by, the United States Government under this title or under the U.S.-

IAEA Additional Protocol shall be exempt from disclosure under section 552 of title 5, 

United States Code.” 

The language in the presidential message prepared by State and used by 

the National Security Council did not clearly and explicitly state that the 

 

11As evidenced by a May 2009 memorandum on Classified Information and Controlled 

Unclassified Information, the President is generally committed to broad implementation of 

a framework for the standardization of treatment and the facilitation of information sharing 

that is not classified, but may still merit protection from public disclosure. 

Page 14 GAO-10-251 Managing Sensitive Information
 

information was not to be published, and the additional legal citations did 

not clarify how to handle the document.12

According to attorneys from the Office of the White House Counsel, the 

White House clerks who transmitted the document to Congress read the 

presidential message and noticed its reference to the draft declaration as 

SBU. However, while the White House clerks have security clearances and 

have received training on how to handle unclassified, sensitive, and 

classified documents, they do not normally see SBU documents and did 

not have the authority or responsibility to determine whether Congress 

could print the document. Attorneys from the Office of the White House 

Counsel told us the draft declaration was an unusual and unique document 

because of the IAEA classification markings and the reference to the 

information as SBU. 

The White House clerks transmit only unclassified documents. The 

National Security Council does not transmit documents that cannot be 

printed, such as classified documents, to the White House clerks. Instead, 

the National Security Council transmits those documents directly to 

congressional committee staff with the appropriate clearances. Because 

the clerks received the draft declaration from the National Security 

Council, the clerks transmitted the presidential message and the draft 

declaration to Congress just as they had received it from the National 

Security Council—without a transmittal sheet or SBU markings on the top 

or bottom of any page. 

 

12Public Law 109-401 refers to the United States Additional Protocol Implementation Act, 

and section 552 of Title 5 refers to the Freedom of Information Act (FOIA). The United 

States Additional Protocol Implementation Act exempted the information collected for the 

declaration from disclosure under FOIA. However, FOIA was only marginally relevant to 

Congress’ handling of the document because FOIA only applies to agencies responding to 

requests for specific pieces of information and Congress is not an agency, nor was there a 

request for this information. Exemption under FOIA may be one criterion that an agency 

uses in its own determination as to whether to treat a document as OUO or SBU, but the 

agencies had already decided to treat the draft declaration as OUO/SBU and, ultimately, it 

was the draft declaration’s OUO/SBU status that should have governed whether or not it 

was to be published, not its exemption under FOIA. 

Page 15 GAO-10-251 Managing Sensitive Information
 

Congressional Offices That 

Reviewed and Transmitted 

the Draft Declaration 

Determined Incorrectly 

That the Document Could 

be Published 

Congressional offices that reviewed and then transmitted the draft 

declaration to GPO for publication—the House of Representatives’ Office 

of the Parliamentarian and Clerk’s Office—determined, incorrectly in our 

view, that the document could be published. The draft declaration passed 

through several congressional offices. First, on May 5, 2009, the Executive 

Clerk of the White House formally delivered the presidential message and 

draft declaration while the House was in session. The Parliamentarian 

read the presidential message and decided the message should be referred 

to the House Committee on Foreign Affairs and ordered it printed as a 

House of Representatives document. The Parliamentarian told us that 

while he received security training on classification issues, he did not 

recall ever seeing a presidential message that just mentioned the SBU 

designation and did not know how that type of information should be 

safeguarded. The Parliamentarian believed that the draft declaration could 

be published because it was unclassified. According to the 

Parliamentarian, sensitive and classified messages and documents are 

usually not delivered to the floor of the House, but rather are transmitted 

by secure courier and referred directly to the appropriate committee for 

handling and storage. In addition, while the Parliamentarian read the 

presidential message—the one-page message from the President to 

Congress that described the purpose and contents of the draft 

declaration—he did not read the draft declaration, which listed U.S. 

civilian nuclear sites and activities. Staff in the Office of the 

Parliamentarian do not routinely read enclosures accompanying a 

presidential message, according to the House Parliamentarian. 

Second, the Office of the Parliamentarian gave the document to the House 

of Representatives’ Clerk’s Office to process it for referral to the House 

Committee on Foreign Affairs and prepare it for transmission to and 

publication by GPO. After reading the President’s message and seeing the 

IAEA markings on the draft declaration, the Executive Communications 

Clerk, who works in the Clerk’s Office, told us she was confused about the 

classification level of the document and whether it could be published. As 

a result, the Clerk locked the document in a safe while she sought 

clarification and guidance from the following sources before sending the 

draft declaration to GPO for publication: 

• The Journal Clerk in the House of Representatives’ Legislative 

Operations Office. On May 5, 2009, this clerk had received the documents 

from the Office of the Parliamentarian and stamped the documents 

acknowledging receipt from the White House before providing the 

documents to the Executive Communications Clerk. According to the 

Page 16 GAO-10-251 Managing Sensitive Information
 

Executive Communications Clerk, the Journal Clerk told her she could 

print the document because it was unclassified. 

• The House of Representatives’ Security Office. The Security Office 

Director reviewed the document on May 5, 2009, but did not take custody 

of it or make inquiries on its proper handling and safeguarding. Instead, 

the Security Office Director told the Executive Communications Clerk to 

obtain clarification from IAEA—incorrectly assuming that IAEA was the 

classifier of the document—and the White House Clerk’s Office. The 

Security Office stated that it was not required to take custody of the 

document and the Executive Communications Clerk did not request that 

the Security Office store the document or help her in contacting the 

agencies and offices that transmitted the document. However, the 

Security Office did not raise concerns with the House Clerk’s Office about 

publicly releasing 266 pages of information on U.S. nuclear sites and 

activities and, in our view, missed an opportunity to be more directly 

involved in ensuring that the document was not publicly released without 

explicit authorization from the agencies that designated the information as 

SBU. 

• An IAEA official located in New York. According to the Executive 

Communications Clerk, this official told her on May 5, 2009, that IAEA 

member states have discretion on how to treat information provided to 

IAEA and publication of the declaration is a decision left to each member 

state. In July 2009, we interviewed IAEA officials in the Department of 

Safeguards in Vienna, Austria. This department is responsible for 

reviewing all Additional Protocol agreements between the agency and 

member states. These officials told us that the Executive Communications 

Clerk received correct information from IAEA’s New York office, but the 

appropriate inquiry should have been directed to their office in Vienna. 

• The White House Clerk’s Office. The White House Clerk’s Office and the 

Executive Communications Clerk disagreed in their recollections of the 

advice the White House clerk provided to the House of Representatives. 

According to attorneys from the Office of the White House Counsel, the 

White House Clerk’s office told the Executive Communications Clerk that 

the document was unclassified but did not make a legal judgment or 

provide any advice on whether the document should be printed. However, 

according to the Executive Communications Clerk, the White House 

Clerk’s office referred her to the penultimate paragraph in the presidential 

message stating that the United States regards the information as SBU as 

justification for printing the document. According to the Executive 

Communications Clerk, the White House Clerk’s justification for going 

forward with the printing was that the document was unclassified. 

Page 17 GAO-10-251 Managing Sensitive Information
 

On the basis of advice from these various offices, on May 6, 2009, the 

Executive Communications Clerk ordered GPO to print the presidential 

message and the draft declaration. 

GPO Did Not Raise 

Concerns about Publishing 

the Draft Declaration 

GPO, which edited and processed the document for publication, did not 

raise any concerns about the document’s sensitivity. On May 6, 2009, GPO 

received a request from the House of Representatives’ Executive 

Communications Clerk to print the presidential message and draft 

declaration by 7:00 a.m. on May 7, 2009. The transmittal page from the 

Clerk did not include any special handling instructions and ordered the 

documents to be printed. The presidential message, which contained the 

language that the contents of the draft declaration should be treated as 

SBU, was typeset and proofread twice by GPO production employees. 

According to an August 2009 GPO Inspector General’s report, GPO 

production employees are not required to read and proof for meaning, but 

merely to check for proper characters and format.13 The 266-page draft 

declaration was digitally scanned, rather than typed and proofread. While 

“Highly Confidential Safeguards Sensitive” was marked on nearly every 

page of the draft declaration, the GPO Inspector General found that no 

GPO employees raised any concerns during the processing of the 

document. According to the GPO Inspector General’s report, GPO 

employees who reviewed the scanned copy looked for page numbers and 

format, without proofreading or reviewing the document text or markings. 

GPO officials told us that GPO rarely prints sensitive or classified 

documents. They told us that GPO relies on its customers to identify 

sensitive documents and notify it of special instructions, given the high 

volume of print requests. However, the August 2009 GPO Inspector 

General’s report found that GPO does not have procedures for identifying 

potentially sensitive documents and safeguarding them. In addition, most 

employees had not received education or training for recognizing or 

identifying sensitive documents or information. 

Although the GPO Inspector General found no wrongdoing on the part of 

GPO or its employees, it made several recommendations to improve GPO’s 

process for handling sensitive information and preventing the inadvertent 

 

13GPO, Management Implication Report Publication of House Document 111-37 on U.S. 

Nuclear Sites, August 3, 2009, http://www.gpo.gov/pdfs/ig/investigations/MIR_HD_111-

37.pdf (assessed Nov. 12, 2009). 

Page 18 GAO-10-251 Managing Sensitive Information
 

disclosure of such information in the future. These recommendations 

included 

• establishing a protocol with customer agencies on clearly identifying 

sensitive information that may be published and developing written 

procedures for handling such information; 

• establishing written procedures for verifying any requests for publishing 

documents that are clearly identified or marked as being of a sensitive or 

otherwise restricted nature; 

• updating GPO guidance to define “sensitive information” and how to 

specifically recognize, mark, and safeguard such information; and 

• developing and conducting ongoing training of GPO employees on how to 

recognize, handle, and safeguard sensitive information and documents. 

During the course of our review, officials from several of the federal 

agencies and offices told us that it would be helpful if there was a 

standardized marking system for documents that are sensitive but are 

unclassified. In fact, the term sensitive but unclassified was very confusing 

for several officials who handled the draft declaration. To help clarify, a 

May 2008 presidential memorandum had adopted the phrase “Controlled 

Unclassified Information” (CUI) as a single designation for all information 

previously labeled SBU or with another similar marking. This 

memorandum also charged the National Archives and Records 

Administration with implementing a framework for CUI terrorism-related 

information, which is not expected to be in place until 2013. Despite these 

efforts, a May 27, 2009, presidential memorandum found that there is still 

no uniformity across federal agencies on rules to implement safeguards for 

information that is deemed SBU. The memorandum noted that agencies 

use SBU as a designation for federal government documents and 

information that are sufficiently sensitive to warrant some level of 

protection, but that do not meet the standards for national security 

classification. With each agency implementing its own protections for 

categorizing and handling SBU material, the memorandum stated that 

there are more than 107 unique markings and over 130 different labeling or 

handling processes and procedures for SBU information. The 2009 

memorandum directed the creation of a Task Force to review agencies’ 

current procedures for categorizing and sharing SBU information, to track 

the progress federal agencies are making to implement the framework for 

CUI terrorism-related information, and to recommend whether the CUI 

framework should be extended to apply to all SBU information. 

Page 19 GAO-10-251 Managing Sensitive Information
 

Public Release of 

Draft Declaration 

Does Not Appear to 

Have Harmed 

National Security, 

According to DOE, 

NRC, and Commerce 

Officials 

The inadvertent public release of the draft declaration of civilian nuclear 

sites and nuclear facilities does not appear to have damaged national 

security, according to officials from DOE, NRC, and Commerce. 

Information in the draft declaration was limited to civilian nuclear 

activities, and most nuclear-related information was publicly available on 

agency Web sites or in other published documents, according to officials 

from the three agencies. However, officials from all of the agencies that 

compiled this information told us the information—all of which was 

considered unclassified—was sensitive because it was consolidated into 

one document and should never have been posted to GPO’s Web site. 

Commerce, DOE, and NRC did not formally assess the impact of the public 

release of the information on U.S. national security. According to DOE, 

NRC, and Commerce officials, it was not necessary to do so because the 

agencies reviewed the list of civilian nuclear facilities and related activities 

on multiple occasions to ensure that no information of direct national 

security significance was included and that no classified information was 

contained in the declaration prior to transmitting it to the White House 

and Congress. 

Consolidated List of 

Civilian Nuclear Facilities 

and Activities Contained in 

the Draft Declaration Is 

Considered Sensitive and 

Was Never Meant to be 

Made Public 

According to U.S. government officials, the draft declaration in totality 

represents a consolidated list of hundreds of U.S. civilian nuclear facilities 

and activities that never should have been publicly released. These 

officials asserted that it could be potentially problematic if such a 

consolidated list of facilities and activities found its way into the hands of 

individuals who had malicious or malevolent intentions. For example, 

agency officials told us, in several instances, the draft declaration 

contained maps showing detailed diagrams of civilian reactor facilities or 

buildings storing nuclear materials at national laboratories. 

The draft declaration included 14 diagrams of buildings or facilities, 2 of 

which were marked OUO. For example, the declaration provided the 

building and vault numbers where highly enriched uranium is stored at the 

Y-12 nuclear production facility, as well as a diagram showing the layout of 

the part of the building where the material is stored. According to DOE 

officials, this information was sensitive because it identified the specific 

building and vault number, but no classified information was revealed 

because the diagram does not show a map of the entire Y-12 facility and 

the specific location of a vault at the Y-12 complex. Of the other 12 

diagrams, 1 was of a plutonium oxide storage area at DOE’s Savannah 

River site and 11 were of civilian nuclear facilities. The pages containing 

these diagrams did not have any markings: Highly Confidential Safeguards 

Sensitive, OUO, or any other U.S. designation. 

Page 20 GAO-10-251 Managing Sensitive Information
 

The 11 diagrams of civilian nuclear facilities accompanied information on 

8 NRC licensed commercial sites—4 reactors and 4 fuel fabrication 

facilities. For example, the draft declaration included a site map of the 

Turkey Point reactor in Florida and a diagram identifying the building 

where spent fuel is stored. According to NRC officials, the information and 

diagrams related to the facilities in the draft declaration are not classified 

because they do not specify the quantities and types of nuclear materials 

held at these facilities. However, the information is sensitive because it 

includes commercially sensitive data, such as the actual annual 

production, rather than the more general and publicly available 

information on how much material the facility is licensed to produce. 

According to DOE and State officials, the release of the information could 

be problematic for the United States because other countries could 

scrutinize the completeness and accuracy of the information and 

potentially pressure IAEA to do more rigorous inspections of the facilities 

listed. Inspections of nuclear facilities with nuclear materials and nuclearrelated activities are the cornerstone of IAEA’s data collection efforts and 

provide the ability to independently verify information in countries’ 

Additional Protocol declarations. Potential pressure to conduct more 

comprehensive inspections of U.S. facilities could divert time and 

resources from more rigorous inspections in countries and facilities of 

proliferation concern, such as Iran or Syria. 

Agencies Did Not Assess 

National Security 

Implications of Disclosure 

of Draft Declaration 

Commerce, DOE, State, and NRC did not undertake any assessments after 

the draft declaration was released to determine its impact on U.S. national 

security. According to officials from these agencies, no such assessment 

was necessary because all of the agencies involved in the development of 

the draft declaration (as well as the Department of Defense) had fully 

reviewed the consolidated list of civilian nuclear facilities and related 

activities on multiple occasions to ensure that no information of direct 

national security significance was included and that no classified 

information was contained in the declaration prior to transmitting it to the 

White House and Congress. 

DOE, which provided most of the information in the draft declaration, had 

three separate levels of security review and approvals for the information 

it submitted for the document. First, the national laboratories’ 

counterintelligence, export controls, and security offices reviewed the 

information submitted for the declaration. Second, the national 

laboratories’ site managers reviewed the information, and each site 

manager certified to DOE that the national laboratory had completed 

Page 21 GAO-10-251 Managing Sensitive Information
 

vulnerability assessments on the national security impact of releasing the 

information to IAEA and that the facilities were ready for IAEA 

inspections. Finally, program managers and security officers at DOE 

headquarters reviewed the contents. According to DOE officials, at all 

levels of review, officials from the national laboratories and DOE 

concluded that no information detrimental to national security was 

included in the document. NRC and Commerce reported information 

about facilities’ activities and locations that was mostly, if not all, publicly 

available. State obtained additional confirmation from DOE, Commerce, 

NRC, and the Department of Defense that the draft declaration contained 

no classified or national security information before sending it to the 

White House. 

According to agency officials, there was no requirement to conduct a 

formal assessment of any possible security concerns arising from the 

declaration’s publication because classified information was not released. 

A formal assessment is required only if there is a release of information 

that could harm U.S. national security. DOE and NRC did seek assurances 

after the release of the draft declaration from officials at the national 

laboratories and civilian nuclear facilities that physical security at those 

locations was sufficient. DOE asked the national laboratories to review 

their security procedures and ensure that the facilities were secure. Based 

on these assessments, DOE officials told us they did not increase security 

at any site. NRC contacted every NRC licensee and agreement states with 

licensees included in the draft declaration to notify them of the disclosure 

of information.14 Agreement states notified their affected licensees. NRC 

and agreement states’ licensees reviewed their security procedures to 

make sure there were no vulnerabilities. According to NRC, the only NRC 

facility to express concern was Turkey Point in Florida because of its 

spent fuel pool. NRC officials told us that the location of this facility was 

already publicly disclosed, and satellite images show the building that 

houses the spent fuel pool. Turkey Point operators reviewed their security 

procedures and determined the procedures they had in place were 

sufficient, even with the release of the draft declaration. 

 

14Under the Atomic Energy Act of 1954, NRC has the authority to give primary regulatory 

authority to states (called agreement states) under certain conditions. As of October 1, 

2009, NRC has relinquished its licensing, inspection, and enforcement authority to 37 

agreement states while NRC continues to issue licenses in the remaining 13 states. 

Page 22 GAO-10-251 Managing Sensitive Information
 

The draft declaration listing civilian nuclear sites and activities under the 

terms of the Additional Protocol was the first of its kind prepared by the 

United States for IAEA and sent to Congress for review. However, the 

draft declaration contained sensitive civilian nuclear information that, 

when taken in its totality, needed to be properly handled and safeguarded. 

Protecting sensitive information from inadvertent public disclosure is a 

critical function of all federal entities that possess, handle, or transmit 

such information. Since the United States is required to submit a draft 

declaration to Congress and then send the declaration to IAEA every year, 

there is an opportunity to address the problems that occurred to ensure 

that this inadvertent disclosure does not occur again. 

Conclusions 

A more systematic, well-coordinated approach by all of the agencies that 

handled the draft declaration would have reduced the chances of publicly 

releasing sensitive information—particularly if the document had been 

clearly identified as not for public release. We found several critical points 

where opportunities to improve safeguards over the document were 

missed due to: the absence of clear interagency guidance, different 

procedures across the agencies governing the handling and marking of 

sensitive documents, poor decision making, and the lack of training and 

adequate security awareness. 

No agency or office that was involved with the production or transmittal 

of the draft declaration ensured that the final document was marked with 

any U.S. security designation. DOE, NRC, and Commerce marked the 

information they submitted for the draft declaration as OUO. However, 

none of these agencies took the added precaution of ensuring that the 

consolidated draft declaration maintained the OUO designation on each 

page of the document once the IAEA marking was placed on the 

document. Further contributing to the subsequent confusion over how to 

handle the draft declaration was State’s use of the SBU marking. Many 

officials focused on the unclassified portion of the marking and 

determined, incorrectly in our view, that the document could be made 

public. We believe that it would have been a simple matter to clearly state 

in the presidential message that the draft declaration was not meant for 

public dissemination. 

Furthermore, the White House failed to take measures to ensure that the 

draft declaration was not published. Attorneys from the Office of the 

White House Counsel did not provide us with any written guidance on how 

the National Security Council and the Executive Clerk’s Office usually 

handle documents that are unclassified, but are considered sensitive, such 

as those marked SBU, that should not be publicly released. However, 

Page 23 GAO-10-251 Managing Sensitive Information
 

counsel did indicate that individuals with the National Security Council 

and White House Clerk’s office handled the draft declaration according to 

White House practices. In our view, these practices, as best as we 

understand them, are not sufficient to prevent similar problems from 

occurring in the future. 

In addition, legislative branch officials did not properly safeguard the draft 

declaration and did not properly handle the information. In particular, we 

believe that the House of Representatives Security Office Director should 

have been more directly involved in resolving conflicting and confusing 

information regarding the classification of the draft declaration. 

Conversely, the Executive Communications Clerk is to be commended for 

taking actions to do everything in her power—at her level of 

responsibility—to pursue the right course of action. 

Finally, in our view, GPO officials also share responsibility for the public 

disclosure of the draft declaration. Although the August 2009 GPO 

Inspector General’s report assigns no wrongdoing to either GPO or its 

employees, GPO officials should have had procedures in place to prevent 

such a release from occurring. Thus, we agree with the Inspector General’s 

proposed recommendations and we encourage GPO to implement them as 

expeditiously as possible. 

To ensure that corrective actions are taken to prevent the inadvertent 

public disclosure of sensitive information in future draft declarations or 

other documents prepared for IAEA by multiple U.S. agencies, we are 

making the following four recommendations: 

Recommendations for 

Executive Action 

• The Secretaries of Commerce, Energy, and State, and the Chairman of the 

NRC should enter into an interagency agreement concerning the 

designation, marking, and handling of such information, and make any 

policy or regulatory changes necessary to reach such an agreement. This 

agreement should be revised, as necessary, to take into account future 

direction from the President or the Controlled Unclassified Information 

Council regarding standardization of the procedures for designating, 

marking, and handling documents that are unclassified but are not 

intended for public release. 

• The Secretary of State should clearly indicate in the text whether the 

presidential message and attached documents, if any, should be printed 

and made publicly available when preparing presidential communications 

to Congress for documents to be presented to IAEA. 

Page 24 GAO-10-251 Managing Sensitive Information
 

• The Executive Office of the President should consider revising any written 

guidance and/or practices it has and conduct staff training for handling 

and safeguarding sensitive information in future declarations or other 

documents between the United States and IAEA before it needs to issue its 

next declaration in May 2010. 

• GPO’s public printer should implement, as expeditiously as possible, the 

recommendations from the agency’s August 2009 Inspector General report 

in order to improve the security culture and reduce the possibility of 

future postings of sensitive information to the GPO Web site. 

We provided a draft of this report to DOE, State, GPO, NRC, Commerce, 

Office of the White House Counsel, and the House of Representatives’ 

Sergeant at Arms and Offices of the Clerk and Parliamentarian for 

comment. DOE, State, GPO, NRC and the House of Representatives 

Sergeant at Arms provided written comments, which are presented in 

appendixes I, II, III, IV and V, respectively. State and the Office of the 

White House Counsel provided technical comments which we 

incorporated as appropriate. Commerce and the House Offices of the 

Clerk and Parliamentarian reviewed, but did not provide comments on our 

draft report. 

Agency Comments 

and Our Evaluation 

DOE, State, and GPO agreed with our recommendations. NRC neither 

agreed nor disagreed with our recommendations, but did provide technical 

comments which we incorporated as appropriate. In response to our 

recommendation involving an interagency agreement to designate, mark, 

and handle sensitive information provided to IAEA on U.S. nuclear sites 

and activities, DOE noted that the interagency agreement would 

specifically address the marking and handling of future draft declarations 

and other documents provided to IAEA under U.S. safeguards agreements. 

The interagency agreement will not address broader, governmentwide 

standards on how to mark and handle all unclassified, but sensitive 

information. These standards will be developed by the Controlled 

Unclassified Information Council or other entity designated by the 

President. This is consistent with our recommendation. As we state in 

our report, the interagency agreement should be a corrective action to 

prevent the inadvertent public disclosure of sensitive information in future 

draft declarations or other documents prepared for IAEA by multiple U.S. 

agencies, rather than addressing broader, governmentwide standards on 

how to mark and handle all unclassified but sensitive information. 

Page 25 GAO-10-251 Managing Sensitive Information
 

The House of Representatives’ Sergeant at Arms did not comment on our 

recommendations but provided three points of clarification regarding the 

Office of Security’s role in reviewing and transmitting the draft 

declaration. First, the House Sergeant at Arms stated that, contrary to 

what we stated in our draft report, the House Security Office made no 

determination as to whether the draft document could be published and 

did not provide the House Clerk’s office with any direction or legal advice 

regarding this matter. Second, according to the House Sergeant at Arms, 

the House Security Office properly advised the House Clerk’s office to 

contact IAEA regarding the handling of the draft document. Third, the 

House Sergeant at Arms stated that the House Security Office did not need 

to take control of the draft document, nor was the Security Office 

requested to take control of the document. In addition, the Security Office 

does not have the authority to order a House of Representatives office or 

entity to store a document with the Security Office. 

Regarding the first point, we believe that given the sensitive nature of the 

draft document—and commensurate with its role and responsibilities—

the House Security Office should have, at a minimum, raised concerns 

with the House Clerk’s Office about publicly releasing 266 pages of 

information on U.S. nuclear sites and activities and advised the House 

Clerk not to print the document without explicit authorization from the 

agencies that designated the information SBU. While we do not dispute 

the statement that the House Security Office did not provide any advice or 

direction regarding the printing of the document, we believe that it would 

have been appropriate for this Office to play a more assertive role because 

the House Clerk sought advice and guidance in determining whether the 

document could be printed. However, based on these comments, we 

modified the text of the report to reflect the claims made by the House 

Security Office. Specifically, we removed reference to the Security Office 

on page 16 to avoid inferences that the Security Office provided direction 

or legal advice to the Clerk’s Office that it could print the document. 

Regarding the second point, the House Office of Security has 

misconstrued what we stated in the draft report. While there was nothing 

inherently wrong with the Office of Security suggesting that the Clerk’s 

Office contact IAEA about the document, IAEA did not prepare, transmit, 

or mark the document. As we noted in our report, the U.S. agencies that 

prepared the draft declaration placed the IAEA markings on the document. 

The presidential message explained that the draft declaration was 

prepared by the United States and would be submitted to IAEA. Because 

the IAEA markings on the document have no legal significance in the 

United States, the presidential message further explained that information 

Page 26 GAO-10-251 Managing Sensitive Information
 

in the document should be treated as SBU and was exempt from 

disclosure. IAEA was not the originating agency for the information. As a 

result, it continues to be our view that the Director of the House Office of 

Security did not provide the correct advice to the House Clerk on who she 

should contact to obtain authorization on releasing SBU information. 

Finally, regarding the matter of physical custody of the document, we do 

not dispute Security Office’s claim that it was not required—nor did it have 

the authority—to take control of the document. However, we believe that 

it would have been prudent for that office to take physical control of the 

document as a precautionary measure until a determination was made 

concerning whether or not the document could be published. The 

Director of the Office of Security missed opportunities to prevent the 

document’s release and should have been more directly involved in 

resolving conflicting and confusing information regarding the 

dissemination of the draft declaration. However, we modified the text on 

page 17 to include information about the Security Office’s physical 

custody requirements and the assistance the House Clerk requested from 

the Security Office. 

As agreed with your office, unless you publicly announce the contents of this 

report earlier, we plan no further distribution of it until eight days from date 

of this report. At that time, we will send copies of this report to the 

Secretaries of Commerce, Energy, and State; the Chairman of the Nuclear 

Regulatory Commission; the House of Representatives’ Parliamentarian, 

Clerk, and Sergeant at Arms; the Executive Clerk of the White House; the 

Public Printer of the Government Printing Office; and interested 

congressional committees. In addition, the report will be available at no 

charge on the GAO Web site at http://www.gao.gov. 

Page 27 GAO-10-251 Managing Sensitive Information
 

If you or your staff have any questions about this report, please contact me 

at (202) 512-3841 or aloisee@gao.gov. Contact points for our Office of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made major contributions to this report are 

listed in appendix VI. 

Sincerely yours, 

Director, Natural Resources 

nment 

Gene Aloise 

 and Enviro

Page 28 GAO-10-251 Managing Sensitive Information
Appendix I: Comments from the Department Appendix I: Comments from the Department of Energy 

of Energy 

Page 29 GAO-10-251 Managing Sensitive Information
Appendix II: Comments from the Department 

of State 

Page 30 GAO-10-251 

Appendix II: Comments from the Department 

of State 

Managing Sensitive Information
Appendix II: Comments from the Department 

of State 

Page 31 GAO-10-251 Managing Sensitive Information
Appendix III: Comments from the Appendix III: Comments from the Government Printing Office 

Government Printing Office 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

See comment 1. 

See comment 2. 

Page 32 GAO-10-251 Managing Sensitive Information
Appendix III: Comments from the 

Government Printing Office 

The following are GAO’s comments to the Government Printing Office 

letter dated December 2, 2009. 

1. We added GPO to the Highlights page as one of the agencies and 

offices we met with to discuss why the disclosure of the draft 

declaration occurred. 

GAO Comments 

2. We modified the text on page 3 to include the most recent data on the 

status of the printed copies of the draft declaration, based on 

information contained in the technical appendix provided by GPO. 

Page 33 GAO-10-251 Managing Sensitive Information
Appendix IV: Comments from the Nuclear Appendix IV: Comments from the Nuclear Regulatory Commission 

Regulatory Commission 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

See comment 1. 

Page 34 GAO-10-251 Managing Sensitive Information
Appendix IV: Comments from the Nuclear 

Regulatory Commission 

The following is GAO’s comment to the Nuclear Regulatory Commission 

letter dated December 2, 2009. 

1. We modified the text on the bottom of page 4 in the Background 

section to clarify that under the Additional Protocol, the U.S. must 

declare exports of sensitive nuclear-related equipment specified by 

IAEA. 

GAO Comment 

Page 35 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of Appendix V: Comments from the House of Representatives’ Sergeant at Arms 

Representatives’ Sergeant at Arms 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

See comment 1. 

See comment 2. 

See comment 3. 

See comment 4. 

Page 36 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

See comment 5. 

See comment 6. 

See comment 7. 

See comment 8. 

See comment 9. 

Page 37 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

See comment 10. 

See comment 11. 

See comment 12. 

See comment 13. 

Page 38 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

See comment 14. 

Page 39 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

Page 40 GAO-10-251 

The following are GAO’s comments to the House of Representatives 

Sergeant at Arms letter dated December 2, 2009. 

1. We have modified the text on page 16 by removing a reference to the 

Security Office to clarify that it did not make a determination as to 

whether the document could be published. 

GAO Comments 

2. The Sergeant at Arms is incorrect when he states that IAEA marked 

the document “Highly Confidential Safeguards Sensitive.” As we state 

in our report, U.S. agencies that prepared the declaration marked the 

document, not IAEA. U.S. agencies used an IAEA-supplied software to 

mark the document with the highest IAEA security marking to put 

IAEA on notice, once it received the document, that it should be 

properly safeguarded against disclosure. However, the draft 

declaration is a U.S. document and should not have been publicly 

disclosed. 

3. We agree that U.S. agencies and offices that prepared and transmitted 

the document prior to sending it to the House of Representatives 

missed opportunities to better mark the document and avoid confusion 

about whether it should have been published. However, the 

presidential message that accompanied the draft declaration explained 

that the United States regarded the information as SBU. The 

presidential message also explained that the information was exempt 

from disclosure under FOIA. In our view, the information in the 

presidential message should have been sufficient to put the House 

Security Office on notice that the information should be treated as 

SBU and should not be published or publicly released without a more 

rigorous inquiry. 

4. See comment 2. 

5. See comment 1. 

6. While there was nothing inherently wrong with the Office of Security 

suggesting that the Clerk’s Office contact IAEA about the document, 

IAEA did not prepare, transmit, or mark the document. IAEA was not 

the originating agency for the information. As a result, it continues to 

be our view that the Director of the House Office of Security did not 

provide the correct advice to the House Clerk on who she should have 

contacted to obtain authorization on releasing SBU information. 

 Managing Sensitive Information 
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

7. As we noted in our report, U.S. agencies that prepared the draft 

declaration placed the IAEA marking on the document. The 

presidential message explained that the draft declaration was prepared 

by the United States and would be submitted to IAEA. IAEA was not 

the originating agency for the information. 

8. We have modified the text on page 17 to clarify that the Security Office 

was not required to take custody and control of the document. 

9. See comment 8. 

10. We have modified the text on page 17 to clarify that the Security Office 

was not required to take custody and control of the document. 

However, given the unfamiliar markings and 266 pages of detailed 

information on U.S. nuclear sites and activities, we believe that it 

would have been prudent to take positive physical control of the 

document as a precautionary measure until a determination was made 

concerning whether or not the document could be published. The 

Director of the Office of Security missed opportunities to prevent the 

document’s release and he should have been more directly involved in 

resolving conflicting and confusing information regarding the 

classification of the draft declaration. 

11. See comment 8. 

12. We have modified the text on page 17 to clarify that the Security Office 

was not required to take custody and control of the document and the 

Executive Communications Clerk did not request that the Security 

Office take custody of the document or assist her in contacting the 

agencies and offices that transmitted the document. 

13. We have modified the text on page 17 to clarify the Security Office’s 

document custody requirements and what was asked of the Security 

Office by the House Clerk. However, we believe that given the 

sensitive nature of the draft document—and commensurate with its 

role—the House Security Office should have, at a minimum, raised 

concerns with the House Clerk’s Office about publicly releasing 266 

pages of information on U.S. nuclear sites and activities and advised 

the House Clerk not to print the document without a more rigorous 

inquiry as to whether it should have been published. 

14. We believe that the recommendation suggested by the Sergeant at 

Arms to require Member offices and other non-Committee House 

Page 41 GAO-10-251 Managing Sensitive Information
Appendix V: Comments from the House of 

Representatives’ Sergeant at Arms 

entities that are not equipped to properly store sensitive or classified 

data to relinquish custody of such material to the House Security 

Office would involve a change in House rules and procedures that is 

beyond the scope of our review. 

Page 42 GAO-10-251 Managing Sensitive Information
Appendix VI: 

A

GAO Contact and Staff 

cknowledgments 

Page 43 GAO-10-251 

Appendix VI: GAO Contact and Staff 

Acknowledgments 

Gene Aloise (202) 512-3841 or aloisee@gao.gov. 

In addition to the contact named above, Glen Levis, Assistant Director, 

Antoinette Capaccio, Leland Cogliani; Ralph Dawn, Karen Keegan; Tim 

Persons; and Carol Herrnstadt Shulman made significant contributions to 

this report. 

 Managing Sensitive Information 

GAO Contact 

Staff 

Acknowledgments 

(361127) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper