Source: https://www.pogo.org/letter/2015/07/pogo-joins-group-urging-for-improvements-to-controlled-unclassified-information-proposed-rule/
Timestamp: 2019-04-20 10:29:23+00:00

Document:
The undersigned organizations write to provide comments on the proposed Federal Regulation by the Information Security Oversight Office (ISOO) on Controlled Unclassified Information (CUI). We have coordinated closely with ISOO as it has worked to implement the CUI framework, and we greatly appreciate the office’s responsiveness to our concerns and suggestions along the way. We nonetheless have some remaining concerns that certain provisions of the proposed rule could discourage legitimate information-sharing, both internally and outside the government. Accordingly, we submit the following comments that are designed to ensure CUI does not become a fourth level of classification, contrary to the spirit and intent of Executive Order 13556, or hinder public access to government records pursuant to the Freedom of Information Act.
§ 2002.1 Purpose and scope.
(b) The CUI Program standardizes the way the executive branch handles sensitive certain information that requires protection special controls under laws, regulations, or Government-wide policies, but that does not qualify as classified under Executive Order 13526, Classified National Security Information, December 29, 2009 (3 CFR, 2010 Comp., p. 298), or the Atomic Energy Act of 1954 (42 U.S.C. 2011, et seq), as amended.
(2) Other non-executive branch entities. When feasible, executive branch agencies should enter formal information-sharing agreements and include a requirement that any non-executive branch party to the agreement comply with the Order, this part, and the CUI Registry. When an agency’s mission requires it to disseminate CUI without entering into an information-sharing agreement, the agency must communicate to the recipient that because of the sensitive nature of the information, the Government strongly encourages the non-executive branch entity to protect CUI consistent with the Order, this part, the CUI Registry, and other applicable statutes or regulations.
We also have concerns that the restrictions on disclosure set forth in this rule could be interpreted to override policies that implement discovery obligations in litigation, whistleblower protections, and other lawful disclosures. Our understanding from conversations with ISOO is that the rule is not intended to affect existing rights or responsibilities with respect to such disclosures. The proposed regulation is silent on the Whistleblower Protection Act of 1989 and related statutes, which could create confusion and a corresponding chilling effect, as well as unnecessary personnel disputes and associated litigation.
(b) The mere fact that information is designated as CUI shall not have a bearing on determinations pursuant to any law requiring the disclosure of information or permitting disclosure as a matter of discretion, including disclosures to the legislative or judicial branches.
The whistleblower laws all are discretionary disclosure statutes. Further, this year in a 7-2 decision, MacLean v. Department of Homeland Security, 135 S. Ct. 913 (2015, the Supreme Court overturned the dismissal of an employee for publicly releasing CUI, in that instance Sensitive Security Information, because the termination violated the Whistleblower Protection Act.
(i) Nothing in this part is intended to limit lawful and/or protected disclosures to law enforcement officials, Inspectors General, or the legislative or judicial branches or elements thereof, or to preempt, override, or otherwise affect legal protections for disclosures by whistleblowers as set forth in statute, regulation, or executive order or directive.
This language could alternatively be inserted as a new subsection (d) – entitled “Rule of Construction” – to Section 2002.13 (Access and Disseminating). Finally, it could be the contents of a new provision, § 2002.28, CUI, the Whistleblower Protection Act and related statutes. However organized, the regulation must be clear that CUI status does not affect the rights and responsibilities of these laws.
Misuse of CUI occurs when someone uses CUI or applies CUI markings in a manner inconsistent with the policy contained in the Order, this part, and the CUI Registry, or any of the laws, regulations, and Government-wide policy that establish CUI categories and subcategories. This may include intentional violations or unintentional errors in marking, safeguarding or disseminating CUI.
Unauthorized disclosure occurs when individuals or entities disseminate or permit access to CUI in a manner inconsistent with the restrictions set forth in this rule. that do not have a lawful Government purpose to access the CUI gain access to it. Unauthorized disclosure may be intentional or unintentional.
Non-executive branch entity is a person or organization established, operated, and controlled by individual(s) acting outside the scope of any official capacity as officers, employees, or agents of the executive branch of the Federal Government. Such entities may include elements of the legislative or judicial branches of the Federal government; State, interstate, Tribal, local, or foreign government elements; and private or international persons or organizations, including contractors and vendors.
§ 2002.4 Roles and responsibilities.
(8) Reviews changes to law, regulation, or Government-wide policy authorizing CUI categories or subcategories, revises CUI categories and subcategories to reflect changed authorizations, and updates the CUI Registry accordingly.
We are concerned that some of the specific safeguarding obligations in this section could pose barriers to timely access by authorized holders and are unduly onerous for some categories of CUI.
We believe it should be sufficient to place clear responsibility on authorized holders to guard against authorized disclosure and provide specific examples of how such a responsibility could be discharged, without mandating each of these measures in every instance. For instance, the proposed rule currently “encourage[s]” rather than mandates the use of in-transit tracking of CUI that is transported or delivered; we believe this is a sensible approach that could be expanded.
(1) Agencies must safeguard CUI at all times in a manner that minimizes the risk of unauthorized disclosure while allowing for timely access by authorized holders.
(1) Authorized holders must have access to controlled environments in which to protect CUI from unauthorized access or observation.
(2) When discussing CUI, you must reasonably ensure that unauthorized individuals cannot overhear the conversation.
(3) When outside a controlled environment, you must keep the CUI under your direct control or protect it with at least one physical barrier. You or the physical barrier must reasonably protect the CUI from unauthorized access or observation.
(4) Agencies must protect the confidentiality of CUI that is processed, stored, or transmitted on Federal information systems consistently with the security requirements and controls established in FIPS Publication 199, FIPS Publication 200, and NIST SP 800-53.
(2) When reproducing CUI documents on equipment such as printers, copiers, scanners, or fax machines, you must are encouraged to ensure that the equipment does not retain data or you must to otherwise sanitize it in accordance with NIST SP 800-53.
§ 2002.13 Accessing and disseminating.
(ii) Use of limited dissemination controls to unnecessarily restrict access to CUI is contrary to the stated goals of the CUI Program. You may therefore use these controls only when it serves a lawful Government purpose, or if you are required or permitted by laws, regulations, or Government-wide policies to do so.
(6 5) When a pre-determined event or date occurs, as described in the decontrol indicators section of this part.
(b) Agencies also may decontrol CUI in response to a request to decontrol it, if the agency is the designating agency.
(bc) Decontrolling may shall occur automatically upon the occurrence of one of the conditions in paragraph (a) of this section. Decontrol may also be accomplished or through an affirmative decision by the designating agency.
We also recommend removing the current subsection (e), as information that no longer requires or permits control should be decontrolled automatically pursuant to the revised language suggested above.
(g) Once decontrolled, any public release of information that was formerly CUI must be in accordance with existing applicable law and agency policies on the public release of information.
(k) You must not decontrol CUI in an attempt to conceal, or otherwise to circumvent accountability for, or mitigate an identified unauthorized disclosure.
(5) You must not mark information as CUI to conceal illegality, negligence, ineptitude, or other disreputable circumstances embarrassing to any person, any agency, the Federal Government, or any partners thereof, or for any purpose other than adherence to the law, regulation, or Government-wide policy authorizing control.
In subsection (a)(6), we note that there is a need for guidance as to the legal status of “legacy markings.” Because the rule does not require such markings to be stricken, it creates some confusion as to whether (and, if so, for how long) they continue to have legal effect.
(e) Date of designation (mandatory). To facilitate decontrol, all media containing CUI must be marked with the date or dates on which the information was designated CUI.
§ 2002.22 Challenges to designation of information as CUI.
(a) Authorized holders of CUI Anyone who, in good faith, believes that its the designation of information as CUI is improper or incorrect should may (and authorized holders of CUI should) notify the designating agency of this belief.
(5) Ensures that challengers who are authorized holders have the option of bringing such challenges anonymously, and that challengers who are authorized holders are not subject to retribution for bringing such challenges.
We thank you for the opportunity to submit comments, and appreciate your consideration. For further information, please contact Patrice McDermott at OpenTheGovernment.org (pmcdermott@openthegovernment.org), Elizabeth Goitein at the Brennan Center for Justice (goiteine@mercury.law.nyu.edu), Tom Devine at the Government Accountability Project (TomD@whistleblower.org), or Scott Amey (scott@pogo.org), with any questions.

References: § 2002
 v. 
 § 2002

§ 2002

§ 2002

§ 2002