Managing Sensitive Information: DOJ Needs a More Complete Staffing Strategy for Managing Classified Information and a Set of Internal Controls for Other Sensitive Information
Published: 2006-10-20T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The September 11 attacks showed that agencies must balance the need to protect and share sensitive information to prevent future attacks. Agencies classify this information or designate it sensitive but unclassified to protect and limit access to it. The National Archives' Information Security Oversight Office (ISOO) assesses agencies' classification management programs, and in July 2004 and April 2005 recommended changes to correct problems at the Justice Department (DOJ) and Federal Bureau of Investigation (FBI). GAO was asked to examine (1) DOJ's and FBI's progress in implementing the recommendations and (2) the management controls DOJ components have to ensure the proper use of sensitive but unclassified designations. GAO reviewed ISOO's reports and agency documentation on changes implemented and controls in place, and interviewed security program managers at DOJ, its components, and ISOO to examine these issues.
section_title: What GAO Found
paragraphs: At the time of GAO's review, DOJ and FBI had made progress implementing ISOO's recommendations aimed at correcting deficiencies in their programs to properly classify information. FBI had taken action on 11 of 12 recommendations, including issuing security regulations governing its program and updating most of the classification guides that employees use to help them decide what information should be classified. FBI is also correcting deficiencies in its training and oversight activities. If FBI completes all recommendations, this will help to lower program risk since it makes 98 percent of DOJ's classification decisions. DOJ had taken action on 5 of 10 recommendations, including fixing problems with outdated and insufficient training and insufficient monitoring of components' programs. DOJ, however, has taken no action on the most important recommendation, addressing its staff shortages, which continue to place its program at risk given that it sets policy, provides training, and oversees classification practices departmentwide. DOJ said it did not have staff resources to address other shortcomings in its training and oversight activities that ISOO recommended it correct. DOJ is trying to address its resource constraints, a long-standing problem that GAO identified as early as 1993, by requesting additional funds from an administrative account in fiscal year 2007. However, DOJ does not know the optimum number of staff it needs for the program because it has not assessed its needs. It also does not have a strategy that identifies how it will use additional resources to address remaining deficiencies so as to reduce the highest program risks, such as whether to first address training, oversight, or other program gaps. For sensitive but unclassified information, the five components in our review--Bureau of Alcohol, Tobacco, Firearms and Explosives; Criminal Division; Drug Enforcement Administration; FBI; and U.S. Marshals Service--had orders and directives that identified and defined the various designations components were using, such as Law Enforcement Sensitive, to protect information, such as information critical to a criminal prosecution. But the components did not have specific guides, with examples, to help employees decide whether information merits a sensitive but unclassified designation. Furthermore, none of the components had training to help employees make these decisions or oversight of their designation practices. Without these controls, DOJ cannot reasonably ensure that information is properly restricted or disclosed and that designations are consistently applied. GAO recently identified similar problems at several other agencies and recommended that they implement such controls, and the agencies agreed to do so. According to security officials, DOJ is waiting for the results of an interagency working group established to set governmentwide standards for sensitive but unclassified information before considering additional changes in its sensitive but unclassified practices or those of its components. The final results from the working group are due by the end of December 2006. Once standardization is realized, it is important for DOJ to ensure that sensitive but unclassified practices across the agency provide employees with the tools they need to apply designations appropriately.

section_title: Letter
paragraphs: According to the former Vice Chair of the National Commission on  Terrorist Attacks Upon the United States (9/11 Commission), the  government’s single greatest failure in the lead-up to the September 11,  2001, attacks was the inability of federal agencies to share information  about suspected terrorists and their activities. Likewise, as we have  previously reported, critical to homeland protection efforts is the ability to  share information among key homeland security stakeholders so they can  coordinate their antiterrorism activities yet also protect sensitive  information from unauthorized access that could compromise our nation’s  security. As part of these protection efforts, pursuant to Executive Order  12958, as amended, the federal government routinely classifies certain  documents and other information critical to our national security as Top  Secret, Secret, or Confidential. These classification levels indicate the  degree of damage that could be reasonably expected from unauthorized  disclosure. Classified information can only be used by individuals who  have an appropriate security clearance and a need to know and must be  safeguarded from unauthorized access and disclosure. A critical  component of balancing the competing interests of the need to share and  the need to protect information is the establishment of clear policies and  procedures to guide decisions on whether information should be  classified.
Reviewing classified information to determine if it must continue to be  restricted or if it can be declassified and be made publicly available and  shared is also a vital part of the classification system. For example, under  a provision in the executive order, all records of a permanent historical  value over 25 years old that contain classified national security  information will be automatically declassified on December 31, 2006, and  each year thereafter, and may be available for public disclosure. Before  this date, agencies may review applicable records to determine if they  qualify for certain exemptions—for example, information about the  confidential human sources of intelligence information cannot be  disclosed—if they should be reclassified, or if they should be withheld for  reasons such as concerns about an individual’s privacy rights.
Government agencies may also designate other types of information  important to their missions, such as law enforcement information critical  to a prosecution, as sensitive but unclassified. Agencies have employed a  number of different sensitive but unclassified designations, such as Law  Enforcement Sensitive, For Official Use Only, and Limited Official Use,  which have associated restrictions on handling and sharing such  information with other government entities and with the public. Sensitive  but unclassified information generally must be safeguarded from public  release and can only be used by those with a need to know. Unlike  classified information, generally, a security clearance is not required for  access to sensitive but unclassified information, and there is no time limit  on the designation indicating when it can be removed.
As part of the post-September 11 efforts to better share information  critical to homeland protection, agencies’ classification and sensitive but  unclassified information security programs have come under scrutiny. In  response to congressional requests, we have recently published several  reports assessing various executive branch agencies’ programs for  designating and sharing classified and sensitive but unclassified  information. (See app. I for summaries of each of our related reports.) This  work noted that agencies needed to enhance their policies and procedures  governing classified and other sensitive information to help ensure they  were appropriately protecting it. For example, we found that the  Department of Defense’s information security program had weaknesses,  such as in the training provided employees on the classification program,  and in the use of self-inspections to monitor program implementation. In  addition, congressional committees have conducted a number of hearings  on agencies’ information security efforts that raised issues such as  whether some agencies have been overclassifying documents, thereby  restricting public access to important historical information.
The Information Security Oversight Office (ISOO), an office within the  National Archives and Records Administration, is responsible for issuing  directives to implement the executive order that governs classified  information. The office is also responsible for overseeing executive branch  agencies’ national security information classification programs for  compliance with the order and implementing directives. The office is not  responsible for overseeing agencies’ sensitive but unclassified information  security programs, which is the responsibility of each agency. ISOO’s  oversight consists of performing on-site inspections of classification  programs, conducting classified document reviews, evaluating agency  security education and training programs, and recommending corrective  actions to agencies when it finds violations under the order or directives.  According to ISOO, while the order provides it with the authority to make  such recommendations, it cannot require agencies to implement them.  ISOO is also required to report at least annually to the President on the  status of federal agencies’ national security information classification  programs.
The Department of Justice (DOJ), the nation’s top law enforcement  agency, is the third largest classifier of information in the executive  branch, following the Department of Defense and the Central Intelligence  Agency, based on information that these agencies reported to ISOO.  Furthermore, one component within DOJ, the Federal Bureau of  Investigation (FBI), makes up 98 percent of the department’s total  classification decisions. Thus, it is important that both organizations have  effective information classification programs. In July 2004, ISOO made   10 recommendations to DOJ to correct deficiencies in its policies and  procedures for classifying and declassifying national security information.  For example, ISOO found gaps in the level of resources DOJ had available  to oversee its classification management program, in its employee training  programs, and in the use of inspections to ensure employees were making  proper classification decisions. In response, ISOO recommended that DOJ  provide more resources, update and more consistently provide employee  training, and conduct more regular inspections of how well its  classification management program is working to correct these  deficiencies. Likewise, ISOO made 12 recommendations to the FBI in April  2005 to address deficiencies in that component’s program, including gaps  in the guidance employees can use to make classification decisions,  outdated training, and little program oversight. ISOO recommended that  the FBI issue regulations governing the program, update or create  classification and declassification guides to help employees properly  classify information, update employee training, and use more regular  inspections to test program effectiveness.
In response to your request, this report examines matters related to DOJ’s  management of classified and sensitive but unclassified information. More  specifically, we address the following questions:  1.  To what extent has DOJ implemented ISOO’s recommendations?  2.  To what extent has FBI implemented ISOO’s recommendations?  3.  What policies, procedures, and internal controls are in place in  selected DOJ components to properly use sensitive but unclassified  designations?  4.  What processes are in place at selected DOJ components to respond to  intragovernmental requests to share national security and sensitive but  unclassified information?
To determine the extent of changes that DOJ and the FBI have made to  implement ISOO’s recommendations and other changes made to improve  their classification management programs, we (1) reviewed the results of  ISOO’s audits; (2) obtained supporting documents that addressed these  changes, when available; and (3) discussed challenges that DOJ and FBI  managers responsible for implementing and overseeing these programs  faced in making these changes. While these results cannot be generalized  to all classified documents, we determined the methodology ISOO uses to  conduct its reviews is adequate to support its recommendations.
To determine the extent of policies, procedures, and internal controls that  selected DOJ components have in place for designating information as  sensitive but unclassified, we used our Standards for Internal Control in  the Federal Government to provide criteria to assess the components’  sensitive but unclassified designation practices. We selected five DOJ  components for our review: Bureau of Alcohol, Tobacco, Firearms and  Explosives (ATF); Criminal Division; Drug Enforcement Administration  (DEA); the FBI; and U.S. Marshals Service (USMS). We selected these  components because, on the basis of data we collected as part of our prior  governmentwide assessment of 26 agencies’ sensitive but unclassified  information programs, we determined that each of these components had  adopted one or more sensitive but unclassified designations, in addition to  the Limited Official Use designation used across the department. We  reviewed the available data collected on these five components as part of  the governmentwide review. We had determined these data were reliable  enough for our purposes, and we conducted follow-up interviews with  each component’s security officials and senior program officials on these  issues.
To determine how selected DOJ components respond to federal  intragovernmental requests for classified and sensitive but unclassified  information, we reviewed supporting documents when available,  interviewed these same security officials, and compared the components’  processes for responding to requests, but we did not independently test  the effectiveness of these processes. We conducted our work from June  2005 through August 2006 in accordance with generally accepted  government auditing standards. More detailed information about our  scope and methodology appears in appendix II.
subsections: section_title: Background
paragraphs: The U.S. government classifies information that it determines could  reasonably be expected to damage the national security of the United  States if disclosed publicly. Since 1940, the classification of official secrets  has been governed by policies and procedures flowing from executive  orders issued by presidents, largely based on authority granted under  Article II of the Constitution. Current classification and declassification  requirements are mandated by Executive Order 12958, Classified National  Security Information, as amended. The order establishes the basis for  classifying national security information at one of three levels—Top  Secret, Secret, or Confidential—depending on the degree of damage that  unauthorized disclosure of this information could reasonably be expected  to cause to the national security of the United States. Pursuant to the  executive order, designated individuals, called original classifiers, exercise  original classification authority, meaning they can classify national  security information for the first time. Such individuals, including the  President, agency heads, and other government officials that have been  delegated this authority determine the degree of damage that disclosure  could cause, decide on a classification level for the information, and  attempt to establish a date or event for its declassification.
Declassification is a vital part of the classification system because it  prompts the change in status of the information from classified to  unclassified, which may make it available for others to access and use,  such as members of the general public, researchers, historians, or other  parties. Under the automatic declassification provision of the executive  order, all records of a permanent historical value over 25 years old that  contain classified national security information will be automatically  declassified on December 31, 2006, and each year thereafter, and may be  available for public disclosure, unless an agency head or senior agency  official determines that these records fall within an exemption that  permits continued classification as approved by the President or the  Interagency Security Classification Appeals Panel. Examples of  exemptions include information that, if released, could be expected to  seriously impair relations between the United States and a foreign  government; undermine diplomatic activities of the United States; identify  a human intelligence source; or violate a statute, treaty, or international  agreement. Information that is automatically declassified as of December  31, 2006, will not necessarily enter the public domain. According to ISOO  officials, declassified information may continue to be withheld from public  disclosure for reasons under the Freedom of Information Act (FOIA) or  other legal authority or may be reclassified in accordance with the  executive order.
The order also requires ISOO to implement directives and perform  oversight inspections of executive branch agencies’ national security  information classification programs to ensure these programs are in  compliance with the order. When the oversight inspections result in  findings of noncompliance with the order, ISOO recommends corrective  actions to the agencies. However, according to ISOO, it cannot require  agencies to implement the recommended corrective actions.
According to ISOO, DOJ is the third largest classifier of information in the  executive branch, although this represents about 2 percent of all executive  branch classification decisions during fiscal years 2000 through 2004, as  the vast majority of classified information originates in the Department of  Defense. Nevertheless, DOJ is responsible for a large volume of classified  information, some of which if improperly disclosed could harm the  national security of the United States. The majority (approximately   98 percent) of classification activity within DOJ occurs at the FBI.
DOJ also designates certain information as sensitive but unclassified and  prescribes specific requirements for handling and sharing this information  to ensure that harm is not caused to governmental, commercial, or privacy  interests as a result of disclosing it to the public or persons who do not  need such information to perform their jobs. DOJ components in our  review use a number of sensitive but unclassified designations, such as  Law Enforcement Sensitive, For Official Use Only, and Limited Official  Use, to identify information as sensitive but unclassified. Such information  at DOJ could include that which is critical to a criminal prosecution. As  such, the department would protect this information from inappropriate  dissemination by designating it Law Enforcement Sensitive and applying  prescribed dissemination and handling procedures that correspond with  the designation. Information designated as sensitive but unclassified  remains so indefinitely, unless it is reviewed, for example, pursuant to a  request under FOIA. That act requires federal agencies to disclose records  requested in writing by any person unless one or more of the nine  exemptions and three exclusions authorize the agency to withhold the  requested information. For example, law enforcement records may be  withheld if their release could reasonably be expected to interfere with  enforcement proceedings.
Within DOJ, the Office of Information Safeguards and Security Oversight,  which is part of the Security and Emergency Planning Staff (SEPS), is  responsible for developing security policy and administering and  overseeing the department’s programs for managing classified and  sensitive but unclassified information. This office currently has a total of  13 staff, of which 1 is responsible for policy development and training, and  3 are responsible for program oversight. The remaining 9, among other  things, administer the department’s sensitive compartmented information  program, reviews information technology security policies developed by  the department’s Chief Information Officer, and ensures the development  and implementation of departmentwide policies and procedures that  govern certain security related activities. Figure 1 shows an excerpt of  DOJ’s organizational chart that features the offices responsible for  classification management.
At the component level, security program managers are responsible for  implementing component-specific security activities, such as conducting  internal inspections and training employees on their responsibilities in  relation to DOJ’s security programs. In total, there are approximately   40 security program managers and alternates, 33 of which conduct these  duties on a part-time basis.
DOJ shares classified and sensitive but unclassified information with those  who have a need to know this information, such as with other law  enforcement agencies at all levels of government. One manner in which  DOJ shares this information is in response to requests it receives from  other federal entities, such as Congress, other executive agencies, and  legislative agencies.
section_title: DOJ Has Made Progress Implementing ISOO Recommendations but Has Not Yet Addressed Critical Staff Resource Issues That Limit Its Ability to Address All Needed Changes
paragraphs: Although DOJ has completed or partially completed half of ISOO’s   10 recommendations, it has not implemented the other half, primarily  because of resource constraints, according to DOJ. This has been a long- standing problem in the program, as our prior work shows, but DOJ  reported that it is seeking additional resources from an administrative  fund in fiscal year 2007. The ISOO recommendations were to correct,  among other things, resource constraints, a lack of sufficient training on  how to classify information, and inadequate oversight to ensure its  classification management practices were working well. DOJ is not certain  that the additional resources will be enough for an effective program.  However, it has not assessed the optimum resources it needs or developed  a strategy to use available resources most effectively to resolve remaining  deficiencies.
subsections: section_title: DOJ Took Action on 5 of the 10 ISOO Recommendations for Its Classification Management Program
paragraphs: ISOO made 10 recommendations to DOJ in July 2004 aimed at resolving  deficiencies in DOJ’s classification management program, and, at the time  of our review, the department had completed or partially addressed half of  the recommendations, as table 1 shows.
Through SEPS, DOJ had implemented 1 recommendation to require that  each of its components file self-inspection reports on its classification  management program as a matter of course by including this requirement  in its May 2005 revised Security Program Operating Manual. DOJ also  built in the requirement that all components submit inspection reports for  each fiscal year no later than October 15 of the following fiscal year, but at  the time of our review, a SEPS official noted that none of the components  had submitted inspection reports for fiscal year 2005.
Through SEPS, DOJ has partially implemented 2 other recommendations.  First, in response to ISOO’s recommendation that security program  managers hold security clearances at levels appropriate for the activity of  their office, SEPS reported that all of its component security program  managers who handle classified information had security clearances, but  SEPS was considering revising the order on security programs and  responsibilities to include a requirement for these managers to hold  clearances. Second, as of April 2006, SEPS reported that it has taken steps  to make refresher training, including how to mark classified documents,  available to all staff in all DOJ components. According to DOJ security  officials, SEPS has developed a computer-based refresher training module,  which is estimated to be available to employees by December 2006.
DOJ disagreed with an ISOO recommendation to examine the placement  of SEPS within the department’s organizational structure and consider  repositioning it to afford it higher visibility and increased stature. DOJ’s  Assistant Attorney General for Administration informed ISOO that SEPS’s  reporting to the Deputy Assistant Attorney General for Administration  does not hinder it from fulfilling its responsibilities, and SEPS’s director  has access to the department’s senior leadership whenever needed.  However, ISOO still maintains this change is needed.
section_title: DOJ’s Inaction on Staff Resource Issues Impedes Full Implementation of ISOO’s Recommendations
paragraphs: ISOO reported that SEPS lacked sufficient staff resources to effectively  implement DOJ’s classification management program and recommended  that measures be taken to correct this deficiency. ISOO’s recommendation  to DOJ on resources for classification management is consistent with the  executive order governing classified information that requires agency  heads to commit the resources necessary to effectively implement a  national security information program. The order also requires the senior  agency official—who is designated by the agency head to direct and  administer the agency’s classified national security information program— in part, to establish and maintain programs to (1) train and educate  employees on the need to properly classify and mark national security  information and prevent unnecessary access to and unauthorized  disclosure of classified information; and (2) provide oversight of the  program through mechanisms such as ongoing internal inspections.   These requirements are also consistent with federal standards for   internal control.
ISOO reported that SEPS’s lack of resources is particularly significant  because of DOJ’s large volume of classification activity—especially when  SEPS is compared to security offices at other federal agencies of similar  size and structure. DOJ, the third largest classifier of information in the  federal government, has 13 full-time positions devoted to information  security. Four of the 13 are dedicated to DOJ’s classification management  training and program oversight departmentwide, 1 to provide and oversee  training across the department and components and 3 to conduct security  compliance reviews at DOJ’s 3,500 locations. DOJ does have security  program managers at each of its components to provide training and  program oversight for that component that helps to supplement  departmental activity. Nevertheless, in comparison, the Department of  Energy, the fifth largest classifier, has 23 full-time positions, and the  Department of State, the fourth largest classifier of information, has   8 full-time positions to cover its classification management program at  headquarters alone, according to ISOO.
SEPS did not receive additional resources, as requested, nor did DOJ  reallocate resources to SEPS from other activities, according to DOJ  security officials, although they would not provide additional information  explaining the reasons why funds were not made available. This problem  is longstanding. In 1993, for example, we reported that limited staff  resources in SEPS’s Security Compliance Review Group affected its ability  to conduct compliance reviews of all DOJ locations in overseeing the  department’s security program. In addition, during 1991 and 1992, the  group had 6 employees to conduct reviews of 1,300 DOJ locations  compared to half as many staff to cover almost three times as many  locations today. Moreover, in 1993, we reported that DOJ requested, but  was not authorized, additional staff, and we recommended that the  Attorney General direct SEPS’s Security Compliance Review Group to  explore other alternatives for selecting and conducting these annual  reviews to maximize the use of its limited resources. In response, DOJ  devised a strategy to use components’ security specialists to help with  compliance reviews and their inspection reports to target locations to  review. As a result, DOJ reported that the number of compliance, follow- up, and unscheduled reviews increased. However, at the time of our  review, SEPS indicated that security program officials only perform  oversight of their components’ security programs. Despite the progress  reported after our 1993 report, ISOO found over 10 years later that DOJ  was not able to compensate for its lack of resources and provide sufficient  oversight.
As a result of these staff resource limitations, DOJ security officials stated  that SEPS had only been able to partially implement 2 ISOO  recommendations and had not taken steps to address 3 others. DOJ had  partially responded to ISOO’s recommendation that department security  program managers be given consistent and regular training they need to  understand their responsibilities for managing their respective  component’s classification activities. SEPS agreed to provide training to  these managers in two ways: (1) an annual conference, at which  attendance is not required, that the department has hosted since 2003 and   (2) detailed training workshops on handling and safeguarding classified  information, such as marking documents, conducting self-inspections, and  managing classification programs, which are provided only upon request.  However, DOJ does not have a mechanism, as called for in our federal  internal control standards, and sufficient staff, as ISOO noted in its report,  to ensure all security program managers consistently receive the training  they need. In addition, SEPS has implemented a database to track security  incidents departmentwide, such as classification program violations, as  ISOO recommended. However, SEPS officials reported that they have not  been able to monitor security violations and incidents to identify patterns  and trends and incorporate these lessons learned into the department’s  security education and training program because they lack the staff to   do so.
The three recommendations SEPS had not taken any action on primarily  related to monitoring aspects of the classification management program.  First, ISOO found that SEPS was not conducting frequent reviews of the  department’s compliance with the security program, as a whole, and that  the components were not supplementing these department-level reviews  by conducting self-inspections of compliance with their security programs  on a frequent and consistent basis to ensure that sound security practices  are maintained. SEPS’s team of three reviewers was responsible for  conducting security program compliance reviews at an estimated   3,500 DOJ facilities currently located worldwide. ISOO also found that  SEPS had not established a mechanism to ensure that components were  conducting the self-inspections. ISOO recommended that DOJ correct  these deficiencies.
Second, ISOO also found that classified documents were not always  marked as required. Over half of the 81 classified documents that ISOO  reviewed did not meet the marking requirements of the executive order.
The most frequent marking errors consisted of a lack of, or incomplete,  portion markings (27 documents) and missing, incomplete, or improper  declassification instructions (23 documents). Therefore, ISOO  recommended that DOJ review classified documents on a regular basis to  determine if staff are properly applying the marking requirements after  employees have been trained on these requirements. According to SEPS  officials, because of related resource constraints, the office had not taken  action to institute these reviews.
Third, DOJ had not taken action on ISOO’s recommendation that  employees receive security debriefings upon leaving the department.   ISOO reported that such termination briefings are essential to informing  employees that were leaving the agency of their continuing responsibility  to protect classified security information. This recommendation is  consistent with the executive order and implementing directives, federal  standards for internal control, and DOJ’s own Security Program  Operating Manual. DOJ reported that it enforces this requirement by  checking to see if components are providing the briefings when SEPS  conducts components’ security compliance reviews. However, ISOO found  that SEPS did not conduct these reviews frequently enough to ensure that  sound security practices are maintained. Furthermore, DOJ officials  concurred with ISOO’s position on this matter and attributed the  department’s insufficient reviews to its resource limitations. As an  alternative, ISOO suggested to us that DOJ might coordinate with its  human resources department to establish a system to track whether  employees received the termination briefings before departure.
To address its resource constraints, SEPS expects to add 9 more staff—  5 full-time employees and 4 contract employees—to the 13 it currently has  on board, pending the department’s Customer Advisory Board approval of  funds from its Working Capital Fund. This fund is an administrative  account generally intended to recover operating costs by having the  department charge components fees for common administrative  services—such as financial, telecommunications, and personnel services— that the department provides to them. DOJ officials were not certain how  all 9 staff would be divided across the training, oversight, technical  security policy reviews, and other functions within SEPS. A SEPS official  said that 3 of the 9 staff are to be allocated to oversight but noted that  while the additional staff would help, they most likely would still not be  enough to implement an effective classification management program.  However, although DOJ includes SEPS in its departmentwide workforce  analysis, that office has not separately determined the optimal level of  resources needed to administer an effective security program. This is an  important first step to resolving its resource constraints and complying  with ISOO’s recommendations.
In addition, SEPS does not have a strategy that lays out how it can best use  anticipated resources to address the remaining deficiencies ISOO  identified in ways that reduce the most risks to protecting national  security information, such as whether to focus on addressing training,  oversight, or other program gaps first. According to the program manager,  with only 4 staff to cover departmentwide training and oversight issues,  the office had not been able to be more proactive and strategic, achieving  more comprehensive monitoring to prevent problems, and instead had to  be more reactive and address classification concerns as they arose. In  providing technical comments on a draft of the report, DOJ acknowledged  that it has not conducted a formal assessment of the optimal level of  resources SEPS needs to administer the information security program.  DOJ also stated that SEPS identified in budget documents how the   9 additional staff would be allocated to address the remaining deficiencies  identified by ISOO. However, DOJ provided no evidence of SEPS’s strategy  for allocating these additional staff.
Our previous work notes the importance of having a workforce analysis  and developing a strategy to fill staffing gaps, both of which are  characteristic of best practices followed by high-performing organizations.  In A Model of Strategic Human Capital Management, we highlighted the  importance of identifying current and future staffing needs, including the  appropriate number of employees and the correct mix of skills, for  maximizing the value of employees and managing risk. Also, we have  emphasized that an essential element of effective workforce planning is  aligning human capital strategies to eliminate gaps. We have previously  recommended that specific agencies adopt these practices. For instance,  in a 2001 review of the Environmental Protection Agency (EPA), we  recommended that EPA direct its major program offices to perform  workforce analyses and then focus hiring and recruitment to fill any  identified gaps. Similarly, we recommended in 2003 that the Government  Printing Office complete a workforce analysis to identify gaps in skills and  competencies and develop strategies to address any gaps. SEPS might  benefit from adopting these human capital practices as part of a broad  strategy to respond to ISOO’s recommendations.
section_title: The FBI Has Begun to Implement All but One of ISOO’s Recommendations
paragraphs: The FBI has begun or completed actions on all but one of ISOO’s  recommendations to correct several deficiencies ISOO identified in the  FBI’s classification management program. These deficiencies included  outdated policy guides for classifying information, insufficient training and  program oversight, and improper marking of classified information. In its  April 2005 final report, ISOO recommended that the FBI take 12 associated  corrective actions. As of August 2006, the FBI had fully implemented 4 and  had actions under way to implement 7 more, as shown in table 2.
The FBI implemented 3 of ISOO’s recommendations—those addressing  security regulations, self-inspections, and the processing of security  violations—by issuing its Security Policy Manual in December 2005,   laying out responsibilities, policies, and procedures for implementing its  classification management program. For a fourth completed  recommendation—evaluating the effectiveness of security inspections— FBI’s Security Division recently established the requirement that chief  security officers conduct annual self-inspections of their divisions’  classification management programs and that Security Division staff  conduct site visits to provide assistance where the head of the Security  Division or another FBI division deems necessary.
As to the remaining 8 recommendations, the FBI disagreed with 1—to  develop a graduated sanctions system for employees who repeatedly  commit program violations—because it said that its Office of Professional  Responsibility already had a system in place to apply such sanctions.   Upon review of aspects of the sanctions system FBI has in place, ISOO  officials agreed that it responds to this recommendation. The remaining   7 recommendations have been partially implemented, as discussed below.
subsections: section_title: Updated and Completed Classification Program Guidance
paragraphs: ISOO reported that the guides the FBI had in place to help employees  make classification decisions neither contained current information nor  reflected changes in the FBI’s mission, particularly the increase in its  intelligence capacity after the terrorist attacks of September 11, 2001.  ISOO recommended the guides be updated. One had not been revised for   9 years, even though ISOO’s directive implementing the executive order  governing classified information calls for updates at least every 5 years.  Classification guides are key to helping ensure employees have current,  clear, and consistent guidance to make decisions about what information  needs to be protected and restricted and what information can be released  and shared, according to ISOO. FBI had complied with this  recommendation for most of its guides. Security officials stated that  although it had drafted an update of its primary classification guide,  entitled Foreign Counterintelligence Investigations Classification Guide,  it had not yet been issued because ongoing discussions between the FBI  and DOJ’s Office of Intelligence Policy and Review about various  intelligence-related issues will affect the guide’s content. As of August  2006, the FBI officials did not know when these issues would be resolved.
ISOO also found that the FBI lacked a guide for how to declassify  documents, as the executive order requires and recommended that the   FBI develop such a guide and submit it to the Interagency Security  Classification Appeals Panel (ISCAP) for approval. According to FBI  security officials, the guide has been drafted but not issued because the  bureau was responding to panel comments on the draft. This guide is  important because, among other things, it was to formally establish those  exemptions the FBI could use when reviewing records to comply with the  December 31, 2006, automatic declassification mandate. Delays in issuing  the guide and establishing exemptions make it difficult for FBI to have  time to complete its review because of the volume of records it has to  address, which could be as many as 110 million records, according to  bureau estimates. ISOO noted that the FBI has taken positive steps to try  to meet the date, such as drafting its declassification guide, identifying  information that it could present to ISCAP for exemption from the  automatic declassification requirement, and authorizing bulk  declassification of documents. But even with these initiatives, the bureau  could still have up to 30 million records to review, which is why delays in  issuing the guide and establishing exemptions may hinder completion of  this review. As a result, some information that should remain protected  could be available for public release, although the FBI could still try to  reclassify it, deny release to protect individual privacy rights, or deny  release for other reasons, such as to protect the identity of individuals who  provide intelligence information to the government.
section_title: Updated Training on Classification and Marking Procedures
paragraphs: ISOO reported that although the FBI had some very sound training tools  and to some extent provided excellent training, it was not thorough and  offered consistently across the bureau. Specifically, ISOO reported that  the amount and level of refresher training varied considerably among the  FBI divisions, noting that the Counterintelligence and Counterterrorism  Divisions’ training was substantial and met the requirements of the  executive order, in contrast to the Office of Intelligence, which did not  provide adequate training as its refresher training included only a few  minutes on security awareness. ISOO recommended that the FBI ensure  that all employees with security clearances receive sufficient annual  refresher training on the classification program. In response, FBI security  officials stated that the agency has instituted a security awareness  program that includes the refresher training, which is offered continuously  rather than annually. The training is provided through means such as  posting security tips as well as classification and marking materials on the  FBI’s intranet; having chief security officers distribute security awareness  materials to employees; and providing live presentations and webcasts to  all employees on classifying and marking practices. Although FBI has  made this material available, it acknowledged that it does not have a  system in place to track and ensure that all employees have received the  information because, according to FBI, tracking would be administratively  burdensome considering the methods used to convey the information,  which is not consistent with ISOO’s directive. The directive requires  agencies to maintain records of the training programs offered and  employees’ participation in them.
ISOO also noted that the FBI had outdated and insufficient training  materials for those staff who are the primary classifiers of information,  known as original classification authorities. ISOO found that the FBI’s  practice of waiting for these classifiers to contact the Security Division  with questions about their responsibilities does not ensure they have a  complete understanding of their role, as well as the executive order and  implementing directives, and that this was critical since these individuals  determine whether information meets the standards of potential damage  to national security and should be classified. ISOO recommended that the  FBI update this training, and the FBI expects to do so but is waiting until  its classification and declassification guides are issued so that it can cover  them in the training. FBI security program managers point out that more  and more, these individuals are making declassification rather than  classification decisions, and have been getting some training on their  responsibilities for these decisions through one-on-one training, electronic  communications, and participation in related training programs.
In almost half of the 575 classified FBI documents ISOO reviewed, it found  marking errors. For example, ISOO found that portions of 110 documents  (19 percent) appeared to be unnecessarily classified, while another   8 (1 percent) were clearly overclassified. To help eliminate these  discrepancies, ISOO recommended that employees be provided refresher  training on marking requirements and classifiers be trained in the updated  classification guide when implemented. Otherwise, an ISOO official said,  without proper guidance, employees tend to take a conservative approach  and err on the side of classifying information. As we noted, the FBI has  incorporated marking requirements in the refresher training and does plan  to provide training on the new guides.
section_title: Review the Number of Staff with Classification Decision Authority
paragraphs: ISOO also recommended that the FBI review the number, roles, and  responsibilities of those staff with original classification authority to  determine if the number could be reduced. ISOO made this  recommendation, in part, because it found that the percentage of staff  with this authority within the FBI’s Records Management Division, a  support office, was higher than that for other executive branch agencies.  According to FBI security officials, the number of staff with this authority  has been reduced in the Records Management Division and in the FBI as a  whole. However, they said they will still have to re-examine the role of  original classification authorities once the new guides are approved and  issued.
section_title: Review and Update Automated Marking Mechanisms
paragraphs: ISOO also found missing, incomplete, or improper declassification  markings in 176 of the documents (31 percent), but for most of these  documents, about 80 percent, the errors were due to the fact that the FBI’s  automated marking mechanism (computer macro) was erroneously  applying outdated codes that exempted information from being  declassified. ISOO recommended that the FBI review and update its macro  to ensure it is applying current codes, and FBI security officials reported  they are testing updated macros and expect to implement them by the end  of September 2006.
section_title: DOJ Components Lack Specific Guidance, Training, and Oversight to Ensure Proper Designation of Sensitive but Unclassified Information
paragraphs: The five components we reviewed had orders and directives in place to  identify the various types of categories of sensitive but unclassified  information they used and to describe how information should be handled  and protected. However, none of these components had specific guidance  in place to help ensure employees properly designate information as  sensitive. DOJ indicated that it is waiting for the results of a  governmentwide working group that will determine what designations  agencies are to use before considering any modifications to how it  manages this type of information. In addition to a lack of specific  guidance, the components do not have other key internal controls in place  to provide reasonable assurance that designations are being consistently  applied—specifically, formal training on how to make decisions on when  to apply the designations or perform oversight, such as assessments of  how well their practices are working. Having these controls—specific  guidance, training, and oversight—in place is important, considering that  these components share information formally and informally with various  federal and nonfederal entities, such as state and local law enforcement  agencies. Without such controls, errors could occur and materials could  be restricted unnecessarily or information that should be withheld could  be disseminated.
subsections: section_title: DOJ Components Lack Specific Guidance for Sensitive but Unclassified Decision Making
paragraphs: All five DOJ components in our review developed general policy  guidelines, such as orders and directives, in addition to a 1982 order,  Control and Protection of Limited Official Use Information, which  established a departmentwide policy for protecting sensitive but  unclassified information. However, the five DOJ components we reviewed  do not have specific guidance to help employees determine how to apply  their sensitive but unclassified designations. Additionally, our  governmentwide review of agencies’ sensitive but unclassified designation  practices also points to the importance of having formal, written guidance  to give agency personnel a consistent understanding of whether and when  to apply such designations, and we recommended in our March 2006  report that the Office of Management and Budget ensure agencies have  this internal control in place. Written guidance is important because,  according to the Standards for Internal Control in the Federal  Government, information must be communicated in a suitable form and in  a timely manner to those within an organization who need it to carry out  their responsibilities. Furthermore, on the basis of our previous  recommendations, other federal agencies have taken initiatives to enhance  their guidance for their sensitive but unclassified designation processes.  For example, earlier this year, the Department of Energy agreed with a  recommendation we made to clarify its guidance on this subject and said  that it is also planning ways to explicitly define for its employees what  would be an inappropriate application of the sensitive but unclassified  designations so that information is properly designated and handled.  Similarly, in part because of our past recommendation to the Department  of Homeland Security’s Transportation Security Administration, that office  has begun to develop internal guidance that expands its existing  regulations for sensitive security information—a category of sensitive but  unclassified information—by providing personnel with examples of the  types of information that should fall within various categories of sensitive  security information. By taking similar actions, DOJ could reduce the  likelihood of errors and inconsistencies in applying the sensitive but  unclassified designations throughout the department.
The existing policy guidelines for the five components we reviewed do not  provide employees the level of specificity needed to adequately guide their  decision making on applying the designation. For example, in its policy,  the Drug Enforcement Administration’s (DEA) definition of sensitive  information includes any information and materials that are investigative  in nature, critical to the operation and mission of the agency, would  violate a privileged relationship, or have its access restricted by law.  However, the policy provides no explanation, guidance, or examples of the  information that would meet any of these criteria, for instance,  information that could be categorized as critical to DEA’s mission.  Similarly, the FBI’s Intelligence Policy Manual sets forth definitions of  various sensitive but unclassified categories, such as Law Enforcement  Sensitive and For Official Use Only, but does not have specific guidance  for designating documents, such as identifying the criteria for determining  whether text in a document should be Law Enforcement Sensitive  because, for example, it is associated with an ongoing criminal  investigation. Finally, neither DEA nor FBI guidance contains examples of  inappropriate applications of sensitive but unclassified designations.  Without explicit language identifying appropriate and inappropriate use of  the designation, DOJ components cannot be confident that their personnel  are making correct and consistent decisions.
Moreover, the components in our review use five different sensitive but  unclassified designations, as table 3 shows.
Within a single DOJ component, employees could be confronted with  making decisions on the sensitive but unclassified designation that might  involve up to four categories, each with its own unique definition and  safeguarding requirements, yet not have specific guidance on the types of  information that merit each designation. For example, an employee at  DEA can designate information Limited Official Use (LOU), Law  Enforcement Sensitive, or DEA Sensitive (DEA-S), and each has different  requirements. DEA requires administrative controls and additional  safeguards for storage and transmission of DEA-S information that is  equivalent to those for classified information. This means that DEA-S  information must be locked, for example, in a General Services  Administration (GSA)-approved security container when not in the  custody of an individual with a need to know that information. The LOU  category, however, carries less stringent handling requirements that do  not, for example, involve storing documents in a GSA-approved locked  cabinet. Consequently, in such an instance, information that would  warrant the DEA-S protection may not be adequately safeguarded from  unintended disclosure. This underscores the need for employees to have  specific guidance and examples to use to be able to clearly determine  which information should be protected under these categories.
According to DOJ security officials, additional changes affecting the  departmentwide guidance on sensitive but unclassified policies and  procedures have been suspended pending the results of efforts connected  to a December 2005 presidential memorandum. This calls for, among  other things, the development of standardized procedures across the  federal government for designating, marking, and handling sensitive but  unclassified information, in part, to promote effective and efficient use and  sharing of this information. In general, the memorandum requires  executive departments and agencies to inventory and assess their sensitive  but unclassified procedures and determine the underlying authority for  each procedure. For example, it mandated the submission of  recommendations to the President for standardizing sensitive but  unclassified procedures across the federal government for homeland  security, law enforcement, and terrorism information, and the  recommendations are expected by the end of December 2006. Once  governmentwide standards have been established and a final decision is  made on what sensitive but unclassified designations DOJ and its  components will use, it will be important for them to develop specific  guidance for employees that provides them with a clear understanding  about when to apply each designation to ensure information is properly  designated.
section_title: Training and Oversight for Their Designation Programs Are Limited for Selected DOJ Components
paragraphs: Federal internal control standards discuss the need for both training and  continuous program oversight as necessary elements to ensure effective  program implementation. However, training for the sensitive but  unclassified designation process is lacking for the five DOJ components  we reviewed. Although the Criminal Division and DEA offer training on  handling and protecting sensitive but unclassified documents and material  as part of periodic security awareness briefings, this training does not  cover how to decide what information merits the designation. Specifically,  security officials at the Criminal Division reported that the unit’s  classification briefing includes a section on sensitive but unclassified  information. However, this training only provides employees with a  definition of the various categories of information, such as grand jury  information, informant and witness information, and investigative  material, and not specific guidance on how to determine if specific  information qualifies for one of these categories. Similarly, DEA provides  employees computer-based training and briefings but only to convey  information on handling, but not designating, sensitive but unclassified  information. Without such training, employees may be at higher risk of  improperly designating or not designating information as sensitive but  unclassified. We have previously recommended that other agencies  develop training to cover designation of sensitive but unclassified  information, and all have agreed to initiate such training.
In addition to having limited training programs, none of the components  we reviewed have formally established policies and procedures regarding  how they will monitor employees’ appropriate and consistent application  of sensitive but unclassified designations. Federal internal control  standards call for, among other things, ensuring that ongoing oversight— such as self-inspections and supervisory reviews—occurs in the course of  normal operations. The lack of such internal controls over sensitive but  unclassified designations increases the potential that different  components could designate the same information differently without  detecting inconsistencies. Some components told us they rely on their  unit’s periodic security compliance reviews to assess how sensitive but  unclassified information is handled and protected. However, some of these  reviews have been conducted at up to 3-year intervals and, according to  DEA security officials, are not designed to verify the accuracy of  employees’ sensitive but unclassified decisions. On the basis of our  previous work, other agencies have acknowledged the role of effective  oversight procedures for the designation process and have taken actions  to implement our recommendations to strengthen their procedures. For  example, the Department of Defense and the Department of Energy, in  response to our recommendations, have agreed to include oversight  reviews of the sensitive but unclassified process as part of their routine  security oversight assessments. Without similar actions, DOJ does not  have reasonable assurance that the designations are applied accurately  and consistently throughout the department.
The lack of guidance, training, and oversight is of particular concern in   three of the five components we reviewed because these components do  not limit the number of employees who can designate information as  sensitive but unclassified. ATF and DEA restrict those authorized to make  designations to a limited number of senior level employees. At the other  components, however, any employee at any level is authorized to make  these decisions. For example, at the FBI, any employee or contractor in  the course of performing assigned duties may designate information Law  Enforcement Sensitive. Yet in these components, employees do not have  guides to consult and adequate training to help them make decisions on  which information warrants a sensitive but unclassified designation, and  the agencies do not have processes in place to oversee employee decision  making in these instances. This increases the risk of inadvertent disclosure  of information that should be protected or unintentional restriction of  information needed to assist other governmental entities involved in  criminal investigations or antiterrorism activities, or the unwarranted  withholding of information from the public.
section_title: DOJ Components Report Having Processes in Place for Responding to Intragovernmental Information Requests
paragraphs: Information may be shared among federal entities through both formal  and informal channels. One method for sharing information among  Congress, executive agencies, and other federal entities is in response to  formal requests from one federal entity to another. Each of the  components in our review reported having processes in place for  responding to intragovernmental requests for classified and sensitive but  unclassified information, and the processes are consistent with federal  internal control standards, although we did not independently test the  effectiveness of these controls. For example, all of the components have  central offices for receiving intragovernmental requests, involve subject  matter experts in determining whether information can be disseminated,  and conduct supervisory reviews of responses prior to release.
subsections: section_title: DOJ Components Report Having Central Offices for Receiving Intragovernmental Information Requests and Involving Subject Matter Experts in Determining How to Respond
paragraphs: Information may be shared among federal entities through both formal  and informal channels. For instance, four of the DOJ components in our  review reported that their employees share information informally with  their counterparts at other federal agencies as part of everyday operations.  Intragovernmental information requests are another, more formal method  for sharing information. Four of the five components reported having  central offices for receiving such requests from both Congress and  executive agencies. DEA has a central office for receiving congressional,  but not executive agency, requests. The use of central offices is consistent  with federal standards for internal control, which note the importance of  having clearly defined areas of responsibility in an organization. For  example, USMS’s Office of Congressional Affairs receives requests from  Congress, while its Executive Secretariat receives executive agency  requests. After a component’s central office receives a request, it reviews  the request to determine which subcomponent office has the knowledge  necessary to respond and forwards it to that office.
From there, all of the components report using internal subject matter  experts who have the relevant expertise to identify and assess material  that would be used to respond to a request. This is also consistent with  federal internal control standards that discuss the importance of ensuring  that tasks are performed by the right employees. The subject matter  experts rely on various resources as they decide how to respond. For  example, these individuals might consult with other knowledgeable  agency personnel. ATF employees may consult subject matter experts,  such as the Office of Chief Counsel, and USMS staff may consult with the  Office of General Counsel and division security officers.
Subject matter experts may consider several factors as they determine  how to respond to a request, according to program officials at the  components. At ATF, for instance, different factors are taken into account  for different types of information, such as investigative records, tax  information, or criminal informant records. DEA experts consider the  content and sensitivity of the information, how the information will be  used by the receiving entity, and the time frame for providing a response  to determine how to respond to a request. In addition, at the Criminal  Division, subject matter experts use their professional judgment to  determine which factors to consider.
ATF, the Criminal Division, and the FBI reported having documented  processes to guide their staff in responding to intragovernmental  information requests, although these documents do not provide detailed  guidance because components decide on how to respond on a case-by- case basis. For instance, the Criminal Division cited the Departmental  Executive Secretariat Correspondence Policy, Procedures, and Style  Manual as providing written guidelines on responding to  intragovernmental requests, although this manual does not include any  guidance on what factors to consider during the decision-making process  or how to determine whether information may be released to a requester.  According to the components, the response process may differ for various  reasons, such as the nature of the request and the requester’s needs. For  example, for a classified information request, a component may  communicate with the requester to determine if an unclassified version of  the information would satisfy the requester’s information needs.  Therefore, formal written policies may not always be helpful, given the  need for a case-by-case approach to responses.
section_title: All of the Components Report Conducting Supervisory Reviews of Responses
paragraphs: After the subject matter experts have determined how to respond to the  information request, all of the components report conducting a  supervisory review before releasing the response; this corresponds to  federal internal control standards that highlight the importance of  management reviews for achieving effective results. At the FBI, a response  may also undergo a review to determine if the information should continue  to carry any classification or sensitive but unclassified designation after it  is released. DEA and Criminal Division have processes for supervisory  review that may vary depending on the nature of the request, according to  officials at those components. At the Criminal Division, for instance,  designated officials in the division determine who should review the  information based on the nature of the request; reviews may be conducted  by the Section Chief, Office Director, the Chief of Staff, and the Deputy  Chief of Staff, among others. At DEA, the review process varies depending  on which office owns the information that is responsive to the request and  the nature of the request. According to DEA, executive agencies’ requests  that may be satisfied by information that is not sensitive may be approved  by a unit chief, but the release of a response that contains sensitive  information may require the approval of a section chief. Similarly,  responses with highly sensitive information, such as information related to  ongoing investigations or undercover operations, may require the approval  of a senior executive at DEA.
section_title: All of the Components Report Communicating with Requesters during the Response Process, but the Level of Communication Varies by Request
paragraphs: All of the components reported that they communicated with requesters  during the response process, which is consistent with federal internal  control standards that note the importance of communicating with  external stakeholders. Depending on the component, different offices  communicate with requesters. At the FBI, the Office of Congressional  Affairs may contact the congressional committee that requested  information to obtain clarification about what is being requested. At the  Criminal Division and DEA, however, experts within the relevant program  office will contact the requester directly if clarification is needed.  According to DEA officials, if the program office finds that the responsive  information is classified or sensitive but unclassified, it may contact the  requester to determine whether an unclassified or nonsensitive version of  the information would be sufficient. For example, DEA might offer to  provide an overview of an investigation, rather than a detailed description  of the law enforcement techniques used during the investigation. All of the  components reported that they inform requesters if information will be  withheld or redacted prior to release. At the FBI, redacted information is  usually assigned a deletion code, which explains the reason for the  redaction, and according to agency officials, it provides congressional  requesters with a deletion code sheet that describes the reasons for any  redactions.
section_title: Conclusions
paragraphs: DOJ and FBI have made progress in implementing ISOO recommendations  that help to strike a balance between the need to protect and the need to  share critical information. FBI was taking action on almost all of ISOO’s  recommendations, and if it completes them, this will help to lower  program risk, since FBI makes 98 percent of the classification decisions at  DOJ. On the other hand, DOJ’s program will remain at risk until DOJ  addresses the most critical recommendation—providing sufficient  resources. This is important because DOJ sets policy, provides training,  and conducts oversight of classification management across the  department and its components. SEPS’s efforts to resolve staff limitations  by acquiring additional resources through DOJ’s Working Capital Fund  may still not guarantee its needs are met because it is not certain it will get  these resources, and even if it does, the security office does not know the  optimum number of staff resources required to carry out its  responsibilities. Furthermore, DOJ has not provided evidence of how  SEPS will use the anticipated resources to perform various functions or of  SEPS’s strategy for how best to use these resources to address the  remaining deficiencies ISOO identified in ways that reduce the most risks  to protecting national security information, such as whether to focus on  addressing training, oversight, or other program gaps first. Developing a  strategy, based on thoughtful workforce analysis and identification of  gaps, would give SEPS a solid foundation on which to base its resource  decisions to help perform its responsibilities, including implementing the  remaining ISOO recommendations.
Moreover, without policies and procedures to provide specific guidance,  training, and oversight for managing sensitive but unclassified  information, DOJ cannot have reasonable assurance that this information  is properly restricted or disclosed. Although DOJ is waiting for the results  of the interagency working group before proceeding with additional  changes to its program, it is important that DOJ ensures that its sensitive  but unclassified designation practices provide its employees with the tools  they need to apply designations appropriately. These tools include specific  guidance, systematic training, and effective internal controls for  overseeing compliance with policies and guidance. Identifying and  designating documents properly is vital for not only preventing potential  damage to governmental, commercial, or private interests, but also for  sharing information, particularly with law enforcement entities that need it  to protect the homeland.
section_title: Recommendations for Executive Action
paragraphs: To strengthen DOJ’s management of classified information, we  recommend that the Attorney General direct the SEPS director to take the  following two actions:    determine the resource level needed to ensure that it can effectively  carry out the office’s responsibilities, including full implementation of  the ISOO recommendations; and    devise a strategy for making resources available and for using them  most effectively to address remaining deficiencies in ways that reduce  the most risk to proper management of classified information, such as  determining whether to address training, oversight, or other program  deficiencies first.
In addition, to help ensure that sensitive but unclassified designations are  correctly and consistently applied, we recommend that once the  interagency working group has determined the standard set of sensitive  but unclassified designations for the federal government, the Attorney  General ensure that the department and its various components take the  following three actions:    establish specific guidance for applying the designations they will    ensure that all employees authorized to make the designations have  the necessary training before they can designate documents, and    set internal controls for overseeing sensitive but unclassified  designations to help ensure that they are properly applied.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOJ for review and comment. DOJ  provided only written technical comments on the draft, which we  incorporated, as appropriate. In providing these comments, DOJ stated  that it generally agreed with the report and recommendations, and upon  receipt of the final report, it will provide a response to our  recommendations directly to Congress, as required by statute.
As agreed with your office, unless you publicly release its contents earlier,  we plan no further distribution of this report until 30 days from its issue  date. At that time, we will send copies of this report to the appropriate  congressional committees and subcommittees, the Attorney General, and  other interested parties. We will also make copies available to others upon  request. In addition, this report will be available at no charge on the GAO  Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-6510 or larencee@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. GAO staff who made major contributions to this  report are listed in appendix III.
section_title: Appendix I: Summaries of Related GAO Reports
paragraphs: This appendix summarizes the results of several related recently issued  reports on agencies’ programs for sharing classified and sensitive  information and designating information as sensitive but unclassified. In  June 2006, we issued two reports: one on the Department of Defense’s  classification management program and its effectiveness in minimizing  classification errors and the other on the status of the Department of  Energy’s classification management program. We also issued two reports  in March 2006: one on programs to safeguard sensitive but unclassified  information at the Departments of Defense and Energy and the other on  the federal government’s efforts to share terrorism-related and other  sensitive but unclassified information among federal and nonfederal  entities. In June 2005, we issued a report on the designation of sensitive  security information at the Transportation Security Administration. These  reports noted that policies and procedures governing classified and  sensitive information require a number of enhancements to help ensure  the effectiveness of information security programs. The highlights page for  each of these reports is attached for more information.
subsections: section_title: Highlights
paragraphs: Miclassifictio of nationaecritformtio imedeeffective iformtio ring, can provide dversarie with  iformtio to hrm the Uited  Ste and it llie, and imillions of doll voidble dmitrtive co. Areqted, GAO examied (1) whether the imlemetioof the Departmet of Defense’ (DOD) iformtion secritanagemerom, effectivel miimize the rik of  miclassifictio; (2) the etet to which DOD ernnel follow eblihed rocedrefor classifngformtio, to iclde correctlrking classified iformtio; (3) the relibilitof DOD’s annual etimte of its number of classifictio deciions;  and (4) the likelihood of DOD’s meeting automtic declassifictiodedli.
A lck of overht and iconstet imlemetio of DOD’sformtio  ecrit rore icreasng the rik of miclassifictio.  DOD’sformtio ecrit rom i decetrlized to the DOD comt level,  and the Office of the Uder Secretof Defense for Itellice (OUSD(I)),  the DOD office respnsible for DOD’sformtio ecrit rom, has  limited ivolvemet with, or overht of, coms’formtio ecrity pro.  While ome DOD com and their subordinate comman  appr to manage effective ro, GAO idetified wess other the reas of classifictioanagemet trng, elf-inspections, and  classifictio guide.  For exale, trng t 9 of the 19 com ansubordinate comman reviewed did ot cover funmel classifictioanagemericile, such as how to roerlrk classified iformtio  or the rocess for determing the dtio of classifictio. Alo, OUSD(I) doe ot hve  rocess to cofirm whether elf-inspectionsve bee  erformed or to evuate their qualit. O 8 of the 19 coms performed elf-inspections.  GAO o found thome of the DOD  com ansubordinate commantht were examied rotiel do  ot submit coie of their ecrit classifictio guide, docmetio tht  idetifie which iformtio eed rotectio and the reas for  classifictio, to  cetrl libry as reqired. Some did ot trck their  classifictio guide to ensure the were reviewed t least ever   for  crre as reqired.  Because of the lck of overht and wess  trng, elf-inspectio, anecrit classifictio guide managemet, the Secret of Defense cannot be assured tht the iformtio ecrit  rom i effectivel limiting the rik of miclassifictio cross the  departmet.
To redce the rik of miclassifictio and imrove DOD’sformtio ecritertions, GAO i recommeding s ctions, iclding everl to  icreasrom overht anccounbilit. Ireviewing  drft of thi reort, DOD corred with GAO’s recommetions. DOD rovided techicl comme, which we hve iclded as approrite.
GAO’s review of  nprobbilit sale of 111 classified docme from  five office withi the Office of the Secret of Defenshow tht, withi  thee office, DOD ernnel re ot uniforml followingblihed  rocedre for classifngformtio, to iclde mirking.  I   docmet review, GAO qtioed DOD officis’ classifictio deciions for  29—tht i, 26 ercet of the sale. GAO o found tht 92 of the 111  docmexamied (83 ercet) ht least oe mrking error, and more  thanlf hd mltile mrking error.  While the result from thi review  cannot be erlized cross DOD, the re constet with the wess  GAO found i the way DOD imleme itformtio ecrit rom. www.go.gov/cgi-in/getrpt?GAO-06-706.
To view the fll prodct, inclding the cope  nd methodology, click on the link above. For more informtion, contct Dvi M.  D'Agotino t (202) 512-541 or  dgotinod@go.gov.
The cc of DOD’s classifictiodeciiotimtetionable  because of the considerble vriance i how thee etimte re derived cross the departmet, and from r to r.  However, bennng with the  fir 200timte, OUSD(I) will review etimte of DOD  com.  Thi dditional review cold imrove the cc of DOD’s  classifictio deciiotimte if methodoloicl iconstecie re  redced.
section_title: Highlights
subsections: section_title: Highlight of GAO-06-75, report to the Chirmn, Subcommittee on NtionSecrity, Emerging Thre nd Interntionl Reltion, Committee on Government Reform, House of Repreenttive
paragraphs: I rece, the Cngressas become icreasngcocered tht federagcie re miclassifngformtio. Cassified iformtioteril cong national defense or  foreign olicformtio  determied b the U.S. overmet to reqire rotectiofor reasns of nationaecrit. GAO was asked to assss the etet to which (1) DOE’s trng, guidance, and overht ensure tht iformtio  classified and declassified ccording to eblihed criteria and (2) DOE has found docmeto be miclassified.
GAO i recommeding tht DOE coct  imilnumber of classifictio overht review,  imilr deth of anays, as it did before the October 2005 shift irespnsibilit for classifictiooverht; app election procedretht more randomlidetif classified docme for review; and dicloe theelectio rocedrere classifictionspectioreort.
DOE’s Office of Cassifiction’s systemtic trng, comrehensive guidance, and riorous overht roel successl hitor  of ensuring tht iformtioas classified and declassified ccording to  eblihed criteri.   However, an October 200 hift i respnsibilit for  classifictio overht to the Office of Secrit Evuationsas creted uncerty abot whether  hih level of erformance i overht will be  sused.  Specificll, rior to thi hift, the Office of Cassifictioerformed 34 inspections of classifictio ro t DOE ite ce 2000.  Thee inspections reviewed whether DOE ite comlied with agclassifictio olicies anrocedre. After the October 2005 shift, however, the pace of thi overht wasterrupted as classifictiooverht ctivitieceased until Februa 2006.  So fr i 2006, oe classifictio overht reort has bee comleted for two offices at DOE’s  Pante Site i Texas, and work o  ecod reort i under way t for  offices at the SaannaRiver Site i Sth Carolina.  More overht  inspections evuating classifictio ctivity at eiht DOE office re anned for the remder of 2006.  I dditio, ccording to the Director of  the Office of Secrit Evuations, the rocedre for coctingre  overht re till evolving—iclding the number of ite to be inspected and the deth of anays to be erformed.  If the overht inspections panned for the remder of 2006 re comleted, it will demonstrte resutio the pace of overht cocted rior to October 200. However, if thee inspections are ot comleted, or re ot as comrehensive as  the past, the eteand deth of overht will be  dimihed and may result i DOE classifictio ctivitie becoming less relible and more roe to miclassifictio.
DOE agreed with GAO’s three recommetionsasserted it  was lreking ctions and mking ans to ensure tht the classifictio overht rom remns effective. Although GAO icoaged b DOE’s effort, until the agblihe  record of ccomlihmeunder the ew organiztionatrctre, it will ot  be cler whether overht will be as effective as it has bee. www.go.gov/cgi-in/getrpt?GAO-06-75.
To view the fll prodct, inclding the cope  nd methodology, click on the link above. For more informtion, contct Gene Aloie,  202-512-41, loiee@go.gov.
O the bas of review of classified docme erformed dring it 34 overht inspections, the Office of Cassifictio believe tht ver few of  DOE’s docmed bee miclassified.  The departme’s review of more  than 12,000 docme betweeand 200 uncovered 20 docme tht  hd bee miclassified—less thane-th of 1 ercet.  DOE officibelieve tht it miclassifictiote i reasnable ive the le volme of  docme rocessed.  Mot miclassified docme remed classified, jusot t the approrite level or cteor.  Of reter cocer re the  everl docme thhold hve bee classified bt mike were ot. Whe mike ot classified, such docmeayup librrie or  o DOE Web ite where the cold revel classified iformtio to the  public.  The o otble hortcomings we idetified i thee inspections were the iconstet way the Office of Cassifictio te elected the  classified docme for review anilre to dequatel dicloe therocedre their reort.  Inspectio teunfettered ccess whe  electing docme to review ome ite, bt other thereviewed docme from collections reelected b ite offici.  Office of  Cassifictio reort do ot dicloe how docme were elected for  review.
section_title: Highlights Highgg lighgg thh s
subsections: section_title: What GAO Recommends What GAO Recommends
paragraphs: GAO mde everl  GAO mde everl recommeaa ions forff DOE and recommetions for DOE and  DOD to clrif their olicie to their olicie to DOD to clrifff assure the consteapplictio of  assure the consteapaa plictioof  OUO and FOUO degnations and  OUO and FOUO degnaaa ions and icrease the level of managemet  icrease the level of managemet overht i their use.  overht itheir use.
While both DOE and DOD offer trng their OUO and FOUO olicie,  While both DOE and DOD offer trng their OUO and FOUO olicie,  either DOE or DOD has an agwide reqiremet tht emloeebe either DOE or DOD has an agwide reqiremet tht emloee be  tred before the degnate docme as OUO or FOUO.  Moreover, tred before the degnate docme as OUO or FOUO.  Moreover,  either ag coct overht to assure tht iformtio  either agcoct overht to assure tht iformtio  approritelidetified and mrked as OUO or FOUO. According to  approritel idetified and mrked as OUO or FOUO.  According to  Stanrds for Iternal Cotrol ie Federl Governm, trng anStanrds for Iternal Cotrol ie Federl Governm, trng and  overht re imortant elemecreting a good iternal cotrol overht re imortant eleme creting  ood iternal cotrol  rom.  DOE and DOD offici told us tht limited rerce, and i the  rom.  DOE and DOD offici told us tht limited rerce, and i the case of DOE, the ewss of the rom, haa e cotribted to the lck of case of DOE, the ewss of the rom, hve cotribted to the lck of  trng reqqq ireme and overht.  Noetheless, the lck of trng trng reqireme and overht.  Noetheless, the lck of trng  reqiremes and overht of the OUO and FOUO roleve DOE and  reqireme and overht of the OUO and FOUO ro leve DOE and  DOD offici unable to assure tht OUO and FOUO docme re mrked  DOD officiunable to assure tht OUO and FOUO docme re mrkedff and handled i anner constet with ag olicies and may res and handled i anner constet with ag olicie and may result i lt iaa constecies and errorthe applictioof the ro. iconstecie and error the applictio of the ro.
DOE and DOD agreed with mot of  DOE anaa DOD agreed with mot of GAO’s recommetions, bt  GAO’s recommetions, bpartill disagreed with it  partrr illdisagreed with itrecommetio to eriodicll  recommetioto eriodicll  review OUO or FOUO iformtio.   review OUO or FOUO ifoff rmaa io. DOD o disagreed thernnel  DOD o disagreed thaa pernnel degnating  docmeas FOUO  degnating a docmeas FOUO hold o mrk it with the  hold o mrk it with the applicble FOIA eemtio.  applic aa ale FOIA eemtio. www.go.gov/cgi-in/getrpt?GAO-06-69. www.go.gov/vv cgi-in/getrpt?GAO-06-69.
To view the fll prodct, inclding the cope  To view the fll prodct, inclding the cope nd methodology, click on the link above.  nd methodology, click on the link above. For more informtion, contct  Dvi  For more informtion, contct  Dvi  D'Agotino t (202) 512-541 or Gene Aloie  D'Agotino t (202) 512-541 or Gene Aloit (202) 512-41.  t (202) 512-41.
section_title: Highlights
subsections: section_title: Highlight of GAO-06-5, report to congressionl requter
paragraphs: A number of iititive to imrove iformtio ring ve beelled for, iclding the HomelanSecritAct of 2002 and ithe Itellice Reform and Terrorim  Prevetio Act of 2004. The 2002 ct reqired the develomet of  olicie for ring classified annsitive bunclassified homelanecritformtio. The 2004 ct clled for the develomet of an Iformtio Sring Eviromet for terrorim iformtio.
Thi reort exami (1) the us of effort to ebliovermet- wide iformtio ring olicies anrocess and (2) the univere of nsitive bunclassified degnations used b the 26  agcie tht GAO surveed and their relted olicie anrocedre.
More than fter Stember 11, the natio till lck overmetwide olicies anrocess to hel agcietete the mrid of ongoing effort, iclding the agititivewe idetified, to imrove the ring of terrorim-relted iformtio tht i criticl to rotectingr homeland.  Rspnsibilit for creting theolicie anrocess hifted iitill from  the White House to the Office of Managemeand Bet (OMB), and the  to the Departmet of HomelanSecrit, be has et comleted the  task. Sueqtl, the Itellice Reform Act clled for cretio of an  Iformtio Sring Eviromet, iclding overng olicie anrocess for ring, an rom manager to overee it develomet. I  December 200, the Preidet clrified the role and respnsibilitie of the  rom manager, ow under the Director of Ntional Itellice, as well  as the ew Iformtio Sring Cuncil and the other agcie support of creting an Iformtio Sring Eviromet b December 2006. At the time  of or review, the rom manager was the erl ag of ddressng thiante. He issued anterim imlemetio reort with specified  tas and mileto to CngressJanua 2006, boo fter annunced  hi regnatio. Thitettemt to eblian overll iformtio- ring rod map under the Director of Ntional Itellice, if it i to  succeed oce  ew manager i appoited, will reqire the Director’s  cotinued viilance i moitoring roress towrd meeting kemileto, idetifng anyrrier to chieving them, and recommeding any ecessachang to the overht committee.
To rovide for iformtio-ring policie anrocedre, GAO  recomme tht the Director of Ntional Itellice (DNI) assss proress, ddressrrier, anroe chang, and tht OMB work with agcien policie, rocedre, and cotrol to help achieve more ccounbilit. OMB said tht oce ODNI comleted itwork, OMB wold work with ODNI  anll agcien additionateps, if eeded. ODNI declied to commet or reort, idicting tht the subject mtter iide GAO’s purview. We disagree with thi assssmet because it does not cctel reflect the coe of GAO’s tory authoritie.
The agcie tht GAO reviewed re usng 56 differensitive bunclassified degnations (16 of which belong to oag) to rotect iformtio tht the deem criticl to their missions—for exale, nsitive  w or drugforcemet iformtio or cotrolled nucler iformtio. For mot degnations there re overmetwide olicie or rocedre tht  decribe the bas which an agy shold assgn  ive degnatio and  ensure tht it will be used constetlfrom oag to another. Withosuch olicie, ech ag determi wht degnations anassocited olicie to app to the nsitive iformtio it develops or re. More thanlf the agcie reorted chlleng ring such iformtio. Finall, mot of the agcie GAO reviewed hve olicie for determing  who and how many emloee hold hve authorit to mke nsitive bunclassified degnations, roviding them trng how to mke thee  degnations, or erforming eriodic review to determie how well their ctices are working. The lck of such recommeded iternal cotrolcreas the rik tht the degnations will be misapplied. Thi cold result  i either unnecessaril retricting teri tht cold be red or  nadvertetl releasngteri thhold be retricted. www.go.gov/cgi-in/getrpt?GAO-06-5.
To view the fll prodct, inclding the cope  nd methodology, click on the link above. For more informtion, contct Dvid Powner,  202-512-926, pownerd@go.gov or Eileen  Lrence, 202-512-6510, lrencee@go.gov.
section_title: Highlights
subsections: section_title: What GAO Recommends
paragraphs: TSA o lck dequate iternal cotrol to rovide reasnable assuance  tht it SSI degnatio rocess being constetl applied cross TSA.  Specificll, TSA has ot eblihed and docmeted olicie and iternal  cotrol rocedre for moitoring comliance with the regutions, olicie,  anrocedre overng it SSI degnatio rocess, icldingngoing  moitoring of the rocess. TSA offici told us tht it ew SSI Prom  Office will ltimtel be respnsible for ensuring thff re constetl  appng SSI degnations. Thi office, which wasblihed i Februa, will o develo and imlemell TSA olic cocerng SSI  handling, trng, anrotectio. More detiled iformtio how thi  office’s ctivitie will be oertionalized was ot et ilble. Specificll,  TSA offici rovided o writte olicie formlizing the office’s role,  respnsibilitie, anauthorit.
GAO recomme tht the  Secret of HomelanSecrit  direct TSA to eblih cleguidance anrocedre for usng  the TSA regutions to determie  wht constitte SSI; eblicler respnsibilit for the  idetifictio and degnatio of  SSI iformtio; eblih iternal  cotrol moitoring comliance  with it SSI regutions, olicie,  anrocedre, and communicte  tht respnsibilit for  imlemeting the cotrol  throughot TSA; anrovide  specilized trng to thoe  mking SSI degnations how  iformtio to be idetified and  evuated for SSI us. The  Departmet of HomelanSecrit  erll corred with or  recommetions.
TSA has ot develoed olicie anrocedre for roviding specilized  trng for ll of it emloeeking SSI degnations how iformtio   idetified and evuated for rotected us. Develomet of such  trng for SSI degnations eeded to helnsure constet  imlemetio of the degnatio authorit cross TSA. While TSA has  rovided  trng briefing SSI regutions to cert ff, such as the  FOIA ff, it doe ot hve specilized trng ce to instrct  emloee how to constetl degnate iformtio as SSI. I dditio,  TSA has o writte olicie idetifng who i respnsible for ensuring tht  emloee com with SSI trng reqireme. www.go.gov/cgi-in/getrpt?GAO-05-677.
To view the fll prodct, inclding the cope  nd methodology, click on the link above.  For more informtion, contct Laurie E.  Ektrnd t (202) 512-777 or  ektrndl@go.gov.
section_title: Appendix II: Objectives, Scope, and Methodology
paragraphs: This report responds to the following questions:  1.  To what extent has the Department of Justice (DOJ) implemented the  Information Security Oversight Office’s (ISOO) recommendations?  2.  To what extent has the Federal Bureau of Investigation (FBI)  implemented ISOO’s recommendations?  3.  What policies, procedures, and internal controls are in place in  selected DOJ components to properly use sensitive but unclassified  designations?  4.  What processes are in place at selected DOJ components respond to  intragovernmental requests to share national security and sensitive but  unclassified information?
To determine the extent of changes DOJ and the FBI have made to  implement ISOO’s recommendations, published in July 2004 and April  2005, we reviewed the results of ISOO’s audits; obtained supporting  documents, when available, such as DOJ and FBI policy directives, orders,  and guidance; and interviewed DOJ and FBI managers responsible for  implementing and overseeing these programs. Although the results of  ISOO’s reviews are not necessarily generalizable to all classified  documents at DOJ and the FBI, we assessed the methodology ISOO used  to conduct its reviews and determined that it is adequate to support its  recommendations. We also compared ISOO’s recommendations and DOJ’s  and FBI’s classified information practices to Executive Order 12958, as  amended; ISOO’s Directive No. 1, entitled Classified National Security  Information; and our Standards for Internal Control in the Federal  Government, as appropriate. We did not assess the effectiveness of the  security education and training programs at DOJ and the FBI.
To determine the extent of policies, procedures, and internal controls that  selected DOJ components have in place for designating information as  sensitive but unclassified, we used our Standards for Internal Control in  the Federal Government to provide criteria against which we assessed  components’ sensitive but unclassified designation policies and  procedures. Moreover, we reviewed DOJ-specific data collected as part of  GAO’s governmentwide review of 26 agencies’ programs on sensitive but  unclassified information. These data consisted of written responses to a  set of questions about the agencies’ policies, procedures, and internal  controls and any written documentation provided in support of these  responses, such as policy and training manuals. We selected the five DOJ  components included in this review—Bureau of Alcohol, Tobacco,  Firearms and Explosives; Criminal Division; Drug Enforcement  Administration; the FBI; and U.S. Marshals Service—because data  collected as part of a GAO governmentwide review of sensitive but  unclassified information indicated that each of these DOJ components had  adopted one or more of this type of designation in addition to the  departmentwide Limited Official Use designation. We conducted follow-up  interviews with security officials and senior program officials in these five  components to supplement information gathered as part of GAO’s  governmentwide review. We also examined individual components’  written policies and procedures on sensitive but unclassified information,  when available.
To determine how selected DOJ components respond to federal  intragovernmental requests for classified and sensitive but unclassified  information, we obtained documentation of their response processes from  the five components, when available, and interviewed security officials  and senior program officials. We compared their processes for responding  to these requests to identify similarities and differences within and across  the components and reviewed supporting documents, when available. We  did not independently test the effectiveness of the processes components  described to us.
We conducted our work from June 2005 through August 2006 in  accordance with generally accepted government auditing standards.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Glenn Davis, Assistant Director;  Cynthia Auburn; Kathryn Godfrey; David Hudson; Thomas Lombardi;   Mary Martin; Terry Richardson; and Susan Tieh made key contributions to  this report.