Managing Sensitive Information: Actions Needed to Prevent Unintended Public Disclosures of U.S. Nuclear Sites and Activities
Released: 2009-12-23T00:00:00

Letter

Background

Under its Safeguards Agreement with IAEA, the United States submitted a list of civilian nuclear facilities—primarily civilian nuclear power reactors. The Additional Protocol, a separate agreement between the United States and IAEA, supplements the United States’ Safeguards Agreement with IAEA. Under the Additional Protocol, the United States must provide IAEA with a broader range of civilian nuclear and nuclear-related information than that required under the Safeguards Agreement, such as the manufacturing of key nuclear-related equipment; research and development activities related to the nuclear fuel cycle; the use and contents of buildings on a nuclear site; and exports of IAEA-specified, sensitive nuclear-related equipment. The United States must also provide IAEA with access, through on-site inspections, to resolve questions relating to the accuracy and completeness of the information. As a nuclear weapon state party to the Treaty on the Non-Proliferation of Nuclear Weapons, the United States is not obligated by the Treaty to accept IAEA safeguards or to implement an Additional Protocol. However, according to U.S. officials, voluntarily adopting the Additional Protocol underscores U.S support for IAEA’s strengthened safeguards system and makes efforts to encourage more countries to adopt the Additional Protocol more effective and credible.

In its act implementing the Additional Protocol, Congress prohibited the inclusion of certain information: any classified information; any information that would be deemed restricted data under the Atomic Energy Act; and any information of direct national security significance regarding any location, site, or facility associated with activities of the Department of Defense or DOE. The act also provided that information collected for the purposes of the Additional Protocol would be exempt from disclosure under 5 U.S.C. § 552, which is the Freedom of Information Act. Figure 1 shows a timeline of the U.S. implementation of the Additional Protocol.

The U.S. government classifies information that it determines could damage the national security of the United States if disclosed publicly. Beginning in 1940, classified national defense and foreign relations information has been created, handled, and safeguarded in accordance with a series of executive orders. Executive Order 12958, Classified National Security Information, as amended, is the most recent. It demarcates different security classification levels, the unauthorized disclosure of which could reasonably be expected to cause exceptionally grave damage (Top Secret), serious damage (Secret), or damage (Confidential).

Federal agencies also place dissemination restrictions on certain unclassified information. Federal agencies use many different designations to identify this type of information. For example, DOE uses the designation OUO, while State uses SBU. According to a May 2009 presidential memorandum, there are more than 107 unique markings and over 130 different labeling or handling processes and procedures for documents that are unclassified, but are considered sensitive. For example, according to DOE officials, although OUO information is less sensitive than classified information, OUO information may be shared with people lacking security clearances provided that officials determine they have a “need to know.” These restrictions are used to indicate that the information, if disseminated to the public or persons who do not need such information to perform their jobs, may cause foreseeable harm to protected governmental, commercial, or privacy interests. Such information includes, for example, sensitive personnel information, such as Social Security numbers and the floor plans for some federal buildings. It may also include information exempted from disclosure under the Freedom of Information Act.

Each of the Federal Agencies and Offices Involved in Preparing and Publishing the Draft Declaration Shares Some Responsibility for Its Release to the Public

While no single U.S. government agency or office was entirely responsible for the public disclosure of the draft declaration, all of the agencies and offices involved in preparing and publishing the draft declaration share some responsibility for its public release. We identified several points during the life cycle of the draft document where problems occurred. Specifically, we found that opportunities to improve the secure handling of the document were missed because of the absence of clear interagency guidance, different procedures across the agencies governing the handling and marking of sensitive documents, poor decision making, and a lack of training and adequate security awareness. These missed opportunities occurred between February 2008 and May 2009. Several U.S. government agencies played key roles in preparing and making important decisions regarding the publication of the draft declaration: DOE, Commerce, State, NRC, the White House (the National Security Council and Executive Clerk’s Office), the U.S. House of Representatives (Office of the Parliamentarian, Office of Security, and the Clerk’s Office), and GPO. Figure 2 is a two-page summary of key dates and events that occurred during the life cycle of the draft declaration, leading up to its inadvertent public release on May 7, 2009.

DOE, NRC, and Commerce Began Collecting Information on Civilian Nuclear Sites to Be Included in the Draft Declaration in Early 2008

After the President signed an executive order in February 2008 to implement the Additional Protocol, DOE, Commerce, and NRC began collecting information on nuclear sites, facilities, and activities to be included in the draft declaration. DOE collected information from national laboratories and nuclear weapons production facilities. NRC, which regulates the civilian use of nuclear materials, collected information from NRC-licensed nuclear facilities, including four civilian nuclear power plants previously selected by IAEA for the application of safeguards. DOE and NRC provided nuclear-related information to Commerce on January 15, 2009, and March 18, 2009, respectively. Commerce collected information from private nuclear-related industries not regulated by DOE or NRC, such as the location, operational status, and production capacity of conventional uranium mines. Commerce then consolidated all nuclear- related information from its offices, as well as from DOE and NRC, into a draft U.S. declaration for final interagency approval and transmittal to State. The process for collecting and consolidating this information from the three agencies took several months.

Commerce, in consolidating and formatting the information in the draft declaration, did not mark the document with an official U.S. government security marking. The only marking on the draft declaration was IAEA’s designation on the top of the document—“Highly Confidential Safeguards Sensitive”—which has no legal significance in the United States. To consolidate and properly format the information, Commerce established and managed a central database, known as the U.S. Additional Protocol Reporting System (APRS). IAEA provided a software program for this database that standardizes the information sent to IAEA by each member state and helps IAEA assess the completeness of the information. Before transmitting data to Commerce or adding data to the APRS, each agency reviewed the information it collected for accuracy, data consistency, and national security concerns. Each agency also reviewed the information to ensure that no classified information was being disclosed. The agencies had agreed that the information in the U.S. declaration would not be classified, as required by the U.S. Additional Protocol Implementation Act; that an unclassified database could be used to process the information; and that the data were sensitive and would be restricted to authorized personnel only.

When Commerce and NRC added information to APRS, IAEA-supplied software automatically marked the top of each page of the draft declaration as “Highly Confidential Safeguards Sensitive.” IAEA uses this designation to ensure the document’s appropriate handling and control. According to IAEA officials, Highly Confidential Safeguards Sensitive information is the agency’s highest classification level. This type of information, if released, could cause grave damage to IAEA interests. When IAEA receives a document from a country with this classification, it cannot publicly disclose the information in the document because, in some instances, its release could disclose confidential business information, create potential security issues, or identify reporting discrepancies between countries. Distribution of this information is limited and released on a need-to-know basis. Since this IAEA marking has no legal significance in the United States, DOE, Commerce, and NRC treated the information as OUO. These agencies use OUO markings to provide a warning that information in a document is sensitive and is generally only to be released to those with a need to know, regardless of their security clearance.

DOE, NRC, and Commerce took steps to safeguard the information that each contributed to the draft declaration. Specifically, before DOE and NRC submitted data to Commerce in January and March 2009, respectively: DOE marked the top and bottom of each page it submitted to Commerce with nuclear information from the national laboratories and production facilities as OUO and added a statement that the information may be exempt from public release under the Freedom of Information Act.

NRC officials hand carried a compact disc containing its nuclear-related information to Commerce, rather than electronically sending the information.

Commerce officials also safeguarded the information by password protecting APRS and sending State the draft declaration through secure e- mail that included a transmittal letter explaining that the contents were considered OUO. In addition, they hand carried a compact disc to State that was marked with “For Official Use Only/Not For Public Release/IAEA Highly Confidential Safeguards Protected” hand written on the disc.

Although each agency designated the information it contributed as OUO, the document—which was produced from each agency’s contributions— did not have any U.S. government security markings. The agencies reviewed the draft declaration multiple times, but no agency marked the pages containing information it had contributed to the full draft declaration as OUO. Once all the information was consolidated, the 266- page document was not marked OUO or any other security designation recognized in the United States that would have clearly indicated that the data were sensitive, restricted to authorized personnel only, and not releasable to the public. The only OUO markings were next to site diagrams of two DOE facilities found on two different pages of the draft declaration.

According to Commerce officials, while the IAEA software template automatically adds the IAEA designation, it does not add a U.S. security designation to the top and bottom of each page and does not allow Commerce to modify the IAEA designation or add U.S. security markings. They stated that the only way to mark the draft document as OUO would have been to print out each page, stamp the U.S. designation by hand, and then scan the document back in as a new electronic file. Furthermore, according to DOE officials, the agencies wanted to submit a draft declaration to Congress that was identical to the final declaration submitted to IAEA. Providing Congress with a draft declaration that had both the IAEA and U.S. security markings would not have been an exact representation of the declaration sent to IAEA. However, there were no requirements in the U.S. Additional Protocol Implementation Act binding U.S. agencies to submit a declaration free of any additional U.S. security markings.

Even after Commerce circulated the draft declaration to DOE, NRC, and the Department of Defense for a final interagency review in late March 2009 to ensure no information of national security significance was included in the draft before submission to State, agency officials did not raise any concerns about the draft declaration’s lack of a U.S. security designation. According to DOE, Commerce, and NRC officials, they assumed that the draft declaration would never be publicly released and that, once delivered to IAEA, it would be properly safeguarded. As a result, they saw no need to add an additional U.S. government security marking.

In Mid-April 2009, Commerce Sent the Draft Declaration to State for Transmittal to the White House

Commerce sent the consolidated draft declaration to State on April 17, 2009. State prepared the draft declaration for transmittal to the White House. In completing the draft declaration for transmittal, State prepared a letter to the National Security Council asking it to treat the contents of the draft declaration as SBU. Unlike DOE, Commerce, and NRC, State does not use the OUO designation, but rather the SBU designation. State’s guidance governing the use and handling of SBU documents is similar to that of the other agencies for handling OUO. State also prepared a draft message from the President to Congress that would accompany the draft declaration. In describing the purpose and contents of the document and the classification level of the information, State wrote in the draft presidential message, “the IAEA classification of the enclosed declaration is ‘Highly Confidential Safeguards Sensitive’; however, the United States regards this information as ‘Sensitive but Unclassified’.” The two-page transmittal letter described the contents of the draft declaration and the top and bottom was clearly marked SBU, accompanied by a footnote explaining that the draft declaration was exempt from disclosure under the Freedom of Information Act.

State completed its review of the draft declaration and accompanying transmittal documentation in mid-April 2009 and sent the “package” to the Executive Secretary of the National Security Council on April 30, 2009.

The White House’s National Security Council and Executive Clerk’s Office Did Not Provide Explicit and Clear Instructions on How to Safeguard the Draft Declaration When It Sent the Document to Congress

In early May 2009, the National Security Council completed its review of the draft declaration and presidential message and provided the documents to the Executive Clerk of the White House for transmission to Congress. The National Security Council, which reviewed these documents on behalf of the White House, did not add explicit and clear instructions in the presidential message on how to handle the draft declaration, such as whether or not it should be published, when it sent the documents to the White House Clerk’s Office, which transmitted the documents to Congress. The National Security Council also did not include a transmittal letter, as other executive branch agencies had, with instructions on how to handle the draft declaration. Attorneys from the Office of the White House Counsel provided two reasons why the National Security Council did not feel it was necessary to take these additional measures to protect the document from disclosure. First, counsel stated that they did not think Congress would publish the report and the National Security Council and the Executive Clerk’s Office followed their standard practice for transmitting unclassified documents, which does not involve using a transmittal letter or modifying text in the presidential message. However, attorneys from the Office of the White House Counsel did not provide us with any written guidance on how these offices usually handle documents that are unclassified, but are considered sensitive, such as those marked SBU, and should not be publicly released. In addition, attorneys from the Office of the White House Counsel told us that the Executive Clerk’s Office does not have written guidance on how it transmits documents to Congress. Second, counsel pointed out that the draft declaration was an unusual and unique document because it was the first time that the United States had prepared a draft declaration and submitted it to Congress. “The IAEA classification of the enclosed declaration is ‘Highly Confidential Safeguards Sensitive;’ however, the United States regards this information as ‘Sensitive but Unclassified.’ Nonetheless, under Public Law 109-401, information reported to, or otherwise acquired by, the United States Government under this title or under the U.S.- IAEA Additional Protocol shall be exempt from disclosure under section 552 of title 5, United States Code.”

The language in the presidential message prepared by State and used by the National Security Council did not clearly and explicitly state that the information was not to be published, and the additional legal citations did not clarify how to handle the document.

According to attorneys from the Office of the White House Counsel, the White House clerks who transmitted the document to Congress read the presidential message and noticed its reference to the draft declaration as SBU. However, while the White House clerks have security clearances and have received training on how to handle unclassified, sensitive, and classified documents, they do not normally see SBU documents and did not have the authority or responsibility to determine whether Congress could print the document. Attorneys from the Office of the White House Counsel told us the draft declaration was an unusual and unique document because of the IAEA classification markings and the reference to the information as SBU.

The White House clerks transmit only unclassified documents. The National Security Council does not transmit documents that cannot be printed, such as classified documents, to the White House clerks. Instead, the National Security Council transmits those documents directly to congressional committee staff with the appropriate clearances. Because the clerks received the draft declaration from the National Security Council, the clerks transmitted the presidential message and the draft declaration to Congress just as they had received it from the National Security Council—without a transmittal sheet or SBU markings on the top or bottom of any page.

Congressional Offices That Reviewed and Transmitted the Draft Declaration Determined Incorrectly That the Document Could be Published

Congressional offices that reviewed and then transmitted the draft declaration to GPO for publication—the House of Representatives’ Office of the Parliamentarian and Clerk’s Office—determined, incorrectly in our view, that the document could be published. The draft declaration passed through several congressional offices. First, on May 5, 2009, the Executive Clerk of the White House formally delivered the presidential message and draft declaration while the House was in session. The Parliamentarian read the presidential message and decided the message should be referred to the House Committee on Foreign Affairs and ordered it printed as a House of Representatives document. The Parliamentarian told us that while he received security training on classification issues, he did not recall ever seeing a presidential message that just mentioned the SBU designation and did not know how that type of information should be safeguarded. The Parliamentarian believed that the draft declaration could be published because it was unclassified. According to the Parliamentarian, sensitive and classified messages and documents are usually not delivered to the floor of the House, but rather are transmitted by secure courier and referred directly to the appropriate committee for handling and storage. In addition, while the Parliamentarian read the presidential message—the one-page message from the President to Congress that described the purpose and contents of the draft declaration—he did not read the draft declaration, which listed U.S. civilian nuclear sites and activities. Staff in the Office of the Parliamentarian do not routinely read enclosures accompanying a presidential message, according to the House Parliamentarian.

Second, the Office of the Parliamentarian gave the document to the House of Representatives’ Clerk’s Office to process it for referral to the House Committee on Foreign Affairs and prepare it for transmission to and publication by GPO. After reading the President’s message and seeing the IAEA markings on the draft declaration, the Executive Communications Clerk, who works in the Clerk’s Office, told us she was confused about the classification level of the document and whether it could be published. As a result, the Clerk locked the document in a safe while she sought clarification and guidance from the following sources before sending the draft declaration to GPO for publication: The Journal Clerk in the House of Representatives’ Legislative Operations Office. On May 5, 2009, this clerk had received the documents from the Office of the Parliamentarian and stamped the documents acknowledging receipt from the White House before providing the documents to the Executive Communications Clerk. According to the Executive Communications Clerk, the Journal Clerk told her she could print the document because it was unclassified.

The House of Representatives’ Security Office. The Security Office Director reviewed the document on May 5, 2009, but did not take custody of it or make inquiries on its proper handling and safeguarding. Instead, the Security Office Director told the Executive Communications Clerk to obtain clarification from IAEA—incorrectly assuming that IAEA was the classifier of the document—and the White House Clerk’s Office. The Security Office stated that it was not required to take custody of the document and the Executive Communications Clerk did not request that the Security Office store the document or help her in contacting the agencies and offices that transmitted the document. However, the Security Office did not raise concerns with the House Clerk’s Office about publicly releasing 266 pages of information on U.S. nuclear sites and activities and, in our view, missed an opportunity to be more directly involved in ensuring that the document was not publicly released without explicit authorization from the agencies that designated the information as SBU.

An IAEA official located in New York. According to the Executive Communications Clerk, this official told her on May 5, 2009, that IAEA member states have discretion on how to treat information provided to IAEA and publication of the declaration is a decision left to each member state. In July 2009, we interviewed IAEA officials in the Department of Safeguards in Vienna, Austria. This department is responsible for reviewing all Additional Protocol agreements between the agency and member states. These officials told us that the Executive Communications Clerk received correct information from IAEA’s New York office, but the appropriate inquiry should have been directed to their office in Vienna.

The White House Clerk’s Office. The White House Clerk’s Office and the Executive Communications Clerk disagreed in their recollections of the advice the White House clerk provided to the House of Representatives. According to attorneys from the Office of the White House Counsel, the White House Clerk’s office told the Executive Communications Clerk that the document was unclassified but did not make a legal judgment or provide any advice on whether the document should be printed. However, according to the Executive Communications Clerk, the White House Clerk’s office referred her to the penultimate paragraph in the presidential message stating that the United States regards the information as SBU as justification for printing the document. According to the Executive Communications Clerk, the White House Clerk’s justification for going forward with the printing was that the document was unclassified.

On the basis of advice from these various offices, on May 6, 2009, the Executive Communications Clerk ordered GPO to print the presidential message and the draft declaration.

GPO Did Not Raise Concerns about Publishing the Draft Declaration

GPO, which edited and processed the document for publication, did not raise any concerns about the document’s sensitivity. On May 6, 2009, GPO received a request from the House of Representatives’ Executive Communications Clerk to print the presidential message and draft declaration by 7:00 a.m. on May 7, 2009. The transmittal page from the Clerk did not include any special handling instructions and ordered the documents to be printed. The presidential message, which contained the language that the contents of the draft declaration should be treated as SBU, was typeset and proofread twice by GPO production employees. According to an August 2009 GPO Inspector General’s report, GPO production employees are not required to read and proof for meaning, but merely to check for proper characters and format. The 266-page draft declaration was digitally scanned, rather than typed and proofread. While “Highly Confidential Safeguards Sensitive” was marked on nearly every page of the draft declaration, the GPO Inspector General found that no GPO employees raised any concerns during the processing of the document. According to the GPO Inspector General’s report, GPO employees who reviewed the scanned copy looked for page numbers and format, without proofreading or reviewing the document text or markings.

GPO officials told us that GPO rarely prints sensitive or classified documents. They told us that GPO relies on its customers to identify sensitive documents and notify it of special instructions, given the high volume of print requests. However, the August 2009 GPO Inspector General’s report found that GPO does not have procedures for identifying potentially sensitive documents and safeguarding them. In addition, most employees had not received education or training for recognizing or identifying sensitive documents or information.

Although the GPO Inspector General found no wrongdoing on the part of GPO or its employees, it made several recommendations to improve GPO’s process for handling sensitive information and preventing the inadvertent disclosure of such information in the future. These recommendations included establishing a protocol with customer agencies on clearly identifying sensitive information that may be published and developing written procedures for handling such information; establishing written procedures for verifying any requests for publishing documents that are clearly identified or marked as being of a sensitive or otherwise restricted nature; updating GPO guidance to define “sensitive information” and how to specifically recognize, mark, and safeguard such information; and developing and conducting ongoing training of GPO employees on how to recognize, handle, and safeguard sensitive information and documents.

During the course of our review, officials from several of the federal agencies and offices told us that it would be helpful if there was a standardized marking system for documents that are sensitive but are unclassified. In fact, the term sensitive but unclassified was very confusing for several officials who handled the draft declaration. To help clarify, a May 2008 presidential memorandum had adopted the phrase “Controlled Unclassified Information” (CUI) as a single designation for all information previously labeled SBU or with another similar marking. This memorandum also charged the National Archives and Records Administration with implementing a framework for CUI terrorism-related information, which is not expected to be in place until 2013. Despite these efforts, a May 27, 2009, presidential memorandum found that there is still no uniformity across federal agencies on rules to implement safeguards for information that is deemed SBU. The memorandum noted that agencies use SBU as a designation for federal government documents and information that are sufficiently sensitive to warrant some level of protection, but that do not meet the standards for national security classification. With each agency implementing its own protections for categorizing and handling SBU material, the memorandum stated that there are more than 107 unique markings and over 130 different labeling or handling processes and procedures for SBU information. The 2009 memorandum directed the creation of a Task Force to review agencies’ current procedures for categorizing and sharing SBU information, to track the progress federal agencies are making to implement the framework for CUI terrorism-related information, and to recommend whether the CUI framework should be extended to apply to all SBU information.

Public Release of Draft Declaration Does Not Appear to Have Harmed National Security, According to DOE, NRC, and Commerce Officials

The inadvertent public release of the draft declaration of civilian nuclear sites and nuclear facilities does not appear to have damaged national security, according to officials from DOE, NRC, and Commerce. Information in the draft declaration was limited to civilian nuclear activities, and most nuclear-related information was publicly available on agency Web sites or in other published documents, according to officials from the three agencies. However, officials from all of the agencies that compiled this information told us the information—all of which was considered unclassified—was sensitive because it was consolidated into one document and should never have been posted to GPO’s Web site. Commerce, DOE, and NRC did not formally assess the impact of the public release of the information on U.S. national security. According to DOE, NRC, and Commerce officials, it was not necessary to do so because the agencies reviewed the list of civilian nuclear facilities and related activities on multiple occasions to ensure that no information of direct national security significance was included and that no classified information was contained in the declaration prior to transmitting it to the White House and Congress.

Consolidated List of Civilian Nuclear Facilities and Activities Contained in the Draft Declaration Is Considered Sensitive and Was Never Meant to be Made Public

According to U.S. government officials, the draft declaration in totality represents a consolidated list of hundreds of U.S. civilian nuclear facilities and activities that never should have been publicly released. These officials asserted that it could be potentially problematic if such a consolidated list of facilities and activities found its way into the hands of individuals who had malicious or malevolent intentions. For example, agency officials told us, in several instances, the draft declaration contained maps showing detailed diagrams of civilian reactor facilities or buildings storing nuclear materials at national laboratories.

The draft declaration included 14 diagrams of buildings or facilities, 2 of which were marked OUO. For example, the declaration provided the building and vault numbers where highly enriched uranium is stored at the Y-12 nuclear production facility, as well as a diagram showing the layout of the part of the building where the material is stored. According to DOE officials, this information was sensitive because it identified the specific building and vault number, but no classified information was revealed because the diagram does not show a map of the entire Y-12 facility and the specific location of a vault at the Y-12 complex. Of the other 12 diagrams, 1 was of a plutonium oxide storage area at DOE’s Savannah River site and 11 were of civilian nuclear facilities. The pages containing these diagrams did not have any markings: Highly Confidential Safeguards Sensitive, OUO, or any other U.S. designation.

The 11 diagrams of civilian nuclear facilities accompanied information on 8 NRC licensed commercial sites—4 reactors and 4 fuel fabrication facilities. For example, the draft declaration included a site map of the Turkey Point reactor in Florida and a diagram identifying the building where spent fuel is stored. According to NRC officials, the information and diagrams related to the facilities in the draft declaration are not classified because they do not specify the quantities and types of nuclear materials held at these facilities. However, the information is sensitive because it includes commercially sensitive data, such as the actual annual production, rather than the more general and publicly available information on how much material the facility is licensed to produce.

According to DOE and State officials, the release of the information could be problematic for the United States because other countries could scrutinize the completeness and accuracy of the information and potentially pressure IAEA to do more rigorous inspections of the facilities listed. Inspections of nuclear facilities with nuclear materials and nuclear- related activities are the cornerstone of IAEA’s data collection efforts and provide the ability to independently verify information in countries’ Additional Protocol declarations. Potential pressure to conduct more comprehensive inspections of U.S. facilities could divert time and resources from more rigorous inspections in countries and facilities of proliferation concern, such as Iran or Syria.

Agencies Did Not Assess National Security Implications of Disclosure of Draft Declaration

Commerce, DOE, State, and NRC did not undertake any assessments after the draft declaration was released to determine its impact on U.S. national security. According to officials from these agencies, no such assessment was necessary because all of the agencies involved in the development of the draft declaration (as well as the Department of Defense) had fully reviewed the consolidated list of civilian nuclear facilities and related activities on multiple occasions to ensure that no information of direct national security significance was included and that no classified information was contained in the declaration prior to transmitting it to the White House and Congress.

DOE, which provided most of the information in the draft declaration, had three separate levels of security review and approvals for the information it submitted for the document. First, the national laboratories’ counterintelligence, export controls, and security offices reviewed the information submitted for the declaration. Second, the national laboratories’ site managers reviewed the information, and each site manager certified to DOE that the national laboratory had completed vulnerability assessments on the national security impact of releasing the information to IAEA and that the facilities were ready for IAEA inspections. Finally, program managers and security officers at DOE headquarters reviewed the contents. According to DOE officials, at all levels of review, officials from the national laboratories and DOE concluded that no information detrimental to national security was included in the document. NRC and Commerce reported information about facilities’ activities and locations that was mostly, if not all, publicly available. State obtained additional confirmation from DOE, Commerce, NRC, and the Department of Defense that the draft declaration contained no classified or national security information before sending it to the White House.

According to agency officials, there was no requirement to conduct a formal assessment of any possible security concerns arising from the declaration’s publication because classified information was not released. A formal assessment is required only if there is a release of information that could harm U.S. national security. DOE and NRC did seek assurances after the release of the draft declaration from officials at the national laboratories and civilian nuclear facilities that physical security at those locations was sufficient. DOE asked the national laboratories to review their security procedures and ensure that the facilities were secure. Based on these assessments, DOE officials told us they did not increase security at any site. NRC contacted every NRC licensee and agreement states with licensees included in the draft declaration to notify them of the disclosure of information. Agreement states notified their affected licensees. NRC and agreement states’ licensees reviewed their security procedures to make sure there were no vulnerabilities. According to NRC, the only NRC facility to express concern was Turkey Point in Florida because of its spent fuel pool. NRC officials told us that the location of this facility was already publicly disclosed, and satellite images show the building that houses the spent fuel pool. Turkey Point operators reviewed their security procedures and determined the procedures they had in place were sufficient, even with the release of the draft declaration.

Conclusions

The draft declaration listing civilian nuclear sites and activities under the terms of the Additional Protocol was the first of its kind prepared by the United States for IAEA and sent to Congress for review. However, the draft declaration contained sensitive civilian nuclear information that, when taken in its totality, needed to be properly handled and safeguarded. Protecting sensitive information from inadvertent public disclosure is a critical function of all federal entities that possess, handle, or transmit such information. Since the United States is required to submit a draft declaration to Congress and then send the declaration to IAEA every year, there is an opportunity to address the problems that occurred to ensure that this inadvertent disclosure does not occur again.

A more systematic, well-coordinated approach by all of the agencies that handled the draft declaration would have reduced the chances of publicly releasing sensitive information—particularly if the document had been clearly identified as not for public release. We found several critical points where opportunities to improve safeguards over the document were missed due to: the absence of clear interagency guidance, different procedures across the agencies governing the handling and marking of sensitive documents, poor decision making, and the lack of training and adequate security awareness.

No agency or office that was involved with the production or transmittal of the draft declaration ensured that the final document was marked with any U.S. security designation. DOE, NRC, and Commerce marked the information they submitted for the draft declaration as OUO. However, none of these agencies took the added precaution of ensuring that the consolidated draft declaration maintained the OUO designation on each page of the document once the IAEA marking was placed on the document. Further contributing to the subsequent confusion over how to handle the draft declaration was State’s use of the SBU marking. Many officials focused on the unclassified portion of the marking and determined, incorrectly in our view, that the document could be made public. We believe that it would have been a simple matter to clearly state in the presidential message that the draft declaration was not meant for public dissemination.

Furthermore, the White House failed to take measures to ensure that the draft declaration was not published. Attorneys from the Office of the White House Counsel did not provide us with any written guidance on how the National Security Council and the Executive Clerk’s Office usually handle documents that are unclassified, but are considered sensitive, such as those marked SBU, that should not be publicly released. However, counsel did indicate that individuals with the National Security Council and White House Clerk’s office handled the draft declaration according to White House practices. In our view, these practices, as best as we understand them, are not sufficient to prevent similar problems from occurring in the future.

In addition, legislative branch officials did not properly safeguard the draft declaration and did not properly handle the information. In particular, we believe that the House of Representatives Security Office Director should have been more directly involved in resolving conflicting and confusing information regarding the classification of the draft declaration. Conversely, the Executive Communications Clerk is to be commended for taking actions to do everything in her power—at her level of responsibility—to pursue the right course of action.

Finally, in our view, GPO officials also share responsibility for the public disclosure of the draft declaration. Although the August 2009 GPO Inspector General’s report assigns no wrongdoing to either GPO or its employees, GPO officials should have had procedures in place to prevent such a release from occurring. Thus, we agree with the Inspector General’s proposed recommendations and we encourage GPO to implement them as expeditiously as possible.

Recommendations for Executive Action

To ensure that corrective actions are taken to prevent the inadvertent public disclosure of sensitive information in future draft declarations or other documents prepared for IAEA by multiple U.S. agencies, we are making the following four recommendations: The Secretaries of Commerce, Energy, and State, and the Chairman of the NRC should enter into an interagency agreement concerning the designation, marking, and handling of such information, and make any policy or regulatory changes necessary to reach such an agreement. This agreement should be revised, as necessary, to take into account future direction from the President or the Controlled Unclassified Information Council regarding standardization of the procedures for designating, marking, and handling documents that are unclassified but are not intended for public release.

The Secretary of State should clearly indicate in the text whether the presidential message and attached documents, if any, should be printed and made publicly available when preparing presidential communications to Congress for documents to be presented to IAEA.

The Executive Office of the President should consider revising any written guidance and/or practices it has and conduct staff training for handling and safeguarding sensitive information in future declarations or other documents between the United States and IAEA before it needs to issue its next declaration in May 2010.

GPO’s public printer should implement, as expeditiously as possible, the recommendations from the agency’s August 2009 Inspector General report in order to improve the security culture and reduce the possibility of future postings of sensitive information to the GPO Web site.

Agency Comments and Our Evaluation

We provided a draft of this report to DOE, State, GPO, NRC, Commerce, Office of the White House Counsel, and the House of Representatives’ Sergeant at Arms and Offices of the Clerk and Parliamentarian for comment. DOE, State, GPO, NRC and the House of Representatives Sergeant at Arms provided written comments, which are presented in appendixes I, II, III, IV and V, respectively. State and the Office of the White House Counsel provided technical comments which we incorporated as appropriate. Commerce and the House Offices of the Clerk and Parliamentarian reviewed, but did not provide comments on our draft report.

DOE, State, and GPO agreed with our recommendations. NRC neither agreed nor disagreed with our recommendations, but did provide technical comments which we incorporated as appropriate. In response to our recommendation involving an interagency agreement to designate, mark, and handle sensitive information provided to IAEA on U.S. nuclear sites and activities, DOE noted that the interagency agreement would specifically address the marking and handling of future draft declarations and other documents provided to IAEA under U.S. safeguards agreements. The interagency agreement will not address broader, governmentwide standards on how to mark and handle all unclassified, but sensitive information. These standards will be developed by the Controlled Unclassified Information Council or other entity designated by the President. This is consistent with our recommendation. As we state in our report, the interagency agreement should be a corrective action to prevent the inadvertent public disclosure of sensitive information in future draft declarations or other documents prepared for IAEA by multiple U.S. agencies, rather than addressing broader, governmentwide standards on how to mark and handle all unclassified but sensitive information.

The House of Representatives’ Sergeant at Arms did not comment on our recommendations but provided three points of clarification regarding the Office of Security’s role in reviewing and transmitting the draft declaration. First, the House Sergeant at Arms stated that, contrary to what we stated in our draft report, the House Security Office made no determination as to whether the draft document could be published and did not provide the House Clerk’s office with any direction or legal advice regarding this matter. Second, according to the House Sergeant at Arms, the House Security Office properly advised the House Clerk’s office to contact IAEA regarding the handling of the draft document. Third, the House Sergeant at Arms stated that the House Security Office did not need to take control of the draft document, nor was the Security Office requested to take control of the document. In addition, the Security Office does not have the authority to order a House of Representatives office or entity to store a document with the Security Office.

Regarding the first point, we believe that given the sensitive nature of the draft document—and commensurate with its role and responsibilities— the House Security Office should have, at a minimum, raised concerns with the House Clerk’s Office about publicly releasing 266 pages of information on U.S. nuclear sites and activities and advised the House Clerk not to print the document without explicit authorization from the agencies that designated the information SBU. While we do not dispute the statement that the House Security Office did not provide any advice or direction regarding the printing of the document, we believe that it would have been appropriate for this Office to play a more assertive role because the House Clerk sought advice and guidance in determining whether the document could be printed. However, based on these comments, we modified the text of the report to reflect the claims made by the House Security Office. Specifically, we removed reference to the Security Office on page 16 to avoid inferences that the Security Office provided direction or legal advice to the Clerk’s Office that it could print the document.

Regarding the second point, the House Office of Security has misconstrued what we stated in the draft report. While there was nothing inherently wrong with the Office of Security suggesting that the Clerk’s Office contact IAEA about the document, IAEA did not prepare, transmit, or mark the document. As we noted in our report, the U.S. agencies that prepared the draft declaration placed the IAEA markings on the document. The presidential message explained that the draft declaration was prepared by the United States and would be submitted to IAEA. Because the IAEA markings on the document have no legal significance in the United States, the presidential message further explained that information in the document should be treated as SBU and was exempt from disclosure. IAEA was not the originating agency for the information. As a result, it continues to be our view that the Director of the House Office of Security did not provide the correct advice to the House Clerk on who she should contact to obtain authorization on releasing SBU information.

Finally, regarding the matter of physical custody of the document, we do not dispute Security Office’s claim that it was not required—nor did it have the authority—to take control of the document. However, we believe that it would have been prudent for that office to take physical control of the document as a precautionary measure until a determination was made concerning whether or not the document could be published. The Director of the Office of Security missed opportunities to prevent the document’s release and should have been more directly involved in resolving conflicting and confusing information regarding the dissemination of the draft declaration. However, we modified the text on page 17 to include information about the Security Office’s physical custody requirements and the assistance the House Clerk requested from the Security Office.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until eight days from date of this report. At that time, we will send copies of this report to the Secretaries of Commerce, Energy, and State; the Chairman of the Nuclear Regulatory Commission; the House of Representatives’ Parliamentarian, Clerk, and Sergeant at Arms; the Executive Clerk of the White House; the Public Printer of the Government Printing Office; and interested congressional committees. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-3841 or aloisee@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI.

Appendix I: Comments from the Department of Energy

Appendix II: Comments from the Department of State

Appendix III: Comments from the Government Printing Office

The following are GAO’s comments to the Government Printing Office letter dated December 2, 2009.

GAO Comments

1. We added GPO to the Highlights page as one of the agencies and offices we met with to discuss why the disclosure of the draft declaration occurred. 2. We modified the text on page 3 to include the most recent data on the status of the printed copies of the draft declaration, based on information contained in the technical appendix provided by GPO.

Appendix IV: Comments from the Nuclear Regulatory Commission

The following is GAO’s comment to the Nuclear Regulatory Commission letter dated December 2, 2009.

GAO Comment

1. We modified the text on the bottom of page 4 in the Background section to clarify that under the Additional Protocol, the U.S. must declare exports of sensitive nuclear-related equipment specified by IAEA.

Appendix V: Comments from the House of Representatives’ Sergeant at Arms

The following are GAO’s comments to the House of Representatives Sergeant at Arms letter dated December 2, 2009.

GAO Comments

1. We have modified the text on page 16 by removing a reference to the Security Office to clarify that it did not make a determination as to whether the document could be published. 2. The Sergeant at Arms is incorrect when he states that IAEA marked the document “Highly Confidential Safeguards Sensitive.” As we state in our report, U.S. agencies that prepared the declaration marked the document, not IAEA. U.S. agencies used an IAEA-supplied software to mark the document with the highest IAEA security marking to put IAEA on notice, once it received the document, that it should be properly safeguarded against disclosure. However, the draft declaration is a U.S. document and should not have been publicly disclosed. 3. We agree that U.S. agencies and offices that prepared and transmitted the document prior to sending it to the House of Representatives missed opportunities to better mark the document and avoid confusion about whether it should have been published. However, the presidential message that accompanied the draft declaration explained that the United States regarded the information as SBU. The presidential message also explained that the information was exempt from disclosure under FOIA. In our view, the information in the presidential message should have been sufficient to put the House Security Office on notice that the information should be treated as SBU and should not be published or publicly released without a more rigorous inquiry. 4. See comment 2. 5. See comment 1. 6. While there was nothing inherently wrong with the Office of Security suggesting that the Clerk’s Office contact IAEA about the document, IAEA did not prepare, transmit, or mark the document. IAEA was not the originating agency for the information. As a result, it continues to be our view that the Director of the House Office of Security did not provide the correct advice to the House Clerk on who she should have contacted to obtain authorization on releasing SBU information. 7. As we noted in our report, U.S. agencies that prepared the draft declaration placed the IAEA marking on the document. The presidential message explained that the draft declaration was prepared by the United States and would be submitted to IAEA. IAEA was not the originating agency for the information. 8. We have modified the text on page 17 to clarify that the Security Office was not required to take custody and control of the document. 9. See comment 8. 10. We have modified the text on page 17 to clarify that the Security Office was not required to take custody and control of the document. However, given the unfamiliar markings and 266 pages of detailed information on U.S. nuclear sites and activities, we believe that it would have been prudent to take positive physical control of the document as a precautionary measure until a determination was made concerning whether or not the document could be published. The Director of the Office of Security missed opportunities to prevent the document’s release and he should have been more directly involved in resolving conflicting and confusing information regarding the classification of the draft declaration. 11. See comment 8. 12. We have modified the text on page 17 to clarify that the Security Office was not required to take custody and control of the document and the Executive Communications Clerk did not request that the Security Office take custody of the document or assist her in contacting the agencies and offices that transmitted the document. 13. We have modified the text on page 17 to clarify the Security Office’s document custody requirements and what was asked of the Security Office by the House Clerk. However, we believe that given the sensitive nature of the draft document—and commensurate with its role—the House Security Office should have, at a minimum, raised concerns with the House Clerk’s Office about publicly releasing 266 pages of information on U.S. nuclear sites and activities and advised the House Clerk not to print the document without a more rigorous inquiry as to whether it should have been published. 14. We believe that the recommendation suggested by the Sergeant at Arms to require Member offices and other non-Committee House entities that are not equipped to properly store sensitive or classified data to relinquish custody of such material to the House Security Office would involve a change in House rules and procedures that is beyond the scope of our review.

Appendix VI: GAO Contact and Staff Acknowledgments

Gene Aloise (202) 512-3841 or aloisee@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Glen Levis, Assistant Director, Antoinette Capaccio, Leland Cogliani; Ralph Dawn, Karen Keegan; Tim Persons; and Carol Herrnstadt Shulman made significant contributions to this report.