Managing Sensitive Information: DOJ Needs a More Complete Staffing Strategy for Managing Classified Information and a Set of Internal Controls for Other Sensitive Information
Released: 2006-11-20T00:00:00

Letter

Background

The U.S. government classifies information that it determines could reasonably be expected to damage the national security of the United States if disclosed publicly. Since 1940, the classification of official secrets has been governed by policies and procedures flowing from executive orders issued by presidents, largely based on authority granted under Article II of the Constitution. Current classification and declassification requirements are mandated by Executive Order 12958, Classified National Security Information, as amended. The order establishes the basis for classifying national security information at one of three levels—Top Secret, Secret, or Confidential—depending on the degree of damage that unauthorized disclosure of this information could reasonably be expected to cause to the national security of the United States. Pursuant to the executive order, designated individuals, called original classifiers, exercise original classification authority, meaning they can classify national security information for the first time. Such individuals, including the President, agency heads, and other government officials that have been delegated this authority determine the degree of damage that disclosure could cause, decide on a classification level for the information, and attempt to establish a date or event for its declassification.

Declassification is a vital part of the classification system because it prompts the change in status of the information from classified to unclassified, which may make it available for others to access and use, such as members of the general public, researchers, historians, or other parties. Under the automatic declassification provision of the executive order, all records of a permanent historical value over 25 years old that contain classified national security information will be automatically declassified on December 31, 2006, and each year thereafter, and may be available for public disclosure, unless an agency head or senior agency official determines that these records fall within an exemption that permits continued classification as approved by the President or the Interagency Security Classification Appeals Panel. Examples of exemptions include information that, if released, could be expected to seriously impair relations between the United States and a foreign government; undermine diplomatic activities of the United States; identify a human intelligence source; or violate a statute, treaty, or international agreement. Information that is automatically declassified as of December 31, 2006, will not necessarily enter the public domain. According to ISOO officials, declassified information may continue to be withheld from public disclosure for reasons under the Freedom of Information Act (FOIA) or other legal authority or may be reclassified in accordance with the executive order.

The order also requires ISOO to implement directives and perform oversight inspections of executive branch agencies’ national security information classification programs to ensure these programs are in compliance with the order. When the oversight inspections result in findings of noncompliance with the order, ISOO recommends corrective actions to the agencies. However, according to ISOO, it cannot require agencies to implement the recommended corrective actions.

According to ISOO, DOJ is the third largest classifier of information in the executive branch, although this represents about 2 percent of all executive branch classification decisions during fiscal years 2000 through 2004, as the vast majority of classified information originates in the Department of Defense. Nevertheless, DOJ is responsible for a large volume of classified information, some of which if improperly disclosed could harm the national security of the United States. The majority (approximately 98 percent) of classification activity within DOJ occurs at the FBI.

DOJ also designates certain information as sensitive but unclassified and prescribes specific requirements for handling and sharing this information to ensure that harm is not caused to governmental, commercial, or privacy interests as a result of disclosing it to the public or persons who do not need such information to perform their jobs. DOJ components in our review use a number of sensitive but unclassified designations, such as Law Enforcement Sensitive, For Official Use Only, and Limited Official Use, to identify information as sensitive but unclassified. Such information at DOJ could include that which is critical to a criminal prosecution. As such, the department would protect this information from inappropriate dissemination by designating it Law Enforcement Sensitive and applying prescribed dissemination and handling procedures that correspond with the designation. Information designated as sensitive but unclassified remains so indefinitely, unless it is reviewed, for example, pursuant to a request under FOIA. That act requires federal agencies to disclose records requested in writing by any person unless one or more of the nine exemptions and three exclusions authorize the agency to withhold the requested information. For example, law enforcement records may be withheld if their release could reasonably be expected to interfere with enforcement proceedings.

Within DOJ, the Office of Information Safeguards and Security Oversight, which is part of the Security and Emergency Planning Staff (SEPS), is responsible for developing security policy and administering and overseeing the department’s programs for managing classified and sensitive but unclassified information. This office currently has a total of 13 staff, of which 1 is responsible for policy development and training, and 3 are responsible for program oversight. The remaining 9, among other things, administer the department’s sensitive compartmented information program, reviews information technology security policies developed by the department’s Chief Information Officer, and ensures the development and implementation of departmentwide policies and procedures that govern certain security related activities. Figure 1 shows an excerpt of DOJ’s organizational chart that features the offices responsible for classification management.

At the component level, security program managers are responsible for implementing component-specific security activities, such as conducting internal inspections and training employees on their responsibilities in relation to DOJ’s security programs. In total, there are approximately 40 security program managers and alternates, 33 of which conduct these duties on a part-time basis.

DOJ shares classified and sensitive but unclassified information with those who have a need to know this information, such as with other law enforcement agencies at all levels of government. One manner in which DOJ shares this information is in response to requests it receives from other federal entities, such as Congress, other executive agencies, and legislative agencies.

DOJ Has Made Progress Implementing ISOO Recommendations but Has Not Yet Addressed Critical Staff Resource Issues That Limit Its Ability to Address All Needed Changes

Although DOJ has completed or partially completed half of ISOO’s 10 recommendations, it has not implemented the other half, primarily because of resource constraints, according to DOJ. This has been a long- standing problem in the program, as our prior work shows, but DOJ reported that it is seeking additional resources from an administrative fund in fiscal year 2007. The ISOO recommendations were to correct, among other things, resource constraints, a lack of sufficient training on how to classify information, and inadequate oversight to ensure its classification management practices were working well. DOJ is not certain that the additional resources will be enough for an effective program. However, it has not assessed the optimum resources it needs or developed a strategy to use available resources most effectively to resolve remaining deficiencies.

DOJ Took Action on 5 of the 10 ISOO Recommendations for Its Classification Management Program

ISOO made 10 recommendations to DOJ in July 2004 aimed at resolving deficiencies in DOJ’s classification management program, and, at the time of our review, the department had completed or partially addressed half of the recommendations, as table 1 shows.

Through SEPS, DOJ had implemented 1 recommendation to require that each of its components file self-inspection reports on its classification management program as a matter of course by including this requirement in its May 2005 revised Security Program Operating Manual. DOJ also built in the requirement that all components submit inspection reports for each fiscal year no later than October 15 of the following fiscal year, but at the time of our review, a SEPS official noted that none of the components had submitted inspection reports for fiscal year 2005.

Through SEPS, DOJ has partially implemented 2 other recommendations. First, in response to ISOO’s recommendation that security program managers hold security clearances at levels appropriate for the activity of their office, SEPS reported that all of its component security program managers who handle classified information had security clearances, but SEPS was considering revising the order on security programs and responsibilities to include a requirement for these managers to hold clearances. Second, as of April 2006, SEPS reported that it has taken steps to make refresher training, including how to mark classified documents, available to all staff in all DOJ components. According to DOJ security officials, SEPS has developed a computer-based refresher training module, which is estimated to be available to employees by December 2006.

DOJ disagreed with an ISOO recommendation to examine the placement of SEPS within the department’s organizational structure and consider repositioning it to afford it higher visibility and increased stature. DOJ’s Assistant Attorney General for Administration informed ISOO that SEPS’s reporting to the Deputy Assistant Attorney General for Administration does not hinder it from fulfilling its responsibilities, and SEPS’s director has access to the department’s senior leadership whenever needed. However, ISOO still maintains this change is needed.

DOJ’s Inaction on Staff Resource Issues Impedes Full Implementation of ISOO’s Recommendations

ISOO reported that SEPS lacked sufficient staff resources to effectively implement DOJ’s classification management program and recommended that measures be taken to correct this deficiency. ISOO’s recommendation to DOJ on resources for classification management is consistent with the executive order governing classified information that requires agency heads to commit the resources necessary to effectively implement a national security information program. The order also requires the senior agency official—who is designated by the agency head to direct and administer the agency’s classified national security information program— in part, to establish and maintain programs to (1) train and educate employees on the need to properly classify and mark national security information and prevent unnecessary access to and unauthorized disclosure of classified information; and (2) provide oversight of the program through mechanisms such as ongoing internal inspections. These requirements are also consistent with federal standards for internal control.

ISOO reported that SEPS’s lack of resources is particularly significant because of DOJ’s large volume of classification activity—especially when SEPS is compared to security offices at other federal agencies of similar size and structure. DOJ, the third largest classifier of information in the federal government, has 13 full-time positions devoted to information security. Four of the 13 are dedicated to DOJ’s classification management training and program oversight departmentwide, 1 to provide and oversee training across the department and components and 3 to conduct security compliance reviews at DOJ’s 3,500 locations. DOJ does have security program managers at each of its components to provide training and program oversight for that component that helps to supplement departmental activity. Nevertheless, in comparison, the Department of Energy, the fifth largest classifier, has 23 full-time positions, and the Department of State, the fourth largest classifier of information, has 8 full-time positions to cover its classification management program at headquarters alone, according to ISOO.

SEPS did not receive additional resources, as requested, nor did DOJ reallocate resources to SEPS from other activities, according to DOJ security officials, although they would not provide additional information explaining the reasons why funds were not made available. This problem is longstanding. In 1993, for example, we reported that limited staff resources in SEPS’s Security Compliance Review Group affected its ability to conduct compliance reviews of all DOJ locations in overseeing the department’s security program. In addition, during 1991 and 1992, the group had 6 employees to conduct reviews of 1,300 DOJ locations compared to half as many staff to cover almost three times as many locations today. Moreover, in 1993, we reported that DOJ requested, but was not authorized, additional staff, and we recommended that the Attorney General direct SEPS’s Security Compliance Review Group to explore other alternatives for selecting and conducting these annual reviews to maximize the use of its limited resources. In response, DOJ devised a strategy to use components’ security specialists to help with compliance reviews and their inspection reports to target locations to review. As a result, DOJ reported that the number of compliance, follow- up, and unscheduled reviews increased. However, at the time of our review, SEPS indicated that security program officials only perform oversight of their components’ security programs. Despite the progress reported after our 1993 report, ISOO found over 10 years later that DOJ was not able to compensate for its lack of resources and provide sufficient oversight.

As a result of these staff resource limitations, DOJ security officials stated that SEPS had only been able to partially implement 2 ISOO recommendations and had not taken steps to address 3 others. DOJ had partially responded to ISOO’s recommendation that department security program managers be given consistent and regular training they need to understand their responsibilities for managing their respective component’s classification activities. SEPS agreed to provide training to these managers in two ways: (1) an annual conference, at which attendance is not required, that the department has hosted since 2003 and (2) detailed training workshops on handling and safeguarding classified information, such as marking documents, conducting self-inspections, and managing classification programs, which are provided only upon request. However, DOJ does not have a mechanism, as called for in our federal internal control standards, and sufficient staff, as ISOO noted in its report, to ensure all security program managers consistently receive the training they need. In addition, SEPS has implemented a database to track security incidents departmentwide, such as classification program violations, as ISOO recommended. However, SEPS officials reported that they have not been able to monitor security violations and incidents to identify patterns and trends and incorporate these lessons learned into the department’s security education and training program because they lack the staff to do so.

The three recommendations SEPS had not taken any action on primarily related to monitoring aspects of the classification management program. First, ISOO found that SEPS was not conducting frequent reviews of the department’s compliance with the security program, as a whole, and that the components were not supplementing these department-level reviews by conducting self-inspections of compliance with their security programs on a frequent and consistent basis to ensure that sound security practices are maintained. SEPS’s team of three reviewers was responsible for conducting security program compliance reviews at an estimated 3,500 DOJ facilities currently located worldwide. ISOO also found that SEPS had not established a mechanism to ensure that components were conducting the self-inspections. ISOO recommended that DOJ correct these deficiencies.

Second, ISOO also found that classified documents were not always marked as required. Over half of the 81 classified documents that ISOO reviewed did not meet the marking requirements of the executive order.

The most frequent marking errors consisted of a lack of, or incomplete, portion markings (27 documents) and missing, incomplete, or improper declassification instructions (23 documents). Therefore, ISOO recommended that DOJ review classified documents on a regular basis to determine if staff are properly applying the marking requirements after employees have been trained on these requirements. According to SEPS officials, because of related resource constraints, the office had not taken action to institute these reviews.

Third, DOJ had not taken action on ISOO’s recommendation that employees receive security debriefings upon leaving the department. ISOO reported that such termination briefings are essential to informing employees that were leaving the agency of their continuing responsibility to protect classified security information. This recommendation is consistent with the executive order and implementing directives, federal standards for internal control, and DOJ’s own Security Program Operating Manual. DOJ reported that it enforces this requirement by checking to see if components are providing the briefings when SEPS conducts components’ security compliance reviews. However, ISOO found that SEPS did not conduct these reviews frequently enough to ensure that sound security practices are maintained. Furthermore, DOJ officials concurred with ISOO’s position on this matter and attributed the department’s insufficient reviews to its resource limitations. As an alternative, ISOO suggested to us that DOJ might coordinate with its human resources department to establish a system to track whether employees received the termination briefings before departure.

To address its resource constraints, SEPS expects to add 9 more staff— 5 full-time employees and 4 contract employees—to the 13 it currently has on board, pending the department’s Customer Advisory Board approval of funds from its Working Capital Fund. This fund is an administrative account generally intended to recover operating costs by having the department charge components fees for common administrative services—such as financial, telecommunications, and personnel services— that the department provides to them. DOJ officials were not certain how all 9 staff would be divided across the training, oversight, technical security policy reviews, and other functions within SEPS. A SEPS official said that 3 of the 9 staff are to be allocated to oversight but noted that while the additional staff would help, they most likely would still not be enough to implement an effective classification management program. However, although DOJ includes SEPS in its departmentwide workforce analysis, that office has not separately determined the optimal level of resources needed to administer an effective security program. This is an important first step to resolving its resource constraints and complying with ISOO’s recommendations.

In addition, SEPS does not have a strategy that lays out how it can best use anticipated resources to address the remaining deficiencies ISOO identified in ways that reduce the most risks to protecting national security information, such as whether to focus on addressing training, oversight, or other program gaps first. According to the program manager, with only 4 staff to cover departmentwide training and oversight issues, the office had not been able to be more proactive and strategic, achieving more comprehensive monitoring to prevent problems, and instead had to be more reactive and address classification concerns as they arose. In providing technical comments on a draft of the report, DOJ acknowledged that it has not conducted a formal assessment of the optimal level of resources SEPS needs to administer the information security program. DOJ also stated that SEPS identified in budget documents how the 9 additional staff would be allocated to address the remaining deficiencies identified by ISOO. However, DOJ provided no evidence of SEPS’s strategy for allocating these additional staff.

Our previous work notes the importance of having a workforce analysis and developing a strategy to fill staffing gaps, both of which are characteristic of best practices followed by high-performing organizations. In A Model of Strategic Human Capital Management, we highlighted the importance of identifying current and future staffing needs, including the appropriate number of employees and the correct mix of skills, for maximizing the value of employees and managing risk. Also, we have emphasized that an essential element of effective workforce planning is aligning human capital strategies to eliminate gaps. We have previously recommended that specific agencies adopt these practices. For instance, in a 2001 review of the Environmental Protection Agency (EPA), we recommended that EPA direct its major program offices to perform workforce analyses and then focus hiring and recruitment to fill any identified gaps. Similarly, we recommended in 2003 that the Government Printing Office complete a workforce analysis to identify gaps in skills and competencies and develop strategies to address any gaps. SEPS might benefit from adopting these human capital practices as part of a broad strategy to respond to ISOO’s recommendations.

The FBI Has Begun to Implement All but One of ISOO’s Recommendations

The FBI has begun or completed actions on all but one of ISOO’s recommendations to correct several deficiencies ISOO identified in the FBI’s classification management program. These deficiencies included outdated policy guides for classifying information, insufficient training and program oversight, and improper marking of classified information. In its April 2005 final report, ISOO recommended that the FBI take 12 associated corrective actions. As of August 2006, the FBI had fully implemented 4 and had actions under way to implement 7 more, as shown in table 2.

The FBI implemented 3 of ISOO’s recommendations—those addressing security regulations, self-inspections, and the processing of security violations—by issuing its Security Policy Manual in December 2005, laying out responsibilities, policies, and procedures for implementing its classification management program. For a fourth completed recommendation—evaluating the effectiveness of security inspections— FBI’s Security Division recently established the requirement that chief security officers conduct annual self-inspections of their divisions’ classification management programs and that Security Division staff conduct site visits to provide assistance where the head of the Security Division or another FBI division deems necessary.

As to the remaining 8 recommendations, the FBI disagreed with 1—to develop a graduated sanctions system for employees who repeatedly commit program violations—because it said that its Office of Professional Responsibility already had a system in place to apply such sanctions. Upon review of aspects of the sanctions system FBI has in place, ISOO officials agreed that it responds to this recommendation. The remaining 7 recommendations have been partially implemented, as discussed below.

Updated and Completed Classification Program Guidance

ISOO reported that the guides the FBI had in place to help employees make classification decisions neither contained current information nor reflected changes in the FBI’s mission, particularly the increase in its intelligence capacity after the terrorist attacks of September 11, 2001. ISOO recommended the guides be updated. One had not been revised for 9 years, even though ISOO’s directive implementing the executive order governing classified information calls for updates at least every 5 years. Classification guides are key to helping ensure employees have current, clear, and consistent guidance to make decisions about what information needs to be protected and restricted and what information can be released and shared, according to ISOO. FBI had complied with this recommendation for most of its guides. Security officials stated that although it had drafted an update of its primary classification guide, entitled Foreign Counterintelligence Investigations Classification Guide, it had not yet been issued because ongoing discussions between the FBI and DOJ’s Office of Intelligence Policy and Review about various intelligence-related issues will affect the guide’s content. As of August 2006, the FBI officials did not know when these issues would be resolved.

ISOO also found that the FBI lacked a guide for how to declassify documents, as the executive order requires and recommended that the FBI develop such a guide and submit it to the Interagency Security Classification Appeals Panel (ISCAP) for approval. According to FBI security officials, the guide has been drafted but not issued because the bureau was responding to panel comments on the draft. This guide is important because, among other things, it was to formally establish those exemptions the FBI could use when reviewing records to comply with the December 31, 2006, automatic declassification mandate. Delays in issuing the guide and establishing exemptions make it difficult for FBI to have time to complete its review because of the volume of records it has to address, which could be as many as 110 million records, according to bureau estimates. ISOO noted that the FBI has taken positive steps to try to meet the date, such as drafting its declassification guide, identifying information that it could present to ISCAP for exemption from the automatic declassification requirement, and authorizing bulk declassification of documents. But even with these initiatives, the bureau could still have up to 30 million records to review, which is why delays in issuing the guide and establishing exemptions may hinder completion of this review. As a result, some information that should remain protected could be available for public release, although the FBI could still try to reclassify it, deny release to protect individual privacy rights, or deny release for other reasons, such as to protect the identity of individuals who provide intelligence information to the government.

Updated Training on Classification and Marking Procedures

ISOO reported that although the FBI had some very sound training tools and to some extent provided excellent training, it was not thorough and offered consistently across the bureau. Specifically, ISOO reported that the amount and level of refresher training varied considerably among the FBI divisions, noting that the Counterintelligence and Counterterrorism Divisions’ training was substantial and met the requirements of the executive order, in contrast to the Office of Intelligence, which did not provide adequate training as its refresher training included only a few minutes on security awareness. ISOO recommended that the FBI ensure that all employees with security clearances receive sufficient annual refresher training on the classification program. In response, FBI security officials stated that the agency has instituted a security awareness program that includes the refresher training, which is offered continuously rather than annually. The training is provided through means such as posting security tips as well as classification and marking materials on the FBI’s intranet; having chief security officers distribute security awareness materials to employees; and providing live presentations and webcasts to all employees on classifying and marking practices. Although FBI has made this material available, it acknowledged that it does not have a system in place to track and ensure that all employees have received the information because, according to FBI, tracking would be administratively burdensome considering the methods used to convey the information, which is not consistent with ISOO’s directive. The directive requires agencies to maintain records of the training programs offered and employees’ participation in them.

ISOO also noted that the FBI had outdated and insufficient training materials for those staff who are the primary classifiers of information, known as original classification authorities. ISOO found that the FBI’s practice of waiting for these classifiers to contact the Security Division with questions about their responsibilities does not ensure they have a complete understanding of their role, as well as the executive order and implementing directives, and that this was critical since these individuals determine whether information meets the standards of potential damage to national security and should be classified. ISOO recommended that the FBI update this training, and the FBI expects to do so but is waiting until its classification and declassification guides are issued so that it can cover them in the training. FBI security program managers point out that more and more, these individuals are making declassification rather than classification decisions, and have been getting some training on their responsibilities for these decisions through one-on-one training, electronic communications, and participation in related training programs.

In almost half of the 575 classified FBI documents ISOO reviewed, it found marking errors. For example, ISOO found that portions of 110 documents (19 percent) appeared to be unnecessarily classified, while another 8 (1 percent) were clearly overclassified. To help eliminate these discrepancies, ISOO recommended that employees be provided refresher training on marking requirements and classifiers be trained in the updated classification guide when implemented. Otherwise, an ISOO official said, without proper guidance, employees tend to take a conservative approach and err on the side of classifying information. As we noted, the FBI has incorporated marking requirements in the refresher training and does plan to provide training on the new guides.

Review the Number of Staff with Classification Decision Authority

ISOO also recommended that the FBI review the number, roles, and responsibilities of those staff with original classification authority to determine if the number could be reduced. ISOO made this recommendation, in part, because it found that the percentage of staff with this authority within the FBI’s Records Management Division, a support office, was higher than that for other executive branch agencies. According to FBI security officials, the number of staff with this authority has been reduced in the Records Management Division and in the FBI as a whole. However, they said they will still have to re-examine the role of original classification authorities once the new guides are approved and issued.

Review and Update Automated Marking Mechanisms

ISOO also found missing, incomplete, or improper declassification markings in 176 of the documents (31 percent), but for most of these documents, about 80 percent, the errors were due to the fact that the FBI’s automated marking mechanism (computer macro) was erroneously applying outdated codes that exempted information from being declassified. ISOO recommended that the FBI review and update its macro to ensure it is applying current codes, and FBI security officials reported they are testing updated macros and expect to implement them by the end of September 2006.

DOJ Components Lack Specific Guidance, Training, and Oversight to Ensure Proper Designation of Sensitive but Unclassified Information

The five components we reviewed had orders and directives in place to identify the various types of categories of sensitive but unclassified information they used and to describe how information should be handled and protected. However, none of these components had specific guidance in place to help ensure employees properly designate information as sensitive. DOJ indicated that it is waiting for the results of a governmentwide working group that will determine what designations agencies are to use before considering any modifications to how it manages this type of information. In addition to a lack of specific guidance, the components do not have other key internal controls in place to provide reasonable assurance that designations are being consistently applied—specifically, formal training on how to make decisions on when to apply the designations or perform oversight, such as assessments of how well their practices are working. Having these controls—specific guidance, training, and oversight—in place is important, considering that these components share information formally and informally with various federal and nonfederal entities, such as state and local law enforcement agencies. Without such controls, errors could occur and materials could be restricted unnecessarily or information that should be withheld could be disseminated.

DOJ Components Lack Specific Guidance for Sensitive but Unclassified Decision Making

All five DOJ components in our review developed general policy guidelines, such as orders and directives, in addition to a 1982 order, Control and Protection of Limited Official Use Information, which established a departmentwide policy for protecting sensitive but unclassified information. However, the five DOJ components we reviewed do not have specific guidance to help employees determine how to apply their sensitive but unclassified designations. Additionally, our governmentwide review of agencies’ sensitive but unclassified designation practices also points to the importance of having formal, written guidance to give agency personnel a consistent understanding of whether and when to apply such designations, and we recommended in our March 2006 report that the Office of Management and Budget ensure agencies have this internal control in place. Written guidance is important because, according to the Standards for Internal Control in the Federal Government, information must be communicated in a suitable form and in a timely manner to those within an organization who need it to carry out their responsibilities. Furthermore, on the basis of our previous recommendations, other federal agencies have taken initiatives to enhance their guidance for their sensitive but unclassified designation processes. For example, earlier this year, the Department of Energy agreed with a recommendation we made to clarify its guidance on this subject and said that it is also planning ways to explicitly define for its employees what would be an inappropriate application of the sensitive but unclassified designations so that information is properly designated and handled. Similarly, in part because of our past recommendation to the Department of Homeland Security’s Transportation Security Administration, that office has begun to develop internal guidance that expands its existing regulations for sensitive security information—a category of sensitive but unclassified information—by providing personnel with examples of the types of information that should fall within various categories of sensitive security information. By taking similar actions, DOJ could reduce the likelihood of errors and inconsistencies in applying the sensitive but unclassified designations throughout the department.

The existing policy guidelines for the five components we reviewed do not provide employees the level of specificity needed to adequately guide their decision making on applying the designation. For example, in its policy, the Drug Enforcement Administration’s (DEA) definition of sensitive information includes any information and materials that are investigative in nature, critical to the operation and mission of the agency, would violate a privileged relationship, or have its access restricted by law. However, the policy provides no explanation, guidance, or examples of the information that would meet any of these criteria, for instance, information that could be categorized as critical to DEA’s mission. Similarly, the FBI’s Intelligence Policy Manual sets forth definitions of various sensitive but unclassified categories, such as Law Enforcement Sensitive and For Official Use Only, but does not have specific guidance for designating documents, such as identifying the criteria for determining whether text in a document should be Law Enforcement Sensitive because, for example, it is associated with an ongoing criminal investigation. Finally, neither DEA nor FBI guidance contains examples of inappropriate applications of sensitive but unclassified designations. Without explicit language identifying appropriate and inappropriate use of the designation, DOJ components cannot be confident that their personnel are making correct and consistent decisions.

Moreover, the components in our review use five different sensitive but unclassified designations, as table 3 shows.

Within a single DOJ component, employees could be confronted with making decisions on the sensitive but unclassified designation that might involve up to four categories, each with its own unique definition and safeguarding requirements, yet not have specific guidance on the types of information that merit each designation. For example, an employee at DEA can designate information Limited Official Use (LOU), Law Enforcement Sensitive, or DEA Sensitive (DEA-S), and each has different requirements. DEA requires administrative controls and additional safeguards for storage and transmission of DEA-S information that is equivalent to those for classified information. This means that DEA-S information must be locked, for example, in a General Services Administration (GSA)-approved security container when not in the custody of an individual with a need to know that information. The LOU category, however, carries less stringent handling requirements that do not, for example, involve storing documents in a GSA-approved locked cabinet. Consequently, in such an instance, information that would warrant the DEA-S protection may not be adequately safeguarded from unintended disclosure. This underscores the need for employees to have specific guidance and examples to use to be able to clearly determine which information should be protected under these categories.

According to DOJ security officials, additional changes affecting the departmentwide guidance on sensitive but unclassified policies and procedures have been suspended pending the results of efforts connected to a December 2005 presidential memorandum. This calls for, among other things, the development of standardized procedures across the federal government for designating, marking, and handling sensitive but unclassified information, in part, to promote effective and efficient use and sharing of this information. In general, the memorandum requires executive departments and agencies to inventory and assess their sensitive but unclassified procedures and determine the underlying authority for each procedure. For example, it mandated the submission of recommendations to the President for standardizing sensitive but unclassified procedures across the federal government for homeland security, law enforcement, and terrorism information, and the recommendations are expected by the end of December 2006. Once governmentwide standards have been established and a final decision is made on what sensitive but unclassified designations DOJ and its components will use, it will be important for them to develop specific guidance for employees that provides them with a clear understanding about when to apply each designation to ensure information is properly designated.

Training and Oversight for Their Designation Programs Are Limited for Selected DOJ Components

Federal internal control standards discuss the need for both training and continuous program oversight as necessary elements to ensure effective program implementation. However, training for the sensitive but unclassified designation process is lacking for the five DOJ components we reviewed. Although the Criminal Division and DEA offer training on handling and protecting sensitive but unclassified documents and material as part of periodic security awareness briefings, this training does not cover how to decide what information merits the designation. Specifically, security officials at the Criminal Division reported that the unit’s classification briefing includes a section on sensitive but unclassified information. However, this training only provides employees with a definition of the various categories of information, such as grand jury information, informant and witness information, and investigative material, and not specific guidance on how to determine if specific information qualifies for one of these categories. Similarly, DEA provides employees computer-based training and briefings but only to convey information on handling, but not designating, sensitive but unclassified information. Without such training, employees may be at higher risk of improperly designating or not designating information as sensitive but unclassified. We have previously recommended that other agencies develop training to cover designation of sensitive but unclassified information, and all have agreed to initiate such training.

In addition to having limited training programs, none of the components we reviewed have formally established policies and procedures regarding how they will monitor employees’ appropriate and consistent application of sensitive but unclassified designations. Federal internal control standards call for, among other things, ensuring that ongoing oversight— such as self-inspections and supervisory reviews—occurs in the course of normal operations. The lack of such internal controls over sensitive but unclassified designations increases the potential that different components could designate the same information differently without detecting inconsistencies. Some components told us they rely on their unit’s periodic security compliance reviews to assess how sensitive but unclassified information is handled and protected. However, some of these reviews have been conducted at up to 3-year intervals and, according to DEA security officials, are not designed to verify the accuracy of employees’ sensitive but unclassified decisions. On the basis of our previous work, other agencies have acknowledged the role of effective oversight procedures for the designation process and have taken actions to implement our recommendations to strengthen their procedures. For example, the Department of Defense and the Department of Energy, in response to our recommendations, have agreed to include oversight reviews of the sensitive but unclassified process as part of their routine security oversight assessments. Without similar actions, DOJ does not have reasonable assurance that the designations are applied accurately and consistently throughout the department.

The lack of guidance, training, and oversight is of particular concern in three of the five components we reviewed because these components do not limit the number of employees who can designate information as sensitive but unclassified. ATF and DEA restrict those authorized to make designations to a limited number of senior level employees. At the other components, however, any employee at any level is authorized to make these decisions. For example, at the FBI, any employee or contractor in the course of performing assigned duties may designate information Law Enforcement Sensitive. Yet in these components, employees do not have guides to consult and adequate training to help them make decisions on which information warrants a sensitive but unclassified designation, and the agencies do not have processes in place to oversee employee decision making in these instances. This increases the risk of inadvertent disclosure of information that should be protected or unintentional restriction of information needed to assist other governmental entities involved in criminal investigations or antiterrorism activities, or the unwarranted withholding of information from the public.

DOJ Components Report Having Processes in Place for Responding to Intragovernmental Information Requests

Information may be shared among federal entities through both formal and informal channels. One method for sharing information among Congress, executive agencies, and other federal entities is in response to formal requests from one federal entity to another. Each of the components in our review reported having processes in place for responding to intragovernmental requests for classified and sensitive but unclassified information, and the processes are consistent with federal internal control standards, although we did not independently test the effectiveness of these controls. For example, all of the components have central offices for receiving intragovernmental requests, involve subject matter experts in determining whether information can be disseminated, and conduct supervisory reviews of responses prior to release.

DOJ Components Report Having Central Offices for Receiving Intragovernmental Information Requests and Involving Subject Matter Experts in Determining How to Respond

Information may be shared among federal entities through both formal and informal channels. For instance, four of the DOJ components in our review reported that their employees share information informally with their counterparts at other federal agencies as part of everyday operations. Intragovernmental information requests are another, more formal method for sharing information. Four of the five components reported having central offices for receiving such requests from both Congress and executive agencies. DEA has a central office for receiving congressional, but not executive agency, requests. The use of central offices is consistent with federal standards for internal control, which note the importance of having clearly defined areas of responsibility in an organization. For example, USMS’s Office of Congressional Affairs receives requests from Congress, while its Executive Secretariat receives executive agency requests. After a component’s central office receives a request, it reviews the request to determine which subcomponent office has the knowledge necessary to respond and forwards it to that office.

From there, all of the components report using internal subject matter experts who have the relevant expertise to identify and assess material that would be used to respond to a request. This is also consistent with federal internal control standards that discuss the importance of ensuring that tasks are performed by the right employees. The subject matter experts rely on various resources as they decide how to respond. For example, these individuals might consult with other knowledgeable agency personnel. ATF employees may consult subject matter experts, such as the Office of Chief Counsel, and USMS staff may consult with the Office of General Counsel and division security officers.

Subject matter experts may consider several factors as they determine how to respond to a request, according to program officials at the components. At ATF, for instance, different factors are taken into account for different types of information, such as investigative records, tax information, or criminal informant records. DEA experts consider the content and sensitivity of the information, how the information will be used by the receiving entity, and the time frame for providing a response to determine how to respond to a request. In addition, at the Criminal Division, subject matter experts use their professional judgment to determine which factors to consider.

ATF, the Criminal Division, and the FBI reported having documented processes to guide their staff in responding to intragovernmental information requests, although these documents do not provide detailed guidance because components decide on how to respond on a case-by- case basis. For instance, the Criminal Division cited the Departmental Executive Secretariat Correspondence Policy, Procedures, and Style Manual as providing written guidelines on responding to intragovernmental requests, although this manual does not include any guidance on what factors to consider during the decision-making process or how to determine whether information may be released to a requester. According to the components, the response process may differ for various reasons, such as the nature of the request and the requester’s needs. For example, for a classified information request, a component may communicate with the requester to determine if an unclassified version of the information would satisfy the requester’s information needs. Therefore, formal written policies may not always be helpful, given the need for a case-by-case approach to responses.

All of the Components Report Conducting Supervisory Reviews of Responses

After the subject matter experts have determined how to respond to the information request, all of the components report conducting a supervisory review before releasing the response; this corresponds to federal internal control standards that highlight the importance of management reviews for achieving effective results. At the FBI, a response may also undergo a review to determine if the information should continue to carry any classification or sensitive but unclassified designation after it is released. DEA and Criminal Division have processes for supervisory review that may vary depending on the nature of the request, according to officials at those components. At the Criminal Division, for instance, designated officials in the division determine who should review the information based on the nature of the request; reviews may be conducted by the Section Chief, Office Director, the Chief of Staff, and the Deputy Chief of Staff, among others. At DEA, the review process varies depending on which office owns the information that is responsive to the request and the nature of the request. According to DEA, executive agencies’ requests that may be satisfied by information that is not sensitive may be approved by a unit chief, but the release of a response that contains sensitive information may require the approval of a section chief. Similarly, responses with highly sensitive information, such as information related to ongoing investigations or undercover operations, may require the approval of a senior executive at DEA.

All of the Components Report Communicating with Requesters during the Response Process, but the Level of Communication Varies by Request

All of the components reported that they communicated with requesters during the response process, which is consistent with federal internal control standards that note the importance of communicating with external stakeholders. Depending on the component, different offices communicate with requesters. At the FBI, the Office of Congressional Affairs may contact the congressional committee that requested information to obtain clarification about what is being requested. At the Criminal Division and DEA, however, experts within the relevant program office will contact the requester directly if clarification is needed. According to DEA officials, if the program office finds that the responsive information is classified or sensitive but unclassified, it may contact the requester to determine whether an unclassified or nonsensitive version of the information would be sufficient. For example, DEA might offer to provide an overview of an investigation, rather than a detailed description of the law enforcement techniques used during the investigation. All of the components reported that they inform requesters if information will be withheld or redacted prior to release. At the FBI, redacted information is usually assigned a deletion code, which explains the reason for the redaction, and according to agency officials, it provides congressional requesters with a deletion code sheet that describes the reasons for any redactions.

Conclusions

DOJ and FBI have made progress in implementing ISOO recommendations that help to strike a balance between the need to protect and the need to share critical information. FBI was taking action on almost all of ISOO’s recommendations, and if it completes them, this will help to lower program risk, since FBI makes 98 percent of the classification decisions at DOJ. On the other hand, DOJ’s program will remain at risk until DOJ addresses the most critical recommendation—providing sufficient resources. This is important because DOJ sets policy, provides training, and conducts oversight of classification management across the department and its components. SEPS’s efforts to resolve staff limitations by acquiring additional resources through DOJ’s Working Capital Fund may still not guarantee its needs are met because it is not certain it will get these resources, and even if it does, the security office does not know the optimum number of staff resources required to carry out its responsibilities. Furthermore, DOJ has not provided evidence of how SEPS will use the anticipated resources to perform various functions or of SEPS’s strategy for how best to use these resources to address the remaining deficiencies ISOO identified in ways that reduce the most risks to protecting national security information, such as whether to focus on addressing training, oversight, or other program gaps first. Developing a strategy, based on thoughtful workforce analysis and identification of gaps, would give SEPS a solid foundation on which to base its resource decisions to help perform its responsibilities, including implementing the remaining ISOO recommendations.

Moreover, without policies and procedures to provide specific guidance, training, and oversight for managing sensitive but unclassified information, DOJ cannot have reasonable assurance that this information is properly restricted or disclosed. Although DOJ is waiting for the results of the interagency working group before proceeding with additional changes to its program, it is important that DOJ ensures that its sensitive but unclassified designation practices provide its employees with the tools they need to apply designations appropriately. These tools include specific guidance, systematic training, and effective internal controls for overseeing compliance with policies and guidance. Identifying and designating documents properly is vital for not only preventing potential damage to governmental, commercial, or private interests, but also for sharing information, particularly with law enforcement entities that need it to protect the homeland.

Recommendations for Executive Action

To strengthen DOJ’s management of classified information, we recommend that the Attorney General direct the SEPS director to take the following two actions: determine the resource level needed to ensure that it can effectively carry out the office’s responsibilities, including full implementation of the ISOO recommendations; and devise a strategy for making resources available and for using them most effectively to address remaining deficiencies in ways that reduce the most risk to proper management of classified information, such as determining whether to address training, oversight, or other program deficiencies first.

In addition, to help ensure that sensitive but unclassified designations are correctly and consistently applied, we recommend that once the interagency working group has determined the standard set of sensitive but unclassified designations for the federal government, the Attorney General ensure that the department and its various components take the following three actions: establish specific guidance for applying the designations they will ensure that all employees authorized to make the designations have the necessary training before they can designate documents, and set internal controls for overseeing sensitive but unclassified designations to help ensure that they are properly applied.

Agency Comments and Our Evaluation

We provided a draft of this report to DOJ for review and comment. DOJ provided only written technical comments on the draft, which we incorporated, as appropriate. In providing these comments, DOJ stated that it generally agreed with the report and recommendations, and upon receipt of the final report, it will provide a response to our recommendations directly to Congress, as required by statute.

As agreed with your office, unless you publicly release its contents earlier, we plan no further distribution of this report until 30 days from its issue date. At that time, we will send copies of this report to the appropriate congressional committees and subcommittees, the Attorney General, and other interested parties. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions concerning this report, please contact me at (202) 512-6510 or larencee@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Summaries of Related GAO Reports

This appendix summarizes the results of several related recently issued reports on agencies’ programs for sharing classified and sensitive information and designating information as sensitive but unclassified. In June 2006, we issued two reports: one on the Department of Defense’s classification management program and its effectiveness in minimizing classification errors and the other on the status of the Department of Energy’s classification management program. We also issued two reports in March 2006: one on programs to safeguard sensitive but unclassified information at the Departments of Defense and Energy and the other on the federal government’s efforts to share terrorism-related and other sensitive but unclassified information among federal and nonfederal entities. In June 2005, we issued a report on the designation of sensitive security information at the Transportation Security Administration. These reports noted that policies and procedures governing classified and sensitive information require a number of enhancements to help ensure the effectiveness of information security programs. The highlights page for each of these reports is attached for more information.

Highlights

Miclassifictio of nationaecritformtio imedeeffective iformtio ring, can provide dversarie with iformtio to hrm the Uited Ste and it llie, and imillions of doll voidble dmitrtive co. Areqted, GAO examied (1) whether the imlemetioof the Departmet of Defense’ (DOD) iformtion secritanagemerom, effectivel miimize the rik of miclassifictio; (2) the etet to which DOD ernnel follow eblihed rocedrefor classifngformtio, to iclde correctlrking classified iformtio; (3) the relibilitof DOD’s annual etimte of its number of classifictio deciions; and (4) the likelihood of DOD’s meeting automtic declassifictiodedli.

A lck of overht and iconstet imlemetio of DOD’sformtio ecrit rore icreasng the rik of miclassifictio. DOD’sformtio ecrit rom i decetrlized to the DOD comt level, and the Office of the Uder Secretof Defense for Itellice (OUSD(I)), the DOD office respnsible for DOD’sformtio ecrit rom, has limited ivolvemet with, or overht of, coms’formtio ecrity pro. While ome DOD com and their subordinate comman appr to manage effective ro, GAO idetified wess other the reas of classifictioanagemet trng, elf-inspections, and classifictio guide. For exale, trng t 9 of the 19 com ansubordinate comman reviewed did ot cover funmel classifictioanagemericile, such as how to roerlrk classified iformtio or the rocess for determing the dtio of classifictio. Alo, OUSD(I) doe ot hve rocess to cofirm whether elf-inspectionsve bee erformed or to evuate their qualit. O 8 of the 19 coms performed elf-inspections. GAO o found thome of the DOD com ansubordinate commantht were examied rotiel do ot submit coie of their ecrit classifictio guide, docmetio tht idetifie which iformtio eed rotectio and the reas for classifictio, to cetrl libry as reqired. Some did ot trck their classifictio guide to ensure the were reviewed t least ever for crre as reqired. Because of the lck of overht and wess trng, elf-inspectio, anecrit classifictio guide managemet, the Secret of Defense cannot be assured tht the iformtio ecrit rom i effectivel limiting the rik of miclassifictio cross the departmet.

To redce the rik of miclassifictio and imrove DOD’sformtio ecritertions, GAO i recommeding s ctions, iclding everl to icreasrom overht anccounbilit. Ireviewing drft of thi reort, DOD corred with GAO’s recommetions. DOD rovided techicl comme, which we hve iclded as approrite.

GAO’s review of nprobbilit sale of 111 classified docme from five office withi the Office of the Secret of Defenshow tht, withi thee office, DOD ernnel re ot uniforml followingblihed rocedre for classifngformtio, to iclde mirking. I docmet review, GAO qtioed DOD officis’ classifictio deciions for 29—tht i, 26 ercet of the sale. GAO o found tht 92 of the 111 docmexamied (83 ercet) ht least oe mrking error, and more thanlf hd mltile mrking error. While the result from thi review cannot be erlized cross DOD, the re constet with the wess GAO found i the way DOD imleme itformtio ecrit rom. www.go.gov/cgi-in/getrpt?GAO-06-706.

To view the fll prodct, inclding the cope nd methodology, click on the link above. For more informtion, contct Dvi M. D'Agotino t (202) 512-541 or dgotinod@go.gov.

The cc of DOD’s classifictiodeciiotimtetionable because of the considerble vriance i how thee etimte re derived cross the departmet, and from r to r. However, bennng with the fir 200timte, OUSD(I) will review etimte of DOD com. Thi dditional review cold imrove the cc of DOD’s classifictio deciiotimte if methodoloicl iconstecie re redced.

Highlights

Highlight of GAO-06-75, report to the Chirmn, Subcommittee on NtionSecrity, Emerging Thre nd Interntionl Reltion, Committee on Government Reform, House of Repreenttive

I rece, the Cngressas become icreasngcocered tht federagcie re miclassifngformtio. Cassified iformtioteril cong national defense or foreign olicformtio determied b the U.S. overmet to reqire rotectiofor reasns of nationaecrit. GAO was asked to assss the etet to which (1) DOE’s trng, guidance, and overht ensure tht iformtio classified and declassified ccording to eblihed criteria and (2) DOE has found docmeto be miclassified.

GAO i recommeding tht DOE coct imilnumber of classifictio overht review, imilr deth of anays, as it did before the October 2005 shift irespnsibilit for classifictiooverht; app election procedretht more randomlidetif classified docme for review; and dicloe theelectio rocedrere classifictionspectioreort.

DOE’s Office of Cassifiction’s systemtic trng, comrehensive guidance, and riorous overht roel successl hitor of ensuring tht iformtioas classified and declassified ccording to eblihed criteri. However, an October 200 hift i respnsibilit for classifictio overht to the Office of Secrit Evuationsas creted uncerty abot whether hih level of erformance i overht will be sused. Specificll, rior to thi hift, the Office of Cassifictioerformed 34 inspections of classifictio ro t DOE ite ce 2000. Thee inspections reviewed whether DOE ite comlied with agclassifictio olicies anrocedre. After the October 2005 shift, however, the pace of thi overht wasterrupted as classifictiooverht ctivitieceased until Februa 2006. So fr i 2006, oe classifictio overht reort has bee comleted for two offices at DOE’s Pante Site i Texas, and work o ecod reort i under way t for offices at the SaannaRiver Site i Sth Carolina. More overht inspections evuating classifictio ctivity at eiht DOE office re anned for the remder of 2006. I dditio, ccording to the Director of the Office of Secrit Evuations, the rocedre for coctingre overht re till evolving—iclding the number of ite to be inspected and the deth of anays to be erformed. If the overht inspections panned for the remder of 2006 re comleted, it will demonstrte resutio the pace of overht cocted rior to October 200. However, if thee inspections are ot comleted, or re ot as comrehensive as the past, the eteand deth of overht will be dimihed and may result i DOE classifictio ctivitie becoming less relible and more roe to miclassifictio.

DOE agreed with GAO’s three recommetionsasserted it was lreking ctions and mking ans to ensure tht the classifictio overht rom remns effective. Although GAO icoaged b DOE’s effort, until the agblihe record of ccomlihmeunder the ew organiztionatrctre, it will ot be cler whether overht will be as effective as it has bee. www.go.gov/cgi-in/getrpt?GAO-06-75.

To view the fll prodct, inclding the cope nd methodology, click on the link above. For more informtion, contct Gene Aloie, 202-512-41, loiee@go.gov.

O the bas of review of classified docme erformed dring it 34 overht inspections, the Office of Cassifictio believe tht ver few of DOE’s docmed bee miclassified. The departme’s review of more than 12,000 docme betweeand 200 uncovered 20 docme tht hd bee miclassified—less thane-th of 1 ercet. DOE officibelieve tht it miclassifictiote i reasnable ive the le volme of docme rocessed. Mot miclassified docme remed classified, jusot t the approrite level or cteor. Of reter cocer re the everl docme thhold hve bee classified bt mike were ot. Whe mike ot classified, such docmeayup librrie or o DOE Web ite where the cold revel classified iformtio to the public. The o otble hortcomings we idetified i thee inspections were the iconstet way the Office of Cassifictio te elected the classified docme for review anilre to dequatel dicloe therocedre their reort. Inspectio teunfettered ccess whe electing docme to review ome ite, bt other thereviewed docme from collections reelected b ite offici. Office of Cassifictio reort do ot dicloe how docme were elected for review.

Highlights Highgg lighgg thh s

What GAO Recommends What GAO Recommends

GAO mde everl GAO mde everl recommeaa ions forff DOE and recommetions for DOE and DOD to clrif their olicie to their olicie to DOD to clrifff assure the consteapplictio of assure the consteapaa plictioof OUO and FOUO degnations and OUO and FOUO degnaaa ions and icrease the level of managemet icrease the level of managemet overht i their use. overht itheir use.

While both DOE and DOD offer trng their OUO and FOUO olicie, While both DOE and DOD offer trng their OUO and FOUO olicie, either DOE or DOD has an agwide reqiremet tht emloeebe either DOE or DOD has an agwide reqiremet tht emloee be tred before the degnate docme as OUO or FOUO. Moreover, tred before the degnate docme as OUO or FOUO. Moreover, either ag coct overht to assure tht iformtio either agcoct overht to assure tht iformtio approritelidetified and mrked as OUO or FOUO. According to approritel idetified and mrked as OUO or FOUO. According to Stanrds for Iternal Cotrol ie Federl Governm, trng anStanrds for Iternal Cotrol ie Federl Governm, trng and overht re imortant elemecreting a good iternal cotrol overht re imortant eleme creting ood iternal cotrol rom. DOE and DOD offici told us tht limited rerce, and i the rom. DOE and DOD offici told us tht limited rerce, and i the case of DOE, the ewss of the rom, haa e cotribted to the lck of case of DOE, the ewss of the rom, hve cotribted to the lck of trng reqqq ireme and overht. Noetheless, the lck of trng trng reqireme and overht. Noetheless, the lck of trng reqiremes and overht of the OUO and FOUO roleve DOE and reqireme and overht of the OUO and FOUO ro leve DOE and DOD offici unable to assure tht OUO and FOUO docme re mrked DOD officiunable to assure tht OUO and FOUO docme re mrkedff and handled i anner constet with ag olicies and may res and handled i anner constet with ag olicie and may result i lt iaa constecies and errorthe applictioof the ro. iconstecie and error the applictio of the ro.

DOE and DOD agreed with mot of DOE anaa DOD agreed with mot of GAO’s recommetions, bt GAO’s recommetions, bpartill disagreed with it partrr illdisagreed with itrecommetio to eriodicll recommetioto eriodicll review OUO or FOUO iformtio. review OUO or FOUO ifoff rmaa io. DOD o disagreed thernnel DOD o disagreed thaa pernnel degnating docmeas FOUO degnating a docmeas FOUO hold o mrk it with the hold o mrk it with the applicble FOIA eemtio. applic aa ale FOIA eemtio. www.go.gov/cgi-in/getrpt?GAO-06-69. www.go.gov/vv cgi-in/getrpt?GAO-06-69.

To view the fll prodct, inclding the cope To view the fll prodct, inclding the cope nd methodology, click on the link above. nd methodology, click on the link above. For more informtion, contct Dvi For more informtion, contct Dvi D'Agotino t (202) 512-541 or Gene Aloie D'Agotino t (202) 512-541 or Gene Aloit (202) 512-41. t (202) 512-41.

Highlights

Highlight of GAO-06-5, report to congressionl requter

A number of iititive to imrove iformtio ring ve beelled for, iclding the HomelanSecritAct of 2002 and ithe Itellice Reform and Terrorim Prevetio Act of 2004. The 2002 ct reqired the develomet of olicie for ring classified annsitive bunclassified homelanecritformtio. The 2004 ct clled for the develomet of an Iformtio Sring Eviromet for terrorim iformtio.

Thi reort exami (1) the us of effort to ebliovermet- wide iformtio ring olicies anrocess and (2) the univere of nsitive bunclassified degnations used b the 26 agcie tht GAO surveed and their relted olicie anrocedre.

More than fter Stember 11, the natio till lck overmetwide olicies anrocess to hel agcietete the mrid of ongoing effort, iclding the agititivewe idetified, to imrove the ring of terrorim-relted iformtio tht i criticl to rotectingr homeland. Rspnsibilit for creting theolicie anrocess hifted iitill from the White House to the Office of Managemeand Bet (OMB), and the to the Departmet of HomelanSecrit, be has et comleted the task. Sueqtl, the Itellice Reform Act clled for cretio of an Iformtio Sring Eviromet, iclding overng olicie anrocess for ring, an rom manager to overee it develomet. I December 200, the Preidet clrified the role and respnsibilitie of the rom manager, ow under the Director of Ntional Itellice, as well as the ew Iformtio Sring Cuncil and the other agcie support of creting an Iformtio Sring Eviromet b December 2006. At the time of or review, the rom manager was the erl ag of ddressng thiante. He issued anterim imlemetio reort with specified tas and mileto to CngressJanua 2006, boo fter annunced hi regnatio. Thitettemt to eblian overll iformtio- ring rod map under the Director of Ntional Itellice, if it i to succeed oce ew manager i appoited, will reqire the Director’s cotinued viilance i moitoring roress towrd meeting kemileto, idetifng anyrrier to chieving them, and recommeding any ecessachang to the overht committee.

To rovide for iformtio-ring policie anrocedre, GAO recomme tht the Director of Ntional Itellice (DNI) assss proress, ddressrrier, anroe chang, and tht OMB work with agcien policie, rocedre, and cotrol to help achieve more ccounbilit. OMB said tht oce ODNI comleted itwork, OMB wold work with ODNI anll agcien additionateps, if eeded. ODNI declied to commet or reort, idicting tht the subject mtter iide GAO’s purview. We disagree with thi assssmet because it does not cctel reflect the coe of GAO’s tory authoritie.

The agcie tht GAO reviewed re usng 56 differensitive bunclassified degnations (16 of which belong to oag) to rotect iformtio tht the deem criticl to their missions—for exale, nsitive w or drugforcemet iformtio or cotrolled nucler iformtio. For mot degnations there re overmetwide olicie or rocedre tht decribe the bas which an agy shold assgn ive degnatio and ensure tht it will be used constetlfrom oag to another. Withosuch olicie, ech ag determi wht degnations anassocited olicie to app to the nsitive iformtio it develops or re. More thanlf the agcie reorted chlleng ring such iformtio. Finall, mot of the agcie GAO reviewed hve olicie for determing who and how many emloee hold hve authorit to mke nsitive bunclassified degnations, roviding them trng how to mke thee degnations, or erforming eriodic review to determie how well their ctices are working. The lck of such recommeded iternal cotrolcreas the rik tht the degnations will be misapplied. Thi cold result i either unnecessaril retricting teri tht cold be red or nadvertetl releasngteri thhold be retricted. www.go.gov/cgi-in/getrpt?GAO-06-5.

To view the fll prodct, inclding the cope nd methodology, click on the link above. For more informtion, contct Dvid Powner, 202-512-926, pownerd@go.gov or Eileen Lrence, 202-512-6510, lrencee@go.gov.

Highlights

What GAO Recommends

TSA o lck dequate iternal cotrol to rovide reasnable assuance tht it SSI degnatio rocess being constetl applied cross TSA. Specificll, TSA has ot eblihed and docmeted olicie and iternal cotrol rocedre for moitoring comliance with the regutions, olicie, anrocedre overng it SSI degnatio rocess, icldingngoing moitoring of the rocess. TSA offici told us tht it ew SSI Prom Office will ltimtel be respnsible for ensuring thff re constetl appng SSI degnations. Thi office, which wasblihed i Februa, will o develo and imlemell TSA olic cocerng SSI handling, trng, anrotectio. More detiled iformtio how thi office’s ctivitie will be oertionalized was ot et ilble. Specificll, TSA offici rovided o writte olicie formlizing the office’s role, respnsibilitie, anauthorit.

GAO recomme tht the Secret of HomelanSecrit direct TSA to eblih cleguidance anrocedre for usng the TSA regutions to determie wht constitte SSI; eblicler respnsibilit for the idetifictio and degnatio of SSI iformtio; eblih iternal cotrol moitoring comliance with it SSI regutions, olicie, anrocedre, and communicte tht respnsibilit for imlemeting the cotrol throughot TSA; anrovide specilized trng to thoe mking SSI degnations how iformtio to be idetified and evuated for SSI us. The Departmet of HomelanSecrit erll corred with or recommetions.

TSA has ot develoed olicie anrocedre for roviding specilized trng for ll of it emloeeking SSI degnations how iformtio idetified and evuated for rotected us. Develomet of such trng for SSI degnations eeded to helnsure constet imlemetio of the degnatio authorit cross TSA. While TSA has rovided trng briefing SSI regutions to cert ff, such as the FOIA ff, it doe ot hve specilized trng ce to instrct emloee how to constetl degnate iformtio as SSI. I dditio, TSA has o writte olicie idetifng who i respnsible for ensuring tht emloee com with SSI trng reqireme. www.go.gov/cgi-in/getrpt?GAO-05-677.

To view the fll prodct, inclding the cope nd methodology, click on the link above. For more informtion, contct Laurie E. Ektrnd t (202) 512-777 or ektrndl@go.gov.

Appendix II: Objectives, Scope, and Methodology

This report responds to the following questions: 1. To what extent has the Department of Justice (DOJ) implemented the Information Security Oversight Office’s (ISOO) recommendations? 2. To what extent has the Federal Bureau of Investigation (FBI) implemented ISOO’s recommendations? 3. What policies, procedures, and internal controls are in place in selected DOJ components to properly use sensitive but unclassified designations? 4. What processes are in place at selected DOJ components respond to intragovernmental requests to share national security and sensitive but unclassified information?

To determine the extent of changes DOJ and the FBI have made to implement ISOO’s recommendations, published in July 2004 and April 2005, we reviewed the results of ISOO’s audits; obtained supporting documents, when available, such as DOJ and FBI policy directives, orders, and guidance; and interviewed DOJ and FBI managers responsible for implementing and overseeing these programs. Although the results of ISOO’s reviews are not necessarily generalizable to all classified documents at DOJ and the FBI, we assessed the methodology ISOO used to conduct its reviews and determined that it is adequate to support its recommendations. We also compared ISOO’s recommendations and DOJ’s and FBI’s classified information practices to Executive Order 12958, as amended; ISOO’s Directive No. 1, entitled Classified National Security Information; and our Standards for Internal Control in the Federal Government, as appropriate. We did not assess the effectiveness of the security education and training programs at DOJ and the FBI.

To determine the extent of policies, procedures, and internal controls that selected DOJ components have in place for designating information as sensitive but unclassified, we used our Standards for Internal Control in the Federal Government to provide criteria against which we assessed components’ sensitive but unclassified designation policies and procedures. Moreover, we reviewed DOJ-specific data collected as part of GAO’s governmentwide review of 26 agencies’ programs on sensitive but unclassified information. These data consisted of written responses to a set of questions about the agencies’ policies, procedures, and internal controls and any written documentation provided in support of these responses, such as policy and training manuals. We selected the five DOJ components included in this review—Bureau of Alcohol, Tobacco, Firearms and Explosives; Criminal Division; Drug Enforcement Administration; the FBI; and U.S. Marshals Service—because data collected as part of a GAO governmentwide review of sensitive but unclassified information indicated that each of these DOJ components had adopted one or more of this type of designation in addition to the departmentwide Limited Official Use designation. We conducted follow-up interviews with security officials and senior program officials in these five components to supplement information gathered as part of GAO’s governmentwide review. We also examined individual components’ written policies and procedures on sensitive but unclassified information, when available.

To determine how selected DOJ components respond to federal intragovernmental requests for classified and sensitive but unclassified information, we obtained documentation of their response processes from the five components, when available, and interviewed security officials and senior program officials. We compared their processes for responding to these requests to identify similarities and differences within and across the components and reviewed supporting documents, when available. We did not independently test the effectiveness of the processes components described to us.

We conducted our work from June 2005 through August 2006 in accordance with generally accepted government auditing standards.

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Glenn Davis, Assistant Director; Cynthia Auburn; Kathryn Godfrey; David Hudson; Thomas Lombardi; Mary Martin; Terry Richardson; and Susan Tieh made key contributions to this report.