Classified Information Policy and Executive Order 13526
Released: 2010-12-10T00:00:00

Recent Heightened Interest

President Barack H. Obama issued Executive Order 13526 on "Classified National Security Information" on December 29, 2009.

In the months succeeding the issuance of E.O. 13526, multiple incidents have further heightened congressional, media, and public interest in the issue of classified information policy:

1. Shamai Leibowitz, a former Federal Bureau of Investigation contractor, was sentenced to prison for divulging classified materials to a blogger. 2. Wikileaks .org , an organization that describes itself as a "public service designed to protect whistleblowers, journalists and activists who have sensitive materials to communicate to the public," published online more than 600,000 classified diplomatic cables and government documents produced during the wars in Afghanistan and Iraq. These disclosures have been condemned by the Obama Administration and other officials. 3. An August 6, 2010, memorandum indicates that the Department of Defense (DOD) is purchasing and destroying the entire first edition of a book by a former employee. The agency believes the book reveals classified information regarding military and intelligence operations in Afghanistan. 4. Jack Goldsmith, a former U.S. assistant attorney general, has alleged that "senior government officials" have leaked classified information to journalist Bob Woodward.

These incidents occurred in the wake of other information releases in the past few years.

This report addresses classified information policy, including its history, costs, and the agencies assigned a role in it. The report focuses on Executive Order 13526, which establishes the current policy, and identifies possible classified information policy oversight issues for Congress.

Overview: Classified Information Policy

Definition

Many authorities and policies limit access to information held by the federal government. Three examples include

Article I, Section 5, of the U.S. Constitution specifies that each house of Congress "shall keep a Journal of its Proceedings, and from time to time publish the same, excepting such Parts as may in their Judgment require Secrecy;" Federal law keeps personal income tax records confidential (26 U.S.C. 6103); and Federal agencies have devised policies to restrict access to information. Agencies have, for example, marked documents as "For Official Use Only," which proscribes their public release.

This report focuses on one of these policies—classified information policy, which also is called security classification policy and classified national security information policy .

Federal law has defined classified information as

information or material designated and clearly marked or clearly represented, pursuant to the provisions of a statute or Executive order (or a regulation or order issued pursuant to a statute or Executive order), as requiring a specific degree of protection against unauthorized disclosure for reasons of national security (50 U.S.C. 426(1)).

Broadly speaking, classified information policy refers to a range of federal governmental practices that aim to restrict access to information or documents on the grounds of national security. The purpose in limiting access to this information is to prevent it from being used by persons, organizations, or nations to inflict harm upon the United States.

As the two following sections describe, Congress has enacted classified information policy statutes. However, classified information policy largely has been established through executive orders.

Executive Orders

Since 1940, Presidents regularly have issued executive orders to set classified information policies ( Table 1 ). As this report later details, President Obama has revised classified information policy through the issuance of E.O. 13526 on December 29, 2009.

Typically, these directives have defined

who in the federal government may classify information, what levels of classification and classification markings (e.g., "top secret") may be used, who may access classified information, and how and when classified information is to be declassified.

These executive orders also have limited the use of classification. For example, executive orders have forbidden the use of classification "to conceal violations of law, inefficiency, or administrative error; to prevent embarrassment to a person, organization, or agency; to restrain competition; or to prevent or delay the release of information that does not require protection in the interest of national security" (e.g., E.O. 12356, Section 1.6).

In some instances, executive orders have mandated the declassification of documents (E.O. 12937), or established new agencies to implement aspects of classified information policy (E.O. 12065).

Frequently, a new executive order repeals the classified information policies of previous executive orders. One exception to this generalization is E.O. 10104 (1950). This order limits the dissemination of information regarding "certain vital military and naval installations or equipment" and has not been repealed explicitly. President Truman issued this executive order subsequent to the enactment of statutes that remain law (18 U.S.C. 795 and 797).

Statutes

As described above, classified information policy largely has been established through executive orders. However, periodically Congress has enacted classified information statutes, including those that

forbid individuals from gathering, receiving, and transmitting information related to national defense and intelligence activities, and authorize sanctions, including the death penalty in certain instances (62 Stat. 736-738; 18 U.S.C. 793-797); forbid the disclosure of classified information regarding intelligence codes, systems, or cryptography (65 Stat. 719; 18 U.S.C. 798); protect the identities of covert intelligence agents and criminalize their disclosure ( P.L. 97-200 , Sec. 2(a); 96 Stat. 122; 50 U.S.C. 421); established the Public Interest Declassification Board (PIDB) and charged it with advising the President and other public officials on information declassification policy ( P.L. 106-567 , Title VII; 114 Stat. 2856; 50 U.S.C. 435, Amendments); and required the establishment of procedures for the protection against unauthorized disclosure of any classified information in the custody of federal courts, including the Supreme Court ( P.L. 96-456 ; 94 Stat. 2025; 18 U.S.C. Appendix).

Congress enacted a particularly significant classified information policy in the FY1995 intelligence authorization act ( P.L. 103-359 , Sec. 802; 108 Stat. 3435; 50 U.S.C. 435). It assigned to the President the responsibility to establish procedures governing access to classified information. This made into law what had hitherto been a practice—allowing the President to have a lead role in devising classified information policy.

Most recently, Congress enacted P.L. 111-258 , the Reducing Over-Classification Act, which President Obama signed into law on October 9, 2010. According to the Senate report accompanying the legislation, this statute aims to

prevent federal departments and agencies from unnecessarily classifying information or classifying information at a higher and more restricted level than is warranted, and by doing so to promote information sharing across departments and agencies and with State, local, tribal and private sector counterparts, as appropriate.

To these ends, the statute advances multiple measures, including requiring executive branch agencies' inspectors general to assess whether their agencies are following current classified information policies ( P.L. 111-258 , Section 6(b)).

Estimated Annual Federal Expenditures

The federal government's total annual expenditures for classifying and declassifying information are not publicly available.

The Information Security Oversight Office (ISOO), an agency within the National Archives and Records Administration (NARA), annually releases a report on agencies' estimated classified information policy costs. However, these estimates are drawn from the agencies' own estimates, which are not audited by ISOO or any other agency. Additionally, the ISOO report figures do not include the costs of the Central Intelligence Agency (CIA), the Defense Intelligence Agency (DIA), Office of the Director of National Intelligence (ODNI), the National Geospatial-Intelligence Agency (NGIA), the National Reconnaissance Office (NRO), and the National Security Agency (NSA). The classified information policy cost estimates for these latter agencies are provided to the President in a classified addendum to the report.

The ISOO reports that total government classified information policy costs were $8.8 billion in FY2009. This amount is slightly higher than the estimated costs in each of the four previous years ( Figure 1 ).

Nearly 55% ($4.8 billion) of the FY2009 estimated costs are attributed by agencies to "information security," an administrative category that includes the information systems (e.g., computer hardware and software) used to collect, store, and utilize classified information, and administrative expenses related to information security classification activities.

Approximately 15% ($1.3 billion) of classified information policy costs are attributed to "security management, oversight, and planning." The remaining 30% ($2.7 billion) of costs goes toward the costs of personnel security (e.g., background checks on persons with access to classified information), the training of personnel in the proper handling of classified information, and the physical security of facilities holding classified information.

In FY2009, the federal government is estimated to have spent $44.7 million to declassify information. This amounts to 0.5% of the FY2009 total classified information policy costs ($8.8 billion).

Classified Information Policy: Who Does What?

Generally speaking, authorized executive branch agencies are to classify information in accordance with standing classified information policy. Agencies also are obliged to secure this information and to train their personnel in its proper handling. Executive branch inspectors general, as noted previously, must assess their agencies' compliance with classified information policy.

However, four entities have been established and assigned classified information policy responsibilities: (1) the Information Security Oversight Office (ISOO), (2) the Public Interest Declassification Board (PIDB), (3) the Interagency Security Classification Appeals Panel (ISCAP), and (4) the National Declassification Center (NDC). The authorizations that established these entities and their responsibilities are described below.

Information Security Oversight Office

President James E. Carter established the Information Security Oversight Office via E.O. 12065, which he issued on June 28, 1978. The ISOO is located within the NARA.

Under E.O 13526, Part 5, the ISOO is responsible for issuing the directives necessary to implement the executive order, and for reviewing agencies' compliance therewith. More specifically, the ISOO establishes the standards for

1. classification, declassification, and classification marking principles; 2. safeguarding classified information; 3. agencies' security education and training programs; 4. agencies' self-inspection programs; and 5. agencies' classification and declassification guides.

The ISOO also is authorized to conduct on-site evaluations of agencies' compliance with E.O. 13526 and to act upon complaints regarding agencies' implementation of the executive order. Annually, the ISOO produces a report on the implementation of classified information policy and another on the federal government's information classification and declassification costs.

Interagency Security Classification Appeals Panel

President Clinton established the Interagency Security Classification Appeals Panel via E.O. 12958, which he issued on April 20, 1995. While President Obama's E.O. 13526 made modest augmentations to the ISCAP's role, its membership and duties remain largely as they were upon establishment.

The ISCAP's members include the director of the ISOO, who serves as its executive secretary, and senior-level representatives from the Departments of State, Defense, and Justice, and the National Archives, the Office of the Director of National Intelligence, and the National Security Advisor. (The President designates the ISCAP chair from among the aforementioned persons.) The CIA may appoint a temporary member in instances where information classified by the CIA is under consideration. The ISOO provides administrative support to the ISCAP.

The ISCAP was designed to serve as a forum for resolving declassification disputes. The ISCAP decides in instances involving (1) disputes over or challenges of the proper classification level of information; (2) agencies wishing to exempt information from automatic declassification; and (3) persons or entities (private or governmental) appealing an agency's decision to keep information classified after said person or entity has requested its declassification.

Public Interest Declassification Board

Congress established the Public Interest Declassification Board on December 27, 2000 ( P.L. 106-567 , Sec. 703; 114 Stat. 2856; 50 U.S.C. 435 Amendments). This independent executive branch agency has nine members, five of whom are appointed by the President, and four of whom are appointed by Congress. The Director of the ISOO serves as the PIDB's executive secretary.

The law requires the PIDB to

1. advise the President, the Assistant to the President for National Security Affairs, the Director of the Office of Management and Budget, and such other executive branch officials as the Board considers appropriate on the systematic, thorough, coordinated, and comprehensive identification, collection, review for declassification, and release to Congress, interested agencies, and the public of declassified records and materials (including donated historical materials) that are of archival value, including records and materials of extraordinary public interest. 2. promote the fullest possible public access to a thorough, accurate, and reliable documentary record of significant United States national security decisions and significant United States national security activities in order to (A) support the oversight and legislative functions of Congress; (B) support the policymaking role of the executive branch; (C) respond to the interest of the public in national security matters; and (D) promote reliable historical analysis and new avenues of historical study in national security matters. 3. provide recommendations to the President for the identification, collection, and review for declassification of information of extraordinary public interest that does not undermine the national security of the United States, to be undertaken in accordance with a declassification program that has been established or may be established by the President by executive order. 4. advise the President, the Assistant to the President for National Security Affairs, the Director of the Office of Management and Budget, and such other executive branch officials as the Board considers appropriate on policies deriving from the issuance by the President of executive orders regarding the classification and declassification of national security information (50 U.S.C. 435 Amendments).

In December 2007, the PIDB published a report, Improving Declassification , and participated in the process that led to the issuance of E.O. 13526. The PIDB also has held public meetings to discuss declassification issues.

National Declassification Center

President Obama established the National Declassification Center via E.O. 13526. The NDC, which is described below, is responsible for expediting the declassification of information accessioned (or released) to the NARA.

The Obama Administration's Review of Classified Information Policy

When President Obama took office in January 2009, classified information policy was established by E.O. 12958 as amended by E.O 13292. President William J. Clinton issued E.O. 12958 on April 17, 1995, and his successor President George W. Bush amended it via E.O. 13292 on March 28, 2003.

President Obama ordered a review of classified information policy on May 27, 2009. The President wrote,

[M]y Administration is committed to operating with an unprecedented level of openness. While the Government must be able to prevent the public disclosure of information where such disclosure would compromise the privacy of American citizens, national security, or other legitimate interests, a democratic government accountable to the people must be as transparent as possible and must not withhold information for self-serving reasons or simply to avoid embarrassment.

To achieve these goals, the Assistant to the President for National Security Affairs (commonly known as the National Security Advisor) was to submit to the President "recommendations and proposed revisions" to the current policy (E.O. 12958) regarding

(i) Establishment of a National Declassification Center to bring appropriate agency officials together to perform collaborative declassification review under the administration of the Archivist of the United States;

(ii) Effective measures to address the problem of over classification, including the possible restoration of the presumption against classification, which would preclude classification of information where there is significant doubt about the need for such classification, and the implementation of increased accountability for classification decisions;

(iii) Changes needed to facilitate greater sharing of classified information among appropriate parties;

(iv) Appropriate prohibition of reclassification of material that has been declassified and released to the public under proper authority;

(v) Appropriate classification, safeguarding, accessibility, and declassification of information in the electronic environment, as recommended by the Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass Destruction and others; and

(vi) Any other measures appropriate to provide for greater openness and transparency in the Government's security classification and declassification program while also affording necessary protection to the Government's legitimate interests.

The National Security Advisor's response was due in 90 days.

At the request of the National Security Advisor, the Public Interest Declassification Board established a website to solicit public input on improving classified information policy. The PIDB asked the public to limit their comments to (1) declassification policy, (2) a national declassification center, (3) classification policy, and (4) technology issues and challenges. Approximately 150 comments were submitted to the PIDB during the two weeks of the submission period (June 29, 2009 to July 10, 2009). The PIDB also held a public meeting in Washington, DC, on July 8, and then transmitted the comments it received to the National Security Advisor.

After an interagency review process, the Obama Administration issued its revisions to classified information policy in Executive Order 13526 on December 29, 2009, along with an accompanying memorandum and order.

Current Classified Information Policy: E.O. 13526

E.O 13526 revoked E.O. 12958 as amended by E.O. 13292 and "prescribe[d] a uniform system for classifying, safeguarding, and declassifying national security information." The major components of this new policy are enumerated below.

Classification Levels

E.O. 13526 maintains the three long-standing classification levels, or classification markings, of top secret, secret, and confidential.

(1) "Top Secret" shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe;

(2) "Secret" shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe; [and]

(3) "Confidential" shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe (Section 1.2(a)).

The term or iginal classification authority refers to the person or agency who initially classified a piece of information.

To improve the accuracy of classification activities, E.O. 13526, Section 1.9 requires agencies to complete a "comprehensive review" of their internal classification guidance within two years. Previously, there has been evidence to indicate that many agencies use classification guides that are out of date and not fully in alignment with current classification policy.

The Types of Information That May Be Classified

In keeping with previous executive orders, E.O. 13526 limits classification to information that pertains to

(a) military plans, weapons systems, or operations;

(b) foreign government information;

(c) intelligence activities (including covert action), intelligence sources or methods, or cryptology;

(d) foreign relations or foreign activities of the United States, including confidential sources;

(e) scientific, technological, or economic matters relating to the national security;

(f) United States Government programs for safeguarding nuclear materials or facilities;

(g) vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security; or

(h) the development, production, or use of weapons of mass destruction (Section 1.4).

Additionally, E.O. 13526 continues the prohibition on the use of classification to

(1) conceal violations of law, inefficiency, or administrative error;

(2) prevent embarrassment to a person, organization, or agency;

(3) restrain competition; or

(4) prevent or delay the release of information that does not require protection in the interest of the national security (Section 1.7).

Section 1.7 of the order also forbids the classification of "[b]asic scientific research information not clearly related to the national security."

Challenges to Classification and Classification Levels

Persons who are authorized by E.O. 13526 or statute to hold classified information may challenge the classification of a piece of information (Section 1.8). They also may challenge its level of classification. Thus, for example, if two agencies classified the same piece of information at different levels (e.g., top secret and secret), each agency may contest the other's classification marking. Such disputes are resolved by the ISCAP.

Persons Authorized to Classify Information and Derivative Classification

Original classification refers to an instance when a government official classifies a piece of information that hitherto had not been classified. Derivative classification refers to an instance when originally classified information is reproduced or used in the course of producing other classified information. Original classifiers and their delegates may produce derivatively classified information, but most derivatively classified material likely is produced by other persons whose positions require them to work with classified information (e.g., intelligence analysts). E.O. 13526 sets forth policies for both original and derivative classification.

E.O. 13526 empowers the President, Vice President, and "agency heads and officials" with original classification authority (Section 1.3). An individual with original classification authority may delegate his or her power to other U.S. government officials, though any such delegations must be made known to the Director of the ISOO. The guidance that accompanied E.O. 13526 enumerates the more than two dozen "agency heads and officials" who possess original classification authority. It also clarifies which officials may classify information at the three classification levels. Thus, for example, the Director of National Drug Control Policy is authorized to classify information at the top secret level (or any lower level), but the Secretary of Commerce may not classify above the secret level.

Both original and derivative classifiers must mark information that they classify with a classification marking, their name, their official position and agency, the date of classification, and the duration of classification (Section 1.6). Additionally, all persons with classification authority must be trained in classification and declassification policy. Persons so trained must study both executive-branch-wide policies (such as E.O. 13526) and their individual agency's classification guide (which holds agency-specific policies). Original classifiers must receive this training annually, and derivative classifiers must receive it every two years.

Duration of Classification

Section 1.5 of E.O. 13526 requires a public release date to be set when information is classified. Specifically, a classifier must designate a "specific date or event for declassification based upon the duration of the national security sensitivity of the information."

Under the previous executive order (E.O. 13142), classified information was to remain classified for not less than 25 years, absent agency action to declassify it. E.O. 13526 caps the duration for classification at 10 years, except in the instance of information that can "clearly or demonstrably be expected to reveal the identity of a confidential human source or key design concepts of weapons of mass destruction." Such information is to be classified for 25 years, and in accordance with policies set forth in Section 3.3, may remain classified for up to an additional 50 years.

Declassification

Declassification refers to the process by which classified information becomes unclassified. Usually, the onus of declassification falls upon the agency or persons who originally classified a piece of information. Said agency or person (or a delegate thereof) reviews the information to see whether it should be (1) declassified, (2) exempted from declassification by an exception within current classified information policy, or (3) referred to another agency that may seek to keep the information classified. In the end, the information might be wholly declassified, partially declassified (e.g., redacted), or remain wholly classified.

E.O. 13526 provides five means through which national security information may be declassified. First, whoever has classified a piece of information may declassify it when the reason(s) for its classification no longer hold. Second, declassification also may occur when an agency challenges the propriety of another agency's classification of information. (As mentioned previously, these "classification challenges" are resolved by the ISCAP.)

Part 3 of E.O. 13526 sets forth three additional means: automatic declassification, systematic declassification review, and mandatory declassification review.

Automatic declassification: Under automatic declassification, information 25 years or older moves to declassified status. This, however, does not mean that the records become immediately available to the public. The NDC must review the agency's declassification activities to see that they are in accordance with current policy. Additionally, other agencies' declassifiers may need to review the records for information that their agency believes should be kept classified. Finally, E.O. 13526, Section 3.3(b) provides nine such instances under which an original classifying authority may request that a piece of automatically declassified information remain classified.

Systematic declassification: According to E.O. 13526, Section 3.3 (h) and (j), an agency seeking to exempt information from automatic declassification must submit a detailed request to ISOO's director, and the ISCAP will adjudicate the request. If the ISCAP approves the request, the information in question is subject to systematic declassification review. Under this process, the information remains classified for up to an additional 50 years, after which it will be automatically declassified unless the classifying agency seeks another exemption.

Mandatory declassification review: Finally, E.O 13526, Section 3.5 sets the rules for mandatory declassification review, a process that is instigated in response to a request for declassification. As with Freedom of Information Act (5 U.S.C. 522) requests, a mandatory declassification review request may be sought by a member of the public. The process requires the original classifier to assess whether the classified information still meets the standards for continued classification enumerated in Section 1.2(a) of E.O. 13526. Certain types of information are exempt from mandatory declassification requests, such as information exempted from disclosure under the Freedom of Information Act (5 U.S.C. 552), information originated by the President or Vice President and some of the individuals who work with them, and documents required to be submitted for prepublication review (e.g., memoirs by intelligence agents).

A New Entity: National Declassification Center

E.O. 13526, Section 3.7 established the National Declassification Center (NDC) at the National Archives in College Park, MD. The NDC is headed by a director, who is appointed by the Archivist in consultation with the secretaries of the agencies that classify significant quantities of information (i.e., the Departments of State, Defense, Energy, Homeland Security) and the Attorney General and Director of National Intelligence. Currently the NDC has 75 employees, and it is charged with expediting both automatic and systematic declassification.

Although a new entity, the NDC has been in development since 2006. It was devised as a means for reducing the significant backlog of classified government records that have been released by agencies to the National Archives but not yet fully reviewed for declassification. The NDC recently estimated this backlog to be 418 million pages, and the memorandum to agency heads that accompanied E.O. 13526 requires the NDC to eliminate the backlog by December 31, 2013.

One of the causes for delay in declassification is what is often called "multiple agency equity" in classified information. Put simply, when an agency moves to declassify a document, it may contain information that other agencies may wish to keep classified. Thus, for example, a document that describes a foreign nation's clandestine efforts to acquire nuclear materials may be of interest to the Central Intelligence Agency, and the Departments of Energy and State. In these instances, the declassifying agency is obliged to refer the information to these other agencies and wait for their review of it and agreement to declassify it.

The NDC aims to speed up this process through multiple means, such as allowing declassifiers from multiple agencies to work more closely to review these multiple-agency-equity materials, and by implementing processes to reduce unnecessary referrals.

Safeguarding Classified Information

Generally speaking, agencies that produce and utilize classified information are obliged to safeguard it. E.O. 13526, Part 4 sets the basic standards for access to classified information by government employees and other persons:

(a) A person may have access to classified information provided that:

(1) a favorable determination of eligibility for access has been made by an agency head or the agency head's designee;

(2) the person has signed an approved nondisclosure agreement; and

(3) the person has a need-to-know.

This part of the executive order also requires regular training and retraining in the handling and safekeeping of classified information. E.O. 13526 also sets the conditions for the distribution of classified information outside of the original classifying agency, and Part 5 of the order empowers the ISOO to issue binding regulations that prescribe the standards for safeguarding, storing, distributing, transmitting, destroying, and accounting for classified information. The ISOO also must prescribe the standards for agencies' programs for training employees in classified information security and for carrying out self-inspection programs.

Possible Issues for Congress

E.O. 13526 and its accompanying memorandum and order were issued less than a year ago, so it may be premature to attempt an assessment of its success as a policy. However, several aspects of its implementation may be worthy of congressional attention.

1. E.O. 13526 continues the tradition of congressional deference to the executive branch in setting classified information policy. Since 1995, three Presidents (Clinton, Bush, Obama) have issued three executive orders (E.O. 12958, E.O. 13292, and E.O. 13526) requiring agencies to make significant revisions to their security classification policies and practices. Congress may opt to reevaluate the benefits and costs of the decision to permit significant changes in classified information policy via executive order.

2. As with previous executive orders, E.O. 13526 bases the classification levels on the criterion of damage. The differing levels of classification markings represent varying levels of possible "damage to national security." Thus, the classification marking of "'Confidential' shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe." Meanwhile, a document may be given the highest security protection if its release "could reasonably be expected to cause exceptionally grave damage." No other values or criterion are to be taken into account.

The terms damage and national security are inherently broad concepts. Neither damage nor the state of relations among nations are easily quantified or determinable with precision. E.O. 13526 carries these two terms under a unified definition that defines national security to include the United States' international relations.

"Damage to the national security" means harm to the national defense or foreign relations of the United States from the unauthorized disclosure of information, taking into consideration such aspects of the information as the sensitivity, value, utility, and provenance of that information.

Congress might examine the utility of the continued use of the singular criterion of harm and the concept of damage to national security . It also could assess the utility of the parameters of the term damage to the national secu rity to determine whether they are overly or insufficiently broad.

3. As described above, E.O. 13526 assigns significant classified information policy responsibilities to the ISOO, NDC, and NARA. An executive order cannot be used to appropriate funds from the U.S. Treasury; hence, Congress may assess whether these agencies have sufficient resources to carry out their work.

4. E.O. 13526, Section 1.9 requires classifying agencies to review their classification guides to ensure they comport with current classified information policy. This must be done within two years. One objective of this practice is to reduce the incidences of information being classified needlessly. Over-classification, or the act of classifying material that need not be classified, not only is a violation of government policy, it also creates unnecessary costs related to safe-keeping, handling, and declassification. Congress may ask agencies to report on their progress toward completing this task.

5. In the memorandum accompanying E.O. 13526, the President ordered the National Declassification Center to clear the more than 400 million pages of classified records more than 25 years old by December 31, 2013. The NDC's role is to facilitate agencies' review of these documents and their determinations to release records (in whole or in part), or to keep them classified.

To date, agencies' declassification of information has lagged behind their production of it. According to an NDC estimate, each year 15 million new pages of classified material are accessioned to the NARA, and only 11 million pages complete the declassification process and are made available to the public. The President's memorandum would require more than 400 million pages of information to move through this process in four years, a rate of approximately 100 million pages per year.

Congress may choose to monitor the NDC's progress toward achieving the reduction of the backlog.

6. Congress enacted the Reducing Over-Classification Act in October 2010, four months after the ISOO released its regulations (32 C.F.R. 2001) for implementing E.O. 13526. The Senate Committee on Homeland Security and Governmental Affairs wrote:

The Committee wishes to emphasize that none of the provisions in this Act is intended to supplant the Executive Branch's longstanding authority to determine what information should be appropriately classified within the framework established in Executive Order 13526 and its predecessors. Indeed, the Committee believes that the provisions of the Act complement and do not conflict with Executive Order 13526, and that both the Order and the Act will promote the goals of increased transparency, information sharing, and security.

Section 4 of this new statute requires the Secretary of DHS to appoint a classified information advisory officer, who has the authority to "develop and disseminate educational materials and to develop and administer training programs" to assist sub-federal actors (i.e., state, local, and tribal governments and private-sector firms) that utilize classified information. It is unclear whether this new official must have these materials and programs approved by the ISOO, which is authorized to set the standards for agencies' security education and training programs (E.O. 13526, Part 5). Congress may consider examining whether agencies have faced any challenges in implementing the new law and the executive order consonantly.

7. The Reducing Over-Classification Act aims to increase information-sharing among agencies. The illicit release of over 250,000 State Department cables, possibly by a Department of Defense employee, may indicate the inherent difficulty of balancing information sharing and information protection. Already, some agencies have announced new security controls. Furthermore, the Office of Management and Budget has ordered agencies that handle classified information to "establish a security assessment team consisting of counterintelligence, security, and information assurance experts to review the agency's implementation of procedures for safeguarding classified information against improper disclosures." Congress may move to hold a hearing where it can aggregate agency reports on their improvements to classified information safeguarding.

8. The incidents of unauthorized leaks cited at the beginning of this report appear to share a common feature—they involve persons authorized to have access to classified information. Congress may wish to survey these and other cases to determine whether there were further commonalities in these instances. Were, for example, the individuals' motivations similar? Were these individuals little supervised in their handling of classified information? Would increasing the negative consequences for the unauthorized release of classified information be likely to discourage further incidents? Was most of the information in electronic format?