"Sensitive But Unclassified" and Other Federal Security Controls on Scientific and Technical Information: Background on the Controversy
Released: 2004-02-20T00:00:00

Introduction

This report (1) summarizes provisions of several laws and regulations, including the PatentLaw, the Atomic Energy Act, International Traffic in Arms Control regulations, the USA PATRIOTAct ( P.L. 107-56 ), the Public Health Security and Bioterrorism Preparedness and Response Act of2002 ( P.L. 107-188 ), and the Homeland Security Act ( P.L. 107-296 ), that permit the federalgovernment to restrict disclosure of scientific and technical information that could harm nationalsecurity; (2) describes the development of federal controls on "sensitive but unclassified" (SBU)scientific and technical information; (3) summarizes current controversies about White House policyon "Sensitive But Unclassified Information," and "Sensitive Homeland Security Information" (SHSI)issued in March 2002; and (4) identifies controversial issues which might affect the development ofOffice of Management and Budget (OMB) and agency guidelines for sensitive unclassifiedinformation, which were expected to be released during 2003.

Federal Controls on Privately Generated Scientific and Technical Information

Several laws permit the federal government to classify privately-generated scientific andtechnical information that could harm national security, even when it is not held by federal agencies. These laws deal with patent law secrecy and atomic energy restricted data.

Patent Law Secrecy

Pursuant to 35 U.S.C. 181-188, the U.S. Patent Commissioner has the right to issue patent secrecy orders to prevent disclosure of information about an invention if disclosure by granting ofa patent would be detrimental to the national security. This provision is applicable to a patent forwhich the "government has a property interest" and those privately developed inventions which thegovernment does not own. Thus, if a federal government agency has a "property interest" in theinvention, the agency head will notify the Patent Commissioner, who is to withhold the publicationof the application or the granting of a patent. If the government does not have a property interestin the patent and the Commissioner decides that the granting of a patent or publication of anapplication would be detrimental to the national security, the Patent Commissioner is required toprovide the patent application in question for inspection to the Atomic Energy Commission [nowthe Secretary of Energy], the Secretary of Defense, or the heads of other relevant agencies. If theagency head determines that publication or disclosure by the grant of patent is detrimental to thenational security, the Patent Commissioner shall order that the invention be kept secret, and "shallwithhold the grant of a patent ... for such period as the national interest requires...." The owner ofthe application may appeal the decision to the Secretary of Commerce. The invention may be keptsecret for one year, but the Commerce Secretary may renew the secrecy order for additional periodsas instructed by the agency head who initially determined the need for secrecy. (1)

If a secrecy order is issued during time of war, it shall remain in effect for the duration of hostilities and for one year following cessation of hostilities. If a secrecy order is issued during anational emergency, it shall remain in effect for the duration of the emergency and six monthsthereafter. The order may be rescinded by the Patent Commissioner upon written notification of theagency head who requested the order.

In addition, to prevent circumventing the law, a license must be obtained from the Patent Commissioner before a U.S. inventor files for a foreign patent application or registers a design ormodel with a foreign patent office. Penalties for violation of the law include a fine of not more than$10,000 or imprisonment for not more than two years, or both. During FY2002, 4,792 secrecyorders were in effect on patents applications; most of these were recommended by and issued tofederal agencies for their own government-owned technical information; 37 were issued to individualprivate inventors. (2)

The Atomic Energy Act and "Restricted Data"

Because of potential national security implications, nongovernmental scientists who conducted atomic energy research and development at the beginning of World War II took actions to keep suchresearch secret, except for those with a need to know it. Strict governmental security during the warkept this knowledge limited, and after the war's end, the U.S. Congress passed the Atomic EnergyAct of 1946 , (3) which created the AtomicEnergy Commission and established policies for securingatomic energy-related information. Atomic energy laws, as administered first by the Atomic EnergyCommission and now the Department of Energy, allow the federal government to limit access to allatomic energy-related information, which is automatically "born classified" and is categorized uponcreation as "restricted data," (RD), even if it is developed by private researchers outside ofgovernment. At first, access to this information was allowed only for defense purposes. Subsequentmodifications in law, principally the Atomic Energy Act of 1954 , permitted certain non-governmentalpersons, such as industrialists and foreign governments, to obtain permits to access such "restricteddata," for the purposes of peaceful commercial development of atomic energy or internationalcooperative programs if they could obtain the necessary security clearances.

"Restricted data," or RD, is defined as "all data concerning (1) design, manufacture, or utilization of atomic weapons; (2) the production of special nuclear material; or (3) the use of specialnuclear material in the production of energy, but shall not include data declassified or removed fromthe Restricted data category pursuant to section 142 [42 USC 2162]." (4) Current penalties forviolating the law include imprisonment for "any term of years," a fine of $100,000, or both. (5) Thedevelopment and history of these controls were explained in a document prepared in 1989 by ArvinS. Quist, a classification officer at the Oak Ridge Gaseous Diffusion Plant, Oak Ridge NationalLaboratory, which is operated on contract for the Department of Energy. Excerpts from thisdocument are included in Appendix 1 .

Export Control Regulations for Scientific and Technical Information

Both the Export Administration Act (50 U.S.C. App. 2401-2420) (6) and the Arms Export ControlAct (22 U.S.C. 2751-2794) provide authority to control the dissemination to foreign nationals, bothin the United States and abroad, of scientific and technical data related to items requiring exportlicenses according to the Export Administration Regulations (EAR) or the International Traffic inArms Regulations (ITAR). Both laws regulate export of technical data. (7) ITAR control the releaseof defense articles specified on the U.S. Munitions List (22 CFR 121) and technical data directlyrelated to them. EAR, among other things, control the export of dual-use items (items that have bothcivilian and military uses) on the [Department of] Commerce Control List (15 CFR Part 774) andtechnical data related to them. Licenses are needed to export controlled items. The implementingregulations are administered by the Department of Commerce, which licenses items subject to EAR,and by the Department of State, which licenses items subject to ITAR and the Munitions List ofitems. (8) They apply to "exporters" of both privateand federally funded scientific and technicalinformation. Fundamental research is excluded from ITAR and EAR.

ITAR generally treats the disclosure or transfer of technical data to a foreign national, whether in the United States or abroad as an export. (9) Someacademic researchers believe they need to beregistered with the State Department to hold conversations or meetings with foreigners in the UnitedStates about scientific developments. (10) Accordingto ITAR regulations, publicly available scientificand technical information and academic exchanges and information presented at scientific meetingsare not treated as controlled technical data. (11) Nevertheless, there has been considerable ambiguityand confusion regarding these provisions at some academic institutions because of uncertaintiesabout which research projects might not be excluded because they use space or defense articles,technologies, and defense services on the Munitions List which is used to identify technologiesrequiring export licensing. (12) The ExportAdministration regulations also categorize as "deemed"exports communications to foreign nationals about technologies characterized as "sensitive" orcountries identified as "sensitive" under EAR rules. (13) This is declaimed by some as a hindrance tointernational science and supported by others who view it as a needed national security protection. (14)

Since 1999, export of information about satellites and spacecraft instruments, including technical discussions about them, has been under the jurisdiction of the State Department and ITAR. Some academic researchers have complained that these rules curtailed their presentations atmeetings, their on-campus research, and international collaborations because "research activity thatonce was subject to the fundamental research exclusion under National Security Directive 189, [Seethe next section for details] was, for the first time, formally regulated ...." (15) Reportedly, some foreignresearchers at U.S. universities had not been able to access this information and U.S. researchersbelieved they needed a license to discuss defense-related basic research information with foreigncolleagues. Universities sought clarifying rules.

Under a new rule issued in March 2002, the State Department clarified language exemptingU.S. universities from obtaining ITAR licenses for export of certain (16) space-based fundamentalresearch information or articles in the public domain to certain universities and research centers incountries that are members of the North Atlantic Treaty Organization (NATO), the European Union,or the European Space Agency, or to major non-NATO allies, such as Japan and Israel. Also to bepermitted are exports of certain services and unclassified technical data for assembly of products intoscientific, research, or experimental satellites. The exemption does not permit export of technicaldata for the integration of a satellite or spacecraft to a launch vehicle or Missile Technology ControlRegime controlled defense services or technical data. A license will be needed for export ofexempted information (including discussions) and hardware to researchers from all other countries. In addition, collaborators in approved countries would have to guarantee that researchers fromnon-approved countries were not receiving restricted information. (17) Some university researchersmaintain that these rules do not go far enough in clarifying the situation and that academicresearchers will find it difficult to design and implement campus controls and to bloc access to suchinformation by students and scientists from disallowed countries. (18)

Summary of Policies Regarding Classification of Scientific and Technical Research Results and Information

Several laws and directives govern classification of federally owned or federally fundedscientific and technical research results or information. These are Executive Order (E.O.) 12958,National Security Decision Directive (NSDD) 189, and rules related to pre-publication review.

Executive Order 12958, on "Classified National Security Information," as Amended by Executive Order 13292

Federal policy allows classification of federal information at three levels, "top secret," "secret," and "confidential." Until March 25, 2003, the most recent version of this policy was in ExecutiveOrder 12958, released on April 17, 1995. (19) Itpermitted classification of "scientific, technological,or economic matters relating to the national security" (Sec. 1.5). But Section 1.8 (b) prohibitedclassification of "basic scientific research information not related to the national security." OnMarch 25, 2003, the President issued a new Executive Order 13292 on classification, which amendedExecutive Order 12958. It changed section 1.5 by adding a new clause, permitting classification of "scientific, technological, or economic matters relating to the national security, which includesdefense against transnational terrorism" (Sec. 1.4 (e) of Executive Order 13292). (20) The amendmentalso added a new category of information which may be classified, that is information that concerns"weapons of mass destruction" (Sec. 1.4 (h)). The exemption for basic scientific research not clearlyrelated to national security remains (renumbered section 1.7).

National Security Decision Directive 189 (NSDD 189)

The policy embodied in Executive Order 12958 reflected prior policy expressed in National Security Decision Directive 189, NSDD 189, issued on September 21, 1985, (21) during the ReaganAdministration. It says if federally funded basic scientific and technical information produced atcolleges, universities and laboratories is to be controlled for national security reasons, it should beclassified. But fundamental research findings generally are not to be restricted. Specifically, NSDD189 states:

... to the maximum extent possible, the products of fundamental research (22) remain unrestricted. Itis also the policy of this Administration that, wherethe national security requires control, the mechanism for control of information generated duringFederally funded fundamental research in science, technology, and engineering at colleges,universities, and laboratories is classification.

NSDD 189 made agencies sponsoring research responsible for determining, before the award of a research contract or grant, whether classification is appropriate and for periodically reviewinggrants and contracts for potential classification. (23) It also said that "No restriction may be placed onthe conduct or reporting of Federally funded fundamental research that has not received nationalsecurity classification, except as provided in applicable U.S. statutes." NSDD 189 is still in effect,as stated in a letter issued by National Security Advisor Condoleeza Rice on November 1, 2001. (24)

Pre-Publication Review

The federal government exercises "pre-publication review" of some privately published scientific and technical information by current and former employees and contractors who workedfor federal agencies and who had access to classified information. For instance, the US Departmentof Agriculture issued the following guidance to employees regarding pre-publication review:

In order to protect against the unauthorized disclosure of classified information, you are required to submit for security review any material intended forpublic release that might be based in any way on information you learned through your access toclassified information. This requirement covers all written materials, including technical papers,books, articles, and manuscripts. It also includes lectures, speeches, films, videotapes. It includesworks of fiction as well as non-fiction. (25)

Pre-publication review controls for research and development information may be written into federal government contracts. Typically the Defense Department (DoD) includes "pre-publicationreview" clauses in government contracts for extramural research that allow DoD to review researchgenerated extramurally with federal support before it is published. (26) These controls are used ifclassified information was used in research or when the government seeks to prohibit release ofinformation deemed sensitive because of the way it is aggregated.

An agreement was initiated in 1980 with the American Council on Education for all academic cryptography research to be submitted on a voluntary basis for pre-publication review to the federalgovernment's National Security Agency. (27) Relatedto this, the U.S. Government may enter intocontracts to purchase exclusive rights to commercial satellite imagery and has the ability to stop thecollection and dissemination of commercial satellite imagery for national security reasons. (28)

In February 2002, DoD released a draft report, Mandatory Procedures for Research and Technology Protection Within the DOD, which would have required researchers to obtain DoDapproval to discuss or publish findings of all military-sponsored unclassified research, a departurefrom existing policy guidelines. After academic objections, the draft was withdrawn; a revised andclearer set of new regulations was planned. (29)

Controls on Information in the USA PATRIOT Act and in the Public Health Security and Bioterrorism Preparedness and Response Act of 2002

Before the 2001 terrorist attacks, U.S. laboratories that transported "select agents," that is, about 40 dangerous biological agents and toxins, had to register with the federal government (42 CFR72.6). Pursuant to the USA PATRIOT Act, P.L. 107-56 and the Public Health Security andBioterrorism Preparedness and Response Act of 2002, P.L. 107-188 , and the AgriculturalBioterrorism Protection Act of 2002, (which is part of P.L. 107-56 ), limits were placed on publicaccess was extended to an additional 60 select agents, defined as "certain biological agents andtoxins," (30) whose misuse could pose security risks. Registration requirements were extended toinclude registration of persons who used these agents. To prohibit potential terrorists from accessto these agents, controls were placed on access by selected persons, including those who could bepotential terrorists, including criminals, illegal aliens, persons with mental defects, and or drugabusers; aliens not admitted for permanent residence from certain countries "which the Secretary ofState has made a determination (that remains in effect) that such country has repeatedly providedsupport for acts of international terrorism," (31) orpersons who have been dishonorably dischargedfrom the Armed Services. These controls will be administered by the Justice Department. (32)

Pursuant to these laws, the Departments of Health and Human Services and of Agriculture, identified the new list of "select agents," which was released in the Federal Register on December13, 2002. (33) Under the interim final rule, whichwas amended on November 3, 2003, (34) thelaboratories that use such agents will need to register and control access to such agents; scientistswill have to register, submit to background checks, and obtain prior approval to use, send, or receiveselect agents used in experiments. Some say this process, while denying access to possible terrorists,might prove costly and burdensome to some researchers (estimated in an article by Malakoff at$700,000 per laboratory) (35) and has the potentialof limiting the conduct of some scientific researchthat would otherwise be performed by such persons, including some foreign researchers. In addition,privately funded scientists will be subject to the same requirements as government-fundedresearchers who need "prior approval from the DHHS ... for genetic engineering experiments thatmight make a select agent more toxic or more resistant to known drugs." (36) Civilian and criminalpenalties for noncompliance apply to universities, private companies and government laboratories. Laboratories that handle select agents were to be in compliance with the new rules by fall 2003.

"Sensitive But Unclassified" Information Restrictions

Over time some agencies have established procedures to identify and safeguard "sensitive butunclassified information" (SBU), also called "sensitive unclassified information." Generally, thisunclassified information is withheld from the public for a variety of reasons, but needs to beaccessible to federal agency personnel. As will be discussed next in this report, the term SBU hasbeen defined in various presidential-level directives and agency guidances, but, some critics say, onlyindirectly in statute. Agencies have given the term various meanings in their implementing rules andregulations. Some agency guidance documents have started to use interchangeably the terms "forofficial use only," "limited use," "sensitive," "sensitive but unclassified," and related terms, and havedefined SBU by referring to such statutes as Privacy Act of 1974 (5 USC 552a), (37) the Freedom ofInformation Act (FOIA) of 1966 (5 USC 552 ), the Computer Security Act of 1987 (relevantportionscodified at 15 USC 278 g-3), and other language. Agencies have discretion to define SBU in waysthat serve their particular needs to safeguard information. There is no uniformity in implementingrules throughout the government on the use of SBU. Agencies also may assign various criminal andcivilian penalties to improper release of "sensitive but unclassified" information.

Summary of the Evolution of Policies Relating to "Sensitive But Unclassified" Information

Official definitions of SBU were issued as early as 1977 and over the years thereafter.

Telecommunications Protection Policy (PD/NSC-24) . In 1977, in one of the earliest references to SBU, a PresidentialDirective on Telecommunications Protection Policy (PD/NSC-24) mandated protectionofunclassified, but sensitive communications "that could be useful to an adversary." It did not definethe term further. (38)

National Security Decision Directive 145 (NSDD-145) . In 1984, National Security Decision Directive 145 (NSDD-145) directed that "sensitive, but unclassified, government or government-derived information, the lossof which could adversely affect the national security interest ..." should be "protected in proportionto the threat of exploitation and the associated potential damage to the national security." NSDD-145 did not define the term, "sensitive, but unclassified," but explained that even unclassifiedinformation in the aggregate can "reveal highly classified and other sensitive information ..." harmfulto the national security interest. (39)

The absence of a precise definition was widely criticized, especially by the General Accounting Office (GAO) (40) because of concern that the 1984definition of SBU could include nationalsecurity-related as well as possibly innocuous information needed to make policy. For instance, aGAO witness testified, "... unclassified sensitive civil agency information affecting national securityinterests could include hazardous materials information held by the Department of Transportation,flight safety information held by the Federal Aviation Administration, and monetary policyinformation held by the Federal Reserve." He recommended that the Administration "needs toclearly define the types of information that fall under the coverage of NSDD-145." (41)

National Policy on Protection of Sensitive, but Unclassified Information in Federal Government Telecommunications and Automated Information Systems, NTISSP No. 2 OnOctober29, 1986, President Reagan's National Security Advisor, John Poindexter, (42) issued a document,entitled National Policy on Protection of Sensitive, but Unclassified Information in FederalGovernment Telecommunications and Automated Information Systems, NTISSP No. 2 , thatwidenedthe rationale for safeguarding "sensitive, but unclassified" information for reasons of nationalsecurity, as in NSDD-145, to include also "other government interests." Specifically, it said,

Sensitive, but unclassified information is information the disclosure, loss, misuse, alteration or destruction of which could adversely affect nationalsecurity or other Federal Government interests. National security interests are those unclassifiedmatters that relate to the national defense or the foreign relations of the U.S. Government. Othergovernment interests are those related, but not limited to the wide range of government orgovernment-derived economic, human, financial, industrial, agricultural, technological, and lawenforcement information, as well as the privacy or confidentiality of personal or commercialproprietary information provided to the U.S. Government by itscitizens.

This policy was to be applicable to all federal executive departments and agencies, including their contractors, which electronically transferred, stored, processed, or communicated sensitive, butunclassified information. (43)

During 1986-1987, criticisms about NTISSP No. 2 focused on both the scope of information to be restricted and the responsibility given to the intelligence community over civilian informationactivities. These led to the withdrawal of both NTISSP No. 2 in 1987 (attendant to passage of theComputer Security Act of 1987) and to official use of this definition of "sensitive, butunclassified." (44) (However, as will be noted below,some agencies, notably the Department ofEnergy, still use this broad conceptualization of SBU.)

The Computer Security Act of 1987 (P.L. 100-235). In the Computer Security Act of 1987 ( P.L. 100-235 , 101 Stat.1724-1730), 40 USC 1441, Congress declared: "... improving the security and privacy of sensitiveinformation in Federal computer systems is in the public interest, and hereby creates a means forestablishing minimum acceptable security practices for such systems, without limiting the scope ofsecurity measures already planned or in use" (Section 2, Purpose). The law authorized creation ofa computer standards program within the National Bureau of Standards, now called the NationalInstitute of Standards and Technology (NIST)), actions to enhance Government-wide computersecurity, and training in security matters for persons who are involved in the management, operation,and use of Federal computer systems.

P.L. 100-235 also addressed some of the criticisms raised about NTISSP No. 2. It defined the term "sensitive" as

any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct ofFederal programs, or the privacy to which individuals are entitled under section 552a of title 5,United States Code (the Privacy Act) , but which has not been specifically authorized under criteriaestablished by an Executive order or an Act of Congress to be kept secret in the interest of nationaldefense or foreign policy" (Section 3). (Emphasis added.)

The last clause of this definition specifically limited the definition of "sensitive" to information that was not classified. Agencies were given discretion to identify information that was sensitiveand risks accompanying release of it. The report accompanying the bill said that each individualfederal agency should make a determination of which unclassified information in its systems wassensitive in accord with the definition of sensitive in the law and the purposes of the law. (45) Federalagencies were given responsibility for developing plans "commensurate with the risk and magnitudeof the harm resulting from the loss, misuse, or unauthorized access to or modification of theinformation being protected," and are responsible for protecting such "sensitive" information. (46)

In 1992 the National Institute of Standards and Technology (NIST) issued guidance about agency implementation of systems to protect sensitive information pursuant to P.L. 100-235 . Itreiterated that,

Interpretation of the Computer Security Act's definition of sensitive is, ultimately, an agency responsibility. Typically, protecting sensitive informationmeans providing for one or more of the following: Confidentiality : disclosure of the informationmust be restricted to designated parties; Integrity : The information must be protected from errors orunauthorized modification; Availability : The information must be available within some given timeframe (i.e., protected against destruction)." (47)

The NIST document urged agency information owners to "use a risk-based approach to determine" harm of inadequate protection of information. In defining this discretionary process, it emphasized,

Information 'owners,' not system operators, should determine what protection their information requires. The type and amount of protection neededdepends on the nature of the information and the environment in which it is processed. The controlsto be used will depend on the risk and magnitude of the harm resulting from the loss, misuse, orunauthorized access to or modification of the information contained in the system. (48)

Because P.L. 100-235 applied to "sensitive" information that is not classified, some say, in effect, it defined "sensitive but unclassified."

Computer Security in Relation to the Freedom of InformationAct. The Freedom of Information Act of 1966 (FOIA) was enacted to ensure publicaccess to certain types of information held by federal agencies. However, it permits agencies toexempt from public disclosure nine types of information:

As noted above, the definition of "sensitive" in the Computer Security Act cited three reasons to categorize non-classified information as sensitive: adverse effects on the national interest, adverseeffects on the conduct of federal programs, and privacy. It included explicit provisions saying it wasnot authority to withhold information sought pursuant to "section 552 of title 5, United States Code[the Freedom of Information Act]...." (50) This wasreiterated in 1992 when the National Institute ofStandards and Technology issued guidance about agency implementation of systems to protectsensitive information pursuant to P.L. 100-235 . (51) Neither the Computer Security Act nor theaccompanying report indicated that information exempt from FOIA was to be designated as"sensitive." Also, the report accompanying the legislation said specifically, "The designation ofinformation as sensitive [or as subject to protection] under the Computer Security Act is not adetermination that the information is not subject to public disclosure." (52)

However, major federal agencies started to apply the label SBU to information defined as "sensitive" in the Computer Security Act and to information exempt from disclosure under theFreedom of Information Act (especially as governed by provisions 2 and 4). In fact, some agencieshave declared that these acts define SBU, a statement which is open to debate.

Federal Agencies' Various Definitions of "Sensitive But Unclassified"

Introduction. Even before the terrorist attacksof September 2001 and actions taken by the White House during 2001 and 2002 to safeguard"sensitive but unclassified" information, federal agencies had implemented a variety of proceduresto safeguard information. While they have used classification categories to withhold informationclassified pursuant to Executive Order 12958, they also use a variety of administrative controlmarkings and procedures to control access to unclassified information to which public access isrestricted, such as privacy data, law enforcement information, health information, and informationexempt from disclosure under the Freedom of Information Act (FOIA), and "sensitive" information. According to a report of the Commission on Protecting and Reducing Government Secrecy, 1997 ,"... at least 52 different protective markings [are] being used on unclassified information,approximately 40 of which are used by departments and agencies that also classify information. Included among these are widely-used markings such as 'Sensitive But Unclassified,' 'LimitedOfficial Use,' 'Official Use Only,' and 'For Official Use Only.' " (53) Other notable categories areDrug Enforcement Administration (DEA) sensitive information, and DoD Unclassified ControlledNuclear Information. (54)

There is no uniformity in Federal agency definitions, or rules to implement safeguards for "sensitive but unclassified" information. Over time the term "sensitive but unclassified" has cometo be used to encompass information subject to control pursuant to the Computer Security Act, aswell as information determined to be exempt from disclosure under the Freedom of Information Act,5 USC 552. This is further complicated by the fact that, as noted above, agencies were givendiscretion under the Computer Security Act of 1987 to do risk analysis to identify information to besafeguarded as sensitive. In addition , as will be described below, since the terrorist attacks of 2001, the Bush Administration has given agencies discretion to make nondisclosure decisions under FOIAin relation to homeland security and the thwarting of terrorist attacks.

SBU in the State Department and U.S. Agency for InternationalDevelopment. In its Foreign Affairs Manual, issued on October 1, 1995, theDepartment of State said it would stop using the designation "limited official use," (LOU), whichit had applied to information exempt from FOIA disclosure, and in its place would use the term"sensitive but unclassified" (SBU). (55) This appearsto have been one of the earliest instances of anagency declaring that SBU applies to information exempt from disclosure under the Privacy Act aswell as under the Freedom of Information Act:

a. SBU describes information which warrants a degree of protection and administrative control that meets the criteria for exemption from public disclosureset forth under Sections 552 and 552a of Title 5, United States Code: the Freedom of InformationAct and the Privacy Act. (12 FAM 540, Sensitive but Unclassified Information (SBU), (TL: DS-61;10-01-1999) 12 FAM 541 SCOPE, (TL: DS-46; 05-26-1995).

The State Department declared that,

b. SBU information includes, but is not limited to:

(1) Medical, personnel, financial, investigatory, visa, law enforcement, or other information which, if released, could result in harm or unfair treatmentto any individual or group, or could have a negative impact upon foreign policy or relations; and (2)Information offered under conditions of confidentiality which arises in the course of a deliberativeprocess (or a civil discovery process), including attorney-client privilege or work product, andinformation arising from the advice and counsel of subordinates to policy makers. (12 FAM 540,Sensitive but Unclassified Information (SBU), (TL: DS-61; 10-01-1999) 12 FAM 541 SCOPE, (TL:DS-46; 05-26-1995).

In an explanatory telegram sent to U.S. embassies, the department explained why it would use the SBU category instead of the LOU category and it declared that SBU covered information exemptfrom FOIA. It said, "Sensitive but unclassified is not a classification level for national securityinformation, but is used when it's necessary to provide a degree of protection from unauthorizeddisclosure for unclassified information as set forth in 12 FAM 540." (56) It explained that it would usethe category of SBU for two reasons: "... to keep classified material to a minimum and to be able topass-on relevant, but sensitive information to individuals (including FSNS [Foreign Service Nationalstaff]) on a need to know bases (sic)." (57) Publicaccess to "sensitive but unclassified" informationwould be limited to those with a need to know and would be subject to provisions which governdisclosure and exemptions in the Freedom of Information Act and Privacy Act; unauthorizeddisclosure would be subject to criminal penalties, including "criminal and/or civil penalties. Supervisors may take disciplinary action, as appropriate." (58)

In 1995, the U.S. Agency for International Development equated "sensitive" with "sensitive but unclassified" and linked procedures needed to protect "sensitive but unclassified" to protectionsrequired by FOIA and the Computer Security Act. (59)

Defense Agencies' Use of SBU. DoD's guidancefor "controlled unclassified information," issued in 1997, stated that "For Official Use Only(FOUO)" designations should be used for unclassified information that should be protected, that thisincludes "information that may be exempt from mandatory release to the public under the Freedomof Information Act (FOIA)" and "sensitive but unclassified" information that the Department of Stateformerly designated as Limited Official Use (which meets the criteria for exemption from mandatorypublic disclosure under FOIA), and "there must be a legitimate Government purpose served bywithholding it." (60) This same DoD directivelimited dissemination of information labeled "for officialuse only" including "sensitive but unclassified" information to:

... within the DoD Components and between officials of the DoD Components and DoD contractors, consultants, and grantees as necessary in the conductof official business. FOUO information may also be released to officials in other Departments andAgencies of the Executive and Judicial Branches in performance of a valid Government function. (Special restrictions may apply to information covered by the Privacy Act.) Release of FOUOinformation to Members of Congress is covered by DoD Directive 5400.4, and to the GeneralAccounting Office by DoD Directive 7650.1." (61)

According to the U.S. Army, citing DoD Regulation 5200.1 and Army Regulation 25-55, SBU information is information exempted from disclosure under FOIA. Also, Army Regulation 380-19,Section 1-5, "gives some examples of SBU as information that: (a) involves intelligence activities,(b) involves cryptological activities related to national security, (c) involves command and controlof forces, (d) is contained in systems that are an integral part of weapon or a weapon system; (e) iscontained in systems that are critical to the direct fulfillment of military or intelligence missions, (f)involves processing of research, development, and engineering data." (62)

The U.S. Army Materiel Command encrypts certain categories of SBU data, including "logistics, medical care, personnel management, Privacy Act data, contractual data, and "For OfficialUse Only Information." (63) Since there is no onesource for a definition of SBU, according to thissource, "Other factors such as risk management, consideration of the effects of unauthorizeddisclosure, and an examination of the timeliness of information, should be taken into account as well. Ultimately level of sensitivity of the information should be determined by owner/creator of thedata." (64) A matrix presented that guides thedefinition of SBU follows. Note that certain researchand development data are included:

SBU MATRIX (65)

The matrix below provides a general guide on the data categories and description of the types of data that should be considered Sensitive But Unclassified. This matrix should notbe considered authoritative or all-inclusive.

Department of Energy. The Department of Energy (DOE) uses a definition of "sensitive but unclassified" which is identical to the 1986Poindexter definition that Congress had the Administration withdraw. It is:

Sensitive Unclassified Information:

(66)

Guidance used by the DOE laboratories refers to this concept and cites, as authority, Executive Order 12958 and DOE regulations. (67)

Other Agencies' Definitions of SBU, Including the General Services Administration, the Federal Aviation Administration, and the National Aeronautics andSpace Administration. Other agencies have issued directives to define andprescribe safeguards that should be taken and penalties used for releasing SBU information. Forinstance, in 2002 the General Services Administration (GSA) defined SBU to include informationthat could possibly benefit terrorists, such as equipment plans, building designs, operating plans, the locations of secure facilities or functions within GSA buildings, utility locations, and informationabout security systems or guards. (68) The FederalAviation Administration (FAA) issued regulationsto safeguard unclassified but "sensitive security information," which may be developed from securityor research and development activities and whose release, the Administration determines, could bean invasion of personal privacy, reveal private or financial information, or could "be detrimental tothe safety of passengers in transportation." (69)

The National Aeronautics and Space Administration (NASA) labels nonclassified sensitive information as "administratively controlled information (ACI)," and describes procedures forcontrolling it under the same heading that it uses to describe procedures to control classified nationalsecurity information (CNSI):

Such information and material, which may be exempt from disclosure by statute or is determined by a designated NASA official to be especially sensitive,shall be afforded physical protection sufficient to safeguard it from unauthorized disclosure. WithinNASA, such information has previously been designated "For Official Use Only." (70)

The statutes cited as justification are the Export Administration Act of 1979, the Arms Export Control Act, and section 303 (b) of the Space Act. NASA also cited as justification the exemptioncriteria of the Freedom of Information Act, and information designated by NASA officials, such aspredecisional and not-yet-released materials relating to national space policy, pending reorganizationplans, or sensitive travel itineraries.

In some agencies, the official responsible for guiding and developing agency policy and procedure for classified information also has responsibility for control and decontrol of sensitive butunclassified information. (71)

Equivalence Between "Sensitive" and "Sensitive But Unclassified" Information

By 1997, the Department of the Navy had issued guidance that said explicitly that the Computer Security Act of 1987 defined the requirements for "sensitive but unclassified" informationand further that "all business conducted within the federal government is sensitive butunclassified." (72)

In 1998, the equivalence between "sensitive" and "sensitive but unclassified" was codified by DoD in administrative law in 32 CFR 149.3, relating to technical surveillance countermeasures usedby all federal agencies that process SBU. DoD defined "sensitive but unclassified" by using thedefinition of "sensitive" that appeared in the Computer Security Act of 1987. (73)

In 2002, the Department of the Interior issued guidance that "... all unclassified DOI systems are considered SBU." (74)

White House Policy for "Sensitive but Unclassified" Information Related to Homeland Security, March 2002

On March 19, 2002, the White House released a memo, signed by Chief of Staff Andrew Card, entitled "Action to Safeguard Information Regarding Weapons of Mass Destruction and otherSensitive Documents Related to Homeland Security." It called for agencies to reconsider currentmeasures for safeguarding information regarding weapons of mass destruction and other sensitivedocuments related to homeland security and "information that could be misused to harm the securityof our Nation and the safety of our people." Agencies were required to examine their policies andholdings in accord with an accompanying memos issued by the National Archives and RecordsAdministration's (NARA) Information Security Oversight Office (ISOO) and the Department ofJustice's Office of Information and Privacy (OIP) to determine if information should be classified,including previously unclassified or declassified information, or handled as sensitive but unclassifiedinformation and report the status of their review to the White House, via the Office of HomelandSecurity, within ninety days. (75)

Agencies Instructed to Use FOIA Exemptions to Control Disclosure of Information. The accompanying ISOO and OIP memo included asection titled "sensitive but unclassified information," (SBU), which instructed agencies to safeguard"sensitive information related to America's homeland security"(SHSI), and told them to considerall applicable FOIA exemptions if FOIA requests are received for such information. (76) The memourged agencies to consider using specifically FOIA exemptions 2 and 4 when determining whetherto categorize information as "sensitive but unclassified." Exemption 2 refers to "(2) internalpersonnel rules and practices of an agency," while Exemption 4 deals with "trade secrets andcommercial or financial information obtained from a person and privileged or confidential." TheISOO/OIP memo cautioned that "The need to protect such sensitive information from inappropriatedisclosure should be carefully considered, on a case-by-case basis, together with the benefits thatresult from the open and efficient exchange of scientific, technical, and like information." See Appendix 3 for excerpts of the memo.

As further justification, the memo referred agencies to guidance on FOIA that had been issued by Attorney General Ashcroft in October 2001. This memorandum expressed the Administration'sintent to comply with FOIA while, at the same time, instructing agencies, when undertakingdiscretionary disclosure determinations under FOIA, to consider protecting values and interests towhich the Bush Administration is committed, including "safeguarding our national security,enhancing the effectiveness of our law enforcement agencies, protecting sensitive businessinformation, and, not least, preserving personal privacy." (77) In explaining the intent of the memo, theDepartment of Justice said

In replacing the predecessor FOIA memorandum, the Ashcroft FOIA Memorandum establishes a new "sound legal basis" standard governing theDepartment of Justice's decisions on whether to defend agency actions under the FOIA when theyare challenged in court. This differs from the "foreseeable harm" standard that was employed underthe predecessor memorandum. Under the new standard, agencies should reach the judgment thattheir use of a FOIA exemption is on sound footing, both factually and legally, whenever theywithhold requested information.

In the predecessor memorandum issued by Attorney General Janet Reno in 1993, agencies wereencouraged to release documents even if the law provided a way to withhold information, if therewas no "foreseeable harm" from doing do. The October 2001 memo underscored the need to ensurethat information about agency deliberations not be made public and encouraged agencies to makedisclosure determinations under FOIA "only after full and deliberate consideration of theinstitutional, commercial, and personal privacy interests that could be implicated by disclosure ofthe information." (78)

Also, referring to the need for heightened sensitivity after the September 2001 terrorist attacks, the October 2001 memo instructed agencies to utilize FOIA exemptions when making an agency"assessment of, or statement regarding, the vulnerability of ... a critical asset ..." (79) or the need toprotect critical infrastructure information, referenced in the memo as "critical systems, facilities,stockpiles, and other assets from security breaches and harm -- and in some instances from theirpotential uses weapons of mass destruction in and of themselves. Such protection efforts, of course,must at the same time include the protection of any agency information that could enable someoneto succeed in causing the feared harm." (80)

The Attorney General's October 2001 memorandum instructed agencies to interpret FOIA exemption 2 broadly to permit withholding of a document, which if released would allowcircumvention of an agency rule, policy or statute, thereby impeding the agency in the conduct of itsmission. (This is generally referred to as the high profile interpretation of exemption 2.) (81) It saidthat agencies should "avail themselves of the full measure of exemption 2's protection for theircritical infrastructure information as they continued to gather more of it, and assess its heightenedsensitivity, in the wake of the September 11 terrorist attacks." (82) The memo referred to guidance thatwas issued in 1989 describing the sensitivity of vulnerability assessments and the need to exemptsuch information from disclosure under FOIA. (83)

Pursuant to the Card memo, and attachments, the information to be covered by theAdministration's "sensitive but unclassified" homeland security information seems to includerecords that deal with the agency, public infrastructure the agency might regulate or monitor, someinternal databases (reports, data the agency has collected, maps, etc.), vulnerability assessments,some internal deliberations, and information provided to the government by private firms, such aschemical companies. (84)

Although most of this information is not classified, it appears as if security clearances may be required for access to some SHSI and certain types of SBU information. The National Archives andRecords Administration (NARA) included in its Annual Performance Plan, FY2003, (85) a goal oftraining state and local officials in the proper handling of classified and sensitive homeland securityinformation. The document stated that this included the objectives of obtaining Top Secret securityclearances for state and local officials who need such clearances to handle classified or sensitivehomeland security information, and also of developing "a training program at the state and locallevel for the proper use and handling of classified and sensitive but unclassified homeland securityinformation for all officials with Top Secret security clearances and other officials who have accessto sensitive information. Finally ISOO will ensure that Federal agencies have the necessaryclassification authority for homeland security information."

It should be noted that, on March 12, 2002, and again on June 23, 2003, the House oversight committee on FOIA, the Committee on Government Reform, called the Attorney General's October2001 memorandum into question and specifically rejected its standard to allow the withholding ofinformation sought under FOIA whenever there is merely a "sound legal basis" for doing so. (86) Thecommittee directed agencies to withhold documents only in those cases when the agency reasonablyforesees that disclosure would be harmful to an interest protected by an exemption. (87)

Policies for Control of Unclassified Information in P.L. 107-296

Introduction

The dilemma about balancing security and science is reflected in the Homeland Security Act, P.L. 107-296 , signed November 2, 2002. Among other things, it required that research conductedby the Department of Homeland Security (DHS) created by the law "shall be unclassified to thegreatest extent possible" (Sec. 306 (a)). Nevertheless, in a signing statement, the President reiteratedthat the executive branch had the right to implement this provision (and others) in a manner whichwould protect information "...the disclosure of which could otherwise harm the foreign relations ornational security of the United States." (88)

Protection of Critical Infrastructure Information

P.L. 107-296 , also included prohibitions against disclosure under FOIA of "critical infrastructure information" regarding to the security of critical infrastructure and protected systemssubmitted voluntarily by private companies. Criminal penalties for disclosure by affected employeesinclude fines, dismissal, or imprisonment for up to a year (Section 214). (89) The statute also providedfor the preemption of state freedom of information laws regarding the public disclosure of suchinformation if it is shared with a state or local government official in the course of DHS's activities. (90) Subsequently, the Department of Defense issued a memo on March 25, 2003 which appliedprohibitions like those in P.L. 107-296 to critical infrastructure information voluntarily submittedto DoD. (91) On April 15, 2003, the Departmentof Homeland Security published interim rules in the Federal Register which implement the critical information infrastructure protection provisions of P.L. 107-296 , and which would extend the rules to other agencies by requiring them to pass similarinformation that they receive to DHS. (92) DHSpublished a final rule and to established the "ProtectedInfrastructure Information (PCII) Program on February 18, 2004. (93) The submitted information willbe withheld from public disclosure under FOIA and "Initially, the PCII Program Office will limit thesharing of PCII to IIAP [DHS's Information Analysis and Infrastructure Protection Directorate]analysts," (94) and then, if accepted as appropriateto be safeguarded pursuant to the law andregulations, to other federal agencies. Submitters are to certify, under penalty of fine orimprisonment, that the submitted information is not subject to disclosure under the rules of anotherdepartment, such as to meet health, safety, or environmental regulations. This later provision isintended to allay some of the fears of groups that suspect companies will submit to DHS informationthey do not want to be disclosed in order to hide from the public information about pollution, newfacilities, or security gaps.

"Sensitive But Unclassified" Homeland Security Information

P.L. 107-296 also required the President to "prescribe and implement procedures" for federal agencies to, among other things, identify, safeguard, and share with appropriate federal, state, andlocal agencies "homeland security information that is sensitive but unclassified" (Sec. 892). Thisis often abbreviated SHSI. "Homeland security information" was defined as

any information possessed by a Federal, State, or local agency that -- (A) relates to the threat of terrorist activity; (B) relates to the ability or prevent,interdict, or disrupt terrorist activity; (C)would improve the identification or investigation of asuspected terrorist or terrorist organization; and (D) would improve the response to a terrorist act(Sec. 892(f)(1)).

The law did not define sensitive or "sensitive but unclassified." It stated that, in sharing sensitive but unclassified information with state and local persons, it is the sense of Congress thatthe procedures developed to share information that is sensitive but unclassified may includerequirements for "entering into nondisclosure agreements with appropriate State and local personnel"(Sec. 892(c)(2)(B)).

On July 29, 2003, the President assigned his responsibility to provide such procedural guidance to federal agencies and most other responsibilities of sections 892 and 893 of P.L. 107-296 to theSecretary of the Department of Homeland Security (pursuant to Executive Order 13311). (95) DHS wastasked with developing such guidance; no guidance for identifying and sharing sensitive unclassifiedhomeland security information has been issued yet.. Also, DHS is drafting the report onimplementation of section 892 of P.L. 107-296 , as required by Section 893 of the law.

Federal Agency Implementation Actions. After the release of the Ashcroft and Card memos some agencies started to respond to this issue in itsbroadest sense. Some issued policy statements or rules relating to SBU even before passage of P.L.107-296 or the issuance of the guidance Congress mandated in the law.

Reportedly, some agencies are increasingly inserting restrictions based on the category"sensitive but unclassified" into contracts for unclassified research negotiated with some universities. This has not only raised questions about whether the term should be better defined before it is morewidely used but has caused some universities to object to such clauses and have refused to acceptfederal contract funds for unclassified research that contain them. (96)

Some agencies have defined "sensitive" information that will be protected from public disclosure or might be exempt from disclosure under FOIA, and have developed procedures to sharethis information with appropriate officials in federal state and local agencies. Several federalagencies have developed guidance or regulations to define SHSI or SBU and protect it from publicrelease. The Nuclear Regulatory Commission's guidance, which it described as interim pending afinal Administration definition for SHSI, was released on April 4, 2002. It includes such things as"plan specific information, generated by NRC, our licensees, or our contractors, that would clearlyaid in planning an assault on a facility.... Physical vulnerabilities or weaknesses of nuclearfacilities.... Construction details of specific facilities.... Information which clearly would be usefulto defeat or breach key barriers at nuclear facilities," and "Information in any type of comment (e.g.plant status report, press release) that provides the current status or configuration of systems andequipment that could be used to determine facility vulnerabilities if used by an adversary." (97)

The U.S. Department of Agriculture issued Regulation 3440-002 on "Control and Protection of 'Sensitive Security Information,' " on January 30, 2003. It said it applied to "...the identificationof unclassified but sensitive information as 'Sensitive Security Information,' ".... (98) The definitionapplies generally to facilities, critical infrastructure and cyber-based systems (Sec. 6). Thisinformation is to be made available only to individual who have a "need-to-know," and theregulation provided procedures to protect it (Secs. 11 and 12 of the regulation).

Pursuant to the Transportation Security Regulations, (99) DHS's Transportation SecurityAdministration (TSA) has defined the types of information that are categorized as "sensitive securityinformation," (SSI) and to be protected from disclosure and be exempted from FOIA. There are alsoreports that the TSA has sought to remove unclassified congressional testimony tht was alreadypublished, "in which a government contractor described security problems at the Rochester, N.Y.airport" on the grounds that it included "sensitive security information." (100) Reportedly, the testimonywas removed from some, but not all, sources. The TSA has defined the types of of information thatare SSI and to be protected from disclosure and exempted from FOIA.

Some federal agencies have withdrawn from their websites information they have categorized as SBU and that might prove to be useful to terrorists, but which would appear to be accessible tothe public under existing laws such as the Emergency Planning and Community Right-To-Know Actof 1986 (42 U.S.C. 11049), which environmental advocates often cite to obtain information. Forinstance, reportedly, the Department of Energy "removed environmental impact statements whichalerted local communities to potential dangers from nearby nuclear energy plants, as well asinformation on the transportation of hazardous materials." (101) Reportedly, some agencies may bewithholding some information that normally would be made available under FOIA requests. (102) According to one report, the Environmental Protection Agency (EPA) has removed documents fromits website and the Defense Department has removed more than 6,000 documents in response to thememo. (103) The Nuclear Regulatory Commissionis reported to have removed documents from itswebsite. (104) State governments have removeddata from public websites, including "hospital securityplans and information on energy stockpiles of pharmaceuticals" in Florida. (105) The Secretary ofDefense was reported to have said a review of information accessible on DOD websites indicatedover 1,500 instances where posted data were insufficiently reviewed for sensitivity or not adequatelyprotected. He said the trend should be reversed and he advised that " 'Thinking about what may behelpful to an adversary prior to posting any information to the web could eliminate manyvulnerabilities....' " (106) One critic said inresponse, "However, such guidance, taken by itself, woulddictate the elimination of nearly all accurate information from DoD web sites since practicallyanything could be of use to an adversary in some conceivable scenario." (107) It has been reported thatsome information which researchers have sought and that agencies removed from their websites isbeing advertised to researchers through commercial vendors on CD and hard copy. Someresearchers now fear that the deleted information, including USGS topographic map information will"become unavailable due to tighter security .... " (108) This might deny public access to suchinformation of could possibly resulting in a "commercialization of information similar to whathappened with Landsat data in the 1980s, when the satellite imagery became privatized, dramaticallyraising the cost of research." (109)

Some assessments made so far of the changes to agency FOIA procedures based on the Ashcroft October 2001 guidance, which restricted discretionary disclosures under FOIA, indicate that the newpolicies appear not to have had a major impact on agency activities. Preliminary analysis issued bythe National Security Archive regarding implementation of this guidance in 35 agencies indicatedthat while a few agencies, such as NASA, EPA, and the Departments of the Interior and Navy, hadto undertook significant activities to comply, most did not. Some agencies reported that the Cardmemo, rather than the Ashcroft memo, would appear to have had more significant effects ondisclosures requested via FOIA. (110) Accordingto a GAO assessment, released in September 2003, the Ashcroft memo appears to have had only limited impact on the processing of FOIA requests. GAO reported that 48% of the FOIA officers surveyed "... did not notice a change with regard tothe likelihood of their agencies' making discretionary disclosures. About one third of the FOIAofficers reported a decreased likelihood; of these officers, 75 percent cite the new policy as a topfactor influencing the change." (111)

In contrast, others have concluded that the effects are serious. For instance, the Lawyers Committee for Human Rights, in a 2003 report, described as an example, DOD refusal to releasean unclassified conference report on lessons learned from the 2001 anthrax attacks and concluded"The 'homeland security information' provision represents a sweeping new delegation of authorityto expand secrecy well beyond formal classification procedures in a manner that is likely to furtherimpair Congress' oversight responsibilities. Whether Congress will step in to try to mitigate thispotential remains uncertain." (112)

Some speculate that less unclassified information will be made available since passage of Section 214 of P.L. 107-296 , relating to critical infrastructure information. This has been viewedas a controversial provision. Critics say while it would protect sensitive information submitted tothe government about dams, buildings, electric power lines, pipelines, rail transit and so forth. Others say that it "... could make government officials fearful of disclosing information aboutcorporate activities that pose risks to the public." (113) Reportedly, the American Civil Liberties Union(ACLU) was concerned "... that companies could ensure secrecy for a wide range of informationprovided to the government simply by declaring that it involves critical infrastructure and thendemanding confidentiality." (114) It also"contended that the ... law could prevent the disclosure ofpotential health risks from uranium stored at private sites or of defects in railroad tracks ... [or] ...thatthe law might discourage whistle-blowers from coming forward with revelations about corporatewrongdoing." (115) Supporters of withholdingthis kind of information cite the potential threats tohomeland security that may be incurred if such information is allowed to remain widely accessible. They say that potential terrorists could use information about critical U.S. public and privateinfrastructure to design and implement attacks that could destroy U.S. power, communications,transportation and public works networks and facilities. Access to this kind of information, they say,should be given only to those with a need to know.

Concerns About Sensitive Information in Non-governmental Research and Scientific Publications

Acknowledging the serious potential threats from release of certain kinds of "sensitive"privately developed research information, professional scientific societies and groups haveconsidered developing ways to regulate, review, identify and deal with publication of "sensitive"journal articles. (116) Some believe that privatescientific publishers and editors will feel compelled tomodel their publications policy for sensitive papers on guidelines that the federal governmentdevelops for release of agency documents. There is considerable controversy about this issue.

National Academies' Policy. The NationalAcademy of Sciences says it voluntarily deleted from a public version of a report, and put into aseparate appendix, certain information on vulnerabilities of U.S. croplands after review by the U.S.Department of Agriculture, the sponsoring agency. (117) The rationale was that terrorists might be ableto exploit information on vulnerabilities. The information is being made available "on aneed-to-know basis" to a select list of persons including "federal, state, and local governmentworkers, officials involved in homeland security, and animal and plant health scientists, but notmembers of the media or the general public. Anyone interested in the appendix has to file a writtenrequest.... Academy staff members then call applicants, ascertain their identify, and ask why theyneed the report...." (118) Reportedly, the Academycited FOIA exemption 2, "which protects matters'related solely to the internal personnel rules and practices of an agency' " in justifying thisprocedure. (119) Regarding another Academyreport, DoD's Joint Non-Lethal Weapons Directoratereportedly took several months to review a study on non-lethal weapons, finally released inNovember 2002. But there are "conflicting opinions of that review, including whether it was usedimproperly to suppress NAS' criticism of DoD's non-lethal weapons program." (120)

On October 18, 2002, the three presidents of the National Academies issued a statement (121) which sought to balance security and openness in disseminating scientific information. Itsummarized the policy dilemma by saying that "Restrictions are clearly needed to safeguard strategicsecrets; but openness also is needed to accelerate the progress of technical knowledge and enhancethe nation's understanding of potential threats." The statement encouraged the government toreiterate that basic scientific research should not be classified, that nonclassified research reportingshould not be restricted, and that vague and poorly defined categories of research information, suchas sensitive but unclassified, should not be used. "Experience shows that vague criteria of this kindgenerate deep uncertainties among both scientists and officials responsible for enforcing regulations. The inevitable effect is to stifle scientific creativity and to weaken national security." The statementoutlined "action points" for both government and professional societies to consider when developinga dialogue about procedures to safeguard scientific and technical information which could possiblybe of use to potential terrorists.

The National Academies held a workshop on this subject early in 2003 (122) in cooperation withthe Center for Strategic and International Studies. (123) Reportedly, during this meeting, Administrationofficials, stated the view that scientists should voluntarily craft a policy that protects sensitiveinformation and that they should assist the government "... to help it identify and censor trulysensitive findings," especially in the biological sciences. (124) One result is that the CSIS and theAcademies established a "Roundtable on Scientific Communication and National Security," aworking group composed of scientific and security leaders which will hold continuing discussionsto try to develop a workable publications policy. (125)

Other Groups. Some scientists, including Dr. Ronald Atlas, President of the American Society for Microbiology, (126) have suggested that thescientific community should come together to discuss the issue of balancing secrecy in science andscientific publication in a move similar to the 1975 Asilomar conference, which helped to developguidelines for information communication and institutional review boards to monitor and controlthe development of genetically modified organisms. Some suggest that perhaps the NationalAcademy of Sciences or a committee of a relevant professional society be established to evaluatewhether parts of methodology of especially sensitive research should be published. (127) Reportedly,Dr. Anthony Fauci, Director of the NIH National Institute of Allergy and Infectious Diseases(NIAID), which is receiving the bulk of funds allocated to NIH for counterterrorism R&D, said onOctober 3, 2002, that while transparency in publication should be the norm, consideration shouldbe given to developing a "specially appointed committee to determine whether publication isappropriate." He suggested the formation of a panel to determine whether it is appropriate to pursuecertain types of biomedical research," similar to the Asilomar Conference. (128) Others have suggestedthat only certain kinds of sensitive research be restricted or classified, such as research relating tothe "weaponization of biological and toxin agents...." (129)

The International Council for Science (ICSU), an international non-governmental scientific association, (130) announced that it will reviewthreats to scientific freedom, including limitations orrestrictions being placed on the conduct and communication of scientific information and thefreedom of movement of scientific materials. (131) The Council of the American Library Associationadopted a resolution at its June 2002 meeting that urged that the provisions relating to "Sensitive butUnclassified" information be dropped from the Card memorandum and that urged "governmentagencies ... ensure that public access to government information is maintained absent specificcompelling and documented national security or public safety concerns." (132) The AmericanAssociation of University Professors (AAUP) announced on September 11, 2002, that it was creatinga committee to review and analyze "post-September 11 developments which impinge on academicfreedom." (133)

In January 2004, the American Physical Society (APS) Council released a statement which concluded, "Restricting exchange of scientific information based on non-statutory administrativepolicies is detrimental to scientific progress and the future health and security of our nation. TheAPS opposes any such restrictions, such as those based on the label 'sensitive but unclassified'...." (134)

Professional Groups Views That Scientists Should Voluntarily"Self-Regulate" Research and Publications. Some professional scientific groups,such as the American Society for Microbiology, have called upon their members to be cautious aboutreleasing or publishing information which might be useful to potential terrorists, includingspecifically the "methodology" sections of some scientific papers, and have established publicationreview committees to evaluate the sensitivity of articles presented for publication in their journals. (135) The society has established procedures to have an editorial panel review for sensitivity manuscriptswhich deal with "select agents." So far, reportedly only one paper has been asked to be revised. (136)

In February 2003, shortly after the Academies/CSIS 2003 meeting, 32 journal editors and scientists, including officials with the American Association for the Advancement of Science andthe American Society of Microbiology, issued a statement on "Statement on Scientific Publicationsand Security," published in Science , Nature and the Proceedings of the NationalAcademy ofSciences , saying that they would take security issues into account when reviewing research papersfor publication. Each scientific publication will develop its own process to review papers submittedfor publication. (137)

A National Academy of Sciences report, entitled Biotechnology Research in an Age of Terrorism: Confronting the "Dual Use" Dilemma , published in 2003 and dubbed the "Fink" reportfor its chairman, called for greater self-regulation by scientists, using institutional biosafetycommittees at academic and research institutions, for research that could possibly aid terrorists. Italso urged creation of a new federal National Science Advisory Board for Biodefense to provideguidance to nongovernmental researchers. But it did not propose government control of suchresearch. (138)

Partly in reaction, the American Association of University Professors (AAUP) Special Committee on Academic Freedom and National Security in a Time of Crisis, in a report issued in2003, urged a note of caution regarding self-restraint by the scientific community: "the academiccommunity must be careful not to impose on itself a regulatory burden that differs from thegovernment's only in the locus of administration." (139) Although there has been no evidence ofnegative effects on scientific research so far, " a realistic appraisal of what the scientific communityis doing to monitor its own members requires us to be aware of the possibility that researchers andjournal editors might exercise their responsibilities with too much rigor and thus inadvertently givetoo little attention to freedom's needs." (140)

Policy Options. Congress has also expressed interest in this topic. Shortly after publication on July 1, 2002, in Science magazine online, of acontroversial scientific paper that described the synthesis of an infectious polio virus from mail ordercomponents, Congressman Weldon introduced H.Res. 514 (107th Congress). Itexpressed "serious concern" about the paper, which was funded by the Defense Advanced ResearchProjects Agency (DARPA), and called for tighter controls on the publication of certain scientificresearch. It also sought to have the scientific community and the executive branch ensure thatinformation that may be used by terrorists is not made widely available, or is properly classified. (141) The resolution was not reported from the committee.

For additional information see CRS Report RL31695 , Balancing Scientific Publication andNational Security Concerns: Issues for Congress .

Policy Issues About "Sensitive But Unclassified" Information

Introduction

As explained above, some federal agencies use the definition of "sensitive" in the Computer Security Act of 1987 as the basis for identifying information to label SBU. Other agencies haveexpanded the definition of sensitive in various ways, with some agencies including informationexempt from release under FOIA and others including other kinds of information determined to besensitive to a particular agency's activities. Following the terrorist attacks of September 11, 2001,the Administration instructed agencies to withhold more information when undertaking discretionarydisclosure deliberations under FOIA. Agencies were instructed to balance access to informationwith the needs to protect critical infrastructure information, national security, law enforcementeffectiveness, agency deliberations and decision-making, and related values and interests, and to usespecifically FOIA exemptions 2 and 4. When making such deliberations, they were also told toconsider, on a case by case basis, "benefits that result from the open and efficient exchange ofscientific, technical, and like information."

These actions have raised significant policy issues, such as allegations that the terms sensitive and SBU are ambiguous because they are subject to agency interpretation. This, some say, makesit difficult to identify and safeguard such information, while raising questions about the need foruniformity in standards. Some say expanded interpretation of FOIA exemptions 2 and 4 to identifySBU divides those who want increased security of information from those who want public accessto the information now exempted in order to protect public and community oversight, civil liberties,and accountability, to promote the conduct of science, or to monitor private sector activities. Theprocedures mandated in P.L. 107-296 are intended to guide agencies toward the use of similar procedures to identify, share, and safeguard sensitive but unclassifed homeland security information. As will be discussed below, there has been considerable debate about this content of these proposedguidelines.

Historical Controversy About "Sensitive But Unclassified"

Even before the terrorist attacks of 2001, there had been considerable controversy about the meaning and use of the term SBU. One position is that agencies should interpret the term morebroadly to categorize and safeguard more information as SBU; alternatively, others say that thiscategory is often imprecise and leads to indiscriminate withholding of information from the public.

For instance, a February 28, 1994 report, Redefining Security , by the Joint Security Commission prepared for the Director of the CIA and the Secretary of Defense, which according to the Federationof American Scientists (FAS) "was the first significant post-cold war examination of governmentsecurity policies and practices," (142) estimatedthat as much as 75% of all government-held informationmay be sensitive and unclassified. It recommended that more attention should be paid to protectingsuch information and labeling it as SBU within the defense, intelligence and other sectors ofgovernment as well as "... information that, while neither classified nor government-held, is crucialto U.S. security in its broadest sense." Continuing, it said,

We have in mind information about, and contained in, our air traffic control system, the social security system, the banking, credit, and stock marketsystems, the telephone and communications networks, and the power grids and pipeline networks. All of these are highly automated systems that require appropriate security measures to protectconfidentiality, integrity and availability." (143)

In a contrasting position, the aforementioned Moynihan commission report, entitled Report of the Commission on Protecting and Reducing Government Secrecy, 1997 , noted that agencies oftenuse different types of mandates to justify protecting unclassified information and these range fromthe very broad to specific. This causes problems because

"... [V]irtually any agency employee can decide which information is to be so regulated;" there is no oversight of this categorization and agencies controlaccess "though a need-to know process," and "... the very lack of consistency from one agency toanother contributes to confusion about why this information is to be protected and how it is to behandled. These designations sometimes are mistaken for a fourth classification levels, causingunclassified information with these markings to be treated like classifiedinformation." (144)

As a result, the Commission concluded that more information is protected than is warranted.

An attempt had been made in December 1994, the report said, to develop a policy to address sensitive but unclassified information, but it "met with great resistance by both the civilian side ofthe Government and industry" because the process was controlled by the Security Policy Board,which dealt largely with classified information and was controlled by the defense and intelligencecommunity. (145) The report also found thatoverzealous labeling of information as SBU could beavoided if more attention were devoted to improving the security of governmentcomputer-information systems (146) to preventunauthorized access.

Critiquing the wide scope of the current DOE definition of SBU (see above under the section, "Department of Energy"), a Center for Strategic and International Studies (CSIS) commissiondealing with DOE laboratories reported in 2002:

The Department's official definition is so broad as to be unusable. ...There is no ... common understanding of how to control ... [SBU] ..., no meaningfulway to control it that is consistent with its level of sensitivity, and no agreement on what significanceit has for U.S. national security. Sensitive unclassified information is causing acute problems atDOE. ... Security professionals find it difficult to design clear standards for protection. Scientistsfeel vulnerable to violating rules on categories that are ill defined. Without clear definition orstandards for protection, those who oversee implementation for the Department find it extremelydifficult to measure laboratory performance.

... Yet the Department tends to treat this information as if subject to security measures not unlike those for classified information. It is considered whendeveloping background checks for foreign visitors and when reviewing presentations that mayinvolve sensitive unclassified information.

... The lack of management discipline around sensitive unclassified information both hinders the scientific enterprise and reduces the ability of security andcounterintelligence professionals to control information wherenecessary. (147)

The CSIS commission recommended that DOE avoid using the definition and label "SBU." "By avoiding these labels," it said, "the Department can depart from treating unclassified informationas if subject to national security controls. The Department should have just three classes ofinformation: (1) classified; (2) unclassified but subject to administrative controls; and (3)unclassified, publicly releasable." (148) DOEshould also avoid use of a sensitive subjects list or changeits name, since the list deals primarily with items and technology potentially subject to exportcontrol. (149) "If information is not classified butrequires administrative control," DOE shouldconsider using "the category of information designated official use only (OUO)...." "A single officewithin DOE administers OUO, which has guidelines established in law and unclassified informationcould be reviewed for applicability under the OUO statutes. Existing statutes governing certain typesof sensitive unclassified information could remain unchanged and distinct from OUO (i.e.unclassified but controlled nuclear information [UCNI]), as long as they provide sufficiently clearguidelines for control." (150)

During the 107th Congress, congressional interest in this topic was reflected in a recommendation made by the congressional Joint Inquiry Into September 11, which among otherthings recommended a review encompassing the concepts of sensitive or classified information:

Congress should also review the statutes, policies and procedures that govern the national security classification of intelligence information and itsprotection from unauthorized disclosure. Among other matters, Congress should consider the degreeto which excessive classification has been used in the past and the extent to which the emergingthreat environment has greatly increased the need for real-time sharing of sensitive information. TheDirector of National Intelligence, in consultation with the Secretary of Defense, the Secretary ofState, the Secretary of Homeland Security, and the Attorney General, should review and report tothe House and Senate Intelligence Committees on proposals for a new and more realistic approachto the processes and structures that have governed the designation of sensitive and classifiedinformation. The report should include proposals to protect against the use of the classificationprocess as a shield to protect agency self-interest. (151)

Critiques of the White House (Card) Memorandum

While many observers agree with the objectives and implementation of the March 2002 Card memorandum in order to lessen potential terrorist attacks, some critics have urged caution ininterpreting it and the accompanying guidance which appears to allow agencies to widen types ofinformation to be exempt from disclosure under FOIA. It has been argued that "Several of the newrestrictions on information are not congruent with the existing legal framework defined by theFreedom of Information Act (FOIA) or with the executive order [Executive Order 12598] thatgoverns National Security classification and declassification." (152) Some have questioned the authorityof national security directives pertaining to "sensitive, but unclassified" information or say thatwhere Congress has statutorily prescribed policy contrary to information management policyprescribed in presidential directives or agency regulations, the supremacy of statutory law wouldseemingly prevail. One critic of the March 2002 White House memo cautioned that the term"sensitive but unclassified" may be "the most dangerous level of secrecy, because it was not defined[in the past] and there were no channels of appeal." (153) Similarly, others say that "... no administrativemechanisms have been developed to allow those who disagree with the decision to withholdinformation to challenge the decision or to seek some remedy to the decision. To make this policywork, the federal government needs to develop procedures that will allow citizens the ability todisagree with the conclusions of the agency denying or withholding the information." (154)

Policy Options for "Sensitive But Unclassified" Information

Some who seek to clarify policies for controlling public or private scientific information thatis not classified believe that scientific progress and innovation, and even the fight against terrorism,will be harmed by limiting information flow. Yet these critics share the goal of trying to keeppotential terrorists from obtaining information that could be used to threaten the United States. Some have called for closer cooperation between the scientific and intelligence community to draftguidelines relating to safeguarding scientific information that might be useful to potentialterrorists. (155) These conflicting objectives raiseperplexing dilemmas for policymakers and scientistsalike. Policy options discussed below focus on several parts of this debate, including establishinguniformity in definitions and implementing guidelines; establishing an appeals process for SBUinformation; and the potential to classify or label as SBU more research information.

Considerations Related to a Uniform Definition of SBU. Since agencies define the term SBU differently, various interpretations couldlead to the possibility that information that should not be released to the public because of itspotential value to terrorists might be released; that agencies might not release SBU information toother agencies, or to state or local officials; or that the public may be denied access to informationwhose release might be permitted. Questions about ambiguities in the definition of the term SBUmay raise interest about legislating, or overseeing the process of developing, uniform criteria forSBU, especially since, in P.L. 107-296 , Congress encouraged nonfederal first responders tosafeguard such information via nondisclosure agreements. (156)

In order help set standards for SBU and SHSI, and to resolve policy dilemmas surrounding definitions and procedural controls, after release of the Card memorandum in March 2002, the WhiteHouse Office of Homeland Security was reported to have drafted a definition for SHSI, (157) and that"originally, there was an initiative to issue a Presidential Directive on unclassified but HomelandSecurity-sensitive information." (158) This wasnever publically released, but several agencies,including the Nuclear Regulatory Commission, utilized it when developing criteria to define SHSIas discussed in the Card and Ashcroft memos. (159) Subsequently the Office of Homeland Securityasked the White House Office of Science and Technology Policy (OSTP) and the Office ofManagement and Budget to develop guidance, which had been expected to be released in 2002 or2003. An objective of the proposed guidance was to withhold information from persons who shouldnot have access to it, but to allow such information to be shared with those who might have a needfor it, such as law enforcement and emergency response personnel. (160)

OMB and OSTP met with stakeholder groups, including academics and scientists, to obtain their views about how to develop guidance. (161) During a meeting held in late August 2002, withacademic and scientific officials and others discussing the March 2002 memos, their implementation,and definitions, "[a]cademic and scientific representatives ... argued [that] basic and appliedresearch, even research performed by the government, should not be subject to [sensitive butunclassified homeland security information] SHSI guidelines and advocated following existing rulesfor the handling of sensitive information, such as the Centers for Disease Control and Prevention(CDC) guidance for the handling of select agents." (162) Academic officials reportedly left the meetingconvinced that the March memo applied only to "information that was generated and owned by thegovernment, and not university research," nor to university research funded by federal governmentgrants. (163) During hearings on ConductingResearch During the War on Terrorism: BalancingOpenness and Security, held by the House Science Committee on October 10, 2002, White HouseOffice of Science and Technology (OSTP) Director John Marburger testified that the Administrationwants "to ensure an open scientific environment" while maintaining homeland security. He saidSHSI would apply to federal intelligence, law enforcement and public health information thatgenerally is not made public, but would not necessarily include research results. (164) Several otherwitnesses endorsed this position.

According to OSTP Director Marburger, SBU information related to homeland security "... may be withheld from public disclosure only when it warrants protection under one of the nineexceptions of the Freedom of Information Act." (165) The relationship between FOIA and theAdministration's homeland security information policies was the theme of a conference held by theDepartment of Justice's Office of Information and Privacy for FOIA officers during June 25, 2004. (166) The topics of the meeting were summarized in a FOIA Post article, but the discussion summarieswere not released to the public.

Despite many meetings in 2002 and 2003 with various stakeholders and apparent attempts to draft policy, no SBU or SHSI policy guidance was issued.

Before July 2003, the OMB/OSTP guidance had been expected to constitute the President's instructions to federal agencies to "prescribe and implement procedures" to "identify and safeguardsensitive homeland security information that is sensitive but unclassified," and to share thisinformation with other federal agencies and appropriate State and local personnel, as required bysection 892 (a) (1) (A)(B) of P.L. 107-296 . The Secretary of DHS was assigned these functionspursuant to Executive Order 13311, July 29, 2003 and the DHS Office of General Counsel was,reportedly, developing the guidelines mandated by P.L. 107-296 . It is not known which perspectiveswill be used in guidance to federal agencies -- the limited definition of sensitive as in the ComputerSecurity Act of 1987, the more expansive, but somewhat limited, conceptualization of SBU in theCard memorandum and attachments, or the broader conceptualization of SBU used by theDepartment of Energy. It is expected that the definition will extend beyond SHSI per se , that is,beyond information not routinely released to the public, such as law enforcement data, personnelinformation, and information on computer vulnerabilities, to include also a conceptualization of SBUinformation that could extend to some kinds of scientific and technical data.

Some have speculated that the delay in issuing guidance is due to disagreement about whether there should be public comment -- which might involve discussions raised by critics relating toensuring allowing public access to information that could be used to continue to permit public andcommunity oversight of governmental and industrial activities. Another concern that might be raisedby the public in commenting on proposed regulations could focus on penalties for violatingnondisclosure agreements that might affect unsuspecting recipients of SBU information. (167) Otherssay the delay "... may be ... a recognition of the voluntary restraints the academic community hasimposed on itself," referring specifically to professional groups' activities in support of voluntaryself-restraint (168) for sensitive scientificinformation. Although the law does not require publiccomment, an OMB official (169) and a Departmentof Justice release had said that SHSI guidance wouldbe subject to public notice comment before the regulation was implemented. (170) It is not clearwhether the Department of Homeland Security will seek public comment now that it has been givenresponsibility to draft the regulations. (171) Over75 public groups, "representing journalists, scientists,librarians, environmental groups, privacy advocates, and others" wrote to DHS Secretary in August2003, urging that he allow public input on procedures to be prescribed and implemented foridentifying, safeguarding, and sharing the sensitive but unclassified homeland security informationreferenced in section 892. (172)

Factors Agencies Might Use in Developing Nondisclosure Policyfor SBU Information. The Card and Ashcroft memos, together with section 892of P.L. 107-296 , have given agencies a basis to make decisions about restricting access to certainelectronic and hard copy information that previously may have been accessible to the public, butwhose continued distribution might be detrimental to homeland security. But it is unclear whatconceptualizations agencies and the DHS guidance will use. As noted above, agencies havediscretion to identify and withhold from the public, as sensitive or as sensitive but unclassified,information which they determine is subject to nondisclosure (pursuant to both the ComputerSecurity Act of 1987 and the Administration's interpretation of FOIA). Since the basis of thesedeterminations is subject to interpretation, both agency program managers and the public who mightseek access to such information may confront ambiguity in definitions and different kinds ofbalancing tests. There are questions about the uniformity of definitions used by different agenciesand which values or objectives should be encompassed in a risk analysis on which suchnondisclosure determinations might be based.

The definition of what information is SBU, at a minimum, is likely to encompass concepts that are defined as sensitive in the Computer Security Act 1987, that is to protect information whosedisclosure "could adversely affect the national interest or the conduct of Federal programs, or theprivacy to which individuals are entitled under ... the Privacy Act." Also, it may encompass theNIST criteria for sensitive information protection: confidentiality, integrity, and availability. (173) Additionally, among the topics the Administration instructed agencies to consider when making"discretionary disclosures" of SBU homeland security-related information that could be exempt fromFOIA is the "need to protect critical systems, facilities, stockpiles, and other assets from securitybreaches and harm -- and in some instances from their potential use as weapons of massdestruction in and of themselves." (174) TheAdministration also stressed that agencies, when applyingexemption 2, should consider the needs for an informed citizenry to ensure accountability,"safeguarding our national security, enhancing the effectiveness of our law enforcement agencies,protecting sensitive business information, and not least preserving personal privacy." (175) Also to beconsidered were " ... benefits that result from the open and efficient exchange of scientific, technical,and like information." Criteria for sensitive but unclassified SHSI also are likely to reference thetypes of information P.L. 107-296 identifies as "homeland security information" -- "any informationpossessed by a Federal, state, or local agency that -- relates to the threat of terrorist activity; relatesto the ability to prevent, interdict, or disrupt terrorist activity; would improve the identification orinvestigation of a suspected terrorist or terrorist organization, or would improve the response to aterrorist act" (Sec. 892 (f)).

Because of the difficulty of balancing the needs for information with security, some critics of the White House March 2002 memo have focused on the need for developing guiding principles. According to Steven Aftergood and Henry Kelly, "In deciding how to treat such information, theadministration should enunciate a clear set of principles, as well as an equitable procedure forimplementing them and appealing adverse decisions," with the appeals procedure "outside theoriginating agency." (176) They said that "Theguiding principles could be formulated as a set ofquestions, such as:

Is the information otherwise available in public domain? (Or can it be readily deduced from first principles?) If the answer is yes, then there is no valid reasonto withhold it, and doing so would undercut the credibility of official information policy.

Is there specific reason to believe the information could be used by terrorists? Are there countervailing considerations that would militate in favor ofdisclosure, i.e., could it be used for beneficial purposes? Documents that describe in detail howanthrax spores could be milled and coated so as to maximize their dissemination presumptively posea threat to national security and should be withdrawn from the public domain. But not everydocument that has the word "anthrax" in the title is sensitive. And even documents that are in someways sensitive might nevertheless serve to inform medical research and emergency planning andmight therefore be properly disclosed.

Is there specific reason to believe the information should be public knowledge? It is in the nature of our political system that it functions in response to publicconcern and controversy. Environmental hazards, defective products, and risky corporate practicesonly tend to find their solution, if at all, following a thorough public airing. Withholdingcontroversial information from the public means short-circuiting the political process, and riskinga net loss in security.

Given the contending values and factors that affect a workable definition and implementing rules, Congress may monitor the guidance that DHS develops to assist agencies in identifyingsensitive homeland security information and SBU. Because of the potential implications of theforthcoming DHS concepts for private scientific publications policy, various constituencies andscientific groups will undoubtedly seek to examine the balance between security and access toinformation in these guidelines.

The Potential to Classify More Research Information. Several activities have occurred that might increase the amount ofscientific research information that is classified. As noted above, NSDD 189 and Executive Order12958 both prohibit classification of certain kinds of federal scientific research information exceptfor reasons of national security. NSDD 189 deals with basic research and Executive Order 12958applies the prohibition to fundamental, or what it defines as basic and applied, research. During2001 and 2002, the heads of several federal agencies with substantial research responsibilities, whodid not have classification authority under Executive Order 12958, the prevailing executive orderon classifying information, (177) were givenoriginal classification authority. These include theSecretaries of Health and Human Services (178) and of Agriculture, (179) and also theAdministrator of theEnvironmental Protection Agency. (180) Someof the agencies with new classification authority,especially Health and Human Services and Agriculture, support substantial amounts ofcounterterrorism research, as well as of fundamental research in a variety of scientific and technicalareas, often performed on an extramural basis by researchers in colleges and universities. (181)

New Executive Order 13292, issued on March 25, 2003, amends Executive Order 12958 on classified national security information. The amendment permits classification of "scientific,technological, or economic matters relating to the national security, which includes defense againsttransnational terrorism " (new clause in italics, sec. 1.4 (e)). The amendment appears to highlightthat national security-related scientific, technological, and economic information dealing withdefense against international terrorism may be classified. Given that the definition of "nationalsecurity," in the two executive orders is not changed and that definition could have encompassedmatters related to transnational terrorism, it is unclear if the amended order widens the scope ofscientific, technological, and economic information to be classified. (182)

In addition, the Department of Defense reportedly plans to reissue its guidelines relating to pre-publication review of extramural research that it funds outside of its own laboratories. Recentlyseveral university groups wrote a letter to the Director of the Office of Science and TechnologyPolicy complaining that more agency program officials are inserting pre-publication review clausesinto contracts, including for fundamental research, without explanation as to their justification. Thishas a "pernicious effects," they said, "not only with regard to the freedom to publish but also withregard to employment of foreign-born students and researchers on federally funded research projects. If the contract clauses require blanket screening of any and all foreign-born scientists, universitieswill object." (183)

Agencies which were given original classification authority in the last few years are now developing implementing guidelines and appointing security officers in operating units. Given thelong-standing federal policy embodied in Executive Order 12598 and in NSDD 189 of notclassifying basic scientific research, except if release would threaten national security, the balancebetween science and security in agency guidelines will remain a topic of interest and concern. Interest in this topic may be heightened because of the recent changes made in Executive Order13292 to the definition of the kinds of scientific, technological, and economic information that maybe classified.

The scientific and academic communities are expected to pay close attention to these issues. Among the questions that may be raised are:

Will new controls be placed on federally funded research, including both intramural research conducted in an agency's laboratories, and on extramural research, that mightbe federally funded but conducted in nonfederal academic and industrial research laboratories?

Will controls encompass both classification levels and use of designations such as sensitive and sensitive but unclassified?

Will designation of a controlled research project be made before the award offunds and the start of a project, or after a project is completed and during a pre-publication reviewphase?

What kinds of requirements will be placed upon nonfederal researchers tosafeguard research information?

How will such controls affect the conduct of academic research for the federalgovernment?

How will such controls differ from the controls on proprietary researchinformation that are deemed acceptable by most academic institutions eager to receive financialsupport from industry?

Will research agencies with original classification authority modify theirlong-standing policies of encouraging publication and dissemination of federally funded researchresults?

Under the expanded definition of scientific and technological informationsubject to classification in Executive Order 13292, will agencies classify information that might haveotherwise been categorized as SBU?

Appeals Process for SBU Information. Anothercontinuing issue is expected to be an appeals process for designating information as SBU. StephenAftergood, with the Federation of American Scientists (FAS), suggested that " ... An appeals panelthat is outside of the originating agency and that therefore does not have [the] same bureaucraticinterests at stake would significantly enhance the credibility of the deliberative process. The efficacyof such an appeals process has been repeatedly demonstrated by an executive branch body called theInteragency Security Classification Appeals Panel (ISCAP)." (184) Another suggested approach is that"To solve disputes that develop out of the new category of 'sensitive but unclassified' information,one could allow the Information Security Oversight Office (a part of the Executive Branch) toreceive appeals to review disputes and challenges to executive agency decisions regarding the releaseof documents and reports The Office would oversee the appeals, it would have another set of eyesthat would examine the requested information and review it in a different context that the executiveagency. The ISOO might be able to work with both the agency involved and those requesting theinformation to reach a compromise that everyone could accept. It would also have the effect ofkeeping the oversight of the information in the hands of the executive branch." (185)

Determination of "Tiered" Access to SBU Information. Some agencies have discussed developing procedures to permit"tiered," or selective, access to qualified and pre-screened individuals for some scientific andtechnical information, that could be categorized as SBU or SHSI. Reportedly, EPA requiresresearchers to obtain sponsorship from a senior EPA official, have their requests approved inadvance and register before using the Envirofacts database. (186) EPA also has issued instructions toutilities to submit threat or vulnerability assessments to the agency. Using a protocol issued inDecember 2002, reportedly, EPA "... will keep sensitive information in the assessments secure. Thedocuments will be kept in one location under lock and only individuals designated by EPA will haveaccess to them." (187) EPA also will release otheragency information to selected individuals only inhard copy at EPA offices and libraries throughout the nation. (188) The Federal Energy RegulatoryCommission (FERC) issued a final rule, effective April 2, 2003, which limits release of its criticalenergy infrastructure information on a selective or "tiered" basis to members of the public based ontheir need to know and the legitimacy of their need as determined by the Commission. (189) FERC saidit would not alter its responsibilities under FOIA, but appears to be broadening, or at a minimum,reinterpreting implementation of exemptions to disclosure under FOIA. (190) The U.S. GeologicalSurvey has announced that it will implement four levels of control for its information products:

a. No sensitivity is determined. No restriction is required. b. Product is determined to be sensitive. Do not distribute. c. Sensitivity has beendetermined for a previously distributed product that is widely available. Withdrawal would beineffective. Continue distribution of current version. Restrict distribution of new features to updatesfor l year. d. Product is restricted according to directive from another agency with specific authorityfor public safety or national security. (191)

The equity of procedures for "tiered" or selective access; the need to create public and or private panels to examine controls on the release of some information; and the need to clarify relationshipsbetween the private sector and the government with respect to safeguarding information in scientificpublications to protect the public interest are issues which may be raised in the legislative context.

Appendices

Appendix 1. History of Atomic Energy "Restricted Data" Controls

The development and history of atomic energy restricted data controls were explained in a document prepared in 1989 by Arvin S. Quist, a classification officer at the Oak Ridge GaseousDiffusion Plant, Oak Ridge National Laboratory, which is operated on contract for the Departmentof Energy. (192) Excerpts below from the Quistdocument explain the relevant provisions of these laws.

In the ... Atomic Energy Act of 1946, Congress established a special category of information called "Restricted Data." Restricted Data was definedto encompass "all data concerning the manufacture or utilization of atomic weapons, the productionof fissionable material, or the use of fissionable material in the production of power." (193) Thus, byoperation of law, nearly all atomic (nuclear) energy information fell within the definition of RD. TheAtomic Energy Act authorized the AEC to control the dissemination of RD, specifying as aprerequisite to access to this information that an individual must have a security clearance....

... Two particularly unique and significant aspects ofRD warrant emphasis. First, a positive action is not required to put information into the RD category.If information falls within the Act's definition of RD, it is in this category from the moment of itsorigination; that is, it is "born classified." The government has no power to determine thatinformation is RD ... only the power to declassify RD. [In practice, the Government (Departmentof Energy) determines whether information falls within the definition of Restricted Data.] ... The"born classified" concept is unique with RD. This concept assumes that newly discovered atomicenergy information might be so significant with respect to the nation's security that it requiresimmediate and absolute control. ...National Security Information is not so designated until anoriginal classifier makes a positive determination that the information falls within the definition ofNSI ....

Although RD is said to be born classified, the AtomicEnergy Act does not specifically designate it as "classified" information. The Act defines RD andprescribes very strict methods for its control without stating that it is "classified" information. However, the Act does describe declassification of RD; therefore, by implication, RD is "classified." A second unique aspect of RD is that information does not have to be owned or controlled by thegovernment to be classified as RD. ... The circumstance could even arise in which an individualcould originate RD and then not be allowed to possess it because of lack of security clearance or"need to know." The Atomic Energy Act does not forbid an individual to generate RD, but, onceRD is generated, the Act prohibits its communication to persons not authorized to receive it.

In 1951, Congress amended the Atomic Energy Act of 1946 to make certain atomic energy information available to other countries for purposes of weapons development, but the NationalSecurity Council had to approve these information flows. The Atomic Energy Act of 1954 amendedthe 1946 act to include "an increased emphasis on wider dissemination of atomic energy information,to make more of it accessible to U.S. industry and to the world in order to permit the developmentof nuclear reactors for commercial production of electric power ... as a consequence of PresidentEisenhower's [1953] Atoms For Peace initiative ...." The Quist document says:

With respect to the control of information, the 1954 Act stated:

"It shall be the policy of the Commission to control thedissemination and declassification of Restricted Data in such a manner as to assure the commondefense and security. Consistent with such policy the Commission shall be guided by the followingprinciples: (a) Until effective and enforceable international safeguards against the use of atomicenergy for destructive purposes have been established by an international arrangement, there shallbe no exchange of Restricted Data with other nations except as authorized by section 2164 of thistitle; and (b) The dissemination of scientific and technical information relating to atomic energyshould be permitted and encouraged so as to provide that free interchange of ideas and criticismwhich is essential to scientific and industrial progress and public understanding and to enlarge thefund of technical information. ...[42 U.S.C. sec. 2161.]"

... The 1954 Actadded "industrial progress," "public understanding," and "enlarge the fund of technical information"as reasons to disseminate atomic energy information. Those additions provided the basis for thesubsequent declassification or downgrading of much atomic energyinformation.

... The 1946 Act had permitted declassification of RDonly when the AEC determined that it could be published without "adversely affecting the commondefense and security .... The 1954 Act changed "adversely affecting" to "undue risk," therebyshifting the balancing test towards declassification of more information .... The increased emphasisof the 1954 Act in disseminating atomic energy information is further exemplified by a continuousreview requirement...:

... Prior to the Atomic Energy Act of 1954, privatepersons could not have access to RD for commercial purposes (e.g., development of commercialnuclear power reactors). The only reason for allowing private persons to have access to such datawas on a need-to- know basis, in connection with national defense work. Although the 1954 Actenvisioned the commercial development of nuclear energy, the Act contained no express provisionspermitting access to RD for commercial purposes. This hurdle was overcome in 1956 when the AECused its administrative powers to establish an Access Permit Program ... Under this program, apermitted is able to have access to RD "applicable to civil uses of atomic energy for use in hisbusiness, trade or profession."

Appendix 2. Foreign Affairs Manual on SBU Information (194)

12 FAM 540, SENSITIVE BUT UNCLASSIFIED INFORMATION (SBU) (TL:DS-61; 10-01-1999)

12 FAM 541 SCOPE (TL:DS-46; 05-26-1995)

a. SBU describes information which warrants a degree of protection and administrativecontrol that meets the criteria for exemption from public disclosure set forth underSections 552 and 552a of Title 5, United States Code: the Freedom of Information Act andthe Privacy Act.

b. SBU information includes, but is not limited to:

(1) Medical, personnel, financial, investigatory, visa, law enforcement, or otherinformation which, if released, could result in harm or unfair treatment to any individualor group, or could have a negative impact upon foreign policy or relations; and

(2) Information offered under conditions of confidentiality which arises in the course ofa deliberative process (or a civil discovery process), including attorney-client privilege orwork product, and information arising from the advice and counsel of subordinates topolicy makers.

12 FAM 542 IMPLEMENTATION (TL:DS-46; 05-26-1995)

Previous regulations regarding LOU material are superseded and LOU becomes SBU asof the date of this publication.

12 FAM 543 ACCESS, DISSEMINATION, AND RELEASE (TL:DS-61; 10-01-1999)

a. U.S. citizen direct-hire supervisory employees are responsible for access, dissemination,and release of SBU material. Employees will limit access to protect SBU information fromunintended public disclosure.

b. Employees may circulate SBU material to others, including Foreign Service nationals,to carry out an official U.S. Government function if not otherwise prohibited by law,regulation, or interagency agreement.

c. SBU information is not required to be marked, but should carry a distribution restrictionto make the recipient aware of specific controls. To protect SBU information stored orprocessed on automated information systems, the requirements found in 12 FAM 600(Information Security Technology) must be met.

12 FAM 544 SBU HANDLING PROCEDURES: TRANSMISSION, MAILING,

SAFEGUARDING/STORAGE, AND DESTRUCTION (TL:DS-47; 06-08-1995)

a. Regardless of method, transmission of SBU information should be effected throughmeans that limit the potential for unauthorized public disclosure. Since informationtransmitted over unencrypted electronic links such as telephones may be intercepted byunintended recipients, custodians of SBU information should decide whether specificinformation warrants a higher level of protection accorded by a secure fax, phone, or otherencrypted means of communication.

b. SBU information may be sent via the U.S. Postal Service, APO, commercial messenger,or unclassified registered pouch, provided it is packaged in a way that does not discloseits contents or the fact that it is SBU.

c. During nonduty hours, SBU information must be secured within a locked office or suite,or secured in a locked container.

d. Destroy SBU documents by shredding or burning, or by other methods consistent withlaw or regulation.

12 FAM 545 RESPONSIBILITIES (TL:DS-46; 05-26-1995)

Unauthorized disclosure of SBU information may result in criminal and/or civil penalties.Supervisors may take disciplinary action, as appropriate. State offices responsible for theprotection of records are outlined in 5 FAM. See 3 FAM for regulations and process ondisciplinary actions. (12 FAM 550 provisions regarding incidents/violations do not pertainto SBU.)

Appendix 3. Excerpts From ISOO/OIP Guidance, March 18, 2002 (195)

III. Sensitive But Unclassified Information

In addition to information that could reasonably be expected to assist in the development or use of weapons of mass destruction, which should beclassified or reclassified as described in Parts I and II above, departments and agencies maintain andcontrol sensitive information related to America's homeland security that might not meet one ormore of the standards for classification set forth in Part 1 of Executive Order 12958. The need toprotect such sensitive information from inappropriate disclosure should be carefully considered, ona case-by-case basis, together with the benefits that result from the open and efficient exchange ofscientific, technical, and like information.

All departments and agencies should ensure that in taking necessary and appropriate actions to safeguard sensitive but unclassified information relatedto America's homeland security, they process any Freedom of Information Act request for recordscontaining such information in accordance with the Attorney General's FOIA Memorandum ofOctober 12, 2001, by giving full and careful consideration to all applicable FOIA exemptions. See FOIA Post , "New Attorney General FOIA Memorandum Issued" (posted 10/15/01) (found atwww.usdoj.gov/oip/foiapost/2001foiapost19.htm), which discusses and provides electronic links tofurther guidance on the authority available under Exemption 2 of the FOIA, 5 U.S.C. ï¿½ 552 (b)(2),for the protection of sensitive critical infrastructure information. In the case of information that isvoluntarily submitted to the Government from the private sector, such information may readily fallwithin the protection of Exemption 4 of the FOIA, 5 U.S.C. ï¿½ 552 (b)(4).

As the accompanying memorandum from the Assistant to the President and Chief of Staff indicates, federal departments and agencies should not hesitateto consult with the Office of Information and Privacy, either with general anticipatory questions oron a case-by-case basis as particular matters arise, regarding any FOIA-related homeland securityissue. Likewise, they should consult with the Information Security Oversight Office on any matterpertaining to the classification, declassification, or reclassification of information regarding thedevelopment or use of weapons of mass destruction, or with the Department of Energy's Office ofSecurity if the information concerns nuclear or radiologicalweapons.