Under its Safeguards Agreement with IAEA, the United States submitted a list of civilian nuclear facilities—primarily civilian nuclear power reactors. The Additional Protocol, a separate agreement between the United States and IAEA, supplements the United States’ Safeguards Agreement with IAEA. Under the Additional Protocol, the United States must provide IAEA with a broader range of civilian nuclear and nuclear-related information than that required under the Safeguards Agreement, such as the manufacturing of key nuclear-related equipment; research and development activities related to the nuclear fuel cycle; the use and contents of buildings on a nuclear site; and exports of IAEA-specified, sensitive nuclear-related equipment. The United States must also provide IAEA with access, through on-site inspections, to resolve questions relating to the accuracy and completeness of the information. As a nuclear weapon state party to the Treaty on the Non-Proliferation of Nuclear Weapons, the United States is not obligated by the Treaty to accept IAEA safeguards or to implement an Additional Protocol. However, according to U.S. officials, voluntarily adopting the Additional Protocol underscores U.S support for IAEA’s strengthened safeguards system and makes efforts to encourage more countries to adopt the Additional Protocol more effective and credible. In its act implementing the Additional Protocol, Congress prohibited the inclusion of certain information: any classified information; any information that would be deemed restricted data under the Atomic Energy Act; and any information of direct national security significance regarding any location, site, or facility associated with activities of the Department of Defense or DOE. The act also provided that information collected for the purposes of the Additional Protocol would be exempt from disclosure under 5 U.S.C. § 552, which is the Freedom of Information Act. Figure 1 shows a timeline of the U.S. implementation of the Additional Protocol. The U.S. government classifies information that it determines could damage the national security of the United States if disclosed publicly. Beginning in 1940, classified national defense and foreign relations information has been created, handled, and safeguarded in accordance with a series of executive orders. Executive Order 12958, Classified National Security Information, as amended, is the most recent. It demarcates different security classification levels, the unauthorized disclosure of which could reasonably be expected to cause exceptionally grave damage (Top Secret), serious damage (Secret), or damage (Confidential). Federal agencies also place dissemination restrictions on certain unclassified information. Federal agencies use many different designations to identify this type of information. For example, DOE uses the designation OUO, while State uses SBU. According to a May 2009 presidential memorandum, there are more than 107 unique markings and over 130 different labeling or handling processes and procedures for documents that are unclassified, but are considered sensitive. For example, according to DOE officials, although OUO information is less sensitive than classified information, OUO information may be shared with people lacking security clearances provided that officials determine they have a “need to know.” These restrictions are used to indicate that the information, if disseminated to the public or persons who do not need such information to perform their jobs, may cause foreseeable harm to protected governmental, commercial, or privacy interests. Such information includes, for example, sensitive personnel information, such as Social Security numbers and the floor plans for some federal buildings. It may also include information exempted from disclosure under the Freedom of Information Act. While no single U.S. government agency or office was entirely responsible for the public disclosure of the draft declaration, all of the agencies and offices involved in preparing and publishing the draft declaration share some responsibility for its public release. We identified several points during the life cycle of the draft document where problems occurred. Specifically, we found that opportunities to improve the secure handling of the document were missed because of the absence of clear interagency guidance, different procedures across the agencies governing the handling and marking of sensitive documents, poor decision making, and a lack of training and adequate security awareness. These missed opportunities occurred between February 2008 and May 2009. Several U.S. government agencies played key roles in preparing and making important decisions regarding the publication of the draft declaration: DOE, Commerce, State, NRC, the White House (the National Security Council and Executive Clerk’s Office), the U.S. House of Representatives (Office of the Parliamentarian, Office of Security, and the Clerk’s Office), and GPO. Figure 2 is a two-page summary of key dates and events that occurred during the life cycle of the draft declaration, leading up to its inadvertent public release on May 7, 2009. After the President signed an executive order in February 2008 to implement the Additional Protocol, DOE, Commerce, and NRC began collecting information on nuclear sites, facilities, and activities to be included in the draft declaration. DOE collected information from national laboratories and nuclear weapons production facilities. NRC, which regulates the civilian use of nuclear materials, collected information from NRC-licensed nuclear facilities, including four civilian nuclear power plants previously selected by IAEA for the application of safeguards. DOE and NRC provided nuclear-related information to Commerce on January 15, 2009, and March 18, 2009, respectively. Commerce collected information from private nuclear-related industries not regulated by DOE or NRC, such as the location, operational status, and production capacity of conventional uranium mines. Commerce then consolidated all nuclear- related information from its offices, as well as from DOE and NRC, into a draft U.S. declaration for final interagency approval and transmittal to State. The process for collecting and consolidating this information from the three agencies took several months. Commerce, in consolidating and formatting the information in the draft declaration, did not mark the document with an official U.S. government security marking. The only marking on the draft declaration was IAEA’s designation on the top of the document—“Highly Confidential Safeguards Sensitive”—which has no legal significance in the United States. To consolidate and properly format the information, Commerce established and managed a central database, known as the U.S. Additional Protocol Reporting System (APRS). IAEA provided a software program for this database that standardizes the information sent to IAEA by each member state and helps IAEA assess the completeness of the information. Before transmitting data to Commerce or adding data to the APRS, each agency reviewed the information it collected for accuracy, data consistency, and national security concerns. Each agency also reviewed the information to ensure that no classified information was being disclosed. The agencies had agreed that the information in the U.S. declaration would not be classified, as required by the U.S. Additional Protocol Implementation Act; that an unclassified database could be used to process the information; and that the data were sensitive and would be restricted to authorized personnel only. When Commerce and NRC added information to APRS, IAEA-supplied software automatically marked the top of each page of the draft declaration as “Highly Confidential Safeguards Sensitive.” IAEA uses this designation to ensure the document’s appropriate handling and control. According to IAEA officials, Highly Confidential Safeguards Sensitive information is the agency’s highest classification level. This type of information, if released, could cause grave damage to IAEA interests. When IAEA receives a document from a country with this classification, it cannot publicly disclose the information in the document because, in some instances, its release could disclose confidential business information, create potential security issues, or identify reporting discrepancies between countries. Distribution of this information is limited and released on a need-to-know basis. Since this IAEA marking has no legal significance in the United States, DOE, Commerce, and NRC treated the information as OUO. These agencies use OUO markings to provide a warning that information in a document is sensitive and is generally only to be released to those with a need to know, regardless of their security clearance. DOE, NRC, and Commerce took steps to safeguard the information that each contributed to the draft declaration. Specifically, before DOE and NRC submitted data to Commerce in January and March 2009, respectively: DOE marked the top and bottom of each page it submitted to Commerce with nuclear information from the national laboratories and production facilities as OUO and added a statement that the information may be exempt from public release under the Freedom of Information Act. NRC officials hand carried a compact disc containing its nuclear-related information to Commerce, rather than electronically sending the information. Commerce officials also safeguarded the information by password protecting APRS and sending State the draft declaration through secure e- mail that included a transmittal letter explaining that the contents were considered OUO. In addition, they hand carried a compact disc to State that was marked with “For Official Use Only/Not For Public Release/IAEA Highly Confidential Safeguards Protected” hand written on the disc. Although each agency designated the information it contributed as OUO, the document—which was produced from each agency’s contributions— did not have any U.S. government security markings. The agencies reviewed the draft declaration multiple times, but no agency marked the pages containing information it had contributed to the full draft declaration as OUO. Once all the information was consolidated, the 266- page document was not marked OUO or any other security designation recognized in the United States that would have clearly indicated that the data were sensitive, restricted to authorized personnel only, and not releasable to the public. The only OUO markings were next to site diagrams of two DOE facilities found on two different pages of the draft declaration.