President Barack H. Obama issued Executive Order 13526 on "Classified National Security Information" on December 29, 2009. In the months succeeding the issuance of E.O. 13526, multiple incidents have further heightened congressional, media, and public interest in the issue of classified information policy: 1. Shamai Leibowitz, a former Federal Bureau of Investigation contractor, was sentenced to prison for divulging classified materials to a blogger. 2. Wikileaks .org , an organization that describes itself as a "public service designed to protect whistleblowers, journalists and activists who have sensitive materials to communicate to the public," published online more than 600,000 classified diplomatic cables and government documents produced during the wars in Afghanistan and Iraq. These disclosures have been condemned by the Obama Administration and other officials. 3. An August 6, 2010, memorandum indicates that the Department of Defense (DOD) is purchasing and destroying the entire first edition of a book by a former employee. The agency believes the book reveals classified information regarding military and intelligence operations in Afghanistan. 4. Jack Goldsmith, a former U.S. assistant attorney general, has alleged that "senior government officials" have leaked classified information to journalist Bob Woodward. These incidents occurred in the wake of other information releases in the past few years. This report addresses classified information policy, including its history, costs, and the agencies assigned a role in it. The report focuses on Executive Order 13526, which establishes the current policy, and identifies possible classified information policy oversight issues for Congress. Many authorities and policies limit access to information held by the federal government. Three examples include Article I, Section 5, of the U.S. Constitution specifies that each house of Congress "shall keep a Journal of its Proceedings, and from time to time publish the same, excepting such Parts as may in their Judgment require Secrecy;" Federal law keeps personal income tax records confidential (26 U.S.C. 6103); and Federal agencies have devised policies to restrict access to information. Agencies have, for example, marked documents as "For Official Use Only," which proscribes their public release. This report focuses on one of these policies—classified information policy, which also is called security classification policy and classified national security information policy . Federal law has defined classified information as information or material designated and clearly marked or clearly represented, pursuant to the provisions of a statute or Executive order (or a regulation or order issued pursuant to a statute or Executive order), as requiring a specific degree of protection against unauthorized disclosure for reasons of national security (50 U.S.C. 426(1)). Broadly speaking, classified information policy refers to a range of federal governmental practices that aim to restrict access to information or documents on the grounds of national security. The purpose in limiting access to this information is to prevent it from being used by persons, organizations, or nations to inflict harm upon the United States. As the two following sections describe, Congress has enacted classified information policy statutes. However, classified information policy largely has been established through executive orders. Since 1940, Presidents regularly have issued executive orders to set classified information policies ( Table 1 ). As this report later details, President Obama has revised classified information policy through the issuance of E.O. 13526 on December 29, 2009. Typically, these directives have defined who in the federal government may classify information, what levels of classification and classification markings (e.g., "top secret") may be used, who may access classified information, and how and when classified information is to be declassified. These executive orders also have limited the use of classification. For example, executive orders have forbidden the use of classification "to conceal violations of law, inefficiency, or administrative error; to prevent embarrassment to a person, organization, or agency; to restrain competition; or to prevent or delay the release of information that does not require protection in the interest of national security" (e.g., E.O. 12356, Section 1.6). In some instances, executive orders have mandated the declassification of documents (E.O. 12937), or established new agencies to implement aspects of classified information policy (E.O. 12065). Frequently, a new executive order repeals the classified information policies of previous executive orders. One exception to this generalization is E.O. 10104 (1950). This order limits the dissemination of information regarding "certain vital military and naval installations or equipment" and has not been repealed explicitly. President Truman issued this executive order subsequent to the enactment of statutes that remain law (18 U.S.C. 795 and 797). As described above, classified information policy largely has been established through executive orders. However, periodically Congress has enacted classified information statutes, including those that forbid individuals from gathering, receiving, and transmitting information related to national defense and intelligence activities, and authorize sanctions, including the death penalty in certain instances (62 Stat. 736-738; 18 U.S.C. 793-797); forbid the disclosure of classified information regarding intelligence codes, systems, or cryptography (65 Stat. 719; 18 U.S.C. 798); protect the identities of covert intelligence agents and criminalize their disclosure ( P.L. 97-200 , Sec. 2(a); 96 Stat. 122; 50 U.S.C. 421); established the Public Interest Declassification Board (PIDB) and charged it with advising the President and other public officials on information declassification policy ( P.L. 106-567 , Title VII; 114 Stat. 2856; 50 U.S.C. 435, Amendments); and required the establishment of procedures for the protection against unauthorized disclosure of any classified information in the custody of federal courts, including the Supreme Court ( P.L. 96-456 ; 94 Stat. 2025; 18 U.S.C. Appendix). Congress enacted a particularly significant classified information policy in the FY1995 intelligence authorization act ( P.L. 103-359 , Sec. 802; 108 Stat. 3435; 50 U.S.C. 435). It assigned to the President the responsibility to establish procedures governing access to classified information. This made into law what had hitherto been a practice—allowing the President to have a lead role in devising classified information policy. Most recently, Congress enacted P.L. 111-258 , the Reducing Over-Classification Act, which President Obama signed into law on October 9, 2010. According to the Senate report accompanying the legislation, this statute aims to prevent federal departments and agencies from unnecessarily classifying information or classifying information at a higher and more restricted level than is warranted, and by doing so to promote information sharing across departments and agencies and with State, local, tribal and private sector counterparts, as appropriate. To these ends, the statute advances multiple measures, including requiring executive branch agencies' inspectors general to assess whether their agencies are following current classified information policies ( P.L. 111-258 , Section 6(b)). The federal government's total annual expenditures for classifying and declassifying information are not publicly available. The Information Security Oversight Office (ISOO), an agency within the National Archives and Records Administration (NARA), annually releases a report on agencies' estimated classified information policy costs. However, these estimates are drawn from the agencies' own estimates, which are not audited by ISOO or any other agency. Additionally, the ISOO report figures do not include the costs of the Central Intelligence Agency (CIA), the Defense Intelligence Agency (DIA), Office of the Director of National Intelligence (ODNI), the National Geospatial-Intelligence Agency (NGIA), the National Reconnaissance Office (NRO), and the National Security Agency (NSA). The classified information policy cost estimates for these latter agencies are provided to the President in a classified addendum to the report. The ISOO reports that total government classified information policy costs were $8.8 billion in FY2009. This amount is slightly higher than the estimated costs in each of the four previous years ( Figure 1 ). Nearly 55% ($4.8 billion) of the FY2009 estimated costs are attributed by agencies to "information security," an administrative category that includes the information systems (e.g., computer hardware and software) used to collect, store, and utilize classified information, and administrative expenses related to information security classification activities. Approximately 15% ($1.3 billion) of classified information policy costs are attributed to "security management, oversight, and planning." The remaining 30% ($2.7 billion) of costs goes toward the costs of personnel security (e.g., background checks on persons with access to classified information), the training of personnel in the proper handling of classified information, and the physical security of facilities holding classified information. In FY2009, the federal government is estimated to have spent $44.7 million to declassify information. This amounts to 0.5% of the FY2009 total classified information policy costs ($8.8 billion). Generally speaking, authorized executive branch agencies are to classify information in accordance with standing classified information policy. Agencies also are obliged to secure this information and to train their personnel in its proper handling. Executive branch inspectors general, as noted previously, must assess their agencies' compliance with classified information policy. However, four entities have been established and assigned classified information policy responsibilities: (1) the Information Security Oversight Office (ISOO), (2) the Public Interest Declassification Board (PIDB), (3) the Interagency Security Classification Appeals Panel (ISCAP), and (4) the National Declassification Center (NDC). The authorizations that established these entities and their responsibilities are described below. President James E. Carter established the Information Security Oversight Office via E.O. 12065, which he issued on June 28, 1978. The ISOO is located within the NARA.