Federal agencies have long confronted the need to balance the release of information for public use with the need to withhold information that could be used to threaten privacy or security. The term "sensitive but unclassified" (SBU) information was used before the terrorist attacks of September 11, 2001, even though there is no statutory definition for it. Since 9/11 more agencies have started to use the term "SBU," or some variant of it, and to implement security systems to identify and protect nonclassified information whose release might benefit terrorists. Many questions have been raised about how to design uniform policies and controls for SBU information. This report focuses on controls for two kinds of scientific and technical information—information used in research and scientific publication and information used to serve broader public policy purposes, such as in regulatory decisionmaking and citizen oversight. Both public and privately controlled information are included and in some respects, private professional groups' responses are being defined by public pressures and decisions. Two divergent perspectives are discernable. From one perspective, broadening controls to deny public access to federal SBU information will constrain terrorists, who might use it to threaten buildings, infrastructure, people, and services. It has been estimated that "our adversaries derive up to 80% of their intelligence from open-source information." Another source put this at 90%, referring to information about local energy infrastructures, water reservoirs, dams, highly enriched uranium storage sites, and nuclear and gas facilities. Moreover, some say that the potential for terrorism is heightened if terrorists can aggregate seemingly innocuous bits of public information. Although many agencies have begun to limit public access to sensitive information, from this perspective, these efforts are inadequate. In contrast to those who seek to widen controls, another view contends that inadequate and insufficient sharing of information with the public and among first responders potentially weakens efforts to protect the nation from terrorist attacks. A related perspective is that as government policy on sharing information shifts to the "need to know" rationale that has become more prevalent since the 9/11 terrorist attacks, the imposition of more controls will deny ordinary citizens information relating to research, environmental protection, transportation, and so forth that they need in order to be informed and to hold accountable government and industry decisionmakers. Some say new control policies unduly limit access to information needed to advance the progress of science and technology and the development of technologies to counter threats, arguing that if scientific and technical information needs to be restricted, it should be classified. This report traces the evolution of SBU-related controls; summarizes actions taken to protect certain types of scientific and technical information; describes critiques of some control policies; and summarizes proposals and actions, including congressional, executive and other initiatives, to clarify these issues and develop policies that serve various stakeholders. It also raises issues that may warrant further attention. Generally, pursuant to National Security Decision Directive 189 (NSDD-189), fundamental (basic or applied) research conducted in universities is not to be labeled "classified" if does not affect national security; it is therefore "unrestricted." Nevertheless, as one commentator noted, "[T]he federal government seems to possess wide latitude in declaring information, even purely scientific research, classified or at least sensitive to prevent publication." If research does compromise national security, it may be classified pursuant to Executive Order 12958 and Executive Order 13292—the latter of which expanded the government's ability to classify some scientific and technical information to include information related to "defense against transnational terrorism" (Section 1.4 of Executive Order 13292). During 2001 and 2002, the heads of several federal agencies with substantial research responsibilities, who did not have classification authority under Executive Order 12958, were given original classification authority. These included the Secretaries of Health and Human Services and of Agriculture, the Administrator of the Environmental Protection Agency (EPA), and the Director of the White House Office of Science and Technology Policy (OSTP). Also, pursuant to Executive Order 12958, federally funded researchers at any research-performing institution, including universities and colleges, are obligated to report to the government information that they produce that should be classified. In addition, the government may exercise prepublication reviews on some R&D information, and by writing into contracts control clauses for SBU or classified information. Some R&D information is "born classified," according to the Atomic Energy Act of 1946. In addition, pursuant to the Information Security Act of 1951, certain patent information may be classified if release would harm national security. Academic and industrial researchers are also subject to sensitive information controls for nonclassified information. Some of these are voluntary and self-imposed by researchers or professional societies and publishers. For instance, in the early 1940s basic physics research in fission was voluntarily withheld from publication by a leading journal, Physical Review , because of fears that publication of research results would benefit German atomic energy research. After the war ended the results were published. However, reportedly, foreign scientists, especially Soviet scientists, deduced that the absence of research publications on the topic meant that Americans "were pursuing an atomic bomb" and started their own inquiries on this subject. More recently, some researchers have initiated voluntary controls on the conduct and/or publication of sensitive research in biological sciences fields that might assist terrorists. (For additional details, see the section below entitled " Controls on Unclassified Biological Research Information .") In addition, the directors of the Department of Homeland Security's (DHS) six academic centers of excellence have developed draft guidelines "to control the dissemination of sensitive information generated by their research" —which is in the fields of agricultural, chemical, biological, nuclear and radiological, cyber terrorism, and the behavioral aspects of terrorism. There are also formal government-mandated controls. For instance, pursuant to sections 3235 and 3295(c) of the National Defense Authorization Act for FY2000, the Department of Energy (DOE) released regulations, effective August 18, 2006, that require all users of DOE computers, including persons who e-mail a DOE computer, to give the department written permission for investigators to check any DOE computer accessed by that person for up to three years in the future. The regulation applies to all information, including classified and sensitive but unclassified, and other types. Reportedly, the required paperwork might prove to be costly to some researchers. The federal government also mandates controls on contract research. For instance, the issue of federal agency research contracts with universities imposing prepublication review clauses was addressed in an April 2004 report, Restrictions on Research Awards: Troublesome Clauses, released by the Association of American Universities, in cooperation with the Council on Government Relations. It detailed 138 instances of restrictions placed on publications or other prohibitions on foreign nationals as preconditions for receiving research awards. The report opposed the practice, recommended that federal agencies adhere to the mandates of NSDD-189, and concluded that governmental restrictions were not compatible with university research. Export control regulations generally do not apply to the conduct of fundamental research as long as it is ordinarily published and shared broadly within the scientific community. However, export control regulations and International Traffic in Arms Control regulations (ITAR) permit the government to require licensing for the export, or "deemed export," of certain scientific and technical information to specific foreign countries or citizens of those countries working in the United States on university campuses or in industrial laboratories. During 2004 and 2005, considerable controversy arose over the publication of two Inspector General reports, one from the Department of Defense (DOD) and the other from the Department of Commerce (DOC). They proposed strict adherence to government interpretations that, even if the research being conducted is fundamental, the operation, technical training, installation, maintenance, repair, overhaul, or refurbishing of commercially available equipment used in the research is a "deemed export" that requires an export license for certain foreign researchers. This would be for equipment as common as fermenters and global positioning system (GPS) locators and would apply to students from China, Russia, India, and other countries on lists of countries that pose national security threats. In a notice of a proposed rule published in the Federal Register on March 28, 2005, the DOC recommended that country of birth rather than of citizenship or permanent residence be used as the criterion for determining nationality for deemed export controls. DOD's proposed rules, which would require badging, training, and segregated work areas for eligible researchers and exclusion of others, were published in July 2005, when the comment period began. Subsequently, some university officials argued that expanded interpretations of rules for "deemed export" licenses may be unnecessary. Other members of the academic community cite problems in administering use controls, including ambiguity about identifying which equipment or material in university laboratories is subject to export controls; discrimination on the basis of nationality; difficulty in controlling access of students and researchers in university laboratories; time required to obtain licenses and inflexibility in obtaining licenses; modest security benefits; slowing or preventing important discoveries due to licensing delays; loss of research talent if students and researchers study in other countries; and reduction in research at the leading edge of science. The three presidents of the National Academies [of Science, Engineering, and the Institute of Medicine] opposed such controls in a letter to DOC Secretary Carlos M. Guitierrez, June 16, 2005, and made several recommendations, including the proposal to "[c]lear international students and postdoctoral fellows for access to controlled equipment when their visas are issued or shortly thereafter so that their admission to a university academic program is coupled with their access to use of export controlled equipment." One policy group recommended an alternative approach: to require a deemed export license for "transfers of technology to specifically identified individuals if specific adverse information exists about that individual."