The U.S. government classifies information that it determines could reasonably be expected to damage the national security of the United States if disclosed publicly. Since 1940, the classification of official secrets has been governed by policies and procedures flowing from executive orders issued by presidents, largely based on authority granted under Article II of the Constitution. Current classification and declassification requirements are mandated by Executive Order 12958, Classified National Security Information, as amended. The order establishes the basis for classifying national security information at one of three levels—Top Secret, Secret, or Confidential—depending on the degree of damage that unauthorized disclosure of this information could reasonably be expected to cause to the national security of the United States. Pursuant to the executive order, designated individuals, called original classifiers, exercise original classification authority, meaning they can classify national security information for the first time. Such individuals, including the President, agency heads, and other government officials that have been delegated this authority determine the degree of damage that disclosure could cause, decide on a classification level for the information, and attempt to establish a date or event for its declassification. Declassification is a vital part of the classification system because it prompts the change in status of the information from classified to unclassified, which may make it available for others to access and use, such as members of the general public, researchers, historians, or other parties. Under the automatic declassification provision of the executive order, all records of a permanent historical value over 25 years old that contain classified national security information will be automatically declassified on December 31, 2006, and each year thereafter, and may be available for public disclosure, unless an agency head or senior agency official determines that these records fall within an exemption that permits continued classification as approved by the President or the Interagency Security Classification Appeals Panel. Examples of exemptions include information that, if released, could be expected to seriously impair relations between the United States and a foreign government; undermine diplomatic activities of the United States; identify a human intelligence source; or violate a statute, treaty, or international agreement. Information that is automatically declassified as of December 31, 2006, will not necessarily enter the public domain. According to ISOO officials, declassified information may continue to be withheld from public disclosure for reasons under the Freedom of Information Act (FOIA) or other legal authority or may be reclassified in accordance with the executive order. The order also requires ISOO to implement directives and perform oversight inspections of executive branch agencies’ national security information classification programs to ensure these programs are in compliance with the order. When the oversight inspections result in findings of noncompliance with the order, ISOO recommends corrective actions to the agencies. However, according to ISOO, it cannot require agencies to implement the recommended corrective actions. According to ISOO, DOJ is the third largest classifier of information in the executive branch, although this represents about 2 percent of all executive branch classification decisions during fiscal years 2000 through 2004, as the vast majority of classified information originates in the Department of Defense. Nevertheless, DOJ is responsible for a large volume of classified information, some of which if improperly disclosed could harm the national security of the United States. The majority (approximately 98 percent) of classification activity within DOJ occurs at the FBI. DOJ also designates certain information as sensitive but unclassified and prescribes specific requirements for handling and sharing this information to ensure that harm is not caused to governmental, commercial, or privacy interests as a result of disclosing it to the public or persons who do not need such information to perform their jobs. DOJ components in our review use a number of sensitive but unclassified designations, such as Law Enforcement Sensitive, For Official Use Only, and Limited Official Use, to identify information as sensitive but unclassified. Such information at DOJ could include that which is critical to a criminal prosecution. As such, the department would protect this information from inappropriate dissemination by designating it Law Enforcement Sensitive and applying prescribed dissemination and handling procedures that correspond with the designation. Information designated as sensitive but unclassified remains so indefinitely, unless it is reviewed, for example, pursuant to a request under FOIA. That act requires federal agencies to disclose records requested in writing by any person unless one or more of the nine exemptions and three exclusions authorize the agency to withhold the requested information. For example, law enforcement records may be withheld if their release could reasonably be expected to interfere with enforcement proceedings. Within DOJ, the Office of Information Safeguards and Security Oversight, which is part of the Security and Emergency Planning Staff (SEPS), is responsible for developing security policy and administering and overseeing the department’s programs for managing classified and sensitive but unclassified information. This office currently has a total of 13 staff, of which 1 is responsible for policy development and training, and 3 are responsible for program oversight. The remaining 9, among other things, administer the department’s sensitive compartmented information program, reviews information technology security policies developed by the department’s Chief Information Officer, and ensures the development and implementation of departmentwide policies and procedures that govern certain security related activities. Figure 1 shows an excerpt of DOJ’s organizational chart that features the offices responsible for classification management. At the component level, security program managers are responsible for implementing component-specific security activities, such as conducting internal inspections and training employees on their responsibilities in relation to DOJ’s security programs. In total, there are approximately 40 security program managers and alternates, 33 of which conduct these duties on a part-time basis. DOJ shares classified and sensitive but unclassified information with those who have a need to know this information, such as with other law enforcement agencies at all levels of government. One manner in which DOJ shares this information is in response to requests it receives from other federal entities, such as Congress, other executive agencies, and legislative agencies. Although DOJ has completed or partially completed half of ISOO’s 10 recommendations, it has not implemented the other half, primarily because of resource constraints, according to DOJ. This has been a long- standing problem in the program, as our prior work shows, but DOJ reported that it is seeking additional resources from an administrative fund in fiscal year 2007. The ISOO recommendations were to correct, among other things, resource constraints, a lack of sufficient training on how to classify information, and inadequate oversight to ensure its classification management practices were working well. DOJ is not certain that the additional resources will be enough for an effective program. However, it has not assessed the optimum resources it needs or developed a strategy to use available resources most effectively to resolve remaining deficiencies. ISOO made 10 recommendations to DOJ in July 2004 aimed at resolving deficiencies in DOJ’s classification management program, and, at the time of our review, the department had completed or partially addressed half of the recommendations, as table 1 shows. Through SEPS, DOJ had implemented 1 recommendation to require that each of its components file self-inspection reports on its classification management program as a matter of course by including this requirement in its May 2005 revised Security Program Operating Manual. DOJ also built in the requirement that all components submit inspection reports for each fiscal year no later than October 15 of the following fiscal year, but at the time of our review, a SEPS official noted that none of the components had submitted inspection reports for fiscal year 2005. Through SEPS, DOJ has partially implemented 2 other recommendations. First, in response to ISOO’s recommendation that security program managers hold security clearances at levels appropriate for the activity of their office, SEPS reported that all of its component security program managers who handle classified information had security clearances, but SEPS was considering revising the order on security programs and responsibilities to include a requirement for these managers to hold clearances. Second, as of April 2006, SEPS reported that it has taken steps to make refresher training, including how to mark classified documents, available to all staff in all DOJ components. According to DOJ security officials, SEPS has developed a computer-based refresher training module, which is estimated to be available to employees by December 2006. DOJ disagreed with an ISOO recommendation to examine the placement of SEPS within the department’s organizational structure and consider repositioning it to afford it higher visibility and increased stature. DOJ’s Assistant Attorney General for Administration informed ISOO that SEPS’s reporting to the Deputy Assistant Attorney General for Administration does not hinder it from fulfilling its responsibilities, and SEPS’s director has access to the department’s senior leadership whenever needed. However, ISOO still maintains this change is needed. ISOO reported that SEPS lacked sufficient staff resources to effectively implement DOJ’s classification management program and recommended that measures be taken to correct this deficiency. ISOO’s recommendation to DOJ on resources for classification management is consistent with the executive order governing classified information that requires agency heads to commit the resources necessary to effectively implement a national security information program. The order also requires the senior agency official—who is designated by the agency head to direct and administer the agency’s classified national security information program— in part, to establish and maintain programs to (1) train and educate employees on the need to properly classify and mark national security information and prevent unnecessary access to and unauthorized disclosure of classified information; and (2) provide oversight of the program through mechanisms such as ongoing internal inspections. These requirements are also consistent with federal standards for internal control. ISOO reported that SEPS’s lack of resources is particularly significant because of DOJ’s large volume of classification activity—especially when SEPS is compared to security offices at other federal agencies of similar size and structure. DOJ, the third largest classifier of information in the federal government, has 13 full-time positions devoted to information security.