Our friend Steven Aftergood of the Federation of American Scientists noted some apparently good news on his Secrecy News blog last week: the government is at long last moving to rationalize the chaos that has long existed in the handling of information deemed sensitive but unclassified--and yes, they call that "SBU."
More than two years ago, President Bush issued a memo ordering a new policy for such information, often marked "For Official Use Only," or "Limited Distribution." But Aftergood points out that the president's purpose was to promote information sharing among federal agencies, not necessarily to rationalize the system for us outsiders.
The situation has become more absurd through the years as different agencies dreamed up new ways to say "you can't have it!" In testimony last April before the House Homeland Security Subcommittee on Intelligence, Amb. Ted McNamara, Program Manager for the ODNI Information Sharing Environment, testified that without a manageable system for handling SBU, it's impossible for federal agencies to share critical information among themselves, much less with state and local agencies, or the private sector.
McNamara testified that the "lack of a single, rational, standardized, and simplified SBU framework...heightens risk aversion and undermines confidence in the control mechanisms. This leads to both improper handling and unwillingness to share information....This is a national concern because the terrorist threat to the nation requires that many communities of interest, at different levels of government, share information." McNamara called the current situation "unacceptable."
Whereas the system for handling classified information is controlled by both law and regulation, unclassified info has grown haphazardly and is treated differently across federal agencies. McNamara told the committee: "Among the twenty departments and agencies we have surveyed, there are at least 107 unique markings and more than 131 different labeling or handling processes."
Further confusing matters, some agencies use "SSI" to mean "Sensitive Security Information," while EPA uses it to mean "Source Selection Information." And "ECI" can mean either "Enforcement Confidential Information" or "Export Controlled Information." Also, ten different agencies employ the designation "Law Enforcement Sensitive" or "LES," but there is no uniformity of definition or control. "Thus," said McNamara, "an individual can have access to the information in one agency but be denied access to the same information in another." McNamara testified that henceforth what has been called SBU will now be dubbed "Controlled Unclassified Information," or CUI.
Sebastian Sprenger at InsideDefense.com reports that McNamara has sent a report to the White House with his recommendations for the new system, which will reduce the hundred-plus markings to only three. Sprenger writes that McNamara found there are two central criteria for controlling CUI: the amount of safeguarding needed, and the breadth of its dissemination. Safeguarding would be either "standard" or "enhanced," and dissemination would be either "standard" or "specified." The three new markings--for which the White House has yet to select the new names--would correspond to: Standard/Standard, Standard/Specified, and Enhanced/Specified (officials thought that "Enhanced/Standard" doesn't make much sense).
Both Aftergood and Sprenger report optimism that the new system will allow for more public access to government information. In support, Aftergood quoted 2006 testimony from McNamara that "the great majority of the information which is now controlled can be put in a simple unclassified, uncontrolled category, it seems to me." Later in the hearing, McNamara expanded on the need for no more than about six CUI categories: "but then inserting those categories that definitely require under legislation or government-wide regulation, require controls, that they be put in the proper category of control. And that the rest of it I would think would just become unclassified, with no control mechanism." Of course, McNamara's main concern was to simplify the sharing of necessary information among various government actors and their private-sector partners, not to release more information to the public.
We at POGO are crossing all our fingers and toes, but we are concerned that some agency-specific markings will apparently remain, even with the new policy. They include several that pertain to homeland security issues and would otherwise be thought of as information that should be shared: SGI for "Safeguards Information," which relates to nuclear security; PCII for "Protected Critical Infrastructure Information;" SSI for "Sensitive Security Information," used in the transportation sector; and CVI for "Chemical Vulnerability Information."
We are even more concerned that the final word on this policy will come from a White House that has hitherto shown no aptitude or inclination for sharing public information with the public, that has rather than decreasing secrecy, steadily increased it throughout its term. But we will keep those fingers and toes crossed.
-- Beverley Lumpkin