National Security from Unclassified to Classified information
The classification system itself serves a government purpose to protect national security information and is merely a tool to do so. It is not the only system of control for information in government possession as agencies also identify and protect unclassified information related to national security. Such information is labeled in multiple ways and includes many security measures, guard forces schedules, facility security procedures and rules, export controls, special nuclear technology, critical infrastructure information, etc. In short, while classification clearly identifies information requiring protection, there is significant amounts of information not classified but nonetheless protected within the government.
The US has used three levels to denote classified information and in many instances especially today, the lowest level confidential is too restrictive for practical use. Other nations often use additional “classification” levels to denote information that have lower standards for control than what is prescribed by the US. While still technically classified, access to such information may not require a clearance or require any special protections beyond what the US currently uses for many types of controlled unclassified information. In recognition of this, the current US Executive order created a modified handling form of US Confidential information for lesser foreign information to reduce handling and control requirements.
Therefore when considering classification system reform, it would be appropriate to consider the perspective that information related to national security is a continuum of information ranging from unclassified to the highest forms of classified information, all withheld from public release. Many in the public misunderstand that a government decision to control less information as classified does not mean necessarily that more information will be available to the public and in fact could mean that more information will be labeled as controlled unclassified information. It is in this light that the PIDB recommendation to reduce the classification levels from three to two should be considered and in absolute sense whether the change would result in more information released to the public.
The change from three levels to two levels will be expensive. Certain agencies that have used all three levels will have considerable conversion costs in terms of their operations, types of communication channels, and clearances. To counterbalance those costs, the public should be assured that the change in classification levels will result in significantly more government information made public. For other agencies that have only used Top Secret and Secret levels for the vast majority of their information, there will be a strong incentive to leave the levels as named and therefore their classification practices as is.
Given the PIDB goal is to have the government classify less information such that it is releasable to the public, the recommendation have two levels is at best an indirect mechanism. If, in fact, the reduction of three levels to two simply moves classified information into the two new levels (or leaves the information as is) or if the information is no longer classified but still controlled within the government then it would seem the value of the change is greatly diminished. Clearly, serious discussion is needed here on what real costs and real benefits can be achieved and whether this recommendation is the best way for the government to achieve this goal.

In the report cited by Mr. Faga, (report of the 1997 Secrecy Commission) Sen. Daniel Patrick Moynihan said “when everything is classified, nothing is classified.” That is, perhaps, the phenomenon that has led to the kinds of leaks we have recently seen. When information that no reasonable person could claim is classified has been marked as classified, how do holders of that information determine what information is REALLY classified? Nothing excuses leaking information that is marked as classified, but overuse of classification or use where it is not warranted does nothing to help recipients to understand why some information must be protected.

A two-tiered system will be hard to implement and not without costs. But the way all federal employees view secrecy needs to be changed and the only effective way to initiate such change is with a complete revision of the system. For this change to be complete and effective, the Congress absolutely MUST identify funding sufficient to train employees, oversee and manage the new system, and configure all automated systems to facilitate appropriate classification. New tools are also available that can aid employees in making decisions about what information should be classified and more importantly what information should NOT be classified.

With support from Congress, this Administration could make the first fundamental change in classification since its establishment in 1940 by President Roosevelt.

On your second question, I am not sure that moving the current 25-year timeline to 20 would be transformative, though I would support any reduction in this arbitrary timeframe. I think it would be more effective to reduce the lower time limit, currently 10 years, than the upper. We suggested 3 years, but even if only reduced to 5 years I think this could have a transformative effect. If you look at the ISOO report for 2010, the 10-year or less timeframe was used in 74% of the original classification decisions, which seems to show that OCAs are focusing on the lower limit as a default, rather than the upper limit. This is good news. And it may be that OCAs are already using lower than 10 year declassification dates at a high rate, but I would suspect that the majority of these are set at 10 years, simply because that is the lower limit set in the EO. If that lower time period was reduced to 3 or even 5 years, I think we’d see OCAs using these lower numbers as default, or at least thinking more seriously about justifying any time-frame greater than the set lower limit.
I hope this helps.

Could you expand on what process the government needs to put in place to ensure national security information is being shared among necessary parties? How would you tailor the design of these processes to also account for eventually sharing this information with the public, in the form of release? Would implementing metadata standards be enough to structure information for sharing, or are there some other methods that can be employed by agencies when they are creating information?

I wanted to ask your opinion about resource allocation for declassification. Would you be in favor of redirecting some of the funding you propose to piloting a project to test some of the newer technologies available for reviewing electronic records? Do you think the public interest groups and research community are open to the idea of reducing the number of records reviewed for declassification in the upcoming years so that resources can be used to explore new technologies and future innovations?

Lastly, the notion of absolute timelines (25 years max.) was considered “transformative” when enacted by President Clinton in 1995 – would decreasing the maximum time from 25 to 20 years have any meangful effect? Would you conside it “transformative”? What real effect would this have?

In your discussion of compartmentation, could you explain what would comprise the single set of standards that you mention? Specifically, what kinds of formal guidance or specifics need to be in place to ensure that compartmentation is being used appropriately?

In line with my paper, what quick processes can be put in place to allow for the release of classified information as it is in our national insterest?

Our proposal, like yours, pins the problem on the notion of agency “ownership” of information. As you mention, “ownership” is not absolute, as demonstrated by the role of the ISCAP. We would go further and have suggested two options in our draft white paper. What is your opinion of ending agency ownership of historical information and instead requiring detailed guidance and training be established and shared among all agencies?

The proposed documentary history would have to have to be prepared by a team of professional historians with subject matter expertise as well as unrestricted access to classified agency collections. This would be a challenging historical project and not a records management exercise. So it probably would need to be housed at an existing agency historical office or at a new one established for this purpose.

The State Department Historian’s Office is accustomed to interacting with other agencies in the preparation of the Foreign Relations of the United States series and has part of the needed “infrastructure,” but as I mentioned above its process currently leaves much to be desired. The State Department may need to get the FRUS series in order before taking on additional burdens of this sort.

CIA and NSA both have substantive history programs, but they seem to be hopelessly subordinated to the existing classification regime — which is what we are seeking to transform. I am not sure that they are capable of challenging and overcoming the legacy classification practices and procedures to the degree that is necessary.

The NDC is of course focused on the declassification mission, but I don’t think it has a resident historical staff. Nor does it have ready access to classified agency records that are 25 years old or less.

Another scenario would be to direct each agency to generate its own declassified documentary history. This would be “easier” to implement in some respects, but without a centralized, government-wide focus that is outside of any individual agency’s control, I think that the transformative potential of the idea would be lost.

I don’t know what the capabilities of the Defense Department are in this area.

I think a next step might be to consult with agency historians at ODNI, State, and perhaps CIA and NSA in order to get their reading of the feasibility of this proposal, and their assessment of what authorities and resources would be needed to execute it effectively. The nay-sayers will quickly remove themselves from further consideration, while others may be able to advance the idea with recommendations of their own…

Could you expand on what types of testing and prototyping of the SDC system are taking place right now? Have there been any pilot projects established to test its accuracy against that of an experienced human reviewer? From a risk management perspective, it seems the effectiveness of the system would need to be assured even before cost-effectiveness could be considered.

In your discussion of auditing classifiers, do you see any value in also implementing “safe harbor” protections for classifiers and reviewers who either make a mistake or who report errors of other classifiers? Part of the change you advocate is a change in culture among the agencies, and while many of your points mention consequences for classifiers and the agency, there may also be some merit in considering if agencies’ threshold for acceptable risk. Would it be possible to give classifiers and reviewers some whistleblower-style protection so that they would be more likely to err on the side of openness and either not classify or declassify?

Who would be responsible for writing the declassified documentary history that you are proposing? It seems that a centralized history program would be necessary to ensure that a comprehensive approach is taken. Furthermore, this centralized program would need to have a records management focus to ensure the records needed to complete this history are not only prioritized for declassification, but are identified and preserved in the first place. Would a Center at the IC or at the NDC be an appropriate organization to tackle this job? CIA has a vibrant program, could their mission be expanded, especially given the availability of resources?

I agree that classification officials with the proper authority should reconsider the classification of what is termed here as “historic FRD” pertaining to the overseas locations. However, there is alot more to FRD than that and to sugest an entire category of classified information been done away with is wrong.

While members of the PIDB certainly have impressive credentials and experience, and while employees of the National Security Archives are well respected historians, nothing in these peoples’ background suggests extensive experience in writing technical classification guidance, or work reviewing documents for classification or declassification specifically for RD or FRD; no background in physics or nuclear engineering or time working at a National Lab… People can make comments about what they think RD or FRD is in board terms but can do little more than speculate beyond that – not surprising since it’s classified. Sorry, but I don’t find the paper by Professor Simms to be credible and perhaps the entire discussion goes outside of the PIDB’s mandate.

I believe one of the largest problems with the Federal system is non-standardization. Classification is made individually based upon each agencies terms and definitions. None of which clearly represent the true and clear ‘United States’ standard, but rather a Department of the United States.

1. Define National Security as it pertains to classification, in particular, what is a threat to the United States, i.e. a 16 year old threatening the President, a telephone call of an angry individual stating he wants to kill someone, a cache of explosives found in a sensitive area, a commander realizing he overstepped his bounds.

All of these are current issues with classification, but really, are any of them a true threat to the United States?? Our current system of classification allows all of these instances to be classified.

2. As with every other instance of the Nation, National Security also needs checks and balances. I think the Executive Department should initiate what they believe as National Security Threats, but should require the approval of congress (or at least a subcommittee) before it can be completed. This would prevent harsh actions taken in the heat of the moment and maintain the true idea of threat to the nation. The courts should maintain their deference to interpret when the two disagree, and have the ability to overturn classification needlessly applied.

3. Apply stiff penalties to those who misuse classification for personal use, i.e. to protect an embarrassment. i.e. Remove the protections put in place against law suites of Government Officials in the performance of their duties and statue of limitations protections for personnel found to have violated or misused classifications. A lot of 2nd thoughts will occur if an individual knows they can be personally accountable for violating the law, even 10 years later. Many leaders will establish protections and barriers for short term events of a few years, after which they are protected by the system.

4. Finally, a review to be completed timely, and a sunset for each classification. If it has not been reviewed timely, then the classification expires. There is no need to claim a National Security Interest for 50 years when the event only traverses a few years at most. The American People deserve to see what is going on to prevent crime from overtaking the otherwise honest folks. One section of the Government should not be prevented from looking at classified documents from another section, after all, we all work for the same team. If the Classification truly is needed, then an oversight authority such as the courts should have no reason not to look at it. One agency should NEVER have the power to make these decisions single handedly without another agencies oversignt…expecially if the other agency is related, i.e. CIA/DOD. I disagree that for example OPM could not understand sources protection, but commonly these are used not only to protect sources, but many times to protect unlawfull activity as well (methods).

Thanks and hope I have helped. The protection of the U.S. is a U.S. concern, not a DOD concern, or a State Department Concern, or a CIA concern. The infighting is 90% of the problem. If the classification is only understood by one Department, then it may not be really a National Security issue at all, but a departmental issue.

The recommended audits and independent oversight also sounds good but would prove impractical given the scope of classification. Scores of agencies with millions of employees produce perhaps a billion classified pages a year on electronic systems that reach every inch of the planet. Finding a way to look over everyone’s shoulder and approve her or his decisions would create a giant shadow government larger than the real one.

We need to look at classification seriously and figure out EXACTLY what information should be classified. Getting 3-5 million people to do something different can only be accomplished by throwing out the current rule book and writing a new one. Then train all those people on a new system and at that point oversight may make sense.

http://ijdc.net/index.php/ijdc/article/viewFile/152/215

http://perpos.gtri.gatech.edu/publications/index.htm

http://perpos.gtri.gatech.edu/IE/

http://www.archives.gov/ncast/ncsa/9-a-methodology-for-file-relationship-discovery.pdf

Over the years NARA and its Research Partners have collected empirical evidence related to the effectiveness of NLP, machine learning, information extraction, decision-support sytems, etc that could be used to inform this discussion.

I am especially intriqued by the idea of incorporating tools into the classification process. This could certainly make it easier to declassify records downstream.

Another area for consideration would be the use of visualization tools to isolate the areas where the needles are most likely to be located in the haystack. NARA has sponsored research in this area as well. See for example:

http://www.utexas.edu/features/2011/04/11/tacc_archives/

Great discussion so far.

More fundamentally, we should be urging classifiers to put more thought into their classification decisions, rather than simply classifying by rote (one of the main culprits behind overclassification). How can we simultaneously ask classifiers to be more thoughtful about their decisions while assigning these same decisions to a computer program? To say the least, this would be sending a mixed message.

Relatedly, as Bill Leonard often points out, the classification EO permits the classification of certain information, but doesn’t *require* it. In most cases, there is room for judgment – i.e., for a case-specific determination that broader considerations of policy, strategy, or public interest weigh against classifying certain information even though it means the relevant criteria. To my knowledge, context accumulation technology is not capable of making that type of judgment.

I’m less concerned with applying this technology to declassification efforts. Unlike classification decisions, declassification in many cases *should* be automatic. The inevitable “false negatives” are less problematic, in this context, than “false positives” in the context of classification decisions, because they result in no change to the status quo – and because supplemental human effort in the declassification context would be directed toward catching such omissions.

The Constitution Project (TCP) is an independent, nonprofit organization that promotes and defends constitutional safeguards by bringing together a wide array of individuals who share a common concern about preserving civil liberties. As part of its work, in July 2009, TCP’s bipartisan Liberty and Security Committee – composed of members of law enforcement, legal academics, former government officials, and advocates from across the political spectrum – released a report entitled Reining in Excessive Secrecy: Recommendations for Reform of the Classification and Controlled Unclassified Information Systems. Since the release of this report, which made eighteen specific recommendations for reforming the classification regime, several important strides forward have been made, most notably the issuance of Executive Order 13526 by President Obama. Much remains to be done, however, and TCP is grateful to the Public Interest Declassification Board (PIDB) for its efforts in this regard. As set forth below in more detail, TCP supports many of the features in the White Paper which are consistent with TCP’s own report, and suggests additional measures to be included in the PIDB’s final proposal.

In particular, TCP applauds the PIDB’s recommendation that agencies better employ the presumption against classification. TCP’s Reining in Excessive Secrecy specifically recommends “a presumption in favor of lower level classifications, or declassification, such that decisionmakers resolve doubts by applying the lower classification level or no classification.” As this White Paper notes, unwarranted classification of information threatens national security by preventing the timely exchange of information between government agencies and branches, burdens the system with unnecessary costs of protecting huge stores of data, and fosters public distrust in the government.

TCP also concurs with this White Paper’s recommendation that agencies more robustly employ the provision of the Executive Order that allows for discretionary declassification and include guidance to this effect in their internal policies and procedures. This recommendation reflects our Liberty and Security Committee’s recommendations that the public interest in releasing information should be taken into account whenever classification and declassification determinations are made. Similarly, TCP supports the PIDB’s recommendation that agencies take affirmative steps to reduce the duration of classifications. Both of these recommendations reflect the importance of governmental transparency, particularly when the rationale for secrecy is outweighed by the public interest in the release of the information, or when the need for sequestering the information has passed altogether.

However, despite these laudable goals set forth by PIDB, TCP shares the concerns voiced by other commentators that this White Paper lacks specific and concrete steps that agencies should take in order to meet those goals. For example, TCP’s report recommends that the timeframes for automatic declassification should be decreased, so that automatic declassification is required after 10 years, except for particularly sensitive information requiring a period of up to 25 years. Specifically, our report recommends that the “lower time limit of this automatic declassification range should be decreased from 10 years to 5 years, and the upper limit should be decreased from 25 years to 20 years.” Therefore, we urge the PIDB to expand upon the White Paper’s statement that “agencies should also reduce the duration of classifications,” and provide specific guidance on such shorter timeframes for automatic declassification when it issues its final recommendations.

Similarly, although we commend the White Paper’s citation to the provision of the Executive Order on weighing the public interest in discretionary declassification decisions, we urge the PIDB to strengthen this guidance. TCP’s report includes two specific recommendations on weighing the public interest: that agencies should be required to consider the public interest before information is classified and that the government should adopt a balancing test requiring that the public interest be weighed in making declassification determinations. In addition, while we appreciate the White Paper’s suggestion that congressional action could assist in the accelerated review and possible declassification of records pertaining to significant events or controversial government actions, we note that congressional action is not necessary for this acceleration to occur. Rather, the agencies themselves can and should be required to prioritize for review the records related to these events and actions.

There are also a number of other questions that this White Paper leaves unanswered, where greater guidance could further promote the goals set forth by the PIDB. For example, how should agencies ensure that their employees with classification authority are adequately weighing the public interest in making their classification determinations? What systems and process could be put in place that would facilitate this review? TCP also recommends that each federal agency that classifies information “should periodically conduct a detailed public review of its classification practices” to ensure there are not broad categories of information, or simply too many documents, that are currently being classified that should not be.

In sum, TCP supports the aspirations set forth in this White Paper, but more specific guidance is needed if real progress is to be made. We respectfully urge PIDB to issue more detailed, specific, and robust final recommendations.

But once you leave the fuzzy middle ground between classified and unclassified, the protection of information marked as classified is both legitimate and necessary. Mr. Aftergood has seen the fuzzy area both in terms of material that has been released over government objections and material that has been released after being classified for many years. From that limited point of view it is easy to say that everything is over classified and some arbitrary date should be set when all this stuff is just released. If you are only talking about the information in that middle fuzzy area – I agree. You must take into account the information that would cause legitimate damage and either get people killed or destroy the advantage the US often has politically and militarily. The sweeping statements about over classification can only do harm if they are not tempered with understanding that some information really does require protection from release.

To put this in perspective, classification needs to be done in a surgical way to identify specific information that needs protection for legitimate reasons. That protection is on a scale that may range from a few days to some decades and a very small amount (maybe 1/10th of 1%) that needs protection virtually forever. The tool we’ve been given is not a scalpel, however, its more like a sledge or a fire axe. No matter how we wield this tool, we are destine to do extensive collateral damage. The result is a classification system that appears completely broken when countless documents are protected unnecessarily or necessary protection exceeds the weeks or months that is warranted and goes on for decades.

I agree that we need a classification policy test bed where we can find the right balance using some trial and error. We simply have to gather the right people and work on the real solutions to the problem.

In response, the Archivist tasked the National Declassification Center (NDC) and the Center for Legislative Archives to come up with a plan to review classified Senate committee records more than 25 years old. A plan and a pilot project are in place that will introduce these records into the declassification process in small segments. We look forward to reporting the results of the pilot.

We understand Mr. Aftergood’s concern about the potential impact on NDC resources when more records are added to the process. The other issue we face is the willingness of Executive branch agencies to review congressional records that are not subject to the Presidents’ Executive Order and Memo. Eliminating the backlog at College Park is our top priority. We believe that controlling the flow of records in this process will not significantly impact the mission of the NDC, but we will continue to monitor this and other projects to ensure we meet the goals of the President’s Memoranda.

If implemented in the coming years, Admiral Studeman’s proposal for an integral approach would be a stunning contrast to some agency policies and practices of the recent past and the present. As the late Air Force historian Ed Mark would tell anyone who would listen, his agency has had a disastrous track record when it came to preserve historical decision-making records. For example, he would say that the only record he could find of some Air Force decisions during the 1991 Gulf War was a set of Power Point slides. Even if Air Force historical records preservation practices have improved, Admiral Studeman’s proposals are plainly in order to ensure that progress continues.

Bill Burr and Bob Wampler, The National Security Archive, George Washington University

Action should be initiated with Congress that allows for the treatment of FRD as NSI, but until such time as the AEA is amended, FRD must be treated in accordance with its provisions.

Caveat: I am not the “official” voice of DoD on this issue and regardless of my personal feelings, I am professionally required to abide by not only the AEA, but also DoD policy.

A second issue with this piece is a running difference of opinion between government and historians about who should determine what is historically significant. Even if agencies have historians on staff who continually monitor records to identify significant collections, we will face criticism from academic historians who want to decide for themselves what records are significant. The bonanza (and failure) of the 25 year declassification program was the notion of declassifying everything regardless of topic and the failure was that hundreds of millions of pages of junk was declassified and hundreds of millions of pages of potentially significant historic records remain in the “backlog.” For the money that was spent on the junk historians could have had a gold mine. But even then they would have argued that the junk we left behind was concealing a treasure.

Maybe the solid ground between the positions of Messrs Studeman and Aftergood is in developing robust metadata that will help us identify both the historically significant records and the most sensitive documents that actually do need to be reviewed. If we could focus our limited effort on only the documents that need to be reviewed, the process could be efficient and reasonable. With a metadata approach we would release the wheat with the chaff and let the historians decide which is which.

The bulleted questions and propositions at the end are precisely what the PIDB needs to recommend to our leaders. The PIDB has been given a grand bully pulpit and this BLOG should help illustrate to them that many of the ideas here are showing a way toward real change.

We absolutely need sweeping change in our classification system. We must get out a clean sheet of paper and design classification for the 21st century. Reducing the levels, expanding access, using automation to help rather than hinder access, and taking full advantage of metadata is only a start.

Its not a small task and without robust Congressional support it will never happen. With talk of reducing the deficit (which means cuts in government spending), the challenge is even greater. JD has certainly characterized the problem correctly. We need both policy changes and resources. A single comprehensive metadata standard is complex and will require reconfiguration of literally 1000s of systems; centralized management of identities and access profiles requires a large staff, a highly secure system, and a means to manage changes to profiles of millions of people in real time (we can’t have users waiting for 3 months for their profile to be changed). To get this done the effort will have to be legislatively mandated and funded for success.

Mr. Faga and other members of the PIDB, you’ve got a tough row to hoe to get this done. You certainly have my support.

To illustrate the problem I would point to the following three cases:

* Because of failures to declassify half-century old records, the State Department’s Foreign Relations of the United States (FRUS) series has still not produced its documentary history of U.S. foreign policy concerning the 1953 covert action in Iran, despite a statutory requirement that it do so.

* Another FRUS volume on covert action in Chile in 1973 is likewise stalled.

* This week the National Security Archive found it necessary to file a lawsuit against the CIA in an effort to gain access to a classified CIA history of the 1961 Bay of Pigs invasion which the Agency has refused to release, a half-century after the fact.

The PIDB proposal would not ameliorate these and numerous similar failures. In each of these cases, the subject matter has already been “prioritized” — its historical importance is not in question. Furthermore, the records requiring declassification have already been identified. So improved records management and prioritization of historical issues would be of no help. There is a deeper dysfunction that needs to be fixed.

I would suggest an amended proposal along the following lines.

When an agency fails to declassify records on a topic of significant historical importance in a timely manner, the subject records shall be removed from the custody and control of the agency and transferred to a (new) Historical Records Declassification Board, composed of individuals with relevant subject matter expertise. The Board should have authorities comparable to those of the Assassination Records Review Board, and should operate with a similar presumption of disclosure.

Of course, this thumbnail suggestion leaves many questions open, such as: What qualifies as significant historical importance? What is a timely manner? Who should be on the Board? etc.

But the important point, which also underlies the PIDB proposal, is that there is a profound national interest in maintaining an accurate and reliable historical record. This national interest must take precedence over any agency’s interests or preferences. And when an agency fails to fulfill its declassification responsibilities for whatever reason — incompetence, bad faith, or something else — then those responsibilities must be taken over by another entity that will fulfill them.