Security Classification of Information: Table of ContentsOn to Chapter Five.
INTRODUCTION Chapter 4.
CAN THE INFORMATION BE CONTROLLED BY THE GOVERNMENT?Information must be under U.S. Government control before classification of that information by that government is anything other than a relatively ineffective action. Government control is the second major requirement that must be met before information can be classified (see Chapter 3 for identification of the other major requirements).
Determining whether information is under governmental control requires that three major questions be answered. First, is the information subject to governmental control when that information is within the United States? Does the government have the power to control the information, either through governmental ownership, contractual relations, or by a statute? If the government cannot control information that is under consideration for classification, then it is generally futile to classify that information. Second, do the government's adversaries already have the information? Protecting information already known to adversaries is a wasted effort.* Third, can the government's adversaries readily obtain the information by their own, independent, nonespionage efforts? If adversaries can easily obtain the information, then it is usually not cost effective to classify it. Considerations in determining the answers to these three major questions are described in the following subsections of this chapter.
* Under certain circumstances, even if the information is known to some of our adversaries, it may still be advantageous to our national security to keep the information from our other adversaries.
In the first section, factors that determine whether information can be controlled by the government are discussed. Some of those factors are similar to those discussed in Appendix A concerning the general availability of information alleged to be a trade secret.In the last two sections of this chapter are discussions of whether adversaries already know or can readily obtain the information under consideration for classification. Determining whether adversaries already know or can readily obtain the information that a government desires to protect is an especially troublesome problem in determining whether to classify scientific or technical information of national security significance. The last two sections of this chapter will therefore focus mainly on scientific or technical information.
DOES THE GOVERNMENT HAVE THE POWER
TO CONTROL THE INFORMATION?EO 12356 states that only information that is "owned by, produced by or for, or is under the control of the United States Government" can be classified.*, 1 If information cannot be controlled by the government, classifying that information will not stop its dissemination. For example, published information cannot be controlled by the government. Outside views of a facility (views from a vantage point accessible to the public) cannot be classified.
* Note that the Atomic Energy Act gives the government the power to control atomic energy information that is within the United States, even if someone else owns that information. Atomic energy information is "born classified" [Atomic Energy Act of 1954, 68 Stat. 919; 42 U.S.C. §§2011–2296].
Information can be controlled by the government if the government owns it or can exert some legal control over it or its owner (e.g., through a contractual relationship or by a statute such as the Invention Secrecy Act of 19512). Most information potentially classifiable as NSI is generated by or for the government and is therefore under governmental control when originated (e.g., military and diplomatic information).++ This was also true of atomic energy information (Restricted Data) during the Manhattan Project and the early years of the Atomic Energy Commission. Most of that information was generated in government facilities or under contract to the government and therefore was under governmental control when it was generated. The "born classified" concept did not cause major problems at that time.
DoD provided the following guidance with respect to classification of nongovernment research and development information:
A product of nongovernment research and development that does not incorporate or reveal classified information to which the producer or developer was given prior access may not be classified until and unless the government acquires a proprietary interest in the product. This prohibition does not affect the provisions of the Patent Secrecy Act of 1952.3In any event, it should be relatively straightforward to determine whether information within the United States is or can be placed under governmental control.
Some information that the government classifies is not totally under governmental control. That information may be under governmental control inside the United States but not under governmental control outside the country. Examples include foreign government information (also controlled by the providing government) and information about foreign relations activities (to the extent that it is known by other nations participating in those activities). Another example of information not subject to total control by the government is scientific or technical information. Scientific "secrets" can be discovered independently by others. Even though the government may control this scientific or technical information when it is discovered or created within the United States, other countries may independently discover the same or similar information by their own scientific and technical efforts.++
++ This situation, where the government does not totally control certain information but nevertheless classifies that information, has its analogy in trade secret law (discussed in Appendix A). The same or similar trade secrets may be independently discovered or held by more than one company and each will be entitled to protection of their respective trade secrets. All of those companies use their best efforts to keep those trade secrets from each other and from those who do not possess the trade secrets.
Some information not totally under government control may be controlled outside the United States by agreements with other nations. For example, shortly after World War II, the United States, Great Britain, and Canada agreed to similarly classify the atomic energy information produced by their joint wartime efforts. Subsequently, those countries have generally maintained mutually consistent atomic energy classification guidance on those matters. Another example of this type of classification agreement was instituted in 1960 when the United States, Great Britain, the Netherlands, and West Germany informally agreed to control information on isotope separation by the gas centrifuge process. Agreements were even reached with the Union of Soviet Socialist Republics (U.S.S.R.) (and presumably will be reached with its successors) and other nations to control certain information and materials relative to uranium isotope enrichment technologies and other technologies used to develop nuclear weapons. The objective of those agreements is to prevent countries that do not now have nuclear weapons from developing those weapons, or at least to delay the development of such weapons in those countries. Therefore, even information not totally under government control may be effectively kept from third parties by explicit or implicit agreements between the United States and other countries.4
DO ADVERSARIES ALREADY KNOW THE INFORMATION?
Classifying and subsequently protecting information that is already known to adversaries is usually a waste of time and money.* DOE considers the "extent to which the information has been published, publicized, or otherwise disseminated" as a major factor when evaluating atomic energy information for declassification.+, 5
+ In certain circumstances it might be desirable to not publish our information, even if the adversary has published comparable information, and thereby not confirm the accuracy of the adversary's information. There might be an advantage to having the adversary be uncertain about the accuracy of his information (see infra in the next subsection). In other situations, even though an adversary may know certain information, we should not publish the information if its association with a program could reveal a use for the information that has not yet been discovered by the adversary.
With respect to declassifying information on nuclear reactors, the Atomic Energy Commission's Director of Classification, J. G. Beckerley, stated in 1953 that:+ This was one of the classification guidelines for preparation of the Manhattan Project's Smyth Report, where one requirement for release of information was "that it is already known generally by competent scientists. . . ." [V. C. Jones, "Manhattan: The Army and the Atomic Bomb," United States Army in World War II, Special Studies, Center of Military History, United States Army, Washington, D.C., 1985, pp. 558–559, quoting from a May 21, 1945, letter from General L. R. Groves to H. D. Smyth].
DoD classification guidance also requires that the extent of an adversary's knowledge be considered:As other nations develop nuclear reactors and publish data thereon, it is pointless to withhold from publication similar data developed in this country.6
Classification requires consideration of the information available from intelligence sources concerning the extent to which the same or similar information is known or is available to others. . . . The state-of-the-art in other nations may often be a vital consideration.7Therefore, in making classification decisions, the classifier must determine whether the information under consideration for classification is already available to an adversary.Determining whether an adversary already knows the information requires (1) a knowledge of the published information available to an adversary, (2) a knowledge of the unpublished and unclassified information to which the adversary might have access, and (3) intelligence information concerning information discovered and classified by an adversary.
Published information includes information that is generally available, whether or not it has actually been published in a document.* Outside views of a facility are "published" and therefore cannot be classified. Destinations of shipments from a facility can be observed by the public and therefore cannot be classified. When a weapons system is deployed in the field, or tested in the open, its visible features should no longer be classified.+ Classification principles in this area are very similar to trade secret law rules (see Appendix A). To paraphrase a court's statement in a trade secret case, that which is readily visible and ascertainable cannot be classified [constitute a trade secret].8
* "Publish" means to declare publicly, make generally known, disclose, circulate, to impart or acknowledge to one or more persons, to proclaim officially [Webster's Third New International Dictionary of the English Language, Unabridged, Merriam-Webster, Inc., Springfield, Mass., 1986].
Determining whether scientific or technical information is publicly available requires advice from an expert who has state-of-the-art knowledge in the area of interest.++ That expert should know all pertinent published information about the matter considered for classification. The expert should also know about the as-yet-unpublished information that is disseminated through personal communications between those who are at the forefront of their fields. This is particularly important with respect to scientific and technical information because there is usually a delay of many months between the time that research results are obtained and communicated informally and the time that they are published in the literature. Many more months usually elapse before those results are summarized or otherwise identified in abstracting services' publications or in computer-searchable data bases. This unpublished information is generally just as available to an adversary's experts as to our experts, since scientific and technical information is communicated by many informal methods. Consequently, an expert's advice should be sought to help determine whether certain unpublished information is either widely known or is not widely known but soon will be published or otherwise widely disseminated.+ An example of what should not occur involved the classified external configuration of a nuclear weapon. When deployed, the weapon was externally carried on an airplane. In the field, after attaching the weapon to an airplane behind a security screen, the screen would be removed and the airplane would taxi away, thereby revealing the "classified" external configuration of the weapon. Eventually, of course, the external configuration of that weapon was declassified [J. A. Griffin, "ERDA—A New Structure," J. Natl. Class. Mgmt. Soc., 11, 14–29 (1975), pp. 14–15].
++ Reasonable classification determinations cannot be made in the scientific and technical field without analysis of what has been accomplished, and what is being attempted and by whom" [U.S. Department of Defense, Department of Defense Handbook for Writing Security Classification Guidance, DoD 5200.1-H, Sect. 3.2, p. 3-1, March 1986]. See also DoD 5120.34-H, Writing and Applying Classification Guidance, U.S. Department of Defense, Enclosure 1, Step 2, July 1968.
Another factor with respect to the availability of the information under consideration for classification is that this information could already be known to an adversary through his own unpublished efforts which have been kept out of normal communications channels. As mentioned above, a U.S. expert in the technical field may know, through informal communications, about recent unpublished results discovered or developed by an adversary. However, if the information concerns an area of recognized importance to a nation's security, then an adversary's recent results will probably be classified by that country and will not be known to a U.S. expert. Therefore, assistance from intelligence agencies must be obtained to try to determine whether the adversary may know, but has not yet disseminated, the information. *, 9* "Classification requires consideration of the information available from intelligence sources concerning the extent to which the same or similar information is known or is available to others" [U.S. Department of Defense, Information Security Program Regulation, DoD 5200.1-R, Chap. II, §2-208, June 1986].
Some scientific or technical information of national security significance may be publicly available through its use in commercial products ("dual use" technology). In recent years some advanced microelectronics technologies were used in commercial products before the government selected them for military applications.10 In those instances, by the time the advanced technology was selected for military application, it was too late for classification to be of much help in preventing the dissemination of that technology. (However, the specific application of the technology to a weapon system could be classified.)A complication with respect to determining whether adversaries already know certain information arises when that information has been compromised by an unauthorized disclosure.+, ++ A question to be answered is whether the unauthorized disclosure actually resulted in the information getting to the adversary. Information may remain classified even when there has been an unauthorized disclosure if the disclosure was only an isolated instance that did not receive widespread dissemination and therefore probably did not reach the adversary.** It may even be possible to recall all documents containing the unauthorized disclosure to eliminate the possibility of further transfer of the information via those documents.+++ Related to this matter is the DOE policy not to comment on (i.e., neither confirm, deny, nor expand upon) statements in the open literature on classified subjects. Such comments could add credibility to speculative information. It is also DOE policy not to permit use of obscurely published or not fully documented publications as a basis for releasing confirmatory data in otherwise classified areas of research and development.
+ This is a consideration in DOE declassification decisions.
A similar situation occurs when unclassified information has been disseminated, by proper authority, within the United States (but not published) but then, later, it appears desirable to classify that information. Expert advice should be obtained concerning the extent of possible foreign knowledge of that unpublished information before the classification decision is made.++ One of the goals of the DoD classification management program, established in 1963, was to decide what to do about the classification of information when that classified information became "a part of the public domain, either through authorized official action or through disclosures not bearing the stamp of official approval" [W. Skallerup, "Panel—The Executive Views Classification Management," J. Natl. Class. Mgmt. Soc., 1(2, 3, 4), 68–72 (1965), pp. 69–70].
** The Chicago Tribune's 1942 account of the Battle of Midway in the Pacific Ocean in World War II contained classified information that indirectly revealed that the United States had broken the Japanese naval code. U.S. authorities were very worried that the Japanese would read this account, deduce that the United States had broken their naval code, and change that code, thereby eliminating a U.S. advantage. Fortunately, the Japanese did not become aware of this isolated unauthorized disclosure, and the United States continued to be able to read the Japanese code [D. Kahn, The Codebreakers/The Story of Secret Writing, MacMillan Publishing Co., Inc., New York, 1967, pp. 602–604)].
+++ Executive Order 12356 authorizes, under certain circumstances, reclassification of previously declassified information [§1.6(c)]. The Information Security Oversight Office procedures for implementing EO 12356 state that before reclassifying information, the following factors should be considered: the elapsed time following disclosure, the nature and extent of disclosure, the ability to bring the fact of reclassification to the attention of persons to whom the information was disclosed, the ability to prevent further disclosure, and the ability to retrieve the information voluntarily from persons not authorized access to that information in its reclassified state [32 CFR Part 2001.6].
Table 4.1 summarizes what classifiers need to know about the dissemination of know ledge in a scientific or technical field before they can make good classification decisions concerning information in that field.
CAN ADVERSARIES READILY OBTAIN THE INFORMATION?
Classifiers must consider whether specific information under consideration for classification can readily* be deduced from theory, minor experimentation, or from fragmentary information already publicly available. + "There is no point in classifying information easily deducible from the laws of physics . . . ." 11 If adversaries can readily obtain the specific information through their own straightforward, nonespionage efforts, then it may not be cost effective to classify that information. In those situations, the adverse effects that classification will have in slowing our development of a new technology may outweigh the benefits of imposing slight delays on our adversaries.
* "Readily," as used here, means that the information could be obtained with relatively little effort (e.g., about a person-year or less). Considerations with respect to major expenditures of effort to get the information are discussed in the next chapter.
Readily obtainable information includes information that can be deduced or derived from known physical principles and information already in the public domain. It is information that follows logically from known principles and available information. Assistance from experts in the technology is needed to determine if the information can readily be deduced or estimated. If estimates can readily be made, then a further consideration is whether it is important to the adversary that these estimates are confirmed.++ Readily obtainable information also includes scientific or technical information that can be obtained with minor experimental effort. The "extent to which the information can be duplicated through simple calculations and experiments" has been used by DOE when evaluating atomic energy information for declassification. 12+ The ease or difficulty with which information could properly be acquired by others is a factor in determining whether that information is a trade secret (see Appendix A).
++ There may be advantages to having an adversary be uncertain about the accuracy of his or her information. Those advantages were recognized by a U.S. Circuit Court in deciding whether the government (i.e., the Central Intelligence Agency) should be compelled to reveal information about an intelligence activity under a Freedom of Information Act request. That court stated that "there may be some advantage in leaving the Soviet intelligence agencies some lingering doubts whether some other purpose motivated the project" [Military Audit Project v. Casey, 656 F.2d 724, pp. 744–745 (D.C. Cir. 1981)].
Reverse engineering is another procedure that can be used to deduce or estimate scientific or technical information. Reverse engineering, the process of examining a product to determine how it was made, is mentioned in the appendix on trade secrets (Appendix A). If the information under consideration for classification is embodied in a product that is available to an adversary, then expert advice is needed as to whether that information can be reverse-engineered from that product.It may not be cost effective, in certain fields, to classify scientific or technical information even if that information is somewhat more than a normal evolutionary advance or more than a straightforward accumulation of experimental data. In some fields, certain innovations become somewhat inevitable as knowledge is accumulated and specific national needs direct attention to the solution of particular problems. 13 Thus, certain scientific or technical innovations may seem classifiable but they may shortly be discovered in other countries.
Table 4.2 summarizes the information control criteria that must be evaluated before it can be determined whether the information under consideration for classification can be controlled to the extent required for meaningful classification of information.
Table 4.2. Information control criteria to use when determining whether
information under consideration for classification
can be controlled by the government
Criterion Number Information control criteria (descriptive questions) Does the government have the power to control the information? ICC1 Has the information been published? What is the published state of the art for the information in the United States and in other countries? ICC2 Is the information obtainable by viewing from a vantage point accessible to the public? ICC3 Does the U.S. Government have the power to control the information within the United States by governmental ownership, by contractual relations, or by statute? ICC4 If the information is also known to some other nations, will those other nations control that information? Do adversaries already know the information? ICC1 Has the information been published? What is the published state of the art for the information in the United States and in other countries? ICC5 What is the unpublished, unclassified state of the art for the information in the United States and in other countries. ICC6 What is the extent of foreign knowledge of the unpublished, unclassified state of the art in the United States? ICC7 What is the classified state of the art in the United States and in other countries? ICC8 To what extent has the information been revealed by its use in commercially available products ("dual use" information)? ICC9 To what extent has the information been compromised by unauthorized disclosure? Can adversaries readily obtain the information? ICC10 To what extent can the information be obtained by other nations through simple theoretical calculations or minor experimentation? ICC11 To what extent can the information be revealed by reverse engineering of unclassified materials? Miscellaneous ICC12 If the information is a scientific or technical "innovation," is it expected that others will shortly make the same discovery?REFERENCES
1. Executive Order 12356, Fed. Reg., 47, 14874 (Apr. 6, 1982), Preamble, §1.1, §6.1(b), §6.1(c).
2.Invention Secrecy Act of 1951, 66 Stat. 3 (Feb. 1, 1952).
3.U.S. Department of Defense, Information Security Program Regulation, DoD 5200.1-R, Chap. II, §2-204.c, June 1986. Hereafter cited as "DoD 5200.1-R." (See also DoD 5200.1-R, Chap. II, §7.)
4.A. S. Fisher, "International Aspects of Classification Management," J. Natl. Class. Mgmt. Soc., 1(2, 3, 4), 84–98 (1965).
5.U.S. Department of Energy, Washington, D.C., internal document, 1987.
6.J. G. Beckerley, Director of Classification, Atomic Energy Commission, in Atomic Power Development and Private Enterprise, Hearings Before the Joint Committee on Atomic Energy, Congress of the United States, 83rd Cong., 1st Sess., on Atomic Power Development and Private Enterprise, June and July 1953, U.S. Govt. Printing Office, June 24, 25, and 29; July 1, 6, 9, 13, 15, 16, 20, 22, 23, 27, and 31, 1953, p. 36.
7. DoD 5200.1-R, §2-208.
8.Paraphrased from Interox America v. PPG Industries, Inc., 736 F.2d 194, 201 (5th Cir., 1984).
9.G. MacLain, "Panel—Government Classification Management Policies and Programs," J. Natl. Class. Mgmt. Soc., 2, 69–75 (1966), p. 71.
10.Panel on the Impact of National Security Controls on International Technology Transfer, Balancing the National Interest: U.S. National Security Export Controls and Global Economic Competition, National Academy Press, Washington, D.C., 1987, p. 56.
11.A. P. Stringer, "Classification Management in the United Kingdom," J. Natl. Class. Mgmt. Soc., 23, 38–43 (1987), p. 40.
12. (a) Smyth Report guidelines, 1945. See A. S. Quist, "Declassification of Atomic Energy Information," p. 64 in Security Classification of Information, Volume 1. Introduction, History, and Adverse Impacts, K/CG-1077/V1, Martin Marietta Energy Systems, Inc., Oak Ridge, Tenn., Chap. 5. (b) Tolman Committee criterion, 1945. See A. S. Quist, pp. 65–67. (c) U.S. Department of Energy, Washington, D.C., internal document, 1987.
13.R. K. Merton, The Sociology of Science, Univ. of Chicago Press, Chicago, 1973, p. 213, citing the following study, which reported on independently duplicated scientific discoveries and technological innovations: W. F. Ogburn and D. Thomas, "Are Inventions Inevitable? A Note on Social Evolution," Political Science Quarterly, 37, 83–98 (1922).