ATT1 - CUI_Guide.pdf

Distribution A: Unlimited Public Release

Controlled Unclassified Information Guide

Program: Environmental Microbes as a BioEngineering Resource (EMBER) Program Manager: Dr. Linda Chrisey

Program Security Officer: Michael Langerman

Date: 06/15/2021 Version: 1

Dr. Linda Chrisey Michael Langerman BTO Program Manager BTO Program Security Officer

Local reproduction of this document is authorized only in its entirety.

ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATAGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE of CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

iii

FOREWORD

1. DESCRIPTION

The EMBER program seeks to leverage the diversity, specificity, and customizability of environmental microbiology to overcome challenges facing supply of rare earth elements (REE) critical to the Department of Defense (DoD). REEs are critical ingredients in components of many DoD systems: e.g., permanent magnets for electric motors, glass colorants and polishing agents, and lasers. The 17-element REE group includes lanthanum (La), cerium (Ce), praseodymium (Pr), neodymium (Nd), promethium (Pm), samarium (Sm), europium (Eu), gadolinium (Gd), terbium (Tb), dysprosium (Dy), holmium (Ho), erbium (Er), thulium (Tm), ytterbium (Yb), lutetium (Lu), yttrium (Y), and scandium (Sc). The United States (U.S.) supply chain for REEs is vulnerable despite the U.S. having adequate domestic REE resources to meet current and projected demands.

This is due to reliance on foreign entities to purify REEs and convert them into manufacturing-ready forms (e.g., REE oxides, salts, and metals). Minimal capability to perform these steps currently exists in the U.S. The EMBER program aims to engineer or adapt microbes, including those from extreme or metal-rich environments, in order to bind and assimilate individual REEs.

This program will address the DoD’s pressing challenge of securing a supply of highly purified REEs from domestic sources.

If successful, EMBER will provide platform technology to enable separation and purification of REEs from any domestic source of REEs, a capability that is currently lacking in the U.S. and is a primary source of supply chain fragility. Domestic ore and phosphate mining companies, as well as those seeking to recycle REE from electronic/magnetic waste, have indicated interest in EMBER’s new approach to REE separation.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. Distribution

Approved for public release. Distribution is unlimited.

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of EMBER information IAW DoDI 5200.48. EMBER information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST). Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in

Executive Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support EMBER. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with EMBER. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of EMBER, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on EMBER as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of EMBER.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at Michael.Langerman@darpa.mil.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at Michael.Langerman@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. EMBER critical information falls under the following CUI indices:

1) Defense

2) Export Control

3) Proprietary Business Information

4) Nuclear

6. CUI Categories

a. Defense: Controlled Technical Information (CTI). This category relates to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information would meet that criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents.

b. Defense: DoD Critical Infrastructure Security Information (DCRIT). Information that, if disclosed, would reveal vulnerabilities in the DoD critical infrastructure and, if exploited, would likely result in the significant disruption, destruction, or damage of or to DoD operations, property, or facilities, including information regarding the securing and safeguarding of explosives, hazardous chemicals, or pipelines, related to critical infrastructure or protected systems owned or operated on behalf of the DoD, including vulnerability assessments prepared by or on behalf of the DoD, explosives safety information (including storage and handling), and other site-specific information on or relating to installation security.

c. Export Control: Export Controlled (EXPT). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information.

d. Proprietary Business Information: General Proprietary Business Information (PROPIN). This category relates to material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements;

trade secrets; product research and development; existing and future product designs and performance specifications.

e. Nuclear: Nuclear Security-Related Information (SRI). This category relates to information that could be useful, or could reasonably be expected to be useful, to a terrorist in a potential attack that does not qualify as Safeguards or classified information, including the exact location and quantities of radioactive material, certain detailed design drawings, information on nearby facilities, emergency planning information, and certain assessments of vulnerability and safety analyses.

7. EXPORT CONTROL RESTRICTED INFORMATION

a. Performers who develop equipment for biomining, which may constitute instruments/tools/machines/devices/etc. intended for sale and/or commercial manufacturing, must adhere to guidance of the Commerce Control List and follow Export Administration Regulations (EAR) that are pertinent to any relevant articles that meet the criteria described in Supplement No. 1 to Part 774 of the EAR.

Depending on specification of equipment being developed:

i. 2B999 Specific processing equipment: h. Mining and drilling equipment, as follows: h.2.

Large earth-moving equipment used in the mining industry; j. Pumps designed for industrial service and for use with an electrical motor of 5 HP or greater.

ii. 2B352 Equipment capable of use in handling biological materials, as follows: b.

Fermenters and components as follows: b.1. Fermenters capable of cultivation of micro-organisms or of live cells for the production of viruses or toxins, without the propagation of aerosols, having a total internal volume of 20 liters or greater; b.2. Components designed for such fermenters, as follows: b.2.c. Process control units capable of simultaneously monitoring and controlling two or more fermentation system parameters (e.g., temperature, pH, nutrients, agitation, dissolved oxygen, air flow, foam control).

c. Performers who isolate and separate radioactive materials (ECCN 0C521), including byproduct materials (discrete source of naturally occurring radioactive material and/or tailings or wastes produced by the extraction or concentration of uranium or thorium) and source materials (ores that contain greater than 0.05 weight % of any combination of uranium and thorium), must adhere to export control protections if sufficient quantities are obtained during the course of the program. As defined in 10 CFR § 110.23 and 75 FR 44072, quantities of ‘by product material’ that exceed 3.7 gigabequerels (GBq) (100 millicuries (mCi)) of alpha activity per device or source require export control.

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for EMBER are listed below; however other exemptions could apply:

1) Exemption 3 – Protects information exempted from release by statute.

2) Exemption 4 – Protects trade secrets and commercial or financial information which could harm the competitive posture or business interests of a company.

9. DISCLOSURE of CUI.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, SID, who is the Foreign Disclosure Officer for

DARPA.

10. CUI PROTECTION REQUIREMENTS

a. EMBER CUI (e.g., Confidential Business Information, CTI, OPSEC) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. CUI may only be processed on Defense Industrial Base (DIB) systems that are compliant with DFARS 252.204-7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the EMBER PSO and PSR at Michael.Langerman@darpa.mil.

b. Data breaches of DIB networks and systems involving EMBER CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

12. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the EMBER effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at Michael.Langerman@darpa.mil.

Element of Information Index Category Reason LDC or Distribution Statement

Remarks

Completed engineered (TA 2) systems that conduct biomining operations and extract REEs, including design of tanks, filtration systems, biomass extraction and purification

Defense;

Export Control;

Critical Infrastructure

CTI;

EXPT;

CRIT

CCL 2B352;

CCL 2B999;

DoDI 5230.24

DFARS 252.204-

Distribution list C

This includes REE biomining workflow details on how to remove/mitigate radioactive or other toxic/hazardous contaminants (if present in source material), concentrate REEs, separate light from heavy REE, and purify individual REEs when being integrated into this system.

Designs, schematics, drawings, and multimedia regarding custom hardware intended for use in EMBER biomining operation systems

Defense;

Critical Infrastructure

CTI;

CRIT

DoDI 5230.24;

DFARS 252.204-

Distribution list C

Identity of accumulated radioisotopes and/or technologically enhanced naturally occurring radioactive materials (TENORM), their radioactivity, and security measures in place to safeguard these materials

Export Control;

Nuclear

EXPT;

SRI;

10 CFR § 110.23;

75 FR 44072;

DoDI 5230.24;

NRC RIS 2005-31,

Revision 1

FEDCON

Element of Information Index Category Reason LDC or Distribution Statement

Remarks

Information regarding source material (e.g., natural and depleted uranium, thorium) and byproduct material (as defined in 10

CFR 110

Appendix L)

Export Control;

Nuclear

EXPT;

SP-SRI

10 CFR 110.8;

NRC RIS 2005-31,

Revision 1

FEDCON

Techno-economic analysis of biomining operations that extract REEs from domestic sources and process them into REE ingredients

Proprietary, Financial

PROPIN DoDI 5200.48

DFARS 252.204-

DoDI 5230.24

FEDCON

Fundamental scientific discoveries of organisms and/or biomolecules that specifically bind and/or modify REEs

N/A N/A N/A N/A N/A

Concentration, identity, and chemical composition of REEs and other materials in REE source materials

N/A N/A N/A N/A N/A

Fundamental synthetic biology tools and genetic engineering discoveries that modify organisms’ interactions with REEs and other elements

Proprietary Business Information

PROPIN 18 USC 1905

15 USC 2055

FEDCON Information of this nature is normally regarded as proprietary information.

Biological and biomolecular pathways that interconvert chemical forms of REEs, e.g. change the bonding of REEs to oxygen/phosphates/nitrates/halides, as well as biological pathways to reduce REEs into metal or metal alloys

Proprietary Business Information

PROPIN 18 USC 1905

15 USC 2055

FEDCON Information of this nature is normally regarded as proprietary information.

Fundamental research into a platform to assay REE association with organisms

N/A N/A N/A N/A N/A