Attachment_1_-_Tellus_CUI_Guide_Final.pdf

Controlled Unclassified Information Guide

Program: Tellus Program Manager: Dr. Linda Chrisey

Program Security Officer: Jesse Watkins

Date: 12 April 2023 Version: 1

Dr. Linda Chrisey Jesse Watkins BTO Program Manager BTO Program Security Officer

Local reproduction of this document is authorized only in its entirety.

Table of Contents

FOREWORD

DESCRIPTION

AUTHORITY

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. OPERATIONS SECURITY (OPSEC)

6. CUI Indices and Categories

a. Defense:

b. Export Control:

c. Intelligence:

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE of CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

12. STIMULI MICROBES ARE ENGINEERED TO DETECT WHICH WILL

RESULT IN CONTROLLED TECHNICAL INFORMATION (CTI) FOR TELLUS

PROGRAM

13. DEFINITIONS

14. ACRONYMS

15. INFORMATION PROTECTION GUIDANCE CHART

TABLE 1 CUI INFORMATION PROTECTION GUIDANCE CHART

FOREWORD

DESCRIPTION

Tellus will explore the development of a platform Methodology for the rapid and modular design of microbe-based sensing systems to include tailoring of input stimuli and output signals, biologically-encoded signal processing, and response times. The microbial devices that are developed must be able to transduce detected stimuli into a variety of output signals (e.g., luminescence, fluorescence, colorimetric changes, chemicals, electric current, mechanical actuation) that are measurable by conventional ‘receiver’ devices (e.g., optoelectronic, photonic, imaging, electrode). Stimuli/output signal types will include both chemical and physical, with emphasis on sensor functionality across many different environments and conditions. As remote environmental monitoring for existing and emerging threats, pollutants or changing conditions is an area of DoD/national security interest, microbial sensing systems that are capable of detecting stimuli and/or relaying output signals at a distance and can operate unattended for long durations are desired. Tellus is a 2.5-year program focused on developing a Methodology that enables rapid design, building and testing of microbial sense-and-respond devices for environmental monitoring.

AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

1. PURPOSE

The purpose of this CUI guide is to ensure the protection of Tellus information IAW DoDI 5200.48. Tellus information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST).

Sensitive information does not include information in the public domain.

This guide is not for classified national security information as defined in Executive Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and performers who support Tellus. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with Tellus. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of Tellus, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on Tellus as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of Tellus.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA BTO. All inquiries concerning content, interpretations, and clarification of this document should be addressed to BTO PSO at BTO_Security@darpa.mil.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at BTO_Security@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

6. CUI Indices and Categories

a. Defense:

i. Controlled Technical Information (CTI): Technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

b. Export Control:

i. Export Control (EXPT): Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives.

ii. Export Controlled Research (EXPTR): Related to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions.

c. Intelligence:

i. Operational Security (OPSEC): This category relates to critical information determined to give evidence of the planning and execution of sensitive (frequently classified) government activities after going through a formal systematic vetting process in accordance with National Security Decision Directive Number 298. This process identifies unclassified information that must be protected. It almost always results from an agency’s official OPSEC program, or is otherwise commonly approved for use by the CUI Senior Agency Official.

7. EXPORT CONTROL RESTRICTED INFORMATION

Performers who develop devices/tools intended for commercial applications, must adhere to guidance of the U.S. Munition List (USML), Commerce Control List (CCL), and follow Export Administration Regulations (EAR) that are pertinent to any relevant articles that meet the criteria described in Part 774 of the EAR and 87 FR 16422 https://www.federalregister.gov/citation/87-FR-16422:

https://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear and eCFR :: 22 Part 121 The United States Munitions List https://www.ecfr.gov/current/title-22/chapter- I/subchapter-M/part-121

Export controlled restrictions for Tellus CTI based on specification of Tellus device being developed are listed below:

a. USML Category XIV Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment (f) (ii) Any equipment “specially designed” for testing the articles controlled in paragraphs (a), (b), (c), (e), or (f)(4) of this category and developed under a Department of Defense contract or other funding authorization. Any equipment, containing reagents, algorithms, coefficients, software, libraries, spectral databases, or alarm set point levels developed under a Department of Defense contract or other funding authorization, for the detection, identification, warning, or monitoring of:

(i) Articles controlled in paragraphs (a) or (b) of this category; or (ii) Chemical agents or biological agents specified in the Department of Defense contract or other funding authorization.

b. USML Category IV - Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines (c) Apparatus and devices specially designed for the handling, control, activation, monitoring, detection, protection, discharge, or detonation of the articles enumerated in paragraphs (a) and (b) of this category (MT for those systems enumerated in paragraphs (a)(1), (a)(2), and (b)(1) of this category).

c. ECCN: 1A004 Protective and detection equipment and “components”, not “specially designed” for military use, as follows (see List of Items Controlled). c. Detection systems, “specially designed” or modified for detection or identification of any of the following, and “specially designed” “components” therefore: c.2. ‘Radioactive materials’; or c.3. Chemical warfare (CW) agents; d. Electronic equipment designed for automatically detecting or identifying the presence of “explosives” (as listed in the annex at the end of Category 1) residues and utilizing ‘trace detection’ techniques (e.g., surface acoustic wave, ion mobility spectrometry, differential mobility spectrometry, mass spectrometry).

d. ECCN: 1A995 Protective and detection equipment not “specially designed” for military use and not controlled by ECCN 1A004 or ECCN 2B351, as follows, and “parts” and

“components” not “specially designed” for military use and not controlled by ECCN 1A004 or ECCN 2B351 therefor. a. Personal radiation monitoring dosimeters.

e. ECCN: 1C607 Tear Gases, Riot Control Agents and materials for the detection and decontamination of chemical warfare agents (see List of Items Controlled).

f. ECCN: 2B351 Toxic gas monitors and monitoring systems, and their dedicated detecting “parts” and “components” (i.e., detectors, sensor devices, and replaceable sensor cartridges), as follows, except those systems and detectors controlled by ECCN 1A004.c.

g. ECCN: 4A004 Computers as follows (see List of Items Controlled) and “specially designed” related equipment, “electronic assemblies” and “components” therefor. 2.

‘Neural computers’ are computational devices designed or modified to mimic the behavior of a neuron or a collection of neurons, i.e., computational devices which are distinguished by their hardware capability to modulate the weights and numbers of the interconnections of a multiplicity of computational components based on previous data.

3. ‘Optical computers’ are computers designed or modified to use light to represent data and whose computational logic elements are based on directly coupled optical devices.

h. ECCN: 6A006 “Magnetometers”, “magnetic gradiometers”, “intrinsic magnetic gradiometers”, underwater electric field sensors, “compensation systems”, and “specially designed” “components” therefor, as follows:

i. Underwater electromagnetic receivers incorporating magnetic field sensors specified by 6A006.a or underwater electric field sensors specified by 6A006.b (see CATEGORY 6 - SENSORS AND LASERS Supplement No. 1 to Part 774 for additional details).

i. ECCN: 6A996 “Magnetometers” not controlled by ECCN 6A006, “Superconductive” electromagnetic sensors, and “specially designed” “components” therefor, as follows (see List of Items Controlled). a. “Magnetometers”, n.e.s., having a ‘sensitivity’ lower (better) than 1.0 nT (rms) per square root Hz.

j. ECCN: EAR99 Items subject to the EAR that are not elsewhere specified in this CCL Category or in any other category in the CCL are designated by the number EAR99.

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for Tellus are listed below; however other exemptions could apply:

Exemption 3 – Protects information exempted from release by statute.

Exemption 4 – Protects trade secrets and commercial or financial information which could harm the competitive posture or business interests of a company.

9. DISCLOSURE of CUI

Public Disclosure: Information generated during the Tellus program that does not clearly identify as “CUI” (as described in Sections 6, 7 , 12 or Table 1) may still need to undergo review prior to public release DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29;

Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

FOIA Requests: All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

Proprietary Information (PROPIN): Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

Foreign Disclosure: Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, Security and Intelligence Directorate (SID), who is the Foreign Disclosure Officer (FDO) for DARPA.

10. CUI PROTECTION REQUIREMENTS

Tellus CUI information (e.g. PROPIN, CTI, OPSEC) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

CUI may only be processed on Defense Industrial Base (DIB) systems that are compliant with DFARS 252.204-7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the Tellus PSO at BTO_Security@darpa.mil.

Data breaches of DIB networks and systems involving Tellus CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

12. STIMULI MICROBES ARE ENGINEERED TO DETECT WHICH WILL

RESULT IN CONTROLLED TECHNICAL INFORMATION (CTI) FOR TELLUS

PROGRAM:

a. Chemical compounds agents banned by international treaty https://www.cwc.gov/cwc_treaty_chemicals_schedules.html

b. Articles controlled in paragraph (a), (b) and (c) of USML Category XIV

(https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-121)- Toxicological Agents, Including Chemical Agents and Associated Equipment to include:

a. Precursor chemicals used in the creation of the items listed

b. Chemicals or by-products generated during the manufacturing process

c. Simulants for the listed chemicals

c. Chemical listed as controlled substance by the Drug Enforcement Administration or

Department of Justice. A list of substances can be found here:

https://www.ecfr.gov/current/title-21/chapter-II/part-1308?toc=1

d. Riot control agents listed under ECCN 1C607 to include:

i. Precursor chemicals used in the creation of the items listed.

ii. Chemicals or by-products generated during the manufacturing process.

iii. Simulants for the listed substances.

e. The general military equipment listed under USML Category IV paragraphs (a) or

(b) explosives listed in ANNEX to Category 1 of explosives, or their detonation, when the detection of them is protected at CUI .

*If you plan to propose this line of research, contact the PM and PSO for additional guidance prior to moving forward.

f. Detection of radioactive elements.

**If you plan to identify a specific isotope vs. an element or to identify that a substance contains a radiation source please contact the PM and PSO for additional guidance prior moving forward with research.

g. Detection of magnetic fields and/or electromagnetic (EM) radiation, or operation in presence of EM clutter.

***The detection of magnetic fields and electromagnetic radiation is UNCLASSIFIED but must be associated with public safety standards such as those identified in the BAA (e.g., https://www.govinfo.gov/content/pkg/CFR-2021-title47-vol1/xml/CFR-2021-title47-vol1-sec1-1310.xml). Contact the PM and PSO if you propose to conduct research with parameters that do not fall within these guidelines to obtain additional guidance.

***Engineering microbes to operate or survive in an EM cluttered environments similar to those being next to a cellphone tower, radio or TV station is UNCLASSIFIED fundamental research. Contact the PM and PSO if you propose to conduct research with parameters that do not fall within these guidelines to obtain additional guidance.

h. When a stimulus or combination of stimuli to be detected are not defined above, but defined as CUI by your contract for OPSEC reasons.

****Any work proposed to engineer microbes to survive or operate in environments or conditions not listed in the BAA should not be proposed or conducted without contacting the PM and PSO.

13. DEFINITIONS

a. Controlled Technical Information – technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

b. Controlled Unclassified Information – is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

14. ACRONYMS

BTO Biological Technologies Office

CCL Commerce Control List

CFR Code of Federal Regulations

CTI Controlled Technical Information

CUI Controlled Unclassified Information

CUIG Controlled Unclassified Information Guide

DARPA Defense Advanced Research Projects Agency

DFARS Defense Federal Acquisition Regulation Supplement

DIB Defense Industrial Base

DoD Department of Defense

DoDI Department of Defense Instruction

EAR Export Administration Regulations

ECCN Export Controlled Classification Number

FOIA Freedom of Information Act

ITAR International Traffic in Arms Regulations

IAW in accordance with

LDC Limited Dissemination Control mG Milligray mSv Millisievert

NIST National Institute of Standards and Technology

OPSEC Operational Security

PM DARPA Program Manager

PSO Program Security Officer

PSR Program Security Representative

SID Security and Intelligence Directorate (DARPA)

USC United States Code

USML United States Munitions List

15. INFORMATION PROTECTION GUIDANCE CHART

This chart (see Table 1 of the CUI Guide below) is provided to assist in identifying what types of information within the Tellus CUIGs is protected as CUI, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply.

This chart is not all-encompassing and does not cover all information that may be protected as CUI. Consult the CUI registry located at http://www.archives.gov/cui/resgistry/category-list.html to verify information not addressed below. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from their program PSR or the BTO PSO.

TABLE 1

CUI INFORMATION PROTECTION GUIDANCE CHART

Element of Information Index Category Reason LDC or

Distribution Statement

Remarks

a) Identification of naturally occurring microbes, or biomolecular components from naturally occurring microbes, that react to a stimuli.

N/A N/A N/A N/A Contact the PM and PSO if you propose to conduct research with parameters or stimuli that do not fall within the BAA guidelines to obtain additional guidance.

b) Identification of microbes or biomolecular components (e.g., proteins, nucleic acids, genes, cellular compartments) that enable the recording and/or transduction of a stimulus.

Defense, Export

Controlled

CTI;

EXPT;

EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when the stimulus is listed in section 12 (see pages 9-10).

CUI when a stimulus or combination of stimuli to be detected are not defined above but are defined as such in your contract for OPSEC reasons.

N/A N/A N/A N/A UNCLASSIFIED if a stimulus other than one described in section 12 (pages 9,10) is being detected.

c) The process, design, or implementation of a biosynthetic pathway to create or change a microbe’s ability to detect, record and/or transduce a stimulus.

Defense, EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when the stimulus is listed in section 12 (see pages 9,10).

N/A N/A N/A N/A UNCLASSIFIED if a stimulus other than one described in section 12 (pages 9,10) is being detected.

d) Identification of native microbes that survive or thrive in terrestrial or maritime environments under one or more environmental conditions identified in the Tellus BAA Table 1 (i.e., hyperbaric, corrosive, foliated, biofouled, swamp, murky, snow, dusty, smoky).

N/A N/A N/A N/A This research is

UNCLASSIFIED.

e) Identification of native microbes that survive or thrive in terrestrial or maritime environments under one or more environmental conditions that are NOT identified in the Tellus BAA (Table 1) or in section 12 (pages 9,10).

N/A N/A N/A N/A Contact the PM and PSO before proposing or conducting this research.

f) Identification of native microbes that survive or thrive in terrestrial or maritime environments

N/A N/A N/A N/A If the “EM cluttered environment” is similar to that experienced near a cellphone tower, in EM-cluttered conditions.

radio or TV station, the research is

UNCLASSIFIED

fundamental research.

Contact the PM and PSO if you propose to conduct research with parameters that do not fall within these guidelines to obtain additional guidance.

g) Identification of changes to a microbe that also changes its ability to survive or thrive in terrestrial or maritime environments under one or more environmental conditions identified in the Tellus BAA Table 1 (i.e., hyperbaric, corrosive, foliated, biofouled, swamp, murky, snow, dusty, smoky).

N/A N/A N/A N/A This research is

UNCLASSIFIED.

If not listed in the BAA research should not be proposed or conducted without contacting the PM and PSO.

h) Identification of changes to a microbe that also changes its ability to survive or thrive in terrestrial or maritime environments with EM-clutter/noise.

N/A N/A N/A N/A If the “EM cluttered environment” is similar to that experienced near a cellphone tower, radio or TV station, the research is

UNCLASSIFIED

fundamental research.

Contact the PM and PSO if you propose to conduct research with parameters that do not fall within these guidelines to obtain additional guidance.

i) Methods to encapsulate, contain or sustain the microbes

Defense, Export

Controlled

CTI;

EXPT;

EXPTR

48 CFR

252.204-

DISTRO

C or F, IAW

CUI when the stimulus is listed in section 12 (see pages 9,10).

affording ability to survive and remain functional for detecting stimuli in different environments or under different environmental conditions.

50 USC

4614(c)

DoDI 5230.24

UNCLASSIFIED when not listed in section 12.

j) Engineering a microbe to reduce its ability to survive in the environment should it escape its encapsulant or the system in which it was embedded (i.e., biocontainment strategies).

N/A N/A N/A N/A This research is

UNCLASSIFIED.

k) A functional microbial device that exhibits any combination of the following:

Specific and sensitive detection of the stimulus.

Functional in many of the environmental conditions listed in the “Microbial Device Parameters” table in the

BAA.

Production of an output signal that is highly likely to be detectable at Tellus’ target stand-off distances.

Defense, EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when the stimulus is listed in section 12 (see pages 9,10).

Protect in accordance with any applicable guidance assigned by the PM and PSO.

N/A N/A N/A N/A UNCLASSIFIED if a stimulus other than one described in section 12 (pages 9,10) is being detected, or other guidance was provided by the PM and PSO.

l) Design, test, and evaluation data revealing details of engineering that are unique and essential to the Tellus program.

Defense, EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when the stimulus is listed in section 12 (see pages 9,10).

UNCLASSIFIED when not listed in section 12.

m) Tests and test results revealing performance capabilities of Tellus devices (e.g., sensitivity, specificity, Defense, EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when the stimulus is listed in section 12 (see pages 9,10) and in accordance with row

(k) of this table.

endurance, environmental tolerance).

n) Photographs, artist concepts, and drawings.

Defense, EXPTR

48 CFR

252.204-

50 USC

4614(c)

DISTRO

C or F, IAW DoDI 5230.24

CUI when technical details are disclosed and the stimulus is listed in section 12 (see pages 9,10).

Protect in accordance with any applicable guidance assigned by the PM and PSO.

N/A N/A N/A N/A UNCLASSIFIED if a stimulus other than one described in section 12 (pages 9,10) is being detected, or other guidance was provided by the PM and PSO.