Attachment 2_DOD 5200.1-R.pdf

DoD 5200.1-R, January 1997

2 FOREWORD

3 FOREWORD

TABLE OF CONTENTS

Page

FOREWORD 2

TABLE OF CONTENTS 4

CHAPTER 1 - POLICY AND PROGRAM MANAGEMENT 7

C1.1. POLICY 7

C1.2. PROGRAM MANAGEMENT 9

C1.3. SPECIAL TYPES OF INFORMATION 10

C1.4. EXCEPTIONAL SITUATIONS 11

C1.5. CORRECTIVE ACTIONS AND SANCTIONS 12

C1.6. PEPORTS 13

C1.7. SELF-INSPECTION 13

CHAPTER 2 - ORIGINAL CLASSIFICATION 15

C2.1. GENERAL PROVISIONS 15

C2.2. ORIGINAL CLASSIFICATION AUTHORITY 15

C2.3. THE ORIGINAL CLASSIFICATION PROCESS 16

C2.4. SPECIAL CONSIDERATIONS 19

C2.5. SECURITY CLASSIFICATION AND/OR DECLASSIFICATION GUIDES 20

C2.6. INFORMATION FROM PRIVATE SOURCES 23

CHAPTER 3 - DERIVATIVE CLASSIFICATION 26

C3.1. POLICY AND GENERAL REQUIREMENTS 26

C3.2. PROCEDURES 27

CHAPTER 4 - DECLASSIFICATION AND REGRADING 29

C4.1. GENERAL 29

C4.2. DECLASSIFICATION DECISIONS BY ORIGINAL CLASSIFIERS 30

C4.3. AUTOMATIC DECLASSIFICTION AT 25 YEARS 32

C4.4. MANDATORY REVIEW FOR DECLASSIFICATION 35

C4.5. SYSTEMATIC REVIEW FOR DECLASSIFICATION 36

C4.6. DOWNGRADING 37

C4.7. UPGRADING 38

C4.8. FOREIGN GOVERNMENT INFORMATION 38

C4.9. CHALLENGES TO CLASSIFICATION 39

4 TABLE OF CONTENTS

TABLE OF CONTENTS, continued

CHAPTER 5 - MARKING 41

C5.1. GENERAL PROVISIONS 41

C5.2. SPECIFIC MARKINGS ON DOCUMENTS 42

C5.3. MARKING SPECIAL TYPES OF DOCUMENTS 54

C5.4. MARKING SPECIAL TYPES OF MATERIALS 57

C5.5. CHANGES IN MARKINGS 60

C5.6. REMARKING AND USING OLD CLASSIFIED MATERIAL 62

C5.7. FOREIGN GOVERNMENT INFORMATION/EQUIVALENT U.S. CLASSIFICATION

DESIGNATION

CHAPTER 6 - SAFEGUARDING 66

C6.1. CONTROL MEASURES 66

C6.2. ACCESS 67

C6.3. SAFEGUARDING 70

C6.4. STORAGE 75

C6.5. REPRODUCTION OF CLASSIFIED MATERIAL 81

C6.6. FOREIGN GOVERNMENT INFORMATION 82

C6.7. DISPOSITION AND DISTRUCTION OF CLASSIFIED MATERIAL 83

C6.8. ALTERNATIVE OR COMPENSATORY CONTROL MEASURES 84

CHAPTER 7 - TRANSMISSION AND TRANSPORTATION 87

C7.1. METHODS OF TRANSMISSION OR TRANSPORTATION 87

C7.2. PREPARATION OF MATERIAL FOR TRANSMISSION 92

C7.3. ESCORT OR HAND-CARRYING OF CLASSIFIED MATERIAL 93

CHAPTER 8 - SPECIAL ACCESS PROGRAMS 98

C8.1.1. Policy 98 C8.1.2. SAP Procedures 98 C8.1.3. Control and Administration 100 C8.1.4. Establishment of DoD SAPs 101 C8.1.5. Reviews of SAPs 106 C8.1.6. Annual Reports and Revalidation 107 C8.1.7. Interim Reports 108 C8.1.8. Changes in Classification 108 C8.1.9. Termination and Transitioning of SAPs 109

5 TABLE OF CONTENTS

TABLE OF CONTENTS, continued

CHAPTER 9 - SECURITY EDUCATION AND TRAINING 110

C9.1. POLICY 110

C9.2. INITIAL ORIENTATION 110

C9.3. SPECIAL REQUIREMENTS 112

C9.4. CONTINUING SECURITY EDUCATION/REFRESHER TRAINING 115

C9.5. TERMINATION BRIEFINGS 115

C9.6. PROGRAM OVERSIGHT 116

CHAPTER 10 - ACTUAL OR POTENTIAL COMPROMISE OF CLASSIFIED INFORMATION 117

C10.1.1. Policy 117 C10.1.2. Reporting 117 C10.1.3. Inquiry/Investigation 118 C10.1.4. Results of the Inquiry/Investigation 120 C10.1.5. Verification, Reevaluation, and Damage Assessment 120 C10.1.6. Debriefings in Cases of Unauthorized Access 121 C10.1.7. Management and Oversight 122 C10.1.8. Additional Investigation 123 C10.1.9. Unauthorized Absences 123

APPENDIX 1 - REFERENCES 124

APPENDIX 2 - DEFINITIONS 129

APPENDIX 3 - CONTROLLED UNCLASSIFIED INFORMATION 138

APPENDIX 4 - SPECIAL PROCEDURES FOR USE IN SYSTEMATIC AND MANDATORY

REVIEW OF CRYPTOLOGIC INFORMATION

APPENDIX 5 - CONTROL OF DISSEMINATION OF INTELLIGENCE INFORMATION

(to be provided at a later date)

APPENDIX 6 - EQUIVALENT FOREIGN SECURITY CLASSIFICATIONS 154

APPENDIX 7 - PHYSICAL SECURITY STANDARDS 158

APPENDIX 8 - TRANSMISSION TO FOREIGN GOVERNMENTS 168

APPENDIX 9 - SPECIAL ACCESS PROGRAM DOCUMENTATION 174

6 TABLE OF CONTENTS

C1. CHAPTER 1

POLICY AND PROGRAM MANAGEMENT

C1.1. POLICY

C1.1.1. Purpose and Scope

C1.1.1.1. This Regulation implements Executive Order 12958 (reference (e)), "Classified National Security Information," and associated OMB directives within the Department of Defense. It applies to all Components of the Department of Defense.

It establishes the Department of Defense Information Security Program to promote proper and effective classification, protection and downgrading of official information requiring protection in the interest of the national security. It also promotes the declassification of information no longer requiring such protection.

C1.1.1.2. There is information, other than classified information, that has been determined to require some type of protection or control. This information is generally known as "controlled unclassified information." Guidance concerning the protection or controls required for such information may be found in a number of DoD Directives, Regulations and Instructions. However, since classified information and controlled unclassified information often exist side-by-side in the work environment, often in the same document, the essence of available guidance pertaining to controlled unclassified information has been captured in Appendix 3 of this Regulation. The purpose of the Appendix is to provide the user, to the extent possible, a single source document for guidance concerning both classified and controlled unclassified information.

C1.1.2. Policies

C1.1.2.1. All personnel of the Department of Defense are personally and individually responsible for providing proper protection to classified information under their custody and control. All officials within the Department of Defense who hold command, management, or supervisory positions have specific, nondelegable responsibility for the quality of implementation and management of the Information Security Program within their areas of responsibility. Management of classified information shall be included as a critical element or item to be evaluated in the rating of original classification authorities, security managers or specialists, and other personnel whose duties primarily involve the creation or handling of classified information.

7 CHAPTER 1

C1.1.2.2. Except for information subject to the Atomic Energy Act of 1954 (as amended) (reference (o)), Executive Order 12958 (reference (e)) and this Regulation provide the only basis for application of security classification to information within the Department of Defense.

C1.1.2.3. Information shall be classified only when necessary in the interest of national security, and shall be declassified as soon as is consistent with the requirements of national security.

C1.1.2.4. Information shall not be reclassified after it has been declassified and officially released to the public by proper authority.

C1.1.2.5. Persons shall be allowed access to classified information only if they:

C1.1.2.5.1. Possess a valid and appropriate security clearance;

C1.1.2.5.2. Have executed an appropriate non-disclosure agreement; and

C1.1.2.5.3. Have a valid need for access to the information to perform a lawful and authorized governmental function. DoD 5200.2-R (reference (ss)) contains detailed guidance on personnel security investigation, adjudication and clearance.

C1.1.2.6. Classified information shall be protected at all times. See Chapters 6 and 7 of this Regulation.

C1.1.2.7. Classified information shall be maintained only when it is required for effective and efficient operation of the organization or its retention is required by law or regulation.

C1.1.2.8. Classified documents and material that constitute permanently valuable records of the Government shall be maintained and disposed of in accordance with DoD Directive 5015.2 (reference (v)). Other classified material shall be destroyed in accordance with Chapter 6 of this Regulation.

C1.1.2.9. Special Access Programs shall be created, continued, managed, and discontinued in conformance with Chapter 8 of this Regulation.

8 CHAPTER 1

C1.2. PROGRAM MANAGEMENT

C1.2.1. Department of Defense. The Secretary of Defense has designated the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD(C3I)) as the senior agency official responsible for direction and administration of the Information Security Program for the Department of Defense.

The Under Secretary of Defense for Policy (USD(P)) has been designated as the senior official responsible for administering that portion of the DoD Information Security Program pertaining to Special Access Programs (SAPs), the National Disclosure Policy (NDP), foreign government (including NATO) information, and security arrangements for international programs. These officials shall perform those functions specified in subsection 5.6(c) of Executive Order 12958 (reference (e)) and appropriate implementing directives for the Department of Defense.

C1.2.2. DoD Components. The Head of each DoD Component shall:

C1.2.2.1. Appoint a Senior Agency Official to be responsible for direction and administration of the program within the Component. (The Component head may designate a separate senior official to be responsible for overseeing Special Access Programs within the Component, if necessary.)

C1.2.2.2. Commit necessary resources to the effective implementation of the Information Security Program; and

C1.2.2.3. Establish procedures to ensure that the head of each activity within the Component that creates, handles or stores classified information appoints an official to serve as security manager for the activity, to provide proper management and oversight of the activity's Information Security Program. Persons appointed to these positions shall be provided training as required by Chapter 9 of this Regulation.

C1.2.3. Senior Agency Officials. The Senior Agency Official appointed in each Component in accordance with subparagraph C1.2.2.1., above, shall:

C1.2.3.1. Oversee the Component's Information Security Program;

C1.2.3.2. Promulgate (or cause to be promulgated) implementing directives as necessary for program implementation;

C1.2.3.3. Establish and maintain a security education program as required by Chapter 9 of this Regulation;

9 CHAPTER 1

C1.2.3.4. Establish and maintain an ongoing self-inspection program, to include periodic review and assessment of the Component's classified products;

C1.2.3.5. Establish procedures to prevent unauthorized access to classified information;

C1.2.3.6. Develop special contingency plans, as necessary, for the safeguarding of classified information used in or near hostile or potentially hostile areas;

C1.2.3.7. Ensure that the performance contract or other system used to rate the performance of civilian and military personnel includes the management of classified information as a critical element or item to be evaluated in the rating of:

C1.2.3.7.1. Original classification authorities;

C1.2.3.7.2. Security managers and security specialists; and

C1.2.3.7.3. All other personnel whose duties include significant involvement with the creation or handling of classified information;

C1.2.3.8. Account for the costs associated with the implementation of this Regulation within the Component and report those costs as required; and

C1.2.3.9. Ensure prompt and appropriate response to any request, appeal, challenge, complaint, or suggestion arising out of the implementation of this Regulation within the Component.

C1.3. SPECIAL TYPES OF INFORMATION

C1.3.1. Restricted Data. Classified information in the custody of the Department of Defense marked as Restricted Data under the Atomic Energy Act of 1954 (as amended) (reference (o)), shall be stored, protected, and destroyed as required by this Regulation for other information of a comparable level of security classification. DoD policy and procedures concerning access to and dissemination of Restricted Data within the Department of Defense are contained in DoD Directive 5210.2 (reference (z)).

10 CHAPTER 1

C1.3.2. Sensitive Compartmented Information (SCI) and Communications Security (COMSEC) Information. SCI and COMSEC information shall be controlled and protected in accordance with applicable national policy and DoD Directives and Instructions. Security classification and declassification policies of this Regulation apply to SCI and COMSEC information in the same manner as other classified information except that Appendix 4 of this Regulation provides special procedures for use in systematic and mandatory review of cryptologic information.

C1.3.3. Special Access Program Information. Information covered by Special Access Programs established in accordance with Chapter 8 of this Regulation shall be classified, declassified, controlled and protected as required in this Regulation and instructions issued by officials charged with management of those programs. The provisions of this Regulation pertaining to classification, declassification and marking apply, without exception, to Special Access Program information unless waivers of specific requirements are obtained in accordance with section C1.4. of this Chapter.

C1.3.4. North Atlantic Treaty Organization and Other Foreign Government Information. North Atlantic Treaty Organization (NATO) classified information shall be safeguarded in compliance with United States Security Authority for NATO (USSAN) Instruction I-69 (reference (ggg)). Other foreign government information shall be safeguarded as described herein for U.S. information except as specified in Appendix 8 or as required by treaties or international agreements.

C1.4. EXCEPTIONAL SITUATIONS

C1.4.1. Military Operations. The provisions of this Regulation pertaining to accountability, dissemination, transmission, and storage of classified information and material may be modified by military commanders as necessary to meet local conditions encountered during military operations. Military operations include combat and peacekeeping operations as well as other operations involving military deployments. Classified information shall be introduced into combat areas or zones, or areas of potential hostile activity, only as necessary to accomplish the military mission.

C1.4.2. Waivers to Requirements

C1.4.2.1. Unless otherwise specified herein, DoD Components shall submit requests for waivers to the requirements of this Regulation through established channels, to the ASD(C3I) or, for information related to SAPs, foreign government information (including NATO) information, and security arrangements for international programs, to the Under Secretary of Defense (Policy) (USD(P)). The ASD(C3I) and

11 CHAPTER 1

USD(P) shall be responsible for promptly notifying the Director, Information Security Oversight Office of all waivers approved involving E.O. 12958 (reference (e)) and its' implementing directives.

C1.4.2.2. Requests for waivers shall contain sufficient information to permit a complete and thorough analysis to be made of the impact on national security of approval of the waiver. DoD Components shall maintain documentation regarding approved waivers and furnish such documentation, upon request, to other Agencies with whom classified information or secure facilities are shared.

C1.5. CORRECTIVE ACTIONS AND SANCTIONS

C1.5.1. General. Heads of the DoD Components shall establish procedures to ensure that prompt and appropriate management action is taken in case of compromise of classified information, improper classification of information, violation of the provisions of this Regulation, and incidents that may put classified information at risk of compromise. Such actions shall focus on correction or elimination of the conditions that caused or occasioned the incident.

C1.5.2. Sanctions

C1.5.2.1. DoD military and civilian personnel shall be subject to sanctions if they knowingly, willfully, or negligently:

C1.5.2.1.1. Disclose to unauthorized persons information properly classified under this Regulation;

C1.5.2.1.2. Classify or continue the classification of information in violation of this Regulation;

C1.5.2.1.3. Create or continue a Special Access Program contrary to the requirements of this Regulation; or

C1.5.2.1.4. Violate any other provision of this Regulation.

C1.5.2.2. Sanctions include, but are not limited to, warning, reprimand, suspension without pay, forfeiture of pay, removal, discharge, loss or denial of access to classified information, and removal of classification authority. Action may also be taken under the Uniform Code of Military Justice for violations of that Code and under applicable criminal law.

12 CHAPTER 1

C1.5.2.3. In case of demonstration of reckless disregard or a pattern of error in applying the classification standards of this Regulation on the part of a person holding original classification authority, the appropriate official shall, as a minimum, remove the offending individual's original classification authority.

C1.5.3. Reporting of Incidents. Whenever a violation under paragraph C1.5.2.1.1., C1.5.2.1.2., or C1.5.2.1.3., above, occurs, the Component Senior Agency Official shall promptly notify the ASD(C3I) through appropriate channels. The ASD(C3I)) shall notify the Director, Information Security Oversight Office, as required by paragraph 5.7(e)(2) of Executive Order 12958 (reference (e)). If the violation involves Special Access Program, NATO or foreign government information, it shall be promptly reported to the Assistant Deputy to the USD(P) for Policy Support, who will be responsible for all further notifications and appropriate coordination.

C1.6. REPORTS

C1.6.1. Reporting Requirements

C1.6.1.1. The ASD(C3I) shall establish requirements for the collection and reporting of data necessary to support fulfillment of the requirements of Executive Order 12958 (reference (e)) and OMB and Security Policy Board implementing directives. As a minimum, DoD Components shall submit, on a fiscal year basis, a consolidated report concerning the Information Security Program of the Component on Standard Form (SF) 311, "Agency Information Security Program Data," to reach the Principal Director for Information Warfare, Security and Counterintelligence (PD(IWS&CI)), OASD(C3I), by October 20 of each year. SF 311 shall be completed in accordance with the instructions thereon and augmenting instructions issued by the OASD(C3I). The OASD(C3I) shall submit the DoD report (SF 311) to the Information Security Oversight Office by October 31 of each year. Interagency Report Control Number 0230-GSA-AN applies to this information collection requirement.

C1.6.1.2. The USD(P) shall establish requirements for the collection and reporting of data necessary to the proper management of Special Access Programs within the Department.

C1.7. SELF-INSPECTION

Heads of DoD Components shall establish and maintain a self-inspection program based on program needs and the degree of involvement with classified information. The

13 CHAPTER 1

purpose of the program shall be to evaluate and assess the effectiveness and efficiency of the Component's implementation of the DoD Information Security Program.

Component activities that originate significant amounts of classified information should be inspected at least annually.

14 CHAPTER 1

C2. CHAPTER 2

ORIGINAL CLASSIFICATION

C2.1. GENERAL PROVISIONS

Original classification is the initial decision that an item of information could be expected to cause damage to the national security if subjected to unauthorized disclosure, and that the interests of the national security are best served by applying the safeguards of the Information Security Program to protect it. This decision may be made only by persons who have been specifically delegated the authority to do so, have received training in the exercise of this authority, and have program responsibility or cognizance over the information. The decision must be made in accordance with the requirements of this Chapter.

C2.2. ORIGINAL CLASSIFICATION AUTHORITY

C2.2.1. Policy. Information may be originally classified only by the Secretary of Defense, the Secretaries of the Military Departments, and other officials who have been specifically delegated this authority in writing. Delegations of original classification authority shall be limited to the minimum required for effective operation of the Department of Defense. The authority shall be delegated only to officials who have a demonstrable and continuing need to exercise it.

C2.2.2. Delegation of Authority

C2.2.2.1. Information may be originally classified Top Secret only by the Secretary of Defense, the Secretaries of the Military Departments, or those officials who have been specifically delegated this authority in writing by the Secretary of Defense or the Secretaries of the Military Departments.

C2.2.2.2. Information may be originally classified Secret or Confidential only by the Secretary of Defense, the Secretaries of the Military Departments, and the Senior Agency Officials appointed by them in accordance with Section 5.6(c) of E.O. 12958 (reference (e)) provided those Senior Agency Officials have also been delegated original Top Secret classification authority. Senior Agency Officials of the Military Departments may further delegate original Secret and Confidential classification authority as necessary to respond to requests received under the provisions of subparagraphs C2.2.2.3. and C2.2.2.4., below.

15 CHAPTER 2

C2.2.2.3. Requests for original classification authority for officials serving in OSD and the DoD Components other than the Military Departments shall be submitted to the ASD(C3I). These requests will specify the position title for which the authority is requested, provide a brief justification for the request, and be submitted through established organizational channels.

C2.2.2.4. Requests for original classification authority shall be granted only when:

C2.2.2.4.1. Original classification is required during the normal course of operations in the organization;

C2.2.2.4.2. Sufficient expertise and information is available to the prospective original classification authority to permit effective classification decision-making;

C2.2.2.4.3. The need for original classification cannot be eliminated by issuance of classification guidance by existing original classification authorities; and

C2.2.2.4.4. Referral of decisions to existing original classification authorities at higher levels in the chain of command or supervision is not practical.

C2.2.3. Required Training. Persons who have been delegated original classification authority must receive training as required by Chapter 9 of this Regulation before they can exercise the delegated authority.

C2.3. THE ORIGINAL CLASSIFICATION PROCESS

C2.3.1. Overview. In making a decision to originally classify information, designated DoD original classification authorities shall:

C2.3.1.1. Determine that the information is owned by, produced by or for, or is under the control of the U.S. Government;

C2.3.1.2. Determine that the information falls within one or more of the categories of information listed in paragraph C2.3.2., below;

C2.3.1.3. Determine that the unauthorized disclosure of the information could be expected to result in damage to the national security and be able to identify or describe the damage;

16 CHAPTER 2

C2.3.1.4. Select the appropriate level of classification to be applied to the information, based on a judgment as to the degree of damage that could be caused by unauthorized disclosure;

C2.3.1.5. Determine the appropriate declassification instructions to be applied to the information; and

C2.3.1.6. Communicate the classification decision as required by paragraph C2.3.7., below.

C2.3.2. Eligibility for Classification. Classification may be applied only to information that is owned by, produced by or for, or is under the control of the United States Government. Information may be considered for classification only if it concerns one of the categories specified in Section 1.5 of Executive Order 12958 (reference (e)):

C2.3.2.1. Military plans, weapon systems, or operations;

C2.3.2.2. Foreign government information;

C2.3.2.3. Intelligence activities (including special activities), intelligence sources or methods, or cryptology;

C2.3.2.4. Foreign relations or foreign activities of the United States, including confidential sources;

C2.3.2.5. Scientific, technological, or economic matters relating to the national security;

C2.3.2.6. United States Government programs for safeguarding nuclear materials or facilities; or

C2.3.2.7. Vulnerabilities or capabilities of systems, installations, projects or plans relating to the national security.

C2.3.3. Possibility of Protection. The original classification authority must determine that, if classification is applied or reapplied, there is a reasonable possibility that the information can be provided protection from unauthorized disclosure. (See subparagraphs C2.4.3.4. and C2.4.3.5., below.)

17 CHAPTER 2

C2.3.4. The Decision to Classify

C2.3.4.1. The decision to apply classification involves two sub-elements, both of which require the application of reasoned judgment on the part of the classifier. The first is the determination that the unauthorized disclosure of the information could reasonably be expected to cause damage to the national security of the United States, and that the damage can be identified or described. It is not necessary for the original classifier to produce a written description of the damage at the time of classification, but the classifier must be prepared to do so if the information becomes the subject of a classification challenge, a request for mandatory review for declassification, or a request for release under the Freedom of Information Act (reference (g)).

C2.3.4.2. The second step in this decision is to determine the probable operational, technological and resource impact of classification.

C2.3.4.3. If there is significant doubt about the need to classify information, it shall not be classified.

C2.3.5. Level of Classification. The original classifier, again using reasoned judgment, must determine which level of classification is to be applied. If there is significant doubt about the appropriate level of classification, the information shall be classified at the lower level.

C2.3.5.1. Top Secret shall be applied to information the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe.

C2.3.5.2. Secret shall be applied to information the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe.

C2.3.5.3. Confidential shall be applied to information the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe.

C2.3.6. Duration of Classification. At the time of original classification, the original classifier must make a decision about the length of time the information shall require the protection of security classification. The specific options available in making this decision are discussed in Chapter 3 of this Regulation.

18 CHAPTER 2

C2.3.7. Communicating the Decision. An original classification authority who makes a decision to originally classify information is responsible for ensuring the decision is effectively communicated to persons who will be in possession of the information. This may be accomplished by issuing classification guidance, discussed in section C2.5. of this Chapter, or by ensuring that a document containing the information is properly marked to reflect the decision. Marking of classified documents is covered by Chapter 5 of this Regulation.

C2.4. SPECIAL CONSIDERATIONS

C2.4.1. Compilation. In unusual circumstances, compilations of information that are individually unclassified may be classified if the compiled information reveals an additional association or relationship that:

C2.4.1.1. Qualifies for classification under this Regulation; and

C2.4.1.2. Is not otherwise revealed by the individual information.

Classification by compilation must meet the same criteria in terms of justification as other original classification actions. (See subparagraph C5.2.7.3. and paragraph C5.3.3., below, for marking requirements.)

C2.4.2. The Acquisition Process. Classification of information involved in the DoD acquisition process shall conform to the requirements of DoD Directive 5000.1 (reference (t)) and DoD 5000.2-R (reference (nn)), as well as this Chapter.

C2.4.3. Limitations and Prohibitions

C2.4.3.1. Classification may not be used to conceal violations of law, inefficiency, or administrative error; to prevent embarrassment to a person, organization, or agency; or to restrain competition.

C2.4.3.2. Basic scientific research and its results may be classified only if it clearly relates to the national security.

C2.4.3.3. Classification may not be used to prevent or delay the release of information that does not require protection in the interest of the national security.

C2.4.3.4. The reclassification of information which was once classified but was declassified and officially released to the public is prohibited.

19 CHAPTER 2

C2.4.3.5. Information may be classified or reclassified after receipt of a request for it under the Freedom of Information Act (reference (g)), the Privacy Act of 1974 (reference (h)), or the mandatory review provisions of E.O. 12958 (reference (e)) only if it is done on a document-by-document basis with the personal participation or under the direction of the Secretary of Defense or Deputy Secretary of Defense, the Secretary or Under Secretary of a Military Department, or the Senior Agency Official appointed within OSD or a Military Department in accordance with Section 5.6(c) of E.O. 12958 (reference (e)).

C2.4.3.6. Information that is a product of non-Government research and development that does not incorporate or reveal classified information to which the producer or developer was given prior access may be classified only as provided in section C2.6. of this Chapter.

C2.5. SECURITY CLASSIFICATION AND/OR DECLASSIFICATION GUIDES

C2.5.1. Policy. A security classification guide shall be issued for each system, plan, program, or project in which classified information is involved.

C2.5.2. Content

C2.5.2.1. Security classification guides shall:

C2.5.2.1.1. Identify specific items, elements or categories of information to be protected;

C2.5.2.1.2. State the specific classification to be assigned to each item or element of information and, when useful, specify items of information that are unclassified;

C2.5.2.1.3. Provide declassification instructions for each item or element of information, to include the applicable exemption category for information exempted from automatic declassification;

C2.5.2.1.4. State a concise reason for classification for each item, element, or category of information that, at a minimum, cites the applicable classification category(ies) in Section 1.5 of E.O. 12958 (reference (e)) (See paragraph C2.3.5. of this Regulation, above);

20 CHAPTER 2

C2.5.2.1.5. Identify any special handling caveats that apply to items, elements, or categories of information;

C2.5.2.1.6. Identify, by name or personal identifier and position title, the original classification authority approving the guide and the date of approval; and

C2.5.2.1.7. Provide a point-of-contact for questions about the guide and suggestions for improvement.

C2.5.2.2. For information exempted from automatic declassification because its disclosure would reveal foreign government information or violate a statute, treaty or international agreement (see paragraphs C4.2.3. and C4.3.2. of this Regulation, below), the guide will identify the government or specify the applicable statute, treaty or international agreement, as appropriate.

C2.5.3. Approval, Distribution, and Indexing

C2.5.3.1. Security classification guides shall be approved personally and in writing by an original classification authority who is authorized to classify information at the highest level established by the guide, and who has program or supervisory responsibility for the information or the organization's Information Security Program.

C2.5.3.2. Security classification guides shall be distributed by the originating organization to those organizations and activities they believe will be derivatively classifying information covered by the guide.

C2.5.3.3. One copy of each guide shall be forwarded to the Director of Freedom of Information and Security Review, Office of the Assistant to the Secretary of Defense for Public Affairs. Guides that cover SCI or Special Access Program information and that contain information that requires special access controls are exempt from this requirement.

C2.5.3.4. Two copies of each approved guide (other than those covering SCI or Special Access Program information, or guides determined by the approval authority for the guide to be too sensitive for automatic secondary distribution) shall be provided to the Administrator, Defense Technical Information Center (DTIC). Each guide furnished to DTIC must bear the appropriate distribution statement required by DoD Directive 5230.24 (reference (ff)).

C2.5.3.5. Security classification guides issued under this Regulation will be indexed in DoD 5200.1-I (reference (rr)), the DoD Index of Security Classification

21 CHAPTER 2

Guides. Originators of guides shall submit DD Form 2024, "DoD Security Classification Guide Data Elements," to the Administrator, DTIC, upon approval of the guide. If the originator determines that listing the guide in reference (rr) would be inadvisable for security reasons, issuance of the guide shall be separately reported to the PD(IWS&CI), OASD(C3I), with an explanation of why the guide should not be listed. Special Access Program determinations shall be reported separately to the Director, Special Programs, ODTUSD(P)PS. Report Control Symbol DD-C3I(B&AR)1418 applies to the reporting requirements of this paragraph.

C2.5.4. Review, Revision, and Cancellation

C2.5.4.1. Security classification guides shall be reviewed by the originator for currency and accuracy at least once every 5 years. Changes identified as necessary in the review process shall be promptly made. If no changes are required, the record copy of the guide shall be so annotated, with the date of the review.

C2.5.4.2. Guides shall be revised whenever necessary to promote effective derivative classification. When a guide is revised or reissued, computation of declassification instructions will continue to be based on the date of original classification of the information, not the date of revision or reissue.

C2.5.4.3. Guides shall be canceled only when:

C2.5.4.3.1. All information specified as classified by the guide has been declassified; or

C2.5.4.3.2. When the system, plan, program, or project has been canceled, discontinued, or removed from the inventory;

C2.5.4.3.3. When a major restructure has occurred as the information is incorporated into a new classification guide and there is no reasonable likelihood that information covered by the guide will be the subject of derivative classification.

Impact of the cancellation on systems, plans, programs, and projects provided to other nations under approved foreign disclosure decisions; and impact of such decisions on existing U.S. classification guides of similar systems, plans, programs or projects shall be considered in the decision. Upon cancellation of a guide, the responsible official shall consider the need for publication of a declassification guide, discussed in paragraph C4.1.3. of this Regulation, below.

22 CHAPTER 2

C2.5.4.4. Revision, reissuance, review, and cancelation of a guide will be reported as required for new guides in subparagraph C2.5.3.5., above. Copies of changes, reissued guides, and cancelation notices will be distributed as required by subparagraphs C2.5.3.2., C2.5.3.3., and C2.5.3.4., above.

C2.6. INFORMATION FROM PRIVATE SOURCES

C2.6.1. Policy. Information that is a product of contractor or individual independent research and development (IR&D) or bid and proposal (B&P) efforts conducted without prior access to classified information or current access to classified information associated with the specific information in question may not be classified unless:

C2.6.1.1. The U.S. Government first acquires a proprietary interest in the information; or

C2.6.1.2. The contractor conducting the IR&D/B&P requests that the U.S.

Government activity place the information under the control of the security classification system without relinquishing ownership of the information.

C2.6.2. Classification Determination

C2.6.2.1. The individual or contractor conducting an IR&D/B&P effort and believing that information generated without prior access to classified information or current access to classified information associated with the specific information in question may require protection in the interest of national security should safeguard the information and submit it to an appropriate U.S. Government activity for a classification determination.

C2.6.2.2. The Government activity receiving such a request shall issue security classification guidance as appropriate if the information is to be classified. If the information is not under that activity's classification authority, the activity shall refer the matter to the appropriate classification authority or inform the individual or contractor to take that action. The information shall be safeguarded until the matter has been resolved.

C2.6.2.3. The activity that holds classification authority over the information shall verify whether the individual or contractor is cleared and has been authorized storage capability. If not, the appropriate contracting authority for the activity shall advise whether clearance action should be initiated.

23 CHAPTER 2

C2.6.2.4. If the individual or contractor refuses to be processed for a clearance and the Government does not acquire a proprietary interest in the information, the information may not be classified.

C2.6.3. Patent Secrecy Act . The Patent Secrecy Act of 1952 (reference (m)) provides that the Secretary of Defense, among others, may determine that disclosure of an invention by granting of a patent would be detrimental to national security. See DoD Directive 5535.2 (reference (ii)). A patent application on which a secrecy order has been imposed shall be handled as follows within the Department of Defense:

C2.6.3.1. If the patent application contains information that warrants classification, it shall be assigned a classification and be marked and safeguarded accordingly.

C2.6.3.2. If the patent application does not contain information that warrants classification the following procedures shall be followed:

C2.6.3.2.1. A cover sheet (or cover letter for transmittal) shall be placed on the application with substantially the following language:

"The attached material contains information on which secrecy orders have bee issued by the U.S. Patent Office after determination that disclosure would be detrimental to national security (Patent Secrecy Act of 1952, 35 U.S.C. 181-188) (reference (m)). Its transmission or revelation in any manner to an unauthorized person is prohibited by law.

Handle as though classified CONFIDENTIAL (or other classification as appropriate)."

C2.6.3.2.2. The information shall be withheld from public release; its dissemination within the Department of Defense shall be controlled; the applicant shall be instructed not to disclose it to any unauthorized person; and the patent application (or other document incorporating the protected information) shall be safeguarded in the manner prescribed for equivalent classified material.

C2.6.3.3. If filing of a patent application with a foreign government is approved under provisions of the Patent Secrecy Act of 1952 (reference (m)) and agreements on interchange of patent information for defense purposes, the copies of the patent application prepared for foreign registration (but only those copies) shall be marked at the bottom of each page as follows:

24 CHAPTER 2

"Withheld under the Patent Secrecy Act of 1952 (35 U.S.C. 181-188)."

"Handle as CONFIDENTIAL (or such other level as has been determined appropriate)."

25 CHAPTER 2

C3. CHAPTER 3

DERIVATIVE CLASSIFICATION

C3.1. POLICY AND GENERAL REQUIREMENTS

C3.1.1. The Nature of the Process. Derivative classification is the process of determining whether information that is to be included in a document or material has been classified and, if it has, ensuring that it is identified as classified information by marking or similar means. Information is derivatively classified whenever it is extracted, paraphrased, restated, or generated in a new form. Application of classification markings to a document or other material as directed by a security classification guide or other source material is derivative classification. Simply photocopying or otherwise mechanically reproducing classified material is not derivative classification.

C3.1.2. Authority and Responsibility. Within the Department of Defense, all cleared personnel who generate or create material that should be derivatively classified are responsible for ensuring that the derivative classification is accomplished in accordance with this Chapter. No specific delegation of authority is required by persons doing derivative classification. DoD officials who sign or approve derivatively classified documents have principal responsibility for the quality of their derivative classification.

C3.1.2.1. Policy. All persons performing derivative classification shall:

C3.1.2.1.1. Observe and respect the classification determinations made by original classification authorities. If they believe information to be improperly classified, they will take action as required by paragraph C4.9.1. of this Regulation, below.

C3.1.2.1.2. Apply markings or other means of identification to the derivatively classified material as required by Chapter 5 of this Regulation.

C3.1.2.1.3. Use only authorized sources of instructions about the classification of the information in question. Authorized sources of instructions about classification are security classification guides, other forms of classification guidance, and markings on material from which the information is extracted. The use of only memory or "general rules" about the classification of broad classes of information is prohibited.

26 CHAPTER 3

C3.1.2.1.4. Use caution when paraphrasing or restating information extracted from a classified source document to determine whether the classification may have been changed in the process.

C3.1.2.1.5. Take appropriate and reasonable steps to resolve doubts or apparent conflicts about the classification, level of classification, and duration of classification of information. These steps may include consulting a security classification guide or referral to the organization responsible for the original classification. In cases of apparent conflict between a security classification guide and a classified source document about a discrete item of information, the instructions in the security classification guide shall take precedence.

C3.2. PROCEDURES

C3.2.1. General

C3.2.1.1. Derivative classifiers must carefully analyze the material they are classifying to determine what information it contains or reveals and evaluate that information against the instructions provided by the classification guidance or the markings on source documents.

C3.2.1.2. Drafters of documents that must be derivatively classified should be encouraged to portion mark their drafts and keep records of the sources they use, to facilitate derivative classification of the finished product.

C3.2.1.3. Declassification instructions for derivatively classified documents shall not be automatically copied from source documents. They must be determined as required by Chapter 4, and applied in accordance with Chapter 5 of this Regulation.

C3.2.1.4. When material is derivatively classified based on "multiple sources" (more than one security classification guide, classified source document, or combination thereof), the derivative classifier must compile a list of the sources used.

A copy of this list must be included in or attached to the file or record copy of the document.

C3.2.2. Special Cases

C3.2.2.1. If information is extracted from a document or section of a document classified by compilation, the derivative classifier will consult the explanation on the source document to determine the appropriate classification. If that does not

27 CHAPTER 3

provide enough guidance, the originator of the source document should be contacted for assistance.

C3.2.2.2. If the derivative classifier has reason to believe the classification applied to information is inappropriate, the classifier of the source document shall be contacted to resolve the issue. The information will continue to be classified as specified in the source document until the matter is resolved.

C3.2.2.3. If the activity originating the classified information no longer exists, the activity that inherited the functions of the originating activity is responsible for determining the action to be taken with respect to declassification. If the functions of the originating activity were dispersed to more than one other activity, the inheriting activity(ies) cannot be determined or, the functions have ceased to exist, the Senior Agency Official of the DoD Component of which the originating activity was a part, is responsible for determining the action to be taken with respect to classification.

28 CHAPTER 3

C4. CHAPTER 4

DECLASSIFICATION AND REGRADING

C4.1. GENERAL

C4.1.1. Policy. E.O. 12958 (reference (e)) provides that "information shall be declassified as soon as it no longer meets the standards for classification" established by the Order. It further states that, "in some exceptional cases, ....the need to protect...information [still meeting these standards] may be outweighed by the public interest in disclosure of the information, and in these cases the information should be declassified." It is DoD policy that information shall remain classified as long as:

C4.1.1.1. It is in the best interest of the national security to keep it protected;

and

C4.1.1.2. Continued classification is in accordance with the requirements of the E.O. (reference (e)). If DoD officials have reason to believe that the public interest in disclosure of information outweighs the need for continued classification, they shall refer the matter to the appropriate Senior Agency Official appointed in accordance with Section 5.6(c) of E.O. 12958, reference (e).

C4.1.2. Declassification Systems. E.O. 12958 (reference (e)) established four separate and parallel systems that can bring about the declassification of information:

C4.1.2.1. A system requiring the original classifier to decide at the time information is classified when it can be declassified:

C4.1.2.2. A system that will cause information of permanent historical value to be automatically declassified on the 25th anniversary of its classification unless specific action is taken to keep it classified;

C4.1.2.3. A system for reviewing information for possible declassification upon request; and

C4.1.2.4. A process for systematic review of information for possible declassification. The Heads of the DoD Components are responsible for ensuring the establishment and maintenance of declassification programs and/or plans to meet the requirements of this paragraph.

29 CHAPTER 4

C4.1.3. Declassification Authority

C4.1.3.1. Information may be declassified and downgraded by the Secretary of Defense, the Secretaries of the Military Departments, those officials who have been delegated Original Classification Authority in accordance with paragraph C2.2.2. of this Regulation, above, and officials who have been delegated declassification authority in accordance with subparagraph C4.1.3.2., below. The authority to declassify information extends only to information for which the specific official has classification, program, or functional responsibility.

C4.1.3.2. DoD Component heads may designate officials within their organizations to exercise declassification authority over specific types or categories of information. Categories of information may be as broad as all information originally classified by officials of the DoD Component. Classification authorities may designate members of their staffs to exercise declassification authority over information under their jurisdiction.

C4.1.3.3. Persons with declassification authority shall develop and issue declassification instructions to facilitate effective review and declassification of information classified under predecessor Executive Orders. These instructions may be in the form of separate guides, sections of classification guides, memoranda, etc.

C4.1.3.4. Declassification authority is not required for simply canceling or changing classification markings in accordance with instructions placed on a document, directions found in a security classification guide or declassification guide, or instructions received from a declassification authority.

C4.1.3.5. Special procedures for use in systematic and mandatory review of cryptologic information are at Appendix 4.

C4.1.4. Exceptions. None of the provisions of this Chapter apply to information classified in accordance with the Atomic Energy Act of 1954 (reference (o)), as amended (Restricted Data and Formerly Restricted Data).

C4.2. DECLASSIFICATION DECISIONS BY ORIGINAL CLASSIFIERS

C4.2.1. Requirement. Every time a designated original classification authority (OCA) classifies information, he or she must make a determination about the duration for which the classification will continue. This is an essential part of the original classification process.

30 CHAPTER 4

C4.2.2. The "10-Year Rule." At the time they classify an item of information, original classifiers shall:

C4.2.2.1. Attempt to determine a date within 10 years from the date of classification upon which the information can be automatically declassified. If that is not possible, they shall:

C4.2.2.2. Attempt to determine a specific event, reasonably expected to occur within 10 years, that can be set as the signal for automatic declassification of the…