Attachment A.1- CBP Information Security Handbook, Office of Professional Responsibility (OPR), HB 1400-04A.pdf

$$1

Information Security Handbook

Office of Professional Responsibility

HB 1400-04

July 2016

A

Foreword

The mission of the U.S. Customs and Border Protection (CBP) is to prevent terrorists and terrorist weapons from entering the United States and to facilitate the flow of legitimate trade and travel across our borders. CBP uses various types of restricted information to accomplish this mission, including classified national security information and sensitive but unclassified information. Protection of such information is of paramount importance; its disclosure to unauthorized individuals, whether deliberate or inadvertent, could result in varying degrees of damage to essential government programs and operations, persons both inside and outside of CBP, and the national security.

The CBP Information Security Handbook establishes CBP policy and guidance on the safeguarding and handling of classified national security information and sensitive but unclassified information throughout CBP. The policies and procedures identified herein are issued in compliance with federal law, executive order, and Department of Homeland Security (OHS) mandate concerning the protection of classified and sensitive information.

This handbook is intended for use by all CBP employees, contractors, and detailees. Its purpose is to guide CBP personnel in properly identifying, handling , and protecting classified and sensitive information that has been entrusted to them in the performance of their official duties and responsibilities.

Security of our critical information is the daily responsibility of all CBP personnel. The integrity of the CBP mission and the capacity to meet the organization's goals is dependent upon our constant vigilance and our ability to safeguard classified and sensitive information from compromise and misuse at the hands of our adversaries. As Component Chief Security Officer for CBP, I fully support the Office of Professional Responsibility in its program oversight activities of CBP's Information Security Program.

For questions or additional information, please contact the Office of Professional Responsibi lity, Security Management Division, Information Security Branch at CBP.Security@dhs.gov.

Assistant Commissioner, Office of Professional Responsibility Component Chief Security Officer U.S. Customs and Border Protection ii

Revision History

Periodic updates to this handbook will be published as necessary to comply with new or revised information security and classification management policies and procedures, including applicable executive orders, regulations, and agency guidance. All revisions will be identified and described in the table below.

Version Release Date Description of Change(s)

1.0 September 2015 Initial release.

1.1 July 2016 Replaced all references to “Office of Internal Affairs” and “IA” with “Office of Professional Responsibility” and “OPR,” respectively.

Moved general information regarding storage of Sensitive Compartmented Information from section 6.5 to introductory section of Chapter 6.

Incorporated changes to CBP policy requiring program offices that handle and store classified information to:

- Conduct annual security container inventories by

September 30 of every year (updated section 5.4, added section 6.11, and revised appendices C and D); and

- Conduct an inventory and turnover process on security containers following the departure of senior CBP officials who had access to such containers (added section 6.12 and Appendix E., Security Container Turnover Procedures).

Updated section 6.1.1 and 6.2 to comply with current Federal specifications for new purchases of combination locks and modified section 6.2 to clarify requirements for the storage of Top Secret information and include definition of Security-in-Depth.

Revised policy on the use of DHS Form 11000-10 (Report of Security Incident) (updated section 8.1 to include that the form is used for reporting security violations and infractions and modified section 8.3.3 to remove that the form is used to provide written statements).

Applied minor revisions to Appendix A., Classified Meeting Procedures Checklist.

Revised Appendix D., Responsibilities of the Classified Document Custodian, to clarify requirements for maintaining receipts of classified material.

iii

Table of Contents

1. Introduction

1.1. Purpose

1.2. Scope

1.3. Authorities

1.4. Responsibilities

1.5. Supersession

1.6. Contact Information

2. Classification Management

2.1. Original Classification Authority

2.2. CBP OCA Positions

2.3. Original Classification Process

2.4. Classification Levels

2.5. Classification Categories

2.6. Duration of Classification

2.7. Communicating Original Classification Decisions

2.8. Security Classification Guides

2.9. Classification Prohibitions

2.10. Classification by Compilation

2.11. Dissemination Controls

2.12. Tentative Classification

2.13. Reclassifying Previously Declassified Information

2.14. Records of Original Classification Actions

2.15. Classification Challenges

2.16. Raising the Classification Level

2.17. Derivative Classification

2.18. Declassification

2.19. Restricted Data/Formerly Restricted Data

2.20. Foreign Government Information

3. Marking Classified Information

3.1. Overall and Portion Markings

3.2. Original Classification Markings

3.3. Derivative Classification Markings

3.4. Working Papers

3.5. Transmittal Documents

3.6. Other Materials

iv

3.7. Declassification Markings

3.8. Email Messages

4. Access and Dissemination

4.1. Access and Dissemination Restrictions

4.2. Access to Classified Information

4.3. Dissemination of Classified Information

5. Custody and Accountability

5.1. Protection of Classified Information

5.2. Custody during Emergencies

5.3. Designated Security Officer and Classified Document Custodian

5.4. Accountability of Classified Information

5.5. Receipts for Classified Information Transmission

5.6. Reproduction of Classified Material

5.7. Destruction of Classified Material

5.8. End-of-Day Security Checks

6. Storage

6.1. Standards for Storage Equipment

6.2. Top Secret Information

6.3. Secret Information

6.4. Confidential Information

6.5. Open Storage

6.6. Identification of Security Containers

6.7. Protection of Classified Combinations

6.8. Access to Classified Combinations

6.9. Changing Combinations

6.10. Security Container Check Sheet

6.11. Annual Security Container Inventory

6.12. Security Container Turnover Process

6.13. Residential Storage

6.14. Security Containers Taken Out of Service

6.15. Storage in Foreign Countries

6.16. Computer Equipment and Removable Storage Media

7. Transmission and Transportation

7.1. Methods of Transmission and Transportation

7.2. Shipment of Freight

7.3. Preparation of Material for Transmission

v

7.4. Escorting or Hand-Carrying of Classified Material

7.5. Receipts

8. Security Incidents

8.1. Reportable Security Incidents

8.2. Incidents Involving Sensitive Compartmented Information

8.3. Preliminary Inquiry

8.4. Formal Investigation

8.5. Classified Spillage

8.6. Overseas Security Violations and Infractions

8.7. Other Agency Security Violations and Infractions

8.8. Sanctions

9. Industrial Security Program

9.1. Personnel Security Clearances

9.2. Facility Security Clearances

9.3. Contract Security Classification Specification (DD Form 254)

9.4. Processing Requirements

9.5. Classified Visits

9.6. Contract Reviews

10. Sensitive But Unclassified (For Official Use Only) Information

10.1. Categories of FOUO

10.2. Designation Authority

10.3. Duration of Designation

10.4. Marking

10.5. Handling Procedures

10.6. Dissemination and Access

10.7. Transmission

10.8. Storage

10.9. Destruction

10.10. Incident Reporting

11. Sensitive Security Information

11.1. DHS SSI Oversight Committee

11.2. Categories of SSI

11.3. Identification of SSI

11.4. Marking SSI

11.5. Duration of SSI

11.6. SSI Reviews

vi

11.7. SSI Challenges

11.8. Compliance Reviews and Self-Inspections

11.9. Access and Dissemination

11.10. Storage and Handling

11.11. Transmission

11.12. Destruction

11.13. CBP FOIA Review Process

11.14. Incident Reporting

12. Security Education, Training, and Awareness

12.1. Security Training

13. North Atlantic Treaty Organization (NATO) Information

13.1. Marking

13.2. Access

13.3. Accountability and Control

13.4. Storage

13.5. Transmission and Transportation

13.6. Destruction

13.7. Incident Reporting

14. Security Compliance Reviews and Self-Inspections

14.1. Compliance Review Procedures

14.2. Self-Inspections

14.3. Unannounced Reviews

14.4. External Reviews and Inspections

Appendix A. Classified Meeting Procedures Checklist .................................................... A-1 Appendix B. Sample Emergency Action Plan ................................................................... B-1 Appendix C. Responsibilities of the Designated Security Officer.................................... C-1 Appendix D. Responsibilities of the Classified Document Custodian ............................. D-1 Appendix E. Security Container Turnover Procedures .................................................... E-1 Appendix F. Inadvertent Disclosure Statement ................................................................ F-1 Appendix G. Abbreviations and Acronyms ....................................................................... G-1

1. Introduction

1.1. Purpose

This handbook implements Executive Order (E.O.) 13526, Classified National Security Information, and Department of Homeland Security (DHS) Instruction 121-01-011, Administrative Security Program. It establishes safeguarding, classifying, declassifying, and downgrading requirements for official information requiring protection in the interest of national security and defines procedures for the identification, handling, and protection of unclassified information that is sensitive in nature. The provisions of this handbook set forth the minimum security standards and safeguards to ensure the protection of classified and sensitive but unclassified information within the U.S. Customs and Border Protection (CBP).

1.2. Scope

This handbook is applicable to all persons who are permanently or temporarily employed by, assigned to, or detailed to CBP.

1.3. Authorities

• Public Law 80-235, National Security Act of 1947, as amended.

• Public Law 83-703, Atomic Energy Act of 1954, as amended.

• Public Law 96-456, Classified Information Procedures Act, October 1980.

• Public Law 107-71, Aviation and Transportation Security Act, November 2001.

• Public Law 107-295, Maritime Transportation Security Act of 2002, as amended.

• Public Law 107-296, Homeland Security Act of 2002.

• Title 49 U.S.C. § 114(r), Nondisclosure of Security Activities.

• E.O. 12829, National Industrial Security Program, January 6, 1993, as amended.

• E.O. 12968, Access to Classified Information, August 2, 1995, as amended.

• E.O. 13526, Classified National Security Information, December 29, 2009.

• E.O. 13549, Classified National Security Information Program for State, Local, Tribal, and Private Sector Entities, August 18, 2010.

• Title 6 C.F.R. § 7, Classified National Security Information, January 27, 2003, as amended.

• Title 32 C.F.R. § 2001, Classified National Security Information; Final Rule.

• Title 32 C.F.R. § 2004, National Industrial Security Program Directive No. 1.

• Title 49 C.F.R. § 1520, Protection of Sensitive Security Information.

• DHS Instruction 121-01-011, The Department of Homeland Security Administrative Security Program, April 2011.

• DHS Management Directive 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information.

• DHS Management Directive 11056.1, Sensitive Security Information (SSI).

• DHS Delegation No. 8100.5, Delegation of Original Classification Authority.

• CBP Directive No. 2130-016, Roles and Responsibilities for Internal Affairs Activities and Functions.

• TSA Management Directive 2810.1, SSI Policies & Procedures Handbook.

• DOD Manual 5220.22-M, National Industrial Security Program Operating Manual, February 2006.

1.4. Responsibilities

1.4.1. Commissioner, U.S. Customs and Border Protection

The Commissioner, CBP, collaborates with the DHS Chief Security Officer in recruiting and selecting the Component Chief Security Officer (CCSO) for CBP.

1.4.2. Assistant Commissioner, Office of Professional Responsibility

The Assistant Commissioner, Office of Professional Responsibility (OPR), as the designated CCSO, serves as the principal advisor to the Commissioner regarding CBP’s Information Security Program and ensures sufficient resources are in place to implement and manage the Information Security Program and the requirements of this handbook.

The Assistant Commissioner, OPR, also tasks the Director, OPR Security Management Division (SMD), with the responsibility to implement and manage the CBP Information Security Program.

1.4.3. Assistant Commissioners and the Chief, U.S. Border Patrol

Assistant Commissioners and the Chief, U.S. Border Patrol (or other officials as designated), are responsible for appointing, in writing, a primary and alternate Designated Security Officer (DSO) for each sector, field office, air and marine location, and program office (e.g., Office of Human Resources Management, Office of Administration, Office of International Affairs, Office of International Trade) that handles classified and sensitive but unclassified information, as well as a primary and alternate Classified Document Custodian (CDC) for locations where classified information is stored and processed.

1.4.4. Office of Professional Responsibility, Security Management Division

OPR/SMD oversees and administers CBP’s classification management and sensitive but unclassified information management programs and the Security Education, Training, and Awareness program. OPR/SMD also issues any necessary procedures required for the effective implementation of this handbook.

1.4.5. Office of Professional Responsibility, Personnel Security Division

The OPR Personnel Security Division (PSD) develops policies and procedures to guide the implementation and administration of the Personnel Security and Suitability program for CBP. OPR/PSD also renders employment suitability determinations and grants security clearances for access to classified national security information, as defined in the CBP Personnel Security Handbook, HB 1400-07A.

1.4.6. Office of Intelligence

The Office of Intelligence is responsible for managing CBP’s Sensitive Compartmented Information (SCI) program and granting SCI access to CBP personnel.

1.4.7. Office of Information and Technology

The Office of Information and Technology is responsible for managing CBP’s Communications Security (COMSEC) program, accrediting classified information systems, providing information technology security training, and managing CBP systems access requirements, as defined in the CBP Information Systems Security Policies and Procedures Handbook, HB 1400-05D.

1.4.8. Supervisors and Managers

Supervisors and managers must ensure that they and those they supervise are aware of the applicable provisions of this handbook and promote and ensure compliance by staff members. Supervisors and managers must ensure security training is provided upon initial assignment of an employee, detailee, or contractor and is reinforced periodically thereafter through routine office interaction, email reminders, staff meetings, and other office gatherings.

1.4.9. Designated Security Officers

DSOs must ensure that the procedures set forth in this handbook are followed within their respective area of responsibility. DSOs are responsible for providing assistance and support to regional CBP personnel and serve as liaisons to OPR/SMD for applicable matters relating to the implementation of and compliance with the provisions of this handbook.

1.4.10. Classified Document Custodians

CDCs are responsible for security containers within their respective office space, including combinations, document control, and container forms. CDCs must ensure that the movement of classified information outside of their office can be traced, dissemination is limited, prompt retrieval of information can be obtained, the loss of information can be detected, and excessive holding and reproduction of information is limited.

1.4.11. CBP Personnel

All CBP personnel, including employees, detailees, contractors, consultants, and others to whom access is granted, are responsible for protecting classified and sensitive but unclassified information from unauthorized disclosure. All personnel must be aware of and comply with the applicable provisions of this handbook and must report to the appropriate officials any incidents or violations that affect the safeguarding of classified and sensitive but unclassified information. Personnel must also ensure that their access to and sharing of classified and sensitive but unclassified information is in conjunction with the appropriate level of security clearance, an established need to know, and applicable laws, Federal regulations, and agency policies and procedures.

1.5. Supersession

This handbook supersedes the following:

• CBP Handbook 1400-02B, CBP Security Policy and Procedures Handbook, Information Security: Safeguarding Classified and Sensitive But Unclassified Information (Volume 4).

1.6. Contact Information

Questions or comments regarding this handbook may be addressed to OPR/SMD at CBP.Security@dhs.gov.

2. Classification Management The integrity of CBP’s classification management system is dependent upon the knowledge and judgment of CBP personnel who access, disseminate, store, and handle classified national security information. CBP officials involved in the classification process must comply with the standards cited in this handbook to ensure the integrity of the classification management system is maintained.

The Office of Professional Responsibility (OPR), Security Management Division (SMD) has program oversight of CBP’s classification management policies, processes, and procedures, as set forth in this handbook. OPR/SMD works closely with the Office of Intelligence (OI), which holds responsibility for the protection of Sensitive Compartmented Information in CBP.

2.1. Original Classification Authority

An original classification authority (OCA) is an official who is authorized, in writing, by the President, by an agency head, or by other officials delegated by the President, to make an initial determination to classify information for national security purposes.

The Secretary of Homeland Security has been delegated by the President as an OCA with the authority to classify eligible information up to and including the Top Secret level.

The Secretary can further delegate Top Secret original classification authority to additional DHS officials, pursuant to E.O. 13526. These delegations are identified in DHS Delegation No. 8100.5, Delegation of Original Classification Authority.

2.2. CBP OCA Positions

Within CBP, two positions have been delegated original classification authority at the Top Secret level: the Commissioner and the Assistant Commissioner, OI. CBP officials who have been delegated original classification authority cannot further delegate this authority; however, if an individual is exercising the authority of a designated position in an acting or interim capacity, that individual has the authority to classify eligible information.

OCAs at a specified clearance level are also authorized to classify information at lower levels.

The Commissioner may request additional OCA delegations when an operational need exists. Requests for OCA delegations are submitted to the DHS Office of the Chief Security Officer (OCSO), through the Assistant Commissioner, OPR, using DHS Form 11041-1 (Request for Delegation of Original Classification Authority). OCA delegation requests are based on justification of a demonstrated and continuing need for such authority.

CBP officials serving in OCA-delegated positions:

(a) Receive training on OCA responsibilities, methods, and procedures within 60 days of occupying a delegated position and at least once each calendar year thereafter.

This specialized training covers proper classification and declassification with an emphasis on the avoidance of over-classification. OPR/SMD is responsible for providing the training. OCAs must sign an acknowledgement that they have received and understand the training prior to taking any original classification action.

OCAs who do not receive the mandatory refresher training at least once within a calendar year will have their original classification authority suspended until completion of such training, unless a temporary waiver has been approved in writing by the Secretary or the DHS Chief Security Officer. Such waivers may not exceed 60 days from the date of issuance.

(b) Communicate original classification decisions through the publication of a security classification guide. When a decision cannot immediately be incorporated into a security classification guide, the decision must be indicated directly on the document as cited in section 3.2 of this handbook. Such decisions must be incorporated into a security classification guide within one year.

(c) Are encouraged to consult with OPR/SMD for assistance when classifying information.

2.3. Original Classification Process

Original classification is the initial determination that information requires protection against unauthorized disclosure in the interest of national security. Information is originally classified under the terms of E.O. 13526 if all of the following conditions are met:

(a) The information is owned by, produced by or for, or under the control of the U.S.

Government (Note: For purposes of this handbook, “control” means the authority of CBP to regulate access to the information.);

(b) The information falls within one or more of the categories of information listed in section 2.5 of this handbook and as defined in E.O. 13526;

(c) The OCA determines and can justify that the unauthorized disclosure of the information could reasonably be expected to cause damage to national security, and the OCA is able to identify or describe the damage; and

(d) The OCA classifies the information by determining the appropriate classification level, as defined in section 2.4 of this handbook, and the appropriate duration of classification, as defined in section 2.6 of this handbook.

If there is significant doubt about the need to classify information or at which level, it is not classified, or it is classified at a lower level.

2.4. Classification Levels

National security information that requires protection against unauthorized disclosure is classified by an OCA at one of the following three levels:

(a) Top Secret is applied to information, the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the OCA is able to identify or describe.

(b) Secret is applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the OCA is able to identify or describe.

(c) Confidential is applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the OCA is able to identify or describe.

2.5. Classification Categories

Information considered for classification must fall into one or more of the categories listed below. The indicator preceding each category is the category identifier defined in E.O. 13526, Section 1.4.

(a) Military plans, weapons systems, or operations;

(b) Foreign government information;

(c) Intelligence activities (including covert action), intelligence sources or methods, or cryptology;

(d) Foreign relations or foreign activities of the United States, including confidential sources;

(e) Scientific, technological, or economic matters relating to national security;

(f) U.S. government programs for safeguarding nuclear materials or facilities;

(g) Vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security; or

(h) The development, production, or use of weapons of mass destruction.

2.6. Duration of Classification

At the time of original classification, the OCA assigns a date or event at which time the information will be downgraded and/or declassified. Upon reaching the date or event, the information is automatically declassified except for information that would clearly and demonstrably be expected to reveal the identity of a confidential human source or key design concepts of a weapon of mass destruction. At the time of classification, the OCA attempts to:

(a) Determine a specific date or event within 10 years of the date of origination, upon which the information can be automatically declassified.

If that is not possible, the OCA attempts to:

(b) Assign a date 10 years from the date of origination at which time the information can be automatically declassified. Should the sensitivity of the information warrant classification beyond a 10-year period, the OCA assigns a date no longer than 25 years from the date of origination at which time the information will be automatically declassified, unless it is reclassified.

No information remains classified indefinitely. Information marked for an indefinite duration of classification under predecessor orders (e.g., information marked as “Originating Agency’s Determination Required”) or classified information that contains incomplete declassification instructions or lacks declassification instructions is declassified in accordance with section 2.18 of this handbook.

Except for information that clearly and demonstrably reveals a confidential human source or reveals key design concepts of a weapon of mass destruction, which may be classified for up to 75 years, an OCA cannot classify information beyond 25 years unless such information has been specifically approved for exemption from declassification, pursuant to E.O. 13526.

2.7. Communicating Original Classification Decisions

Classification decisions made by an OCA must be communicated through a security classification guide. When a decision cannot immediately be incorporated into a security classification guide, the decision is indicated directly on the document. These decisions must be incorporated into a security classification guide within one year.

2.8. Security Classification Guides

A classification guide is a documentary form of classification decisions issued by an OCA. The guide identifies the elements of information regarding a specific subject that are classified and establishes the level and duration of classification for each element.

CBP offices and/or programs that develop originally classified information must coordinate the development of security classification guides with OPR/SMD and OI.

Classification guides must be approved and signed by an OCA and must adhere to the standard DHS format. OPR/SMD will submit final copies of CBP classification guides to the DHS OCSO Administrative Security Division (ASD). For additional guidance on preparing security classification guides, see DHS’s A Guide for Writing a DHS Security Classification Guide, which covers this topic in detail.

Individuals using classification guides to classify documents do not need to have original classification authority. Appropriately trained and certified CBP personnel who generate information that requires classification based on a classification guide may “classify” the information by citing the applicable authority listed in the guide and applying the classification level specified in the guide. This action is considered derivative classification from a classification guide.

2.9. Classification Prohibitions

Under no circumstances may information be classified, continue to be maintained as classified, or fail to be declassified in order to:

(a) Conceal violations of law, inefficiency, or administrative error;

(b) Prevent embarrassment to a person, organization, or agency;

(c) Restrain competition; or

(d) Prevent or delay the release of information that does not require protection in the interest of national security.

2.10. Classification by Compilation

Compilation of items of information that are individually unclassified may be classified under the following circumstances:

(a) The compilation reveals an additional association or relationship that meets the standards and criteria for classification under E.O. 13526.

(b) The additional association or relationship is not otherwise evident or revealed in the individual items of information.

(c) The information is classified by an OCA.

In these instances, the additional association or relationship is what is considered for classification, not the individual items of unclassified information. Careful consideration must be taken when determining the need for classification by compilation. When the determination is made that classification by compilation is necessary, the OCA must provide explicit instructions as to which elements of the compilation, when combined, require classification and the additional association or relationship that warrants the classification.

OPR/SMD and OI will provide assistance in determining whether information should be classified by compilation.

2.11. Dissemination Controls

OCAs may further associate one or more of the following dissemination controls with their classification decisions:

(a) NOFORN (Not Releasable to Foreign Nationals)

Classified information is not shared with non-U.S. entities unless permitted by the originator. In cases where the OCA has determined that there are no possible circumstances or situations in which the information may be shared with a foreign government, the information must be designated NOFORN to preclude sharing requests. OCAs must carefully consider the consequences of applying the NOFORN designation to information.

(b) ORCON (Originator Controlled)

The application of the ORCON designation requires that further dissemination beyond the headquarters and specified sub-elements of the recipient organization be coordinated with the originating office. For any information that is designated ORCON, the OCA tracks all dissemination of the information. OCAs must carefully consider the consequences of applying the ORCON designation to information.

(c) REL (Releasable to)

The application of REL, followed by the applicable Controlled Access Program Coordination Office (CAPCO)-approved trigraph or tetragraph, indicates that information has been approved to be releasable to the countries or organizations listed. Where applicable, the designation of REL must be done in coordination with the appropriate Foreign Disclosure Office through OPR/SMD.

(d) RELIDO (Release Determined by Foreign Disclosure Official)

The application of the RELIDO marking indicates that the OCA has approved the information to be releasable to foreign countries or organizations at the discretion of an authorized foreign disclosure official.

(e) PROPIN (Caution – Proprietary Information Involved)

The PROPIN marking is used to identify information provided by a commercial firm or private source under an express or implied understanding that the information will be protected as a proprietary trade secret or proprietary data believed to have actual or potential value. This marking may be used on government proprietary information only when the information can provide a contractor an unfair advantage, such as U.S. government budget or financial information. Information marked PROPIN is not disseminated to contractors regardless of their status without the explicit authorization of the provider of the information.

2.12. Tentative Classification

If an individual develops information believed to require classification, the individual must safeguard and mark the information in the manner prescribed for its intended classification level. Additionally, the notation “TENTATIVELY CLASSIFIED PENDING AN ORIGINAL CLASSIFICATION DECISION” must be marked prominently and conspicuously on the bottom of each page.

A request for a classification decision must be submitted to the appropriate CBP OCA by a means approved for the intended level of classification, as described in section 7.1 of this handbook. The OCA must notify the sender of a classification determination within 30 days of receiving the request. OPR/SMD will provide guidance as needed to determine the appropriate OCA with subject matter interest.

2.13. Reclassifying Previously Declassified Information

Information may not be reclassified after it has been declassified and released to the public under proper authority unless:

(a) The Secretary approves the reclassification, in writing, based on a document-by-document review and determination that the reclassification is required to prevent significant and demonstrable damage to national security.

(b) The released information may be reasonably recovered and brought back under DHS control without bringing undue attention to it.

(c) The reclassification action is reported within 30 days to the Assistant to the President for National Security Affairs and the Director, Information Security Oversight Office

(ISOO).

(d) The Archivist is notified and reclassification is approved by the Director, ISOO, if the information is in the physical custody of the National Archives and Records Administration (NARA) and has been available for public use.

(e) The recipients or holders of the reclassified information who have current security clearances are appropriately briefed about their continuing legal obligations and responsibilities to protect this information from unauthorized disclosure. The recipients or holders who do not have security clearances are, to the extent practicable, appropriately briefed about the reclassification of the information to which they have had access, reminded of their obligation not to disclose the information, and requested to sign an acknowledgement of this briefing.

2.14. Records of Original Classification Actions

Personnel performing original classification actions must maintain a record of each action taken. For originally classified information, the record must include the total number of documents originally classified, by classification level and by declassification date.

Records of original classification actions are counted by document, not by page, and each document must be reported by its overall classification level. For example, a newly created originally classified document consisting of multiple pages and containing both Secret and Confidential information is counted and reported as one originally classified document at the Secret level.

Reports must be submitted annually to OPR/SMD. OPR/SMD will submit one component report to DHS OCSO as part of the annual reporting requirements defined in E.O. 13526 and DHS Instruction 121-01-011.

2.15. Classification Challenges

Authorized holders of classified information who, in good faith, believe a classification status is improper, are encouraged and expected to challenge the classification status.

Classification challenges are presented to the classifier of the information. When necessary, assistance and/or anonymity in processing a classification challenge can be obtained by processing the challenge through OPR/SMD. In accordance with E.O.

13526, individuals submitting a classification challenge are not subject to retribution of any kind for bringing such actions.

The OCA receiving the challenge must provide a written response with a classification/declassification decision to the challenger within 60 days of receipt. The individual submitting the challenge has a right to appeal the decision to the Interagency Security Classification Appeals Panel (ISCAP). OPR/SMD will assist with appeals as needed.

Challenged information remains classified and must be protected at its highest level of classification until a final classification determination is made by an appropriate OCA.

2.15.1. Informal Classification Challenges

Classification challenges do not prohibit an authorized holder from informally questioning the classification of information through direct and informal contact with the classifier.

When appropriate or when uncertainties exist over the classification status, holders of classified information are encouraged to make direct contact with the classifier to obtain clarification. When a change in classification results from an informal challenge, the challenger must ensure that the official from whom the change was received is authorized to make such a change, and a record of the change, to include the official’s name, position, agency, and date must be maintained with a file copy of the document.

The OCA making the decision is responsible for notifying holders of the change in classification.

2.15.2. Formal Classification Challenges

Formal challenges to classification must be presented in writing to an OCA having jurisdiction over the challenged information. Every effort should be made to keep the written correspondence unclassified. However, if the challenge includes classified information, it must be marked and safeguarded accordingly. The written correspondence must sufficiently describe the information being challenged and must consist of only questions as to why the information is classified and why it is classified at a particular level.

2.16. Raising the Classification Level

Classified information may be raised to a higher level of classification only by officials who have been delegated the appropriate level of original classification authority and have cognizance over the information. Action may be taken to raise the level of classification only if holders of the information can be notified of the change so that the information is uniformly protected at the higher level. The OCA making the decision is responsible for notifying holders of the change in classification.

2.17. Derivative Classification

Derivative classification is the process of incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Derivative classification also includes the classification of information based on guidance provided in a security classification guide.

Restricted Data/Formerly Restricted Data (RD/FRD) derivative classification requires completion of the Department of Energy-approved Restricted Data Derivative Classifier course. This course is offered by the DHS OCSO/ASD Training Branch. For more information on RD/FRD, refer to DHS Instruction 121-01-011, Chapter 6 (Restricted Data and Formerly Restricted Data).

2.17.1. Derivative Classification Authority

Derivative classification authority is tied to an individual or position that has an official need to derivatively classify information. Before being authorized to derivatively classify information, the individual must be identified, trained, and certified based on established DHS standards.

(a) Identification

Supervisors and managers must identify those individuals or positions over which they have cognizance who have a need to derivatively classify information and submit the names of those individuals in writing to OPR/SMD to coordinate training.

All individuals with access to classified systems (e.g., Homeland Secure Data Network (HSDN) and/or Joint Worldwide Intelligence Communications System (JWICS) accounts) must be identified as derivative classifiers.

(b) Training

CBP employees who are identified as derivative classifiers must receive initial and refresher training on proper derivative classification, to include the avoidance of over-classification. Derivative classifiers are required to receive refresher training at least once every two years and to report all such training to OPR/SMD upon completion in order to retain their derivative classification authority.

(c) Certification

Prior to certification as a derivative classification authority, individuals must demonstrate that they are aware of proper derivative classification procedures and markings through the completion of training approved by DHS OCSO/ASD.

Certifications are valid for up to two years throughout DHS. Upon expiration of certification, individuals may not derivatively classify information until they are recertified through refresher training. A waiver, not to exceed 60 days, may be granted by the Assistant Commissioner, OPR, through OPR/SMD, depending upon operational circumstances.

Personnel may be required to complete remedial training and recertification and/or may have their derivative classification authority revoked by the Assistant Commissioner, OPR, for failure to properly protect classified information resulting in a security infraction or violation.

2.17.2. Use of Personal Identifiers

CBP employees who have been appropriately trained and certified as derivative classifiers may use a personal identifier in lieu of their name and position on derivatively classified documents they create. Personal identifiers are made up of a series of numbers and letters and are unique to each individual. Personal identifiers are generated through the Integrated Security Management System (ISMS) and will be provided to derivative classifiers upon successful completion of the required training.

2.17.3. Derivative Classification Applications

When applying derivative classification markings:

(a) Classification markings cited on the source or in a security classification guide must be respected and carried forward to the newly created document.

(b) All applicable classification markings, declassification instructions, handling instructions, and the identity of the derivative classifier (by name and position or by personal identifier) must be placed on the newly created material.

(c) Markings must be applied according to the requirements of E.O. 13526, 32 C.F.R. § 2001, and the guidance provided in the ISOO booklet, Marking Classified National Security Information. These requirements and any supplemental markings must be implemented in accordance with Chapter 3 of this handbook and current CAPCO standards.

(d) Questions on the classification markings as they appear on the source or in a security classification guide must be referred to the originator. Refer to section 2.15 of this handbook for information regarding classification challenges.

(e) If practical, where classified information constitutes a small portion of an otherwise unclassified document, the derivative classifier must use a classified addenda or prepare a product in unclassified form to allow for maximum dissemination.

Questions about derivative classification markings may be addressed to OPR/SMD or to the appropriate Designated Security Officer for coordination with OPR/SMD.

2.17.4. Records of Derivative Classification Actions

Personnel performing derivative classification must maintain a record of each action taken. For derivatively classified documents, the record must include the total number of documents derivatively classified, by classification level.

Records of derivative classification actions are counted and reported by document, not by page. In addition, each document must be counted by its overall classification level.

For example, a newly created derivatively classified document consisting of multiple pages and containing both Secret and Confidential information is counted and reported as one derivatively classified document at the Secret level.

OPR/SMD collects the required information for CBP’s respective areas based on guidance provided by DHS OCSO. OPR/SMD submits one component report to DHS OCSO as part of the annual reporting requirements defined in DHS Instruction 121-01-011. As required by E.O. 13526, DHS combines the input of all components into a single DHS report using the Standard Form (SF) 311 (Agency Security Classification Management Program Data). DHS submits the completed SF-311 to ISOO as a report of the classification activity that occurred within the agency during the preceding fiscal year.

2.18. Declassification

In accordance with DHS policy, information will remain classified as long as it is in the best interest of the national security to keep it protected and the information continues to meet the classification requirements of E.O. 13526. CBP classified information, to include legacy U.S. Customs Service and U.S. Immigration and Naturalization Service information, must be declassified as soon as it no longer meets the standards for classification under E.O. 13526.

Before reviewing classified records for declassification, CBP personnel must coordinate with the CBP Records Manager to ensure that appropriate procedures are established for maintaining the integrity of the records and to ensure that NARA receives accurate information about CBP declassification actions when records are transferred to NARA.

CBP personnel who have reason to believe that the public interest in disclosure of information outweighs the need for continued classification must refer the matter to OPR/SMD. OPR/SMD will further coordinate with the appropriate OCA or the DHS Chief Security Officer for an assessment and determination on whether declassification is appropriate.

None of the provisions cited in this chapter apply to information classified in accordance with the Atomic Energy Act of 1954, as amended (RD/FRD), or North Atlantic Treaty Organization (NATO) classified information.

2.18.1. Declassification Authority

Information may be declassified or downgraded by:

(a) The Secretary of Homeland Security;

(b) The DHS Chief Security Officer;

(c) The official who authorized the original classification if that official is still serving in the same position and has original classification authority, his or her current successor in function provided the successor is a delegated OCA, or a supervisory official of either provided the official is a delegated OCA; and

(d) CBP declassification authorities delegated in writing by the Secretary or the DHS Chief Security Officer.

i. The authority to declassify or downgrade information extends only to information for which the official has classification, program, or functional responsibility.

ii. CBP officials with declassification authority must develop and issue declassification guides, at the request and approval of ISCAP, to facilitate effective review and declassification of CBP information (which includes legacy U.S. Customs Service and U.S. Immigration and Naturalization Service information) not previously covered by a classification or declassification guide, and for information exempt from automatic declassification.

iii. Declassification authority is not required for simply canceling or changing classification markings in accordance with declassification or downgrading instructions cited on a document, directions found in a security classification guide or declassification guide, or instructions received from an OCA or declassification authority.

Classified information that has been declassified without proper authority, as determined by an OCA with jurisdiction over the information, remains classified, and administrative action must be taken to restore markings and controls, as appropriate. All such instances must be reported to DHS OCSO/ASD for notification to ISOO.

2.18.2. Extension of Classification

If an OCA with jurisdiction over the information does not extend the classification of information that has been assigned a specific date or event for declassification, and the information does not contain classified equities of another agency, the information is automatically declassified upon the occurrence of the date or event.

If an OCA has assigned a date or event for declassification that is less than 25 years from the date of origin, an OCA with jurisdiction over the information may extend the classification duration of such information for a period not to exceed 25 years from the date of classification.

Decisions to extend classification must take into account the potential difficulty of notifying holders of the extension, including the possible inability to ensure continued, uniform protection of the information. Officials who make a determination to extend a declassification date are responsible for notifying holders of the information of the decision and for providing a new date and instructions for declassification.

2.18.3. Automatic Declassification of Permanent Historical Records

E.O. 13526 mandates that information contained within permanently valuable historical records (as defined by Title 44, U.S.C.) be automatically declassified 25 years from the date of origin of the document. All classified records are automatically declassified on December 31 of the year that is 25 years from the date of origin, except where such information has been exempted from automatic declassification at 25 years.

2.18.4. Exemption from Automatic Declassification

(a) Information not contained in a file series

The Secretary or the DHS Chief Security Officer may propose to exempt specific information not otherwise contained in an exempted file series from automatic declassification. Such information may be exempted from automatic declassification only if its release could be expected to:

i. Reveal the identity of a confidential human source or a human intelligence source, a relationship with an intelligence or security service of a foreign government or international organization, or a non-human intelligence source; or impair the effectiveness of an intelligence method currently in use, available for use, or under development;

ii. Reveal information that would assist in the development, production, or use of weapons of mass destruction;

iii. Reveal information that would impair U.S. cryptologic systems or activities;

iv. Reveal information that would impair the application of state-of-the-art technology within a U.S. weapon system;

v. Reveal U.S. military war plans that remain in effect, or reveal operational or tactical elements of prior plans that are contained in such active plans;

vi. Reveal information, including foreign government information, that would cause serious harm to relations between the United States and a…