Attachment H CONTROLLED UNCLASSIFIED INFORMATION (CUI) GUIDE.pdf

DISTRIBUTION A: Approved for public release - distribution unlimited

Controlled Unclassified Information Guide

Program: Novel Orbital and Moon Manufacturing, Materials and

Mass-efficient Design (NOM4D)

Program Manager: William Carter, Ph.D.

Program Security Officer: Michael D. Langerman

Defense Advanced Research Projects Agency

Security and Intelligence Directorate

675 North Randolph Street

Arlington, VA 22203

Date: February 12, 2021

Version: 1.0

William Carter, Ph.D. Michael D. Langerman

DSO Program Manager Program Security Officer

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATEGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE of CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

FOREWORD

1. DESCRIPTION

The Novel Orbital and Moon Manufacturing, Materials, and Mass-efficient Design

(NOM4D) program will provide the foundational proof of concept that new materials science, manufacturing, and design technologies can be brought together to enable future structures to be produced in their native environments without the constraints imposed by launch. In addition, this program will also explore opportunities to leverage existing materials on the moon (e.g., regolith) as a resource for future operations. Future manufacturing in space will enable substantial improvements (3-5x) in on-orbit structural efficiency, size, and resiliency. The NOM4D program will enable these substantial gains in efficiency, size, and resilience through development of materials and architectures designed specifically for orbital or lunar needs and designs that significantly reduce the added margin and complexity associated with ground testing, launch survival, and deployment for traditional space systems.

The program is divided into two technical areas:

• Technical Area 1 (TA1): In-space material and manufacturing, to develop new materials and manufacturing processes that enable DoD capability in two focus areas (FAs): FA1 – Large Precision Structures which require high specific stiffness, large net-shape forming, and scalable manufacturing techniques; and

FA2 – Lunar Operations which requires new techniques for regolith reformation, extraction of high quality feedstock, and approaches for composing lunar aggregates with minimal added mass.

• Technical Area 2 (TA2): Design for precision on-orbit and lunar operation, to identify and mature designs that enable ultra-high mass efficiency, nonlinear architectures that passively stabilize sparse structures, and uncertainty-tolerant real-time design refinement

Open source exemplar problems will be used during the program to demonstrate the viability of the approach for future maturation. The exemplar problems are: Phase I megawatt (MW)-class solar power arrays, Phase II >100m diameter RF reflector antennas, and Phase III scalable longwave infrared (LWIR) optical systems. By focusing on technology development that enables these general applications, future DoD capabilities can be optimized for efficient operation both in traditional orbits as well as new orbits (e.g., beyond GEO) and on the moon.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

Unlimited.

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of NOM4D information IAW

DoDI 5200.48. NOM4D information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST).

Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in Executive

Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support NOM4D. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with NOM4D. As defined at 32 CFR

Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of NOM4D, in compliance with Executive Orders and related

DoD guidance. The scope of this guide is based on NOM4D as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of NOM4D.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at DSO_Security@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at DSO_Security@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. NOM4D critical information falls under the following index of CUI :

1) Defense

2) Provisional

6. CUI CATEGORIES

a. Defense: Controlled Technical Information (CTI). This category relates to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information would meet that criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution

Statements on Technical Documents.

With regard to NOM4D, in the following subsections a system is considered a “specific space or lunar asset” if it includes: concept of operations (quantitative and qualitative system characteristics described to stakeholders) or system requirements (e.g. specific bandwidth, focal length, resolution, etc.). Accordingly, designs, processes, and performance are considered

“specific” if they are exact, detailed, and/or otherwise would ordinarily be protected as proprietary or trade secrets.

Research, designs and solutions associated with the exemplar problems are not considered CTI.

As stated in section 1, the exemplar problems are open source generic challenges that are not directly relatable to a specific system.

b. Provisional: Operations Security Information. This category relates to unclassified information that could constitute an indicator of U.S. Government intentions, capabilities, operations, or activities or otherwise threaten/compromise operations security.

7. EXPORT CONTROL RESTRICTED INFORMATION

a. Not Applicable

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for NOM4D are listed below; however other exemptions could apply:

1) Exemption 3 – Protects information exempted from release by statute.

9. DISCLOSURE of CUI.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65; DoD Instructions 5230.09 and

5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07; as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this

Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the

PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, SID, who is the Foreign Disclosure Officer for DARPA.

10. CUI PROTECTION REQUIREMENTS

a. NOM4D CUI (e.g., confidential business information, PII, technical data, etc.) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. CUI may only be processed on DIB systems that are compliant with DFARS 252.204-

7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the NOM4D PSO and PSR at DSO_Security@darpa.mil .

b. Data breaches of DIB networks and systems involving NOM4D CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

13. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the NOM4D effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at DSO_Security@darpa.mil .

Element of

Information

Index Category Reason LDC or

Distribution

Statement

Remarks

Budget Financial Budget FAR 2.101 and

3.104

Federal employees Only

(FED ONLY)

FOIA Exemption 5 may be applicable.

Pre-decisional Provisional Operations

Security (OPSEC)

DoDI 5230.24 Federal employees Only

(FED ONLY)

FOIA Exemption 5 may be applicable.

Application of technology developed in exemplar problems when applied to specific space or lunar asset

Defense Controlled

Technical

Information (CTI)

DFARS

252.204.7012 and DoDI

5230.24

DISTRO C FOIA Exemption 3 may be applicable.

Material architectures, designs and manufacturing techniques of

NOM4D technology developed in exemplar problems when applied to a specific space or lunar asset

Defense Controlled

Technical

Information (CTI)

DFARS

252.204.7012 and DoDI

5230.24

Modeled, predicted or measured performance characteristics of

NOM4D technology

(system, subsystem or component) developed in exemplar problems when applied to a specific space or lunar asset

Defense Controlled

Technical

Information (CTI)

DFARS

252.204.7012 and DoDI

5230.24

Effectiveness of

NOM4D technology when applied to a specific space or lunar asset

Defense Controlled

Technical

Information (CTI)

DFARS

252.204.7012 and DoDI

5230.24

Vulnerability of

NOM4D technology when applied to a specific space or lunar asset

Defense Controlled

Technical

Information (CTI)

DFARS

252.204.7012 and DoDI

5230.24

NOM4D designs or manufacturing techniques protected by the company as proprietary

Proprietary

Business

Information

General Proprietary

Business

Information

(PROPIN)

18 USC 1905

29 USC 664

Dissemination

List Controlled

(DL ONLY)

FOIA Exemption 4 may be