Attachment_H_CONTROLLED_UNCLASSIFIED_INFORMATION__CUI__GUIDE.pdf

Distribution Statement “A” (Approved for Public Release, Distribution Unlimited)

Controlled Unclassified Information Guide

Program: Science of Atomic Vapors for New Technologies (SAVaNT) & SAVaNT Expansion: Enhancing Quantum Sensor Technologies with Rydberg

Atoms (EQSTRA) Program Manager: Mukund Vengalattore, Ph.D.

Program Security Officer: Darrell Shelton

Date: May 22, 2024

Version: 3.0

Mukund Vengalattore Darrell Shelton DSO Program Manager DSO Program Security Officer ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATEGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE OF CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

12. HORIZONTAL SECURITY PROTECTION

13. INFORMATION PROTECTION GUIDANCE CHARTS

iii

FOREWORD

1. DESCRIPTION

The Science of Atomic Vapors for New Technologies (SAVaNT) program is a quantum sensing program that will focus on improving coherence of atomic vapors in the presence of thermal effects, establishing the foundation for future room-temperature (RT), low-SWaP (Size, Weight, and Power) robust sensors. A central goal of the SAVaNT program is to develop compact sensor platforms that push the performance limits of thermal atomic vapor sensors to the quantum limits while retaining low-SWaP, RT operability. SAVaNT contains three Technical Areas (TAs): TA1: Rydberg Electrometry; TA2: Vector Magnetometry; and TA3:

Vapor Quantum Electrodynamics. The SAVaNT program expansion, Enhancing Quantum Sensor Technologies with Rydberg Atoms (EQSTRA), seeks to augment ongoing efforts within the program to advance the performance, capabilities, and application landscape of Rydberg-vapor technologies for quantum information science (QIS), quantum-enhanced electrometry, imaging, and communications.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

Approved for public release - distribution unlimited.

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of SAVaNT and program expansion EQSTRA information IAW DoDI 5200.48. SAVaNT and EQSTRA information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST). Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in Executive

Order 13526, but it identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein, as well as the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR).

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support SAVaNT and EQSTRA. This guide should be cited as the basis for identifying, protecting, and marking of information and material designated as a type of controlled unclassified information (CUI) associated with SAVaNT and EQSTRA. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of the program, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on SAVaNT and EQSTRA as planned at the date of this guide and may expand or change as strategic decisions are made over the course of SAVaNT or EQSTRA.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at DSO_Security@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at DSO_Security@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. SAVaNT and EQSTRA critical information fall under the following index of CUI:

1) Defense

2) Export Control

3) Proprietary

6. CUI CATEGORIES

a. Defense: Controlled Technical Information (CTI). This category relates to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information would meet that criterion, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. See “Clarifying Guidance for Marking and Handling Controlled Technical Information in accordance with Department of Defense Instruction 5200.48, “Controlled Unclassified Information.” for examples of CTI.

b. Export Controlled: Export controlled Research (EXPT). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations, and the munitions list; license applications;

and sensitive nuclear technology information. This category relates to the systematic investigation into and study of materials and sources to establish facts and reach new conclusions.

c. Proprietary Business Information/General Proprietary Business Information

(PROPIN). Material and information related to, or associated with, a company’s products, business, or activities, including but not limited to financial information; data or statements;

trade secrets; product research and development; existing and future product designs and performance specifications.

7. EXPORT CONTROL RESTRICTED INFORMATION

a. SAVaNT and its expansion EQSTRA contain both applied research (TAs 1 and 2) and fundamental research (TA 3), and only benchtop proof-of-principle systems will be developed in the program. TA 2 is focused on development of highly sensitive magnetometer devices based on optically-addressed atomic spins. If such magnetometer devices with sensitivities of <20 pT /√Hz (rms) at 1 Hz were to be developed then they would be subject to export control restrictions under Export Administration Regulation 6A006.a.2: Sensors and Lasers (Category 6), “Magnetometers” and subsystems (6A006a), “‘Magnetometers’ using optically pumped or nuclear precession (proton/Overhauser) ‘technology’ having a ‘sensitivity’ lower (better) than 20 pT (rms) per square root Hz at a frequency of 1 Hz” (a.2).

b. Each performer must determine and assert the export controls (either Export

Administration Regulations or International Traffic in Arms Regulations) relevant to their project and communicate that assertion to their contracting agent and to the DARPA Program Manager. If performer produces export controlled information the following disclaimer must be on cover page of documents: “WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979, as amended (Title 50, U.S.C., App. 2401 et seq.). Violations of these export laws are subject to severe criminal penalties.”

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for the program are listed below; however other exemptions could apply:

a. Exemption 3 – Protects information exempted from release by statute.

b. Exemption 4 – Protects trade secrets and commercial or financial information which could harm the competitive posture or business interests of a company.

c. Exemption 5 – Protects the integrity of the deliberative or policy-making processes withing the agency by exempting from mandatory disclosure opinion, conclusions, and recommendations included within inter-agency or intra-agency memoranda or letters.

9. DISCLOSURE OF CUI.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, SID, who is the Foreign Disclosure Officer for DARPA.

10. CUI PROTECTION REQUIREMENTS

a. SAVaNT and EQSTRA CUI (e.g., confidential business information, personally identifiable information, proprietary business information, unclassified controlled technical information) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. CUI may only be processed on DIB systems that are compliant with DFARS 252.204- 7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the program PSO and PSR at DSO_Security@darpa.mil.

b. Data breaches of DIB networks and systems involving SAVaNT or EQSTRA CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

12. HORIZONTAL SECURITY PROTECTION

The following results were derived from relevant security classification guides through the course of horizontal security protection research.

Quantum Science – Technology Area Protection Plan (TAPP) DARPA Magnetic Sensing, DARPA-CG-839

13. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the SAVaNT and EQSTRA effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at DSO_Security@darpa.mil.

Element of Information

Index Category Reason LDC or Distribution Statement

Remarks

Budget (overall DARPA program budget)

Financial Budget FAR 2.101 and 3.104

Federal employees Only

(FED ONLY)

FOIA Exemption 5 may be applicable.

Techniques for intercepting specific DoD waveforms or signals

Defense Controlled Technical Information (CTI)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C

Electric field sensors capabilities for specific DoD applications

Defense Controlled Technical Information (CTI)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C

Prototype devices that can be used as part of a communications system

Defense;

Proprietary Business Information

Controlled Technical Information (CTI);

General Proprietary Business Information

(PROPIN)

DFARS

252.204.7012 and DoDI 5230.24;

18 USC 1905, 29

USC 664

DISTRO F FOIA Exemption 3 may be applicable.

FOIA Exemption 4 may be

Vector magnetometry capabilities for specific DoD applications

Defense Controlled Technical Information (CTI)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C

Prototype devices that can be used as part of a sensor system

Information

Controlled Technical Information (CTI);

General Proprietary Business Information

(PROPIN)

DFARS

252.204.7012 and DoDI 5230.24;

18 USC 1905, 29

USC 664

Future applications of underwater detection of magnetic signatures

Information

Controlled Technical Information (CTI);

General Proprietary Business Information

(PROPIN)

DFARS

252.204.7012 and DoDI 5230.24;

18 USC 1905, 29

USC 664

Technical information regarding magnetometers exceeding EAR 6A006.a.2

Export Control

Export Controlled

(EXPT)

Export Controlled Research (EXPTR)

15 CFR 734.8(b) DISTRO C FOIA Exemption 3 may be

EAR 6A006.a.2