AFI31-401.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE INSTRUCTION 31-401

1 NOVEMBER 2005

Incorporating Change 1, 19 August 2009

Security

INFORMATION SECURITY

PROGRAM MANAGEMENT

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at www.e-publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: HQ USAF/XOS-FI Certified by: HQ USAF/XO

(Lt Gen Carrol H. Chandler)

Supersedes: AFI 31-401, 1 November 2001

Pages: 91

This publication implements Air Force Policy Directive (AFPD) 31-4, Information Security. It prescribes and explains how to manage and protect unclassified controlled information and classified information. Use this instruction with Executive Order (EO) 12958, as amended, Classified National Security Information, 25 March 2003; Office of Management and Budget

(OMB), Information Security Oversight Office (ISOO) Directive Number 1, Classified National

Security Information, Executive Order 12829, National Industrial Security Program (NISP), DOD Manual 5220.22, National Industrial Security Program Operating Manual, January 1995;

and, Department of Defense (DOD) 5200.1-R, Information Security Program, 14 Jan 97, for the management of the Air Force Information Security Program. Additional references include DOD Instruction (DODI) 5240.11, Damage Assessments, 23 Dec 91; DOD Directive

(DODD) 5210.83, Unclassified Controlled Nuclear Information (UCNI), 15 Nov 91; Air Force

Policy Directive (AFPD) 31-4, Information Security. This instruction is applicable to contractors as prescribed in AFI 31-601, Industrial Security Program. All these references are listed at the end of each paragraph where applicable. This instruction is not to be used as a stand-alone document. HQ USAF/XOS-F is delegated approval authority for revisions to this AFI.

SUMMARY OF CHANGES

This interim change reflects new requirements for management of the Information Security

Program at all echelons; transfers responsibility for Unclassified Controlled Nuclear Information;

reflects the transfer of Information Security Program Manager (ISPM) duties and responsibilities http://www.e-publishing.af.mil/

2 AFI31-401 1 NOVEMBER 2005

from the Chief, Security Forces or installation security official to the Chief of Information

Protection at MAJCOM and installation levels and codifies staff office changes from that action;

updates locations possible for overnight delivery of Secret information in urgent cases; updates references and deletes terms not used in the text; updates glossary of references and supporting information (Attachment 1); updates transmission procedures for unclassified controlled nuclear information (Attachment 2); deletes use of United States Postal System registered mail or

Express Mail to transfer Secret or Confidential material (Attachment 4). An asterisk (|) indicates newly revised material.

Chapter 1—POLICY AND PROGRAM MANAGEMENT 5

1.1. Policy

1.2. Philosophy

1.3. Program Management

1.4. Oversight

1.5. Special Types of Information

1.6. Waivers

1.7. Reporting Requirements

1.8. Administrative Sanctions

1.9. Self-Inspection

Chapter 2—ORIGINAL AND DERIVATIVE CLASSIFICATION 12

2.1. Original Classification Authority (OCA)

2.2. Original Classification

2.3. Derivative Classification

2.4. Classification Prohibitions and Limitations

2.5. Classification Challenges

2.6. Security Classification/Declassification Guides

Chapter 3—DECLASSIFYING AND DOWNGRADING INFORMATION 17

3.1. Declassification and Downgrading Officials

3.2. Declassification

3.3. Exceptions

3.4. Automatic Declassification

3.5. Mandatory Review

3.6. Systematic Review for Declassification

3.7. Referrals

3.8. Public Release

AFI31-401 1 NOVEMBER 2005 3

3.9. Downgrading

Chapter 4—MARKINGS 19

4.1. General

4.2. Required Markings

4.3. Special Control and Similar Notices

4.4. NATO

4.5. Other Foreign Government Information (FGI)

4.6. Marking of Foreign Government and NATO Information in DOD Documents. .. 23

4.7. Audio and Video Tapes

4.8. Removable Information Systems Storage Media

4.9. Sensitive Compartmented Information (SCI)

4.10. Authorized for Release To (REL TO) Markings

4.11. Classified Electronic Mail (E-Mail)

Chapter 5—SAFEGUARDING 26

Section 5A—Control Measures 26

5.1. General

Section 5B—Access 27

5.2. Granting Access to Classified Information

5.3. Nondisclosure Agreement (NdA)

5.4. Access by Persons Outside the Executive Branch

5.5. Access by Visitors

5.6. Preventing Public Release of Classified Information

5.7. Access to Information Originating in a Non-DOD Department or Agency

5.8. Administrative Controls

Section 5C—Safeguarding 36

5.9. Care During Working Hours

5.10. End-of-Day Security Checks

5.11. Residential Storage Arrangements

5.12. In-Transit Storage

5.13. Classified Meetings and Conferences

5.14. Protecting Classified Material on Aircraft

5.15. Information Processing Equipment

4 AFI31-401 1 NOVEMBER 2005

5.16. General Safeguarding Policy

5.17. Standards for Storage Equipment

5.18. Storage of Classified Information

5.19. Use of Key-Operated Locks

5.20. Procurement of New Storage Equipment

5.21. Equipment Designations and Combinations

5.22. Repair of Damaged Security Containers

5.23. Maintenance and Operating Inspections

5.24. Reproduction of Classified Material

5.25. Control Procedures

5.26. Emergency Authority

Section 5D—Disposition and Destruction of Classified Material 45

5.27. Retention of Classified Records

5.28. Disposition and Destruction of Classified Material

Chapter 6—TRANSMISSION AND TRANSPORTATION 47

Section 6A—Methods of Transmission or Transportation 47

6.1. General Policy

6.2. Transmission and Transporting Top Secret Information

6.3. Transmitting and Transporting Secret Information

6.4. Transmitting Confidential Information

6.5. Transmission of Classified Material to Foreign Governments

Section 6B—Preparation of Material for Transmission 50

6.6. Envelopes or Containers

Section 6C—Escort or Handcarrying of Classified Material 50

6.7. General Provisions

6.8. Documentation

Chapter 7—SPECIAL ACCESS PROGRAMS (SAPS) 51

7.1. Control and Administration

7.2. Code Words and Nicknames

Chapter 8—SECURITY EDUCATION AND TRAINING 52

Section 8A—Policy 52

8.1. General Policy

AFI31-401 1 NOVEMBER 2005 5

8.2. Methodology

8.3. Roles and Responsibilities

Section 8B—Initial Security Orientation 54

8.4. Cleared Personnel

8.5. Uncleared Personnel

Section 8C—Special Requirements 56

8.6. Original Classification Authorities (OCAs)

8.7. Derivative Classifiers, Security Personnel, and Others

8.8. Restricted Data (RD)/Formerly Restricted Data (FRD)

Section 8D—Continuing Security Education/Refresher Training 56

8.9. Continuing and Refresher Training

Section 8E—Access Briefings and Termination Debriefings 57

8.10. Access Briefings

8.11. Termination Debriefings

8.12. Refusal to Sign a Termination Statement

Section 8F—Program Oversight 59

8.13. General

Section 8G—Coordinating Requests for Formal Training 59

8.14. Coordinating Requests for Training

Chapter 9—ACTUAL OR POTENTIAL COMPROMISE OF CLASSIFIED

INFORMATION 59

9.1. Policy

9.2. Definitions

9.3. Information System (IS) Deviations

9.4. Sensitive Compartmented Information (SCI) Incidents

9.5. Special Access Program (SAP) Incidents

9.6. Classification

9.7. Public Release

9.8. Reporting and Notifications

9.9. Preliminary Inquiry

9.10. Damage Assessment

9.11. Formal Investigation

6 AFI31-401 1 NOVEMBER 2005

9.12. Management and Oversight

9.13. Unauthorized Absences

9.14. Prescribed Forms. These forms are prescribed throughout this AFI and are available through the Air Force Publications Distribution system:

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 66

Attachment 2—CONTROLLED UNCLASSIFIED INFORMATION 75

Attachment 3—PHYSICAL SECURITY STANDARDS 80

Attachment 4—TRANSMISSION TO FOREIGN GOVERNMENTS 81

Attachment 5—APPOINTMENT OF INQUIRY OFFICIAL MEMORANDUM 81

Attachment 6—PRELIMINARY INQUIRY OF SECURITY INCIDENT REPORT 82

Attachment 7—FORMAT FOR CLASSIFICATION/DECLASSIFICATION GUIDE 83

AFI31-401 1 NOVEMBER 2005 7

Chapter 1

POLICY AND PROGRAM MANAGEMENT

1.1. Policy. It is Air Force policy to identify, classify, downgrade, declassify, mark, protect, and destroy its classified and unclassified information and material consistent with national policy.

This general policy statement also applies to unclassified controlled information (Attachment 2) under the purview of relevant statutes, regulations and directives [Reference DOD 5200.1-R, C1.1.].

1.2. Philosophy. Protecting information is critical to mission accomplishment. The goal of the

Information Security Program is to efficiently and effectively protect Air Force information by delegating authority to the lowest levels possible; encouraging and advocating use of risk management principles; focusing on identifying and protecting only that information that requires protection; integrating security procedures into our business processes so that they become transparent; and, ensuring everyone understands their security roles and responsibilities.

1.3. Program Management. The strength of the Air Force Information Security Program is in its infrastructure. The infrastructure is important because it facilitates effective communication of our security policies and procedures to those performing the Air Force mission. With the support of commanders at all levels, this is accomplished predominantly through our

Information Security Program Manager (ISPM) and security manager system. Both play an integral role in ensuring unit personnel know and understand their role in protecting classified information against unauthorized disclosure [Reference DOD 5200.1-R, C1.2.].

1.3.1. Senior Security Official. The Administrative Assistant to the Secretary of the Air

Force (SAF/ AA) is designated the Air Force Senior Security Official responsible for ensuring implementation of the Information Security Program.

1.3.2. Air Force Program Manager. The Director, Information Protection (SAF/AAP) is responsible for policy, resource advocacy, and oversight of this program.

1.3.3. Commanders of Major Commands (MAJCOM), Field Operating Agencies (FOAs), Direct Reporting Units (DRUs), and Installations. These commanders are responsible for:

1.3.3.1. Establishing information security programs.

1.3.3.2. Identifying requirements.

1.3.3.3. Executing their programs to comply with this policy.

1.3.4. The installation Chief of the Information Protection (IP) Office (IPO) or MAJCOM

Director, Information Protection is designated the ISPM at each Air Force installation or site.

Air Force Chiefs of Information Protection:

1.3.4.1. Implement the Information Security Program, for the Information, Personnel, and Industrial Security Programs on behalf of the installation commander. Assist in the program/technology protection planning process as it relates to information, personnel and industrial security, to include direction on physical security requirements

8 AFI31-401 1 NOVEMBER 2005

for the protection of assets during the various states, i.e., production, deployment, maintenance, test, or undergoing modifications.

1.3.4.2. Integrate on-base contractor operations into the installation‟s Information

Security Program in accordance with (IAW) AFI 31-601.

1.3.4.2.1. Review pre-award and/or draft solicitations and contract documents associated with classified contract efforts; security classification guides and

Department of Defense (DD) Form 254 to ensure appropriate security clauses and/or language is contained therein which address the protection of sensitive government information and resources.

1.3.4.2.2. Serve as technical OPR for the development and preparation of the

Visitor Group Security Agreement (VGSA) or other security agreements as determined necessary by the installation commander.

1.3.4.2.3. Conduct security oversight of on-base designated “cleared facilities” as determined by the installation commander.

1.3.4.3. Provide oversight within their jurisdiction.

1.3.4.4. Provide and monitor training as required by Chapter 8 of this AFI.

1.3.4.5. For organizations at the Wing level and below, conduct security manager meetings no less than semi-annually.

1.3.5. Unit Commanders or Equivalents, and Staff Agency Chiefs. NOTE: For the purpose of this instruction, staff agency chiefs are those individuals serving in 2-digit positions reporting to the commander or vice commander above the Wing level and 2 and 3 digit positions at Headquarters Air Force. These commanders or equivalents, and staff agency chiefs will:

1.3.5.1. Appoint a security manager to administer the unit‟s information security program. Alternate security managers may be appointed as necessary. Commanders or equivalents, and staff agency chiefs should consider Air Expeditionary Force rotation cycles, TDY, training requirements, and other assigned duties. Continuity should receive serious consideration in selection of security managers. Military security managers must have a favorable National Agency Check, local agency check, and credit check (NACLC); civilians a National Agency Check with written inquiries and credit check (ANACI), investigation or higher and eligibility for JPAS access before appointment. NOTE: Smaller organizations and staff agencies are encouraged to appoint primary and alternate security managers to serve multiple activities.

1.3.5.1.1. Contractors will not be appointed as primary or alternate security managers. However, they can be required to provide other security program support, under Air Force direction, such as, assisting the security manager, conducting end-of-day security checks, security training/briefings, etc.

1.3.5.2. Ensure security managers receive training required by Chapter 8.

1.3.5.3. Notify the ISPM in writing when either primary or alternate security managers are changed.

AFI31-401 1 NOVEMBER 2005 9

1.3.6. Security Managers:

1.3.6.1. Establish and manage the Information Security Program within their unit or staff agency.

1.3.6.2. Develop and update a unit security operating instruction.

1.3.6.3. Advise the unit commander or equivalents, and staff agency chief on security issues pertaining to the unit or staff agency.

1.3.6.4. Attend ISPM hosted security manager meetings.

1.3.6.5. Update and remind personnel of security policies and procedures.

1.3.6.6. Oversee the unit or staff agency information security self-inspection program.

1.3.6.7. Report security incidents immediately, but no later than by the end of the first duty day.

1.3.6.8. Assist the unit commander or equivalent, staff agency chief and ISPM in monitoring security incident investigations. Normally security managers will not conduct security incident inquiries.

1.3.6.9. Participate in security education training as defined in Chapter 8.

1.3.6.10. Manage the JPAS within their organization.

1.3.6.10.1. In-process and out-process all unit personnel.

1.3.6.10.2. Monitor and act on system notifications.

1.3.7. Supervisors:

1.3.7.1. Establish criteria, evaluate, and rate all Air Force employees on their performance of security responsibilities [Reference DOD 5200.1-R, C1.1.2.1.].

1.3.7.1.1. Military. See AFI 36-2406, Officer and Enlisted Evaluation Systems, paragraph 1.3.7.

1.3.7.1.2. Civilian. See AFI 36-1001, Managing the Civilian Performance Program, paragraph A3.2.8.

1.3.7.2. Provide and ensure training as directed in Chapter 8 of this AFI.

1.3.8. Foreign Disclosure. The Deputy Under Secretary of the Air Force, International

Affairs, (SAF/ IA), 1080 Air Force Pentagon, Washington DC 20330-1080, oversees the release of all Air Force information to foreign governments, persons, and international organizations.

1.3.9. Historian. The Air Force Historian (HQ USAF/HO), 3 Brookley Avenue, Box 94, Bolling AFB DC 20032-5000, approves or disapproves historical researchers‟ access to classified information. [Reference DOD 5200.1-R, C6.2.2.4.]

1.4. Oversight. In addition to the reporting requirements of the Information Security Program

(see paragraph 1.7), the following will be implemented [Reference DOD 5200.1-R, C1.7.].

1.4.1. MAJCOMs will incorporate information protection issues into Inspector General (IG) inspections/reviews. In addition, MAJCOM Information Protection Offices (IPO) will

10 AFI31-401 1 NOVEMBER 2005

conduct oversight and assistance visits in the form of either an Information Security Program

Review (ISPR) or Staff Assistance Visit (SAV) to subordinate IPOs at least every 36 months.

MAJCOM IPO staffs are encouraged to explore oversight options to minimize resource impact.

1.4.1.1. ISPR.

1.4.1.1.1. An ISPR is an assistance-oriented oversight visit for the information security programs performed by an ISPM, or designated representative(s) on a subordinate ISPM or security manager. It is a non-rated review for policy and program effectiveness to benchmark processes/products, identify problem areas and corrective actions. A key component of the ISPR is an assessment of the effectiveness of the information security training program.

1.4.1.1.2. Air Force on-base contractor visitor groups will be integrated into the host installation‟s Information Security Program unless the mission, operational requirements, autonomous nature or other factors require them to establish and maintain their own security program as a cleared facility under the National

Industrial Security Program Operating Manual (NIS- POM).

1.4.1.1.3. The ISPM will provide the commander or equivalent, and staff agency chief the ISPR results in writing.

1.4.2. Base level ISPMs will conduct ISPRs on an annual basis. EXCEPTION: An extension to 18 months may be granted by the ISPM for units that have demonstrated highly effective, discrepancy free programs during the previous ISPR. ISPRs/SAVs may be conducted every two years for activities or units that do not store classified information.

1.4.3. Security Self-Inspections: Unit commanders or equivalents, and staff agency chiefs involved with processing or holding classified information ensure personnel conduct semiannual security self-inspections to evaluate information security program effectiveness. EXCEPTION: Activities with a small volume of classified material may work with the ISPM to develop an oversight schedule consistent with risk management principles.

1.4.3.1. Unit commanders or equivalents, and staff agency chiefs will appoint an individual, in writing, other than the unit security manager to conduct a semiannual security inspection.

1.4.3.2. A program review may satisfy the requirement for one of the semiannual self-inspections.

1.4.4. SAF/AAP, Chief of Information Protection will visit MAJCOMs to review their information protection and associated security programs every 36 months.

1.5. Special Types of Information. [Reference DOD 5200.1-R, C1.3.]

1.5.1. Restricted Data (RD)/Formerly Restricted Data (FRD). [Reference DODD 5210.2 and DOD 5200.1-R, C1.3.1.]

1.5.1.1. General. RD is governed by DODD 5210.2, Access to and Dissemination of

Restricted Data, 12 Jan 78. Air Force personnel will mark and safeguard RD according to

DODD 5210.2. A list of Air Force Officials Authorized to Certify Access to RD is

AFI31-401 1 NOVEMBER 2005 11

located on the AFSFC web site. These officials are responsible for certifying access to

RD using DoE Form 5631.20, Request for Visit or Access Approval (see paragraph

5.5.1.2). They may delegate this authority to the level they deem necessary for operational efficiency. Officials delegated the authority will sign in the “For” block on behalf of the access granting official. Air Force personnel may obtain DoE Form5631.20 from the DoE activity they are visiting or at the DoE Forms web site.

1.5.1.1.1. Activities must notify SAF/AAP through command IP channels of changes to the list of certifying officials as they occur. When doing so, they must also provide the position title, activity and office symbol of the affected authority. NOTE: When the change involves an activity name change, access-granting officials will sign forms authorizing access using the current activity name and a note that identifies the activity it superseded until the list of officials is updated.

1.5.1.1.2. SAF/AAP will periodically update a master list available at the

Information Protection Directorate Community of Practice (CoP).

1.5.1.2. Critical Nuclear Weapon Design Information (CNWDI). RD that is particularly sensitive. Access is limited to the minimum number of people who need it to do their job.

1.5.1.2.1. CNWDI Approving Officials. These officials are responsible for granting

CNWDI access. This authority is assigned to division chiefs and above at all levels of command.

1.5.1.2.2. Granting Access. Approving officials will ensure access and briefings are documented on AF Form 2583, Request for Personnel Security Action.

1.5.1.2.3. Protection. Air Force personnel will protect CNWDI in the same manner prescribed for collateral classified information. This includes limiting access to containers storing CNWDI to only those personnel who have been granted CNWDI access. [Reference DODD5210.2, Paragraph 6]

1.5.2. North Atlantic Treaty Organization (NATO). [Reference DOD 5200.1-R, C1.3.4.]

1.5.2.1. SAF/AAP is responsible for overall development, approval, and implementation of NATO security policy within the Air Force.

1.5.2.2. The HQ USAFE IP Office is responsible for developing and recommending

NATO security policy for implementation within the Air Force.

1.5.3. For Official Use Only (FOUO). Unclassified information that is exempt from release under the Freedom of Information Act (FOIA) exemptions 2-9, may be designated “For

Official Use Only.” No other material shall be considered FOUO. FOUO is not authorized as an anemic form of classification to protect national security interests. [Reference DOD

Regulation 5400.7/AF Supplement, DOD Freedom of Information Act Program, C4.1.1] The

FOIA exemptions are detailed in DOD Regulation 5400.7/AF Supplement, Chapter 3.

1.5.4. Sensitive Compartmented Information (SCI). The Deputy Chief of Staff, Intelligence, Surveillance and Reconnaissance (AF/A2), 1480 Air Force Pentagon, Washington DC

20330-1480, is responsible for SCI policy. The provisions of this publication may not supersede the policies and guidance prescribed in the appropriate Director of Central

Intelligence Directives governing the control, safeguarding, and dissemination of SCI as promulgated by the Cognizant Security Authority (CSA) for intelligence security

12 AFI31-401 1 NOVEMBER 2005

management. The CSA will, on behalf of the Senior Official of the Intelligence Community

(SOIC), AF/A2, ensure appropriate resolution of actual or perceived conflicts regarding SCI and the provisions of this publication.

1.5.5. Special Access Program (SAP) Information. The Director of Security, Counterintelligence and Special Program Oversight (SAF/AAZ), 1480 Air Force Pentagon, Washington DC 20330-1480, is responsible for SAP policy and oversight of all Air Force

SAPs. Should the policies and guidance in this instruction and those issued by DoD and/or the Air Force SAP Central Office (AFSAPCO) conflict, DoD and AFSAPCO policies and guidance will take precedence.

1.6. Waivers.

1.6.1. Commanders or equivalents, and staff agency chiefs send requests to waive provisions of DOD 5200.1-R, AFPD 31-4, or this AFI through command IP channels to SAF/AAP.

FOAs also coordinate their requests with their respective functional head at Headquarters Air

Force (HAF) before submitting to SAF/AAP [Reference DOD 5200.1- R, C1.4.2.].

1.6.2. Requests for waivers shall contain sufficient information to permit a complete and thorough analysis to be made of the impact on national security should the waiver be approved.

1.6.3. Waivers or exceptions to Special Access Program (SAP) requirements are forwarded through appropriate program channels to SAF/AAZ, 1480 Air Force Pentagon, Washington

DC 20330-1480.

1.7. Reporting Requirements. [Reference DOD 5200.1-R, C1.6.1.]

1.7.1. MAJCOM and DRU IPs will submit the SF Form 311, Agency Security Classification

Program Data, report to SAF/AAP by 1 October of each year.

1.7.1.1. Organizations sample data for Part C, Original Classification Decisions, and

Part D, Derivative Classification Decisions during a consecutive 2-week period each fiscal year quarter (Oct-Dec, Jan-Mar, Apr-Jun, and Jul-Sep). In the last quarter the 2-week period must be set early since the reports are required by 15 October. Interagency

Report Control Number 0230-GSA-AN applies to this information collection requirement.

1.7.1.1.1. Count the number of classification decisions in finished products for dissemination or retention, regardless of the media.

1.7.1.1.2. Do not count reproductions or copies.

1.8. Administrative Sanctions.

1.8.1. Send reports through command IP channels to SAF/AAP when someone knowingly, willfully, or negligently discloses classified information to unauthorized individuals as specified in EO 12958, as amended [Reference DOD 5200.1-R, C1.5.].

1.8.2. Air Force commanders or equivalents and staff agency chiefs report unauthorized disclosures of classified information that violate criminal statutes to their servicing ISPM and

Air Force Office of Special Investigations (AFOSI) offices [Reference DOD 5200.1-R, C1.5.].

AFI31-401 1 NOVEMBER 2005 13

1.8.3. Commanders or equivalents, and staff agency chiefs take and process administrative sanctions/ actions for civilian appropriated fund employees IAW AFI 36-704, Discipline and Adverse Actions, AFMAN 34-310, Nonappropriated Fund Personnel Program

Management and Administration Procedures, for nonappropriated fund employees, and IAW

AFI 36-2907, Unfavorable Information File (UIF) Program, for military personnel. Contact the servicing civilian or military personnel flight office if assistance is needed.

Commanders should consult their servicing legal office before taking action for serious violations.

1.9. Self-Inspection. See paragraph 1.4 of this AFI [Reference DOD 5200.1-R, C1.7.].

14 AFI31-401 1 NOVEMBER 2005

Chapter 2

ORIGINAL AND DERIVATIVE CLASSIFICATION

2.1. Original Classification Authority (OCA) [Reference DOD 5200.1-R, C2.2.]

2.1.1. The Secretary of the Air Force serves as the OCA and may further delegate this authority.

2.1.2. The process for delegating OCA authority is as follows:

2.1.2.1. Secretary of the Air Force delegates Top Secret, Secret, and Confidential authority.

2.1.2.2. SAF/AA delegates Secret and Confidential authority.

2.1.2.3. All requests for the delegation of OCA will be forwarded through command IP channels to SAF/AAP, Director of Information Protection, 1720 Air Force Pentagon, Washington, DC 20330-1340, for processing.

2.1.2.3.1. Address requests for original Top Secret authority to the Secretary of the

Air Force.

2.1.2.3.2. Address requests for original Secret and Confidential authority to SAF/AA.

2.1.2.3.3. Only individuals in senior military or civilian positions (usually General

Officer or Senior Executive Service level) at the first or second echelon of command carrying out a unique mission with responsibility for one of the eight subject areas prescribed by EO 12958, as amended, may be designated as an OCA.

2.1.2.3.4. OCA is assigned to a position, not a person. OCA will not be delegated other than identified in paragraphs 2.1.2.1 and 2.1.2.2 above. However, deputies, vice commanders, chiefs of staff and similar other subordinates of an OCA are empowered to act as an OCA when they assume the duty position of an OCA in an

“acting” capacity and have certified in writing that they have been trained in OCA responsibilities and classification principles in addition to the basic security training on the proper safeguarding of classified information and the criminal, civil, and administrative sanctions that may be brought against an individual who fails to protect classified information from unauthorized disclosure before exercising this authority.

2.1.2.4. All requests will contain the full position title, functional office symbol, a detailed explanation of why the position requires OCA and an estimate of the annual use of the delegated authority.

2.1.3. SAF/AAP will maintain the master list of Air Force OCAs and post on the

Information Protection Directorate Community of Practice (CoP). Periodically, SAF/AAP will request OCA validation from the MAJCOM/FOA/DRU IPMs.

2.1.3.1. Personnel will submit requests for changes or new requests through IP command channels as they occur.

2.1.3.2. See the Information Protection Directorate Community of Practice (CoP) web site for OCA training requirements.

AFI31-401 1 NOVEMBER 2005 15

2.2. Original Classification. [Reference DOD 5200.1-R, Chapter 2 and Interim Information

Security Guidance, April 16, 2004.]

2.2.1. Original classification is the initial decision that an item of information could be expected to cause damage to the national security if subjected to unauthorized disclosure, and that the interests of the national security are best served by applying the safeguards of the

Information Security Program to protect it. This decision may be made only by persons who have been specifically delegated the authority to do so, have received training in the exercise of this authority, and have program responsibility or cognizance over the information [Reference: DOD 5200.1-R, C2.1.].

2.2.1.1. Before an original classification decision is made, it must be determined that classification guidance is not already available in the form of classification guides, plans or other memoranda.

2.2.1.2. OCAs are accountable to the Secretary of Defense for their classification decisions.

2.2.1.3. In those rare situations where the OCAs‟ decision must be rendered verbally due to the priorities of an on-going operation, written confirmation will be issued within seven days.

2.2.1.4. OCAs must notify users when there are changes to an original decision.

2.2.1.5. OCAs shall be prepared to present, as required, deposition and expert testimony in courts of law concerning classification of national security information and be prepared to defend and justify their original decisions.

2.2.2. Classification may be applied only to information that is owned by, produced by or for, or is under the control of the United States Government. Information may be considered for classification only if it concerns one of the categories specified in Section 1.4 of EO

12958, as amended.

2.3. Derivative Classification. The act of incorporating, paraphrasing, restating, or generating in a new form information that is already classified, and marking the newly developed material consistent with the markings of the source information. The source information ordinarily consists of a classified document or a classification guide issued by an OCA. Within DOD, all cleared personnel can perform derivative classification.

2.3.1. Originating Agency‟s Determination Required (OADR). OADR is no longer an approved marking and should not be contained in any originally classified documents that have been created after October 14, 1995.

2.3.2. X1 through X8 are no longer approved markings and should not be contained in any originally classified documents that have been created on or after September 22, 2003.

16 AFI31-401 1 NOVEMBER 2005

2.3.3. When creating a derivatively classified document and using a source document that contains OADR or X1 through X8, the derivative classifier will place the following information in the Declassify On line:

DECLASSIFY ON: Source marked OADR (or X1 thru X8, whatever is applicable)

Date of source: 5 October 1993 (date of source document)

2.3.4. These documents will be subject to review for declassification 25 years after the date of the source document.

2.4. Classification Prohibitions and Limitations.

2.4.1. Under no circumstances shall information be classified in order to (1) conceal violation of law, inefficiency, or administrative error; (2) prevent embarrassment to a person, organization, or agency; (3) restrain competition; or (4) prevent or delay the release of information that does not require protection in the interest of the national security

[Reference EO 12958, as amended, Section 1.7, DOD 5200.1-R, and Interim Information

Security Guidance 16 April 2004].

2.4.2. The OCA having jurisdiction over the subject matter determines if information requested under the FOIA or the mandatory declassification review (MDR) provisions of

EO 12958, as amended, should be declassified [Reference DOD 5200.1-R, C2.4.3.5.]

2.5. Classification Challenges. [Reference DOD 5200.1-R, C4.9.]

2.5.1. If holders of information have reason to believe that the information is improperly or unnecessarily classified, they shall communicate that belief to their commander or equivalent, staff agency chief, security manager, or supervisor.

2.5.2. Send formal challenges to classification, in writing, to the OCA with jurisdiction over the information in question.

2.5.3. Challenges to reclassification decisions are sent through command IP channels to

SAF/AAP.

2.5.4. All classified information undergoing a challenge or a subsequent appeal will remain classified until a final resolution is reached.

2.6. Security Classification/Declassification Guides.

2.6.1. Required Elements. A security classification/declassification guide (see

Attachment 7 for sample format) is the written record of an original classification decision and appropriate declassification instructions and should be issued as early as practical in the life cycle of the classified system, plan, program or project. It shall, at a minimum:

2.6.1.1. Identify the subject matter of the classification guide.

2.6.1.2. Identify the OCA by name or personal identifier, and position.

2.6.1.3. Identify an agency Point of Contact (POC) (name, office symbol, mailing address, organizational e-mail address, DSN/commercial phone numbers) for questions regarding the classification guide.

2.6.1.4. Provide the date of issuance or last review.

AFI31-401 1 NOVEMBER 2005 17

2.6.1.5. State precisely the categories or elements of information to be declassified, to be downgraded, or not to be declassified.

2.6.1.6. State which classification level applies to each element of information, and, when useful, specify the elements of information that are unclassified (NOTE: Only one level of classification will be annotated for each element of information.)

2.6.1.7. State a concise reason for classification which, at a minimum, cites the applicable classification category or categories in Section 1.4 of EO 12958, as amended.

2.6.1.8. State, when applicable, special handling caveats.

2.6.1.9. Prescribe declassification instructions for each element of classified information.

2.6.1.10. Identify any related files series that have been exempted from automatic declassification pursuant to Section 3.3(c) of EO 12958, as amended.

2.6.1.11. To the extent a guide is used in conjunction with the automatic declassification provisions in Section 3.3 of EO 12958, as amended, state precisely the elements of information to be exempted from declassification to include:

2.6.1.11.1. The appropriate exemption category listed in section 3.3(b), and, when citing the exemption category listed in section 3.3(b)(9), specify the applicable statute, treaty or international agreement; and

2.6.1.11.2. A date or event for declassification IAW section 1.5.

2.6.2. OCA Responsibilities.

2.6.2.1. It is the responsibility of the OCA to publish classification/declassification guides to facilitate the proper and uniform derivative classification and declassification of their information. NOTE: In some cases, OCAs may determine that publishing classification guidance in other forms is more effective, e.g., program protection plans, system protection guides, AFIs. In these cases, the applicable publication will be considered the guide and the publishing requirements in paragraph 3.3 still apply.

2.6.2.2. Each OCA will revise (IAW paragraph 2.6.2.4 below) their security classification guides to include an advisory statement in the Release of Information section:

2.6.2.2.1. Release of program data on the World Wide Web. Extreme care must be taken when considering information for release onto publicly accessible or unprotected World Wide Web sites. In addition to satisfying all of the aforementioned approval provisions, owners and/or releasers of information proposed for such release must ensure that it is not susceptible to compilation with other information to render sensitive or even classified data in the aggregate. The search and data mining capabilities of Web technology must be assessed from a risk management perspective. Information intended for publication on publicly accessible or unprotected web sites must be cleared for public release prior to publication according to AFI 35-101, Public Affairs Policy and Procedures. If there are any doubts, do not release the information.

2.6.2.3. All guides will be reviewed by the servicing Foreign Disclosure Office before final approval.

18 AFI31-401 1 NOVEMBER 2005

2.6.2.4. Classification/declassification security guides shall be reviewed and updated, as circumstances require, but at least once every five years. NOTE: Due to the major changes implemented by EO 12958, as amended, all current Air Force classification/declassification guides will be reviewed no later than 31 December 2005, and every five years thereafter.

2.6.3. Publishing Requirements.

2.6.3.1. All guides which extend classification beyond 25 years must be approved by the

Interagency Security Classification Appeals Panel (ISCAP). Once the OCA has signed the guide, the document will be sent to SAF/AAP who will forward it to the ISCAP for approval.

2.6.3.2. The OCA will report publication of or changes to security classification/ declassification guides to the Administrator, Defense Technical Information Center

(DTIC) using DD Form 2024. DTIC will require an electronic copy of the guide.

2.6.3.3. OCAs must also forward a hard copy of the applicable publication or change to:

2.6.3.3.1. HQ AFHRA/RSA, 600 Chennault Circle, Maxwell AFB AL 36112-6424.

2.6.3.3.2. SAF/PA, 1690 Air Force Pentagon, Washington, DC 20330-1690.

2.6.3.4. All guides (to include any changes) will also be forwarded electronically to

SAF/AAP at SAF.AAP.workflow@pentagon.af.mil and AFDO at

AFDO.Workflow@pentagon.af.mil in PDF and Microsoft Word format.

2.6.4. Electronic Location of Guides. SAF/AAP will maintain the master list of all Air

Force classification/declassification guides and will provide guides made available on the

MOSIAC SIPRNET Community of Practice (CoP). Guides are also located on the DTIC web site. To access the DTIC web site you must have a DTIC account. The URL for this is http://www.dtic.mil/dtic/registration.

2.6.5. Nuclear Weapons Classification Policy. The DOD and the Department of Energy

(DoE) issue joint security classification guidance for information relating to nuclear weapons. The Air Force issues security classification policy for information relating to nuclear weapons. Most of these products are classified and users will require the appropriate security clearance before accessing them. Users may obtain copies of Joint DOD/DoE classification guides through DTIC at a cost. Users forward requests for copies of these guides to SAF/AAP (1720 Air Force Pentagon, Washington DC 20330-1340) through command IP channels. Requests must include the name, address, and phone number of the activity

POC, and the POC‟s level of access. IPs will validate this information before submitting the requests to SAF/AAP. For all other Air Force or other agency guides, go direct to the originator. Users refer to DOD 5200.1-I, DOD Index of Security Classification Guides, to determine what other guides relating to nuclear weapons classification guidance are needed.

DOD 5200.1-I can be obtained from DTIC.

mailto:SAF.AAP.workflow@pentagon.af.mil mailto:AFDO.Workflow@pentagon.af.mil http://www.dtic.mil/dtic/registration

AFI31-401 1 NOVEMBER 2005 19

Chapter 3

DECLASSIFYING AND DOWNGRADING INFORMATION

3.1. Declassification and Downgrading Officials. Within the Air Force, only OCAs have the authority to declassify or downgrade classified information.

3.2. Declassification. Note: Exemptions identified in this chapter are found in ISSO Directive

Number 1, Section 2001.21(3)(i).

3.2.1. Originally Classified Documents. The declassification decision determines the duration of protection [Reference EO 12958, as amended, Section 1.6.(a)(4) and ISOO

Directive Number 1, Section2001.12.]. At the time an item of information is classified, original classifiers will determine which of the following four declassification instructions will be used, selecting whenever possible, the declassification instruction that will result in the shortest duration of classification.

3.2.1.1. A date or event less than 10 years from the date of the document; or, if unable to identify such a date or event;

3.2.1.2. A date 10 years from the date of the document;

3.2.1.3. A date greater than 10 and less than 25 years from the date of the document; or

3.2.1.4. A date 25 years from the date of the document.

3.2.2. Derivatively Classified Documents. The “Declassify on” line must include one of the following:

3.2.2.1. The date or event up to 25 years, as noted on the source document; or

3.2.2.2. Source marked OADR, date of source (cannot be a date after October 1995);

3.2.2.3. Source marked X1-X8, date of source (cannot be a date after

September 2003);

3.2.2.4. 25X1 through 25X9, and a specific date or event for declassification; or

3.2.2.5. 25X1-human (the only category that does not require a date or event follow it).

3.3. Exceptions. RD/FRD [Reference 10 CFR 1045.1 Subpart A]. Documents containing RD or FRD are excluded from automatic declassification and do not require a declassification date. RD must be reviewed by the DoE prior to release. DoE and DOD must jointly review documents containing FRD prior to release.

3.4. Automatic Declassification. IAW EO 12958, as amended, Section 3.3, all Air Force activities that possess classified information that is of permanent historical value and is 25 years old or older should have completed a declassification review of these documents by 31

Dec 2006.

3.4.1. The Air Force Declassification Office (AFDO) has published the Air Force

Declassification Plan that provides the framework for Air Force compliance with

Section 3.3 of EO 12958, as amended. It pertains to all classified Air Force records that are

25 years old or older as of 31 December 2006, and have been determined under Federal law to have permanent historical value. The Air Force Declassification Plan is posted at the

20 AFI31-401 1 NOVEMBER 2005

AFDO web site (http://www.afdo.hq.af.mil/Plan.htm). It is critical that records management and information security personnel work together to ensure that requirements of both are met on classified records that are going to be sent to the National Archives or Federal

Records Center.

3.4.2. All classified records shall be automatically declassified on 31 December of the year that is 25 years from the date of its original classification, unless it falls in one of the exemption categories (25X) listed in Section 3.3(b) of EO 12958, as amended.

3.4.3. The 25X categories cannot be used unless the specific information has been approved through the ISCAP process. This is usually done in the form of a security classification/declassification guide. (See paragraph 2.6 and Attachment 7.) The Air Force has an approved list of exemption categories (listed in the Air Force Declassification Plan);

however, the specific item must still be annotated in the security classification/ declassification guide before it is used on derivatively marked documents. For original classification decisions, no 25X marking, other than “25X1-human,” is permitted on the

“declassify on” line. All originally classified documents will contain either a date or event less than 10 years or a date from 10 to 25 years. The only exception is the marking “25X1-human.” This marking may be used when the disclosure of the information could be expected to reveal the identity of a confidential human source or human intelligence source. This is the only 25X marking that does not require a date or event for declassification to be cited with the 25X marking.

3.5. Mandatory Review.

3.5.1. Mandatory review requests must identify the information requested with enough specificity to allow for location of the records with a reasonable amount of effort.

3.5.2. Send all requests for MDR to 11 CS/SCSL (MDR), 1000 Air Force Pentagon, Washington DC 20330-1000.

3.5.3. Send appeals to MDR decisions through 11 CS/SCSL (MDR) to SAF/AA, the

Air Force Appellate Authority for MDRs.

3.6. Systematic Review for Declassification. Activities will set up an annual schedule for conducting systematic declassification reviews for the following records:

3.6.1. Records of permanent historical value prior to their twenty-fifth birthday. These records will be reviewed and appropriate action taken by 31 Dec of the same year that is 25 years from the date of its original classification.

3.6.2. Other records. Activities will set up a reasonable schedule for conducting declassification reviews for all other classified records.

3.7. Referrals. A referral is information that is subject to the provisions of EO 12958, as amended, Section 3.3, Automatic Declassification, and ISOO Directive No. 1, Section 2001.34, and has been referred to, within, or outside the Air Force for review. AFDO is the focal point for processing Air Force referrals. Detailed information regarding the referral process can be found in the Air Force Declassification Plan.

3.8. Public Release. When information is declassified, it is not releasable to the public until it has been approved for release through the security review process IAW AFI 35-101, Chapter http://www.afdo.hq.af.mil/Plan.htm

AFI31-401 1 NOVEMBER 2005 21

15. The same holds true for declassified or unclassified information that will be placed on an

Internet site that can be accessed by the public.

3.9. Downgrading. Downgrading of information to a lower level of classification is appropriate when the information no longer requires protection at the originally assigned level, and can be properly protected at a lower level. Any official who is authorized to classify or declassify the information and has authority over the information may downgrade information.

22 AFI31-401 1 NOVEMBER 2005

Chapter 4

MARKINGS

4.1. General. Air Force personnel who originally and derivatively classify information will mark those products according to DOD 5200.1-R and the ISOO Marking Booklet. Material other than ordinary paper documents, e.g., e-mail transmitted over a secure network, must have the same information either marked on it or made immediately available to holders by other means.

[Reference DOD 5200.1-R, C5.1.]

4.2. Required Markings. Classified documents are required to have the following markings:

4.2.1. The overall classification of the document.

4.2.2. The agency, office of origin, and date of the document.

4.2.3. The office or source document that classified the information.

4.2.3.1. If it is originally classified, the document will reference the office.

Example: CLASSIFIED BY: SAF/AAP.

4.2.3.2. If a document is derivatively classified, it will reference the source document or the security classification/declassification guide. Example: DERIVED FROM: HQ

USAF/A3/5 Memo dated 12 Jan 2008. Subj: Funding Problems.

4.2.4. The reason for classification. Each originally classified document shall bear a concise statement of the reason for classification, determined by the original classifier.

[Reference DOD 5200.1-R, C5.2.4.] The classification categories are listed in EO 12958, as amended, Section 1.4; DOD5200.1-R Interim Information Security Guidance, Chapter 2, Para 1. Example: REASON: 1.4(e).

4.2.4.1. If a document is derivatively classified, the “REASON” is not required to be carried over to the derivative document.

4.2.5. Declassification instructions, and any downgrading instructions that apply.

Example: DECLASSIFY ON: 15 MARCH 2010.

4.2.5.1. If marking material that falls within one of the 25-year exemption categories, the correct marking will be as follows (NOTE: only derivatively classified documents will carry a 25X marking, with the exception of 25X1-human, which is allowed on originally classified documents):

DECLASSIFY ON: 25X5, 15 February 2010

4.2.6. Page and portion markings to identify the specific classified information in the document and its level of classification. When marking a document that is derivatively classified, ensure all markings and caveats are carried over from the source document to the derivative document.

4.2.7. Control notices and other markings that apply to the document.

4.2.8. When a document has been declassified or downgraded, the following markings shall be applied:

4.2.8.1. The word “Declassified” or the new classification if being downgraded.

AFI31-401 1 NOVEMBER 2005 23

4.2.8.2. The authority for the action (the OCA‟s office symbol and the identification of the correspondence or classification instruction that required it).

4.2.8.3. The date of declassification or downgrading action.

4.2.8.4. The overall classification markings that appear on the cover page or first page shall be marked through with a straight line. If downgraded, the new classification will be written in.

4.2.8.5. Page and portion markings will be remarked as required.

4.2.9. Notebooks, binders, folders, etc. containing classified documents will be conspicuously marked with the highest classification of the material contained. Affix the appropriate overall classification marking or classified cover sheet to the front and back of the notebook, binder, folder, etc.

4.3. Special Control and Similar Notices. [Reference DOD 5200.1-R, C5.2.9.]

4.3.1. Working Papers. Working papers are documents and material accumulated or created in the preparation of finished documents and material. Working papers containing classified information will be:

4.3.1.1. Dated when created.

4.3.1.2. Marked with the highest classification of any information contained in the document and annotated “WORKING PAPER”.

4.3.1.3. Destroyed when no longer needed.

4.3.1.4. Protected IAW the assigned classification.

4.3.1.5. Marked in the same…