GRYPHON_Attachment 3_CUI_Guide.pdf

DISTRIBUTION STATEMENT A. Approved for public release: distribution unlimited.

Controlled Unclassified Information Guide

Program: Generating RF with Photonic Oscillators for low Noise (GRYPHON)

Program Manager: Dr. Gordon Keeler

Program Security Officer: Mr. Paul Kieschnick

Date: March 16, 2021

Version: 1.0

Dr. Gordon Keeler Mr. Paul Kieschnick

MTO Program Manager MTO Program Security Officer ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATAGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE of CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

12. INFORMATION PROTECTION GUIDANCE CHARTS

iii

FOREWORD

1. DESCRIPTION

The Generating RF with Photonic Oscillators for low Noise (GRYPHON) program will develop compact, low-noise microwave frequency synthesizers to enable advanced sensing and communication applications.

GRYPHON will focus only on developing sources of microwaves, and will not develop other componentry for modulation, amplification, or other functions needed to condition a microwave signal for use in any particular application. Two technical areas are planned for the program. TA1 will develop synthesizer prototypes to a TRL level between 4 and

5, while TA2 will explore fundamental limits of performance.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of Generating RF with

Photonic Oscillators for low Noise (GRYPHON) information IAW DoDI 5200.48.

GRYPHON information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology

(NIST). Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in Executive

Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of

Information Act (FOIA) and the exemptions therein, Export Administration

Regulations, and International Traffic in Arms Regulations.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support GRYPHON. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with GRYPHON. As defined at 32

CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of GRYPHON, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on GRYPHON as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of G.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at

MTO_Security@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at MTO_Security@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, mailto:MTO_Security@darpa.mil will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the

OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. GRYPHON critical information falls under the following index of CUI:

1) Defense

2) Export Control

3) Proprietary Information

6. CUI Categories

a. Defense: Controlled Technical Information (CTI). This category relates to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet that criteria, if disseminated, for distribution statements B through F using the criteria set forth in

DoD Instruction 5230.24, Distribution Statements on Technical Documents.

b. Export Control: Export Controlled Research (EXPTR). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information. This category relates to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions.

c. Proprietary Business Information: General Proprietary Business Information. Material and information relating to, or associated with, a company’s products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development; existing and future product designs and performance specifications.

7. EXPORT CONTROL RESTRICTED INFORMATION

GRYPHON export control restricted information includes Controlled Technical

Information (CTI) and research information pertaining to Export Administration

Regulations or International Traffic in Arms Regulations.

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal

Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for GRYPHON are listed below;

however other exemptions could apply:

1) Exemption 3 – Protects information exempted from release by statute.

2) Exemption 4 – Protects trade secrets or commercial or financial information that is confidential or privileged.

9. DISCLOSURE of CUI.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and

DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD

Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this

Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation.

Disclosure approval must be granted by the Director, SID, who is the Foreign

Disclosure Officer for DARPA.

https://www.darpa.mil/work-with-us/contract-management/public-release

10. CUI PROTECTION REQUIREMENTS

a. GRYPHON CUI (e.g., export-controlled information, CTI, inventions, confidential business information) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. CUI may only be processed on DIB systems that are compliant with DFARS

252.204-7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the GRYPHON PSO and PSR at MTO_Security@darpa.mil.

b. Data breaches of DIB networks and systems involving GRYPHON CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

12. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the GRYPHON effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at MTO_Security@darpa.mil.

Element of Information Index Category Reason LDC or

Distribution

Statement

Remarks

Non-public business information or data that is not made publically releasable.

Proprietary

Business

Information

General

Proprietary

Business

Information

(PROPIN)

18 USC 1905

29 USC 664

Federal Employees and Contractors

Only (FEDCON)

FOIA Exemption 3 or

Exemption 4 may be applicable.

Commerce Control List. Category 3 –

Electronics. Element 3A001.b.10:

Oscillators with single sideband phase noise better than:

–[126 dBc/Hz + 20log10(F/1 MHz) -

20log10(f)];

F ≡ output freq., f ≡ offset freq.

Export

Control

Export

Controlled

Research

(EXPTR)

15 CFR 734.8(b)

DISTRIBUTION

STATEMENT C.

Distribution authorized to U.S.

Government agencies and their contractors (export controlled) (2021-

03-12). Other requests for this document shall be referred to DARPA

MTO.

Likely to apply to TA1 and TA2 oscillators at all stages of the program; EAR

Fundamental Research exclusion or other

License Exceptions may apply

Commerce Control List, Category 3 –

Electronics. Element 3A001.b.11:

Frequency synthesizer with tuning time faster than any of:

• 143 ps

• 100 µs for changes > 2.2 GHz within 4.8 – 31.8 GHz

Export

Control

Export

Controlled

Research

(EXPTR)

15 CFR 734.8(b)

Distribution authorized to U.S.

Government agencies and their contractors (export controlled) (2021-

May apply to TA1 and

TA2 tunable oscillators / synthesizers in Phase

2/3, depending on implementation; EAR

Fundamental Research exclusion or other

• 500 µs for changes > 550 MHz within 31.8 – 37 GHz

• 100 µs for changes > 2.2 GHz within 37 – 90 GHz

• 1 ms beyond 90 GHz

03-12). Other requests for this document shall be referred to DARPA

MTO.

License Exceptions may apply

U.S. Munitions List XV(e)(15)

Space-qualified oscillator for spacecraft radar subject to Category XV(a), with phase noise less than:

–[120 dBc/Hz + 20log10(F/1 GHz)], measured at (2 kHz * F)/1 GHz offset;

F ≡ output freq.

Defense Controlled

Technical

Information

(CTI)

48 CFR 252.204-

7012; Title 10, §

130; 31 CFR

800.209; Parts 22

CFR 120-130; 15

CFR 730-774; 22

USC 2778

(AECA);

Export Control

Reform Act of

2019 (FY 2019

NDAA, Subitle B

- Sections 1741-

1781/PL 115-

232);10 USC

130(a) (DoD authority to withhold export controlled space/mil info);

32 CFR 250 //

DoDD 5000.01;

DoDD5000.02;

DoDI 5200.39;

DoD Directive

5230.25; DoDI

3200.12

Distribution authorized to U.S.

Government agencies and their contractors (export controlled, critical technology) (2021-

03-12). Other requests for this document shall be referred to DARPA

MTO.

Will not apply to

GRYPHON sources unless performers undertake additional qualification beyond that required by the BAA