HR001121S0041_Attachment_3_QuICC_CUI_Guide.pdf

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Controlled Unclassified Information Guide

Program: Quantum Inspired Classical Computing (QuICC) Program Manager: Bryan Jacobs, Ph.D.

Program Security Officer: Paul Kieschnick

Date: September 17, 2021 Version: 1.1 ii

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATAGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE of CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

iii

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

FOREWORD

1. DESCRIPTION

The Quantum Inspired Classical Computing (QuICC) program will develop new computing architectures that incorporate classical analog (physics-based) systems to increase the computational efficiency for solving hard optimization problems. In this sense, the architectures explored are similar to digitally controlled physics experiments that are carried out on the analog side. The results of the experiments are then transformed into solutions to optimization problems.

The end of program goals include demonstrating a 50x reduction in solving benchmark optimization problems, and data-supported analysis demonstrating that the technology can be scaled to mission relevant problem sizes and deliver a 500x improvement in efficiency over existing techniques.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. Distribution

Unclassified

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of QuICC information IAW DoDI 5200.48. QuICC information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST).

Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in Executive Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein, EAR and ITAR.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support QuICC. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with QuICC. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of QuICC, in compliance with Executive Orders and related DoD guidance.

The scope of this guide is based on QuICC as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of QuICC.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA MTO at MTOSecurity@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA MTO at MTOSecurity@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

Distribution Statement A: Approved for Public Release, Distribution Unlimited

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. QuICC critical information falls under the following index of CUI :

1) Proprietary Business Information

2) Export Control

6. CUI Categories

Proprietary Business Information, General Proprietary Business Information: Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development; existing and future product designs and performance specifications.

7. EXPORT CONTROL RESTRICTED INFORMATION

a. Export Control, Export Controlled: Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in the Export Administration Regulations, the International Traffic in Arms Regulations and the munitions list; license applications; and sensitive nuclear technology information.

b. Export Control, Export Controlled Research: Related to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions.

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR §

5.31 specifies the type of information that falls under each of the nine exemptions that

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for QuICC are listed below;

however other exemptions could apply:

Exemption 3: Information that is prohibited from disclosure by another federal law.

Exemption 4: Trade secrets or commercial or financial information that is confidential or privileged.

9. DISCLOSURE of CUI.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, SID, who is the Foreign Disclosure Officer for

DARPA.

10. CUI PROTECTION REQUIREMENTS

a. QuICC CUI (e.g., General Proprietary Business Information and Export Control) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

b. CUI may only be processed on DIB systems that are compliant with DFARS 252.204- 7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the QuICC PSO and PSR at paul.kieschnick@darpa.mil and sandy.dulac.ctr@darpa.mil.

b. Data breaches of DIB networks and systems involving QuICC CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

Distribution Statement A: Approved for Public Release, Distribution Unlimited

UNCLASSIFIED

Distribution Statement A: Approved for Public Release, Distribution Unlimited

Any research Export Controlled items that fall within Category 3 (Electronics) or Category 4 (Computers) of the Export Administration Regulation

(EAR)

Export Control

Export Controlled Research

15 CFR 734.8(b) “DISTRIBUTION

STATEMENT C.

Distribution authorized to U.S.

Government agencies and their contractors Export Controlled, 20210623. Other requests for this document shall be referred to DARPA

MTO.”

Also: include the Control Warning on first page (see below*)

- FOIA

Exemptions #3.

- Export Control Protections

Any proprietary business information asserted in contracts awarded under this program.

Proprietary Business Information

General Proprietary Business Information

The amount of Law, Regulation, or Government-Wide Policy (LRGWP) is too detailed to fit the spreadsheet. This is the link to CUI Registry:

https://www.archives.gov/cui/registry/category-detail/proprietary-business-info.html

Dissemination List Controlled

(DL ONLY).

Dissemination list- (Include Separate List for Government and Non Competitive Contractors Only)

FOIA

Exemption 4 may be applicable.

*Control Warning Statement:

“WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) of the Export Administration Act of 1979 (Title 50, U.S.C., App 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties.

Disseminate in accordance with provisions of DoD Directive 5230.25.”