LUC_CUI_Guide.pdf

DISTRIBUTION STATEMENT A. Approved for public release: distribution is unlimited.

Controlled Unclassified Information Guide

Program: Lightweight Universal Codec (LUC) Program Manager: Dr. Allyson O’Brien

Program Security Officer: Justin P. Kokernak

Date: 26 June 2026 Version: 1

Dr. Allyson O’Brien Justin P. Kokernak IPTO Program Manager IPTO Program Security Officer ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. CUI CATEGORIES

6. EXPORT CONTROL RESTRICTED INFORMATION

7. DISCLOSURE OF CUI

8. CUI PROTECTION REQUIREMENTS

9. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

10. INFORMATION PROTECTION GUIDANCE CHARTS

iii

FOREWORD

1. DESCRIPTION

The DARPA IPTO program, "Lightweight Universal Codec” (LUC), seeks to expand on the Guessing Random Additive Noise Decoding (GRAND) study’s universal decoder breakthrough to develop a dynamic and universal coder-decoder (codec). The LUC program will create a universal communication ecosystem that standardizes data and signal exchange while reducing hardware complexity, errors due to environmental noise, and the need to have matching transmitters and receivers.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of Executive Order 13556, Controlled Unclassified Information, November 4, 2010 (as amended) and in accordance with DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of LUC IAW DoDI

5200.48. LUC information must be controlled and stored consistent with DFARS 252.204-7012 requirements as detailed in National Institute for Standards and Technology (NIST) 800-171.

b. This guide is not for classified national security information as defined in

Executive Order 13526, but identifies specific elements of sensitive information that are unclassified but require additional protection.

2. APPLICABILITY AND SCOPE: This guide applies information, material and processes generated by LUC. This guide is the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with LUC. This guide is used in conjunction with related guidance (security classification guides, DoD Policy, etc) associated with the overall effort of LUC. The scope of this guide is based on LUC as planned at the date of this guide, and may change over the course of LUC.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR): The Office of Primary Responsibility is DARPA IPTO. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at IPTOSecurity@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES: CUI

Challenges are directed to the OPR. Information is protected in accordance with this guide until the challenge is resolved.

5. CUI Categories. The following CUI Categories are used to protect LUC:

a. Defense, Controlled Technical Information (CTI). Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information is to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents." The term does not include information that is lawfully publicly available without restrictions. "Technical Information" means technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

b. Intelligence, Operations Security (OPSEC). Critical information determined to give evidence of the planning and execution of sensitive (frequently classified) government activities after going through a formal systematic vetting process in accordance with National

Security Presidential Memorandum Number 28. This process identifies unclassified information that must be protected. It almost always results from an agency’s official OPSEC program, or is otherwise commonly approved for use by the CUI Senior Agency Official.

c. Export Control, Export Controlled (EXPT). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations (ITAR) and the munitions list; license applications; and sensitive nuclear technology information.

6. EXPORT CONTROL RESTRICTED INFORMATION: Each performer is responsible for assessing their technology and ensuring compliance with all export control laws and regulations.

This CUI guide does not relieve any program participant from export control requirements.

7. DISCLOSURE of CUI.

a. Public Disclosure. Public Disclosure of any LUC information must follow the DISTAR process. Please contact the LUC OPR and Public_Release_Center@darpa.mil for additional guidance.

b. Freedom of Information Act (FOIA) Requests. All FOIA request are directed to the

DARPA FOIA Office.

c. Foreign Disclosure. CUI controlled by DARPA, as part of a DARPA funded project, may be shared with a U.S. organization’s (i.e., the U.S. defense industry base (DIB), U.S.

academia, or U.S. research institutions) and non-U.S. citizen employees of those U.S.

organizations under specific condition:

i. (U) CUI controlled by DARPA, to include CUI marked NOFORN or EXPORT CONTROLLED, may be disclosed to US Persons if they are a performer on a DARPA S&T proposal team or, if they are a performer who has been awarded a DARPA S&T project. A U.S. Person is a person who is a lawful permanent resident of the United States or who is a protected individual as defined by 8 U.S.C. 1101(a)(20) or 8 U.S.C.1324b(a)(3).

ii. (U) CUI that is NOFORN may be shared with U.S. persons, but will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S.

persons without the originator’s approval in accordance with E.O.s 13526 and 13556.

iii. (U) CUI may be disclosed to a foreign person employed by U.S.

organizations if:

i. (U) They are operating under a formally issued solicitation or awarded DARPA S&T project that clearly defines the U.S.

mailto:Public_Release_Center@darpa.mil organization’s responsibilities to comply with DoD CUI policies and procedures as detailed in either DoD 5200.48, DFARS 252.204-7012, 7019, and 7020, or similarly acceptable guidance and direction.

ii. (U) The CUI is not Export Controlled or NOFORN.

iii. (U) Access to such information is within the scope of their assigned duties.

(U) Access to such information would accomplish a lawful and authorized DoD mission or purpose and would not be detrimental to the interests of the DoD or the U.S. Government.8.

CUI PROTECTION REQUIREMENTS: LUC CUI must be stored in accordance with DODI

5200.48. Processing of CUI is only authorized on systems compliant with DFARS 252.204-7012 as detailed in NIST 800-171.

9. UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, and suspicious activities involving CUI to the LUC PSO and PSR at IPTOSecurity@darpa.mil.

b. Data breaches of Defense Industrial Base (DIB) networks and systems involving

LUC CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

mailto:IPTOSecurity@darpa.mil

10. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the LUC effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from IPTOSecurity@darpa.mil.

Element of Information

Index Category Reason LDC or Distribution Statement

Remarks

Platform specific modifications to hardware or software when integrated into a specific military or space system.

Defense Controlled Technical Information (CTI)

DFARS

252.204-7012

Distribution Statement C

(DISTRO-C)

LUC integration into telecommunications systems resulting in improved characteristics that fall under ECCN 5A001 and 5A991.

Defense CTI

15 CFR 734.8(b) 22 CFR Part 120

DISTRO-C CCL ECCN 5A001 will apply if the LUC technology is further developed by the performers to meet established ECCN 5A001 criteria or integrated into systems covered by export administration regulations, international traffic in arms regulations (ITAR) and the munitions list, or license applications.

CCL ECCN 5A991 will apply as LUC technology improves communications, but does not cross the advanced performance thresholds required for 5A001.

Identification of specific military platforms or DoD systems and capabilities that can be enhanced by LUC technology.

Intelligence OPSEC DoDI 5205.02 DISTRO-C

Data from testing when implemented into a specific military or space system, COTS or

GOTS.

Intelligence, Export Control

OPSEC, EXPT

15 CFR 734.8(b) 22 CFR Part 120

252.225-7048

DISTRO-C ITAR (Category IX- Military Training Equipment and Training (b) (iii).

Outputs from DoD systems/platforms provided to LUC for evaluation.

Defense CTI DFARS

DISTRO-C

Table 2: LUC NOT CUI elements

Phase One:

• All research and development of initial software implementations when information not deemed CTI or derived from CTI sources.

Phase Two: • When information derived from the refinement of codec developed software from Phase One and associated target platform data contain no information derived from CTI sources. This applies until technological development meets the threshold covered within category 5 of the CCL.

• Hardware prototyping when not derived from specific DoD platforms or systems unless the technological development meets the threshold covered within category 5 of the CCL.