On Nov. 4, President Obama signed a new executive order on controlled unclassified information (CUI), reforming the system of safeguarding information that is not classified but is still considered "sensitive." Previous practices for handling CUI stymied public access and inhibited information sharing inside government. The new order has been praised by numerous government openness advocates.

Over the years, agencies have created CUI categories on an ad hoc basis: sometimes as required by legislation or regulation, but also simply out of perceived need. A 2009 report identified more than 100 such categories across the government, including many without a clear public definition. The new executive order will create a public registry of all CUI categories and their definitions, along with their justification in statue, regulation, or government-wide policy. The order also makes clear that CUI documents are subject to standard disclosure processes under the Freedom of Information Act (FOIA); labeling a document as CUI does not exempt it from FOIA.

History of CUI

Since at least the 1970s, agencies have sought ways to protect information that was "sensitive but unclassified." The growth of such practices was facilitated by a post-9/11 Bush White House memo that instructed agencies to control such information.

However, the problems caused by the confusion resulting from the proliferation of "pseudo-secrecy" practices became apparent even to the Bush administration. In 2005, President Bush issued a memorandum directing agencies to standardize procedures for safeguarding sensitive terrorism, homeland security, and law enforcement information in order to better facilitate the sharing of this information between different agencies. This was followed by a 2008 memo adopting CUI as the common designation for systems to protect terrorism-related information.

The Obama administration continued the reform efforts. In May 2009, President Obama established an interagency task force to examine CUI and issue recommendations for reform. OMB Watch, along with other public interest groups, contributed perspectives to this process. In August 2009, the task force issued a set of recommendations, including a call for a new executive order.

What the Executive Order Does

The new executive order establishes CUI as the sole system for controlling unclassified information. It makes clear that a CUI designation is not an exemption from FOIA review and requires an assumption of openness in designating information as CUI. Throughout the process, the National Archives and Records Administration (NARA) can consult with government officials, state and local authorities, private stakeholders, and the public.

NARA is responsible for administration and oversight of the order. NARA is assigned to develop government-wide procedures for implementing the order within six months. At the same time, agencies must review the categories they currently use and submit them to NARA for review, including definitions citing a basis in law, regulation, or government-wide policy. Agencies no longer have the authority to create new information categories on their own; only those categories approved by NARA may be used.

NARA then has six months to review and approve the categories proposed by the various agencies. As the executive agent overseeing the order, NARA has the authority to reorganize categories submitted to eliminate duplication, overlap, and other conflicts. Conflicts over categories or implementation procedures that cannot be settled by NARA and agencies will be resolved by the White House Office of Management and Budget (OMB). Within one year of the order, NARA must publish a public registry of authorized categories, including their definitions and associated procedures. Future proposed categories will also have to be approved by NARA.

While NARA is reviewing the submitted categories and creating the public registry, agencies must establish their CUI programs and policies based on NARA’s implementing guidance. The agencies must submit their plans to NARA for review to ensure they comply with the original guidance. NARA will review the proposals and establish deadlines for agency implementation. The procedures will likely consider questions such as systems for safeguarding CUI, markings, control processes (e.g., who is authorized to control a document), decontrol timelines and processes, staff training, and selective control (controlling parts of documents rather than entire documents).

For the first five years, NARA must produce an annual report on implementation of the order. After five years, NARA will issue a report every other year. The order does not specify any particular metrics or framework for the reports. It may be that the implementation guidance to the agencies will provide some indication by requiring the agencies to collect and report to NARA on certain aspects of implementation.

Analysis

The order steps back from the direction of an earlier draft, which would have directly established a small, tiered set of broad, government-wide categories, rather than having NARA process the existing categories. This earlier approach would have been similar to Bush's 2008 memorandum. According to OpenTheGovernment.org, "The Bush policy and earlier drafts could have created a fourth level of classification." Likewise, the Federation of American Scientists commented that under the earlier draft order, "CUI would have constituted another level of classification, by another name."

The draft order also spelled out government-wide procedures rather than having NARA develop them. Among the policies were sanctions for unauthorized disclosure of CUI, which created concerns about retaliation against whistleblowers. Openness advocates will be closely watching the development of the procedures for such issues.

Even after the procedures are released, implementation of the order will remain a topic of vigilance for openness advocates. One indicator many will no doubt like to see built into the procedures is the reporting of statistics on the use of CUI designations, which will allow assessment of whether the order actually is reining in the volume of information marked as CUI.

Reactions to the E.O.

Initial reactions from open government groups were positive. OMB Watch said that the order "deserves genuine praise as a simple but strong path forward." Gary D. Bass, OMB Watch's executive director, went on to stress that "implementation will determine if this policy succeeds or fails."

The American Civil Liberties Union (ACLU) said the order would "improve government transparency" and added, "This Executive Order is a welcome step toward ensuring that our government agencies can no longer withhold information without oversight."

The Federation of American Scientists commented that the order "seems well-crafted to streamline information handling in the executive branch without creating any new obstacles to public access."

OpenTheGovernment.org commented that the order will "significantly limit the number and end the spiraling proliferation" of CUI categories.