White House Issues Memo on Controlled Unclassified Information
by Clay Northouse, 5/13/2008
The White House released a memorandum on May 9 establishing new rules governing the designation and sharing of Controlled Unclassified Information (CUI). By creating a single designation and consistent procedures, the memo attempts to resolve the growing problem of multiple Sensitive But Unclassified (SBU) designations, which slow the sharing of information.
The memo replaces the multiple SBU categorizations and establishes three universal CUI designations for all agencies; agencies are then barred from creating new CUI categories unless prescribed by the National Archives and Records Administration (NARA). Open government advocates have supported simplifying the more than 100 different SBU categories but fear the memo does little to reduce growing secrecy.
In the wake of the 9/11 terrorist attacks, federal agencies created numerous new SBU categories in an attempt to better protect information believed to have the potential to be used to harm the United States. In doing so, the agencies unwittingly expanded already existing, but little recognized, difficulties that such vague and inconsistent designations carried. This includes confusion among officials as to how to manage information; less and slower sharing of designated information with other federal, state, and local agencies regardless of their need for the information; and near-automatic withholding of such information from the public.
The memo orders several changes that will go far in simplifying the information sharing problems, not the least of which is the creation of CUI as the single SBU category for federal agencies, coupled with a clear ban on the creation of new agency-created SBU categories. However, the definition of CUI remains very broad: information that is "pertinent to the national interests of the United States or to the important interests of entities outside the Federal Government" and requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination. Additionally, the memo appears to only establish a framework for managing "CUI terrorism related information," leaving any CUI that is unrelated to terrorism, which could be a considerable amount of information, largely unaddressed.
The memo creates three possible designations:
- Controlled with Standard Dissemination — Information that requires standard safeguarding to reduce the risks of unauthorized disclosure and dissemination is permitted to the extent that it is reasonably believed to further the execution of a lawful or official purpose.
- Controlled with Specified Dissemination — Information that requires standard safeguarding to reduce the risks of unauthorized or inadvertent disclosure and dissemination is permitted only with additional instructions.
- Controlled Enhanced with Specified Dissemination — More stringent safeguarding measures than those normally required as unauthorized disclosure would risk substantial harm, and material contains additional instructions on what dissemination is permitted.
The absence of any Controlled Enhanced with Standard Dissemination designation implies that any information requiring enhanced safeguarding procedures automatically qualifies as also needing specified dissemination instructions.
The White House memo tasks NARA with being the "Executive Agent" in charge of the new CUI effort, with detailing the safeguarding procedures and dissemination guidance, and several other responsibilities, including:
- Develop and issue CUI policy standards and implementation guidance
- Establish and chair a CUI Council
- Establish, approve, and maintain safeguarding standards and dissemination instructions
- Publish the CUI safeguarding and dissemination standards in the CUI Registry
- Monitor department and agency compliance with CUI policy, standards, and markings
- Establish baseline training requirements and develop a CUI training program to be implemented by departments and agencies
- Provide appropriate information regarding the CUI Framework to Congress; to state, local, tribal, and private sector entities; and to foreign partners
- Advise departments and agencies on the resolution of complaints and disputes concerning the proper designation or marking of CUI
- Establish a process that addresses enforcement mechanisms and penalties for improper handling of CUI.
It appears the purpose of this effort is to eliminate bureaucratic difficulties and to create smoother information sharing with little concern for public access to the information. While the memo's instructions that "CUI markings may inform but do not control the decision of whether to disclose or release the information to the public, such as in response to a request made pursuant to the Freedom of Information Act (FOIA)" acknowledge the possibility that CUI designation could prevent public disclosures of information that merits release, they do little to prevent such outcomes.
The memo offers no instructions that indicate the government is concerned with limiting the amount of information designated CUI. There are no instructions to restrict the number of officials capable of assigning the CUI markings and only some simple acknowledgement that the designation should not be used to conceal information on waste, fraud, or abuse, nor assigned to information that is either already public or ordered to be made public by statute. There are also no time limits on CUI designations; when one considers the fact that classified information is automatically declassified after 25 years unless officials intervene to maintain the information restrictions, it seems strange that CUI designations will be permanent. It may be that NARA will create such procedures to prevent the growth of CUI from encroaching on public access in the policy standards and implementation guidance the agency is tasked with, but the White House memo does not specify that such steps be a part of the effort. Moreover, it is not clear whether NARA will be given additional resources to implement these new tasks.
For years, the government has been working to resolve this multi-headed SBU problem and streamline the sharing of unclassified information. In December 2005, President Bush issued a memorandum directing SBU procedures to be standardized across the government. Two years later, in December 2007, the Department of Defense issued a memorandum to prepare government officials for an administrative overhaul of the numerous SBU categories to the single CUI designation. The memo explained that a policy had been recommended to the president and that approval was expected shortly. Open government advocates had requested a meeting to discuss the issues, but that request was ignored. The current CUI memo explaining the new policy to executive departments and agencies is not the final step in this long journey; work remains to ensure that the public has access to unclassified information.