Student Guide: Controlled Unclassified Information

Transcription

1 Length Two (2) hours Description This course covers the Department of Defense policies on the disclosure of official information. In addition, the nine exemption categories of the Freedom of Information Act are explained. The handling of foreign government information is also described. Objectives Understand the Department of Defense policies covering the disclosure of official information. Describe the nine exemptions under the Freedom of Information Act. Identify how to handle different classifications of foreign government information. POC Page 1 of 33

2 CONTENTS Introduction Controlled Unclassified Information Authority to Disclose Technical CUI Summary Page 2 of 33

3 Introduction This course provides policy and procedures for the disclosure of technical controlled unclassified information (CUI) governed by Department of Defense Directive (DODD) , Withholding of Unclassified Technical Data From Public Disclosure, and Army Regulation (AR) 70-31, Standards for Technical Reporting. Page 3 of 33

4 Controlled Unclassified Information There are two types of unclassified information Controlled Unclassified Information and public domain information. CUI is information to which access or distribution limitations have been applied according to national laws, policies, and regulations of the U.S. Government. CUI includes U.S. information that is determined to be exempt from public disclosure according to DODD and DODD , DoD Freedom of Information Program, or that is subject to export controls according to Title 22, Code of Federal Regulations, parts (22 CFR ) (International Traffic in Arms Regulations (ITAR)) and 15 CFR 768 et seq. (Export Administration Regulations (EAR)). Page 4 of 33

5 Controlled Unclassified Information (cont) These types of information include but are not limited to: patent secrecy data, confidential medical records, inter-and intra-agency memoranda that are deliberative in nature, certain data compiled for law enforcement purposes, data obtained from a company on a confidential basis, employee personal data, and internal rules and practices of a government agency that, if released, would circumvent an agency policy and impede the agency in the conduct of its mission. Foreign governments and international organizations do not routinely request access to these types of CUI under U.S. Army international cooperative programs. CUI normally falls under Exemption 3 (Other Statutes) of the Freedom of Information Act. Public Domain information is information that does not qualify for status as CUI and is generally accessible or available to the public at large. Information placed in the public domain must first undergo an Army Public Affairs review. Page 5 of 33

6 Technical Controlled Unclassified Information The specific category of CUI the Foreign Disclosure personnel are concerned with is termed Technical CUI. Technical CUI is unclassified information with military or space applications. Public law (10 U.S.C. 130) provides the Secretary of Defense with the authority to withhold from the public "unclassified technical data with military or space application in the possession of or under the control of a DoD Component, which may not be exported lawfully without an approval authorization, or license under the Export Administration Act or the Arms Export Control Act (AECA)". There must be a determination that the technical data at issue would disclose "critical technology with military or space application" in order to withhold it from the public. Critical Technology is defined as technology consisting of: Arrays of design and manufacturing know-how (including technical data); Keystone manufacturing, inspection and test equipment (i.e., equipment specifically necessary for the effective application of a significant array of technical information and know-how); Keystone materials (i.e., materials specifically necessary for the effective application of a significant array of technical information and know-how); and Goods accompanied by sophisticated operation, application or maintenance know-how that would make significant contribution to the military potential of any country or combination of countries and compromise of which may prove detrimental to the security of the United States. NOTE: To assist in making a determination as to what constitutes critical technology with a military or space application, the Military Critical Technologies List (MCTL) may be used as general guidance. Page 6 of 33

7 The Freedom of Information Act The Freedom of Information Act (FOIA) (Section 552, Title 5, U.S. Code) as amended, implemented by DODD , DoD Freedom of Information Program and Army Regulation (AR) 25-55, The Department of the Army Freedom of Information Act Program, provides nine categories of information that can be exempt from public disclosure. They are: Exemption 1. (National Security) Information properly and currently classified in the interest of national defense or foreign policy, as specifically authorized under the criteria established by Executive Order and implemented by regulations such as DOD R, DoD Information Security Program Regulation. Exemption 2. (Internal Agency Rules) Information related solely to the internal personnel rules and practices of DoD or any of its Components. Exemption 3. (Governed by Other Statutes) Information concerning matters that a statute specifically exempts from disclosure by terms that permit no discretion on the issue, or in accordance with criteria established by that statute for withholding or referring to particular types of matters to be withheld. CUI normally falls under this exemption. Exemption 4. (Business Information) Records containing trade secrets or commercial or financial information that a DoD Component receives from a person or organization outside the Government with the understanding that the information or record will be retained on a privileged or confidential basis in accordance with the customary handling of such records. Exemption 5. (Internal Government Memos) Internal advice, recommendations, and subjective evaluations, as contrasted with factual matters, that are reflected in records pertaining to the decision-making process of an agency, whether within or among agencies, or within or among DoD Components. Page 7 of 33

8 The Freedom of Information Act (cont) Exemption 6. (Private Matters) Information in personnel and medical files, as well as similar personal information in other files, that, if disclosed to the requestor would result in a clearly unwarranted invasion of personal privacy. Exemption 7. (Law Enforcement) Records or information compiled for law enforcement purposes; i.e., civil, criminal, or military law, including the implementation of executive orders or regulations issued pursuant to law. Exemption 9. (Wells) Records containing geological and geophysical information and data (including maps) concerning wells. It is Exemption 3 of the FOIA, comprising information exempt from public disclosure pursuant to a statute, which is pertinent to the discussion of Technical CUI. Exemption 8. (Regulation of Financial Institutions) Information contained in or related to examination, operation or condition reports prepared by, on behalf of, or for the use of any agency responsible for the regulation or supervision of financial institutions. Page 8 of 33

9 Distribution Markings DoD Directive , Distribution Statements on Technical Documents, requires distribution statements to be placed on technical documents. These statements facilitate control, distribution and release of these documents without the need to repeatedly refer questions to the originating activity. Distribution statements on technical documents will be marked with notices that say, in essence, the following: Distribution Statement A - Approved for public release; distribution is unlimited. Distribution Statement B - Distribution authorized to U.S. Government agencies only; [reason}; [date]. Other requests for this document shall be referred to [controlling DOD office]. Distribution Statement C - Distribution authorized to U.S. Government agencies and their contractors; [reason]; [date]. Other requests for this document shall be referred to [controlling DOD office]. Distribution Statement D - Distribution authorized to the DOD and U.S. DOD contractors only; [reason]; [date]. Other requests for this document shall be referred to [controlling DOD office]. Distribution Statement E - Distribution authorized to DOD Components only; [reason]; [date]. Other requests for this document shall be referred to [controlling DOD office]. Distribution Statement F - Further distribution only as directed by [controlling DOD office] or higher DOD authority; [date]. Distribution Statement X - Distribution authorized to U.S. Government agencies and private individuals or enterprises eligible to obtain export-controlled technical data in accordance with regulations implementing 10 USC 140c; [date]. Other requests must be referred to [controlling DOD office]. Page 9 of 33

10 Distribution Markings (cont) As stated previously, it has been the policy of the DoD to place distribution statements on documents containing unclassified scientific and technical information which was produced either within DoD or on its behalf by others. Until recent times, however, this policy was only marginally directed toward restricting the disclosure of such information to the public and thus to foreign persons. Even though it was the policy to apply such distribution markings, the practice did not always conform to the policy. Page 10 of 33

11 Protecting National Assets Improper markings have resulted in sensitive, scientific and technical information finding its way into the public domain -- to include the foreign public. Situations where sensitive scientific data were improperly released, have been compounded with the enactment of the FOIA. The FOIA has made no provision for exempting unclassified government scientific and technical information from public disclosure, even that information which would be subject to export controls. Although the precise effect of this circumstance on the flow of sensitive U.S. technology overseas is debatable, there can be little doubt that unintended transfers of technology to foreign recipients occurred in this manner. Page 11 of 33

12 Protecting National Assets (cont) It was not until 1984 that the situation was remedied. Enactment of Public Law (PL) provided the Secretary of Defense with the authority to withhold critical technologies from the public. To implement PL 98-94, the Department of Defense published DoD Directive and updated the existing DoD Directive The former interprets and amplifies the provisions of the law and establishes procedures both for withholding such information from the public and for allowing dissemination to those persons, inside and outside the U.S. Government, who have a demonstrable need for the information. The latter is a revision and update of the old DoD policy pertaining to the application of distribution statements to unclassified technical documents. Page 12 of 33

13 CUI Handling Instructions CUI must be secured in a manner that precludes unauthorized access (e.g., locked in a desk drawer, file cabinet, or room to which access is controlled). It should be transmitted using secure voice, fax, or or encrypted, unless the originator waives this requirement. CUI may be mailed using first class or parcel post. CUI documentation may be destroyed by shredding or tearing into small pieces so that reconstruction is difficult. Page 13 of 33

14 Quiz Take a few minutes to challenge your knowledge by answering the following questions. Page 14 of 33

15 AR-CU202 Quiz 1 CUI is information to which access or distribution limitations have been applied according to national laws, policies, and regulations of the U.S. Government. a. True (correct answer) b. False Page 15 of 33

16 AR-CU202 Quiz 1 How many exemption categories are in the Freedom of Information Act? a. Six b. Seven c. Eight d. Nine (correct answer) Page 16 of 33

17 AR-CU202 Quiz 1 Technical CUI is unclassified information with what type of application(s)? a. Chemical or Nuclear b. Computer c. Military or Space (correct answer) d. None of the above Page 17 of 33

18 AR-CU202 Quiz 1 Arrays of design and manufacturing know-how (including technical data); Keystone manufacturing, inspection and test equipment; Keystone materials; and goods accompanied by sophisticated operation, application or maintenance know-how that would make a significant contribution to the military potential of any country or combination of countries and that may prove detrimental to the security of the United States is considered: a. Operation Technology b. Critical Technology (correct answer) c. Manufacturing Technology d. Defense Technology Page 18 of 33

19 Authority to Disclose Technical CUI Department of the Army (DA) agency heads, Army Command (ACOM) commanders, or Army Service Component Command (ASCC) commanders, who have applied a limited distribution statement in accordance with the DOD Directive to the technical unclassified information, have the authority to disclose that CUI. This authority may be further delegated in writing by DA agency heads, ACOM commanders, and ASCC commanders to the lowest level that may be an originator or proponent of CUI consistent with good security practices. In all cases, the disclosure of CUI to foreign entities requires the consent of the originator, as well as coordination with the program and what the foreign entities are allowed to have. In accordance with AR , the foreign disclosure community will provide disclosure action processing support, and advice and assistance with CUI disclosures to foreign entities. CUI Disclosure Guidelines Although designed as an aid in processing disclosure requests for classified military information, the following is a list of criteria (military and political) that may be used in rendering a decision regarding the disclosure of technical CUI to foreign governments, international organizations, or foreign contractors that are carried out under a U.S. Government international program or a U.S. Government-approved export authorization. Page 19 of 33

20 Authority to Disclose Technical CUI (cont) Military Considerations Country's ability and willingness to protect sensitive U.S. information. What elements are really critical? Does the system or do its components represent a significant advance in the state-of-the-art? What precedent exists for disclosure of this particular technology or system? Are comparable systems (foreign and domestic) using the same technology already in the marketplace? Can the critical technology resident in the system be reverse engineered? If so, what level of effort (in terms of time, funding and manpower) is required based on the technological capability of the foreign recipient? Has the technology or information resident in one U.S. Army weapons program been leveraged from another U.S. Army weapons program? If so, has the original U.S. Army weapons PM reviewed and rendered a recommendation on the munitions license request? The technology or information may not be listed as CPI for one program, but identified as CPI for another program. Page 20 of 33

21 Authority to Disclose Technical CUI (cont) Additional Military Considerations Are there any special considerations involved with the disclosure that requires coordination external to the U.S. Army? For example, communications security, low observable, cryptologic information, etc. If so, have proper approvals been obtained? The degree of participation in collective security by the U.S. How the disclosure would affect coalition warfare in support of U.S. policy. How the disclosure would increase the recipient country's offensive or defense capability. Marked CONFIDENTIAL for training purposes only How the disclosure would increase the capability of friendly regional forces to provide regional security to assist the U.S. in the protection of strategic lines of communication. How the disclosure shall strengthen U.S. or allied power projection. Page 21 of 33

22 Authority to Disclose Technical CUI (cont) More Military Considerations: To what extent the disclosure is in consonance with U.S. military plans (e.g., the "Combatant Commander's Theater Support Plan and Army Security Cooperation Plan). How the disclosure would strengthen the Army Technology Base via quid pro quo resulting from this release. Whether or not the disclosure is consistent with Army regional multinational force compatibility policy. Whether or not the information supports a force structure requirement. Can the country's technology base support the information? To what degree the disclosure counters the country's threat. Political Considerations The potential foreign recipient's support for U.S. foreign policy and political objectives. The potential of the disclosure to deny or reduce an influence or presence in the country that is hostile to U.S. interests. The effects of the regional and global strategic balance if the disclosure is approved. Whether or not the country has a defense treaty or political agreement with the United States. The political benefits that could accrue to the United States. Whether or not the disclosure assists the U.S. in obtaining or securing base, transit, and over-flight rights or access to strategic locations. Other countries to which the U.S. has disclosed the information. Page 22 of 33

23 Authority to Disclose Technical CUI (cont) Additional Political Considerations: The possible reaction of other countries in the region to the proposed disclosure. Whether or not the U.S. is the first supplier of the information. The possibility that the information could fall into the hands of terrorists. The impact of the disclosure on the country's economy. Whether or not the disclosure establishes an unfavorable political precedent. Does the disclosure support U.S. foreign policy objectives? Before authorizing CUI disclosures, the CUI Disclosure Authority shall ensure that the contract or agreement contains the requisite access, use, and distribution clauses required before disclosing CUI to another government, international organization, or foreign contractor. CUI Disclosure Authorities may obtain assistance from the local legal office. Page 23 of 33

24 Authority to Disclose Technical CUI (cont) More Political Considerations: If technical CUI originated by another command or agency is resident in a technical CUI document proposed for disclosure to a foreign government, the proponent command or agency of the technical CUI document is responsible for obtaining the approvals for the disclosure of that CUI data belonging to the other originator. At a minimum, Disclosure Officials should apply the principles of disclosure (i.e. disclosure criteria) to all disclosures of CUI. These specific criteria are: The release must support U.S. foreign policy, national security objectives, and military security objectives regarding the intended recipient government or international organization. The release must not jeopardize U.S. military security. The disclosure must result in a clearly defined benefit to the United States. The proposed recipient has the intent and capability to provide the same degree of protection as given the information by the United Sates. The disclosure is limited to that information necessary to satisfy the purpose for which the disclosure is made. Unauthorized disclosures of technical CUI data controlled by the Arms Export Control Act can result in criminal prosecution. Page 24 of 33

25 Disclosure of Technical CUI to Non-Government Persons For the purposes of this training and Army policy, nongovernment persons are defined as all private foreign citizens not representing a foreign government, international organization or foreign contractor. Regardless of the means by which a request involving the potential disclosure of technical CUI from a nongovernment person enters the U.S. Army, the action command or agency should apply its local procedures in processing the request. In disclosing technical CUI to non-government persons, the originator or proponent authorizing the disclosure is responsible for removing the limited distribution statement caveat from the document prior to release and notifying the Defense Technical Information Center to change the limited distribution statement to Distribution Statement A (Approved for Public Release; Distribution Unlimited). Army Regulation 360-5, The Army Public Affairs Program, also applies. U.S. Contractors and academics who possess technical CUI stemming from participation in a DOD acquisition effort (e.g. Cooperative Research and Development Agreement {CRDA}) and desire to disclose (export) this information to any foreign recipient (e.g., employment of a non- U.S. person - foreign student, researcher, etc.), must apply for and obtain an export authorization from the appropriate export authority: The Department of State, Office of Defense Trade Controls, or the Department of Commerce, Bureau of Export Administration. Any such application shall include a statement that the technical data for which export authorization is sought is controlled by the Department of Defense. Page 25 of 33

26 Authority to Disclose Technical CUI Quiz Take a few minutes to challenge your knowledge by answering the following questions. Page 26 of 33

27 AR-CU202 Quiz 2 If a limited distribution statement is applied in accordance with DOD Directive to technical unclassified information, who has the authority to disclose that CUI? a. Department of the Army (DA) agency heads b. Army Command (ACOM) commanders c. Army Service Component Command (ASCC) commanders d. All of the above (correct answer) Page 27 of 33

28 AR-CU202 Quiz 2 Which of the following is a military consideration in rendering a decision regarding the disclosure of technical CUI? a. The country's ability and willingness to protect sensitive U.S. information b. How the disclosure would increase the recipient country's offensive or defense capability c. The impact of the disclosure on the country's economy d. Both a and b (correct answer) Page 28 of 33

29 AR-CU202 Quiz 2 Which of the following is a political consideration in rendering a decision regarding the disclosure of technical CUI? a. Can the country's technology base support the information? b. The degree of participation in collective security by the U.S. c. Other countries to which the U.S. has disclosed the information (correct answer) d. None of the above Page 29 of 33

30 Summary This course provided an overview of technical controlled unclassified information (CUI). There are two types of unclassified information; Controlled Unclassified Information and public domain information. CUI includes U.S. information that is determined to be exempt from public disclosure according to DODD and DODD , DoD Freedom of Information Program. It also includes U.S. information that is subject to export controls. Foreign Disclosure personnel are concerned with Technical CUI, which is unclassified information with military or space applications. The Secretary of Defense has the authority to withhold from the public "unclassified technical data with military or space application in the possession of or under the control of a DoD Component, which may not be exported lawfully without an approval authorization, or license under the Export Administration Act or the Arms Export Control Act (AECA)." Page 30 of 33

31 Summary (cont) Critical Technology is defined as technology consisting of: Arrays of design and manufacturing know-how; Keystone manufacturing, inspection, and test equipment; keystone materials; and goods accompanied by sophisticated operation, application or maintenance knowhow that would make significant contribution to the military potential of any country or combination of countries and compromise of which may prove detrimental to the security of the U.S. The Freedom of Information Act (FOIA) requires that government information be made available to the public, unless the information falls within one or more of nine exemption categories (described in the Act) and a U.S. Government official determines that it should be withheld from disclosure. Exemption category 3 of the FOIA (Information that a statute specifically exempts from disclosure) is most important as it relates to CUI. DoD Directive requires distribution statements to be placed on technical documents. These statements facilitate control, distribution and release of these documents without the need to repeatedly refer questions to the originating activity. The statements are marked with Distribution Statement A through F and X. PL provided the Secretary of Defense with the authority to Withhold critical technologies from the public. To implement PL 98-94, the Department of Defense published DoD Directive and updated the existing DoD Directive Department of the Army (DA) agency heads, Army Command (ACOM) commanders, or Army Service Component Command (ASCC) commanders, who have applied a limited distribution statement in accordance with the DOD Directive to the technical unclassified information, have the authority to disclose that CUI. Page 31 of 33

32 Summary (cont) In all cases, the disclosure of CUI to foreign entities requires the consent of the originator, as well as coordination with the program and what the foreign entities are allowed to have. When rendering a decision regarding the disclosure of technical CUI to foreign governments, international organizations, or foreign contractors that are carried out under a U.S. Government international program or a U.S. Government-approved export authorization, a list of both military and political criteria (provided in this course) should be reviewed. In disclosing technical CUI to nongovernment persons, the originator or proponent authorizing the disclosure is responsible for removing the limited distribution statement caveat from the document prior to release and notifying the Defense Technical Information Center to change the limited distribution statement to Distribution Statement A (Approved for Public Release; Distribution Unlimited). U.S. Contractors and academia who possess technical CUI stemming from participation in a DOD acquisition effort and desire to disclose (export) this information to any foreign recipient must apply for and obtain an export authorization from the appropriate export authority. Page 32 of 33

33 Course Exam You have now completed the learning portion of the course. Take a few minutes to test your knowledge by taking the following Controlled Unclassified Information Exam by clicking on the link in the My Exams section on your home page. Page 33 of 33