Sometime in the next few years, if a memorandum signed by President Bush this month ever goes into effect, one government official talking to another about information on terrorists will have to begin by saying: "What I am about to tell you is controlled unclassified information enhanced with specified dissemination."
That would mean, according to the memo, that the information requires safeguarding because "the inadvertent or unauthorized disclosure would create risk of substantial harm."
Bush's memorandum, signed on the eve of his daughter Jenna's wedding, introduced "Controlled Unclassified Information" as a new government category that will replace "Sensitive but Unclassified."
Such information - though it does not merit the well-known national security classifications "confidential," "secret" or "top secret" - is nonetheless "pertinent" to U.S. "national interests" or to "important interests of entities outside the federal government," the memo says.
The information could be, for example, the steps taken to protect power plants from terrorists, or which pipelines are most vulnerable to attack.
Left undefined are which laws or policies generated the requirement for protecting such information, and which interests are pertinent. But Bush's memo does refer to the "global nature of the threats facing the United States" and to the need to ensure that the "entire network of defenders be able to share information more rapidly" while protecting "sensitive information, information privacy, and other legal rights of Americans."
The president declared that the purpose of the new classification is "to standardize practices and thereby improve the sharing of information, not to classify or declassify new or additional information." But some critics described it as continuing an expansion of secrecy in government and a potential bureaucratic nightmare.
Michael Clark, a contributing editor to the blog Daily Kos, who first wrote about the Bush memorandum, said the White House "seems to have used the crafting of new rules as an opportunity to expand the range of government secrecy." Steven Aftergood, director of the Federation of American Scientists' Project on Government Secrecy, described it as a "not even half-baked" exercise in policymaking.
The new classification, like the old one, was created because of the need for people who handle terrorism information to share it not just within the federal government but also outside it. "The changes will make labeling and sharing information more effective," said an administration official, and do away with other government designations such as "For Official Use Only" and "Law Enforcement Sensitive."
The tough job of implementing the new system was assigned to the National Archives and Records Administration. The Archives, which oversees the current security classification system, was given five years to implement the program throughout federal, state and local governments as well as in "tribal, private sector and foreign partner entities."
The Controlled Unclassified Information designation was the product of a year-long government study of how to replace the "sensitive but unclassified" category. "Among the 20 departments and agencies ... surveyed, there are at least 107 unique markings and more than 131 different labeling or handling processes and procedures for SBU information," Ted McNamara of the office of the director of national intelligence told the House Homeland Security Committee in April 2007.
The Archives was asked to create a single set of policies and procedures on the way materials should be marked, stored safely and disseminated. There are to be three categories of dissemination - standard, specified and enhanced specified. The latter two require measures to reduce possible disclosure.
Designating information as CUI is left to the "head of the originating department or agency," based on "mission requirements, business prudence, legal privilege, the protection of personal or commercial rights, safety, or security."
The Archives will establish "enforcement mechanisms and penalties for improper handling of CUI." The "controlled" classification "may inform," but will not determine, whether information can be made public in response to a Freedom of Information Act request.
All CUI information, either produced by or for the federal government, is to be marked "controlled," regardless of how it is conveyed. Bush's memo specifically requires that "oral communications should be prefaced with a statement describing the controls when necessary to ensure that recipients are aware of the information's status."