Defense Department Takes Narrower Approach to Controlled Unclassified Information
by Gavin Baker, 12/4/2013
A new Department of Defense (DOD) rule requires defense contractors to protect “unclassified controlled technical information” from unauthorized access and disclosure. The rule, issued Nov. 18, is much narrower than DOD’s proposed rule, which had raised concerns that it could result in the inappropriate withholding of public information. However, questions remain about how the rule will interact with the new system of controlled unclassified information (CUI) being set up government-wide.
CUI refers to information that is “sensitive but unclassified” and therefore has certain restrictions on how it must be stored, whether it can be shared, and the like. For instance, individual data collected by the Census Bureau must be protected in certain ways and restricted from public access.
While there are valid reasons why unclassified information could need to be controlled, there is also a risk that such restrictions could be misused to withhold information that ought to be public. This was of particular concern under the old decentralized CUI system, when agencies created numerous vague categories without any coordination or overall framework. The confusion and lack of oversight also meant that information was sometimes improperly withheld from the American people.
In 2010, as an attempt to rein in the previous system, President Obama issued an executive order creating a unified program to manage restrictions on unclassified information in order to increase oversight and consistency across agencies. However, implementation of the executive order has been slow and has left a vacuum for agencies to promulgate their own CUI rules and categories.
Narrower DOD Rule
The DOD originally proposed requiring contractors to safeguard any unclassified information that had not been specifically approved for public release. As we warned at the time, this would have turned the presumption of openness on its head and instead treated unclassified information, by default, as controlled – a dangerous precedent. Moreover, such an approach would almost certainly have led to unnecessary withholding, as contractors would have had no easy way to tell whether particular information could be released and so would treat all information as restricted.
Thankfully, the DOD abandoned that approach in the final rule. Instead, the rule now only requires safeguarding for a single, narrower category of information: unclassified controlled technical information.
Unfortunately, the DOD’s rule still seems detached from the developing CUI framework. The category of “unclassified controlled technical information” does not seem to be included in the CUI Registry, which is the sole list of authorized CUI categories. It’s unclear whether the DOD intends to submit the category for listing in the registry, or whether it considers the rule outside the scope of the CUI policy.
Update: According to the CUI office at NARA, the DOD rule was developed in collaboration with the CUI office and is intended to align with future CUI requirements, and the DOD will submit “unclassified controlled technical information” as a proposed category for inclusion in the CUI registry.
Setting Up the New CUI System
Generally, the DOD comments, “Federal CUI policy has not yet been promulgated for Federal Government agencies and it is unknown when Federal policy will be developed for industry as it relates to CUI.” This raises an important problem.
Although President Obama issued the CUI executive order in 2010, agencies have not yet implemented the new system. The executive order left key procedural requirements to be developed by the National Archives and Records Administration (NARA), the agency charged with overseeing the CUI system. The CUI office in NARA issued initial guidance in 2011 but left out many significant details. Those details have to be worked out before full implementation can begin.
In the meantime, agencies and NARA are stuck in an awkward transition stage. Because the new CUI system has not gone fully into effect, agencies like the DOD are trying to meet their needs in the present while also preparing to meet unknown future requirements. If this drags on, it could undermine the reforms that President Obama issued.
NARA has made some progress in filling in the missing pieces of the new CUI framework – while severely understaffed for executing this mission. Nonetheless, it’s time to get the job done.
In this case, the DOD addressed the largest concerns raised by the open government community by narrowing its rule. However, we recognize the challenges faced by agencies dealing with CUI in the absence of the necessary policies to implement the new CUI system. Therefore, we urge the prompt completion of those policies so implementation can begin and the reforms issued by President Obama three years ago can finally come to fruition.
Elizabeth Hempowicz contributed to this post.