Administration Lays Foundation for New CUI System
Seven months after President Obama issued an executive order on controlled unclassified information (CUI), the outlines of a new CUI system are taking shape. On June 9, the National Archives and Records Administration's (NARA) CUI office released initial guidance on implementing the order.
The notice lays the foundation for a system of CUI categories overseen by NARA and disclosed to the public, as called for in the executive order. Previously, agencies established methods for controlling unclassified information on an ad hoc basis, often without standards or oversight, resulting in an opaque and confusing jumble that stymied public access and inhibited information sharing.
Contents of the Guidance
The guidance requires agencies that handle CUI to establish a program for implementing the new CUI system, including training, markings, dissemination instructions, and decontrol procedures. Each agency is required to develop CUI training for its personnel. Transparency advocates have expressed concern that without adequate training, misunderstandings of CUI among agency staff could result in improperly applying the new system in a manner that unduly restricts public access. Agencies are also required to conduct self-inspections to assess compliance.
The guidance also establishes a uniform system for marking documents as CUI and encourages agencies to mark only the portions of a document subject to controls, rather than the entire document. Portion marking, which is required for classified information, can facilitate public access by limiting the amount of information controlled. The guidance makes clear that if a document bearing pre-CUI labels is reused, the prior labels are to be removed and the information is only to be designated as CUI if it meets the current requirements.
Besides the dissemination controls attached to specific categories, the guidance states that "agencies shall disseminate CUI only to individuals who require the information for an authorized mission purpose." Open government experts have raised concerns that this vague requirement could unduly restrict information sharing or public disclosure.
The guidance states that "CUI shall be decontrolled as soon as possible" and that "CUI may not be controlled indefinitely unless law, regulation, or Government-wide policy so stipulates." Each CUI category will have a "specific time frame or event" for decontrolling information. The guidance does not indicate what the time frames or events for decontrol will be, other than that a few categories may be controlled indefinitely.
In addition, the guidance states that CUI will be decontrolled prior to public release but does not specify the procedures to decontrol information. If the procedures are cumbersome, it could lead to delays or otherwise inhibit public access.
The guidance provides for NARA to oversee agency compliance with the new system, which could include formal reviews and audits. Advocates expect active involvement from NARA will be crucial to smoothly transitioning to the new system and overcoming inertia in the agencies.
While the guidance logically lays out many of the needed components of a CUI program, there are several aspects missing that open government advocates sought. First, the guidance does not include any firm requirements for agencies or NARA to consult with the public when developing policies to implement the new CUI system. Such participation and collaboration is credited by many public interest groups as a vital aspect to the development of the E.O. on CUI.
The guidance also does not require agencies or NARA to publish any information about CUI policies or the operation of the CUI system, other than the registry of categories. The open government community had recommended that agency CUI policies, self-inspection reports, and NARA implementation reports, for instance, be required as public records for all agencies. Open government groups had also asked for statistical data on the use of each CUI category.
In addition, the guidance does not include a mechanism for the public to request that information be decontrolled or that a CUI category be removed from the registry. The comparable procedure for classified information, Mandatory Declassification Review, is seen as a powerful tool for expanding public access and providing a check on overclassification.
The guidance also does not require the use of personal identifiers to indicate the individual who controlled a document. This practice is required in the classification system as a means to ensure accountability, such as identifying personnel who inappropriately classify information.
Agencies now have six months to develop a plan for complying with the guidance. Following that, NARA will establish deadlines for the agencies to phase into full implementation. NARA is also expected to issue additional guidance in the coming months, providing additional detail on how the new CUI system will function.
Perhaps the most critical decisions will be over approving categories for inclusion in the CUI registry. NARA will determine approved CUI categories based on agency submissions and publish a list online by November. The registry will cite the law, regulation, or government-wide policy that authorizes each category, as well as any sanctions established in the law or regulation. The executive order states that NARA cannot turn down categories with a solid basis in law, regulation, or government-wide policy. However, some agencies will likely argue doggedly to retain legacy categories without such a basis. In addition, the order authorizes NARA to "resolve conflicts among categories," which raises the promising but logistically challenging opportunity to replace multiple similar categories across several agencies with a uniform set of rules.