Classified information in the United States
The United States government classification system is established under Executive Order 13526, the latest in a long series of executive orders on the topic of classified information beginning in 1951. Issued by President Barack Obama in 2009, Executive Order 13526 replaced earlier executive orders on the topic and modified the regulations codified to 32 C.F.R. 2001. It lays out the system of classification, declassification, and handling of national security information generated by the U.S. government and its employees and contractors, as well as information received from other governments.
The desired degree of secrecy about such information is known as its sensitivity. Sensitivity is based upon a calculation of the damage to national security that the release of the information would cause. The United States has three levels of classification: Confidential, Secret, and Top Secret. Each level of classification indicates an increasing degree of sensitivity. Thus, if one holds a Top Secret security clearance, one is allowed to handle information up to the level of Top Secret, including Secret and Confidential information. If one holds a Secret clearance, one may not then handle Top Secret information, but may handle Secret and Confidential classified information.
The United States does not have a British-style Official Secrets Act. Instead, several laws protect classified information, including the Espionage Act of 1917, the Invention Secrecy Act of 1951, the Atomic Energy Act of 1954 and the Intelligence Identities Protection Act of 1982. A 2013 report to Congress noted that the relevant laws have been mostly used to prosecute foreign agents, or those passing classified information to them, and that leaks to the press have rarely been prosecuted. The legislative and executive branches of government, including US presidents, have frequently leaked classified information to journalists. Congress has repeatedly resisted or failed to pass a law that generally outlaws disclosing classified information. Most espionage law criminalizes only national defense information; only a jury can decide if a given document meets that criterion, and judges have repeatedly said that being "classified" does not necessarily make information become related to the "national defense". Furthermore, by law, information may not be classified merely because it would be embarrassing or to cover illegal activity; information may be classified only to protect national security objectives.
Over the past decades under most administrations the United States has released classified information to foreign governments for diplomatic goodwill, known as declassification diplomacy. An example includes information on Augusto Pinochet to the government of Chile. In October 2015, US Secretary of State John Kerry provided Michelle Bachelet, Chile's president, with a pen drive containing hundreds of newly declassified documents.
A 2007 research report by Harvard history professor Peter Galison, published by the Federation of American Scientists, claimed that the classified universe in the US "is certainly not smaller and very probably is much larger than this unclassified one.... secrecy... is a threat to democracy."
Terminology
The U.S. government uses the term Controlled Unclassified Information to refer to information that is not Confidential, Secret, or Top Secret, but the dissemination of which is still restricted.Reasons for such restrictions can include export controls, privacy regulations, court orders, and ongoing criminal investigations, as well as national security. Information that was never classified is sometimes referred to as "open source" by those who work in classified activities. Public Safety Sensitive refers to information that is similar to Law Enforcement Sensitive but could be shared between the various public safety disciplines.
Peter Louis Galison, a historian and director in the History of Science department at Harvard University, claims that the U.S. government produces more classified information than unclassified information.
Spillage is defined as a security incident that results in the transfer of classified information onto an information system not authorized to store or process that information.
Levels and categories of classification
The United States government classifies sensitive information according to the degree to which the unauthorized disclosure would damage national security. The three primary levels of classification are Confidential, Secret, and Top Secret.However, even Top Secret clearance does not allow one to access all information at, or below, Top Secret level. Access requires the clearance necessary for the sensitivity of the information, as well as a legitimate need to obtain the information. For example, all US military pilots are required to obtain at least a Secret clearance, but they may only access documents directly related to their orders.
To ensure that only those with a legitimate need to know can access information, classified information may have additional categorizations/markings and access controls that could prevent even someone with a sufficient level of clearance from seeing it. Examples of this include: Special Access Program, Sensitive Compartmented Information, Restricted Data, Transclassified Foreign Nuclear Information, and Alternative or Compensatory Control Measures.
The classification system is governed by Executive Order rather than by law. An exception is information on nuclear weapons, materials and power, where levels of protection are specified in the Atomic Energy Act of 1954, see restricted data. Typically each president will issue a new executive order, either tightening classification or loosening it. The Clinton administration made a major change in the classification system by issuing an executive order that for the first time required all classified documents to be declassified after 25 years unless they were reviewed by the agency that created the information and determined to require continuing classification. Executive Order 13292, issued by President George W. Bush in 2003 relaxed some declassification requirements.
Primary levels
Confidential
This is the lowest classification level of information obtained by the government. It is defined as information that would "damage" national security if publicly disclosed, again, without the proper authorization.Examples include information related to military strength and weapons.
During and before World War II, the U.S. had a category of classified information called Restricted, which was below confidential. The U.S. no longer has a Restricted classification, but many other countries and NATO documents do. The U.S. treats Restricted information it receives from other governments as Confidential. The U.S. does use the term restricted data in a completely different way to refer to nuclear secrets, as described below.
Secret
This is the second-highest classification. Information is classified Secret when its unauthorized disclosure would cause "serious damage" to national security. Most information that is classified is held at the secret sensitivity."Examples of serious damage include disruption of foreign relations significantly affecting the national security; significant impairment of a program or policy directly related to the national security; revelation of significant military plans or intelligence operations: compromise of significant military plans or intelligence operations; and compromise of significant scientific or technological developments relating to national security."
Top Secret
The highest security classification. "Top Secret shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause 'exceptionally grave damage' to the National Security that the original classification authority is able to identify or describe." As of 2019, around 1.25 million individuals have Top Secret clearance."Examples of exceptionally grave damage include armed hostilities against the United States or its allies; disruption of foreign relations vitally affecting the national security; the compromise of vital national defense plans or complex cryptology and communications intelligence systems; the revelation of sensitive intelligence operations, and the disclosure of scientific or technological developments vital to national security."
Additional proscribed categories
Top Secret is the highest level of classification. However some information is further categorized/marked by adding a code word so that only those who have been cleared for each code word can see it. A document marked SECRET//SPECIAL ACCESS REQUIRED- could be viewed only by a person with a secret or top secret clearance and that specific code word clearance.Special Access Program
Executive Order 13526, which forms the legal basis for the U.S. classification system, states that "information may be classified at one of the following three levels", with Top Secret as the highest level. However, this executive order provides for special access programs that further restricted access to a small number of individuals and permit additional security measures.These practices can be compared with the concepts multilevel security and role-based access control. U.S. law also has special provisions protecting information related to cryptography, nuclear weapons and atomic energy and the identity of covert intelligence agents.
Sensitive Compartmented Information
Classified information concerning or derived from sensitive intelligence sources, methods, or analytical processes. All SCI must be handled within formal access control systems established by the Director of National Intelligence.Restricted Data/Formerly Restricted Data
Restricted Data and Formerly Restricted Data are classification markings that concern nuclear information. These are the only two classifications that are established by federal law, being defined by the Atomic Energy Act of 1954. Nuclear information is not automatically declassified after 25 years. Documents with nuclear information covered under the Atomic Energy Act will be marked with a classification level and a restricted data or formerly restricted data marking.Nuclear information as specified in the act may inadvertently appear in unclassified documents and must be reclassified when discovered. Even documents created by private individuals have been seized for containing nuclear information and classified. Only the Department of Energy may declassify nuclear information.
Most RD and FRD are classified at either the Confidential or Secret levels; however they require extra RD/FRD specific clearances in addition to the clearance level.