The White House today issued an executive order to establish a uniform policy for handling “controlled unclassified information” (CUI), which is information that is restricted from disclosure because it involves personal privacy, proprietary data, law enforcement investigations, or for certain other reasons besides national security.
The new CUI framework will replace the multiplicity of agency markings such as “sensitive but unclassified,” “for official use only,” and over a hundred more. By prohibiting the use of such improvised markings and by adopting a standard CUI marking which is subject to external approval and oversight across the executive branch, the new policy is expected to facilitate information sharing among agencies without fostering new secrecy.
CUI policy had been an open, unresolved item on the government’s information policy agenda for nearly five years, ever since President Bush directed agency heads to “standardize procedures for sensitive but unclassified information” in a December 16, 2005 memorandum.
Significantly, the executive order on CUI does not create any new authority to withhold information from disclosure. It limits the use of the CUI marking to information that is already protected by statute, by regulation or by government-wide policy. Furthermore, it requires agencies to gain the approval of the CUI “Executive Agent” before using the CUI marking on any particular category of information. And it mandates that all such approved categories are to be made public on an official Registry.
In short, the CUI program seems well-crafted to streamline information handling in the executive branch without creating any new obstacles to public access.
But it almost turned out very differently, and one of the most important secrecy policy stories of recent years is what did not happen in the lengthy deliberative process over CUI. What was poised to happen — but didn’t — is that CUI nearly became an adjunct part of a vastly expanded national security classification system.
As recently as last summer, the proposed CUI concept had all of the essential attributes of classification. Under a July 2010 draft of the executive order (pdf), agencies would have been permitted to impose CUI controls using a loose, undefined standard (“compelling need”). Access to CUI would have been conditional on a form of “need to know.” And unauthorized disclosure of CUI would have been subject to administrative or criminal sanctions.
In every significant respect, CUI would have constituted another level of classification, by another name. It would have overwhelmed efforts to rein in and reduce official secrecy.
Fortunately a different path was chosen. To an unusual extent, the Obama Administration consulted with public interest groups on the emerging CUI policy. In response to their comments, the attributes of classification that appeared in previous drafts were not merely modified but were eliminated altogether. The result is a tightly focused executive order that clearly articulates a problem and advances a sensible solution to it.
When a hurricane hits, it’s all hands on deck – that goes for federal data, too. Pulling back from our investments in timely, accurate, and accessible public data will only make us less prepared and put us all at greater risk.
This is bigger than a singular elimination of race and ethnicity questions. It could accelerate the second wave of widespread reductions to demographic data, leaving public health officials with even less information to deliver better health outcomes for all Americans.
Soft law was never meant to be a permanent solution. Treating it as one, and letting the sandcastle stand in for the skyscraper indefinitely, is how we end up with a decade of voluntary commitments and no enforceable accountability to show for it.
FAS has partnered with ICLEI USA to launch the CRI Local Advisory Council.