A New Policy on Controlled Unclassified Info

The White House today issued an executive order to establish a uniform policy for handling “controlled unclassified information” (CUI), which is information that is restricted from disclosure because it involves personal privacy, proprietary data, law enforcement investigations, or for certain other reasons besides national security.

The new CUI framework will replace the multiplicity of agency markings such as “sensitive but unclassified,” “for official use only,” and over a hundred more.  By prohibiting the use of such improvised markings and by adopting a standard CUI marking which is subject to external approval and oversight across the executive branch, the new policy is expected to facilitate information sharing among agencies without fostering new secrecy.

CUI policy had been an open, unresolved item on the government’s information policy agenda for nearly five years, ever since President Bush directed agency heads to “standardize procedures for sensitive but unclassified information” in a December 16, 2005 memorandum.

Significantly, the executive order on CUI does not create any new authority to withhold information from disclosure.  It limits the use of the CUI marking to information that is already protected by statute, by regulation or by government-wide policy.  Furthermore, it requires agencies to gain the approval of the CUI “Executive Agent” before using the CUI marking on any particular category of information.  And it mandates that all such approved categories are to be made public on an official Registry.

In short, the CUI program seems well-crafted to streamline information handling in the executive branch without creating any new obstacles to public access.

But it almost turned out very differently, and one of the most important secrecy policy stories of recent years is what did not happen in the lengthy deliberative process over CUI.  What was poised to happen — but didn’t — is that CUI nearly became an adjunct part of a vastly expanded national security classification system.

As recently as last summer, the proposed CUI concept had all of the essential attributes of classification.  Under a July 2010 draft of the executive order (pdf), agencies would have been permitted to impose CUI controls using a loose, undefined standard (“compelling need”).  Access to CUI would have been conditional on a form of “need to know.”  And unauthorized disclosure of CUI would have been subject to administrative or criminal sanctions.

In every significant respect, CUI would have constituted another level of classification, by another name.  It would have overwhelmed efforts to rein in and reduce official secrecy.

Fortunately a different path was chosen.  To an unusual extent, the Obama Administration consulted with public interest groups on the emerging CUI policy.  In response to their comments, the attributes of classification that appeared in previous drafts were not merely modified but were eliminated altogether.  The result is a tightly focused executive order that clearly articulates a problem and advances a sensible solution to it.