FAS

DoD Issues New Information Security Regulation

02.27.12 | 3 min read | Text by Steven Aftergood

The Department of Defense has published its long-awaited new information security regulation that finally brings the Department into conformity with the Obama Administration’s 2009 executive order on national security classification policy.

The new regulation, published in four volumes as DoD Manual 5200.01 and dated 24 February 2012, replaces Information Security Regulation 5200.1-R, which dates from 1997.

DoD is by far the largest and most prolific generator of classified information in the government.  So every shift in DoD information policy (as well as every failure to shift) has significant ramifications for the secrecy system as a whole.

The new regulation generally follows the classification guidelines set by the Obama executive order but it also elaborates on them in interesting ways.  It presents comprehensive guidance on practically every aspect of classification and declassification policy, including an extended discussion of how to respond to unauthorized disclosures of classified information (in volume 3, Enclosure 6).

Other notable provisions in the first volume of the new regulation include the following.

“If holders of information have substantial reason to believe that the information is improperly or unnecessarily classified, they shall communicate that belief to their security manager or the OCA [original classification authority] to bring about any necessary correction….  The Heads of the DoD Components shall ensure that no retribution is taken against any individual for questioning a classification or making a formal challenge to a classification.” (Vol. 1, p. 49)

Each DoD component is required to establish a self-inspection program, which “shall include regular review and assessment of representative samples of the DoD Component’s classified products. Appropriate officials shall be authorized to correct misclassification of information.” (p. 13)

The Assistant Secretary of Defense (NII) shall “Direct the use of technical means to prevent unauthorized copying of classified data and for anomaly detection to recognize unusual patterns of accessing, handling, downloading, and removal of digital classified information.” (p. 12)

“DoD military and civilian personnel may be subject to criminal or administrative sanctions if they knowingly, willfully, or negligently:
(a) Disclose to unauthorized persons information properly classified in accordance with this Volume.
(b) Classify or continue the classification of information in violation of this Volume.
(c) Create or continue a SAP [special access program] contrary to the requirements of… this Volume….”  (p.32)

The Fundamental Classification Guidance Review, which was mandated by the executive order to eliminate obsolete classification instructions, shall encompass “a broad range of perspectives,” the new regulation states. The involvement of outside experts is essential, the regulation seems to recognize, in order to compensate for self-interest, prejudice, and habitual patterns of thought.  “Contributions of subject matter experts with sufficient expertise in narrow specializations must be balanced by the participation of managers and planners who have broader organizational vision and relationships. Additionally, to the extent practicable, input should also be obtained from external subject matter experts and external users of the classification guidance.”  (p. 73)

The new regulation is effective immediately.

A February 16 report from DoD on the Fundamental Classification Guidance Review indicated that of the 1069 security classification guides that had been reviewed by the end of December 2011, no fewer than 318 guides had been scheduled for retirement or cancellation.  (“DoD Reports ‘Impressive Strides’ in Updating Classification,” Secrecy News, February 22.)

publications
See all publications
Clean Energy
Blog
Fixing a Broken Market: A Plan for Cheaper Freight, Cleaner Air, and American Truck Leadership

Americans are paying too much for almost everything, because the United States has long treated its trucking industry as an artifact to be preserved rather than as an opportunity for innovation.

06.16.26 | 9 min read
read more
Emerging Technology
Report
SOURCE CODE: A Policy Agenda for Fostering Trust and Fairness in AI

These ideas aim to advance the detailed policy solutions needed to foster public trust and implement fairness in the adoption of AI across diverse domains, from healthcare and government benefits to rural access, education, and worker protections.

06.11.26 | 17 min read
read more
Emerging Technology
day one project
Policy Memo
Move Algorithmic-Driven Pay and Scheduling Systems From Surveillance Pay to Fair Wages

The evidence is clear: algorithmic pay-setting is established in app-based work, and payroll/timekeeping failures show how software can produce systemic wage harm at scale

06.11.26 | 15 min read
read more
Emerging Technology
day one project
Policy Memo
How State Leaders Can Put People First in AI Decision-Making

While a few states have taken steps to implement decision-making mechanisms for certain AI systems, too many leaders are simply accepting narratives about AI’s purported public benefit at face value – jumping to the “how” of AI implementation before thoroughly vetting potential systems and deciding whether they are appropriate to use at all.

06.11.26 | 17 min read
read more