Many questions have been raised about how to design uniform policies and controls for SBU information. More recently, some researchers have initiated voluntary controls on the conduct and/or publication of sensitive research in biological sciences fields that might assist terrorists. To prevent potential use of sensitive information by terrorists, in March 2002, the White House issued the so-called "Card memo," which required agencies to examine their information holdings and policies; withhold information, including "sensitive but unclassified" information; and use FOIA exemptions if there was a sound legal basis to do so. The Freedom of Information Act Guide, 2004 , explained how an agency's ability to restrict the release of "sensitive" information via FOIA would be broadened; and, citing the September 11, 2001, attacks, the passage of P.L. In a related development, on December 16, 2005, the President issued a memorandum to federal agencies, "Guidelines and Requirements in Support of the Information Sharing Environment," that included requiring agencies to standardize procedures "for designating, marking, and handling SBU information ... across the Federal Government" in order to promote both appropriate, consistent safeguarding and sharing of information. In November 2006, the Program Manager for the Information Sharing Environment issued a report entitled, Information Sharing Environment Implementation Plan . 107-347 updated NIST's mission in light of new understandings relating to information security and required NIST, in consultation with other agencies, including OMB, the National Security Agency, the Government Accountability Office (GAO), and the DHS, to develop risk-based standards to categorize "the criticality and sensitivity of agency information according to information security control objectives and across a range of risk levels" and to develop minimum information security requirements for each information category. It is likely that some scientists will object to guidelines requiring prepublication review. Nongovernmental professional groups have explored the use of codes of conduct or self-policing policies for research topics and publications. Congressional action in 2004 tightened controls on some geospatial information. During the 109 th Congress, H.R. These criticisms, which are discussed next, focus on allegations that some controls can exacerbate vulnerability or stifle scientific research and technological innovation; vagaries in nondisclosure requirements; the relationship of SBU to FOIA; inconsistency in agencies' definitions of and processes to identify SBU information; developing a standard definition of SBU information; monitoring agency use of risk-based standards for SBU; and recommendations for better governance of SBU information procedures. (For additional information, see a previous section of this report entitled " Summary of Federal Policies to Classify or Control Scientific and Technical Information ." As noted, the CSA specified it "was not to be construed to constitute authority to withhold information sought pursuant to the FOIA, or to authorize any federal agency to limit, restrict, regulate, or control, among other actions, the disclosure, use, transfer, or sale of any information disclosable under the FOIA...." According to the DOJ's Freedom of Information Act Guide, May 2004, SBU and SHSI are not to be exempt from disclosure under FOIA, except for CII (which is protected pursuant to P.L. Agencies also differ on how requests to release information under FOIA will be handled. In 2005 guidance, CDC said its SBU information is information that is exempt from disclosure under FOIA. One option for policymakers may be to consider limiting the number of persons who can designate information as SBU. Agencies That Use the Definition of "Sensitive" as Found in the Computer Security Act (CSA)
Some agencies use the CSA definition of sensitive, which identifies information based on its content, not on the risk of release. Only those who have a "need to know" are to have access to SSI.
Providing access to scientific and technical information (S&T) for legitimate uses while protecting it from potential terrorists poses difficult policy choices. Federally funded, extramural academic research is to be "classified" if it poses a security threat; otherwise, it is to be "unrestricted." Since the September 11, 2001 terrorist attacks, controls increasingly have been placed on some unclassified research and S&T information, including that used to inform decision making and citizen oversight. These controls include "sensitive but unclassified" (SBU) labels; restrictive contract clauses; visa controls; controlled laboratories; and wider legal restrictions on access to some federal biological, transportation, critical infrastructure, geospatial, environmental impact, and nuclear information. Some professional groups have supported voluntary controls on the conduct or publication of sensitive research. Federal agencies do not have uniform definitions of SBU or consistent policies to safeguard or release it, raising questions about how to identify SBU information, especially S&T information; how to keep it from terrorists, while allowing access for those who need to use it; and how to develop uniform nondisclosure policies and penalties. On December 16, 2005, President Bush instructed federal agencies to standardize procedures to designate, mark, and handle SBU information, and to forward recommendations for government-wide standards to the Director of National Intelligence (DNI). The Information Sharing Environment Implementation Plan, sent to Congress in November 2006, reports that final action will occur during the lst quarter of CY2006.
Following the 2001 terrorist attacks, the Bush Administration issued guidance that reversed the Clinton Administration's "presumption of disclosure" approach to releasing information under Freedom of Information Act (FOIA) and cautioned agencies to consider withholding SBU information if there was a "sound legal basis" to do so. Some agencies contend that SBU information is exempt from disclosure under FOIA, even though such information per se is not exempt under FOIA. The 2002 enactment of the Federal Information Security Management Act (FISMA) rendered moot the definition of SBU that some agencies had used since the passage of the Computer Security Act of 1987, which identified sensitive information by content. FISMA requires agencies to categorize the criticality and sensitivity of all information according to the security control objectives of confidentiality, integrity, and availability across a range of risk levels and to use safeguards based on risk of release. Many federal agencies have not yet fully implemented these new procedures. During the 109th Congress, P.L. 109-90 and P.L. 109-295 focused on management, oversight, and appropriate use of the sensitive security information (SSI) category. Legislative proposals focused on standardizing concepts of "sensitive" information; modifying penalties for disclosure; and clarifying FOIA. During the 110th Congress, additional topics likely to be controversial include limiting the number of persons who can designate SBU; widening the use of risk-based approaches to control; centralizing review, handling, and appeals; and evaluating the impact of federal policies on nongovernmental professional groups' prepublication review and self-policing of sensitive research. This report will be updated as necessary.