Each of the Federal Agencies and Offices Involved in Preparing and Publishing the Draft Declaration Shares Some Responsibility for Its Release to the Public

While no single U.S. government agency or office was entirely responsible  for the public disclosure of the draft declaration, all of the agencies and  offices involved in preparing and publishing the draft declaration share  some responsibility for its public release. We identified several points  during the life cycle of the draft document where problems occurred. Since this IAEA marking has no legal significance  in the United States, DOE, Commerce, and NRC treated the information as  OUO. State prepared the draft declaration for transmittal to the White  House. In describing the purpose and contents of the document and  the classification level of the information, State wrote in the draft  presidential message, “the IAEA classification of the enclosed declaration  is ‘Highly Confidential Safeguards Sensitive’; however, the United States  regards this information as ‘Sensitive but Unclassified’.” The two-page  transmittal letter described the contents of the draft declaration and the  top and bottom was clearly marked SBU, accompanied by a footnote  explaining that the draft declaration was exempt from disclosure under  the Freedom of Information Act. The National Security Council, which reviewed these  documents on behalf of the White House, did not add explicit and clear  instructions in the presidential message on how to handle the draft  declaration, such as whether or not it should be published, when it sent  the documents to the White House Clerk’s Office, which transmitted the  documents to Congress. The National Security Council also did not  include a transmittal letter, as other executive branch agencies had, with  instructions on how to handle the draft declaration. Congressional Offices That Reviewed and Transmitted the Draft Declaration Determined Incorrectly That the Document Could be Published

Congressional offices that reviewed and then transmitted the draft  declaration to GPO for publication—the House of Representatives’ Office  of the Parliamentarian and Clerk’s Office—determined, incorrectly in our  view, that the document could be published. The White House Clerk’s Office. GPO Did Not Raise Concerns about Publishing the Draft Declaration

GPO, which edited and processed the document for publication, did not  raise any concerns about the document’s sensitivity. Public Release of Draft Declaration Does Not Appear to Have Harmed National Security, According to DOE, NRC, and Commerce Officials

The inadvertent public release of the draft declaration of civilian nuclear  sites and nuclear facilities does not appear to have damaged national  security, according to officials from DOE, NRC, and Commerce. Information in the draft declaration was limited to civilian nuclear  activities, and most nuclear-related information was publicly available on  agency Web sites or in other published documents, according to officials  from the three agencies. However, officials from all of the agencies that  compiled this information told us the information—all of which was  considered unclassified—was sensitive because it was consolidated into  one document and should never have been posted to GPO’s Web site. Commerce, DOE, and NRC did not formally assess the impact of the public  release of the information on U.S. national security. According to officials from these agencies, no such assessment  was necessary because all of the agencies involved in the development of  the draft declaration (as well as the Department of Defense) had fully  reviewed the consolidated list of civilian nuclear facilities and related  activities on multiple occasions to ensure that no information of direct  national security significance was included and that no classified  information was contained in the declaration prior to transmitting it to the  White House and Congress. Regarding the first point, we believe that given the sensitive nature of the  draft document—and commensurate with its role and responsibilities— the House Security Office should have, at a minimum, raised concerns  with the House Clerk’s Office about publicly releasing 266 pages of  information on U.S. nuclear sites and activities and advised the House  Clerk not to print the document without explicit authorization from the  agencies that designated the information SBU. GAO Comments

1. 2. 7.
Why GAO Did This Study

On May 7, 2009, the Government Printing Office (GPO) published a 266-page document on its Web site that provided detailed information on civilian nuclear sites, locations, facilities, and activities in the United States. At the request of the Speaker of the House, this report determines (1) which U.S. agencies were responsible for the public release of this information and why the disclosure occurred, and (2) what impact, if any, the release of the information has had on U.S. national security. In performing this work, the Government Accountability Office (GAO) analyzed policies, procedures, and guidance for safeguarding sensitive information and met with officials from four executive branch agencies involved in preparing the document, the White House, the House of Representatives, and GPO.

What GAO Found

While no single U.S. government agency or office was entirely responsible for the public disclosure of the draft declaration, all of the agencies and offices involved in preparing and publishing the draft declaration share some responsibility for its release. GAO identified several points during the life cycle of the draft document where problems in the process occurred. First, none of the agencies that prepared the draft declaration--the Departments of Energy (DOE) and Commerce, and the Nuclear Regulatory Commission (NRC)--took the added precaution of ensuring that the consolidated draft they helped prepare had a U.S. security designation on each page of the document. Rather, the final version of the document, which they all reviewed, was marked only with the International Atomic Energy Agency's (IAEA) designation--"Highly Confidential Safeguards Sensitive." This marking has no legal significance in the United States. Second, the Department of State, which prepared the draft declaration for transmittal to the White House, sent a transmittal letter to the National Security Council indicating that the contents of the draft declaration should be treated as Sensitive but Unclassified (SBU). Not all federal agencies use this particular marking and, therefore, the marking created confusion for other executive and legislative branch offices that subsequently received the draft declaration on whether the information could be published. Third, the National Security Council, which reviewed the draft declaration on behalf of the White House, did not provide explicit and clear instructions on how to handle the draft declaration to the White House Clerk's Office. Fourth, the legislative branch offices which reviewed and then transmitted the document to GPO for publication--the House of Representatives' Parliamentarian and Clerk's Office--determined incorrectly, in GAO's view, that the document could be published. Officials from these congressional offices were not familiar with the phrase "Sensitive but Unclassified" and did not know how to safeguard that information. Finally, GPO, which proofread and processed the document for publication, did not raise any concerns about the document's sensitivity. GAO believes it is important to correct these problems as soon as possible because the United States is required to submit a declaration to IAEA annually. The public release of the draft declaration of civilian nuclear sites and nuclear facilities does not appear to have damaged national security, according to officials from DOE, NRC, and Commerce. Commerce, DOE, and NRC did not assess the national security implications of the draft declaration's public release because these agencies--plus the Department of Defense--had reviewed the list of civilian nuclear facilities and related activities prior to transmitting it to the White House and Congress to ensure that information of direct national security significance was not included. Information in the draft declaration was limited to civilian nuclear activities, and most nuclear-related information was publicly available on agency Web sites or other publicly available documents. However, according to officials from all of the agencies responsible for compiling this information, the information consolidated in one document made it sensitive and, thus, it should never have been posted to GPO's Web site.