	Introduction

This report (1) summarizes provisions of several laws and regulations, including the PatentLaw, the Atomic Energy Act, International Traffic in Arms Control regulations, the USA PATRIOTAct ( P.L. 107-56 ), the Public Health Security and Bioterrorism Preparedness and Response Act of2002 ( P.L. 107-188 ), and the Homeland Security Act ( P.L. 107-296 ), that permit the federalgovernment to restrict disclosure of scientific and technical information that could harm nationalsecurity; (2) describes the development of federal controls on "sensitive but unclassified" (SBU)scientific and technical information; (3) summarizes current controversies about White House policyon "Sensitive But Unclassified Information," and "Sensitive Homeland Security Information" (SHSI)issued in March 2002; and (4) identifies controversial issues which might affect the development ofOffice of Management and Budget (OMB) and agency guidelines for sensitive unclassifiedinformation, which were expected to be released during 2003. Federal Controls on Privately Generated Scientific and Technical Information

Several laws permit the federal government to classify privately-generated scientific andtechnical information that could harm national security, even when it is not held by federal agencies. 12958,National Security Decision Directive (NSDD) 189, and rules related to pre-publication review. These controls will be administered by the Justice Department. (52)
However, major federal agencies started to apply the label SBU to information defined as "sensitive" in the Computer Security Act and to information exempt from disclosure under theFreedom of Information Act (especially as governed by provisions 2 and 4). In addition , as will be described below, since the terrorist attacks of 2001, the Bush Administration has given agencies discretion to make nondisclosure decisions under FOIAin relation to homeland security and the thwarting of terrorist attacks. (59)
Defense Agencies' Use of SBU. Department of Energy. Other agencies have issued directives to define andprescribe safeguards that should be taken and penalties used for releasing SBU information. 306 (a)). (88)

		Protection of Critical Infrastructure Information

P.L. 107-296 to theSecretary of the Department of Homeland Security (pursuant to Executive Order 13311). National Academies' Policy. (140)
Policy Options. ... Security professionals find it difficult to design clear standards for protection. Under the expanded definition of scientific and technological informationsubject to classification in Executive Order 13292, will agencies classify information that might haveotherwise been categorized as SBU? Appeals Process for SBU Information. No restriction is required. (191)
The equity of procedures for "tiered" or selective access; the need to create public and or private panels to examine controls on the release of some information; and the need to clarify relationshipsbetween the private sector and the government with respect to safeguarding information in scientificpublications to protect the public interest are issues which may be raised in the legislative context. The Atomic Energy Act of 1954 amendedthe 1946 act to include "an increased emphasis on wider dissemination of atomic energy information,to make more of it accessible to U.S. industry and to the world in order to permit the developmentof nuclear reactors for commercial production of electric power ... as a consequence of PresidentEisenhower's [1953] Atoms For Peace initiative ...." The Quist document says: 
With respect to the control of information, the 1954 Act stated: 
"It shall be the policy of the Commission to control thedissemination and declassification of Restricted Data in such a manner as to assure the commondefense and security. b. SBU information may be sent via the U.S.
The U.S. Government has always protected scientific and technical information that might compromise national security. Since the 2001 terrorist attacks, controls have been widened onaccess to information and scientific components that could threaten national security. The policychallenge is to balance science and security without compromising national security, scientificprogress, and constitutional and statutory protections. This report summarizes (1) provisions of thePatent Law; Atomic Energy Act; International Traffic in Arms Control regulations; the USAPATRIOT Act, P.L. 107-56 ; the Public Health Security and Bioterrorism Preparedness and ResponseAct of 2002, P.L. 107-188 ; and the Homeland Security Act, P.L. 107-296 , that permit governmentalrestrictions on either privately generated or federally owned scientific and technical information thatcould harm national security; (2) the evolution of federal concepts of "sensitive but unclassified"(SBU) information; (3) controversies about pending Department of Homeland Security guidance onfederal SBU and "Sensitive Homeland Security Information" (SHSI); and (4) policy options.
Even before the terrorist attacks of 2001, federal agencies used the label SBU to safeguard from public disclosure information that does not meet standards for classification in Executive Order12958 or National Security Decision Directive 189. New Executive Order 13292 might widen thescope of scientific and technological information to be classified to deter terrorism. SBU has notbeen defined in statutory law. When using the term, some agencies refer to definitions for controlledinformation, such as "sensitive," in the Computer Security Act, and to information exempt fromdisclosure in the Freedom of Information Act (FOIA) and the Privacy Act. The identification ofinformation to be released pursuant to these laws may be discretionary, subject to agencyinterpretation and risk analysis. The White House and the Department of Justice recently widenedthe applicability of SBU.
Critics say the lack of a clear SBU definition complicates designing policies to safeguard such information and that, if information needs to be safeguarded, it should be classified. Others say thatwider controls will deny access to information needed for oversight and scientific communication. P.L. 107-296 required the President to issue guidance on safeguarding SBU homeland securityinformation, a function assigned to the Department of Homeland Security Secretary in ExecutiveOrder 13311; action is pending. Issues of possible interest to Congress include designing uniformconcepts and procedures to share and safeguard SBU information; standardizing penalties forunauthorized disclosure; designing an appeals process; assessing the pros and cons of wider SBUcontrols; and evaluating the implications of giving some research agency heads originalclassification authority. On February 20, 2004, DHS published a rule to protect voluntarilysubmitted critical infrastructure information. Some professional groups are starting to limitpublication of some "sensitive" privately controlled scientific and technical information. Theiractions may be guided by federal policy. This report will not be updated.