DOD’s Information Security Program Lacks Oversight and Consistent Implementation

A lack of oversight and inconsistent implementation of DOD’s information  security program are increasing the risk of misclassification. DOD’s  information security program is decentralized to the DOD component  level, and OUSD(I) involvement in, and oversight of, components’  information security programs is limited. Also, while some DOD  components and subordinate commands appear to manage their programs  effectively, we identified weaknesses in others’ training, self-inspections,  and security classification guide management. Also, OUSD(I) does not conduct or  oversee self-inspections, nor does it confirm whether self-inspections have  been performed or review self-inspection findings. Security classification guides identify what information needs  protection and the level of classification; the reason for classification, to  include citing the applicable categories in the Executive Order; and the  duration of classification. Of the 13 components and subordinate commands we reviewed that  possess multiple classification guides:    10 maintain paper or electronic copies of classification guides in a central  location, or are in the process of doing so;    8 track the currency of more than half of their combined classification  guides to facilitate their review, to ensure that they are updated at least  every 5 years, in accordance with the ISOO directive; and    8 either have made or are in the process of making their classification  guides available to authorized users electronically. Results of OSD Document Review Show Some Questionable Classification Decisions and Numerous Marking Errors

In our review of a nonprobability sample of 111 classified OSD documents  we questioned DOD officials’ classification decisions for 29 documents— that is, 26 percent of the sample. We also found that 93 of the 111  documents we examined (84 percent) had at least one marking error, and  about half had multiple marking errors. While the  results from this review cannot be generalized across DOD, they are  indications of the lack of oversight and inconsistency that we found in  DOD’s implementation of its information security program. Beginning with the fiscal year 2005 estimates, OUSD(I) will scrutinize the  classification decision estimates of its components before consolidating  and submitting them to ISOO. Properly conducted, OUSD(I)’s review  could improve the accuracy of these estimates, if methodological  inconsistencies are reduced. Adopting a consistent methodology across the  department and from year to year should improve the reliability and  accuracy of this estimate that is reported to the President. To examine whether DOD’s implementation of its information security  management program in the areas of training, self-inspections, and  security classification guide management effectively minimizes the risk of  misclassification, we compared the DOD components’ and subordinate  commands’ policies and practices with federal and DOD requirements,  including Executive Order 12958, Classified National Security  Information, as amended; Information Security Oversight Office (ISOO)  Directive 1, Classified National Security Information; and DOD  Information Security Program regulation 5200.1-R. Additionally, we  visited the Defense Security Service Academy in Linthicum, Maryland, to  discuss DOD training issues, and the Defense Technical Information  Center at Fort Belvoir, Virginia, to discuss the availability of current  security classification guides. To assess the extent to which DOD personnel in five offices of the Office  of the Secretary of Defense (OSD) followed established procedures for  classifying information, to include correctly marking classified  information, we examined 111 documents classified from September 22,  2003 to June 30, 2005. To assess the reliability of DOD’s annual classification decisions estimate  and the existence of material inconsistencies, we compared the guidance  issued by ISOO and the Office of the Under Secretary of Defense for  Intelligence on methods to derive this estimate with how DOD  components and subordinate commands implemented this guidance.
Why GAO Did This Study

Misclassification of national security information impedes effective information sharing, can provide adversaries with information to harm the United States and its allies, and incurs millions of dollars in avoidable administrative costs. As requested, GAO examined (1) whether the implementation of the Department of Defense's (DOD) information security management program, effectively minimizes the risk of misclassification; (2) the extent to which DOD personnel follow established procedures for classifying information, to include correctly marking classified information; (3) the reliability of DOD's annual estimate of its number of classification decisions; and (4) the likelihood of DOD's meeting automatic declassification deadlines.

What GAO Found

A lack of oversight and inconsistent implementation of DOD's information security program are increasing the risk of misclassification. DOD's information security program is decentralized to the DOD component level, and the Office of the Under Secretary of Defense for Intelligence (OUSD(I)), the DOD office responsible for DOD's information security program, has limited involvement with, or oversight of, components' information security programs. While some DOD components and their subordinate commands appear to manage effective programs, GAO identified weaknesses in others in the areas of classification management training, self-inspections, and classification guides. For example, training at 9 of the 19 components and subordinate commands reviewed did not cover fundamental classification management principles, such as how to properly mark classified information or the process for determining the duration of classification. Also, OUSD(I) does not have a process to confirm whether self-inspections have been performed or to evaluate their quality. Only 8 of the 19 components performed self-inspections. GAO also found that some of the DOD components and subordinate commands that were examined routinely do not submit copies of their security classification guides, documentation that identifies which information needs protection and the reason for classification, to a central library as required. Some did not track their classification guides to ensure they were reviewed at least every 5 years for currency as required. Because of the lack of oversight and weaknesses in training, self-inspection, and security classification guide management, the Secretary of Defense cannot be assured that the information security program is effectively limiting the risk of misclassification across the department. GAO's review of a nonprobability sample of 111 classified documents from five offices within the Office of the Secretary of Defense shows that, within these offices, DOD personnel are not uniformly following established procedures for classifying information, to include mismarking. In a document review, GAO questioned DOD officials' classification decisions for 29--that is, 26 percent of the sample. GAO also found that 92 of the 111 documents examined (83 percent) had at least one marking error, and more than half had multiple marking errors. While the results from this review cannot be generalized across DOD, they are consistent with the weaknesses GAO found in the way DOD implements its information security program. The accuracy of DOD's classification decision estimates is questionable because of the considerable variance in how these estimates are derived across the department, and from year to year. However, beginning with the fiscal year 2005 estimates, OUSD(I) will review estimates of DOD components. This additional review could improve the accuracy of DOD's classification decision estimates if methodological inconsistencies also are reduced.