	DOE and DOD Lack Clear OUO and FOUO Guidance in Key Aspects

Both DOE and DOD have established offices, designated staff, and  promulgated policies to provide a framework for the OUO and FOUO  programs. However, their policies lack sufficient clarity in important  areas, which could result in inconsistencies and errors. However, our analysis of DOD’s FOUO  policies shows that it is unclear which DOD office is responsible for the  FOUO program, and whether personnel designating a document as FOUO  should note the FOIA exemption used as the basis for the designation on  the document. Also, both DOE’s and DOD’s policies are unclear regarding  at what point a document should be marked as OUO or FOUO, and what  would be an inappropriate use of the OUO or FOUO designation. In our  view, this lack of clarity exists in both DOE and DOD because the agencies  have put greater emphasis on managing classified information, which is  more sensitive than OUO or FOUO information. The guide and  the manual supplement the order. According to one senior DOE official, requiring the  employee to cite a reason why a document is designated as OUO is one of  the purposes of the stamp, and one means by which DOE’s Office of  Classification encourages practices consistent with the order, guide, and  manual throughout DOE. Neither DOE nor DOD Requires Training or Conducts Oversight

While both DOE and DOD offer training to staff on managing OUO and  FOUO information, neither agency requires any training of its employees  before they are allowed to identify and mark information as OUO or  FOUO, although some staff will eventually take OUO or FOUO training as  part of other mandatory training. As a result, some  DOE employees may be identifying and marking documents for restriction  from dissemination to the public or persons who do not need to know the  information to perform their jobs, and yet may not be fully informed as to  when it is appropriate to do so. The  department relies on the individual services and field activities within  DOD to determine the extent of training that employees receive. In closing, the lack of clear policies, effective training, and oversight in  DOE’s and DOD’s OUO and FOUO programs could result in both over- and  underprotection of unclassified yet sensitive government documents. Having clear policies and procedures in place can mitigate the risk of  program mismanagement and can help DOE and DOD management assure  that OUO or FOUO information is appropriately marked and handled. DOE  and DOD have no systemic procedures in place to assure that staff are  adequately trained before designating documents OUO or FOUO, nor do  they have any means of knowing the extent to which established policies  and procedures for making these designations are being complied with. These issues are important because they affect DOE’s and DOD’s ability to  assure that the OUO and FOUO programs are identifying, marking, and  safeguarding documents that truly need to be protected in order to prevent  potential damage to governmental, commercial, or private interests. Appendix: FOIA Exemptions

	1.
Why GAO Did This Study

In the interest of national security and personal privacy and for other reasons, federal agencies place dissemination restrictions on information that is unclassified yet still sensitive. The Department of Energy (DOE) and the Department of Defense (DOD) have both issued policy guidance on how and when to protect sensitive information. DOE marks documents with this information as Official Use Only (OUO) while DOD uses the designation For Official Use Only (FOUO). GAO was asked to (1) identify and assess the policies, procedures, and criteria DOE and DOD employ to manage OUO and FOUO information; and (2) determine the extent to which DOE's and DOD's training and oversight programs assure that information is identified, marked, and protected according to established criteria.

What GAO Found

As GAO reported earlier this month, both DOE and DOD base their programs on the premise that information designated as OUO or FOUO must (1) have the potential to cause foreseeable harm to governmental, commercial, or private interests if disseminated to the public or persons who do not need the information to perform their jobs; and (2) fall under at least one of eight Freedom of Information Act (FOIA) exemptions. While DOE and DOD have policies in place to manage their OUO or FOUO programs, our analysis of these policies showed a lack of clarity in key areas that could allow inconsistencies and errors to occur. For example, it is unclear which DOD office is responsible for the FOUO program, and whether personnel designating a document as FOUO should note the FOIA exemption used as the basis for the designation on the document. Also, both DOE's and DOD's policies are unclear regarding at what point a document should be marked as OUO or FOUO and what would be an inappropriate use of the OUO or FOUO designation. For example, OUO or FOUO designations should not be used to conceal agency mismanagement. In our view, this lack of clarity exists in both DOE and DOD because the agencies have put greater emphasis on managing classified information, which is more sensitive than OUO or FOUO. In addition, while both DOE and DOD offer training on their OUO and FOUO policies, neither DOE nor DOD has an agencywide requirement that employees be trained before they designate documents as OUO or FOUO. Moreover, neither agency conducts oversight to assure that information is appropriately identified and marked as OUO or FOUO. DOE and DOD officials told us that limited resources, and in the case of DOE, the newness of the program, have contributed to the lack of training requirements and oversight. Nonetheless, the lack of training requirements and oversight of the OUO and FOUO programs leaves DOE and DOD officials unable to assure that OUO and FOUO documents are marked and handled in a manner consistent with agency policies and may result in inconsistencies and errors in the application of the programs.