	DOE and DOD Lack Clear OUO and FOUO Guidance in Key Aspects

Both DOE and DOD have established offices; designated staff; and  promulgated policies, manuals, and guides to provide a framework for the  OUO and FOUO programs. However, based on our assessment of the  policies governing both DOE’s and DOD’s programs, their policies to  assure that unclassified but sensitive information is appropriately  identified and marked lack sufficient clarity in important areas that could  allow for inconsistencies and errors. However, our analysis of DOD’s FOUO policies shows that it is  unclear which DOD office is responsible for the FOUO program, and  whether personnel designating a document as FOUO should note the FOIA  exemption used as the basis for the designation on the document. Also,  both DOE’s and DOD’s policies are unclear regarding at what point a  document should be marked as OUO or FOUO, and what would be an  inappropriate use of the OUO or FOUO designation. In our view, this lack  of clarity exists in both DOE and DOD because the agencies have put  greater emphasis on managing classified information, which is more  sensitive than OUO or FOUO information. Both programs use the exemptions in FOIA  for designating information in a document as OUO or FOUO. According to Standards for Internal Control in the  Federal Government, agencies should have sufficient internal controls in  place to mitigate risk and assure that employees are aware of what  behavior is acceptable and what is unacceptable. However, while both DOE  and DOD offer training to staff on managing OUO and FOUO information,  neither agency requires any training of its employees before they are  allowed to identify and mark information as OUO or FOUO, although some  staff will eventually take OUO or FOUO training as part of other  mandatory training. DOE and DOD  officials told us that limited resources, and in the case of DOE, the  newness of the program, have contributed to the lack of training  requirements and oversight. Without oversight, neither DOE nor DOD can assure that staff are  complying with agency policies. Conclusions

The lack of clear policies, effective training, and oversight in DOE’s and  DOD’s OUO and FOUO programs could result in both over- and  underprotection of unclassified yet sensitive government documents that  may need to be limited from disclosure to the public or persons who do  not need to know such information to perform their jobs to prevent  potential harm to governmental, commercial, or private interests. Having  clear policies and procedures in place, as discussed in Standards for  Internal Control in the Federal Government, can mitigate the risk that  programs could be mismanaged and can help DOE and DOD management  assure that OUO or FOUO information is appropriately marked and  handled. Recommendations for Executive Action

To assure that the guidance governing the FOUO program reflects the  necessary internal controls for good program management, we  recommend that the Secretary of Defense take the following two actions:  revise the regulations that currently provide guidance on the FOUO  program to conform to the 1998 policy memo designating which office  has responsibility for the FOUO program and  revise any regulation governing the FOUO program to require that  personnel designating a document as FOUO also mark the document  with the FOIA exemption used to determine the information should be  restricted.
Why GAO Did This Study

In the interest of national security and personal privacy and for other reasons, federal agencies place dissemination restrictions on information that is unclassified yet still sensitive. The Department of Energy (DOE) and the Department of Defense (DOD) have both issued policy guidance on how and when to protect sensitive information. DOE marks documents with this information as Official Use Only (OUO) while DOD uses the designation For Official Use Only (FOUO). GAO was asked to (1) identify and assess the policies, procedures, and criteria DOE and DOD employ to manage OUO and FOUO information and (2) determine the extent to which DOE's and DOD's training and oversight programs assure that information is identified, marked, and protected according to established criteria.

What GAO Found

Both DOE and DOD base their programs on the premise that information designated as OUO or FOUO must (1) have the potential to cause foreseeable harm to governmental, commercial, or private interests if disseminated to the public or persons who do not need the information to perform their jobs and (2) fall under at least one of eight Freedom of Information Act (FOIA) exemptions. According to GAO's Standards for Internal Control in the Federal Government, policies, procedures, techniques, and mechanisms should be in place to manage agency activities. However, while DOE and DOD have policies in place, our analysis of these policies showed a lack of clarity in key areas that could allow for inconsistencies and errors. For example, it is unclear which DOD office is responsible for the FOUO program, and whether personnel designating a document as FOUO should note the FOIA exemption used as the basis for the designation on the document. Also, both DOE's and DOD's policies are unclear regarding at what point a document should be marked as OUO or FOUO and what would be an inappropriate use of the OUO or FOUO designation. For example, OUO or FOUO designations should not be used to cover up agency mismanagement. In our view, this lack of clarity exists in both DOE and DOD because the agencies have put greater emphasis on managing classified information, which is more sensitive than OUO or FOUO. While both DOE and DOD offer training on their OUO and FOUO policies, neither DOE nor DOD has an agencywide requirement that employees be trained before they designate documents as OUO or FOUO. Moreover, neither agency conducts oversight to assure that information is appropriately identified and marked as OUO or FOUO. According to Standards for Internal Control in the Federal Government, training and oversight are important elements in creating a good internal control program. DOE and DOD officials told us that limited resources, and in the case of DOE, the newness of the program, have contributed to the lack of training requirements and oversight. Nonetheless, the lack of training requirements and oversight of the OUO and FOUO programs leave DOE and DOD officials unable to assure that OUO and FOUO documents are marked and handled in a manner consistent with agency policies and may result in inconsistencies and errors in the application of the programs.