Classified Data Handling By Francesco Scarimbolo Outline

Classified Data Handling By Francesco Scarimbolo

Outline Purpose & Overall Authority u Security Clearances - Authorization u Security Training & Briefings u Classification & Marking u Safeguarding Classified Information u Automated Access Control System u

Purpose & Overall Authority u u u Requirements, Restrictions and Safeguards to prevention unauthorized disclosure (Information Assurance Policy) Controlled Disclosure from Government to Contractors The President appointed Secretary of Defense – Executive Agent The Director, Information Security Oversight Office Implements, Monitors and issues directives Overall Authority – National Industrial Security Program (NISP) • Executive Order 12829, January 6 1993 • Executive Order 12958, April 17 1995 – Classified National Security Information

Security Clearances - Authorization Facility Clearances u Personal Clearances u

Facility Clearances - (FLC) Eligibility Requirements u u Must need access to classified information for legitimate U. S. Gov. or foreign requirement Must exist under the laws of any of the 50 states, in D. C. , or Puerto Rico, and be located within the U. S. and its territorial areas or possessions Must have a reputation for integrity and lawful conduct in business practices Must not be in under foreign ownership, control, or influence, to the extent that granting FCL would be inconsistent with national interest

Facility Clearances - (FLC) Eligible Requirements (Continued) Facility Security Officer (FSO) must be a U. S. Citizen employee u Senior Management and the FSO must have a Personal Clearance (PLC) = FLC u

Personal Clearances u u Single Scope Background Investigation (SSBI) – Required for Top Secret PCL National Agency Check with Local Check and Credit Check – Required for Secret and Confidential PCL Polygraph – Agency Dependent, coverage expanded upon surfacing concerns in effort to resolve the issues Reciprocity – Previously granted PLC that meets or exceeds current clearance required provides basis without for further investigation unless significant information wasn’t known

Personal Clearances (Continued) Contractor Based Clearances – Not permitted after January 1, 2004 u Proof Of Citizenship u • Birth Certificate for US born • Certificate of Naturalization • Certificate of Citizenship by INS • Birth abroad of a Citizen of US • Passport, Current or Expired

Converting PLC to Industrial Clearance u u u Investigation meets standards for equivalent clearance No More Than 24 Months pass since termination of last investigation No evidence of adverse information exists since last investigation Q access authorization can be converted to a Top Secret PLC L access authorization can be converted to a Secret PLC

Security Training & Briefings u u u FSO Training – Should be completed 1 year of appointment to position of FSO Classified Information Nondisclosure Agreement – SF 312 Initial Security Briefings • • Threat Awareness Briefing Defensive Security Briefing Overview of security classification system Employee reporting obligations and requirements • Security procedures and duties applicable to job function

Classification & Marking u u u Top Secret, Confidential, Unclassified Terms such as “Official Use only” or “Administratively Confidential” are not applicable to national security information Original Classification • Falls within categories set by Executive Order 12958 • May cause damage to National Security by itself or with other information – Classification cannot be given otherwise • Must State Reason on front page • Must also set date for duration of classification if possible or marked with an exemption category of “X” • Viewer must have completed SF 312 and have “Need to Know” • Apply the markings as document is being created • Preliminary documents must be handled as destroyed as if it had a classification

Derivative Classification Responsibilities Manager at operational level where information is being produced or assembled determines classification u Employees are responsible for marking or challenging the classification when copying, extracting, reproducing, or translating a portion of or the totality of the document u

Challenging the Classification Information is classified improperly or unnecessarily u Current security considerations justify downgrading or upgrading classification u • Declassification is not automatically an approval for public disclosure u Security classification guidance is improper or inadequate

Contractor Developed Information Similar information previously identified as classified retain the associated level u Novel information the contractor believes should be classified, the contractor submits it to the appropriate agency that would have interest in it for classification determination u

Identification & Overall Markings u u Name & Address of Facility responsible for preparation Date of Preparation Overall marking should be on the front cover & back cover (if applicable), top and bottom Markings are done by stamped, printed, etched, written engraved, painted or affixed by a adhesive tag (except on documents)

Page, Component, & Portion Marking u u u The top and bottom of the page is marked with the highest classification on that page Components such as annex or an appendix can be given a one time classification marking of UNCLASSIFIED if it holds true for the entire component Each portion, such as a paragraph shall be given the highest classification marking that exists within the portion with either a (TS) for Top Secret, (S) for Secret, (C) for Confidential and (U) for Unclassified

Portion Marking (Continued) u u Foreign government information is marked with abbreviation for that nation and appropriate classification (UK – C) NATO documents receive a mark of “NATO” or “COSMIC” with the appropriate classification (NATO – TS), (COSMIC – S) Illustrations get marked with no abbreviations directly next to the illustration Impractical marking and all portions are at same level, the document can have an overall classification as long as there is a full explanation included

Marking for Derivatively Classified Documents u u u Source of classification and declassification instructions need to be marked The marking of “multiple sources” is acceptable “Declassify on” may have the markings of the date to declassify, an X for unknown declassification date or “Original Agency’s Determination Required”

“Downgrade To” and “Reason Classified” The classification to downgrade to upon a certain date can be given in advance and is marked downgraded subsequently on storage containers u The reason of Classification may sometimes be necessary upon original Classification u

Marking Special Types of Material u u Files, Folders or Groups of Document – Marked with highest classification when not stored Messages – Electronically Transmitted – Need “Derived From” & some agencies require “Classified By” & “Reason Classified” Microfilms – Unaided to the eye markings are necessary on container, Images shall also contain markings of classification so its properly disclosed upon printing Translations – Only difference, U. S. must be indicated as country of origin

Marking Transmittal Documents u u u Classified documents are noted with highest classification information Unclassified documents that transmit classified data as an attachment get marked as “Unclassified when Separated from Classified Enclosures” Classified Documents get marked similarly as follows “Secret when Separated from Enclosures”

Upgrading and Automatic Downgrading u u u Appropriately upgraded material removes all indication of previous classification Authority & date of upgrade is marked Notification to all who obtained information is required for further correct dissemination Automatic downgrading (such as based on date) remove all indication of previous classification with new classification No further dissemination is necessary when it is automatic

Miscellaneous Actions (Improperly handled Information) u u u Determine who has it (their clearance) and should they have it (the information’s discovered classification) Determine who has control of information Determine whether control has been lost If recipients have the correct clearance – issue notices promptly of classified information If not, report incident to Cognizant Security Agency (CSA) Do. D – Incident Response for National Security Matters

Safeguarding Classified Information u u Safeguarding Oral Communication – prohibited: unsecured phone lines, public conversations, any other interception by unauthorized personnel End of Day Security Checks – • At the close of each day – ensure all classified data is securely stored • At the end of each shift – ensure all classified data is securely stored except when facility is in 24 hour contiguous operation

Perimeter Control (Physical Security) Inspections must be done in random nature guided by legal advice u All individuals are subject to inspection u • Must be done within facility grounds • Inspections are not necessary for highly personal – purse, wallet, clothing etc.

External Receipt and Dispatch Records The date of the material u The date of receipt or dispatch u The classification u An Unclassified description u Identify the activity that resulted in the retrieval of the material or to which the material was dispatched u Receipt and dispatch records are kept for 2 years u

Receiving Classified Material Top Secret & Secret Classified data needs signature receipt u Confidential doesn’t, but if signature is required, it must be given u If tampering is detected (TS, S) – should be reported promptly to sender u

Generation of Classified Material u Classified working papers • • • Dated when created Marked with classification Marked with “working papers” Destroyed when no longer needed Classified as finished documents when u u u Transmitted out of facility Retained for more than 180 days Contractor produced Top Secret material – Record must be produced • • • Completed Document Retained for 30 days Transmitted Outside facility

General Services Administration (GSA) Top Secret material – Stored in GSA approved security container, approved vault or approved closed area u Secret Material – Stored similar to Top Secret without the GSA approval u • In a safe, steel file cabinet, automatic locking, 4 sides welded, riveted, or bolted to indicate visible evidence of tampering (Until October 1, 2012)

Restricted Areas Necessary impractical or impossible to store otherwise due to unusual characteristic u Clearly defined perimeter – No barriers necessary u Personnel within the area are responsible for challenging all individuals who may lack proper authority u

Intrusion Detection Systems Guard Patrol – 2 hours for Top Secret Material, 4 hours for Secret u GSA approved containers need no supplemental security if in an area deemed “with security-in-depth” u

Protection of Combinations Record of Names with combinations maintained u All containers are locked if not under the direct supervision of an authorized person u Combination is dependent upon classification of contents, upgrade in classification destroys previous combinations u

Changing Combinations Initial use of container u Termination of employee or clearance is withdrawn, suspended or revoked u Compromise of security container u • Unlocked, Unattended

Supervision of Keys u u u u Key and lock custodian is appointed Key and lock control register center Key and lock audit every month Keys inventoried with every change of custody Keys and spare locks protected as classified Locks and keys rotated at least once a year Master Keys prohibited

Automated Access Control System u Manufactures must meet these requirements • Chances of unauthorized access are no more than one in 10, 000 • Chances of authorized access being rejected in no more than 1 in 1, 000 • Locations of access and there storage must be protected • Tamper alarm protection is mandatory for Top Secret Closed Area

Automated Access Control System Continued u Personal Identification • Identification can be obtained by ID with PIN badge or personal identity ID Badge – must use embedded sensors, integrated circuits magnetic stripes etc u Fingerprint u Hand geometry u Handwriting u Retina u Voice Recognition u

Summary Purpose & Overall Authority u Security Clearances - Authorization u Security Training & Briefings u Classification & Marking u Safeguarding Classified Information u Automated Access Control System u