Background

Prior to the New Deal, decisions regarding classification of national security information were left to military regulation.¹ In 1940, President Franklin D. Roosevelt issued an executive order authorizing government officials to protect information pertaining to military and naval installations.² Presidents since that time have continued to set the federal government's classification standards by executive order, but with one critical difference: while President Roosevelt cited specific statutory authority for his action,³ later Presidents have cited general statutory and constitutional authority.⁴

The Supreme Court has never directly addressed the extent to which Congress may constrain the executive branch's power in this area. Citing the President's constitutional role as commander in chief,⁵ the Supreme Court has repeatedly stated in dicta (i.e., language that does not constitute a legal determination) that "[the President's] authority to classify and control access to information bearing on national security . . . flows primarily from this Constitutional investment of power in the President and exists quite apart from any explicit congressional grant."⁶ This language has been interpreted to indicate that the President has plenary authority to control classified information.⁷ On the other hand, the Supreme Court has suggested that "Congress could certainly . . . provide[ ] that the Executive Branch adopt new [classification] procedures or . . . establish[] its own procedures—subject only to whatever limitations the Executive Privilege may be held to impose on such congressional ordering."⁸ In fact, Congress established a separate regime in the Atomic Energy Act for the protection of nuclear-related "Restricted Data."⁹

Congress has also directed the President to establish procedures governing the access to classified material so that generally no person can gain such access without having undergone a background check.¹⁰ In addition, Congress directed the President, in formulating the classification procedures, to adhere to certain minimum standards of due process with regard to access to classified information.¹¹ These standards include establishing uniform procedures for, inter alia, background checks, denial of access to classified information, and notice of such denial.¹² There is an exception to the due process requirements, however, where compliance could damage national security, although the statute directs agency heads to submit a report to the congressional intelligence committees in such a case.¹³

With the authority to determine classification standards vested in the President, these standards often change when a new administration takes control of the White House.¹⁴ The differences between the standards of one administration and the next have at times been significant. As one congressionally authorized commission put it in 1997:

The rules governing how best to protect the nation's secrets, while still ensuring that the American public has access to information on the operations of its government, past and present, have shifted along with the political changes in Washington. Over the last 50 years, with the exception of the Kennedy Administration, a new executive order on classification was issued each time one of the political parties regained control of the Executive Branch. These have often been at variance with one another . . . at times even reversing outright the policies of the previous order.¹⁵

Historically, various congressional committees have investigated ways to bring some continuity to the classification system and to limit the President's broad powers to shield information from public examination.¹⁶ In 1966, Congress passed the Freedom of Information Act (FOIA),¹⁷ creating a presumption that government information will be open to the public unless it falls into one of FOIA's exceptions. One such exception covers information that, under executive order, must be kept secret for national security or foreign policy reasons.¹⁸ In 2000, Congress enacted the Public Interest Declassification Act of 2000,¹⁹ which established the Public Interest Declassification Board to advise the President on matters regarding the declassification of certain information. The act expressly disclaims any intent to restrict agency heads from classifying or continuing the classification of information under their purview, and it does not create any rights or remedies that may be enforced in court.²⁰ In 2010, Congress also passed the Reducing Over-Classification Act, which, among other things, requires executive branch agencies' inspectors general to conduct assessments of their agencies' implementation of classification policies.²¹

Congress occasionally takes an interest in declassification of specific materials that might be deemed essential for some public purpose. The procedural rules of both the Senate and House provide a means for disclosing classified information in the intelligence committees' possession where the intelligence committee of the respective house (either the House Permanent Select Committee on Intelligence (HPSCI) or the Senate Select Committee on Intelligence (SSCI)) determines by vote that such disclosure would serve the public interest.²² In the event an intelligence committee votes to disclose classified information submitted by the executive branch, and the executive branch requests that it be kept secret, the committee is required to notify the President prior to disclosure. The intelligence committee may disclose the information after five days following notification unless the President formally objects and certifies that the threat to the U.S. national interest outweighs any public interest in disclosing it, in which case the question may be referred to the full chamber.²³

It appears that, to date, the House has invoked its procedure for disclosing classified information in one instance, when the HPSCI voted to release a memorandum authored by its chairman, Representative Devin Nunes, relating to the Committee's investigation into the use of the Foreign Intelligence Surveillance Act (FISA) during the 2016 presidential election cycle.²⁴ Former White House Counsel Donald McGahn objected, arguing that the unilateral release by the legislative branch would raise "significant separation of powers concerns" and that the White House would treat the Committee's notification as "a request for declassification pursuant to the President's authority."²⁵ McGahn relayed to the chairman that President Trump had agreed to declassify the document, obviating the need for a full House vote.²⁶ The Committee subsequently voted to release the HPSCI minority members' memorandum.²⁷ The President declined to declassify the minority memorandum but expressed an inclination to declassify it if the Committee would agree to redactions proposed by the Department of Justice (DOJ).²⁸ In another instance, the SSCI voted to request that part of its study of the Central Intelligence Agency's detention and interrogation program be declassified, and the study was eventually released after the Committee negotiated redactions with the Obama Administration.²⁹

An example of a bicameral congressional declassification procedure involved the 28 pages of classified text from the report of the Joint Inquiry of the HPSCI and the SSCI into the Intelligence Community Activities Before and After the Terrorist Attacks of September 11, 2001.³⁰ The report of the Joint Inquiry was completed in 2002 and referred to the executive branch for a classification review. The executive branch determined that three of the four parts of the report could be disclosed to the public, but that disclosing a portion of the report would pose national security risks.³¹ Despite calls by some Members and former Members of Congress to release the 28 pages,³² and legislative proposals to urge or mandate disclosure,³³ the intelligence committees awaited a declassification review by the Intelligence Community before releasing the material in redacted form.³⁴

Another instance in which Congress sought and procured the declassification of government information involved records pertaining to prisoners of war and personnel listed as missing in action after the Vietnam War (POW/MIA).³⁵ Congress initially required certain agencies to provide information regarding "live-sightings" of such personnel to next of kin, with the exception of "information that would reveal or compromise sources and methods of intelligence collection."³⁶ Congress subsequently directed the Department of Defense (DOD) to create an accessible library of documents related to POW/MIA, excluding records that would be exempt under certain provisions of FOIA.³⁷ The Senate Select Committee on POW/MIA Affairs considered invoking the procedural rule described above to declassify relevant documents, but deemed that untested avenue unsuitable because it would have required the Committee to identify the documents beforehand and to have them in its possession. Furthermore, enforcement of the measure would have required the full vote of the Senate.³⁸ Instead, Members wrote to President George H. W. Bush requesting an executive order to accomplish the declassification of relevant records,³⁹ which was followed by a resolution expressing the sense of the Senate that the President should expeditiously issue an executive order for the declassification, without compromising national security, of relevant documents.⁴⁰ President Bush complied.⁴¹

Congress has directed the President or agency heads through legislation to undertake a declassification review of records pertaining to specific matters and to release them as appropriate. For example, Congress in 1998 enacted the Nazi War Crimes Disclosure Act, directing the President to establish an interagency working group to "locate, identify, inventory, recommend for declassification, and make available to the public at the National Archives and Records Administration, all classified Nazi war criminal records of the United States."⁴² Congress in 2000 directed the President to "order all Federal agencies and departments that possess relevant information [about the murders of churchwomen in El Salvador] to make every effort to declassify and release" such information to the victims' families "as expeditiously as possible."⁴³ In 2002, Congress directed the Secretary of Defense to submit to Congress and to the Secretary of Veterans Affairs "a comprehensive plan for the review, declassification, and submittal" of all information related to Project 112—a series of biological and chemical warfare vulnerability tests conducted by the DOD⁴⁴—that would be relevant for that project's participants' health care.⁴⁵ The DOD complied, issuing its final report to Congress on June 30, 2003.⁴⁶ In 2004, Congress directed the Secretary of Defense to "review and, as determined appropriate, revise the classification policies of the DOD with a view to facilitating the declassification of data that is potentially useful for the monitoring and assessment of the health of members of the Armed Forces who have been exposed to environmental hazards during deployments overseas."⁴⁷ In 2007, Congress directed the Director of the Central Intelligence Agency (CIA) to make public a version of the executive summary of the CIA Office of the Inspector General report on "CIA Accountability Regarding Findings and Conclusions of the Joint Inquiry into Intelligence Community Activities Before and After the Terrorist Attacks of September 11, 2001," declassified "to the maximum extent possible, consistent with national security."⁴⁸ In 2014, Congress directed the Director of National Intelligence (DNI) to conduct a declassification review of documents collected during the raid that killed Osama bin Laden, requiring a justification for materials that remain classified after the review.⁴⁹ In 2021, Congress directed the Public Interest Declassification Board (PIDB) to conduct "a study on the feasibility of carrying out a declassification review relating to nuclear weapons, chemical weapons, or ballistic missile tests conducted by the United States in the Marshall Islands, including with respect to cleanup activities and the storage of waste relating to such tests."⁵⁰ In 2022, Congress directed the DNI to conduct a declassification review to "determine what, if any, additional information relating to the terrorist attacks of September 11, 2001" can be released to the public.⁵¹

Executive Order 13,526

The current standards for classifying and declassifying information were last amended on December 29, 2009, by Executive Order 13,526.⁵² Under these standards, the President, Vice President, agency heads, and any other officials designated by the President may classify information upon a determination that the unauthorized disclosure of such information could reasonably be expected to damage national security.⁵³ Such information must be owned by, produced by, or under the control of the federal government, and must concern one of the following:

• military plans, weapons systems, or operations;
• foreign government information;
• intelligence activities, intelligence sources/methods, cryptology;
• foreign relations or foreign activities of the United States, including confidential sources;
• scientific, technological, or economic matters relating to national security;
• federal programs for safeguarding nuclear materials or facilities;
• vulnerabilities or capabilities of national security systems; or
• weapons of mass destruction.⁵⁴

Information may be classified at one of three levels based on the amount of danger that its unauthorized disclosure could reasonably be expected to cause to national security.⁵⁵ Information is classified as "Top Secret" if its unauthorized disclosure could reasonably be expected to cause "exceptionally grave damage to the national security."⁵⁶ The standard to classify information as "Secret" is if its unauthorized disclosure could reasonably be expected to cause "serious damage to the national security," and classification as "Confidential" is if the unauthorized disclosure of such information could reasonably be expected to cause "damage to the national security."⁵⁷ Significantly, for each level, the original classifying officer must identify or describe the specific danger potentially presented by the information's disclosure.⁵⁸ In case of significant doubt as to the need to classify information or the level of classification appropriate, the information is to remain unclassified or be classified at the lowest level of protection considered appropriate.⁵⁹

The officer who originally classifies the information establishes a date for declassification based upon the expected duration of the information's sensitivity.⁶⁰ If the office cannot set an earlier declassification date, then the information must be marked for declassification in 10 years' time or 25 years, depending on the sensitivity of the information.⁶¹ The deadline for declassification can be extended if the threat to national security still exists.⁶²

Classified information is required to be declassified "as soon as it no longer meets the standards for classification."⁶³ The original classifying agency has the authority to declassify information when the public interest in disclosure outweighs the need to protect that information.⁶⁴ The DNI has the authority to declassify or downgrade information or intelligence relating to intelligence sources, methods, or activities, after consultation with the head of the originating Intelligence Community element or department.⁶⁵ Beginning December 31, 2006, and every year thereafter, all information that has been classified for 25 years or longer and has been determined to have "permanent historical value" is to be automatically declassified, although agency heads can exempt from this requirement classified information that continues to be sensitive in a variety of specific areas.⁶⁶

Agencies are required to review classification determinations upon a request for such a review that specifically identifies the materials so that the agency can locate them, unless the materials identified are part of an operational file exempt under FOIA⁶⁷ or are the subject of pending litigation.⁶⁸ This requirement does not apply to information that has undergone declassification review in the previous two years;⁶⁹ information that is exempted from review under the National Security Act;⁷⁰ or information classified by the incumbent President and staff, the Vice President and staff (in the performance of executive duties), commissions appointed by the President, or other entities within the executive office of the President that advise the President.⁷¹ Each agency that has classified information is required to establish a system for periodic declassification reviews.⁷² The National Archivist is required to establish a similar systematic review of classified information that has been transferred to the National Archives.⁷³

Access to classified information is generally limited to those who demonstrate their eligibility to the relevant agency head, sign a nondisclosure agreement, and have a need to know the information.⁷⁴ Agency heads or senior agency officials of originating agencies may make waivers of the need-to-know requirement available for former Presidents and Vice Presidents, historical researchers, and former policymaking officials who were appointed by the President or Vice President.⁷⁵ The information being accessed may not be removed from the controlling agency's premises without permission.⁷⁶ Each agency is required to establish systems for controlling the distribution of classified information.⁷⁷

The Information Security Oversight Office (ISOO)—an office within the National Archives—is charged with overseeing compliance with the classification standards and promulgating directives to that end.⁷⁸ ISOO is headed by a Director, who is appointed by the Archivist of the United States, and who has the authority to order declassification of information that, in the Director's view, is classified in violation of the aforementioned classification standards.⁷⁹ In addition, there is an Interagency Security Classification Appeals Panel (ISCAP), headed by the ISOO Director and made up of representatives of the heads of various agencies, including the Departments of Defense, Justice, and State, as well as the CIA, and the National Archives.⁸⁰ ISCAP is empowered to decide appeals of classifications challenges⁸¹ and to review automatic and mandatory declassifications. If the ISOO Director finds a violation of Executive Order 13,526 or its implementing directives, then the Director must notify the appropriate classifying agency so that corrective steps can be taken.

Handling of Unauthorized Disclosures

Under Executive Order 13,526, each respective agency is responsible for maintaining control over classified information it originates and is responsible for establishing uniform procedures to protect classified information and automated information systems in which classified information is stored or transmitted. Standards for safeguarding classified information, including the handling, storage, distribution, transmittal, and destruction of and accounting for classified information, are developed by the ISOO.⁸² Persons authorized to disseminate classified information outside the executive branch are required to ensure it receives protection equivalent to those required internally.⁸³ In the event of a knowing, willful, or negligent unauthorized disclosure (or any such action that could reasonably be expected to result in an unauthorized disclosure), the agency head or senior agency official is required to notify ISOO and to "take appropriate and prompt corrective action."⁸⁴ Officers and employees of the United States (including contractors, licensees, etc.) who commit a violation may be subject, at a minimum, to administrative sanctions that can range from reprimand to termination.⁸⁵

Executive Order 12,333, United States Intelligence Activities,⁸⁶ spells out the responsibilities of members of the Intelligence Community (IC)⁸⁷ for the protection of intelligence information, including intelligence sources and methods. Under Section 1.7 of Executive Order 12,333, heads of departments and agencies with organizations in the IC (or the heads of such organizations, if appropriate) must report possible violations of federal criminal laws to the Attorney General "in a manner consistent with the protection of intelligence sources and methods."

In 2019, Congress amended the National Security Act of 1947⁸⁸ to require the heads and inspectors general (IGs) of IC elements to submit semi-annual reports to the congressional intelligence committees regarding the opening and completion of investigations of unauthorized public disclosure of classified information.⁸⁹ The same provision requires the Assistant Attorney General for National Security of the DOJ, in consultation with the Director of the Federal Bureau of Investigation, to provide semi-annual reports to the congressional intelligence committees, the Committee on the Judiciary of the Senate, and the Committee on the Judiciary of the House of Representatives a report on the status of each referral made to DOJ by any IC element regarding an unauthorized disclosure of classified information made during the preceding year or remaining open as of the reporting date.⁹⁰

Information Security Oversight Office

ISOO Directive No. 1 (32 C.F.R. Part 2001) provides further direction for agencies with responsibilities for safeguarding classified information. Section 2001.41 states:

Authorized persons who have access to classified information are responsible for: (a) Protecting it from persons without authorized access to that information, to include securing it in approved equipment or facilities whenever it is not under the direct control of an authorized person; (b) Meeting safeguarding requirements prescribed by the agency head; and (c) Ensuring that classified information is not communicated over unsecured voice or data circuits, in public conveyances or places, or in any other manner that permits interception by unauthorized persons.⁹¹

Section 2001.45 of ISOO Directive No. 1⁹² requires agency heads to establish a system of appropriate control measures to limit access to classified information to authorized persons. Section 2001.46 requires that classified information is transmitted and received in an authorized manner that facilitates detection of tampering and precludes inadvertent access.⁹³ Persons who transmit classified information are responsible for ensuring that the intended recipients are authorized to receive classified information and have the capacity to store classified information appropriately.⁹⁴ Documents classified "Top Secret" that are physically transmitted outside secure facilities must be properly marked and wrapped in two layers to conceal the contents, and must remain under the constant and continuous protection of an authorized courier.⁹⁵ In addition to the methods prescribed for the outside transmittal of Top Secret documents, documents classified at Secret or Confidential levels may be mailed in accordance with the prescribed procedures.⁹⁶ Agency heads are required to establish procedures for receiving classified information in a manner that precludes unauthorized access, provides for detection of tampering and confirmation of contents, and ensures the timely acknowledgment of the receipt (in the case of Top Secret and Secret information).⁹⁷

Section 2001.48 prescribes measures to be taken in the event of loss, possible compromise, or unauthorized disclosure. It states: "Any person who has knowledge that classified information has been or may have been lost, possibly compromised or disclosed to an unauthorized person(s) shall immediately report the circumstances to an official designated for this purpose."⁹⁸

Agency heads are required to establish appropriate procedures to conduct an inquiry or investigation into the loss, possible compromise or unauthorized disclosure of classified information, in order to implement "appropriate corrective actions" and to "ascertain the degree of damage to national security."⁹⁹ The department or agency in which the compromise occurred must also advise any other government agency or foreign government agency whose interests are involved of the circumstances and findings that affect their information or interests.¹⁰⁰ Agency heads are to establish procedures to ensure coordination with legal counsel in any case where a formal disciplinary action beyond a reprimand is contemplated against a person believed responsible for the unauthorized disclosure of classified information.¹⁰¹ Whenever a criminal violation appears to have occurred and a criminal prosecution is contemplated, agency heads are to ensure coordination with the DOJ and the legal counsel of the agency where the individual believed to be responsible is assigned or employed.¹⁰² ISOO must be notified in case of a violation that (1) is reported to congressional oversight committees; (2) may attract significant public attention; (3) involves large amounts of classified information; or (4) reveals a potential systemic weakness in security practices.¹⁰³

Intelligence Community

The most recent Intelligence Community directives related to the safeguarding of classified information appear to be Intelligence Community Directive (ICD) 700, Protection of National Intelligence, effective June 7, 2012;¹⁰⁴ ICD 701, Unauthorized Disclosures of Classified National Security Information, effective December 22, 2017;¹⁰⁵ and ICD 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information, effective June 21, 2013.¹⁰⁶ Damage assessments in the event of an unauthorized disclosure or compromise of classified national intelligence are governed by ICD 732, Damage Assessments, effective June 27, 2014.¹⁰⁷

ICD 700 mandates an integration of counterintelligence and security functions for the purpose of protecting national intelligence and sensitive information and, among other things, to strengthen "deterrence, detection, and mitigation of insider threats, defined as personnel who use their authorized access to do harm to the security of the US through espionage, terrorism, unauthorized disclosure of information, or through the loss or degradation of resources or capabilities."¹⁰⁸ Under ICD 701, in the event of a possible unauthorized disclosure,¹⁰⁹ the head of the originating IC element is to conduct an internal investigation to determine if the filing of a Crimes Report with DOJ is warranted.¹¹⁰ If the investigation determines that a confirmed unauthorized disclosure is likely to cause damage to the national security, the head of the originating IC element is to report the incident to the DOJ with notification to the element's inspector general (IG), the Intelligence Community Inspector General (ICIG), and the Director of the National Counterintelligence and Security Center.¹¹¹ If the DOJ declines prosecution, the ICIG may conduct an independent administrative investigation in coordination with the relevant IC element's IG.¹¹² Significant unauthorized disclosures that may cause "substantial risk to U.S. national security interests" are to be reported to the congressional intelligence committees.¹¹³ The DNI may prohibit the ICIG from conducting any investigation if it is determined that such a prohibition would be necessary to protect vital national security interests, but has to report to the congressional intelligence committees any exercise of this authority.¹¹⁴

Department of Defense

Department of Defense Directive No. 5210.50, Management of Serious Security Incidents Involving Classified Information, October 27, 2014,¹¹⁵ prescribes policy and responsibilities for handling unauthorized disclosures of classified information to the public and other serious security incidents. More detailed procedures governing specific types of information possibly compromised appear in Volume 3 of the DOD Manual No. 5200.01, Enclosure 6, Security Incidents Involving Classified Information, February 24, 2012.¹¹⁶ In the event of a known or suspected disclosure of classified information, the heads of DOD components must take prompt action to decide the nature and circumstances of the disclosure, determine the extent of damage to national security, and take appropriate corrective action.¹¹⁷ If the inquiry or investigation turns up information suggestive of a criminal or counterintelligence nature, component heads are to cease investigation pending coordination with the relevant Deputy Chief Information Officer (DCIO) or Defense Counter-Intelligence (CI) component.¹¹⁸

Security inquiries are to be initiated and completed within 10 duty days unless an extension is required.¹¹⁹ The inquiry is aimed at discovering:

(a) When, where, and how did the incident occur? What persons, situations, or conditions caused or contributed to the incident?

(b) Was classified information compromised?

(c) If a compromise occurred, what specific classified information and/or material was involved? What is the classification level of the information disclosed?

(d) If classified material is alleged to have been lost, what steps were taken to locate the material?

(e) Was the information properly classified?

(f) Was the information officially released?

(g) In cases of compromise involving the public media:

1. In what specific media article, program, book, Internet posting or other item did the classified information appear?

2. To what extent was the compromised information disseminated or circulated?

3. Would further inquiry increase the damage caused by the compromise?

(h) Are there any leads to be investigated that might lead to identifying the person(s) responsible for the compromise?

(i) If there was no compromise, and if the incident was unintentional or inadvertent, was there a specific failure to comply with established security practices and procedures that could lead to compromise if left uncorrected and/or is there a weakness or vulnerability in established security practices and procedures that could result in a compromise if left uncorrected? What corrective action is required?¹²⁰

Section 7(f) of the DOD Manual No. 5200.01, Enclosure 6 lists factors for determining whether to initiate an additional investigation by a DCIO or the DOJ in the event classified information appears in the public media:

(1) The accuracy of the information disclosed.

(2) The damage to national security caused by the disclosure and whether there were compromises regarding sensitive aspects of current classified projects, intelligence sources, or intelligence methods.

(3) The extent to which the disclosed information was circulated, both within and outside the Department of Defense, and the number of persons known to have access to it.

(4) The degree to which an investigation shall increase the damage caused by the disclosure.

(5) The existence of any investigative leads.

(6) The reasonable expectation of repeated disclosures.¹²¹

If classified DOD information appears in a newspaper or other media, the head of the appropriate DOD component is responsible for the preparation of a "DOJ Media Leak Questionnaire" to submit to the Under Secretary of Defense for Intelligence, who prepares a letter for the Chief, Internal Security Section of the Criminal Division at the DOJ.¹²² The following eleven questions are to be promptly and fully addressed:

• What is the date and identity of the media source (article, blog, television, or other oral presentation) containing classified information?
• What specific statement(s) are classified, and is the information properly classified?
• Is the disclosed information is accurate?
• Did the information come from a specific document, and if so, the originating office and person responsible for its security?
• What is the extent of official circulation of the information?
• Has the information been the subject of prior official release?
• Was prepublication clearance or release sought?
• Has sufficient information or background data been published officially or in the press to make educated speculation on the matter possible?
• Will the information be made available for use in a criminal prosecution and is the person competent to testify on its classification?
• Was declassification considered?
• What effect does the disclosure have on the national defense?¹²³

Department of State

Information security at the Department of State¹²⁴ is governed by Parts 500 and 600 in Volume 12 of the Foreign Affairs Manual (FAM).¹²⁵ The Bureau of Administration is responsible for implementing Executive Order 13,526 as it applies to the classification and declassification of material, the marking of classified material, and relevant training and guidance.¹²⁶ The Bureau of Diplomatic Security (DS) is responsible for protecting classified information and special access programs.¹²⁷ Senior agency officials have the primary responsibility for overseeing their respective agency's information security program, while supervisors are charged with safeguarding classified information within their organizational units.¹²⁸ Individual employees having access to classified material are responsible for maintaining its security.¹²⁹

Security incidents are to be reported through the appropriate security officer to DS.¹³⁰ The employee suspected of having caused the incident is given an opportunity to provide a statement of defense or mitigating circumstances, after which the incident is referred to his or her supervisor and to DS.¹³¹ DS is responsible for evaluating security incidents and performing final adjudication of them and initiation of any further action deemed necessary.¹³² Investigations of loss, unauthorized disclosure, or serious compromise of classified information are covered in 12 FAM 228.4 and are the responsibility of the Professional Responsibility Division (DS/ICI/PR) of the Office of Investigations and Counterintelligence.¹³³ In the event of a "media leak" of classified information, the originating agency is to undertake an initial investigation to determine if any other agency had access to the information, and if necessary request that such receiving agency conduct an appropriate investigation into the unauthorized disclosure.¹³⁴ The manual notes that DOJ may decide to prosecute those who disclose classified information without authority, but does not provide a list of reporting criteria.¹³⁵

Penalties for Unauthorized Disclosure

In addition to administrative penalties agencies may employ to enforce information security, there are several statutory provisions that address the protection of classified information as such, but only certain types of information or in specific situations. There is no blanket prohibition on the unauthorized disclosure of classified information.¹³⁶ The Espionage Act itself does not mention classified information, but prohibits transmittal of national defense information with the relevant intent or state of mind.¹³⁷

Criminal Penalties

Generally, federal law prescribes a prison sentence of no more than five years and/or a fine for officers and employees of the federal government who knowingly remove classified material without the authority to do so and with the intention of keeping that material at an unauthorized location.¹³⁸ The Espionage Act provides for a penalty of up to ten years for unlawful collection, receipt, retention, communication, or transmission of national security materials or information.¹³⁹ Stiffer penalties—fines and imprisonment for any term of years or for life, or the death sentence in certain circumstances—attach when anyone transmits classified information to an individual who they have reason to believe is an agent of a foreign government.¹⁴⁰ A fine and a 10-year prison term may also be imposed if an individual publishes, makes available to an unauthorized person, or otherwise uses to the United States' detriment classified information regarding the codes, cryptography, and communications intelligence utilized by the United States or a foreign government.¹⁴¹ Finally, the disclosure of classified information that reveals any information identifying a covert agent,¹⁴² when done intentionally by a person with authorized access to such identifying information, is punishable by imprisonment for up to 15 years.¹⁴³ A similar disclosure by one who learns the identity of a covert agent as a result of having authorized access to classified information is punishable by not more than 10 years' imprisonment.¹⁴⁴ Under the same provision, a person who undertakes a "pattern of activities intended to identify and expose covert agents" with reason to believe such activities would impair U.S. foreign intelligence activities, and who then discloses the identities uncovered as a result is subject to three years' imprisonment, whether or not the violator has access to classified information.¹⁴⁵ Persons subject to the Uniform Code of Military Justice may face court-martial for violation of these statutes¹⁴⁶ or analogous military crimes.¹⁴⁷

Civil Penalties and Other Measures

In addition to the criminal penalties outlined above, the executive branch employs numerous means of deterring unauthorized disclosures by government personnel using administrative measures based on terms of employment contracts. The agency may impose disciplinary action or revoke a person's security clearance. The revocation of a security clearance is usually not reviewable by the Merit Systems Protection Board¹⁴⁸ and may mean the loss of government employment.¹⁴⁹ Government employees may also be subject to monetary penalties for disclosing classified information.¹⁵⁰ Violators of the Espionage Act and the Atomic Energy Act provisions may additionally be subject to loss of their retirement pay.¹⁵¹

Agencies also rely on contractual agreements with employees, who typically must sign nondisclosure agreements prior to obtaining access to classified information,¹⁵² sometimes agreeing to submit all materials that the employee desires to publish to a review by the agency. The Supreme Court enforced such a contract against a former employee of the CIA, upholding the government's imposition of a constructive trust on the profits from a book the employee sought to publish without first submitting it to CIA for review.¹⁵³

In 1986, the Espionage Act was amended to provide for the forfeiture of any property derived from or used in the commission of an offense that violates the Espionage Act.¹⁵⁴ Violators of the Atomic Energy Act may be subjected to a civil penalty of up to $100,000 for each violation of Energy Department regulations regarding dissemination of unclassified information about nuclear facilities.¹⁵⁵

Under some circumstances, the government can also use injunctions to prevent disclosures of information. In at least one instance, a court upheld an injunction against a former employee's publishing of information learned through access to classified information.¹⁵⁶ The Supreme Court also upheld the State Department's revocation of passports for overseas travel by persons planning to expose U.S. covert intelligence agents; the travel's purpose was to disrupt U.S. intelligence activities rather than to assist a foreign government.¹⁵⁷

Declassification vs. Leaks and "Instant Declassification"

As noted above, Executive Order 13,526 sets the official procedures for the declassification of information. Once information is declassified, it may be released to persons without a security clearance.¹⁵⁸ Some argue the President has the authority to disclose classified information without going through the established procedures for declassification.¹⁵⁹ Leaks, by contrast, might be defined as the release of classified information to persons without a security clearance, often journalists. In 2012, some allegedly high-profile leaks of information regarding sensitive covert operations in news stories that seemed to some to portray the Obama Administration in a favorable light¹⁶⁰ raised questions regarding the practice of "instant declassification," or whether disclosure of classified information to journalists may ever be said to be an "authorized disclosure" by a senior official.

The processes for declassification set forth in Executive Order 13,526 seem to presuppose that agencies and classifying officials will not have any need or desire to disclose classified information in their possession other than to comply with the regulations, but there seems to be an informal process for "instant declassification" of information whose release to the public serves an immediate need.¹⁶¹ Representative William Moorhead, at the time chairman of the Foreign Operations and Government Information Subcommittee of the House Government Operations Committee, stated in 1974:

Critics of the present system of handling classified information within the Executive Branch point to an obvious double standard. On one hand, the full power of the Government's legal system is exercised against certain newspapers for publishing portions of the Pentagon Papers and against someone like Daniel Ellsberg for his alleged role in their being made public. This is contrasted with other actions by top Executive officials who utilize the technique of "instant declassification" of information they want leaked. Sometimes it is an "off-the-record" press briefing or "backgrounders" that becomes "on-the-record" at the conclusion of the briefing or at some future politically strategic time. Such Executive Branch leaks may be planted with friendly news columnists. Or, the President himself may exercise his prerogative as Commander in Chief to declassify specific information in an address to the Nation or in a message to the Congress seeking additional funds for a weapons system.¹⁶²

Executive Order 13,526 does not address an informal procedure for releasing classified information. Section 1.1 of the Order provides that "[c]lassified information shall not be declassified automatically as a result of any unauthorized disclosure of identical or similar information," but does not address what happens in the event of a disclosure that was in fact authorized. By definition, classified information is designated as classified based on whether its unauthorized disclosure can reasonably be expected to cause a certain level of damage to national security.¹⁶³ This definition may be read to suggest that disclosures may be authorized under such circumstances when no damage to national security is reasonably expected. Nothing in the order provides explicit authority to release classified information that exists apart from the authority to declassify, but it is possible that such discretionary authority is recognized to release information outside the community of authorized holders without formally declassifying it.

Part 4 of Executive Order 13,526 describes safeguarding of classified information from unauthorized disclosure¹⁶⁴ and preventing access to such information by "unauthorized persons."¹⁶⁵ Most of the provisions appear to envision classified documents or communications and storage devices used for classified information rather than the spoken word. Section 4.1(g) requires agency heads and the DNI to "establish controls to ensure that classified information is used, processed, stored, reproduced, transmitted, and destroyed under conditions that provide adequate protection and prevent access by unauthorized persons." If "transmitted" is interpreted to include oral dissemination and "unauthorized persons" is interpreted to mean persons who do not meet the criteria set forth in Section 4.1(a),¹⁶⁶ then it would seem that agency heads who approve leaks could be in breach of their responsibilities under the Order.

There is also provision for "emergency disclosure" of classified information "when necessary to respond to an imminent threat to life or in defense of the homeland" to "an individual or individuals who are otherwise not eligible for access."¹⁶⁷ Section 4.2(b) provides that such disclosures must be in accordance with implementing regulations or procedures the classifying agency implements; must be undertaken in such a way as to minimize the information disclosed and the number of individuals who receive it; and must be reported promptly to the originator. Information disclosed under this provision is not deemed to be declassified. The existence of this provision could be read to cut against an interpretation that permits selected release of classified information to reporters for broader dissemination. However, it could also be read to allow a different procedure by which an agency head, who is the original classifying authority for the information at issue, might simply authorize remarks to the press that reference classified information in such a way as to minimize harm to national security.

As a practical matter, however, there is seemingly little to stop agency heads and other high-ranking officials from releasing classified information to persons without a security clearance when it is seen as suiting government needs. The Attorney General has prosecutorial discretion to choose which leaks to prosecute.¹⁶⁸ If, in fact, a case could be brought that a senior official has disclosed or authorized the disclosure of classified information, successful prosecution under current laws may be difficult because the scienter requirement is not likely to be met. The Espionage Act of 1917, for example, requires proof that the discloser has the intent or reason to believe the information will be used against the United States or to the benefit of a foreign nation.¹⁶⁹ Although the nature and sensitivity of the information that was released are elements for the jury to decide,¹⁷⁰ knowledge that the information is classified may be enough to persuade a court that damage to national security can be expected.¹⁷¹ However, in the event the disclosure was made or authorized by a person who has the authority to make such determinations—as to whether the information will be used against the United States or to the benefit of a foreign nation—it may be that such deference would potentially result in not meeting the scienter requirement absent some proof of ill intent. For example, a belief on the part of a lower level official that a particular disclosure was authorized could serve as an effective defense to any prosecution, and could entitle the defendant to depose high level government officials in preparation for his or her defense.

Executive branch policy appears to treat an official disclosure as a declassifying event, while non-attributed disclosures have no effect on the classification status of the information.¹⁷² For example, the DOD instructs agency officials, in the event that classified information appears in the media, to neither confirm nor deny the accuracy of the information.¹⁷³ The Under Secretary of Defense for Intelligence is then advised to "consult with the Assistant Secretary of Defense for Public Affairs and other officials having a primary interest in the information to determine if the information was officially released under proper authority."¹⁷⁴ The regulation does not clarify what happens in the event the disclosure turns out to have been properly authorized. It appears no further action need be taken, whether to inform employees that the information no longer needs to be protected or to make annotations in classified records to reflect the newly declassified status of the information. In any event, any documents that contain that information potentially contain other classified information as well, in which case each such document would retain the highest level of classification applicable to information in the document. Thus, it seems unlikely that the authorized disclosure of classified information to the media would often result in the public release of any records.

The Intelligence Authorization Act for FY2013, Section 504 requires a government official who approves a disclosure of classified information to the media, or to another person for publication, to first report the decision and other matters related to the disclosure to the congressional intelligence committees.¹⁷⁵ The provision applies to "national intelligence or intelligence related to national security" that is classified or has been declassified for the purpose of making the disclosure, where the disclosure is made by a government officer, employee, or contractor. According to the original committee report, the reporting is intended to keep the intelligence committees apprised of expected media disclosures of relevant classified information and to assist in distinguishing between "authorized disclosures" and "unauthorized leaks."¹⁷⁶ Originally scheduled to sunset after a year, the provision was made permanent in the Intelligence Authorization Act for Fiscal Year 2014.¹⁷⁷ Any reports to Congress of authorized disclosures submitted pursuant to this provision apparently are classified.¹⁷⁸

Special Considerations for the President

The President, as the head of the executive branch and commander in chief, has the responsibility to protect national security information,¹⁷⁹ which necessarily includes the authority to declassify or downgrade information classified pursuant to the President's Executive Order.¹⁸⁰ Whether the President is bound to comply with processes set forth in the Executive Order for declassification, or any other procedure for declassification, is the subject of debate, especially following President Trump's claim, after leaving office, that Presidents have the authority to declassify information without following any specific procedure or notifying others.¹⁸¹ In a 2020 decision, the U.S. Court of Appeals for the Second Circuit appears to disagree, stating, in the FOIA context, that "declassification, even by the President, must follow established procedures."¹⁸² The court held that a FOIA litigant seeking to demonstrate that information had been declassified by presidential disclosure must show "first, that [the President's] statements are sufficiently specific; and second, that such statements subsequently triggered actual declassification."¹⁸³

While there does not seem to be one established procedure for presidential declassification of national security information, examples from recent decades seem to demonstrate that Presidents have sometimes formally ordered a declassification review by the relevant agency or agencies,¹⁸⁴ and have typically consulted with agency heads before ordering information downgraded or declassified. After President George W. Bush released a portion of his August 6, 2001, presidential daily intelligence brief (PDB) warning of Osama bin Laden's intent to attack the United States, a White House press briefing described the declassification process as follows:

While the President has the ultimate constitutional authority over the classification of information, the Director of Central Intelligence has statutory responsibility to safeguard intelligence sources and methods, and is one of the officials to whom authority to declassify information is delegated by executive order. The President authorized, and Dr. Rice requested, that the DCI review this PDB item to determine whether, in his judgment, declassification and release of this item would damage intelligence sources and methods, and is releasable in light of the relevant provisions of Executive Order on Classification and Declassification of Information.

The DCI has advised Dr. Rice in writing that he has made the required determination and has, in fact, declassified the PDB item. . . . . The DCI determined that three specific items of information—the names of foreign intelligence or security services—must be redacted in order to protect intelligence sources and methods. Those items are replaced with black on the declassified and released version of the PDB you have.

The other redactions on the released version are the original classification of the document as "Top Secret." As the DCI's written declassification order states, this declassification and release "shall not be deemed to constitute any precedent concerning any future declassification or release of any other PDB."¹⁸⁵

In response to litigation, President Obama ordered the declassification of four revoked Office of Legal Counsel (OLC) memoranda analyzing the CIA's enhanced interrogation program after consultation with the Attorney General, the DNI, and others (presumably the Director of Central Intelligence), with the President concluding that "exceptional circumstances surround these memos and require their release."¹⁸⁶ The DOJ subsequently released the memoranda.¹⁸⁷

Examples from the Trump Administration further illustrate the process for declassifying information.¹⁸⁸ On the day before leaving office in 2021, President Trump issued a memorandum declassifying materials related to the FBI's Crossfire Hurricane investigation following a declassification review and after accepting redactions suggested by the FBI.¹⁸⁹ President Trump also directed the DOJ to conduct a declassification review with respect to certain documents related to the investigation of Russian interference in the 2016 election, although it is not clear whether the order was ever put into writing.¹⁹⁰ President Biden ordered the downgrading and declassification of intelligence information pertaining to Russia's plans to invade and wage war in Ukraine as a strategy to undermine Russia's plans.¹⁹¹

There have also been reported examples of less formal presidential releases of classified information. For example, in 2003, President Bush reportedly declassified information from a National Intelligence Estimate to rebut Iraq war critics by directing Vice President Cheney to "get out" the information, presumably by disclosing it to media outlets.¹⁹² President Trump publicly released a classified satellite photograph of an explosion at an Iranian launch site, claiming he had the "absolute right" to do so,¹⁹³ thereby declassifying it.¹⁹⁴

Former Presidents do not automatically receive access to classified national security information, although most have continued to receive intelligence briefings after their term in office ends.¹⁹⁵ It is up to the incumbent President to decide whether to provide classified information to a former President.¹⁹⁶ Agency heads may also permit former Presidents to have access to classified information under their purview by waiving the ordinary need-to-know requirement after determining that the disclosure is in the national security interest and that the classified information will be protected from unauthorized disclosure and will be properly stored.¹⁹⁷

Insider Threat Risk Management

In October 2011 President Obama issued Executive Order 13,587, "Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information."¹⁹⁸ Among other measures, it established an interagency Insider Threat Task Force with a mandate to

develop a Government-wide program (insider threat program) for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure, taking into account risk levels, as well as the distinct needs, missions, and systems of individual agencies. This program shall include development of policies, objectives, and priorities for establishing and integrating security, counterintelligence, user audits and monitoring, and other safeguarding capabilities and practices within agencies.¹⁹⁹

President Obama issued the resulting policy and minimum standards for agencies in implementing their own insider threat programs in November 2012.²⁰⁰

Concerned about WikiLeaks and other disclosures of classified information by those with access, the 112th Congress held at least two hearings on the topic of unauthorized disclosures of classified information.²⁰¹ Congress also passed a measure as part of the National Defense Authorization Act for FY2012 to require the DOD to establish a "program for information sharing protection and insider threat mitigation for the information systems of the DOD to detect unauthorized access to, use of, or transmission of classified or controlled unclassified information."²⁰² The program is required to make use of both technology based solutions as well as a "governance structure and process" to integrate these technologies into existing security measures.²⁰³

As initially reported by the Senate Intelligence Committee, S. 3454 (112th Cong.) contained a number of measures to address the disclosure of classified information by federal employees, whether authorized or not, especially if the disclosure were to the media. Opposition to these measures resulted in a manager's amendment to the bill with all but the reporting provision regarding authorized disclosures removed.²⁰⁴ Some of the measures that were eliminated from the bill involved restrictions on media access to government officials. One was a prohibition on federal officers, employees, and contractors who have security clearances, including some who have left government service within the prior year, from entering into agreements with the media to provide analysis or commentary on matters related to classified intelligence activities or intelligence related to national security.²⁰⁵ Another would have limited the individuals authorized to provide background or off-the-record information to the media regarding intelligence activities to the Director and Deputy Directors or their equivalents of each agency and designated public affairs officers.²⁰⁶ Another would have required the DNI to prescribe regulations regarding the interaction of cleared personnel with the media.²⁰⁷ Such persons would have been required to report all contacts with the media to the appropriate security office.²⁰⁸ Also eliminated was a prohibition on federal officers, employees, and contractors from possessing a security clearance after having made any unauthorized disclosure regarding the existence of, or classified details relating to, a covert action as defined in 50 U.S.C. § 413(b) (now classified at 50 U.S.C. § 3091).²⁰⁹

The insider threat issue was revisited in the Intelligence Authorization Act for FY2016, and passed as Division M of the Consolidated Appropriations Act 2016.²¹⁰ Section 306 added a requirement to Title 5, U.S. Code, for the DNI to direct agencies to each establish an "enhanced personnel security program" to integrate a broader data set into reassessments of the continuing eligibility of personnel to hold security clearances or sensitive positions. Specifically,

The enhanced personnel security program of an agency shall integrate relevant and appropriate information from various sources, including government, publicly available and commercial data sources, consumer reporting agencies, social media and such other sources as determined by the Director of National Intelligence.²¹¹

The provision requires the agency programs to conduct random automated record checks of the selected sources of data at least twice within a five-year period for each covered person, unless that individual is subject to more frequent reviews.²¹² The deadline to implement the programs is five years after enactment (December 15, 2020) or the date on which the backlog of overdue periodic reinvestigations is eliminated, as determined by DNI.²¹³ In 2019, Congress directed the DNI and IC agency heads to develop policies to comply with the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.²¹⁴

With respect to the backlog of security clearance adjudications, ODNI reported in 2022 that the COVID-19 pandemic minimally impacted pending and completed cases.²¹⁵ Going forward, ODNI stated that Executive Branch departments and agencies (D/As) will not routinely conduct periodic reinvestigations, which is forecast to help D/As "consistently maintain a steady state of pending cases in order to reach the established timeliness goals related to security clearance adjudications."²¹⁶