78
I-1 The Department of The Department of Energy’s Energy’s Official Use Only Official Use Only

I-1 The Department of Energy’s Official Use Only

Embed Size (px)

Citation preview

Page 1: I-1 The Department of Energy’s Official Use Only

I-1

The Department of Energy’s The Department of Energy’s

Official Use OnlyOfficial Use Only

Page 2: I-1 The Department of Energy’s Official Use Only

I-2

Why Official Use Only?Why Official Use Only? Consolidates most CUI information within DOE

• Includes unclassified controlled information which is not governed by a DOE-wide directive (e.g., Export Controlled Information, Protected Cooperative Research and Development Information, Applied Technology)

• Does not include

Unclassified Controlled Nuclear Information (UCNI), which is governed by DOE Order 471.1A and DOE Manual 471.1-1

Unclassified Naval Nuclear Propulsion Information, which is Naval Reactors information

OUO ensures consistent handling and protection of unclassified information throughout the complex

OUO ensures information is not released through informal methods (posted on a website or sent to a person without a need-to-know the information)

Page 3: I-1 The Department of Energy’s Official Use Only

I-3

Official Use Only

Export Controlled Information

Applied Technology

Proprietary InformationPrivacy Act Information

Personally Identifiable Information

Source Selection Information

Draft Documents

Business Confidential

Attorney-Client Attorney-Work

Sensitive Nuclear Technology

Intellectual Property

Patent Information

What is OUO Information?What is OUO Information?

Page 4: I-1 The Department of Energy’s Official Use Only

I-4

Who has Responsibility for OUO?Who has Responsibility for OUO?

The Office of Classification is responsible for developing DOE’s overall policy and guidelines for identifying and protecting OUO

The Chief Information Officer (CIO) issues guidance regarding the protection of OUO and other sensitive information on DOE information systems and the identification of PII

Program Offices determine the specific information within their purview that is OUO

Page 5: I-1 The Department of Energy’s Official Use Only

I-5

When Must a Document be Reviewed When Must a Document be Reviewed for OUO?for OUO?

“An unclassified document originated within a program element must be evaluated to determine whether it contains OUO information.”*

If the originator believes the document contains sensitive information, it should be reviewed prior to being finalized, released by the originator outside of the activity or office, or filed

Documents originated prior to April 9, 2003 (when the OUO program was established), must be reviewed if they are going to be publicly released if the possessor believes there is a potential for the document to contain sensitive information

*DOE Order 471.3, Identifying and Protecting Official Use Only

Page 6: I-1 The Department of Energy’s Official Use Only

I-6

Who has Authority to Who has Authority to Identify OUO?Identify OUO?

Any employee, Federal or contractor, from an office with cognizance over the information, may make OUO determinations for unclassified documents• originated within his/her office,

• produced for his/her office, or

• under the control of his/her office

Page 7: I-1 The Department of Energy’s Official Use Only

I-7

Who has Authority to Who has Authority to Identify OUO?Identify OUO?

No special authority or designation or training required• Training is highly recommended

• Training via PowerPoint presentation is available from the Office of Quality Management

Should be familiar with OUO directives

Some Program Offices may have additional requirements (training, specific personnel, etc.)

Page 8: I-1 The Department of Energy’s Official Use Only

I-8

What is the Criteria for What is the Criteria for OUO Information?OUO Information?

Damage: In the opinion of the person making the determination, has the potential to damage Governmental, commercial, or private interests if released to persons who don’t need it to do their jobs or DOE-authorized activity

Potentially Falls under a FOIA Exemption: In the opinion of the person making the determination, may fall under at least one of the FOIA exemptions (2-9)

AND

Certain unclassified information that meets the following two criteria

Page 9: I-1 The Department of Energy’s Official Use Only

I-9

What is the Basis for OUO What is the Basis for OUO Determinations?Determinations?

1. Guidance• Approved by the Office of

Classification • Issued by the Office of

Classification, a program office or a DOE/NNSA contractor

2. Individual Determination• Release could cause damage• May fall under a FOIA

exemption

Page 10: I-1 The Department of Energy’s Official Use Only

I-10

How Do You Make an OUO Determination?How Do You Make an OUO Determination?

Step 1Is the information covered by Guidance?

If there is guidance

Information that is OUO according to guidance must be identified as OUO

If there is no guidance, proceed to Step 2

Page 11: I-1 The Department of Energy’s Official Use Only

I-11

How Do You Make an OUO Determination?How Do You Make an OUO Determination?

Do you think the information could damage Governmental, commercial, or private interests if

given to someone who doesn’t need it to perform his or her job or other DOE-authorized activity?

Step 2

If not, the information is not OUO

If you feel the release of the information could cause damage, the information might be OUO

Proceed to Step 3

Page 12: I-1 The Department of Energy’s Official Use Only

I-12

How Do You Make an OUO Determination?How Do You Make an OUO Determination?

Do you think the information could fall under one of the FOIA exemptions (2-9)?

Step 3

If, you feel the release of the information could case damage and the information

potentially falls under a FOIA exemption,

the information is OUO

Page 13: I-1 The Department of Energy’s Official Use Only

I-13

9, Wells

UCNI

1, National

Security

Information

2, Circumvention

of Statute

RD/ FRD

8, Financial

Information

7, Law

Enforcement

6, Personal

Privacy

5, Privileged

Information

4, Commercial/

Proprietary

Other

How does OUO relate to How does OUO relate to the FOIA Exemptions?the FOIA Exemptions?

CLASSIFIED

RD/FRD

NSI

UCNIControlled by

UCNI Directives

OUO

NOT DOE

OUO3,

Sta

tuto

ry

Exem

ption

Page 14: I-1 The Department of Energy’s Official Use Only

I-14

Does OUO Mean the Information is Does OUO Mean the Information is Exempt from Release underExempt from Release under

the FOIA? the FOIA?

OUO is not a determination that information is FOIA exempt

OUO is a determination that the information may be FOIA exempt

• OUO markings ensure a document is not publicly released without an appropriate review

• If an OUO document is requested under the FOIA, a FOIA Authorizing Official must determine whether the information must be released

• Only a FOIA Official may determine that information is FOIA exempt

The threshold for withholding information under the FOIA is higher, requires in-depth knowledge of FOIA

OUOOUO FOIA Exempt FOIA Exempt

Page 15: I-1 The Department of Energy’s Official Use Only

I-15

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 1 – National Security Information

Information classified by Executive order

Identification and protection governed by executive order, regulation and directives

IS NEVER OUO

Page 16: I-1 The Department of Energy’s Official Use Only

I-16

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 2 – Circumvention of Statute

Disclosure of the information would benefit someone trying to violate a law or regulation

Note: The statute or regulation does not have to be identified

Page 17: I-1 The Department of Energy’s Official Use Only

I-17

OUO Based on Exemption 2OUO Based on Exemption 2

OUO based on “circumvention of statute” may be applied to many unclassified documents that could be misused by an adversary

Page 18: I-1 The Department of Energy’s Official Use Only

I-18

OUO Based on Exemption 2OUO Based on Exemption 2

Exemption 2 Examples

Security-related information Inspection and appraisal procedures Self-assessments Vulnerability assessments Agency computer access codes Information concerning critical systems, facilities,

stockpiles, or other assets subject to harm

Note: OUO based on FOIA Exemption 2 is often found in security-related classification guides – may have to consult a DC

to make sure the information is not classified

Page 19: I-1 The Department of Energy’s Official Use Only

I-19

OUO and FOIA ExemptionsOUO and FOIA Exemptions

Exemption 3 – Statutory Exemption

Disclosure of information is prohibited by statute

Not OUO if Information is otherwise classified or controlled (e.g., RD, FRD, UCNI, NNPI)

Several Exemption 3 statues are routinely used within DOE

If not sure Exemption 3 applies, should ask for interpretation from General Counsel to determine if statute qualifies

NOTE: The determination must be based on statute, but the statute does not have to be identified on the stamp.

Page 20: I-1 The Department of Energy’s Official Use Only

I-20

OUO Based on Exemption 3OUO Based on Exemption 3

Exemption 3 Examples

Federal Technology Transfer Act – Protected CRADA information

Procurement Integrity Act – Source selection information

Internal Revenue Code – taxpayer identification numbers

Page 21: I-1 The Department of Energy’s Official Use Only

I-21

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 4 – Commercial/Proprietary

Trade secrets Commercial or financial

information whose release would• Impair the government’s ability to

obtain information in the future, or

• Cause competitive harm

Page 22: I-1 The Department of Energy’s Official Use Only

I-22

OUO Based on Exemption 4OUO Based on Exemption 4

Indicates a company feels release of the information would cause competitive harm

Examples

• Business Confidential

• Company Proprietary

• Proprietary Information

Corporate/Private Documents Marked Proprietary

Page 23: I-1 The Department of Energy’s Official Use Only

I-23

OUO Based on Exemption 4OUO Based on Exemption 4

Exemption 4 Examples

Trade secret information (Coca Cola) Financial information, such as income,

profits, losses, costs Contract proposal, solicited or unsolicited Customer/supplier lists

Note: Not all contractor information is OUO under Exemption 4

Page 24: I-1 The Department of Energy’s Official Use Only

I-24

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 5 – Privileged Information

Three primary privileges

• Deliberative process (a.k.a. “predecisional”)

• Attorney Work-Product

• Attorney-Client

Page 25: I-1 The Department of Energy’s Official Use Only

I-25

OUO Based on Exemption 5OUO Based on Exemption 5

Exemption 5 – Privileged Information

Reasons deliberative process information is not released

• To encourage open, frank discussions on matters of policy between subordinates and superiors

• To protect against premature disclosure of proposed policies before they are adopted

• To protect against public confusion that might result from disclosure of reasons and rationales that were not the grounds for an agency's action

Page 26: I-1 The Department of Energy’s Official Use Only

I-26

OUO Based on Exemption 5OUO Based on Exemption 5

Not just any deliberative process document

Must have the potential for damage

Refer to the reasons for not releasing to make determination

Page 27: I-1 The Department of Energy’s Official Use Only

I-27

OUO Based on Exemption 5OUO Based on Exemption 5

May protect review/comment process even after decision is made

Examples

• Protected only before final document is released - a draft report of an enforcement action may be OUO during the decision making process and the final report might not be OUO if it must be publicly released

• Protected before and after final document is released - a draft report of a directive could be OUO during decision making and after the final report is issued because release of the draft may cause confusion between the draft and the final directive

Page 28: I-1 The Department of Energy’s Official Use Only

I-28

OUO Based on Exemption 5OUO Based on Exemption 5

Exemption 5 Examples

Documents concerning budget cuts

Documents concerning cancellation of a program

Documents concerning DOE property purchases

Page 29: I-1 The Department of Energy’s Official Use Only

I-29

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 6 – Personal Privacy

Constitutes a “clearly unwarranted invasion of personal privacy”

Personal information that might cause distress or embarrassment, or risk identity theft

Page 30: I-1 The Department of Energy’s Official Use Only

I-30

OUO Based on Exemption 6OUO Based on Exemption 6

Personally Identifiable Information (PII)

Certain OUO information based on exemption 6 (personal privacy)

Examples (when associated with an individual)• Social Security Number (even when not associated with an

individual)

• Place of birth, date of birth

• Mother’s maiden name

• Medical history

• Financial data

• Performance ratings

Page 31: I-1 The Department of Energy’s Official Use Only

I-31

OUO Based on Exemption 6OUO Based on Exemption 6

Personally Identifiable Information (PII)

In hard copy - mark and protect as OUO, using Exemption 6, Personal Privacy

Page 32: I-1 The Department of Energy’s Official Use Only

I-32

NotNot OUO Based on Exemption 6 OUO Based on Exemption 6

Information not OUO under Exemption 6

Federal employee’s name, title, grade, position description, and duty station

Note: May be OUO if release of information would pose a risk to person’s safety or interfere with intelligence or law enforcement programs

Page 33: I-1 The Department of Energy’s Official Use Only

I-33

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 7 – Law Enforcement

Investigative information Law enforcement procedures

Exemption 7 Examples

Law enforcement manuals and guidelines

Statements of witnesses during an investigation

Page 34: I-1 The Department of Energy’s Official Use Only

I-34

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 8 – Financial Institutions

Evaluations of financial institution’s stability prepared by, on behalf of, or for use of an agency responsible for regulation of financial institutions (FDIC, etc.)

Exemption 8 Example

Bank examination reports

Page 35: I-1 The Department of Energy’s Official Use Only

I-35

OUO and the FOIA ExemptionsOUO and the FOIA Exemptions

Exemption 9 – Wells

Technical and scientific information about any type of well

Exemption 9 Examples

Geothermal well BTU production Ground water inventories and well

yields in gallons per minute Natural gas reserves

Page 36: I-1 The Department of Energy’s Official Use Only

I-36

Often-used Exemptions in DOEOften-used Exemptions in DOE

Commonly used exemptions

Exemption 2, Circumvention of Statute• Usually covered by classification guidance• May need to consult a Derivative Classifier to ensure

information is not classified

Exemption 4, Commercial/Proprietary Exemption 5, Privileged Information

• Very little guidance • Decision depends on perception of damage

Exemption 6, Personal Privacy

Page 37: I-1 The Department of Energy’s Official Use Only

I-37

OUO Determinations - SummaryOUO Determinations - Summary

If guidance states information is OUO it must be identified as OUO

If there is no guidance• Information must meet criteria of damage and

• In the opinion of the person, fall under FOIA exemptions 2-9

Many determinations are discretionary• Assessment may vary among program offices/employees

• What is sensitive for one agency/employee may not be for another

YOU decide when to use the tool

Page 38: I-1 The Department of Energy’s Official Use Only

I-38

Basing OUO Determinations on Basing OUO Determinations on FOIA ExemptionsFOIA Exemptions

For more information refer to DOE G 471.3-1

Page 39: I-1 The Department of Energy’s Official Use Only

I-39

What Should You do if You Aren’t What Should You do if You Aren’t Sure it’s OUO? Sure it’s OUO?

Seek advice

• Other employees

• Supervisor

• Office of Classification

Page 40: I-1 The Department of Energy’s Official Use Only

I-40

How is OUO Marked?How is OUO Marked?

Page 41: I-1 The Department of Energy’s Official Use Only

I-41

Markings are ImportantMarkings are Important

Various markings used to indicate sensitive information cause confusion

• Not certain if document needs protection

• Not certain how to protect document

• May have to call to determine intent

• No mandated protection

XXXXX XX X XXXXXX XXX

XX XXXXXXXXXX XXXXXXXX

XXXXXXXXX.

DRAFT

XXXXX XX X XXXXXX XXXXX XXXXXXXXXX XXXXXXXXXXXXXXXXX.

BUSINESS CONFIDENTIAL

XXXXX XX X XXXXXX XXXXX XXXXXXXXXX XXXXXXXXXXXXXXXXX.

PROPRIETARY

XXXXX XX X XXXXXX XXXXX XXXXXXXXXX XXXXXXXXXXXXXXXXX.

PRE-DECISIONAL

Page 42: I-1 The Department of Energy’s Official Use Only

I-42

OUO MarkingOUO Marking

OUO Markings

• Ensures everyone understands a documents must be protected

• Ensures everyone knows how it must be protected

Without OUO markings

• Does not require protection

• No recourse if information is released

Page 43: I-1 The Department of Energy’s Official Use Only

I-43

OFFICIAL USE ONLY May be exempt from public release under the Freedom of Information Act(5 U.S.C. 552), exemption number and category: 5, PrivilegedInformation

Department of Energy review required before public release

Name/Org: John Smithson, NA-121 Date: 4/11/07Guidance (if applicable): CG-SS-4

Markings are for example purposes only

Exemption Number

Exemption Name

Name AND Organization

Date ofDetermination

Short Name of Guide

How are OUO Documents Marked?How are OUO Documents Marked?

Front Marking – Determination based on Guidance (Classification/Control Guides)

Page 44: I-1 The Department of Energy’s Official Use Only

I-44

How are OUO Documents Marked?How are OUO Documents Marked?

OFFICIAL USE ONLY May be exempt from public release under the Freedom of Information Act(5 U.S.C. 552), exemption number and category: 5, PrivilegedInformation

Department of Energy review required before public release

Name/Org: John Smithson, NA-121 Date: 4/11/07Guidance (if applicable): N/A

Markings are for example purposes only

Exemption Number

Exemption Name

Name AND Organization

Date ofDetermination

Suggest N/A if guidance is

not used

Front Marking – Determination based on Damage and FOIA Exemption

Page 45: I-1 The Department of Energy’s Official Use Only

I-45

Requirements – Front MarkingRequirements – Front Marking

Exemption Category Name

2 Circumvention of Statute3 Statutory Exemption4 Commercial/Proprietary5 Privileged Information6 Personal Privacy7 Law Enforcement8 Financial Institutions9 Wells

Page 46: I-1 The Department of Energy’s Official Use Only

I-46

How are OUO Documents Marked?How are OUO Documents Marked?

Page Marking

OFFICIAL USE ONLY On bottom of all pages

OR On bottom of only those

pages containing OUO information

XXXXX XX X XXXXXX XXX

XX XXXXXXXXXX XXXXXXXX

XXXXXXXXX.

XX XXXXXXX XXXXX XXXX

XXXXXXXXX XX XXXXXX. XX

XXXX XXXXXXX X XXXXX

XXXXXX XXXX XXXX.

OFFICIAL USE ONLY

Markings are for example purposes only

Page 47: I-1 The Department of Energy’s Official Use Only

I-47

How are OUO Documents Marked?How are OUO Documents Marked?

Mandatory Supplemental Markings

Markings required by law, regulation, or other DOE directives that convey additional advice on handling or access restrictions

Used in addition to, not in place of, OUO markings (both types of markings must appear on the document)

OUO markings ensure consistent protection and handling throughout DOE

Examples• Protected Cooperative Research and Development Agreement

(CRADA) Information• Export Controlled Information (ECI)• Applied Technology information (AT)• Source Selection Information – See FAR 2.101 and 3.104

Page 48: I-1 The Department of Energy’s Official Use Only

I-48

Sample of OUO DocumentSample of OUO Documentwith Supplemental Marking (CRADA)with Supplemental Marking (CRADA)

OFFICIAL USE ONLY

XXX XXXXXX XX XXXXXXXXXXXX XXXXXXXXXXXX XXXXXX

XXXXXXX. Xxxx xxxxxx xxxxxxxxx xxx xxxxxxxx xxxx xxxxxxx xxxxxxxxx xxx xxxxxxxxxxx, xxxxxxx, xxx xxxxxxxxxx Xxxxxxxx Xxx Xxxx (XXX) xxxxxxxxxxx. Xxxxx xxxxxxxx xxxxxxx xxxxxxxxx xxxxxxxxxx xxx xxxxxxxxxx xxxxxxxxx. Xxxxxxx X xxxxxxxxx xxx xxxxxxxxxxxx xxx xxxxxxxxxxx xxx xxxxxxx XXX xxxxxxxxxxx; Xxxxxxx XX xxxxxxxxx xxxxxxxxxx XXX xxxxxxxxxxx. Xxx Xxxxxxxxxx Xxxxxxxxxxxx Xxxxxxxx (XXX), Xxxxxxxxxx x, xxxx xxxxx xxxxxxxxxxxx xx xxx Xxxxxx xxx xxxxx xx xxx/xxxxxxxx xxxxxxxxxx xxxxxxxxxxx.

XXXXXXX. Xxxxxxxx xxxxxxxxxx xxxx Xxxxxx xxxxxx xx xxxxxxxxx xx Xxxxxxxxxxx Xxxxxxxxxxxxxx xxx Xxxxxxx Xxxxxx xx xxx-xxx-xxxx.

OFFICIAL USE ONLYMay be exempt from public release under the Freedom of Information Act (5 U.S.C. 552), exemption number and category: ___3, Statutory Exemption

Department of Energy review required before public releaseName/Org: Curtis Gonzales, BWXT-Pantex Date: 4/15/03 Guidance (if applicable): Pantex Plant OUO Topical Guide

Markings are for example purposes only

Protected CRADA InformationThis product contains Protected CRADA Information which was produced on 11/6/06 under CRADA No. 12345 and is not to be further disclosed for a period of five years from the date it was produced except as expressly provided for in the CRADA.

Page 49: I-1 The Department of Energy’s Official Use Only

I-49

How is Document Containing OUO and How is Document Containing OUO and National Security Information Marked?National Security Information Marked?

Do not apply OUO front and page markings

Do apply

• title marking

• portion marking

SECRET

Title (O UO )

(S )

(O U O )

(U )

SECRET

Markings are for example purposes only

Derivative Declassifierreview required prior to

declassification

Classified By: Jane Doe, General Engineer, HS-93

Derived From: CG-SS-4, 09/12/00, DOE OC

Declassify On: September 20, 2009

Page 50: I-1 The Department of Energy’s Official Use Only

I-50

How is a Document Containing OUO How is a Document Containing OUO and UCNI Marked?and UCNI Marked?

Apply front marking to unclassified documents containing OUO information even if there is an UCNI marking to alert holder of presence of OUO information

For interior pages may use only highest category of information (UCNI) in the document or on individual pages

Markings are for example purposes only

UCNI

UCNI

UCNI

INTERIOR

PAGE

UCNI

UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION

NOT FOR PUBLIC DISSEMINATIONUnauthorized dissemination subject to civil and criminal sanctions under Section 148 of the Atomic Energy Act of 1954, as amended (42 U.S.C. 2168).

Reviewing Official: __Jane Doe, HS-91_________________________________

Date: _____4/15/03_______________________________________

Guidance Used: ____CG-UCNI-1______________________________________________

OFFICIAL USE ONLY

May be exempt from public release under the Freedom of Information Act

(5 U.S.C. 552), exemption number and Category: _2, Circumvention____

__of Statute__________________________________________________

Department of Energy Review required before public release

Name/Org: ___Jane Doe, SP-51________________ Date: __4/14/06__Guidance (if applicable): __CG-SS-4_______________

FRONT PAGE

Page 51: I-1 The Department of Energy’s Official Use Only

I-51

How Do You Mark Other-agency CUI?How Do You Mark Other-agency CUI?

Work for Others• Markings dictated by sponsoring organization

• Follow sponsoring organization guidance Use in DOE documents

• Apply OUO markings to documents that use other-agency CUI information

• Portion mark as OUO

Examples of other agency CUI markings

Department Label Acronym

NASA Administratively Controlled I nformation ACIDoD For Offi cial Use Only FOUO

CI A For Offi cial Use Only FOUO

DHS For Offi cial Use Only FOUO

DOT For Offi cial Use Only FOUO

DOJ Limited Offi cial Use LOU

DOS, USDA, CDC Sensitive But Unclassifi ed SBU

DEA DEA Sensitive

Page 52: I-1 The Department of Energy’s Official Use Only

I-52

Who Has Authority to Who Has Authority to Remove OUO MarkingsRemove OUO Markings??

If markings applied are based on guidance

• Any person authorized to use guidance when guidance specifies information is no longer OUO

• FOIA Authorizing Official who approves release of document requested under the FOIA

Page 53: I-1 The Department of Energy’s Official Use Only

I-53

Who Has Authority to Who Has Authority to Remove OUO MarkingsRemove OUO Markings??

If markings applied are based on an individual’s determination

• Employee who initially applied markings

• That employee’s supervisor

• FOIA Authorizing Official who approves release of document requested under FOIA

Page 54: I-1 The Department of Energy’s Official Use Only

I-54

How are OUO Markings Removed?How are OUO Markings Removed?

Person making the determination• Crosses out OUO front, page, and any

supplemental markings• Places following marking on front of document:

DOES NOT CONTAIN

OFFICIAL USE ONLY INFORMATION

Name/Org: Michael Kieszkowski, IM-40 Date: _4/30/03_

Page 55: I-1 The Department of Energy’s Official Use Only

I-55

How is a Document How is a Document Transmitting OUO Marked?Transmitting OUO Marked?

Required if transmittal document itself does not contain classified or controlled information

Calls attention to presence of OUO information in attachment

Document transmitted

contains OUO information

Markings are for example purposes only

Page 56: I-1 The Department of Energy’s Official Use Only

I-56

Sample Marking of Document Sample Marking of Document Transmitting OUOTransmitting OUO

XXX XXXXXX XX XXXXXXXXXXXX XXXXXXXXXXXX XXXXXX

XXXXXXX. Xxxx xxxxxx xxxxxxxxx xxx xxxxxxxx xxxx xxxxxxx xxxxxxxxx xxx xxxxxxxxxxx, xxxxxxx, xxx xxxxxxxxxx Xxxxxxxx Xxx Xxxx (XXX) xxxxxxxxxxx. Xxxxx xxxxxxxx xxxxxxx xxxxxxxxx xxxxxxxxxx xxx xxxxxxxxxx xxxxxxxxx. Xxxxxxx X xxxxxxxxx xxx xxxxxxxxxxxx xxx xxxxxxxxxxx xxx xxxxxxx XXX xxxxxxxxxxx; Xxxxxxx XX xxxxxxxxx xxxxxxxxxx XXX xxxxxxxxxxx. Xxx Xxxxxxxxxx Xxxxxxxxxxxx Xxxxxxxx (XXX), Xxxxxxxxxx x, xxxx xxxxx xxxxxxxxxxxx xx xxx Xxxxxx xxx xxxxx xx xxx/xxxxxxxx xxxxxxxxxx xxxxxxxxxxx.

XXXXXXX. Xxxxxxxx xxxxxxxxxx xxxx Xxxxxx xxxxxx xx xxxxxxxxx xx Xxxxxxxxxxx Xxxxxxxxxxxxxx xxx Xxxxxxx Xxxxxx xx xxx-xxx-xxxx.

Document transmitted contains OUO Information

Markings are for example purposes only

Attachment contains OUO, transmitting document does not contain OUO

Page 57: I-1 The Department of Energy’s Official Use Only

I-57

How is an OUO Document that Transmits a How is an OUO Document that Transmits a Classified DocumentClassified Document Marked? Marked?

XXX XXXXXX XX XXXXXXXXXXXX XXXXXXXXXXXX XXXXXX

XXXXXXX. Xxxx xxxxxx xxxxxxxxx xxx xxxxxxxx xxxx xxxxxxx xxxxxxxxx xxx xxxxxxxxxxx, xxxxxxx, xxx xxxxxxxxxx Xxxxxxxx Xxx Xxxx (XXX) xxxxxxxxxxx. Xxxxx xxxxxxxx xxxxxxx xxxxxxxxx xxxxxxxxxx xxx xxxxxxxxxx xxxxxxxxx. Xxxxxxx X xxxxxxxxx xxx xxxxxxxxxxxx xxx xxxxxxxxxxx xxx xxxxxxx XXX xxxxxxxxxxx; Xxxxxxx XX xxxxxxxxx xxxxxxxxxx XXX xxxxxxxxxxx. Xxx Xxxxxxxxxx Xxxxxxxxxxxx Xxxxxxxx (XXX), Xxxxxxxxxx x, xxxx xxxxx xxxxxxxxxxxx xx xxx Xxxxxx xxx xxxxx xx xxx/xxxxxxxx xxxxxxxxxx xxxxxxxxxxx.

XXXXXXX. Xxxxxxxx xxxxxxxxxx xxxx Xxxxxx xxxxxx xx xxxxxxxxx xx Xxxxxxxxxxx Xxxxxxxxxxxxxx xxx Xxxxxxx Xxxxxx xx xxx-xxx-xxxx.

SECRET

SECRET

Markings are for example purposes only

When separated from enclosures, handlethis document as OUO OFFICIAL USE ONLY

May be exempt from public release under the Freedom of Information Act (5 U.S.C. 552), exemption number and category: ___3, Statutory Exemption

Department of Energy review required before public releaseName/Org: Curtis Gonzales, BWXT-Pantex Date: 4/15/03

Guidance (if applicable): Pantex Plant OUO Topical Guide

Document transmitted herewith contains Secret/Restricted Data

Document must be portion marked if document

transmitted is NSI

Page 58: I-1 The Department of Energy’s Official Use Only

I-58

How is an E-mail containing How is an E-mail containing OUO Marked? OUO Marked?

First line of message• Insert “OUO” before text

If attachment to message is OUO• Message must so indicate• Attachment must be marked

correctly

Page 59: I-1 The Department of Energy’s Official Use Only

I-59

Are there Marking Exceptions? Are there Marking Exceptions?

Do not need to be reviewed and marked while in these files or when retrieved from these files if• they will be returned to the files and• they are not accessible by unauthorized personnel

If document is not to be returned to files, it must be reviewed for OUO and, if appropriate, marked

Restricted Access Files

Centralized records storage locations or systems where access is limited to only those specific individuals with a need to know the information in the records, such as central personnel files

Page 60: I-1 The Department of Energy’s Official Use Only

I-60

Are there Marking Exceptions? Are there Marking Exceptions?

No requirement to update markings to conform to the new manual

No requirement to review unless to be publicly released• OUO determination may be made by anyone in

organization that currently has cognizance over information in document

• must use current markings if contains OUO

Documents Containing OUO Generated Before DOE M 471.3-1

(4/9/03)

Page 61: I-1 The Department of Energy’s Official Use Only

I-61

Protecting OUOProtecting OUO

OUO

Page 62: I-1 The Department of Energy’s Official Use Only

I-62

Who May have Access to OUO?Who May have Access to OUO?

Anyone needing the information to perform his/her job or other DOE-authorized activity

• No security clearance required

• Not limited to DOE employees

• No requirement for US citizenship

Some OUO may have additional access restrictions (Export Controlled Information, Source Selection Information, etc.)

Determination made by person possessing document – not person wanting the document

Page 63: I-1 The Department of Energy’s Official Use Only

I-63

What are the Cyber Security What are the Cyber Security Requirements for OUO?Requirements for OUO?

Since the OUO Manual was published, the Office of the Chief Information Officer issued Technical and Management Requirements, Protection of Sensitive Unclassified Information, Including Personally Identifiable Information (TMR-22)

TMR-22 requires senior management to develop Program Cyber Security Plans (PCSP) which are consistent with TMR-22

The DOE HQ PSCP requires HQ to follow TMR-22

If not with DOE HQ, recommend following TMR-22 requirements until you receive clarification from local cyber security

Page 64: I-1 The Department of Energy’s Official Use Only

I-64

What are the Cyber Security What are the Cyber Security Requirements for OUO?Requirements for OUO?

TMR-22 (and DOE HQ) Requirements

• OUO must be encrypted during transmission (If person receiving OUO does not have Entrust, contact cyber security for approved alternate method of transmission)

• OUO on portable/mobile devices and removable media (e.g., CDROMS, thumb drives) must be encrypted

Page 65: I-1 The Department of Energy’s Official Use Only

I-65

How is OUO Transmitted by phone?How is OUO Transmitted by phone?

Transmitting over voice circuits

• Use encryption whenever possible

• If unavailable and other encrypted means not feasible alternative, regular voice circuits allowed

Page 66: I-1 The Department of Energy’s Official Use Only

I-66

How is OUO Transmitted?How is OUO Transmitted?

Transmitting by hand between facilities or within a facility

• May be hand-carried

• Must control access to document

Page 67: I-1 The Department of Energy’s Official Use Only

I-67

How is OUO Transmitted?How is OUO Transmitted?

Transmitting by mail – inside facility

• Place in sealed, opaque envelope or wrapping with recipient’s address, and

• “TO BE OPENED BY ADDRESSEE ONLY” on outside

TO BE OPENED BY ADDRESSEE ONLY

Page 68: I-1 The Department of Energy’s Official Use Only

I-68

How is OUO Transmitted?How is OUO Transmitted?

Transmitting by mail – outside facility

• Place in sealed, opaque envelope or wrapping with recipient’s address,

return address, and “TO BE OPENED BY ADDRESSEE ONLY” on outside (same requirements as inside facility, but must include return address)

• U.S. mail – First Class, Express, Certified, Registered

• Any commercial carrier

Page 69: I-1 The Department of Energy’s Official Use Only

I-69

How is OUO Protected?How is OUO Protected?

In Use

• Take reasonable precautions to prevent access by persons who don’t need the information to do their jobs

• For example, don’t read an OUO document in a public place (in the cafeteria, on public transportation)

OUO

Page 70: I-1 The Department of Energy’s Official Use Only

I-70

How is OUO Protected?How is OUO Protected?

Storing

• With internal building security during non-duty hours - Unlocked file cabinet, desk, briefcase, etc.

• No internal building security during non-duty hours - Locked room or locked file cabinet, desk, briefcase, etc.

Page 71: I-1 The Department of Energy’s Official Use Only

I-71

How is OUO Protected?How is OUO Protected?

Copying

• No permission from originator needed

• Make minimum number of copies

• Mark and protect copies

Page 72: I-1 The Department of Energy’s Official Use Only

I-72

How is OUO Protected?How is OUO Protected?

Destroying

• Strip-cut shredder with strips no more than ¼” wide

• Any other method approved by local security office

Page 73: I-1 The Department of Energy’s Official Use Only

I-73

Protection RequirementsProtection Requirements

Apply to

• DOE OUO documents

• Other-agency CUI documents

AND

Page 74: I-1 The Department of Energy’s Official Use Only

I-74

What are Inappropriate What are Inappropriate Uses of OUO?Uses of OUO?

OUO must not be used to

• Conceal violations of law, inefficiency, or administrative error

• Prevent embarrassment to an organization or agency

• Prevent or delay the release of information that does not meet the criteria to be designated as OUO

Page 75: I-1 The Department of Energy’s Official Use Only

I-75

Are There Penalties for Misuse of Are There Penalties for Misuse of OUO?OUO?

Imposed if person

• Intentionally releases OUO information from document marked “OUO”

• Intentionally or negligently releases an OUO document

• Intentionally does not mark a document known to contain OUO information

• Intentionally marks a document “OUO” known not to contain OUO information

Page 76: I-1 The Department of Energy’s Official Use Only

I-76

What Penalties are Possible?What Penalties are Possible?

Examples of penalties (DOE 3750.1)

• Verbal admonishment

• Written reprimand

• Suspension

• Termination

Supervisor

Page 77: I-1 The Department of Energy’s Official Use Only

I-77

DirectivesDirectives

OUO Directives Issued 4/9/03

DOE Order 471.3 Requirements and responsibilities

DOE Manual 471.3-1 Detailed instructions for implementing requirements

DOE Guide 471.3-1 Assists an employee in deciding whether information falls under one of the eight FOIA exemptions

Page 78: I-1 The Department of Energy’s Official Use Only

I-78

Questions or comments? Questions or comments? Call TPMC Security at ext . Call TPMC Security at ext .

34523452or e-mailor e-mail

[email protected]