Part 1 of National Security Classification Markings: indictment edition
Let’s look at the classification markings and descriptions listed in the indictment of former President Trump to more fully understand the national defense information he is charged with willfully retaining.
To best understand the format of classification markings the two most useful tools are the:
National Security Classification Markings Handbook, which the Information Security Oversight Office (ISOO) publishes.
ISOO is the part of the National Archives and Records Administration (National Archives) that oversees the national security classification and declassification system for the entire executive branch.
While on the ISOO staff I served as the senior staffer with day-to-day responsibility for the National Security Classification Markings Handbook, including providing guidance to agencies on markings.
Register and Manual, which the Office of the Director of National Intelligence (ODNI) maintains.
ODNI coordinates all changes to the Register and Manual through the interagency Classification Management Implementation Working Group (CMIWG).
One or two ISOO staff attend CMIWG meetings as advisors and I was one of the advisors representing ISOO at these meetings.
The version of the Register and Manual linked to in this article is the most recent publicly available version (dated 2016). It was released with some redactions as a result of a Freedom of Information Act (FOIA) request in 2021. Government personnel reading this should go through official channels to get the current version to mark documents. This released version, however, is sufficient to provide better public context to the markings on the documents Trump is indicted for willfully retaining.
Overview of markings’ format:
All markings are tools to communicate to recipients of information that 1) the information they are receiving needs to be protected on authorized national security grounds and 2) how to handle that information. Background on this can be found here:
The markings listed in the indictment are the banner markings listing the overall classification of each document.
The Register and Manual (page 17) provides the format for classification markings as:
Screenshot of graphic from the Register and Manual.
A slightly easier way to think of it is:
There are different types of markings (the Register and Manual calls the different types of markings “categories”).
These types of markings have an established order that they are listed in.
Creating or reading a banner marking is done by following a formula.
Types of markings are separated by “//”.
Some types of markings have multiple items that can be included at the same time and these are separated from each other by “/”.
Key to terms:
SCI is Sensitive Compartmentalized Information. There are multiple compartments and sub-compartments of SCI, each used to limit access so only a set group of people. SCI is “classified national intelligence information concerning or derived from intelligence sources, methods or analytic processes.” These tend to indicate the type of collection used to obtain the information in the document, so it is common in declassification to redact these markings to protect the intelligence source if the substantive content of the document can be declassified without revealing the source.
SAP is a Special Access Program. SAPs are a more restrictive limitation on access. There are multiple different SAPs, each with their own codeword that indicates the information is protected by a particular SAP. This is what is often thought of as “codeword” information and it is often the most sensitive and protected information the government has. Many codewords are themselves classified.
Atomic Energy Act creates a separate classification system for nuclear information. The Atomic Energy Act markings most frequently used are “Restricted Data” or “RD” and “Formerly Restricted Data” or “FRD.” Restricted Data is information on: “1) design, manufacture, or utilization of atomic weapons; 2) production of special nuclear material; or 3) use of special nuclear material in the production of energy.” Formerly Restricted Data is information that “relates primarily to the military utilization of atomic weapons.”
Foreign Government Information (FGI) is information other countries share with the U.S. through official channels with the intent that the U.S. protect that information. This can be intelligence collected by a foreign intelligence service related to terrorist activity, a country or multiple countries of mutual concern, or international crime, money laundering, and/or drug trafficking. It could also be information about a foreign government’s own plans or goals regarding military operations, negotiations, or policy changes that have yet to be made public.
The overall format in layman’s terms is:
Classification level//SCI marking//SAP marking//Atomic Energy Act marking//Foreign Government Information marking//Intelligence Community dissemination control marking//other dissemination control marking
If one of these types of markings isn’t relevant to the document it is skipped.
An example of a marking with some marking types skipped is:
SECRET//SI/TK//NOFORN
Classification level//SCI marking/SCI marking//Intelligence Community dissemination control marking
Document-by-document analysis:
Note: In the below list, the marking and document description are quoted from the indictment. The analysis is mine and is separated into markings analysis and context analysis.
Document 1:
Marking:
TOP SECRET//NOFORN//SPECIAL HANDLING
Document Description:
Document dated May 3, 2018, concerning White House intelligence briefing related to various foreign countries
Analysis:
Markings Analysis:
NOFORN is a dissemination control “used to indicate the information may not be released in any form to foreign governments, foreign nationals, foreign organizations, or non-US citizens without permission of the originator and in accordance with provisions of DCID 6/7, NDP-1, and implementation guidance in [the Register and Manual.]”
The short version is: don’t release to non-US citizens, governments, or organizations without getting approval first.
From the outside it might seem like all classified information by essence is NOFORN, but the conduct of foreign policy, intelligence, and defense and economic coordination means that US government officials work with international partners. In doing so topics that are classified to protect the information from third-party countries or terrorists are discussed. To facilitate that communication, guidance is provided on which countries – if any – information can be shared with. This is conveyed to recipients with dissemination markings such as NOFORN or REL TO. The marking REL TO means the information is authorized for release to a listed set of countries or international organizations.
For more about the NOFORN marking see pages 110-111 of the Register and Manual.
SPECIAL HANDLING is a stand-in that appears in the indictment to convey to the reader that there are other dissemination controls. Given the placement in the order and the “//” separation it seems most likely this is a non-Intelligence Community (non-IC) dissemination control. Some examples of these are:
LIMDIS, which is a National Geospatial-Intelligence Agency (NGA) marking “used to identify unclassified geospatial products and data sets, which the Secretary of Defense may withhold from public release.”
EXDIS or NODIS, which are State Department markings indicating information is highly sensitive and distribution is limited. EXDIS is for “traffic between the White House, the Secretary, Deputy, or Under Secretaries of State and Chiefs of Missions” and NODIS is for messages “between the President, the Secretary of State, and Chief of Mission. No distribution is allowed other than the addressee without the approval of the [State Department] Executive Secretary.”
SBU, which is a State Department marking indicating information meets the requirements to be exempt from FOIA.
LES, which indicates Law Enforcement Sensitive information.
For more about the non-IC dissemination markings see pages 132-152 of the Register and Manual.
Context Analysis:
Based on the description of the document this is likely a President’s Daily Brief (PDB). PDBs are “a daily summary of high-level, all-source information and analysis on national security issues produced for the president and key cabinet members and advisers. The PDB is coordinated and delivered by the ODNI with contributions from the CIA as well as other IC elements and has been presented in some form to the president since 1946.”
We will have an upcoming article on President’s Daily Briefs, as a number of documents Trump is charged with willfully retaining appear to be PDBs.
Document 2:
Marking:
TOP SECRET//SI//NOFORN//SPECIAL HANDLING
Document Description:
Document dated May 9, 2018, concerning White House intelligence briefing related to various foreign countries
Analysis:
Markings Analysis:
Similar to Document 1, with the addition of SI.
SI is a Sensitive Compartmentalized Information marking. It is an abbreviation of Special Intelligence. Special Intelligence is “technical and intelligence information derived from the monitoring of foreign communications signals by other than the intended recipients. Under the purview of the Director of National Intelligence (DNI), the SI control system protects SI-derived information and information relating to SI activities, capabilities, techniques, process and procedures.”
The short version is: signals intelligence.
Substantial resources and effort are often needed to listen in on the communications of an intelligence target. Once communications are able to be intercepted and decrypted they can be a treasure trove in understanding a target’s plans, psychology, social networks, and more. If a target realizes their communications are compromised they stop communicating in the way that could be intercepted and decrypted. Once the target alters their communication the U.S. loses the ability to gain addition intelligence through that interception effort and more resources and effort needed to intercept and decrypt the new communications mechanism.
Some signals intelligence can also be from listening devices planted by human beings. If a target learns their conversations are being intercepted it can endanger the lives of the operatives that planted it and/or the lives of the operatives that go into harm’s way to plant the replacement devices.
For more about Special Intelligence see pages 58-61 of the Register and Manual.
Context Analysis:
Based on the description of the document this is likely a President’s Daily Brief (PDB).
Document 3:
Marking:
TOP SECRET//SI//NOFORN//FISA
Document Description:
Undated document concerning military capacities of a foreign country and the United States, with handwritten annotation in black marker
Analysis:
Markings Analysis:
Similar to Document 2, minus the SPECIAL HANDLING stand-in and with the addition of the FISA dissemination marking.
FISA indicates information collected under the Foreign Intelligence Surveillance Act (FISA). “The Foreign Intelligence Surveillance Act (FISA) of 1978 prescribes procedures for the physical and electronic surveillance and collection of ‘foreign intelligence information’ between or among ‘foreign powers’ on territory under United States control.”
For the collection of FISA information a court warrant needs to first be obtained from the Foreign Intelligence Surveillance Court. “The Court entertains applications made by the United States Government for approval of electronic surveillance, physical search, and certain other forms of investigative actions for foreign intelligence purposes.”
Intelligence collected under FISA are often some of the most important and sensitive intelligence the U.S. collects.
The FISA dissemination control alerts a reader to the presence of FISA material in the document. “The FISA statute provides that information collected pursuant to the statute ‘may not be disclosed for law enforcement purposes unless the disclosure is accompanied by a statement that such information, or any information derived there from, may be used in a criminal proceeding only with advance authorization of the Attorney General.’" This marking along with a separate required warning statement helps readers follow this requirement.
For more about FISA see pages 125-126 of the Register and Manual.
Context Analysis:
The undated nature of this document might indicate it was originally an attachment to another document. Most of the time information that goes to the President has a date on it or is attached to a transmittal memo that has a date.
The “handwritten annotation in black marker” in the description might indicate Trump’s writing on this document.
Document 4:
Marking:
TOP SECRET//SPECIAL HANDLING
Document Description:
Document dated May 6, 2019, concerning White House intelligence briefing related to foreign countries, including military activities and planning of foreign countries
Analysis:
Markings Analysis:
Similar to Documents 1 and 2.
Context Analysis:
Based on the description of the document this is likely a President’s Daily Brief (PDB).
Document 5:
Marking:
TOP SECRET//[redacted]/[redacted]//ORCON/NOFORN
Document Description:
Document dated June 2020 concerning nuclear capabilities of a foreign country
Analysis:
Markings Analysis:
The redactions might indicate SCI, SAP, Atomic Energy Act marking, or FGI, as any of those markings would fall into the marking formula at those points. If none of the “/” or “//” separators are redacted, which appears likely based on saying [redacted] twice and separating it with a “/”, then only one type of marking is redacted and it has two items listed within that marking type.
Given the above bullet and the document description the most likely option is for this document to contain two compartments of SCI. On page 4 of the Register and Manual there are redactions in the list of approved SCI compartments.
ORCON is a dissemination control directing that dissemination and extraction of information is controlled by the originator and a point of contact and their contact information must be included in the document. ORCON is “used on classified intelligence that clearly identifies or reasonably permits ready identification of intelligence sources or methods that are particularly susceptible to countermeasures that would nullify or measurably reduce their effectiveness.”
This marking is sometimes inappropriately and too broadly applied in a way that harms national security by preventing the internal-to-the-U.S. government information sharing necessary to, for example, catch terrorists or develop informed policy options. Past classification reform efforts have attempted to limit originator control.
For more about ORCON see pages 105-106 of the Register and Manual.
Context Analysis:
This document might or might not contain technical information on nuclear weapons. From the markings it is more likely it is an intelligence report written for a high-level non-technical audience. If the document was technical in nature it would likely contain Atomic Energy Act markings. Atomic Energy Act markings are unlikely to 1) need redaction or 2) contain two items listed within the marking type as indicated by “//[redacted]/[redacted]//”.
Document 6:
Marking:
TOP SECRET//SPECIAL HANDLING
Document Description:
Document dated June 4, 2020, concerning White House intelligence briefing related to various foreign countries
Analysis:
Markings Analysis:
Similar to Documents 1, 2, and 4.
Context Analysis:
Based on the description of the document this is likely a President’s Daily Brief (PDB).
Document 7:
Marking:
SECRET//NOFORN
Document Description:
Document dated October 21, 2018, concerning communications with a leader of a foreign country
Analysis:
Markings Analysis:
An example of how SECRET information can also be NOFORN.
Context Analysis:
Based on the markings and description of the document this could be either a Memorandum of Conversation (MemCon) or Memorandum of Telephone Conversation (TelCon). MemCons are memos created to provide a record of in-person meetings and TelCons are memos created to provide a record of telephone or video meetings. It is a long established practice of the White House and NSC to create these for every meeting and call the president has with a foreign leader. This allows a reference point to answer questions of what was discussed and/or agreed to.
The reason this is most likely a MemCon or TelCon and not an intercept of a foreign leader’s communications is that an intercept would likely have an SCI marking such as “SI”.
Upcoming articles will analyze the remaining documents.
For more coverage of national security classification and declassification, the Presidential Records Act, and former President Trump’s indictment check out these articles here on Snapshot:
Classification and Declassification in Context: Starting points
National Security Classification Markings: the thought behind it
Declassified Documents on Viktor Bout: Background on who the US had to exchange for Brittney Griner
National Security Classified Information discovered outside of government control
The continued discovery of national security classified information outside of government control
Balloons and other high flying objects’ historic use for intelligence and military purposes
Chinese spy balloon details could be declassified to advance US national security
Presidential Records Act: a primer for single-term presidents
Update:
Part 2 of National Security Classification Markings: indictment edition is available here.
Update 2:
Part 3 of National Security Classification Markings: indictment edition is available here.
Screenshot of graphic from the Register and Manual.