Part 2 of National Security Classification Markings: indictment edition

Screenshot of the indictment of former President Donald Trump showing part of the list of classified documents he is charged with willfully retaining.

---

In Part 1 we started to look at the classification markings and descriptions listed in the indictment of former President Trump to more fully understand the national defense information he is charged with willfully retaining.

In this, I am happy to serve as your guide to national security classification markings. For more on my background you can check out Part 1 and my bio. Short version is:

• I previously served as the top official in the U.S. government with day-to-day responsibility for the National Security Classification Markings Handbook, which is the government-wide guidance on classification markings.

• I also was one of the advisors the Information Security Oversight Office (ISOO) sent to the Classification Management Implementation Working Group (CMIWG), which coordinates changes to the other main markings guidance, which is the Register and Manual maintained by the Office of the Director of National Intelligence (ODNI).

In Part 1 we looked at documents one through seven listed in the indictment and looked at:

• The overall structure of national security classification markings

• The insights we can gain about these documents from the markings

• What the terms SCI, SAP, FGI mean

• The Atomic Energy Act creating a separate classification system for nuclear information with markings in a specific location in the markings formula

• Markings such as:

  • NOFORN

  • LIMDIS

  • EXDIS

  • NODIS

  • SBU

  • LES

  • SI (Special Intelligence)

  • FISA

  • ORCON

Similar to Part 1, we will use the most recent publicly available version of the Register and Manual (dated 2016) for reference in this article. It was released with some redactions as a result of a Freedom of Information Act (FOIA) request in 2021. Government personnel reading this should go through official channels to get the current version to mark documents. This released version, however, is sufficient to provide better public context to the markings on the documents former President Trump is indicted for willfully retaining.

The graphic we used in Part 1, from the Register and Manual (page 17) showing the overall format of banner markings, will appear between documents 12 and 13 (below) for reference.

Document-by-document analysis:

Note: In the below list, the marking and document description are quoted from the indictment. The analysis is mine and is separated into markings analysis and context analysis.

Document 8:

Marking:

• SECRET//REL TO USA, FVEY

Document Description:

• Document dated October 4, 2019, concerning military capabilities of a foreign country

Analysis:

• Markings Analysis:

  • REL TO is a dissemination control that serves as “an explicit foreign release marking used to indicate the information has been predetermined by the originator to be releasable or has been released to the foreign country(ies)/international organization(s) indicated, through established foreign disclosure procedures and channels, and implementation guidance in this document. It is NOFORN to all other foreign country(ies)/international organization(s) not indicated in the REL TO marking.”

    • The countries and international organizations the information is releasable to are listed using three or four letter abbreviations after the “REL TO” marking in a list separated by commas.

    • The three and four letter abbreviations are called trigraphs or tetragraphs, respectively.

      • A released list of trigraphs is available on this Department of Defense (DoD) website.

      • Many tetragraphs are classified, but the Register and Manual (page 115) lists what three of them are, including FVEY.

    • In this case the REL TO list is: USA, FVEY

      • USA is the United States.

        • From the outside it might seem like all classified information by essence is REL TO USA. It is stated this way because “USA is required to be listed first when the REL TO string is invoked for automated decision making in systems that rely on the first code to represent the originating country.” Or put another way “the computer required it.” Modern computer systems allow for access control settings that confirm a user has the required authorization to access before displaying information. To ease the back end process all REL TO markings in a U.S. originated document lists USA first.

      • FVEY is the abbreviation for “Five Eyes.” Five Eyes “is an intelligence alliance composed of Australia, Canada, New Zealand, the United Kingdom and the United States. These partner countries share a broad range of intelligence with one another in one of the world's most unified multilateral arrangements.”

        • Given the extensive nature of the Five Eyes partnership, FVEY is one of the more common tetragraphs to appear on documents.

    • For more about the REL TO marking see pages 114-117 of the Register and Manual.

  • The short version is: this is a Secret document that can be released to authorized officials from the United States, the United Kingdom, Canada, Australia, and New Zealand, but may not be released to other non-US citizens, governments, or organizations without getting approval first.

• Context Analysis:

  • Based on the description of the document and the markings this is likely either an intelligence report or a military/DoD analytic product. In either case, the markings would indicate that it has been written in a way to protect intelligence sources, so that a reader should not be able to determine and endanger the sources.

  • Just because this document was written in a way to protect intelligence sources, doesn’t mean that damage wouldn’t result from it getting shared with unauthorized foreign countries.

    • Countries can adjust their military capabilities to defend against vulnerabilities we have spotted and that adjustment can cost the lives of U.S. service members and members of our allies’ militaries.

    • Also, though there is a lot of media speculation that the foreign country mentioned in the description is an adversary of the U.S., such as Iran, it is also possible that it is a country friendly with the U.S., such as Ukraine. The release of such a document might hurt U.S. interests by aiding an adversary in attacking a friendly country. Despite the risks of such a document getting in the wrong hands, the U.S. needs to produce analysis of potential threats to friendly countries to help the U.S. be prepared for any attack a friendly country might face.

Document 9:

Marking:

• TOP SECRET//[redacted]/[redacted]//ORCON/NOFORN/FISA

Document Description:

• Undated document concerning military attacks by a foreign country

Analysis:

• Markings Analysis: