Part 3 of National Security Classification Markings: indictment edition

Screenshot of the indictment of former President Donald Trump showing part of the list of classified documents he is charged with willfully retaining

---

In Part 1 and Part 2 we started to look at the classification markings and descriptions listed in the indictment of former President Trump to more fully understand the national defense information he is charged with willfully retaining.

In this, I am happy to serve as your guide to national security classification markings. For more on my background you can check out Part 1 and my bio. Short version is:

• I previously served as the top official in the U.S. government with day-to-day responsibility for the National Security Classification Markings Handbook, which is the government-wide guidance on classification markings.

• I also was one of the advisors the Information Security Oversight Office (ISOO) sent to the Classification Management Implementation Working Group (CMIWG), which coordinates changes to the other main markings guidance, which is the Register and Manual maintained by the Office of the Director of National Intelligence (ODNI).

In Part 1 and Part 2 we looked at documents one through sixteen listed in the indictment and looked at:

• The overall structure of national security classification markings

• The insights we can gain about these documents from the markings

• What the terms SCI, SAP, FGI mean

• The Atomic Energy Act creating a separate classification system for nuclear information with markings in a specific location in the markings formula

• Markings such as:

  • NOFORN

  • REL TO

  • LIMDIS

  • EXDIS

  • NODIS

  • SBU

  • LES

  • SI (Special Intelligence)

  • FISA

  • ORCON

  • TK

• Trigraphs or tetragraphs such as:

  • USA

  • FVEY

Similar to Part 1 and Part 2, we will use the most recent publicly available version of the Register and Manual (dated 2016) for reference in this article. It was released with some redactions as a result of a Freedom of Information Act (FOIA) request in 2021. Government personnel reading this should go through official channels to get the current version to mark documents. This released version, however, is sufficient to provide better public context to the markings on the documents former President Trump is indicted for willfully retaining.

The graphic we used in Part 1 and Part 2, from the Register and Manual (page 17) showing the overall format of banner markings, will appear between documents 21 and 22 (below) for reference.

Document-by-document analysis:

Note: In the below list, the marking and document description are quoted from the indictment. The analysis is mine and is separated into markings analysis and context analysis.

Document 17:

Marking:

• TOP SECRET//[redacted]/TK//ORCON/IMCON/NOFORN

Document Description:

• Document dated January 2020 concerning military capabilities of a foreign country

Analysis:

• Markings Analysis:

  • In this document we know the redacted marking is an SCI compartment since it is separated by a single “/” from TK, which as we discussed in Part 2 is an abbreviation for the SCI compartment Talent Keyhole.

    • See Part 2 for background on Talent Keyhole.

  • As we noted in Part 1 there are several SCI compartments that are redacted in the 2021 FOIA publicly released version of the Register and Manual that we are working from. The redacted SCI compartment in this document’s banner marking is likely one of those.

  • ORCON and NOFORN were discussed in detail in Part 1 .

  • IMCON, according to the Department of Defense (DoD) Manual 5200.01 Volume 2, DoD Information Security Program: Marking of Information, “is used to protect sources and analytic methods associated with the geospatial intelligence discipline that are particularly vulnerable to countermeasures, and if disclosed or released could negate or measurably reduce the effectiveness of those methodologies.”

  • Based on the markings this document includes intelligence obtained from spy satellites. In the era of Google Maps and Google Earth this might not seem to some that sensitive, but in this case the intelligence community believes that release of the information in this document would reveal capabilities (for example: image resolution) and analytic methods beyond what is available to the public through Google Maps and Google Earth.

  • Given these markings there is a high likelihood that this document could include images taken by spy satellites.

  • For more about IMCON see pages 107-109 of the Register and Manual.

• Context Analysis:

  • This is likely a closely held intelligence product that includes images from spy satellites of a foreign government’s military maneuvers and/or installations.

    • The NOFORN indicates that this is information that was so closely held we would not normally share it with our closest allies.

  • As we discussed in Part 2 there seems to be a pattern where many of the documents former President Trump retained deal with the military capabilities of foreign countries. The prevalence of these documents among those listed in the indictment far exceeds these documents’ prevalence among the classified documents former President Trump would have had access to.

Document 18:

Marking:

• SECRET//NOFORN

Document Description:

• Document dated March 2020 concerning military operations against United States forces and others

Analysis:

• Markings Analysis:

  • Similar to Document 7.

• Context Analysis:

  • The description states this is “concerning military operations against United States forces and others.” Since this doesn’t say “military options” like the description of document 14, the use of “military operations” seems to indicate the document is about ongoing military operations that were targeting U.S. forces at the time this document was written. There were very few areas where someone was actively conducting military operations against the U.S. in March 2020. Thus the most likely situation is this document concerns either Taliban forces conducting military operations against the U.S. forces in Afghanistan or ISIS forces conducting operations against U.S forces in Syria.

  • This document with the combination of SECRET and NOFORN would have allowed wide sharing within the U.S. military for after action reports, situational awareness, and force protection of U.S. forces, while also requiring a separate review before it was shared with foreign partners.

Document 19:

Marking:

• SECRET//FORMERLY RESTRICTED DATA

Document Description:

• Undated document concerning nuclear weaponry of the United States

Analysis: