The Security Policy Forum (Forum) was convened at 1010 hours on 21 March 1997, by Mr. Richard Wilhelm, Executive Director for Intelligence Community Affairs, and Mr. Douglas Perritt, Principal Director InformationWarfare, Security and Counterintelligence, OSD/C3I. Mr.Wilhelm introduced and welcomed Mr. Eric Biel of the Secrecy Commission Staff. It was also noted that the next scheduled meeting will be Mr. Peter Saderholm's last meeting prior to his retirement.
All Forum member agencies and departments were represented except Transportation, USCG, OMB, NASA, and GSA. Observers included Defense Investigative Service, NACIC, Industry, and the Secrecy Commission.
Mr. Saderholm observed that there were two minor changes to the 21 February minutes and requested that without objection they stand approved. There were no objections noted.
Mr. Saderholm started the meeting by asking the National Security Council (NSC) representative to comment on the Investigative Standards and Adjudicative Guidelines. Mr. Appel, NSC, announced that the standards and guidelines had been approved by the President. He did not believe there were any major changes since the last time the guidelines were reviewed. More information regarding how the guidelines and standards may be promulgated will be forthcoming.
Mr. Saderholm advised the Forum attendees that their packet contained an update on the status of responses to the Joint Security Commission recommendations. Of the 114 recommendations, 52 were completed. Of the 52 completed, 26 responses were accepted, 22 have been modified, and 4 rejected. There are currently 44 of the 114 recommendations being worked on and 18 have not beenstarted.
Mr. Saderholm indicated that the Security Policy Board (SPB) Staff was in receipt of late arriving issue papers related to Section IX - "Loss, Possible Compromise or Unauthorized Disclosure" of the Safeguard Directive. As a result, option papers (2, 3, and 4), related to Issue Paper 2 were forwarded to the Forum members reflecting revised language. Mr. Saderholm stated that after consultation with the Cochairs, the decision was made to take all late arriving options off the table for discussion. The only option under consideration was Option 1, which reflected the language adopted by the 28 February working group chaired by Mr Perritt.
Ms. Hines led the discussion regarding the remaining issues involving the Safeguarding Directive. She indicated that as a result of the last Forum meeting (21February) a working group, as noted above, met to address Issue Paper 1, Annex B - "Third-country Transfer". Ms. Hines noted that the working group meeting was well attended and that the language adopted by the group removed the requirement for written consent from the originating foreign country. Consent can be provided verbally which is in line with the executive Order. In addition, the group added the term bilateral exchange which met the flexibility needs of the Intelligence Community. It was also noted that the British have accepted this language. The floor was opened for questions or concerns. None being noted, the following language was submitted for a vote:
A vote on the above language reflected unanimous consent by the Forum members.
After the vote, one Forum member expressed his appreciation for Mr. Perritt's leadership in chairing a very productive working group meeting.
In reference to Issue Paper 2, regarding Section IX of the Safeguard Directive, Ms. Hines indicated that the working group also addressed this issue. The group concurred with DOE's recommendation to expand this section and focused on the need to include language that addressed law enforcement and administrative issues. In addition, the group modified the language addressing damage assessments in order to provide more flexibility regarding the extent to which an assessment must be conducted.
The floor was opened for discussion. Justice indicated that they had alternative language to present in response to the proposal they received which referenced "derivative classification" (Option 4). Justice was reminded that due to the lateness of Options 2-4, these options were no longer under consideration and that only Option 1 was under discussion. Due to the continued confusion, Mr. Perritt requested clarification regarding what submissions Justice had made and when theywere received? Ms Hines indicated that Option 1 was drafted by the working group during the 28 February meeting. The working group language was submitted to all Forum members for comment after the meeting. Justice did not submit their comments (Option 3) until Wednesday afternoon (19 March). The SPB Staff noted the Justice language was narrow in scope. As a result the Staff drafted Option 4, which made reference to "derivative classification", as an alternative. Ms. Hines noted the Cochairs decided on Thursday afternoon to remove all late submissions from the table.
One of the Cochairs indicated that the issue of late submissions was addressed during the last meeting. It was requested, at that time, that material submitted for consideration by the Forum, be provided to the SPB Staff at least two weeks in advance. The Cochair indicated that it was not fair to the Forum members to receive last minute submissions which they have not been able to study.
Justice indicated that they were in the process of drafting NSDD-84 and that the language in the Safeguard Directive should be commensurate. The NSC representative indicated that the revised language in NSDD-84 was designed to address "Leaks."
One of the Forum members indicated that they believed that Option 1, which states "Agency heads shall establish appropriate procedures to conduct an inquiry/investigation of a loss, possible compromise, or unauthorized disclosure," was broad enough to incorporate Justice's concern. There was general agreement to this comment.
Mr. Saderholm indicated that the Safeguard Directive should not be held up because of NSDD-84. He stated that if the language needed to be reconciled, it could be accomplished at the Board level or with the NSC.
Justice indicated that if the Forum members were in general agreement with Option 1, then they would go back and consult with their lawyers.
A vote was called to approve Option 1 which reflects the following language:
(a) General. Any person who has knowledge that classified information has been or may have been lost, possibly compromised or disclosed to an unauthorized person(s) shall immediately report circumstances to an official designated for this purpose.
(b) Cases Involving Information Originated by a Foreign Government or Another U.S. GovernmentAgency. Whenever a loss or possible unauthorized disclosure involves the classified information or interests of a foreign government agency, or another government agency, the department or agency in which the compromise occurred shall advise the other government agency or foreign government of the circumstances and findings that affect their information or interests. However, foreign governments normally will not be advised of any security system vulnerabilities that contributed to the compromise.
(c) Inquiry/Investigation and Corrective Actions. Agency heads shall establish appropriate procedures to conduct an inquiry/investigation of a loss, possible compromise or unauthorized disclosure of classified information, in order to implement appropriate corrective actions, which may include disciplinary sanctions, and to ascertain the degree of damage to national security.
(d) Department of Justice and Legal Counsel Coordination. Agency heads shall establish procedures to ensure coordination with legal counsel whenever a formal action, beyond a reprimand, is contemplated against any person believed responsible for the unauthorized disclosure of classified information. Whenever a criminal violation appears to have occurred and a criminal prosecution is contemplated, agency heads shall use established procedures to ensure coordination with (i) the Department of Justice, and (ii) the legal counsel of the agency where the individual(s) responsible is assigned or employed.
All Forum members were in favor of Option 1 except Justice. Justice opposed Option 1 pending consultation with its Legal Department.
Ms. Hines noted that during the last Forum meeting, the members agreed to accept the current draft language for Section 5 - Storage, provided the term Security-in-depth was clarified. The membership tasked the PIC with providing the clarification. Ms. Hines advised that a working group has been established and that they would be meeting this afternoon. It was noted that the current Directive has a definition for "security-in-depth". As aresult, the objective of the PIC working group will not be to redefine security-in-depth. The group will develop a tool which will assist agencies in the decisionmaking process.
The OPM representative observed that the Safeguarding Directive addressed the protection of US and foreign government classified information held in the US, however, it did not address the protection of US classified information in the possession of foreign governments. A general discussion ensued regarding this issue. It was noted by the Cochairs that this issue will be taken under advisement. It was believed that there are other agreements (e.g., Treaties, General Security Agreements, etc.) that addressed this issue. It would not be appropriate to incorporate the protection of US classified by foreign governments in the Safeguard Directive, since the Executive Order pertains to classified information held domestically. It may be possible to address the OPM representative's concerns ina cover letter to the Safeguarding Directive.
Mr. Saderholm announced to the members that all outstanding issues regarding the Safeguarding Directive had been addressed and that the revised language is reflected in the 28 February 1997 draft provided in their packets. The SPB Staff will move forward with presenting the Directive to the Board for final approval.
Mr. Saderholm indicated that a proposal had been received from NSA. He referenced that some think FORTEZZA cards may be the answer, however. this could be an expensive proposition. (Note: FORTEZZA cards was not one of the NSA recommendations). The proposal needs more study and it is hoped that a paper will be presented during the next meeting.
Mr. Biel indicated that he would make some general comments regarding the report and then open the floor for questions. It was noted that the Commission's staff would be disbanding as of 15 April 1997 and that future questions should be referred to Senator Moynihan's office. Mr. Biel thanked Mr. Gary Gower (SPB Staff) and DIS for their assistance in distributing copies of the report to government and industry.
The Forum members were advised that the report was a "unanimous report". The Commissioners tried to find consensus on all the issues in the report. It was noted that the report was written with two audiences in mind: the Senior Government Official/Executive and the Security Professional. The major focus of the report was classification and declassification.
Several questions were asked by the Forum members consisting of the following:
1. How the Commission was going to handle the implementation of the 16 responses since the staff will cease to exist?
2. Is there an expectation that the Executive Branch will propose legislation, if so, when will a draft be available?
3. Has the Executive Branch embraced this report?
4. The implementation of some of the recommendations will cost money, has there been any consideration to budgetary relief?
5. Why were the comments in the report made regarding SF-86 reciprocity when the Commission was aware that the SPB completed the Personnel Investigation Standards and the Draft AdjudicationGuidelines?
There is recognition by Congress that there is a need to address budgetary concerns and shifting resources.There is some discussion with appropriators as to whether classification/declassification should be a separate line item.
It is expected that the Executive Branch will endorse some recommendations and have questions regarding others. It is hoped that government agencies will submit their comments regarding the recommendations through the various committees, (i.e., Forum and ClassificationManagement Committee).
The Commission is interested in the community's thoughts on the overall thrust of the report. Do they agree with a need for a new way of thinking; for example, recommendation regarding neighborhood interviews. The report does not call for the elimination of neighborhood checks, but questions whether they are needed all the time. The report tries to take into account limited resources.
In regard to reciprocity, it was noted by the Commission that Personnel Investigation Standards and Adjudicative Guidelines represent the minimum standards agencies have to follow. Agencies can still add other requirements which stop short of true reciprocity.
The members were advised that the draft Action Plan is an assimilation of the recommendations made by the Commission and provides some thoughts on how the implementation of the recommendations should be addressed within and outside the SPB structure. The plan is not intended to be "directive" in nature, but to identify who or what agency/committee would be most appropriate to field the recommendations.
Mr. Appel indicated that the Secrecy CommissionReport has high level attention and that there will be some upper level movement regarding the recommendations. The President has welcomed the report, and current actions by the Forum may be impacted. However, the Forum was advised to move ahead with their plan and not wait for upper level direction.
Mr. Biel indicated that he was pleased at the seriousness in which the Forum was taking the recommendations and asked if he could show a copy of the plan to Senator Moynihan? Mr. William Davidson noted that some of the actions in the plan appeared defensive and they may not be reflective of all the Forum member views. The Cochairs indicated that there was no objection to giving Senator Moynihan a copy as long as it was presented as a draft. The plan is currently under review by the Forum members and will be subject to change.
Mr. Appel went on to say that we have to remember that the goal of the report was to determine what is wrong with the process, not focus on what is right. A major concern was to ensure that the report maintained its objectivity and integrity. He indicated that the NSC took its share of criticism from the report regarding its oversight role of classification and declassification. This criticism has to be taken seriously. He went on to reiterate the fact that the SPB should move ahead and not wait for legislation. The report should be seen as an opportunity for change and can be used as leverage to justify the need for change. It was noted that there will be some coordination with Mr. Sandy Berger and Mr.Podesta regarding the recommendations, however, the NSC will exert its jurisdiction over classification and declassification.
Mr. Appel indicated that taskings to be considered are as follows:
2. The Forum should establish a subgroup to develop standards for SAP's which will be incorporated into a White House Directive.
3. Mr. Bruce McConnell, OMB, has been tasked by the President to look at the legislation related to classification/declassification of information.
4. Need to look at how to resolve the conflict between establishing standards for unclassified sensitive information and classified. To date, the SPB has not been able to establish a process to address Information Security Standards.
The industry observer commented that until the advent of the Economic Espionage Act there was no tool/incentive for industry to take action regarding the loss of sensitive but unclassified information. It was also noted that the protection of sensitive but unclassified information will require the support of senior leadership.
Comments on the Action Plan should be submitted to the SPB Staff by next Thursday, 27 March 1997.
OPEN FORUM DISCUSSION
A question was asked as to how the Personnel Security Investigative Standards and the Adjudicative Guidelines will be promulgated? It was believed that the SPB will promulgate the guidelines and standards to the community.
ISOO indicated that the next National Industrial Security Program Policy Advisory Committee (NISPPAC) meeting will be held on 25 March 1997 at 1000 hours in room 105at the Archives building.
Friday, 25 April 1997, 1000-1130 hours