Ten years into that process, agencies have until Dec. 31 to submit a plan to NARA’s Information Security Oversight Office outlining how they will standardize the handling of CUI.
The governmentwide focus on CUI stems from the 9/11 Commission, which found agencies weren’t sharing information they had related to counterterrorism and homeland security, and that there were internal barriers to sharing this information.
The Office of the Director of National Intelligence, however, estimates it would cost the intelligence community more than $1 billion to meet the requirements of the CUI program.
Rather than overcome these “insurmountable hurdles” to comply with the CUI program, Director of National Intelligence John Ratcliffe has asked the White House to repeal the Obama-era executive order putting these requirements in place.
“Although its clear mandate was to simplify the unclassified markings system and sharing rules, the resulting CUI Program is exponentially more complex than the classification system” outlined in the executive order, Ratcliffe wrote in a Dec. 4 memo to National Security Adviser Robert O’Brien.
An ODNI spokeswoman declined to comment about the memo or specify whether the agency expected to meet the year-end deadline.
Steven Aftergood, the director of the FAS Project on Government Secrecy, told Federal News Network that the memo, sent a few weeks before the NARA deadline, was a “dramatic gesture,” but unlikely to have an effect.
The Defense Department, which includes several key members of the intelligence community, already issued guidance in March detailing how it would implement CUI policy throughout the agency.
“There’s just too much momentum behind CUI to somehow turn it off and go back in time,” Aftergood said. “It’s hard to see how anybody thought this was a serious move. It certainly is eye-catching, but it’s not how the government produces and implements national policy.”
Rather than request additional time to comply with the CUI program or an exemption, Ratcliffe said the intelligence community would “fully support a long-overdue executive branch-wide E.O. or similar guidance mechanism that provides standardized rules” to protect unclassified information.
“He’s asking to change the entire governmentwide policy, which is not his concern,” Aftergood said. “He doesn’t have any say in what the Department of Commerce of the Department of Agriculture are going to do.”
There is, however, room for criticism with the CUI program. Aftergood said there are more than 100 categories of CUI with rules detailed and complicated requirements, which requires agencies to dedicate a significant amount of time to training personnel.
“If the DNI had written a memo that said, ‘Look, this marking system has gotten too complicated, and it’s too difficult and expensive to train people to follow it. We need a simpler marking system,” I think that’s a decent criticism that deserves a serious response,” Aftergood said.
Mark Bradley, director of the NARA Information Security Oversight Office, told Federal News Network that because of the COVID-19 pandemic, his office has granted reporting extensions to agencies that have requested them.