unauthorized disclosure

UD is the communication or physical transfer of classified national security information (CNSI) or controlled unclassified information (CUI) to an unauthorized recipient.

Anyone who does not meet the criteria to access the information — either the access requirements for CNSI, or the required lawful, government purpose to access CUI.

Someone who has, or had been, granted eligibility for access to CNSI or eligibility to hold a sensitive position.

An individual outside of the organization who has gained unauthorized access to CNSI or CUI.

A signed Standard Form (SF) 312 Classified Information Non-Disclosure Agreement, eligibility at the appropriate level, and a confirmed need-to-know.

A lawful, government purpose. Authorized holders of CUI are responsible for determining who has a lawful, government purpose. Unlike classified information, an individual generally does not need to demonstrate a need-to-know unless required by a specific law, regulation, or government-wide policy.

Willful, negligent, and inadvertent.

When the person purposefully disregards DOD security or information safeguarding policies or requirements — for example, intentionally bypassing a known security control or intentionally disclosing classified information in the public domain.

When the person acted unreasonably, causing UD — for example, a careless act or reckless disregard for proper procedures, such as carelessly sharing classified information via an Unclassified network leading to spillage.

When the person did not know, and had no reasonable basis to know, that the security violation or unauthorized disclosure was occurring — for example, reasonably relying on security classification markings in an authorized source document that was later determined to be improperly marked.

The loss or degradation of resources or capabilities; it undermines DOD's mission and security, damages public trust, and compromises sources and methods.

Public domain, spillage, espionage, and improper safeguarding of information.

It occurs when CNSI or CUI is released either intentionally or inadvertently to the public — through podcasts, print or web-based articles, books, journals, speeches, television broadcasts, blog postings, social media posts, instant messages, VOIP social platforms such as Discord, Zoom, or Skype, and protected or encrypted messaging apps such as WhatsApp or Signal.

A data spill, or spillage, is a willful, negligent, or inadvertent disclosure of CNSI or CUI transferred onto an information system not accredited at the appropriate security level to store, process, or transmit the information.

When classified data is introduced onto an Unclassified information system, an information system with a lower level of classification, or a system not accredited to process data of that restrictive category.

Espionage involves activities designed to obtain, deliver, communicate, or transmit CNSI or CUI intended to aid a foreign power.

It occurs when inappropriate measures, behaviors, or controls are used to protect CNSI or CUI.

Public domain.

Espionage.

Improper safeguarding.

UD involving Foreign Government Information (FGI) or NATO information requires further reporting; UD involving criminal activity requires coordination with the Deputy Chief Information Officer (DCIO) during the investigation; and UD involving special information such as SCI, Special Access Program (SAP) information, and Critical Program Information (CPI) has additional reporting requirements.

No — this is a misconception. Information that has been disclosed in the public domain remains protected and must not be freely read, discussed, or shared.

No — this is a misconception. There is no "journalist privilege" protection for disclosing CNSI or CUI.

No — this is a misconception. They must undergo the required security review first.

No — this is a misconception. The SF 312 NDA continues to apply after you leave the organization.

No — this is a misconception. Sharing nonpublic DOD Unclassified information on a "secure" messaging app is not authorized.

Provide the right information to the right people while still protecting national security assets from unauthorized disclosure, by following the required procedures.

A violation of any law, rule, or regulation; gross mismanagement; a gross waste of funds; abuse of authority; or a substantial danger to public health and safety.

Unauthorized disclosure. Posting protected national security information in the public domain is unauthorized disclosure, not whistleblowing.

It broadened the scope and strengthened the rights and protections of federal employees who blow the whistle on violations involving fraud, waste, and abuse. When reporting violations involving classified programs or information, employees must still follow established guidance for protecting classified information.

PPD 19 (protects employees in the intelligence community or with access to classified information); Title 5 U.S.C. Section 2302, "Prohibited Personnel Practices"; Title 10 U.S.C. Section 1034, "Military Whistleblower Protection Statute"; and Title 10 U.S.C. Section 2890, covering tenants of privatized military housing units.

Yes. Even disclosing nonpublic DOD Unclassified information and CUI can cause damage, and nonpublic Unclassified information and CUI can be aggregated to reveal classified information, damaging national security.

E.O. 13526, Classified National Security Information, and E.O. 13556, Controlled Unclassified Information.

32 CFR Part 117 (NISPOM), 32 CFR Part 2002 (Controlled Unclassified Information), 32 CFR Parts 2001 and 2003 (Classified National Security Information), and 32 CFR Part 2004 (National Industrial Security Program).

DODM 5200.01 — Volume 1: Overview, Classification, and Declassification; Volume 2: Marking of Information; Volume 3: Protection of Classified Information.

ICD 701, Unauthorized Disclosure of Classified National Security Information.

No — he must also have a need-to-know to access classified information. Eligibility at the appropriate level and a signed SF 312 alone are not sufficient.

Use an SF 703 cover sheet. It is required to protect printed copies of Top Secret information with an SF 703 cover sheet.

Send it on a properly accredited system via secure, properly marked email, after ensuring the recipient has access to a system accredited at the Secret level.

Place it in a GSA-approved container or vault when not in use.

Ensuring all proper markings were present on the document — a TOP SECRET marking in the header alerts the holder to the presence of CNSI.

Derivative classification — incorporating, paraphrasing, restating, or generating in a new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information.

Yes — this is considered a lawful, government purpose, which is the standard for access to CUI.

No. FOUO is a legacy marking. The document should be assessed against the DOD CUI Registry to see whether it meets the criteria for a CUI category and then marked appropriately.

To ensure compliance with established national and DOD policies, and to ensure there is no information that may lead to unauthorized disclosure of classified information or compromise national or operational security.

PAO reviews ensure information that could discredit the military or federal government is avoided, that political views are not portrayed, and that offensive or controversial views are not portrayed.

No — delete it. Posting information related to the DOD that has not been cleared for public release on social media is prohibited, including specific information about a DOD installation where you are working.

No — delete it. Posting details about an upcoming deployment on social media is prohibited in accordance with DODI 5400.17.

Yes. While it is a best practice to wait until after a vacation to share details about it, it is safe to post about it after you return.

Report it to your Security Manager. Do not make any statement or comment that confirms or denies the accuracy of the information; follow your Component guidance.

Safeguard it in the appropriate manner and report it to your Security Manager or Facility Security Officer (FSO).

Safeguard, Report, Inquire, Investigate, Evaluate, Elevate, Correct, and Sanction.

The first two — Safeguard and Report. They are the responsibility of anyone who believes they have witnessed, discovered, or have knowledge of an unauthorized disclosure.

Report it to your Security Manager or Facility Security Officer (FSO) immediately after safeguarding. The FSO or Security Manager will report it to authorities at the next level.

The results of the inquiry and, if necessary, the investigation are evaluated to determine whether the incident is a security infraction or a security violation, and to evaluate the severity of the UD where loss or compromise has occurred.

When an inquiry does not yield answers to all of the questions required.

The Original Classification Authority (OCA), so a damage assessment can be initiated. For spillage you would also notify the Information System Security Manager (ISSM), and in some situations results may need to be elevated to the UD Program Management Office (PMO) and the appropriate Military Department Counterintelligence Organizations (MDCOs).

Corrective actions are implemented that focus on preventing future incidents and eliminating any conditions that might have contributed to the event. The cognizant DOD Component determines and implements the appropriate corrective actions based on the extent or severity of the incident.

Administrative sanctions outlined in DODM 5200.01, Volume 1 include a warning, a reprimand, and suspension without pay.

Criminal sanctions must be undertaken when applicable, in accordance with the Uniform Code of Military Justice or sections 801 to 940 of Title 10, U.S.C.

Report it to the Original Classification Authority (OCA) to conduct a damage assessment. This may vary depending on whether you are an FSO or a DOD Security Manager, and UD of certain types of classified information requires unique handling or additional reporting per DODM 5200.01 Volume 3, enclosure 6.

Personally identifiable information (PII), which is a type of CUI, has additional requirements.