DOE G 471.3-1, Guide to Identifying Official Use Only Information

DISTRIBUTION: INITIATED BY: All Departmental Elements Security Policy Staff, Office of Security NOT MEASUREMENT SENSITIVE DOE G 471.3-1 4-9-03 GUIDE TO IDENTIFYING OFFICIAL USE ONLY INFORMATION [This Guide describes suggested nonmandatory approaches for meeting requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with the parent Policy, Order, Notice, or Manual.] U.S. Department of Energy Washington, D.C. 20585 DOE G 471.3-1 i (and ii) 4-9-03 CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii I. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1. Official Use Only Information and the Freedom of Information Act. . . . . . . . . . . . . . . 1 2. Official Use Only Information and Freedom of Information Act Exemptions. . . . . . . . 1 II. FREEDOM OF INFORMATION ACT EXEMPTIONS 2 THROUGH 9 . . . . . . . . . . . . . . . . 3 1. Exemption 2: Circumvention of Statute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Exemption 3: Statutory Exemption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Exemption 4: Commercial/Proprietary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4. Exemption 5: Privileged Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 5. Exemption 6: Personal Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 6. Exemption 7: Law Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 7. Exemption 8: Financial Institutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8. Exemption 9: Wells . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 DOE G 471.3-1 iii (and iv) 4-9-03 FOREWORD This Department of Energy (DOE) Guide is approved by the DOE Office of Security. It is intended and available for use by all DOE elements, including the National Nuclear Security Administration. Suggestions for improving this Guide are welcome and should be addressed to Information Classification and Control Policy at 301-903-5454. DOE Guides, which are part of the DOE Directives System, provide supplemental information for fulfilling requirements contained in rules, regulatory standards, and DOE directives. Guides also are used to identify Government and non-Government standards and methods DOE finds acceptable for implementing the Department’s requirements. Guides do not establish or invoke new requirements nor are they substitutes for requirements. Guides do not replace technical standards, which are used to describe established practices and procedures for implementing requirements. NOTE: This Guide is NOT a classification and control guide that specifies what information is classified, Unclassified Controlled Nuclear Information (UCNI), or Official Use Only. The instructions in such classification and control guides are mandatory. DOE G 471.3-1 1 4-9-03 I. INTRODUCTION This Guide supplements information contained in Department of Energy (DOE) O 471.3, Identifying and Protecting Official Use Only Information, dated 4-9-03, and DOE M 471.3-1, Manual for Identifying and Protecting Official Use Only Information, dated 4-9-03.

1. Official Use Only Information and the Freedom of Information Act. “The Freedom of Information Act generally provides that any person has a right, enforceable in court, to obtain access to federal agency records, except to the extent that such records (or portions of them) are protected from disclosure by one of nine exemptions . . . .” This is the opening statement in the May 2000 edition of the Freedom of Information Act Guide, published by the Department of Justice (http://www.usdoj.gov/oip/foi-act.htm). Although the Freedom of Information Act (FOIA) has been in existence since 1966, few people realize that any system developed to control the dissemination of Government information must be consistent with the nine FOIA exemptions. These nine exemptions protect all sensitive Government information, classified and unclassified, from public release. Certain kinds of information within DOE that are exempt from public release under FOIA are identified and protected under their own formal information control systems. Classified information and Unclassified Controlled Nuclear Information (UCNI) fall into this category. [Classified information is covered under one of two FOIA exemptions: exemption 1 for National Security Information and exemption 3 for Restricted Data and Formerly Restricted Data. UCNI is covered under exemption 3.] DOE also has certain unclassified information that should be protected because of sensitive governmental, commercial, or private interests. Such information is known as Official Use Only (OUO) information. 2. Official Use Only Information and Freedom of Information Act Exemptions. To be eligible to be identified as OUO, unclassified information must— a. have the potential to damage governmental, commercial, or private interests if disseminated to persons who do not need the information to perform their jobs or other DOE-authorized activities. b. fall under at least one of eight FOIA exemptions (exemptions 2 through 9; information falling under exemption 1 can never be OUO because it covers information classified by Executive order) and Guidance issued under paragraphs 5a(3), 5a(4) or 5b(2) of DOE O 471.3 identifies certain information as OUO; however, in the absence of such guidance, an employee evaluates 2 DOE G 471.3-1 4-9-03 whether information in a document meets these criteria. If it does, the employee determines that the document contains OUO information. Therefore, it is important for each employee to understand each of these FOIA exemptions. This Guide provides the FOIA statutory language, a brief description and explanation of each exemption, and some examples of types of information considered to fall under each exemption. (Exemption 1 applies only to information that is formally classified by an Executive order. Because such information can never be OUO, this Guide does not address exemption 1.) NOTE: Information in this Guide is provided only to help someone determine whether unclassified information in a document may fall under one of the eight FOIA exemptions (thereby meeting the criteria described in paragraph 2a above). If a document marked as containing OUO information is requested under FOIA, it is not automatically exempt from release. A formal review under 10 CFR Part 1004 must be conducted, and a denying official must determine whether some or all of the document is exempt from public release. DOE G 471.3-1 3 4-9-03 II. FREEDOM OF INFORMATION ACT EXEMPTIONS 2 THROUGH 9

1. Exemption 2: Circumvention of Statute. a. Statutory Text. Exemption 2 concerns information “related solely to the internal personnel rules and practices of an agency.” b. Discussion. Exemption 2 encompasses two distinct categories of information: (1) internal matters of a relatively trivial nature (known as “low 2”) and (2) more substantial internal matters the disclosure of which would risk circumvention of a legal requirement (known as “high 2”). Generally, low 2 information is not sensitive and does not warrant OUO protection. High 2 information is usually considered to be sensitive and may warrant OUO protection. A document containing such information must meet a two-part test: (1) it must be predominantly internal and (2) disclosure of the information could benefit someone who is attempting to violate a law or Agency regulation and avoid detection. To be considered “predominantly internal,” the document must not regulate activities among members of the public or set standards to be followed by Agency personnel to take action against a member of the public. c. Examples. (1) General guidelines for conducting investigations. (2) Vulnerability assessments. (3) Inspection and appraisal procedures. (4) Examination materials used to evaluate personnel for promotion, transfer, or demotion. (5) Unclassified (and uncontrolled) portions of information classification and control guidance. 4 DOE G 471.3-1 4-9-03 (6) Agency computer access codes. 2. Exemption 3: Statutory Exemption. a. Statutory Text. Exemption 3 concerns information “specifically exempted from disclosure by statute . . . , provided that such statute (A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.” b. Discussion. Exemption 3 covers information that is explicitly prohibited from disclosure by a statute passed by Congress. Within DOE, the Atomic Energy Act, which is the basis for the formal control of Restricted Data, Formerly Restricted Data, and UCNI, is an exemption 3 statute, but these types of information are already subject to formal control systems and, therefore, are not also designated as OUO. However, there are other statutes that meet the requirements of this exemption for which there are no formal control systems in place. Information generated under those statutes may be OUO. Basing an OUO determination on an exemption 3 statute is very complex and requires interpretations of statutory language and case law to ensure that the statute qualifies as an exemption 3 statute and that the document falls within the statute’s scope. Therefore, use of exemption 3 should be limited to those cases where appropriate statute-specific guidance is available (e.g., from your local general counsel). c. Examples. (1) 15 U.S.C. 3710a(c)(7)(B)—Federal Technology Transfer Act. This statute requires a Federal Agency to protect any commercial and confidential information that results from a Cooperative Research and Development Agreement with a non-Federal party for a period of 5 years after its development. This exemption 3 statute essentially extends the exemption 4 concept of commercial and proprietary information to Government information. (See paragraph 3 for a discussion of exemption 4.)

(2) Export Controlled Information (ECI). In general, ECI is not FOIA-exempt, but under certain conditions it may be. For example, if someone living in another country requests a document under the FOIA, a document containing ECI cannot be sent to him or her because that is “exporting” the information, which is prohibited by export control laws and exempt from disclosure under paragraph (b)(3) of the FOIA. Therefore, since ECI is FOIA-exempt under certain conditions, a document containing ECI can be marked as OUO. DOE G 471.3-1 5 4-9-03 (3) Other Statutes. Many other statutes also explicitly prohibit disclosure of information; therefore, it is impossible to provide a definitive list. The following list of statute provisions and sections governing the protection/ disclosure/confidentiality of information is provided to show the broad range of information that may be exempt under statute and, therefore, may be identified as OUO. (NOTE: Most of these statutes do not directly apply to DOE, but may apply if work is being performed for another Agency.) • 7 U.S.C. 12, Commodity Exchange Act • 8 U.S.C. 1202(f), Immigration and Nationality Act • 10 U.S.C. 130, Technical Data Statute (Department of Defense) • 13 U.S.C. 8(b) and 9(a), Census Act • 15 U.S.C. 2055(a)(2), Consumer Product Safety Act • 18 U.S.C. 2510-20, Omnibus Crime Control and Safety Check Act • 22 U.S.C. 3104(c), International Investment Survey Act of 1976 • 26 U.S.C. 6103, Internal Revenue Code • 35 U.S.C. 122, Patent Act • 41 U.S.C. 423, Procurement Integrity Act • 45 U.S.C. 362(d), Railroad Unemployment Insurance Act 3. Exemption 4. Commercial/Proprietary. a. Statutory Text. Exemption 4 concerns “trade secrets and commercial or financial information obtained from a person and [that is] privileged or confidential.” b. Discussion. Exemption 4 protects the interests of both the Government and persons submitting information to the Government. This exemption encourages commercial entities to voluntarily submit useful commercial or financial information to the Government and provides the Government with some assurance that the submitted information is reliable. In some cases, it appears that some overlap exists between exemption 4 and exemption 5 (see paragraph 4 for a discussion of exemption 5). Briefly, the distinction is that exemption 4 applies to information generated by a company and provided to the Government, while exemption 5 applies to Government- generated information. 6 DOE G 471.3-1 4-9-03 Two broad categories of information covered by this exemption are (1) trade secrets and (2) commercial or financial information. (1) Trade Secrets. The courts define trade secret as “a secret, commercially valuable plan, formula, process, or device that is used for the making, preparing, compounding, or processing of trade commodities and that can be said to be the end product of either innovation or substantial effort.” Thus, a direct relationship between the trade secret and the production process must exist. General information about a product’s physical appearance or performance characteristics is not covered by this exemption unless such information would actually reveal a formula or process. (2) Commercial or Financial Information. The second category of information is related to trade secrets but concerns information that is (a) commercial or financial, (b) obtained from a person, and (c) is privileged or confidential. A general description of each of these items is as follows.

(a) Commercial or Financial. Information is considered commercial if the person submitting it has a commercial interest in it. Information submitted by a nonprofit entity may also be considered commercial information. Financial information includes economic data generated solely by a corporation or other business entity, but it may also apply to personal financial information. (b) Obtained from a Person. The term “person” refers to a wide range of entities that includes one individual, a corporation, a State government, a foreign government, or a Native American tribe or nation. However, it does not include the Federal Government; therefore, information generated by the Federal Government is not considered to be obtained from a person unless the document is merely a summary or reformulation of information supplied by entities from outside the Government. (c) Privileged or Confidential. The term “privileged” extends the privileges covered under exemption 5 for Government information to private sector information. To be considered confidential, the information must meet one of the following tests.: 1 If submission of the information is required by the Government, the information may be protected if disclosure would— DOE G 471.3-1 7 4-9-03 a impair the Government’s ability to obtain the information in the future or b cause substantial harm to the competitive position of the person submitting the information. 2 If submission of the information is voluntary on the part of the submitter, the information may be protected if the submitter would not customarily release such information to the public. c. Examples. (1) Commercial or financial information in connection with bids, contracts, or proposals and other related information received in confidence. Included are trade secrets; inventions; discoveries; foreign ownership, control, or influence information; or other proprietary data. (2) Statistical data and commercial or financial information concerning contract performance, income, profits, losses, and expenditures, if offered and received in confidence from a contractor or potential contractor. This includes business sales statistics, research data, technical designs, customer and supplier lists, overhead and operating costs, and information on financial conditions. (3) Sensitive information included in personal statements given in the course of inspections, investigations, or audits when such statements are received in confidence from the individual and retained in confidence because they reveal trade secrets or commercial or financial information normally considered confidential or privileged. (4) Information dealing with scientific and manufacturing processes or developments concerning technical or scientific data or other information submitted with a contract proposal or as part of a report while the contract is in progress. 4. Exemption 5: Privileged Information. a. Statutory Text. Exemption 5 concerns “inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency.” 8 DOE G 471.3-1 4-9-03 b. Discussion. Exemption 5 encompasses both statutory privileges and those commonly recognized by case law. The three primary privileges are deliberative process privilege, attorney work-product privilege, and attorney-client privilege, but the first issue to be addressed is whether the document can be considered an inter-agency or “intra- agency” communication.

At first glance, it would appear that only correspondence within an executive branch Agency or between executive branch agencies would qualify. However, that is not the case. Correspondence from outside consultants also may meet the test as long as the outside consultant is not seeking a Government benefit at the expense of other outside parties. If the document meets the “inter-agency” or “intra-agency” test, then the next decision is whether one of the following privileges applies. (1) Deliberative Process Privilege. This privilege is the most frequently used privilege under exemption 5, and its purpose is to prevent injury to the quality of Agency decisions. The bases for this privilege are to encourage open, frank discussions on matters of policy between subordinates and superiors; to protect against premature disclosure of proposed policies before they are finally adopted; and to protect against public confusion that might result from disclosing reasons and rationales that were not ultimately the grounds for an Agency’s action. To apply the deliberative process privilege, the following fundamental requirements must be met. (a) The communication must be predecisional (i.e., it must occur before a final decision is made). To qualify for the deliberative process privilege, an Agency is not required to identify a specific decision for which a communication is prepared. NOTE: A document containing recommendations or suggestions that were not implemented or adopted may still be OUO under exemption 5 after a final decision is made. (b) The communication must be deliberative (i.e., make recommendations or express opinions on legal or policy matters). (2) Attorney Work-Product Privilege. This privilege protects documents and other memorandums prepared by an attorney in contemplation of litigation. (3) Attorney-Client Privilege. This privilege protects confidential communications between an attorney and his or her client concerning a legal matter for which the client has sought professional advice. DOE G 471.3-1 9 4-9-03 c. Examples. (1) Letters, memorandums, issue papers, reports, and other documents that contain advice, opinions, or recommendations on new or revised Government decisions and policies. (2) Advice, suggestions, evaluations, or recommendations prepared on behalf of DOE by individual consultants, boards, committees, councils, groups, panels, conferences, commissions, task forces, or other similar groups. (3) Drafts of correspondence, issue papers, reports, etc. (4) Evaluations of contractors and their products and services by DOE personnel. (5) Information of a speculative, tentative, or evaluative nature concerning proposed plans to procure, lease, or otherwise acquire and dispose of materials, real estate, facilities, or functions when such information would provide undue or unfair competitive advantage to private personal interests or would impede legitimate Government functions. (6) Trade secret or other confidential research, development, or commercial information owned by the Government where premature release is likely to affect the Government’s negotiating position or other commercial interests. (NOTE: Exemption 5 applies here because the information is owned by the Government, not a private company.) (7) Information that is exchanged among DOE personnel and within and among Agencies in preparation of anticipated administrative proceedings by an Agency or litigation before any Federal or state court and information that qualifies for attorney-client privilege.

5. Exemption 6: Personal Privacy. a. Statutory Text. Exemption 6 concerns “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” b. Discussion. Exemption 6 protects personal information related to a specific individual that, if disclosed, might cause personal distress or embarrassment. 10 DOE G 471.3-1 4-9-03 c. Examples. (1) Personal details about a Federal employee (e.g., social security number, citizenship data, date of birth). (2) Intimate details of an individual’s life (e.g., marital status, religious affiliation, legitimacy of children, sexual inclinations or associations, medical conditions, criminal history, financial data). (3) Personnel matters in which administrative action, including disciplinary action, may be taken. (4) Evaluation of candidates for employment or security clearances. (5) Performance evaluation reports. 6. Exemption 7: Law Enforcement. a. Statutory Text. Exemption 7 concerns “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information (A) could reasonably be expected to interfere with enforcement proceedings, (B) would deprive a person of a right to a fair trial or an impartial adjudication, (C) could reasonably be expected to constitute an unwarranted invasion of personal privacy, (D) could reasonably be expected to disclose the identity of a confidential source, including a State, local, or foreign agency or authority or any private institution which furnished information on a confidential basis, and in the case of a record or information compiled by a criminal law enforcement authority in the course of a criminal investigation, or by an Agency conducting a lawful national security intelligence investigation, information furnished by a confidential source, (E) would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law, or (F) could reasonably be expected to endanger the life or physical safety of any individual.” b. Discussion. Exemption 7 protects information compiled by an Agency with the authority to enforce civil statutes, criminal statutes, and statutes authorizing administrative proceedings. It covers information compiled for law enforcement purposes regardless of the format of the document or how and where the document may be filed. DOE G 471.3-1 11 4-9-03 Exemption 7 protection also is extended to manuals that contain sensitive information about law enforcement procedures followed by an Agency charged with law enforcement responsibilities. The examples in the paragraphs below identify easily understood types of information that may be considered as OUO. However, because this exemption has so many qualifiers, it is suggested that caution be used when basing an OUO determination on this exemption. c. Examples. (1) Statements of witnesses and other material developed during the course of an investigation and all materials prepared in connection with related Government litigation or adjudicative proceedings. (2) The identity of firms or individuals being investigated for alleged irregularities involving contracting with DOE when no indictment has been obtained or no civil action has been filed against them by the United States.

(3) Information obtained in confidence, expressed or implied, in the course of a criminal investigation by a criminal law enforcement Agency or a lawful national security intelligence investigation conducted by an authorized Agency or an office within DOE. National security intelligence investigations include background security investigations and those investigations conducted for the purpose of obtaining affirmative or counterintelligence information. (4) Information from which a confidential source may be identified regardless of whether the source is an individual or an institution. (5) Law enforcement manuals and guidelines describing specific procedures followed by an Agency charged with law enforcement responsibilities. (6) Information concerning homemade weapons that could assist a criminal element and might result in harm to individuals or property. 7. Exemption 8: Financial Institutions. a. Statutory Text. Exemption 8 concerns information “contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions.” b. Discussion. Exemption 8 protects frank evaluations of a financial institution’s stability that might undermine the public’s confidence in the institution or the relationship between financial institutions and supervisory agencies. 12 DOE G 471.3-1 4-9-03 c. Examples. (1) Bank examination reports. (2) Documents related to bank examination reports (e.g., discussions of findings, follow-up actions). 8. Exemption 9: Wells. a. Statutory Text. Exemption 9 concerns “geological and geophysical information and data, including maps, concerning wells.” b. Discussion. Exemption 9 is rarely used but protects well information of a technical or scientific nature. c. Example. Number, location, and depth of proposed uranium exploration drill holes.