DOE O 5635.4 Chg 1, Protection of Unclassified Controlled Nuclear Information

U.S. Department of Energy ORDER Washington, D.C. DOE 5635.4 2-3-88 SUBJECT: PROTECTION OF UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION 1. PURPOSE. To establish Department of Energy (DOE) policy and procedures for the protection of Unclassified Controlled Nuclear Information (UCNI). 2. SCOPE. The provisions of this Order apply to all Departmental Elements contractors performing work for the Department as provided by law and/or contract and as implemented by the appropriate contracting officer. 3. REFERENCES. a. The Atomic Energy Act of 1954, as amended, (42 U.S.C. 2011 et seq.,) which is the statutory basis for this Order. b. Title 10 CFR 725, "Permits for Access to Restricted Data," which establishes procedures and standards for the issuance of access permits to persons who require access to Restricted Data that is classified under the Atomic Energy Act of 1044, as amended, and is applicable to the civil uses of atomic energy. c. Title 10 CFR 1017, "Identification and Protection of Unclassified Controlled Nuclear Information," which establishes overall policies and procedures for the identification and protection of UNCI. d. DOE 1324.2, RECORDS DISPOSITION, of 5-28-80, which assigns responsibilities and authorities and prescribes policies, procedures, standards, and guidelines for the orderly disposition of records of the DOE and its operating and onsite service contractors. e. DOE 1360.2A, COMPUTER SECURITY PROGRAM FOR UNCLASSIFIED COMPUTER SYSTEMS AND SENSITIVE UNCLASSIFIED INFORMATION, of 3-9-79, which establishes Department wide policies and procedures for developing, implementing, and administering a program for safeguarding DOE computer systems and, in particular, DOE sensitive unclassified information in such systems. 4. POLICY. Government information shall be made publicly available to the fullest extent possible. This Order shall be interpreted and implemented so as to apply the minimum restrictions needed to protect the health and safety of the public and the common defense and security of the Nation, consistent with the requirements in 42 U.S.C. 2168 and 10 CFR 1017, to prohibit the unauthorized dissemination of UCNI. 5. DEFINITIONS. a. Authorized Individual is a person who has been granted routine access to specific UCNI under the provisions of paragraph 7a. b. Denying Official is an individual who denies any request made under statute or Executive order for all or any portion of a document or material containing UCNI. c. Document or Material indicates the physical medium on, or in, which information is recorded, or a product or substance which contains or reveals information, regardless of its physical form or characteristics. d. Reviewing Official is an individual who may make a determination that a document or material contains, does not contain, or no longer contains UCNI. e. Unclassified Controlled Nuclear Information is certain unclassified government information prohibited from unauthorized dissemination under section 148 of the Atomic Energy Act-As Amended.

(1) Which concerns atomic energy defense programs; (2) Which pertains to-- (a) The design of production facilities or utilization facilities; (b) Security measures (including security plans, procedures, and equipment) for the physical protection of-- 1 Production or utilization facilities; 2 Nuclear material contained in such facilities; or 3 Nuclear material in transit; or (c) The design, manufacture, or utilization of any nuclear weapon or component if the design, manufacture, or utilization of such weapon or component was contained in any information declassified or removed from the Restricted Data category by the Assistant Secretary for Defense Programs (or the head of the predecessor agency of the Department of Energy) pursuant to section 142 of the Atomic Energy Act. (3) Whose unauthorized dissemination, as determined by a controlling official could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by significantly increasing the likelihood of-- (a) Illegal production of nuclear weapons; or (b) Theft, diversion, or sabotage of nuclear materials, equipment, or facilities. f. Violation means violations of section 148 of the Atomic Energy Act or any regulations or directive issued by, or by order of, the Secretary under that section. 6. RESPONSIBILITIES. a. Secretary (S-1). (1) Oversees the overall program to protect UCNI. (2) Determines whether or not a person has committed a violation. (3) Determines the amount of and imposes a civil penalty for each violation. (4) Requests that the Attorney General institute a civil action to collect any imposed civil penalty. (5) Requests that the Attorney General institute any criminal action under section 223 of the Atomic Energy Act against a person found to be in violation. b. Assistant Secretary for Defense Programs (DP-1). (1) Implements overall Departmental policy for the program to protect UCNI. (2) Recommends, with the concurrence of the General Counsel, to S-1 imposition of a civil penalty for violations. (3) Recommends, with the concurrence of the General Counsel, to S-1 that he or she request the Attorney General to institute a criminal action under section 223 of the Atomic Energy Act for a violation. c. Director of Safeguards and Security (DP-34). (1) Develops and interprets overall Departmental policy and procedures for, and administers the program to protect, UNCI. (2) Assures that education and appraisal programs are conducted to ensure implementation of, and adherence to, this Order. (3) Recommends to DP-1 imposition of any civil penalty for a violation. (4) Recommends to DP-1 that S-1 request that the Attorney General institute any criminal action under section 223 of the Atomic

Energy Act for a violation. d. Heads of Departmental Elements. (1) Ensure compliance with overall Departmental policy and procedures for, and administers the program to protect, UCNI. (2) Establish educational and appraisal programs to ensure implementation and adherence to this order. (3) Recommend to DP-34 the imposition of any civil penalty for a violation. (4) Recommend to DP-34 that the Attorney General institute any criminal action under section 223 of the Atomic Energy Act for a violation. 7. ACCESS TO UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION. UCNI markings shall be applied to any unclassified document or material which contains UCNI regardless of any other distribution control markings (e.g., Official Use Only, company proprietary) that are on a document or material. Before a person with Routine Access or special access is given access to a UCNI document with other control markings, the requirements or special approvals required by the other markings must be met. a. Routine Access. (1) Authorized Individual. A Reviewing Official is an Authorized Individual for documents or materials that the Reviewing Official determines to contain UCNI. An Authorized Individual for UCNI, may determine that another person is an Authorized Individual who may be granted routine access to the UCNI, and who may further disseminate the UCNI under the procedures of paragraph 7a(2) below. This recipient of UCNI from an authorized individual is also an authorized individual for the specific UCNI to which routine access has been granted. An authorized individual designates another person to be an authorized individual by the act of giving that person a document or material that contains UCNI. No explicit designation or security clearance is required. This second authorized individual may further disseminate the UCNI under the procedures in the following paragraph. Only those persons identified below may have access to UCNI. (2) Eligibility for Routine Access. A person to be granted routine access to UCNI must have a need to know the specific UCNI in the performance of official duties or of DOE-authorized activities. The recipient of the document or material shall he notified of the physical protection and access requirements contained in this Order. (Refer to paragraph 7c for a full description of notification responsibilities.) In addition to the need-to-know requirement, the person must meet at least one of the following requirements: (a) The person is a U.S. citizen who is one of the following: 1 A Federal Government employee or member of the U.S. Armed Forces; 2 An employee of a Federal Government contractor, subcontractor, or of a prospective Federal Government contractor or subcontractor who will use the UCNI for the purpose of bidding on a Federal Government contract or subcontract;

3 A Federal Government consultant or DOE advisory committee member; 4 A member of Congress; 5 A staff member of a congressional committee or of an individual Member of Congress; 6 The Governor of a State, his or her designated representative, or a State government official; 7 A local government official or an Indian tribal government official; 8 A member of a State, local or Indian tribal law enforcement or emergency response organization; or 9 A DOE access permittee authorized under 10 CFR Part 725 to have access to Restricted Data that is classified under the Atomic Energy Act of 1954, as amended, and is applicable to civil uses of atomic energy. (b) The person is other than a U.S. citizen, and is one of the following (also following paragraph 7a(2)(c)): 1 A Federal Government employee or a member of the U.S. Armed Forces; 2 An employee of a Federal Government contractor or subcontractor; or 3 A Federal Government consultant or DOE advisory committee member. (c) The person may be other than a U.S. citizen who is not otherwise eligible for routine access to UCNI under the above paragraph, but who requires routine access to specific UCNI in conjunction with one of the following: 1 An International nuclear cooperative activity approved by the Government; 2 U.S. diplomatic dealings with foreign government officials; 3 An agreement for cooperation under section 123 of the Atomic Energy Act; or 4 Provisions of treaties, mutual defense acts, or Government contracts or subcontracts. (3) Additional Controls. The Secretary may impose additional administrative controls concerning the granting of routine access to UCNI by an Authorized Individual to a person who is not a U.S. citizen. (4) Dissemination Limitations. An authorized individual may disseminate UCNI only to another authorized individual, or to a person granted special access to that UCNI information (see paragraph 7b). UCNI shall only be disseminated to other than U.S. citizens described in paragraph 7a(2)(c) after coordination with the HQ element with topical cognizance over the information. The HQ element will coordinate any release with the appropriate Program Secretarial Officer(s). (5) Waiver of Requirement. SA-10 may waive any of the requirements for determination of routine access to specific UCNI. However, SA-10 shall obtain the concurrence of any organization having cognizance over the UCNI to which access is being requested prior to granting such a waiver for routine access to specific UCNI. (6) Special Handling Notices. A reviewing official may impose

additional controls concerning the granting of routine access to UCNI in newly generated documents or material. Such controls shall be indicated by means of an approved special handling notice on the front of the document or material in question. Documents marked as "May Contain UCNI" should be handled as containing UCNI. b. Special Access. (1) Submission of a Request. A person not authorized routine access to UCNI under the above paragraph may submit a request for special access to UCNI to SA-10 or Heads of Field Elements, as appropriate. Such a request must include the following: (a) The name, current residence or business address, birthplace, birthdate, and country of citizenship of the person submitting the request; (b) A description of the UCNI for which special access is being requested; (c) A description of the purpose for which the UCNI is needed; and (d) Certification by the requester of his or her understanding of, and willingness to abide by, the requirements in 10 CFR Part 1017. (2) Basis of Granting A Request. Director, SA-10, shall base his or her decision to grant special access to UCNI on an evaluation of the following criteria: (a) The sensitivity of the UCNI for which special access is being requested (i.e., the worst-case, adverse effect on the health and safety of the public or the common defense and security which would result from unauthorized use of the UCNI); (b) The purpose for which the UCNI is needed (e.g., will the UCNI be used for commercial or other private purposes or used for public benefit to fulfill statutory or regulatory responsibilities); (c) The likelihood of unauthorized dissemination by the requester of the UCNI; and (d) The likelihood of the requester using the UCNI for illegal purposes. (3) Notification of the Requester. SA-10 shall attempt to notify a person who requests special access to UCNI within 30 days of receipt of the request as to whether or not special access to the requested UCNI is granted. If a final determination on the request cannot be made within 30 days of receipt of the request, SA-10 shall notify the requester, within 30 days of the request, as to when the final determination on the request may be made. (4) Special Access Limitations. A person granted special access to specific UCNI is not an authorized individual and shall not further disseminate the UCNI to which special access has been granted. c. Notification of Responsibilities. (1) Routine Access. An authorized individual granting routine access to specific UCNI to another person shall notify each person granted such access (other than when the person being granted such access is a Government employee, a member of the

U.S. Armed Forces, or an employee of a Government contractor or subcontractor) of applicable regulations and Orders concerning UCNI and of any special redistribution limitations that the authorized individual determines to apply for the specific UCNI to which routine access is being granted. (2) Special Access. DP-34 shall notify each person granted special access to UCNI of applicable regulations concerning UCNI prior to dissemination of the UCNI to the person. (3) Notification Cover Sheet. The requirement to notify persons granted routine access or special access to specific UCNI may be met by attachment of a cover sheet to the front of each document or material containing UNCI prior to its transmittal to the person granted access to the specific UCNI in question. 8. PHYSICAL PROTECTION REQUIREMENTS. UCNI requires protection from unauthorized dissemination. UCNI must be protected and controlled in a manner consistent with that customarily accorded other types of unclassified controlled information. The following physical protection requirements are minimum standards. A reviewing official may require more stringent physical protection requirements for a newly generated document or material determined by the reviewing official to contain UCNI than are required in this Order. Any such special handling requirements shall be indicated on the front of the document or material by means of a Notice. a. Protection in Use or Storage. An authorized individual shall maintain physical control over any document or material in use marked as containing UCNI so as to prevent unauthorized access to the document or material. When any document or material marked as containing UCNI is not in use, it shall be stored in a manner affording reasonable and adequate protection against unauthorized access. Unlocked files, desks, or similar containers are adequate in a controlled or guarded area. In an area which is neither a controlled nor a guarded area, documents containing UCNI shall be stored in the locked drawer or desk, in a locked repository, or in a locked room. b. Reproduction. A document or material marked as containing UCNI may be reproduced without permission of the originator only to the minimum extent necessary consistent with the need to carry out official duties, provided the reproduced document or materials is marked and protected in the same manner as the original document. c. Destruction. Any document or material marked as containing UCNI shall be disposed of by any method approved for destruction of classified matter, or any other method which assures sufficiently complete destruction to prevent its retrieval. Note that the decision to dispose of any DOE document or material whether or not it contains UCNI, must be consistent with the policies and procedures in DOE 1324.2. d. Transmission. (1) A document or material marked as containing UCNI shall be packaged to prevent disclosure of the presence of UCNI when transmitted by a means which could allow access to the document

or material by a person who is not an authorized individual. (2) A document or material marked as containing UCNI shall be transmitted by: (a) Any appropriate class of U.S. mail (U.S. First Class, Express, Certified or Registered Mail); (b) Any means approved for the transmission of classified documents or material or unclassified sensitive documents or material (e.g., circuits protected with National Security Agency-certified data encryption devices); (c) An authorized individual when he or she can control access to the document or material being transmitted; or (d) Any other means approved by DP-34 as being sufficiently secure. (3) UCNI may be discussed or transmitted over an unprotected telephone or telecommunications circuit when required by operational considerations. More secure means of communication should be utilized whenever possible. e. Automated Data Processing. UCNI may be processed or produced on any computer system which: (1) Is accredited to process classified information; (2) Provides adequate protection measures for such use; or (3) Has been approved for such use by DP-34. 9. VIOLATIONS. a. Administrative Penalty. Any DOE employee who violates this Order is subject to imposition of an administrative penalty by his or her supervisor. This penalty may range from counseling by the person's supervisor to termination of employment. The specific administrative penalty appropriate for violations of this Order shall be proportionate to the number and severity of the person's violations. b. Civil Penalty. Any person who violates this Order is subject to a civil penalty under section 148 of the Atomic Energy Act. DP-1 may recommend to the Secretary imposition of this civil penalty, which shall not exceed $100,000 for each violation. (1) Written Notification. (a) Whenever DP-1 believes that a person is subject to imposition of a civil penalty under the provisions of section 148 b(1) of the Atomic Energy Act, DP-1 shall notify the person in writing by certified mail, return receipt requested, of: 1 The date, facts, and nature of each act or omission with which the person is charged; 2 The particular provision(s) of the Act that has/have been violated; 3 Each penalty which DP-1 proposes to recommend S-1 impose and its amount; 4 The right of the person to submit to DP-1 the person's written reply to each of the allegations in the notification letter. The person shall mail or deliver any reply letter within 20 days of receipt of the notification letter from DP-1. 5 The right of the person to submit to DP-1 a written request for a hearing under the provisions of paragraph 9b(2); 6 The fact that, upon failure of the person to pay any

civil penalty imposed by S-1, the penalty may be collected by civil action under the provision of paragraph 9b(5); and 7 Copies of 10 CFR Part 1017 and this Order. (b) DP-1 shall respond in writing within 10 days of the receipt of a reply or a hearing request letter. (c) DP-1, at the request of the person accused of a violation, may extend for a reasonable period the time limit for submitting a reply or a hearing request letter. (2) Hearing. Any person who receives a notification letter, as described above, may request a hearing to answer under oath or affirmation the allegations contained in the notification letter. The person shall mail or deliver any hearing request letter to DP-1 within 20 days of receipt of the notification letter. Upon receipt from the person of a written request for a hearing, DP-1 shall request that S-1 appoint a hearing officer and, if necessary, a hearing counsel. (a) The Hearing Counsel, if appointed, shall: 1 Represent the Department; 2 Consult with the person or the person's counsel prior to the hearing; and 3 Examine and cross-examine witnesses during the hearing. (b) The Hearing Officer shall: 1 Be responsible for the administrative preparations for the hearing; 2 Convene the hearing as soon as is reasonable; 3 Conduct the hearing in a manner which is fair and impartial; 4 Arrange for the presence of witnesses and physical evidence at the hearing; 5 Make a recommendation that a violation of section 148 of the Atomic Energy Act or any regulation or order of the Secretary issued under section 148 of the Atomic Energy Act has occurred only if the DOE proves by the preponderance of the evidence that such a violation has occurred; and 6 Submit his or her recommendation, accompanied by a statement of the findings and reasons supporting them, to the Secretary for final determination on the imposition of a civil penalty. (c) Rights of the Person. The person may: 1 Present evidence in his or her own behalf, through witnesses, or by documents; 2 Cross-examine witnesses and rebut records or other physical evidence (except as provided in paragraph 9b(2)(d)4); 3 Be present during the entire hearing (except as provided in paragraph 9b(2)(d)4); 4 Be accompanied, represented, and advised by counsel of his or her own choosing; and 5 Testify in his or her own behalf. (d) Conduct of the Hearing. 1 A summarized record of the hearing shall be made. 2 All relevant and material evidence is admissible

(except as provided in paragraph 9b(2)(d)4); however, formal rules of evidence are not applicable. 3 Witnesses shall testify under oath and are subject to cross-examination (except as provided in paragraph 9b(2)(d)4). 4 If the hearing officer determines that the testimony of a witness or any documentary or physical evidence contains classified information or UCNI, such testimony or evidence will not be considered unless it is material. If it is material, a nonsensitive summary of the testimony or records or description of the physical evidence shall be made available to the person to the maximum extent possible, consistent with the requirements of national security or the public and health and safety. In all such cases, the hearing officer, in considering such testimony or evidence, shall take into account that the person did not have an opportunity to cross-examine the witness or review the actual document or evidence. 5 The DOE bears the burden of proving that a violation of section 148 of the Atomic Energy Act or any regulation or Order of the Secretary issued under section 148 of the Atomic Energy Act, has occurred. (e) Failure to Request a Hearing. If the person fails to file a supporting material, to S-1 for final determination on the imposition of the civil penalty. (3) Final Determination. S-1 makes the final determination on the disposition of a violation and may uphold, compromise or mitigate, or remit any penalty recommended by DP-1. (4) Appeal. A person who violates this Order, as determined by S-1, may appeal the determination to an appropriate United States District Court. (5) Collection of Penalty. S-1 requests the Attorney General to institute a civil action to collect a penalty imposed under this Order. c. Criminal Penalty. Any person who violates this Order may be subject to a criminal penalty under section 223 of the Atomic Energy Act. In such case, S-1 refers the matter to the Attorney General for investigation and possible prosecution. BY ORDER OF THE SECRETARY OF ENERGY: LAWRENCE F. DAVENPORT Assistant Secretary Management and Administration <<EOD>>