September 13, 2013

The US Classification System

(Updated: February 19, 2024)

Top level telecommunications often involve information that has to be kept secret. To ensure that, governments have systems to protect sensitive information by classifying it, which is best known from document markings like "Top Secret".

Here I'll explain the classification system of the United States, which is far more complex than most people think, also because it's one of the world's biggest secrecy systems. In 2012 almost 5 million(!) people in the US had a clearance for access to classified information,* a number that was brought back to 4,2 million by 2015.*

The deeper parts of this classification system are classified, but new details and codewords have been revealed in documents from the Snowden-leaks.



Classification markings

All documents that contain classified information, whether digital or hard copy, have to be marked with the appropriate markings. These are shown in the classification or banner line, which is shown at the top and bottom of every document and usually has three parts, separated by double slashes:


An example of such a classification line would be:

TOP SECRET//COMINT//NOFORN


Additionally, all sections of a document should have a portion marking, which is an abbreviation of the full classification line. Below, the abbreviations for these portion markings are shown in brackets.

When a document contains joint or Foreign Government Information (FGI), the necessary markings are shown in a separate part of the classification line. Finally declassification instructions can be added. These markings will not be discussed here.

The meaning of abbreviations and codewords can be found in the separate listing of Abbreviations and Acronyms and the listing of Nicknames and Codewords.



Overview of the categories and formatting for the US classification and control markings
From the Intelligence Community Classification Manual 6.0 from December 2013
(click to enlarge)



Classification levels

The United States government classifies information according to the degree which the unauthorized disclosure would damage national security. Like many other countries, the US has three classifications levels. From the highest to the lowest level these are:

- TOP SECRET (TS, color code: orange)
- SECRET (S, color code: red)
- CONFIDENTIAL (C, color code: blue)

Government documents which are not classified can be marked as:

- CONTROLLED UNCLASSIFIED INFORMATION (CUI, color code: purple)
- UNCLASSIFIED (U, color code: green)


With 1.3 million US citizens, including some 300,000 members of the Intelligence Community, having a Top Secret clearance in 2017,* it's obvious that additional measures are needed to protect the most sensitive information. Therefore, that information is put in separated compartments, only accessible for those people who have the 'need-to-know'.

This system is called Sensitive Compartmented Information (SCI) for intelligence information, while other highly secret and sensitive information is protected by a Special Access Program (SAP). Both sub-systems will be explained below.

The classification levels Confidential, Secret and Top Secret are sometimes called 'Collateral', denoting that no additional control systems or compartmentations, like SCI or SAP, apply.

The new Controlled Unclassified Information (CUI) marking was meant to simplify the handling of unclassified information that still requires some protection, but has meanwhile expanded into a system with over 100 categories.



Sensitive Compartmented Information (SCI)

Sensitive Compartmented Information (SCI) is a system to protect national intelligence information concerning sources and methods. SCI is divided into control systems and compartments, which are further divided in subcontrol systems and subcompartments.

These systems and compartments are usually identified by a classified codeword, some of which were leaked or have been declassified. In total, there may be between 100 and 300 SCI compartments and subcompartments, grouped into about two dozen control systems. The color code for SCI is yellow.


SCI control systems and their compartments are species of Controlled Access Programs (CAPs), which also include Non-SCI CAPs, like for example at the Secret level. SCI information has to be stored and handled in a Sensitive Compartmented Information Facility (SCIF).

Known and supposed SCI control systems from the past and present are:

- COMINT, replaced by Special Intelligence (SI)
- STELLARWIND (STLW, 2001-2009)
- UMBRA (TSU or TSC)
- ENDSEAL (EL, until 2016)
- TALENT KEYHOLE (TK)
- HUMINT Control System (HCS)
- KLONDIKE (KDK, 2011-2016)
- RESERVE (RSV, since 2005)
- BYEMAN (BYE or B, 1961-2005)
- KLAMATH (KLM)
- MARVEL (MVL)
- FOCAL POINT (FP)
- CREDIBLE WOLF (CW)
- AZURE BLUE (AB)
- Special Navy Control Program (SNCP)
- VERDANT (VER, defunct)
- PANGRAM (PM, defunct)
- MEDITATE (M, defunct)
- SPECTRE
- LOMA
- EARPOP
- ? (CRU)
- ? (BUR)
- ? (GG)

In a classification line this is shown like: TOP SECRET//SI

Multiple control systems are shown like: TOP SECRET//SI/TK


Top Secret/SCI coversheets as found by the FBI in Trump's office at Mar-a-Lago


COMINT / Special Intelligence (SI)
This control system is for communications intercepts or Signals Intelligence. Since 2005, COMINT information which is not marked NOFORN is automatically releasable to the Five Eyes-partners.* Initially, the abbreviation for COMINT was SI, by which it was replaced somewhere between 2008 and 2013.
SI contains various sub-control systems and compartments, which are identified by an abbreviation or a codeword. In a classification line they follow COMINT or SI, connected by a hyphen.

Known COMINT/SI sub-control systems are:
- Very Restricted Knowledge (VRK, 1974-2003)
- Exceptionally Controlled Information (ECI, since 1999)
- GAMMA (G)
- DELTA (D, defunct)
- [undisclosed]
- ECRU (EU, since 2016)
- NONBOOK (NK, since 2016)

In a classification line this is shown like: TOP SECRET//SI-G

Multiple COMINT/SI compartments shown like: TOP SECRET//SI-VRK-G


Very Restricted Knowledge (VRK)
This sub-control system was established in 1974 to limit access to uniquely sensitive COMINT activities and programs (no product or content). It contains compartments or categories which have an identifier of one to three alpha numeric characters.* The term VRK was declassified in 1998* while the compartment was succeeded by ECI in 2003.*

Example: TOP SECRET//SI-VRK 11A


Exceptionally Controlled Information (ECI)
This sub-control system protects highly sensitive information and sources and contains compartments, which are identified by a classified codeword. In the classification line there's a three-letter abbreviation of this codeword. ECI already existed in 1999* and succeeded VRK in 2003.*

Recently disclosed codewords for ECI compartments include:
- AMBULANT (AMB), APERIODIC, AUNTIE, ESCAPEE? (ESC), PAINTEDEAGLE, PAWLEYS, PENDLETON, PIEDMONT, PICARESQUE (PIQ), PITCHFORD, RAGTIME (RGT), REDHARVEST (RDV), WHIPGENIE (WPG).
Lists of ECI compartments from 2003 and 2013.

Example: TOP SECRET//SI-ECI PIQ

Multiple compartments: TOP SECRET//SI-ECI PIQ-ECI AMB

Since 2011, SCI type indicators used to group compartments, like ECI, may not be used anymore in classification lines and portion markings. For example, information formerly marked TS//SI-ECI ABC must now be marked TS//SI-ABC.


GAMMA (G)
This sub-control system of SI is for highly sensitive communication intercepts (product or content)* and therefore requires the ORCON dissemination marking. GAMMA may contain compartments, which are identified by a codeword or an identifier of four alphabetic characters. The term GAMMA was declassified in 1998.*

Some former GAMMA compartments were:
- GABE, GANT, GART, GILT, GOAT, GOUT, GROL, GUPY, GYRO

Example: TOP SECRET//SI-G GUPY

Multiple compartments: TOP SECRET//SI-G GUPY GYRO


DELTA (D)
This was a former SCI control system for intercepts from Soviet military operations.


[undisclosed]
According to classification manuals there are undisclosed SI compartments which have identifiers of three alphabetical characters. Some documents from such a compartment were declassified in early May 2014. It seems that this compartment is for protecting information related to metadata collection, but is different from STELLARWIND.* It probably contains sub-compartments which are identified by three numeric characters.*

For example: TOP SECRET//SI-XXX 888



ECRU (EU)
Formerly a compartment of the ENDSEAL control system, which was retired as of 2016. Now, ECRU is "an ECI used to protect technical data derived from exploitation of a high interest signal". The transition from ENDSEAL to SI was done by the Naval Intelligence Activity (NIA) in coordination with NSA.*


NONBOOK (NK)
Formerly a compartment of the ENDSEAL control system, which was retired as of 2016. Now, NONBOOK is "an SI compartment used for sensitive intelligence products intended for dissemination to IC consumers".*



STELLARWIND (STLW)
This is a "controlled access signals intelligence program", created under presidential authorization in response to the attacks of September 11, 2001. It includes information related to the Terrorist Surveillance Program (TSP) and to the bulk telephony and internet metadata collection by the NSA.* It seems that STLW started as a COMINT compartment* but later on became a hitherto unknown classification category at the same level as SCI and SAP.


Terrorist Surveillance Program (TSP)
The markings "TSP" and "Compartmented" were used instead of "STELLARWIND" in briefing materials and documents related to the STELLARWIND program intended for external audiences, such as Congress and the courts. The term "TSP" was initially used in relation to only that portion of the program that was publicly disclosed by president Bush in December 2005.*



UMBRA (TSC)
This codeword was used since 1968 as the last of a range of succeeding codewords to protect the most sensitive intercepts of Communication Intelligence (COMINT). The portion marking for UMBRA was TSU (Top Secret Umbra)* or TSC (Top Secret Codeword).*
The use of the UMBRA compartment was publicly terminated in 1999, but the Snowden-leaks revealed that NSA is still using it, probably as a registered but unpublished SCI control system for the content of communications collected under authority of EO 12333.



ENDSEAL (EL)
The existance of this control system was declassified in 2014, but the name was already mentioned in 2001. ENDSEAL was for finalized intelligence products, probably based upon information derived from US Navy SIGINT sensors. The raw data collected for ENDSEAL reports were likely handled under a different, still-classified coverterm.*
ENDSEAL contained compartments for intelligence products intended for dissemination to Intelligence Community consumers. These compartments were identified by a codeword and could be divided into sub-compartments. ENDSEAL was retired as of 2016 and its two compartments were moved to SI.*

Declassified names of ENDSEAL compartments are:
- ECRU (EU)
- NONBOOK (NK)

In a classification line this was shown like: TOP SECRET//EL-NK/SI



TALENT KEYHOLE (TK)
This control system is for products of overhead collection systems, such as satellites and reconnaissance aircraft, and contains compartments, which are identified by a classified codeword. The original TALENT compartment was created in the mid-1950s for the U-2. In 1960, it was broadened to cover all national aerial reconnaissance and the KEYHOLE compartment was created for satellite intelligence. The term TALENT KEYHOLE was declassified in 1998.*


Some former TK subcompartments were:
- CHESS, RUFF, DAFF and ZARF

Some current TK compartments are:
- BLUEFISH (BLFH)
- IDITAROD (IDIT)
- KANDIK (KAND)
- GEOCAP (G)

In a classification line this is shown like: TOP SECRET//TK-BLFH

BLUEFISH (BLFH)
This compartment contains sub-compartments which are identified by up to six alphanumeric characters. There are no actual examples.

Example: TOP SECRET//KDK-BLFH XXXXXX

IDITAROD (IDIT)
This compartment contains sub-compartments which are identified by up to six alphanumeric characters. There are no actual examples.

Example: TOP SECRET//KDK-IDIT XXXXXX

KANDIK (KAND)
This compartment contains sub-compartments which are identified by up to six alphanumeric characters. There are no actual examples.

Example: TOP SECRET//KDK-KAND XXXXXX

GEOCAP (G)
GEOCAP stands for Geospatial-Intelligence Controlled Access Program, which in classification markings is treated like a TK compartment. But other than that, little information is publicy available.*


BYEMAN (B)
The BYEMAN Control System (BCS) was established in 1961 by the CIA to protect information about the National Reconnaissance Office (NRO) and its operations. At the unclassified level, B, BRAVO, and BYE were used interchangeably instead of BYEMAN.* The BYEMAN Control System was retired on May 20, 2005 and most of its information was transitioned to TALENT KEYHOLE.

Some publicly acknowledged BYEMAN compartments were:
- ARGON, CORONA, DORIAN, GAMBIT, GRAB, HEXAGON, LANYARD, MELVIN, POPPY, QUILL, and UPWARD

In a classification line this was shown like: TOP SECRET//DORIAN


OXCART/TAGBOARD
A security compartment of BYEMAN to protect information about the covertly developed D-21 supersonic reconnaissance drone, which was initially launched from the CIA's Lockheed A-12 aircraft (OXCART). As of may 1969 this information was identified and classified as TAGBOARD.*

TAGBOARD
A security compartment of BYEMAN to protect information about the covertly developed D-21 supersonic reconnaissance drone. Project TAGBOARD was terminated on July 15, 1971. Documents of historical value were made available for persons with clearance for IDEALIST or STUDY 50006.*


KLONDIKE (KDK)
This control system was for Geospational Intelligence (GEOINT) produced by the National Reconnaissance Office (NRO). Since 2013, the control system contained compartments, which are identified by a codeword.
As of 2016, KLONDIKE has been merged with TALENT KEYHOLE (TK) and its three declared compartments are now a part of the TK Control System.*

Declassified names of former KLONDIKE compartments are:
- BLUEFISH (BLFH)
- IDITAROD (IDIT)
- KANDIK (KAND)

In a classification line this was shown like: TOP SECRET//KDK-IDIT


RESERVE (RSV)
This control system is for compartments protecting new sources and methods during the research, development, and acquisition process done by the National Reconnaissance Office (NRO). Compartments within RESERVE have an identifier of three alphanumeric characters.* There are no actual examples.

In a classification line this is shown like: TOP SECRET//RSV-XXX


HUMINT Control System (HCS)
This control system is "intended to provide enhanced protection to exceptionally fragile clandestine HUMINT sources, methods, and activities based on assessed value, critical nature, and vulnerability of the information." It has two compartments which were revealed in 2014.*

Compartments are:
- HCS-OPERATIONS (HCS-O)
- HCS-PRODUCT (HCS-P)

In a classification line this is shown like: TOP SECRET//HCS-P

HCS-OPERATIONS (HCS-O)
This compartment is used "to protect exceptionally fragile and unique HUMINT operations and methods. Each clandestine HUMINT collector organization is authorized to activate an operations compartment upon the approval of the CIA/Deputy Director of Operations." The information requires the ORCON and NOFORN dissemination markings as well. Dissemination outside the CIA is highly restricted. HCS-O contains sub-compartments which are identified by up to six alphanumeric characters.* There are no actual examples.

Example: TOP SECRET//HCS-O XXXXXX

HCS-PRODUCT (HCS-P)
This compartment is used to protect intelligence information (products) intended for dissemination to Intelligence Community consumers when unauthorized disclosure would endanger or compromise human sources and collection capabilities. HCS-P contains sub-compartments for information that requires extremely restricted access. These are identified by up to six alphanumeric characters.*

Example: TOP SECRET//HCS-P XXXXXX

? (CRD)
Sub-compartment of HCS-P, no further information available.*

Shown like: TOP SECRET//HCS-P CRD




KLAMATH (KLM)
A CIA control system, which in 2003 included the NSA ECI compartments CONQUERER (for joint NSA/CIA clandestine radio frequency operations), LYSERGIC (for NSA efforts to select and prosecute foreign deployed telecommunication cables) and WASHBURN (for a CLANSIG effort to exploit a source in a Middle Eastern location).* There's also a compartment identified as R.*

In a classification line this is shown like: TOP SECRET//KLM-R


MARVEL (MVL)
This control system is only known by its codeword, its purpose is still classified. MARVEL has four known compartments, each identified by two separate codewords.*

Known compartments are:
- GHOSTLY LABRYNTH (GYL)
- MADAM BUTTERFLY (MBF)
- PAINTED LADY (PDL)
- TAME MONARCH (TMN)

In a classification line this is shown like: TOP SECRET//MVL-MBF

GHOSTLY LABRYNTH (GYL)
This compartment of MARVEL is only known by codeword, its purpose is still classified. GHOSTLY LABRYNTH has three known sub-compartments which are also identified by two separate codewords.*

Known compartments are:
- GRAPHITE MESA (GRM)
- TWISTED MIRROR (TMI)
- VICIOUS CALAMITY (VIC)

Example: TOP SECRET//MVL-GYL-TMI

? (GG)
This control system is for information derived from Measurement and Signature Intelligence (MASINT) and is identified by a codeword that is still classified. It's only known by the abbreviation.*


? (BUR)
This control system is only known by its abbreviation and therefore its full codeword as well as its purpose are still classified. BUR has three known compartments and a whole range of sub-compartments.*

Known compartments are:
- ? (BLG)
- ? (DTP)
- ? (WRG)

In a classification line this is shown like: TOP SECRET//BUR-WRG

? (BLG)
This compartment of BUR is only known by its abbreviation and therefore its full codeword as well as its purpose are still classified. BUR-BLG has some 33 known sub-compartments which are identified by four letters, or codewords that are abbreviated by four letters.*

Known compartments of BLG are:
- ASPW, CMBR, CRFT, CSPR, DMRL, DNCW, DRVR, DSPR, DVTL, FLFD, GRLK, GRSH, GRWD, HCAS, HZDP, IRTH, JDHZ, JETS, JPST, LNFX, LTPL, ORGL, PAJE, RDFN, RDGL, RFPT, SKCH, SLSH, SOFX, TLWV, TWIX, WKSW, WVLT.

Example: TOP SECRET//BUR-BLG-GRWD

? (WRG)
This compartment of BUR is only known by its abbreviation and therefore its full codeword as well as its purpose are still classified. BUR-WRG has some 14 known sub-compartments which are identified by four letters, or codewords that are abbreviated by four letters.*

Known compartments of WRG are:
- ARME, BSVL, DEDR, DPRL, DRK, EGLY, JKRG, LOCR, LOEN, PAPL, PLVX, RDSK, SLFX, VCEG.

Example: TOP SECRET//BUR-WRG-JKRG

? (CRU)
This control system is identified by a codeword that is still classified and is only known by the abbreviation which was accidentally revealed in 2009.* It's related to highly secret CIA programs.

> More about the CRU classification marking

A compartment of CRU seems to be:
- GREYSTONE (GST)

In a classification line this is shown like: TOP SECRET//CRU-GST

GREYSTONE (GST)
This compartment is for information about the extraordinary rendition, interrogation and counter-terrorism programs, which the CIA established after the 9/11 attacks. It contains more than a dozen sub-compartments, which are identified by numeric characters.*

Example: TOP SECRET//CRU-GST 001

FOCAL POINT (FP)
This compartment protects CIA support to the military, Special Technical Operations (STOs) and military CIA operations.* The Joint Staff managed FOCAL POINT programs as well, governed by CJCSM 3213.02A, the Joint Staff Focal Point Communications Procedures Manual from January 31, 1997, which implemented additional control measures for protecting operationally-sensitive classified Information.*

EARPOP
Former NSA/NRO compartment, similar to SI and TK, that apparently protected information related to satellite "overhead" collection systems in the 1960s and 1970s.* *

VERDANT (VER)
Former Navy/NSA compartment for SIGINT information.*

PANGRAM (PM)
Former Navy/NSA compartment for information dealing with ocean surveillance.*

MEDITATE (M)
Former Navy/NSA compartment dealing with submarine operations and an IVY BELLS-like operation.*

SPECTRE
Counter-terrorism related compartment, probably no longer in use.*

LOMA
This compartment possibly protects nuclear-related information.*

PSALM
Defunct control system for intelligence related to the Cuban missile crisis (October 1962).*

ICS / PH / ZH
Compartments used by FEMA for continuity of government information and communications. Initiated in 1983, not clear whether these are still used.*

HOLLOW TILE (HT)
SCI control system or Special Access Program for the Air Intelligence Agency.*



Special Access Programs (SAPs)

Special Access Programs (SAPs) are created to control access, distribution, and protection of particularly sensitive information. From the early 1970s to the mid-1990s, SAPs were usually called "black programs" and almost exclusively restricted to safeguarding DoD acquisition programs, but now they include intelligence and operations & support programs as well.*

Each SAP is identified by a nickname which consists of two unassociated, unclassified words. Additionally, a Special Access Program Central Office (SAPCO) can also assign a single classified codeword to the program. These can be changed regularly. The nickname and the codeword can be abbreviated into an unclassified two or three-letter Program Identifier (PID).

There are over 100 SAPs, with many having numerous compartments and sub-compartments. More than 50 SAPs protect operations and capabilities of the Joint Special Operations Command (JSOC), while 75-80% of all SAPs are for military procurement, acquisition, research and testing programs. The existence of a SAP can be acknowledged, unacknowledged or waived.*

Most SAPs protect military operational, tactical and strategical programs, but SAPs may also be created by the Secretaries of State, Energy, Homeland Security and the Attorney General or their principal deputies.

The classification line for SAP information shows the words SPECIAL ACCESS REQUIRED, often abbreviated as SAR, followed by the program's nickname or codeword. Fictitious examples of program nicknames are BUTTER POPCORN, MEDIAN BELL and SENIOR ICE.

In a classification line this is shown like: TOP SECRET//SAR-MEDIAN BELL

Multiple SAP's are shown like: TOP SECRET//SAR-MB/SAR-BP


Some examples of actual Special Access Programs are:

YANKEE WHITE
People who have been cleared for this SAP have unfettered access to presidential workspaces that might contain classified information at any level and may also carry a loaded weapon when the president is around. This clearance requires the most extensive background investigation.*


COPPER GREEN / MATCHBOX
This SAP protected a program for training interrogators to use techniques that had been reverse-engineered by the military's agency that trained special operations forces on how to resist torture.*


TIMBER WIND
Unacknowledged SAP to protect information about the development of (dangerous) nuclear thermal rockets capable as part of president Reagan's Strategic Defense Initiative (SDI). The project was established in 1987, terminated in 1991 and declassified in 1992.*


SEASPRAY
SAP that protected a joint Army-CIA covert aviation unit to support clandestine operations conducted by the Special Operations Division (SOD) in Central America in the early 1980s.*


YELLOW FRUIT
Unacknowledged SAP to provide additional operational security and counter-intelligence assistance for military missions in Central America run by the Special Operations Division. Created in 1982 and terminated in 1983.*


? (CD)
This SAP is identified by a codeword that is still classified and is only known by its abbreviation. It protects all information related to the Air Force Flight Test Center at Groom Lake (aka Area 51).*


Other known Special Access Programs (SAPs) and related Alternative or Compensatory Control Measures (ACCMs) are:

- ADOBE, ANTEMATE, BELL WEATHER, BERNIE, BLACK LIGHT, BLUE MAIL, BLUE ZEPHYR, CAVALRY, CENTENNIAL, CHALK series, CHANNEL series, CITADEL, CLOUD GAP, COMPASS LINK, CONSTANT HELP, CONSTANT PISCES, CONSTANT STAR, COPPER COAST, CORONET PHOENIX, DISTANT PHOENIX, ELEGANT LADY, FIREANT, FOOTPRINT, GALAXY, GENTRY, GIANT CAVE, GIANT DODGE, GRASS BLADE, GREATER SLOPE, GREYHOUND, GULF, GUSTY series, GYPSY series, HAVE DJINN, HAVE FLAG, HAVE TRUMP, HAVE VOID, ISLAND SUN, LEO, LINK series, MALLARD, MERIDIAN, MILKYWAY, MUSTANG, OLYMPIC, OMEGA, OSPREY series, OVERTONE, OXIDE, OZONE, PANTHER series, PAVE RUNNER, PIRATE SWORD, POLO STEP, PROCOMM, PROJECT 19, PROJECT 643, PROJECT 9000, RADIUS, RAVEN, RETRACT series, REWARD, ROSETTA STONE, RUBY, SCATHE series, SCIENCE series, SEA BASS, SEEK CLOCK, SENIOR NEEDLE, SENIOR NIKE, SIERRA, SIT-II, SOFTRING, SPEAR, SUTER, STEEL PUMA, TALON RADIANCE, TAPESTRY, THEME CASTLE, THERMAL VICAR, THIRST WATCHER, THIRSTY SABER, TIGER LAKE, TITRANT RANGER, CAPACITY GEAR, TRACTOR series, UMBRELLA and WHITE KNIGHT.*


SAP compartments and sub-compartments
Special Access Programs can be divided into compartments, sub-compartments and programs. Compartments and sub-compartments can be identified by a two-word unclassified nickname or an alphanumeric designator. They are separated by spaces and they are listed in ascending alphabetic and numeric order. The classification markings do not show the hierarchy beyond the sub-compartment level.

In a classification line this is shown like: TOP SECRET//SAR-MB A691 D722




Alternative Compensatory Control Measures (ACCM)

When regular security measures are insufficient to enforce the need-to-know for classified information, but SCI or SAP protection is not required, Department of Defense Manual (DODM) 5200.01 from January 1997 allows the implementation of Alternative Compensatory Control Measures (ACCMs) for information about military intelligence and special operations. In 2014, there were more than 70 ACCMs in the US Defense Department. Similar additional security measures are provided by the FOCAL POINT control system.*

ACCM consists of three measures: creating a specific description of the information subject to the enhanced ACCM control, maintaining a list of personnel to whom the classified information has been or may be provided, and guidelines for the use of unclassified nicknames. Top Secret, Secret, and Confidential cover sheets used to cover ACCM material are marked with "ACCM" and the appropriate nickname.



Controlled Unclassified Information (CUI)

In 2010, president Obama established the Controlled Unclassified Information (CUI) program to streamline the sharing of unclassified information among more than 100 US government departments and agencies while still providing some level of protection from unauthorized access and release. The CUI program is managed by the Information Security Oversight Office (ISOO) of the National Archives and Records Administration (NARA).

In 2020, DNI Ratcliffe lamented that "instead of simplifying and replacing a handful document markings with one new CUI marking, the CUI Program has expanded to over 124 categories in 20 groupings, with 60 Specified and 60+ Basic categories".* For the specified categories there's an abbreviation to be added (preceded by SP) to the CUI marking in the same way as in classification lines. CUI can also have additional dissemination markings.

In a classification line this is shown like: CUI//SP-CTI//NOFORN



Dissemination markings

Dissemination markings or caveats are used to restrict the dissemination of information within only those people who have the appropriate clearance level and the need to know the information. Dissemination markings can also be used to control information which is unclassified. Some markings are used by multiple agencies, others are restricted to use by one agency.

In a classification line they are shown like: SECRET//SI//ORCON

Multiple markings are shown like: SECRET//SI//ORCON/NOFORN


Markings used by multiple agencies:
- FOR OFFICIAL USE ONLY (FOUO, to be replaced by CUI))
- SENSITIVE INFORMATION (SINFO, defunct since 2002)
- LAW ENFORCEMENT SENSITIVE (LES, to be replaced by CUI)
- OTHER LAW ENFORCEMENT AGENCIES (OLEA)
- FEDERAL EMPLOYEES ONLY (FED ONLY)
- FEDERAL EMPLOYEES AND CONTRACTORS ONLY (FEDCON)
- DISSEMINATION LIST CONTROLLED (DL ONLY)


Intelligence community markings:
- WARNING NOTICE - INTELLIGENCE (WNINTEL; eliminated in 1987)
- NOCONTRACT (eliminated in 1987)
- ORIGINATOR CONTROLLED (ORCON) (OC)
- ORIGINATOR CONTROLLED-USGOV (ORCON-USGOV, since 2013)
- CONTROLLED IMAGERY (IMCON) (IMC)
- SOURCES AND METHODS INFORMATION (SAMI, defunct since 2009)
- NO FOREIGN NATIONALS (NOFORN) (NF)
- PROPRIETARY INFORMATION (PROPIN) (PR)
- AUTHORIZED FOR RELEASE TO (REL TO) [country trigraph or coalition tetragraph]
- DISPLAY ONLY [country trigraph or coalition tetragraph]
- Releasable by Information Disclosure Official (RELIDO)
- Foreign Intelligence Surveillance Act (FISA)


National Security Agency (NSA) markings:
- [country trigraph] EYES ONLY (since 2016 replaced by REL TO)

NSA also used SIGINT Exchange Designators, which were gradually replaced by the 'REL TO [...]' marking. Some former SIGINT Exchange Designators were:
- FRONTO
- KEYRUT
- SEABOOT
- SETTEE

National Geospatial intelligence Agency (NGA) markings:
- LIMITED DISTRIBUTION (LIMDIS) (DS)
- RISK SENSITIVE (RSEN)


Department of Defense (DoD) markings:
- NC2-ESI (Nuclear Command and Control - Extremely Sensitive Information)
- SPECIAL CATEGORY (SPECAT, defunct since 2010)




Department of Homeland Security (DHS) markings:
- SENSITIVE SECURITY INFORMATION (SSI)


State Department (DoS) markings:
- NO DISTRIBUTION (NODIS) (ND)
- EXCLUSIVE DISTRIBUTION (EXDIS) (XD)
- STATE DISTRIBUTION only (STADIS)
- SENSITIVE BUT UNCLASSIFIED (SBU, to be replaced by CUI)


Drug Enforcement Administration (DEA) markings:
- DEA SENSITIVE (DSEN)


Nuclear weapons related markings:
- RESTRICTED DATA (RD)
- FORMERLY RESTRICTED DATA (FRD)
- DOD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (DCNI)
- DOE UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (UCNI)
- TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION (TFNI)

The markings Restricted Data (RD) and Former Restricted Data (FRD) are based upon the Atomic Energy Act (AEA) and used by the Department of Defense and the Department of Energy for information about design and operation of nuclear warheads. For non-military personnel, access to this information requires L Clearance (Secret) or Q Clearance (Top Secret).*
Both RD and FRD can have the following additional sub-markings:

- CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI)
- SIGMA (SG, followed by a number between 1 and 20)

In a classification line this is shown like: SECRET//RD-CNWDI

Multiple SIGMA markings are shown like: SECRET//RD-SIGMA 2 4



Internal markings

Some intelligence agencies also use internal markings, indicating that information may not be released or shown to anyone outside that particular agency without proper permission. Internal markings are shown after the dissemination markings at the very end of a classification line.


White House (WH) internal markings:
- LIMITED ACCESS (not part of the classification line)*
- SPECIAL HANDLING (?)*


Central Intelligence Agency (CIA) internal markings:*
- CIA INTERNAL USE ONLY
- Administrative Internal Use Only (AIUO, to be replaced by CUI)


Federal Bureau of Investigation (FBI) internal markings:
- SENSITIVE
- JUNE (protecting the FBI's most sensitive sources, now defunct)*
- [undisclosed] *


National Security Agency (NSA) internal markings:
These markings are used to identify a COI or CoI, which stands for Community Of Interest. It seems that this term has recently been replaced by Secure Community of Interest (SCoI). Recently disclosed COI identifiers are:
- BULLRUN
- ENDUE
- NOCON

In a classification line this is shown like: TOP SECRET//SI//NOFORN/BULLRUN


Coalition designators
The designators or tetragraphs which are used in the dissemination marking "AUTHORIZED FOR RELEASE TO (REL TO)" are listed here:

- ABCA: American, British, Canadian, Australian (and New Zealand Armies’ Program)
- ACGU: Australia, Canada, Great Britain, United States (Four Eyes)
- AFSC: Afghanistan SIGINT Coalition
- BWCS: Biological Weapons Convention States
- CFCK: Combined Forces Command, Korea
- CMFC: Combined Maritime Forces Central
- CMFP: Cooperative Maritime Forces Pacific
- CPMT: Civilian Protection Monitoring Team (for Sudan)
- CWCS: Chemical Weapons Convention States
- ECTF: European Counter-Terrorism Forces
- EFOR: European Union Stabilization Forces in Bosnia
- FVEY: Five Eyes (Australia, Canada, New Zealand, UK, US)
- GCTF: Global Counter-Terrorism Forces
- GMIF: Global Maritime Interception Forces
- IESC: International Events Security Coalition
- ISAF: International Security Assistance Forces (for Afghanistan)
- KFOR: Stabilization Forces in Kosovo
- MCFI: Multinational Coalition Forces – Iraq
- MIFH: Multinational Interim Force Haiti
- NACT: North African Counter-Terrorism Forces
- NATO: North Atlantic Treaty Organization
- OSAG: Olympic Security Advisory Group
- UNCK: United Nations Command, Korea



CAPCO

In order to prevent codewords being assigned twice, the Security Markings Program (SMP, part of ODNI, Policy & Strategy Information Management Division) lists all codenames and authorized abbreviations of Sensitive Compartmented Information (SCI) and Special Access Programs (SAPs) in the Authorized Classification and Control Markings Register or CAPCO list.



NSA Classification Guides

- Classification Guide for the TAREX Program (2012)
- Classification Guide for SIGINT material from 1945-1967 (2011)
- Classification Guide for Computer Network Exploitation (2010)
- Classification Guide for Project BULLRUN (2010)
- Classification Guide for Cryptgraphic Modernization (pdf) (2010)
- Classification Guide for FISA, PAA and FAA Activities (pdf) (2009)
- Classification Guide for STELLARWIND (pdf) (2009)
- Classification Guide for RAINFALL (Pine Gap) (2009)
- Classification Guide for the Cuban Missile Crisis (2008)
- Classification Guide for USS Liberty Incident (2006)
- Classification Guide for ECI PAWLEYS (2006)
- Classification Guide for Cryptanalysis (2005)
- Classification Guide for ECI WHIPGENIE (2004)
- Classification Guide for the JFK Assassination Records (2000)
- Classification Guide for Cellular communications interception (undated)

In 2023, the US government maintained more than 2000 classification guides, including more than 400 for the Army alone, and roughly 1400 original classification authorities.



Links and Sources

- NPEC: Over-classification: How Bad Is It, What’s the Fix?
- The Debrief: It's Classified! A Deep Dive Into the Dark World of Keeping Secrets
- NSA/CSS: Policy Manual 1-52: Classification
- USA Today: What are the types of 'classified' documents?
- The Atlantic: Not Even the President Can Declassify Nuclear Secrets
- Alex Wellerstein: Secrecy Stamps (for US nuclear secrets)
- The Drive: Special Access Programs And The Pentagon’s Ecosystem Of Secrecy
- Robert Sesek: U.S. Classification Markings, 2016 Update
- The 2016 Intelligence Community Classification and Control Markings Implementation Manual
- Air Force Policy Directive 16-7: Special Access Programs
- Secrecy News: Was Obama Administration the Most Transparent or the Least?
- The 2015 Intelligence Community Directive on Controlled Access programs (pdf)
- The latest SCI compartments: My First FOIA Request: ODNI CAPCO v6 + Update
- TheWeek.com: What Edward Snowden didn't disclose
- Wikipedia articles:
  - Classified information in the United States
  - Sensitive Compartmented Information
  - Special access program
- The 2013 Intelligence Community Classification and Control Markings Implementation Manual (pdf)
- The 2013 DoD Special Access Program (SAP) Instruction (pdf)
- The 2012 NRO Review and Redaction Guide (pdf)
- The 2008 DNI Authorized Classification and Control Markings Register (pdf)
- The 2004 listing of Country Code Trigraphs and Coalition Tetragraphs (pdf)
- Article about Security Clearances and Classifications
- Some notes about Sensitive Compartmented Information
- About The 5 secret code words that define our era
- N.N.: Do You Know the Differences? SCI | SI | SIGINT, in: Cryptolog, p. June 1983, p. 7-9.
- Marc Ambinder & D.B. Grady, Deep State, Inside the Government Secrecy Industry, 2013, p. 164-167.
- William M. Arkin, Code Names, Deciphering U.S. Military Plans, Programs, and Operations in the 9/11 World, Steerforth Press, 2005.

37 comments:

Rob1 said...

The original source don't mention a GAMMA compartment named "GOAT". The list given included GILT, GOUT, GULT, GANT, GABE, GYRO and GUPY.

(it's in http://jfk.hood.edu/Collection/Weisberg%20Subject%20Index%20Files/D%20Disk/Domestic%20Intelligence/Item%2052.pdf)

For an unknown reason, "GOAT" popped up in Jeff Richelson's The U.S. Intelligence Community without other source.

Open sources have identified GUPY as the classification of intercepts made from the US embassy in Moscow, and GOUT as intercept of South Vietnamese government communications.

An interesting paper on NSA SI/COMINT classification is http://www.nsa.gov/public_info/_files/cryptologs/cryptolog_80.pdf. It reports that SCI is a type of SAP.

Hope it helps.

P/K said...

Thank you for the comments and the sources!

Rob said...

In case it interests you, two other GAMMA compartements were called GART and GROL :

"Department of State, Intelligence Note, Denney to Secretary, The Soviet Contribution to the Start of the Current Mid-East Crisis, June 1, 1967, Top Secret Trine/Gamma (Gart-Grol) Controlled..."

http://www.brill.com/sites/default/files/ftp/downloads/53806_Title_List.pdf p.91

P/K said...

Thank you - I will add them to the listing!

Anonymous said...

I just noticed a declassified picture of a post-9/11 shot of Secretary Powell with a SCI coversheet marked "CRU." http://i2.cdn.turner.com/cnnnext/dam/assets/150725160118-14-cheney-911-19296077843-85a372e109-o-jpg-exlarge-169.jpg. Not much to add to the mystery of what CRU is or stands for...but it's all pieces of the puzzle

Anonymous said...

Also...HUMINT CONTROL SYSTEM (HCS) is a CIA compartment. This isn't particularly surprising since the CIA is in charge of human-based collections, but I thought I would clarify. Interestingly, HCS has been used as a compartment on both SECRET and TOP SECRET classified CIA reports...which I find particularly amusing, because I've never met anyone who has access to HCS (it's te 4th most likely compartment to have access to in Nat'l Security Intelligence: 1) (tie) SI and TK, 3) SI-G, 4) HCS) but doesn't have a TS clearance.

QQminusS said...

The classification system is evil, equally as dangerous to the people it disguises away from representing as it is to the enemies of their non-representative State.

Unknown said...

"KEYRUT" is an anagram for Turkey, "SEABOOT" is a rather blunt reference to Italy. A couple new exchange designators courtesy of Jeffery Richelson:
DRUID - Generic third party intercept to be shared with foreign partners.
JAEGER - Austria

(https://books.google.com/books?id=IiedBAAAQBAJ&pg=PA554&lpg=PA554&dq=fronto+keyrut+seaboot&source=bl&ots=LEqCvw2xUu&sig=11dE8iR79P4bLMpT2pgS8jPRCRY&hl=en&sa=X&ved=0CDMQ6AEwA2oVChMIoNC8q5zmxwIVTDs-Ch0Cbgnz)

Anonymous said...

I have identified people deep into the Government Secrecy Operations Industry. Intercepted through cellular communications, their unknown disguises are for Soviet eyes only.

Anonymous said...

Classification Levels You Aren't Even Cleared To Know About

Anybody who works with classified documents knows that there are cover sheets for those documents which serve (as far as I can tell) two purposes. First, the obvious one of protecting the front page of the document from being exposed 'to the elements.' Also, since they usually have a bright color and fairly bold pattern, they serve as a visual reminder not to leave them just laying around.

What I never knew is that there's more to the classification scheme than just 'Confidential,' 'Secret,' and 'Top Secret.' Much more.
Category: That's Funny
Comments
ROFLMAO!

http://www.dangerouslogic.com/archive/001139.html

Anonymous said...

ULTRA CLASSIFIED MILITARY TOP SECRET PLANS DOCUMENT LEAKED.pdf

https://www.mediafire.com/?8hidz41hlfkywqq

Anonymous said...

As a former USAF/NSA member, I just found your site.
I can say for the record no comment.

You are way off on capabilities,
Some of the stuff you are just making up. Wich is sad and funny at the same time.
What's the fascination with knowing secrets????
Go apply for a US gov job. File an SBI and wait.

There is a reason we don't tell everyone, everything.
That traitor Snowden just thought he was a god, not a damp employee.

It will always be a laugh to see the pretend, and made up stuff you post. If you wanted to be taken seriously. You would only post verified facts. Not drunken dribble

Ha

P/K said...

First, let me say that I am not making things up. I always try to stick to facts and what's in official (either declassified or leaked) documents. Given the complexity of these subjects and the secrecy surrounding them, this is often not easy, and things have to be interpreted. Then I sometimes present options which at that moment and given the information available look most plausible.

Of course I can be mistaken, and sometimes subsequent revelations provide new insights, after which I always correct my earlier postings when I had things wrong (find any news outlet doing this!). This is a process of trial-and-error, piecing together small bits of information to get a better picture. It's not much different from how historians works while trying to discover what happened in the past.

As you may know, there are many websites containing much more speculative interpretations, up to outright conspiracy theories. But more important is that since the start of the Snowden-revelations, almost all big news media followed Snowden and Greenwald in their exaggerated and highly biased interpretations of the NSA-documents.

Quite a number of reports had serious misinterpretations or were even misleading, which caused that millions of people around the world now have completely unrealistic ideas about what NSA does and is capable of. I saw it as my task to carefully look at the original documents and try to interpret them in an unbiased way, also providing the necessary context that was most often neglected in the news reports.

Anonymous said...

Just a quick note :

National Geospatial intelligence Agency (NGA) markings:
- RISK SENSITIVE (RSEN)

seem to be also used by the DIA. Source : footnote 132, p16, HPSCI Snowden review.

Anonymous said...

Another one:
https://www.cia.gov/library/readingroom/docs/CIA-RDP68B00255R000300010001-8.pdf

PSALM is a now defunct TS control system for the cuban missiles intelligence.

P/K said...

Nice find! I will add it

Anonymous said...

Hey P/K.. Another one for you. April 2013 Document subject NSA Realationship with Australia. Marked:
TOPSECRET//SI/TALENT KEYHOLE//REL USA, FVEY

Have you seen Talent Keyhole before? Only marked on one page. Others are TOPSEC//SI//REL US, FVEY
So nothing unusual there. Its regarding Pinegap to be more specific.

Hamza Razaq said...

Looks great! this is nice and this article is very helpful
thanks for sharing

Unknown said...

Say it again, I don't think they heard you. Remember what curiosity did to the cat. Still, being aware of what's being put out into the ether, true or false, definitely has value.

jan said...

You identify WNINTEL and NOCONTRACT markings as having been eliminated in 1987. But those markings appear on the President's Foreign Intelligence Advisory Board's (now declassified in part) February 15, 1990, report, "The Soviet 'War Scare'".

P/K said...

Well noticed! It's yet another example of markings that appear to have been used longer than officially acknowledge.
For those who are interested, here's the document about the Soviet War Scare: https://nsarchive2.gwu.edu/nukevault/ebb533-The-Able-Archer-War-Scare-Declassified-PFIAB-Report-Released/

Anonymous said...

Hi! Can you advise me on the procedure used for researchers or historians to access classified information. Thank you.

P/K said...

You can either request classified information through the Freedom of Information Act (FOIA, there's information about this on many websites), or contact the government agency that is the subject of your research.

Unknown said...

May be interesting https://www.sdsfieonline.org/Documents/Schemas/smis/2.0/ic/ism/V13/CVEGenerated/CVEnumISMSCIControls.xsd

MisterAnon said...

I would like to point out that the classification colors guide here https://3.bp.blogspot.com/-IatOVzg8NWw/USlirDEdl6I/AAAAAAAAAII/ekHvxXt19tA/s1600/classification-colors.jpg that you posted isn't quite accurate. It shows Top Secret SCI as a separate level of classification, when really it is technically a subcategory within the Top Secret classification. And yes, it is treated more securely than just plain Top Secret, without the SCI subcategory, but so is Noforn. Any additional markings, beyond the base classification marking, indicate that it must be treated with more security. Yes, I know it's cool to talk about "Above Top Secret" stuff, but the fact is that there is no actual level of classification that is above Top Secret.

P/K said...

You are right, but while officially, Top Secret SCI isn't a classification level, you can see that in practice it's often treated as such: it has it's own color code (yellow) and accordingly there are yellow labels and markings, just like the actual classification levels have theirs (blue/red/orange). It would have been more correct if Top Secret SCI was represented by orange (for Top Secret) with an addition to mark the SCI compartment. But for some reason that's not the case. With the picture I wanted primarily to show the different color codes. I grouped the actual classification levels more close to each other, with SCI and Unclassified more separated to indicate their different nature. Feel free to let me know if you think there's a better way to represent these levels and colors.

Benjamin R. Tremayne said...

Posting this article as a main post or in the comments has been refused by both Facebook and Instagram. Apparently you've crossed somebody's line.

Anonymous said...

New SCI codewords. MARVEL short form -- MVL, MARVEL-GHOSTLY LABRYNTH (short form MVL-GYL), MARVEL-GHOSTLY LABRYNTH-GRAPHITE MESA (MVL-GYL-GRM), MARVEL-GHOSTLY LABRYNTH-TWISTED MIRROR (MVL-GYL-TMI), MARVEL-GHOSTLY LABRYNTH-VICIOUS CALAMITY (MVL-GYL-VIC), MARVEL-MADAM BUTTERFLY (MVL-MBF), MARVEL-PAINTED LADY (MVL-PDL) and Hierarchy:MARVEL-TAME MONARCH (MVL-TMN).

This is from https://www.sdsfieonline.org/Documents/Schemas/smis/2.0/ic/ISM/201903/CVEGenerated/CVEnumISMSCIControls.xsd

Laura said...

Aa and na ar not customy formats used online

Anonymous said...

I understand the allert colored (red, yellow, etc.) cover sheets but I would like to know if every page of the documents behind the covered page is "stamped with CLASSIFIED/SECRET/TOP SECRET, etc." and is each page referenced, by a unique number, back to the cover page? If all pages are not stamped "CLASSIFIED/SECRET/TOP SECRET, etc." and referenced back to the cover page, then anybody can place these cover pages in front of any documents!!!

Years ago, I work with classified information and every page was stamped with a proper classification but no cover sheets were required at that time.

P/K said...

Yes, every page of a classified documents has to be marked with a classification line both at the top and the bottom of each page. In many cases even each paragraph of the document has a so-called portion marking, which is an abbreviation of the full classification line. For example, the portion marking for the classification Top Secret//Talent-Keyhole//Noforn would be: TS//TK//NF. Classified documents have page numbers but these don't include the cover sheet, which isn't necessary because, as said, each page has a classification marking.

Anonymous said...

Seems like many of the documents in the NSA Classification Guide references are now dead links.

Anonymous said...

The truth is out there

Anonymous said...

I'm surprised no one has google searched the "Marvel" codewords one by one.

Start with the assumption that Marvel references the Marvel cinematic universe.

"The principle S.H.I.E.L.D. was founded upon was pure."
"Protection."
"Protection. One word. Sometimes, to protect one man against himself. Other times, to protect the planet against an alien invasion from another universe. It's a broad job description."

Then start from the bottom, up, with GRAPHITE MESA being your first search. Pay attention who else is paying attention to graphite mesa. Next, you can search TWISTED MIRROR or I can help you along and ask you to substitute your search with "photonic magic twist". Once you've found the likely reference to that codeword, don't bother searching VICIOUS CALAMITY. That codeword is obviously meant to reference a potential or already occurred vicious calamity (don't drop that vial Wuhan!)

Now, some brushing up on your Marvel cinematic universe knowledge by Google searching "Marvel cinematic universe labyrinth".

Find the (way too easy) connection between MADAM BUTTERFLY, PAINTED LADY, and TAME MONARCH. Consider that three of the four codewords under Marvel have a correlation while GHOSTLY LABYRINTH stands apart. Google search MADAM BUTTERFLY. Now do you see the butterfly reference? (But wait, there's more!) Head back to the Marvel Universe and find out all you can about butterflies. Are you ready to be afraid? Search for the (very few) references to TAME MONARCH online. End your search with PAINTED LADY so you might be able to go to sleep tonight.

This is either an elaborate hoax, or the codeword assigner at NSA wants the truth known.

Anonymous said...

Let's not forget the Codeword "Hierarchy: Marvel-Tame Monarch"

Hopefully we have a binding agreement and things don't get too out of hand...

https://www.nbcnews.com/mach/science/space-aliens-are-breeding-humans-university-instructor-says-scientists-say-ncna1008971

Anonymous said...

The NSA hides behind 50 USC 3605. It states that “nothing in this chapter OR ANY OTHER LAW shall be construed to require the disclosure of the organization or any function of the National Security Agency, or any information with respect to the activities thereof, or of the names, titles, salaries, or number of the persons employed by such agency”.

Anonymous said...

Марк

In Dutch: Meer over het wetsvoorstel voor de Tijdelijke wet cyberoperaties