Sensitive but unclassified (SBU) information includes information generated within the government but may also extend to knowledge generated purely in the private sector. Particularly in the wake of the September 11th attacks, the standard examples of sensitive information tend to be those that relate to the vulnerability of critical infrastructures, including facilities that are privately owned. The key nodes in an electricity grid are a frequently cited example, and information related to the design and operation of a nuclear power plant or transport of nuclear materials has long been protected as Unclassified Controlled Nuclear Information. In addition, it is easy to imagine that information such as the location of biological research programs might be considered sensitive, if the theft of select agents is considered a threat.32 The Bioterrorism Response Act exempts information on possession of select agents from FOIA.
The Bush Administration has urged federal agencies to use all applicable exemptions to the Freedom of Information Act when considering requests for "sensitive but unclassified information." The White House assigned the Office of Management and Budget the task of developing uniform policy guidance for government agencies on defining and controlling sensitive information.33 Section 892 of the Homeland Security Act directs the President to "identify and safeguard homeland security information that is sensitive but unclassified."34 No definition of "sensitive" is provided in the statute, however, and the fact that different agencies have put forward different definitions is a further concern.35 A key question is whether restraints on sensitive information might be extended beyond the information held internally by federal agencies, and, if so, who would be responsible for determining what counts as "sensitive."
The dOe provides an illustrative example of the difficulties associated with attempts to define "sensitive" information. In the wake of the scandals over alleged Chinese spying at DOE laboratories in 1999, the Defense Authorization Act for FY2000 added a provision that imposed signficant civil penalties for disclosure of "sensitive" information even though no implementing regulations were ever produced. In January 2000 the DOE General Counsel took the position that, since no definition of sensitive information existed in the Atomic Energy Act or departmental regulations, legal restrictions could not be applied or enforced on DOE employees or federal contractors.36 More generally, one basic DOE document defined "sensitive but unclassified information" as:
Information for which disclosure, misuse, alteration, or destruction could adversely affect national security or government interests. National security interests are those unclassified matters that relate to the national defense or foreign relations of the Federal Government. Government interests are those related, but not limited to, the wide range of government or government-derived economic, human, financial, industrial, agricultural, technological, and law enforcement information, as well as the privacy or confidentiality of information provided to the Federal Government by its citizens.37
Was this article helpful?