2013-00532. NASA Information Security Protection

AGENCY:

National Aeronautics and Space Administration.

ACTION:

Direct final rule.

SUMMARY:

This direct final rule makes nonsubstantive changes to align with and implement the provisions of Executive Order (E.O.) 13526, Classified National Security Information, and appropriately to correspond with NASA's internal requirements, NPR 1600.2, Classified National Security Information, that establishes the Agency's requirements for the proper implementation and management of a uniform system for classifying, accounting, safeguarding, and declassifying national security information generated by or in the possession of NASA. The revisions to these rules are part of NASA's retrospective plan under E.O. 13563 completed in August 2011. NASA's full plan can be accessed on the Agency's open Government Web site at http://www.nasa.gov/​open/​.

DATES:

This direct final rule is effective on March 25, 2013. Comments due on or before February 25, 2013. If adverse comments are received, NASA will publish a timely withdrawal of the rule in the Federal Register.

ADDRESSES:

Comments must be identified with RINs 2700-AD61 and may be sent to NASA via the Federal E-Rulemaking Portal: http://www.regulations.gov. Follow the online instructions for submitting comments. Please note that NASA will post all comments on the Internet with changes, including any personal information provided.

FOR FURTHER INFORMATION CONTACT:

Steve Peyton, 202-358-0191, [e-mail].

SUPPLEMENTARY INFORMATION:

Background

In accordance with E.O. 13526, Classified National Security Information, 32 CFR part 2001, Information Security Oversight Office (ISOO) Classified National Security Information Final Rule Implementing Directive, E.O. 12968, Access to Classified Information, E.O. 13549, Classified National Security Information Programs for State, Local, Tribal and Private Sector Entities, E.O. 12829, National Industrial Security Program, and 51 U. S. C., 20132 and 20133, National and Commercial Space Program, the President and the NASA Administrator establish security requirements, restrictions, and safeguards for NASA information in the interest of national security.

Part 1203 is the foundation for establishing NASA's information security program implementation requirements. It prescribes security and protective services requirements for NASA Headquarters, NASA Centers, and component facilities in order to protect the Agency's employees, contractors, property, and information. Therefore, it is being amended to comply with the Order and the Implementing Directive and to clarify the requirements for establishing an Information Security Program and handling National Security Information.

Additional provisions of part 1203 are implemented in NASA Procedural Requirements (NPR) 1600.2, NASA Classified National Security Information, to further ensure compliance. NPR 1600.2 can be accessed at http://nodis3.gsfc.nasa.gov/​displayDir.cfm?​t=​NPR&​c=​1600&​s=​2.

Direct Final Rule and Significant Adverse Comments

NASA has determined this rulemaking meets the criteria for a direct final rule because it involves clarifications, updating, and nonsubstantive changes to existing regulations. NASA does not anticipate this direct final rule will result in major changes to its security procedures. However, if NASA receives significant adverse comments, NASA will withdraw this final rule by publishing a note in the Federal Register in order to revisit the commented-on language. In determining whether a comment necessitates withdrawal of this final rule, NASA will consider whether it warrants a substantive response in a notice and comment process.

Statutory Authority

Section 1203 is established under E.O. 13526, 32 CFR parts 2001 and 2003, the Implementing Directive, E.O. 12968 as amended, Access to Classified Information, E.O. 13549, Classified National Security Information Programs for State, Local, Tribal and Private Sector Entities, E.O. 12829, National Industrial Security Program, and The Space Act, in accordance with 51 U.S.C., National and Commercial Space Program. Sections 20132 and 20133 authorize the NASA Administrator to establish security rules and procedures to handle and safeguard Classified National Security Information. The rules serve to achieve compliance with the Administator's objectives for the protection of NASA's personnel, property, and information.

Regulatory Analysis

Executive Order 12866, Regulatory Planning and Review and Executive Order 13563, Improving Regulation and Regulation Review

Executive Orders 13563 and 12866 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been designated as “administrative” under section 3(f) of Executive Order 12866. Accordingly, the rule has been reviewed by the Office of Management and Budget.

Review Under the Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires an agency to prepare an initial regulatory flexibility analysis to be published at the time the proposed rule is published. This requirement does not apply if the agency “certifies that the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities” (5 U.S.C. 603). This rule does not have a significant economic impact on a substantial number of small entities.

Review Under the Paperwork Reduction Act

This direct final rule does not contain any information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

Review Under Executive Order of 13132

E.O. 13132, “Federalism,” 64 FR 43255 (August 4, 1999) requires regulations be reviewed for Federalism effects on the institutional interest of states and local governments, and, if the effects are sufficiently substantial, preparation of the Federal assessment is required to assist senior policy makers. The amendments will not have any substantial direct effects on state and local governments within the meaning of the Order. Therefore, no Federalism assessment is required.

List of Subjects in 14 CFR Part 1203

• National security information, security information

Accordingly, under the authority of the National Aeronautics and Space Act, as amended, [51 U.S.C. 20113], NASA amends 14 CFR part 1203 as follows:

PART 1203—INFORMATION SECURITY PROGRAM

1. The authority citation for part 1203 is revised to read as follows:

Authority: E.O. 13526, E.O. 12968, E.O. 13549, E.O. 12829, 32 CFR part 2001, and 51 U.S.C., 20132, 20133.

Subpart A—Scope

2. Amend § 1203.100 as follows:

a. In paragraph (a), remove E.O. number “12958” from the heading and add in its place E.O. number “13526” and remove the citation “( E.O. 12958, 3 CFR, 1996 Comp., p. 333), as amended (See, Order of October 13, 1995, 3 CFR, 1996 Comp., p. 513)”.

b. Revise paragraph (c)(1) introductory text.

c. In paragraph (c)(2) introductory text, add the word “Space” in front of the word “Act”.

The revision reads as follows:

§ 1203.100

Legal basis.

* * * * *

(c) * * *

(1) The National Aeronautics and Space Act (51 U.S.C. 20113) (Hereafter referred to as, “The Space Act”), states:

* * * * *

3. Amend § 1203.101 by revising paragraph (c) to read as follows:

§ 1203.101

Other applicable NASA regulations.

* * * * *

(c) NASA Procedural Requirements (NPR) 1600.2, NASA Classified National Security Information (CNSI).

Subpart B—NASA Information Security Program

4. Amend § 1203.200 as follows:

a. Revise paragraph (b) introductory text.

b. In paragraph (c), remove the quotation marks from around the words “The Order”.

The revision reads as follows:

§ 1203.200

Background and discussion.

* * * * *

(b) The Order was promulgated in recognition of the essential requirement for an informed public concerning the activities of its Government, as well as the need to protect certain national security information from unauthorized disclosure. It delegates to NASA certain responsibility for matters pertaining to national security and confers on the Administrator of NASA, or such responsible officers or employees as the Administrator may designate, the authority for original classification of official information or material which requires protection in the interest of national security. It also provides for:

* * * * *

§ 1203.201

[Amended]

5. In § 1203.201(d), remove the words “interchange of information, techniques, or hardware” and add in their place the words “exchange or sharing of information, techniques, hardware, software, or other technologies”.

6. Amend § 1203.202 as follows:

a. Revise paragraph (a) introductory text.

b. In paragraph (a)(1), add the acronym “(NISP)” after the word “Program”.

c. In paragraph (a)(3), add the acronym “NISPC” after the words “NASA Information Security Program Committee” and remove the words “NASA Information Security Program” and add in their place the acronym “NISP”.

d. Revise paragraph (a)(4).

e. In paragraph (a)(5), remove the word “Issuing” and add in its place the word “Ensuring” and add the words “are developed for NASA” before the word “programs”.

f. In paragraph (a)(6), remove the word “30-year-old” and add in its place the word “all”.

g. In paragraph (a)(7), add an apostrophe to the end of the word “records” at its second occurrence.

h. In paragraph (a)(8), remove the words “NASA Information Security Program” and add in their place the acronym “NISP”.

i. In paragraph (b), remove the words “NASA Information Security Program Committee” and add in their place the acronym “NISPC” and remove the word “herein” and add in its place the words “in this section”.

j. In paragraph (c)(2), remove the words “NASA Information Security Program Committee” and add in their place the acronym “NISPC”.

k. In paragraph (c)(3), add the words “within a reasonable period” after the word “guidelines”.

l. In paragraph (d) introductory text, remove the words “Officials-in-Charge of Headquarters Offices” and add in their place the words “supervisors of NASA offices”.

m. In paragraph (d)(2), remove the word “eliminate” and add in its place the word “redact” and add the words “contained therein” after the word “information”.

n. In paragraph (e) introductory text, remove the words “Directors of Field Installations” and add in their place the words “Chiefs of Protective Services at NASA Centers”.

o. In paragraph (e)(1), add the words “and submitting the guide to the Office of Protective Services for review and approval” after the word “Guides”.

p. In paragraph (e)(2), remove the word “installations” and add in its place the word “Center”.

q. In paragraph (e)(3), remove the word “eliminate” and add in its place the word “redact”.

r. Revise paragraph (e)(4).

s. In paragraph (f), remove the words “Senior Security Specialist, NASA Security Office” and add in their place the words “Director of the Office of Protective Services” and remove the words “NASA Information Security Program Committee” and add in their place the acronym “NISPC”.

t. In paragraph (g), remove the words “Director, NASA Security Management Office” and add in their place the words “Information Security Program Manager, Office of Protective Services (OPS)”.

The revisions read as follows:

§ 1203.202

Responsibilities.

(a) The Chairperson, NASA Information Security Program Committee (NISPC) (Subpart I of this part), who is the Assistant Administrator for Protective Services, or designee, is responsible for:

* * * * *

(4) Coordinating NASA security classification matters with NASA Centers and component facilities and other Government agencies.

* * * * *

(e) * * *

(4) Coordinating all security classification actions with the Center's Protective Services Office.

* * * * *

7. In § 1203.203, revise paragraphs (b)(1) and (2) to read as follows:

§ 1203.203

Degree of protection.

* * * * *

(b)(1) Top Secret. Top Secret is the designation applied to information or material, the unauthorized disclosure of which could reasonably be expected to cause exceptionally grave damage to the national security.

(2) Secret. Secret is the designation applied to information or material, the unauthorized disclosure of which could reasonably be expected to cause serious damage to the national security.

* * * * *

Subpart C—Classification Principles and Considerations

8. Revise § 1203.302 to read as follows:

§ 1203.302

Compilation.

A compilation of items that are individually unclassified may be classified if the compiled information reveals an additional association or relationship that meets the standards of classification under the Order; and is not otherwise revealed in the individual items of information. As used in the Order, compilations mean an aggregate of pre-existing unclassified items of information.

9. Revise § 1203.303 to read as set forth below.

§ 1203.303

Distribution controls.

NASA shall establish controls over the distribution of classified information to ensure that it is dispersed only to organizations or individuals eligible for access to such information and with a need-to-know the information.

§ 1203.304

[Amended]

10. Amend § 1203.304 by removing the words “in light of” and add in their place the words “and weighed against”.

§ 1203.305

[Amended]

11. Amend § 1203.305 by adding the words “or by operation of law” after the word “originated,” adding the words “and Formerly Restricted Data” after the third occurrence of the word “Data”, and adding the words “and/or Department of Defense” after the word “Energy”.

Subpart D—Guidance for Original Classification

12. Revise § 1203.400 to read as follows:

§ 1203.400

Specific classifying guidance.

Technological and operational information and material, and in some exceptional cases scientific information falling within any one or more of the following categories, must be classified if its unauthorized disclosure could reasonably be expected to cause some degree of damage to the national security. In cases where it is believed that a contrary course of action would better serve the national interests, the matter should be referred to the Chairperson, NISPC, for a determination. It is not intended that this list be exclusive; original classifiers are responsible for initially classifying any other type of information which, in their judgment, requires protection under § 1.4 of “the Order.”

(a) Military plans, weapons systems, or operations;

(b) Foreign government information;

(c) Intelligence activities (including covert activities), intelligence sources or methods, or cryptology;

(d) Foreign relations or foreign activities of the United States, including confidential sources;

(e) Scientific, technological, or economic matters relating to the national security;

(f) United States Government programs for safeguarding nuclear materials or facilities;

(g) Vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security; or

(h) The development, production, or plans relating to the use of weapons of mass destruction.

§ 1203.403

[Reserved]

13. Remove and reserve § 1203.403.

§ 1203.405

[Amended]

14. Amend § 1203.405 by removing from the last sentence “, General Services Administration, Washington, DC 20405,” after the word “Office.”

15. Amend § 1203.406, in paragraph (b), by adding a new second sentence to read as follows:

§ 1203.406

Additional classification factors.

* * * * *

(b) * * * The Office of Protective Services will coordinate with the Information Security Oversight Office (ISOO) Committee and the National Declassification Center to determine what classification guides are current. * * *

16. Revise § 1203.407 to read as follows:

§ 1203.407

Duration of classification.

(a) At the time of original classification, the original classification authority shall establish a specific date or event for declassification based on the duration of the national security sensitivity of the information. Upon reaching the date or event, the information shall be automatically declassified. Except for information that should clearly and demonstrably be expected to reveal the identity of a confidential human source or a human intelligence source or key design concepts of weapons of mass destruction, the date or event shall not exceed the timeframe established in paragraph (b) of this section.

(b) If the original classification authority cannot determine an earlier specific date or event for declassification, information shall be marked for declassification 10 years from the date of the original decision, unless the original classification authority otherwise determines that the sensitivity of the information requires that it be marked for declassification for up to 25 years from the date of the original decision.

(c) An original classification authority may extend the duration of classification up to 25 years from the date of origin of the document, change the level of classification, or reclassify specific information only when the standards and procedures for classifying information under this Order are followed.

(d) No information may remain classified indefinitely. Information that is marked for an indefinite duration of classification under predecessor orders, for example, information marked as “Originating Agency's Determination Required,” or classified information that contains either incomplete or no declassification instructions, shall have appropriate declassification information applied in accordance with part 3 of this order.

17. Section 1203.408 is amended as follows:

a. Revise the section heading.

b. Amend the introductory text and paragraphs (a) and (d) by removing the word “installation” wherever it appears and adding in its place the word “Center”.

c. Add paragraph (e).

The revision and addition read as follows:

§ 1203.408

Assistance by Information Security Specialist in the Center Protective Services Office.

* * * * *

(e) Forwarding all security classification guides to the Office of Protective Services, NASA Headquarters, for final approval.

18. Amend § 1203.409 as follows:

a. Revise paragraph (a).

b. Amend paragraph (c) by removing number “30” and adding in its place the number “90” and removing “GSA,”.

The revision reads as follows:

§ 1203.409

Exceptional cases.

(a) In those cases where a person not authorized to classify information originates or develops information which is believed to require classification, that person must contact the Center's or installation's Information Security Officer in the Protective Services Office to arrange for proper review and safeguarding. Persons other than NASA employees should forward the information to the NASA Central Registry at 300 E Street SW., Washington, DC 20546, Attention: Office of Protective Services.

* * * * *

19. Amend § 1203.410 as follows:

a. Revise paragraphs (a), (c), (d), and (e).

b. Remove paragraphs (f) and (g).

The revisions read as follows:

§ 1203.410

Limitations.

(a) In no case shall information be classified, continue to be maintained as classified, or fail to be declassified in order to:

(1) Conceal violations of law, inefficiency, or administrative error;

(2) Prevent embarrassment to a person, organization, or agency;

(3) Restrain competition; or

(4) Prevent or delay the release of information that does not require protection in the interest of the national security.

* * * * *

(c) Information may not be reclassified after declassification after being released to the public under proper authority unless: The reclassification is based on a document-by-document review by NASA and a determination that reclassification is required to prevent at least significant damage to the national security and personally approved in writing by the Administrator, the Deputy Administrator, or the Assistant Administrator for Protective Services. All reclassification actions will be coordinated with the Information Security Oversight Office before final approval; the information may be reasonably recovered without bringing undue public attention to the information; the reclassification action is reported promptly to the Assistant to the President for National Security Affairs (the National Security Advisor) and the Director of the Information Security Oversight Office; and for documents in the physical and legal custody of the National Archives and Records Administration (National Archives) that have been available for public use, the Administrator, the Deputy Administrator, or the Assistant Administrator for Protective Services, after making the determinations required by this paragraph, shall notify the Archivist of the United States (hereafter, Archivist), who shall suspend public access pending approval of the reclassification action by the Director of the Information Security Oversight Office. Any such decision by the Director may be appealed by the agency head to the President through the National Security Advisor. Public access shall remain suspended pending a prompt decision on the appeal.

(d) Information that has not previously been disclosed to the public under proper authority may be classified or reclassified after an agency has received a request for it under the Freedom of Information Act (5 U.S.C. 552), the Presidential Records Act, 44 U.S.C. 2204(c)(1), the Privacy Act of 1974 (5 U.S.C. 552a), or the mandatory review provisions of section 3.5 of this Order only if such classification meets the requirements of this Order and is accomplished by document-by-document review with the personal participation or under the direction of the Administrator, the Deputy Administrator, or the Assistant Administrator for Protective Services. The requirements in this paragraph also apply to those situations in which information has been declassified in accordance with a specific date or event determined by an original classification authority in accordance with section 1.5 of this Order.

(e) Compilations of items of information that are individually unclassified may be classified if the compiled information reveals an additional association or relationship that:

(1) Meets the standards for classification under this Order; and

(2) Is not otherwise revealed in the individual items of information.

20. Amend § 1203.412 as follows:

a. Revise paragraphs (a)(3) and (5).

b. Amend paragraph (b), in the first sentence, by removing the word “two” and adding in its place the word “five.”

The revisions read as follows:

§ 1203.412

Classification guides.

(a) * * *

(3) State the duration of each specified classification in terms of a period of time or future event. If the original classification authority cannot determine an earlier specific date or event for declassification, information shall be marked for declassification 10 years from the date of the original decision, unless the original classification authority otherwise determines that the sensitivity of the information requires it be marked for declassification for up to 25 years from the date of the original decision.

* * * * *

(5) All security classification guides should be forwarded to the Office of Protective Services for review and final approval. The Office of Protective Services will maintain a list of all classification guides in current use.

* * * * *

Subpart E—Derivative Classification

21. Revise § 1203.500 to read as follows:

§ 1203.500

Use of derivative classification.

(a) Persons who reproduce, extract, or summarize classified information, or who apply classification markings derived from source material or as directed by a classification guide, need not possess original classification authority.

(b) Persons who apply derivative classification markings shall:

(1) Be identified by name and position or by personal identifier, in a manner that is immediately apparent for each derivative classification action;

(2) Observe and respect original classification decisions; and

(3) Carry forward to any newly created documents the pertinent classification markings. For information derivatively classified based on multiple sources, the derivative classifier shall carry forward:

(i) The date or event for declassification that corresponds to the longest period of classification among the sources or the marking established pursuant to section 1.6(a)(4)(D) of the Order; and

(ii) A listing of the source materials.

(c) Derivative classifiers shall, whenever practicable, use a classified addendum when classified information constitutes a small portion of an otherwise unclassified document or prepare a product to allow for dissemination at the lowest level of classification possible or in unclassified form.

(d) Persons who apply derivative classification markings shall receive training in the proper application of the derivative classification principles of the Order, with an emphasis on avoiding over-classification, at least once every two years. Derivative classifiers who do not receive such training at least once every two years shall have their authority to apply derivative classification markings suspended until they have received such training. A waiver may be granted by the Administrator, the Deputy Administrator, or the Assistant Administrator for Protective Services if an individual is unable to receive such training due to unavoidable circumstances. Whenever a waiver is granted, the individual shall receive such training as soon as practicable.

Subpart F—Declassification and Downgrading

§ 1203.601

[Amended]

22. Amend § 1203.601 by removing the words “Officials authorized original classification authority” and adding in their place the words “Authorized officials with Declassification Authority (DCA)”.

23. Revise § 1203.602 to read as follows:

§ 1203.602

Authorization.

Information shall be declassified or downgraded by an authorized DCA official. If that official is still serving in the same position, the originator's successor, a supervisory official of either, or officials delegated such authority in writing by the Administrator or the Chairperson, NISPC, may also make a decision to declassify or downgrade information.

24. Revise § 1203.603 to read as follows:

§ 1203.603

Systematic review for declassification:

(a) General. (1) NASA must establish and conduct a program for systematic declassification review of NASA-originated records of permanent historical value exempted from automatic declassification under section 3.3 of this Order. The NASA Office of Protective Services shall prioritize the review of such records in coordination with the Center Protective Service Offices.

(2) The Archivist shall conduct a systematic declassification review program for classified records:

(i) Accessioned into the National Archives;

(ii) Transferred to the Archivist pursuant to 44 U.S.C. 2203; and

(iii) For which the National Archives serves as the custodian for an agency or organization that has gone out of existence.

(3) The Chairperson, NISPC, shall designate experienced personnel to assist the Archivist in the systematic review of U.S. originated information and foreign information exempted from automated declassification. Such personnel shall:

(i) Provide guidance and assistance to the National Archives and Records Service in identifying and separating documents and specific categories of information within documents which are deemed to require continued classification; and

(ii) Develop reports of information or document categories so separated, with recommendations concerning continued classification.

(iii) Develop, in coordination with NASA organizational elements, guidelines for the systematic review for declassification of classified information under NASA's jurisdiction. The guidelines shall state specific limited categories of information which, because of their national security sensitivity, should not be declassified automatically, but should be reviewed to determine whether continued protection beyond 25 years is needed. These guidelines are authorized for use by the Archivist and the Director of the Information Security Oversight Office, with the approval of the Senior Agency Official, which is the Assistant Administrator, Office of Protective Services, for categories listed in section 3.3 of the Order. These guidelines shall be reviewed at least every five years and revised as necessary, unless an earlier review for revision is requested by the Archivist. Copies of the declassification guidelines promulgated by NASA will be provided to the Information Security Oversight Office, National Archives and Records Administration (NARA). All security classified records exempt from automatic declassification, whether held in storage areas under installation control or in Federal Records Centers, will be surveyed to identify those requiring scheduling for future disposition.

(A) Classified information or material over which NASA exercises exclusive or final original classification authority and which is to be declassified in accordance with the systematic review guidelines shall be so marked.

(B) Classified information or material over which NASA exercises exclusive or final original classification authority and which, in accordance with the systematic review guidelines is to be kept protected, shall be listed by category by the responsible custodian and referred to the Chairperson, NASA Information Security Program Committee. This listing shall:

(1) Identify the information or material involved.

(2) Recommend classification beyond 25 years to a specific event scheduled to happen or a specific period of time in accordance with the Order.

(3) The Administrator shall delegate to the Senior Agency Official the authority to determine which category shall be kept classified and the dates or event for declassification.

(4) Declassification by the Director of the Information Security Oversight Office (DISOO). If the Director determines that NASA information is classified in violation of the Order, the Director may require the information to be declassified. Any such decision by the Director may be appealed through the NASA ISPC to the National Security Council. The information shall remain classified pending a prompt decision on the appeal.

(b) [Reserved]

25. Amend § 1203.604 as follows:

a. Revise paragraphs (a) and (b).

b. Amend (c)(1) by removing the words “installation which originated the information” and adding in their place the words “Office of Protective Services”.

c. Revise paragraph (c)(2).

d. Amend paragraph (d)(1) by removing the words “shall be processed in accordance with part 1206 of this chapter” and adding in their place the words “cannot be processed under the MDR process”.

e. Revise paragraphs (d)(2) through (4).

f. Revise paragraphs (e)(1), (3) and (5).

g. Amend paragraph (e)(2) by removing the word “installation” and adding in its place the words “Office of Protective Services”.

h. Revise paragraph (g)(2)

The revisions read as follows:.

§ 1203.604

Mandatory review for declassification.

(a) Information covered. Except as provided in paragraph (b) of this section, all information classified under the Order or predecessor orders shall be subject to a review for declassification by the originating agency if:

(1) The request for a review describes the document or material containing the information with sufficient specificity to enable the agency to locate it in a reasonably timely manner;

(2) The document or material containing the information responsive to the request is not contained within an operational file exempted from search and review, publication, and disclosure under 5 U.S.C. 552 in accordance with law; and

(3) The information is not the subject of pending litigation.

(b) Presidential papers. Information originated by the President or Vice President; the President's White House Staff, or the Vice President's Staff; committees, commissions, or boards appointed by the President; or other entities within the Executive Office of the President that solely advise and assist the President are exempted from the provisions of paragraph (a) of this section. However, the Archivist shall have the authority to review, downgrade, and declassify papers or records of former Presidents and Vice Presidents under the control of the Archivist pursuant to 44 U.S.C. 2107, 2111, 2111 note, or 2203. Procedures developed by the Archivist shall provide for consultation with agencies having primary subject matter interest and shall be consistent with the provisions of applicable laws or lawful agreements that pertain to the respective Presidential papers or records. Agencies with primary subject matter interest shall be notified promptly of the Archivist's decision. Any final decision by the Archivist may be appealed by the requester or an agency to the Panel. The information shall remain classified pending a decision on the appeal.

(c) * * *

(2) For the most expeditious action, requests from other Governmental agencies or from members of the public should be submitted directly to the NASA Office of Protective Services only. The requestor may submit the request to: National Aeronautics and Space Administration (NASA), Central Registry, 300 E Street SW., Washington DC 20546, Attention: Office of Protective Services/Information Security Program Manager. The phrase, “Mandatory Declassification Review,” must be stated in the request.

(d) * * *

(2) The request describes the document or material containing the information with sufficient specificity, such as accession numbers, box titles or numbers, date and title of document, in any combination, to enable NASA to locate it with a reasonable amount of effort, not to exceed 30 days. If more time is required, NASA will notify the requester. After review, the information or any portion thereof that no longer requires protection shall be declassified and released unless withholding is otherwise warranted under applicable law.

(3) The requester shall be asked to correct a request that does not comply with paragraph (d)(2) of this section, to provide additional information, or to narrow the scope of the request; and shall be notified that no action will be taken until the requester complies.

(4) If the request requires the rendering of services for which fees may be charged under 31 U.S.C. 483a (1976), the rates prescribed in § 1206.700 shall be used, as appropriate.

(e) * * *

(1) The NASA Office of Protective Services review upon receiving the initial request shall be completed within 365 days.

* * * * *

(3) All appeals of denials of requests for declassification shall be acted upon and determined finally within 120 working days after receipt, and the requester shall be advised that the appeal determination is final. If the requester is dissatisfied with NASA's appeal decision, the requester may initiate an appeal to the Interagency Security Classification Appeals Panel (ISCAP), within the Information Security Oversight Office. If continued classification is required under the provisions of this part 1203, the requester shall be notified of the reasons thereof.

* * * * *

(5) When the NASA Office of Protective Services receives any request for declassification of information in documents in its custody that was classified by another Government agency, it shall refer copies of the request and the requested documents to the originating agency for processing and may, after consultation with the originating agency, inform the requester of the referral.

* * * * *

(g) * * *

(2) Material not officially transferred. When NASA has in its possession classified information or material originated by an agency which has since ceased to exist and that information has not been officially transferred to another department or agency or when it is impossible for NASA to identify the originating agency and a review of the material indicates that it should be downgraded or declassified, NASA shall be deemed to be the originating agency for the purpose of declassifying or downgrading such material. NASA will consult with the Information Security Oversight Office to assist in final disposition of the information.

* * * * *

Subpart G—[Removed and Reserved]

26. Remove and reserve Subpart G, consisting of §§ 1203.700 through 1203.703.

Subpart H—Delegation of Authority To Make Determinations in Original Classification Matters

27. Revise § 1203.800, § 1203.801 and § 1203.802 to read as follows:

§ 1203.800

Establishment.

Pursuant to Executive Order 13526, “Classified National Security Information,” and The Space Act, in accordance with U.S.C. Title 51, National and Commercial Space Program Sections 20132 and 20133, there is established a NASA Information Security Program Committee (as part of the permanent administrative structure of NASA). The NASA Assistant Administrator for Protective Services, or designee, shall be the Chairperson of the Committee. The Information Security Program Manager, NASA Office of Protective Services, is designated to act as the Committee Executive Secretary.

§ 1203.801

Responsibilities.

(a) The Chairperson reports to the Administrator concerning the management and direction of the NASA Information Security Program as provided for in subpart B of this part. In this connection, the Chairperson is supported and advised by the Committee.

(b) The Committee shall act on all appeals from denials of declassification requests and on all suggestions and complaints with respect to administration of the NASA Information Security Program as provided for in subpart B of this part.

(c) The Executive Secretary of the Committee shall maintain all records produced by the Committee, its subcommittees, and its ad hoc panels.

(d) The Office of Protective Services will provide staff assistance and investigative and support services for the Committee.

§ 1203.802

Membership.

The Committee membership will consist of the Chairperson, the Executive Secretary, and one person nominated by each of the following NASA officials:

(a) The Associate Administrators for:

(1) Aeronautics.

(2) Science Missions Directorate.

(3) Human Explorations and Operations.

(4) International and Interagency Relations.

(b) The Associate Administrator.

(c) The General Counsel.

(d) The Chief Information Officer.

(e) Other members may be designated upon specific request of the Chairperson.

28. Add § 1203.803 and § 1203.804 to subpart H to read as follows:

§ 1203.803

Ad hoc committees.

The Chairperson is authorized to establish such ad hoc panels or subcommittees as may be necessary in the conduct of the Committee's work.

§ 1203.804

Meetings.

(a) Meetings will be held at the call of the Chairperson.

(b) Records produced by the Committee and the minutes of each meeting will be maintained by the Executive Secretary.

Subpart I—NASA Information Security Program Committee

29. Revise § 1203.900 to read as follows:

§ 1203.900

Establishment.

Pursuant to Executive Order 13526, “Classified National Security Information,” and The Space Act, in accordance with U.S.C. Title 51, National and Commercial Space Program Sections 20132 and 20133, there is established a NASA Information Security Program Committee (as part of the permanent administrative structure of NASA. The NASA Assistant Administrator for Protective Services, or designee, shall be the Chairperson of the Committee. The Information Security Program Manager, NASA Office of Protective Services, is designated to act as the Committee Executive Secretary.

§ 1203.901

[Amended]

30. Amend § 1203.901, in paragraph (d), by removing the words “NASA Security Office, NASA Headquarters” and adding in their place the “Office of Protective Services”.

31. Add subpart J to read as follows:

Subpart J—Special Access Programs (SAP) and Sensitive Compartmented Information (SCI) Programs

1203.1000

General.

1203.1001

Membership.

1203.1002

Ad hoc committees.

1203.1003

Meetings.

Subpart J—Special Access Programs (SAP) and Sensitive Compartmented Information (SCI) Programs

§ 1203.1000

General.

A SAP or SCI program shall be created within NASA only upon specific written approval of the Administrator and must be coordinated with the Assistant Administrator for Protective Services, or designee, to ensure required security protocols are implemented and maintained.

§ 1203.1001

Membership.

The Committee membership will consist of the Chairperson, the Executive Secretary, and one person nominated by each of the following NASA officials:

(a) The Associate Administrators for:

(1) Aeronautics.

(2) Science Missions Directorate.

(3) Human Explorations and Operations.

(4) International and Interagency Relations.

(b) The Associate Administrator.

(c) The General Counsel.

(d) The Chief Information Officer.

(e) Other members may be designated upon specific request of the Chairperson.

§ 1203.1002

Ad hoc committees.

The Chairperson is authorized to establish such ad hoc panels or subcommittees as may be necessary in the conduct of the Committee's work.

§ 1203.1003

Meetings.

(a) Meetings will be held at the call of the Chairperson.

(b) Records produced by the Committee and the minutes of each meeting will be maintained by the Executive Secretary.

Charles F. Bolden, Jr.,

Administrator.