2011-16810. Tennessee Valley Authority Procedures

AGENCY:

Tennessee Valley Authority (TVA).

ACTION:

Final rule.

SUMMARY:

The Tennessee Valley Authority is amending its regulations which currently contain TVA's procedures for the Freedom of Information Act (FOIA), the Privacy Act, and the Government in the Sunshine Act. TVA is adding procedures related to classified national security information.

DATES:

Effective Date: July 6, 2011.

FOR FURTHER INFORMATION CONTACT:

Mark R. Winter, Senior Information Security Specialist, 1101 Market Street (MP 3C), Tennessee Valley Authority, Chattanooga, Tennessee 37402, [phone]. E-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

This rule was not published in proposed form since it relates to agency procedure and practice. TVA considers this rule to be a procedural rule which is exempt from notice and comment under 5 U.S.C. 533(b)(3)(A). This rule is not a significant rule for purposes of Executive Order 12866 and has not been reviewed by the Office of Management and Budget. As required by the Regulatory Flexibility Act, TVA certifies that these regulatory amendments will not have a significant impact on small business entities. This rule does not impose any new reporting or record-keeping requirements subject to the Paperwork Reduction Act, 44 U.S.C. Chapter 35, as amended.

On December 29, 2009, Executive Order 13526, Classified National Security Information, was published in the Federal Register. This order prescribes a uniform system for classifying, safeguarding, and declassifying national security information. On June 28, 2010, the Information Security Oversight Office (ISOO) published its directive, 32 CFR Part 2001, Classified National Security Information, for implementing the Executive Order at 75 Federal Register 37254.

Since this rule is non-substantive, it is being made effective July 6, 2011.

List of Subjects in 18 CFR Part 1301

• Freedom of information
• Government in the sunshine
• Privacy

For the reasons stated in the preamble, TVA amends 18 CFR part 1301 by adding Subpart E, Protection of National Security Classified Information, as follows:

PART 1301—PROCEDURES

Subpart E—Protection of National Security Classified Information

1301.61

Purpose and scope.

1301.62

Definitions.

1301.63

Senior agency official.

1301.64

Original classification authority.

1301.65

Derivative classification.

1301.66

General declassification and downgrading policy.

1301.67

Mandatory review for declassification.

1301.68

Identification and marking.

1301.69

Safeguarding classified information.

Subpart E—Protection of National Security Classified Information

§ 1301.61

Purpose and scope.

(a) Purpose. These regulations, taken together with the Information Security Oversight Office's implementing directive at 32 CFR Part 2001, Classified National Security Information, provide the basis for TVA's security classification program implementing Executive Order 13526, “Classified National Security Information,” as amended (“the Executive Order”).

(b) Scope. These regulations apply to TVA employees, contractors, and individuals who serve in advisory, consultant, or non-employee affiliate capacities who have been granted access to classified information.

§ 1301.62

Definitions.

The following definitions apply to this part:

(a) “Original classification” is the initial determination that certain information requires protection against unauthorized disclosure in the interest of national security (i.e., national defense or foreign relations of the United States), together with a designation of the level of classification.

(b) “Classified national security information” or “classified information” means information that has been determined pursuant to Executive Order 13526 or any predecessor order to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.

§ 1301.63

Senior agency official.

(a) The Executive Order requires that each agency that originates or handles classified information designate a senior agency official to direct and administer its information security program. TVA's senior agency official is the Director, Enterprise Information Security & Policy.

(b) Questions with respect to the Information Security Program, particularly those concerning the classification, declassification, downgrading, and safeguarding of classified information, shall be directed to the Senior Agency Official.

§ 1301.64

Original classification authority.

(a) Original classification authority is granted by the Director of the Information Security Oversight Office. TVA does not have original classification authority.

(b) If information is developed that appears to require classification, or is received from any foreign government information as defined in section 6.1(s) of Executive Order 13526, the individual in custody of the information shall immediately notify the Senior Agency Official and appropriately protect the information.

(c) If the Senior Agency Official believes the information warrants classification, it shall be sent to the appropriate agency with original classification authority over the subject matter, or to the Information Security Oversight Office, for review and a classification determination.

(d) If there is reasonable doubt about the need to classify information, it shall be safeguarded as if it were classified pending a determination by an original classification authority. If there is reasonable doubt about the appropriate level of classification, it shall be safeguarded at the higher level of classification pending a determination by an original classification authority.

§ 1301.65

Derivative classification.

(a) In accordance with Part 2 of Executive Order 13526 and directives of the Information Security Oversight Office, the incorporation, paraphrasing, restating or generation in new form of information that is already classified, and the marking of newly developed material consistent with the classification markings that apply to the source information, is derivative classification.

(1) Derivative classification includes the classification of information based on classification guidance.

(2) The duplication or reproduction of existing classified information is not derivative classification.

(b) Authorized individuals applying derivative classification markings shall:

(1) Observe and respect original classification decisions; and

(2) Carry forward to any newly created documents the pertinent classification markings.

(3) For information derivatively classified based on multiple sources, the authorized individuals shall carry forward:

(i) The date or event for declassification that corresponds to the longest period of classification among the sources; and

(ii) A listing of these sources on or attached to the official file or record copy.

(c) Documents classified derivatively shall bear all markings prescribed by 32 CFR 2001.20 through 2001.23 and shall otherwise conform to the requirements of 32 CFR 2001.20 through 2001.23.

§ 1301.66

General declassification and downgrading policy.

(a) TVA does not have original classification authority.

(b) TVA personnel may not declassify information originally classified by other agencies.

§ 1301.67

Mandatory review for declassification.

(a) Reviews and referrals in response to requests for mandatory declassification shall be conducted in compliance with section 3.5 of Executive Order 13526, 32 CFR 2001.33, and 32 CFR 2001.34.

(b) Any individual may request a review of classified information and material in possession of TVA for declassification. All information classified under Executive Order 13526 or a predecessor Order shall be subject to a review for declassification by TVA, if:

(1) The request describes the documents or material containing the information with sufficient specificity to enable TVA to locate it with a reasonable amount of effort. Requests with insufficient description of the material will be returned to the requester for further information.

(2) The information requested is not the subject of pending litigation.

(c) Requests shall be in writing, and shall be sent to: Director, Enterprise Information Security & Policy, Tennessee Valley Authority, 1101 Market St., Chattanooga, TN 37402.

§ 1301.68

Identification and marking.

(a) Classified information shall be marked pursuant to the standards set forth in section 1.6, Identification and Marking, of the Executive Order; Information Security Oversight Office implementing directives in 32 CFR part 2001, subpart B; and internal TVA procedures.

(b) Foreign government information shall retain its original classification markings or be marked and classified at a U.S. classification level that provides a degree of protection at least equivalent to that required by the entity that furnished the information. Foreign government information retaining its original classification markings need not be assigned a U.S. classification marking provided the responsible agency determines that the foreign government markings are adequate to meet the purposes served by U.S. classification markings.

(c) Information assigned a level of classification under predecessor executive orders shall be considered as classified at that level of classification.

§ 1301.69

Safeguarding classified information.

(a) All classified information shall be afforded a level of protection against unauthorized disclosure commensurate with its level of classification.

(b) The Executive Order and the Information Security Oversight Office implementing directive provides information on the protection of classified information. Specific controls on the use, processing, storage, reproduction, and transmittal of classified information within TVA to provide protection for such information and to prevent access by unauthorized persons are contained in internal TVA procedures.

(c) Any person who discovers or believes that a classified document is lost or compromised shall immediately report the circumstances to their supervisor and the Senior Agency Official, who shall conduct an immediate inquiry into the matter.

Michael T. Tallent,

Director, Enterprise Information Security & Policy (Acting).