2011-4063. Information Security Program

AGENCY:

Federal Maritime Commission.

ACTION:

Final rule.

SUMMARY:

The Federal Maritime Commission (FMC or Commission) amends its regulations relating to its Information Security Program to reflect the changes implemented by Executive Order 13526—Classified National Security Information—that took effect January 5, 2010, and which prescribes a uniform system for classifying, safeguarding, and declassifying national security information, including information relating to defense against transnational terrorism.

DATES:

Effective February 28, 2011.

FOR FURTHER INFORMATION CONTACT:

Rebecca A. Fenneman, General Counsel, Federal Maritime Commission, 800 North Capitol Street, NW., Washington, DC 20573, [phone], [e-mail].

SUPPLEMENTARY INFORMATION:

The FMC amends Subpart F of Part 503 of Title 46 of the Code of Federal Regulations to reflect the changes implemented by Executive Order 13526—Classified National Security Information—that took effect January 5, 2010, which prescribes a uniform system for classifying, safeguarding, and declassifying national security information, including information relating to defense against transnational terrorism.

Because the changes made in this proceeding only address agency operating procedure and practice, which do not require notice and public comment pursuant to the Administrative Procedure Act, 5 U.S.C. 553, this rule is published as final.

This rule is not a “major rule” under 5 U.S.C. 804(2).

List of Subjects in 46 CFR Part 503

• Freedom of Information Act
• Privacy
• Sunshine Act

For the reasons stated in the SUPPLEMENTARY INFORMATION, the Federal Maritime Commission amends 46 CFR part 503 as follows.

PART 503—PUBLIC INFORMATION

1. Revise the authority citation for part 503 to read as follows:

Authority: 5 U.S.C. 552, 552a, 552b, 553; 31 U.S.C. 9701; E.O. 13526 of January 5, 2010 (75 FR 707), sections 5.1(a) and (b).

2. Amend § 503.51 by revising paragraphs (i)(3), (j), (p), and (q) to read as follows:

§ 503.51

Definitions.

* * * * *

(i) * * *

(3) Information received and treated as “Foreign Government Information” under the terms of Executive Order 13526 or any predecessor order.

(j) Mandatory declassification review means the review for declassification of classified information in response to a request for declassification that meets the requirements under section 3.5 of Executive Order 13526.

* * * * *

(p) Self-inspection means the internal review and evaluation of individual Commission activities and the Commission as a whole with respect to the implementation of the program established under Executive Order 13526 and its implementing directives.

(q) Senior agency official means the official designated by the Chairman under section 5.4(d) of Executive Order 13526 to direct and administer the Commission's program under which classified information is safeguarded.

* * * * *

3. Revise § 503.52 to read as follows:

§ 503.52

Senior agency official.

The Managing Director is designated as Senior Agency Official of the Commission, and shall be responsible for directing, administering and reporting on the Commission's information security program, which includes oversight (self-inspection) and security information programs to ensure effective implementation of Executive Orders 13526 and 12968 and 32 CFR part 2001.

4. Amend § 503.53 by revising the introductory text and paragraphs (a) and (d) to read as follows:

§ 503.53

Oversight Committee.

An Oversight Committee is established, under the chairmanship of the Senior Agency Official with the following responsibilities:

(a) Establish a Commission security education program to familiarize all personnel who have or may have access to classified information with the provisions of Executive Order 13526 and directives of the Information Security Oversight Office. The program shall include initial, refresher, and termination briefings;

* * * * *

(d) Recommend appropriate administrative action to correct abuse or violations of any provision of Executive Order 13526; and

* * * * *

5. Amend § 503.54 by revising paragraphs (b) and (c) to read as follows:

§ 503.54

Original classification.

* * * * *

(b) If a Commission Member or employee develops information that appears to require classification, or receives any foreign government information as defined in section 6.1(s) of Executive Order 13526, the Member or employee shall immediately notify the Senior Agency Official and appropriately protect the information.

(c) If the Senior Agency Official believes the information warrants classification, it shall be sent to the appropriate agency with original classification authority over the subject matter, or to the Information Security Oversight Office, for review and a classification determination.

* * * * *

6. Amend § 503.55 as follows:

a. In paragraph (a) introductory text by removing the reference “ Executive Order 12958” and adding the reference “Executive Order 13526” in its place; and

b. By adding paragraphs (c)(1) and (2) to read as follows:

§ 503.55

Derivative classification.

* * * * *

(c) * * *

(1) Classification authority. The authority for classification shall be shown as follows:

(i) “Classified by (description of source documents or classification guide),” or

(ii) “Classified by multiple sources,” if a document is classified on the basis of more than one source document or classification guide.

(iii) In these cases, the derivative classifier shall maintain the identification of each source with the file or record copy of the derivatively classified document. A document derivatively classified on the basis of a source document that is marked “Classified by Multiple Sources” shall cite the source document in its “Classified by” line rather than the term “Multiple sources.”

(2) Declassification and downgrading instruction s. Date or events for automatic declassification or downgrading, or the notation “Originating Agency's Determination Required” to indicate that the document is not to be declassified automatically, shall be carried forward from the source document, or as directed by a classification guide, and shown on “declassify on” line as follows:

“Declassify on: (date, description of event);” or “Originating Agency's Determination Required (OADR).”

7. In § 503.56, revise paragraph (a) to read as follows:

§ 503.56

General declassification and downgrading policy.

(a) The Commission exercises declassification and downgrading authority in accordance with section 3.1 of Executive Order 13526, only over that information originally classified by the Commission under previous Executive Orders. Declassification and downgrading authority may be exercised by the Commission Chairman and the Senior Agency Official, and such others as the Chairman may designate. Commission personnel may not declassify information originally classified by other agencies.

* * * * *

8. Revise § 503.57 to read as follows:

§ 503.57

Mandatory review for declassification.

(a) Reviews and referrals in response to requests for mandatory declassification shall be conducted in compliance with section 3.5 of Executive Order 13526, 32 CFR 2001.33, and 32 CFR 2001.34.

(b) Any individual may request a review of classified information and material in possession of the Commission for declassification. All information classified under Executive Order 13526 or a predecessor Order shall be subject to a review for declassification by the Commission, if:

(1) The request describes the documents or material containing the information with sufficient specificity to enable the Commission to locate it with a reasonable amount of effort. Requests with insufficient description of the material will be returned to the requester for further information.

(2) The information requested is not the subject of pending litigation.

(3) The information requested has not been reviewed for declassification in the previous two years. If so, the FMC shall inform the requester of this fact and provide the requester with appeal rights in accordance with 32 CFR 2001.33(a)(2)(iii).

(c) Requests shall be in writing, and shall be sent to: Office of the Managing Director, Attn.: Senior Agency Official, Federal Maritime Commission, Washington, DC 20573 or submitted via the FMC's on-line declassification information portal which provides an e-mail address through which requests can be submitted: http://www.http://www.fmc.gov/​about/​web_​policies_​notices_​and_​acts.aspx.

(d) If the request requires the provision of services by the Commission, fair and equitable fees may be charged pursuant to 31 U.S.C. 9701.

(e) Requests for mandatory declassification reviews shall be acknowledged by the Commission within 15 days of the date of receipt of such requests.

(f) If the document was derivatively classified by the Commission or originally classified by another agency, the request, the document, and a recommendation for action shall be forwarded to the agency with the original classification authority. The Commission may, after consultation with the originating agency, inform the requester of the referral.

(g) If a document is declassified in its entirety, it may be released to the requester, unless withholding is otherwise warranted under applicable law. If a document or any part of it is not declassified, the Senior Agency Official shall furnish the declassified portions to the requester unless withholding is otherwise warranted under applicable law, along with a brief statement concerning the reasons for the denial of the remainder, and the right to appeal that decision to the Commission appellate authority within 60 days.

(h) If a declassification determination cannot be made within 45 days, the requester shall be advised that additional time is needed to process the request. Final determination shall be made within one year from the date of receipt of the request. The Commission shall inform the requester in writing of the final determination and of the reasons for any denials. The Commission shall inform the requester in writing of his or her final appeal rights to the Interagency Security Classification Appeals Panel.

(i) When a request has been submitted both under mandatory declassification review and the Freedom of Information Act (FOIA), the agency shall require the requester to select one process or the other. If the requester fails to select one process or the other, the request will be treated as a FOIA request unless the requested materials are subject only to mandatory declassification review.

9. Revise § 503.58 to read as follows:

§ 503.58

Appeals of denials of mandatory declassification review requests.

(a) Within 60 days after the receipt of denial of a request for mandatory declassification review, the requester may submit an appeal in writing to the Chairman through the Secretary, Federal Maritime Commission, Washington, DC 20573. The appeal shall:

(1) Identify the document in the same manner in which it was identified in the original request;

(2) Indicate the dates of the request and denial, and the expressed basis for the denial; and

(3) State briefly why the document should be declassified.

(b) The Chairman shall rule on the appeal within 60 working days of receiving it. If additional time is required to make a determination, the Chairman shall notify the requester of the additional time needed and provide the requester with the reason for the extension. The Chairman shall notify the requester in writing of the final determination and the reasons for any denial.

(c) In accordance with section 5.3 of Executive Order 13526 and 32 CFR 2001.33, within 60 days of such issuance, the requester may appeal a final determination of the Commission under paragraph (b) of this section to the Interagency Security Classification Appeals Panel. The appeal should be addressed to, Executive Secretary, Interagency Security Classification Appeals Panel, Attn: Classification Challenge Appeals, c/o Information Security Oversight Office, National Archives and Records Administration, 7th and Pennsylvania Avenue, NW., Room 5W, Washington, DC 20408.

10. Amend § 503.59 by revising paragraphs (f) introductory text, (g)(2), (k), (m), (n), (o), (q)(1) through (3), (r), and (s) to read as follows:

§ 503.59

Safeguarding classified information.

* * * * *

(f) Waivers under paragraph (e) of this section may be granted when the Commission Senior Agency Official:

* * * * *

(g) * * *

(2) To protect the classified information in accordance with the provisions of Executive Order 13526; and

* * * * *

(k) An inventory of all documents classified higher than confidential shall be made at least annually and whenever there is a change in classified document custodians. The Senior Agency Official shall be notified, in writing, of the results of each inventory.

* * * * *

(m) Combinations to dial-type locks shall be changed only by persons having an appropriate security clearance, and shall be changed whenever such equipment is placed in use; whenever a person knowing the combination no longer requires access to the combination; whenever a combination has been subject to possible compromise; whenever the equipment is taken out of service; and at least once each year. Records of combinations shall be classified no lower than the highest level of classified information to be stored in the security equipment concerned. One copy of the record of each combination shall be provided to the Senior Agency Official.

(n) Individuals charged with the custody of classified information shall conduct the necessary inspections within their areas to insure adherence to procedural safeguards prescribed to protect classified information. The Commission Senior Agency Official shall conduct periodic inspections to determine if the procedural safeguards prescribed in this subpart are in effect at all times.

(o) Whenever classified material is to be transmitted outside the Commission, the custodian of the classified material shall contact the Commission Senior Agency Official for preparation and receipting instructions. If the material is to be hand carried, the Senior Agency Official shall ensure that the person who will carry the material has the appropriate security clearance, is knowledgeable of safeguarding requirements, and is briefed, if appropriate, concerning restrictions with respect to carrying classified material on commercial carriers.

* * * * *

(q) * * *

(1) Knowingly, willfully, or negligently disclose to unauthorized persons information properly classified under Executive Order 13526 or predecessor orders;

(2) Knowingly and willfully classify or continue the classification of information in violation of Executive Order 13526 or any implementing directive; or

(3) Knowingly and willfully violate any other provision of Executive Order 13526 or implementing directive.

(r) Any person who discovers or believes that a classified document is lost or compromised shall immediately report the circumstances to his or her supervisor and the Commission Senior Agency Official, who shall conduct an immediate inquiry into the matter.

(s) Questions with respect to the Commission Information Security Program, particularly those concerning the classification, declassification, downgrading, and safeguarding of classified information, shall be directed to the Commission Senior Agency Official.

By the Commission.

Karen V. Gregory,

Secretary.