SBU -- Sensitive But Unclassified information, and FOUO -- For Official Use Only
The term “sensitive but unclassified” has been around since 1977, but it was given new weight by the Homeland Security Act and regulations subsequently issued by the Department of Homeland Security.
Initially, SBU was used to denote unclassified national security information that might nonetheless be “useful to an adversary.” Interestingly, when the National Security Agency expanded that usage to encompass “other government interests” back in 1986, Congress objected and the NSA backed off.
The Homeland Security Act authorized DHS to identify and safeguard “sensitive unclassified information” but didn’t define the term. It also allowed DHS to share this information with local and state government officials and private individuals, such as public health and medical professionals, and to require them to sign binding non-disclosure agreements. By one estimate, that might be as many as four million people.
DHS issued an internal directive on May 11, 2004 which it titled “Safeguarding Sensitive but Unclassified Information.” The directive said employees should mark as “For Official Use Only” any “sensitive but unclassified information” the department generated or that was received by DHS from other government and non-governmental sources. The directive was itself labeled For Official Use Only and became public only after the Federation of American Scientists filed an FOIA request.
It defines SBU as information whose “unauthorized disclosure could adversely impact a person's privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.” The definition allows maximum individual discretion
Other critical elements:
No clearance of any kind is needed to handle these documents, only a loosely defined “need to know.” However, anyone given access to the information is required to sign a non-disclosure agreement. That includes employees of the department. By comparison, anyone given access to classified documents must go through a clearance process.
Any DHS employee or DHS contractor can decide if a document should be designated as SBU if it falls within one of eleven categories of information. That’s two more categories of exemption than provided under the Freedom of Information Act. In the nation’s classification system, only those specially trained can secure documents as Top Secret, etc.
DHS provides for no internal or external oversight to its document-marking decisions. In contrast, the classification system provides for oversight by an Information Security Oversight Office, which is sometimes quite critical of the process.
There is no time limit on the withholding of this “sensitive” information. By contrast, classification laws provide for declassification, in most cases automatically after 10 years. DHS regulations on sensitive but unclassified say that, "information designated as FOUO (For Official Use Only) will retain its designation until determined otherwise by the originator or a supervisory or management official having program management responsibility over the originator and/or the information."
There is one transparency-saving element. Records marked FOUO are still subject to FOIA. That means it’s at least theoretically possible to get a copy.
