SHSI – Sensitive Homeland Security Information
SHSI, pronounced like the raw seafood, is a term that has been has used in a variety of iterations but not yet formally defined. From what is known, it appears SHSI will include both classified and sensitive but unclassified information and that it will apply to any information shared within the federal government or with state and local governments. The latter would be bound to confidentiality by non-disclosure agreements.
The Department of Homeland Security is reportedly drafting regulations governing the safeguarding of SHSI, but these have not yet been seen outside the department.
The term is not used in the Homeland Security Act which sets the parameters in two paragraphs that deal with the sharing of information.
“(3) The Federal Government collects, creates, manages, and protects classified and sensitive but unclassified information to enhance homeland security.
(4) Some homeland security information is needed by the State and local personnel to prevent and prepare for terrorist attack.
In March 2002, White House Chief of Staff Andrew Card sent out a memo that directed agencies to revisit procedures for protecting sensitive documents related to homeland security and “information that could be misused to harm the security of our Nation and the safety of our people.” It said agencies should review information in its files to determined which documents should be classified that weren’t, and what other information should be treated as sensitive even though not classified.
Based on the Card memorandum and its attachments, “sensitive but unclassified” homeland security information could include records that deal with the agency, public infrastructure the agency might regulate or monitor, some internal databases (reports, data the agency has collected, maps, etc.), vulnerability assessments, and information provided to the government by private firms, such as chemical companies.
DHS further defined SBU in an internal memo of May 11, 2004 as information whose “unauthorized disclosure could adversely impact a person's privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.” That’s potentially a lot more than national security information so presumably it will be modified when incorporated into any SHSI definition.
Meanwhile, the Nuclear Regulatory Commission has offered its own interim definition as “information, generated by NRC, our licensees, or our contractors, that would clearly aid in planning an assault on a facility.... Physical vulnerabilities or weaknesses of nuclear facilities.... Construction details of specific facilities.... Information which clearly would be useful to defeat or breach key barriers at nuclear facilities… and information … that provides the current status or configuration of systems and equipment that could be used to determine facility vulnerabilities.”
And the Agriculture Department said it would use the term to designate information that on facilities, critical infrastructure and cyber-based systems that would be made available only on a need-to-know basis.
