Classified information is sensitive information to which access is restricted by law or regulation to particular groups of persons. A formal security clearance is required to handle classified documents or access classified data. The clearance process requires a satisfactory background investigation. There are typically several levels (classes) of sensitivity, with differing clearance requirements. This sort of hierarchical system of secrecy is used by virtually every national government. The act of assigning the level of sensitivity to data is called data classification.
A distinction could be made between formal security classification and privacy markings such as "Commercial in confidence".
Some corporations and non-government organizations also assign sensitive information to multiple levels of protection, either from a desire to protect trade secrets, or because of laws and regulations governing various matters such as personal privacy, sealed legal proceedings and the timing of financial information releases.
The purpose of classification is ostensibly to protect information from being used to damage or endanger national security. Classification formalises what constitutes a "state secret" and accords different levels of protection based on the expected damage the information might cause in the wrong hands.
Although the classification systems vary from country to country, most have levels corresponding to the following British definitions (from the highest level to lowest):
All information processed by or through Europol, except information which is expressly marked or is clearly recognisable as being public information, is subject to a basic protection level within the Europol organisation as well as in the Member States of the European Union. Information which is only subject to the basic protection level does not require a specific marking of a Europol classification level, but shall be designated as Europol information.
The Parties shall ensure the basic protection level mentioned in paragraph 1 for all information exchanged under this Agreement, by a variety of measures, including the obligation of discretion and confidentiality, limiting access to information to authorised personnel, and general technical and procedural measures to safeguard the security of the information.
Information requiring additional security measures is subject to a classification level of the Republic of Moldova or Europol, which is indicated by a specific marking. Information is assigned such a classification level only where strictly necessary and for the time necessary.
The highest level of classification of material on a national level. Such material would cause "exceptionally grave damage" to national security if made publicly available.
This level is applicable only to information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of Europol(e.g.) or of one or more Member States.
Such material would cause "grave damage" to national security if it were publicly available.
Such material would cause "damage" or be "prejudicial" to national security if publicly available.
Such material would cause "undesirable effects" if publicly available. Some countries do not have such a classification.
Technically not a classification level, but is used for government documents that do not have a classification listed above. Such documents can sometimes be viewed by those without security clearance.
Depending on the level of classification there are different rules controlling the level of clearance needed to view such information, and how it must be stored, transmitted, and destroyed. Additionally, access is restricted on a "need to know" basis. Simply possessing a clearance does not automatically authorize the individual to view all material classified at that level or below that level. The individual must present a legitimate "need to know" in addition to the proper level of clearance.
In addition to the general risk-based classification levels above, often there are additional constraints on access, such as (in the U.S.) Special Intelligence (SI), which protects intelligence sources and methods, No Foreign dissemination (NOFORN), which restricts dissemination to U.S. nationals, and Originator Controlled dissemination (ORCON), which ensures that the originator can track possessors of the information. Documents in some compartments are marked with specific "code words" in addition to the classification level.
Government information about nuclear weapons such as nuclear warheads often has an additional marking to show it contains such information.
When a government agency or group shares information between an agency or group of other country’s government they will generally employ a special classification scheme that both parties have previously agreed to honour.
In example the marken ATOMAL, is applied to U.S. RESTRICTED DATA or FORMERLY RESTRICTED DATA and United Kingdom ATOMIC information that has been released to NATO. ATOMAL information is marked COSMIC TOP SECRET ATOMAL (CTSA), NATO SECRET ATOMAL (NSAT), or NATO CONFIDENTIAL ATOMAL (NCA).
In cases where a country wishes to share classified information bilaterally (or multilaterally) with a country that has a sharing agreement, the information is with the countries it can be shared with. Those countries would have to maintain the classification of the document at the level originally classified (TOP-SECRET, SECRET, etc.) with the appropriate caveat (USNZ, AUSGE, CANUK, etc.).
For example, sensitive information shared amongst NATO allies has four levels of security classification; from most to least classified:
A special case exists with regard to NATO UNCLASSIFIED (NU) information. Documents with this marking is NATO property (copyright) and must not be made public without NATO permission. In general documents with this classification, aren't cleared for internet-transmission either, unless clearly marked with RELEASABLE FOR INTERNET TRANSMISSION. Documents that can be made public however, should be clearly marked with NON SENSITIVE INFORMATION RELEASABLE TO THE PUBLIC.
In addition to the above classification levels NATO operates with
This level is given to people who need to have access to the joined Atomic program of NATO. This level is never given permanently to anyone, regardless of jobtitle - e.g. President of the US etc. It is only given for short periods of time, when needed.
Most countries employ some sort of classification system for certain government information. For example, in Canada, information that the U.S. would classify SBU (Sensitive but Unclassified) is called "protected" and further subcategorised into levels A, B, and C.
On the 19th of July 2011, the National security (NS) classification marking scheme and the non-national security (NNS) classification marking scheme in Australia was unified into one structure.
The Australian Government Security Classification system now comprises TOP SECRET, SECRET, CONFIDENTIAL and PROTECTED. A new dissemination limiting markers (DLMs) scheme was also introduced for information where disclosure may be limited or prohibited by legislation, or where it may otherwise require special handling. The DLM marking scheme comprises For Official Use Only (FOUO), Sensitive, Sensitive: Personal, Sensitive: Legal, and Sensitive Cabinet. [4]
Documents marked Sensitive Cabinet, relating to discussions in Federal Cabinet, are treated as PROTECTED at minimum due to its higher sensitivity.
Background checks for access to TOP SECRET material are carried out at either of two levels: at TOP SECRET NEGATIVE VETTING (TSNV), or at the more stringent and expensive TOP SECRET POSITIVE VETTING (TSPV) level, depending on the extent of required access to TOP SECRET material and on the potential damage to national security should such material be disclosed to unauthorised parties. Most background checks for access to TOP SECRET material are carried out at the TOP SECRET NEGATIVE VETTING level.
In Brazil, a top secret (Ultrassecreto) government-issued document may be classified for a period of 25 years, which may be extended up to another 25 years. Thus, no document remains classified for more than 50 years. This is mandated by the 2011 Information Access Law (Lei de Acesso à Informação), a change from the previous rule, under which documents could have their classification time length renewed indefinitely, effectively shuttering state secrets from the public. The new law applies retroactively to existing documents.
There are 2 main type of sensitive information designation used by the Government of Canada: Classified and Designated. The access and protection of both types of information is governed by the Security of Information Act, effective December 24, 2001, replacing the Official Secrets Act 1981.[5] To access the information, a person must have the appropriate level of clearance and a Need to know.
SOI is not a classification of data per se. It is defined under the Security of Information Act, and unauthorised release of such information constitutes a higher breach of trust, with penalty of life imprisonment.
SOIs include:
Classified information can be designated Top Secret, Secret or Confidential. These classifications are only used on matters of national interest.
Designated information is not classified. Designated information pertains to any sensitive information that does not relate to national security and cannot be disclosed under the access and privacy legislation because of the possible injury to particular public or private interests.[6][7]
Federal Cabinet (Queen's Privy Council for Canada) papers are either designated (i.e. overhead slides prepared to make presentations to Cabinet) or classified (draft legislations, certain memos).[8]
The Criminal Law of the People's Republic of China (which is not operative in the Special Administrative Regions of Hong Kong and Macao) makes it a crime to release a state secret. Regulation and enforcement is carried out by the National Administration for the Protection of State Secrets.
Under the 1989 "Law on Guarding State Secrets,"[9] state secrets are defined as those that concern:
Secrets can be classified into one of three categories:
In France, classified information defined by article 413-9 of the Penal Code.[11] The three levels of military classification are
Less sensitive information is "protected". The levels are
A further mention, "spécial France" (reserved France) restricts the document to French citizens (in its entirety or by extracts). This is not a classification level.
Declassification of documents can be done by the Commission consultative du secret de la défense nationale (CCSDN), an independent authority. Transfer of classified information is done with double envelopes, the outer layer being plastified and numbered, and the inner in strong paper. Reception of the document involves examination of the physical integrity of the container and registration of the document. In foreign countries, the document must be transferred through specialised military mail or diplomatic bag. Transport is done by an authorised convoyer or habilitated person for mail under 20 kg. The letter must bear a seal mentioning "PAR VALISE ACCOMPAGNEE-SACOCHE". Once a year, ministers have an inventory of classified information and supports by competent authorities.
Once their usage period is expired, documents are transferred to archives, where they are either destroyed (by incineration, crushing or electrical overtension), or stored.
In case of unauthorized release of classified information, competent authorities are the Ministry of Interior, the Haut fonctionnaire de défense et de sécurité ("high civil servant for defence and security") of the relevant ministry, and the General secretary for National Defence. Violation of such secrets is an offence punishable with 7 years of imprisonment and a 100 000 Euro fine; if the offence is committed by imprudence or negligence, the penalties are 3 years of imprisonment and a 45 000 Euro fine.
The Security Bureau is responsible for developing policies in regards to the protection and handling of confidential government information. In general, the system used in Hong Kong is very similar to the UK system, developed from the Colonial Hong Kong era.
Four classifications exists in Hong Kong, from highest to lowest in sensitivity:[12]
Restricted documents are not classified per se, but only those who have a need to know will have access to such information, in accordance with the Personal Data (Privacy) Ordinance.[13]
New Zealand uses the Restricted classification, which is lower than Confidential. People may be given access to Restricted information on the strength of an authorisation by their Head of Department, without being subjected to the background vetting associated with Confidential, Secret and Top Secret clearances. New Zealand's security classifications and the national-harm requirements associated with their use are roughly similar to those of the United States.
In addition to national security classifications there are two additional security classifications, In Confidence and Sensitive, which are used to protect information of a policy and privacy nature. There are also a number of information markings used within ministries and departments of the government, to indicate, for example, that information should not be released outside the originating ministry.
Because of strict privacy requirements around personal information, personnel files are controlled in all parts of the public and private sectors. Information relating to the security vetting of an individual is usually classified at the In Confidence level.
In the Russian Federation, a state secret (Государственная тайна) is information protected by the state on its military, foreign policy, economic, intelligence, counterintelligence, operational and investigative and other activities, dissemination of which could harm state security.
The Swedish classification has been updated due to increased NATO/PfP co-operation. All classified defence documents will now have both a Swedish classification (Kvalificerat Hemlig or Hemlig), and an English classification (Top Secret, Secret, Confidential or Restricted).
The United Kingdom currently uses five levels of classification — from lowest to highest, they are: PROTECT, RESTRICTED, CONFIDENTIAL, SECRET and TOP SECRET (formerly MOST SECRET). Those working with such material should have the relevant security clearance and often are required to sign to confirm their understanding and acceptance of the Official Secrets Acts 1911 to 1989, although the Act applies in the same way regardless of signature. PROTECT is not in itself a security protective marking level (such as RESTRICTED or greater), but is used to indicate information which should not be disclosed because, for instance, the document contains tax, or national insurance or other personal information.
Government documents without a classification may be marked as UNCLASSIFIED or NOT PROTECTIVELY MARKED.[14]
The U.S. classification system is currently established under Executive Order 13292 and has three levels of classification — Confidential, Secret, and Top Secret. The U.S. had a Restricted level during World War II but no longer does. U.S. regulations state that information received from other countries at the Restricted level should be handled as Confidential. A variety of markings are used for material that is not classified, but whose distribution is limited administratively or by other laws, e.g., For Official Use Only (FOUO), or Sensitive but Unclassified (SBU). The Atomic Energy Act of 1954 provides for the protection of information related to the design of nuclear weapons. The term "Restricted Data" is used to denote certain nuclear technology. Information about the storage, use or handling of nuclear material or weapons is marked "Formerly Restricted Data." These designations are used in addition to level markings (Confidential, Secret and Top Secret). Information protected by the Atomic Energy Act is protected by law and information classified under the Executive Order is protected by Executive privilege.
| (State) | Top Secret | Secret | Confidential | Restricted |
|---|---|---|---|---|
| Albania | Teper Sekret | Sekret | Konfidencial | I Kufizuar |
| Argentina | Estrictamente Secreto y Confidencial | Secreto | Confidencial | Reservado |
| Australia | Top Secret | Secret | Confidential | Protected |
| Austria | Streng Geheim | Geheim | Vertraulich | Eingeschränkt |
| Belgium (Dutch) | Zeer Geheim | Geheim | Vertrouwelijk | Beperkte Verspreiding |
| Belgium (French) | Très Secret | Secret | Confidentiel | Diffusion restreinte |
| Bolivia | Supersecreto or Muy Secreto |
Secreto | Confidencial | Reservado |
| Bosnia | Strogo Povjerljivo | Tajno | Konfidencialno | Restiktirano |
| Brazil | Ultra Secreto | Secreto | Confidencial | Reservado |
| Bulgaria | Строго секретно | Секретно | Поверително | За служебно ползване |
| Cambodia | Sam Ngat Bamphot | Sam Ngat Roeung | Art Kambang | Ham Kom Psay |
| Canada | Top Secret/Très secret | Secret/Secret | Confidential/Confidentiel | Protected A, B or C / Protégé A, B ou C |
| Chile | Secreto | Secreto | Reservado | Reservado |
| China, People's Republic of | Juémì (绝密) | Jīmì (机密) | Mìmì (秘密) | Nèibù (内部) |
| Colombia | Ultrasecreto | Secreto | Confidencial | Reserva del sumario |
| Costa Rica | Alto Secreto | Secreto | Confidencial | |
| Croatia | Vrlo tajno | Tajno | Povjerljivo | Ograničeno |
| Czech Republic | Přísně tajné | Tajné | Důvěrné | Vyhrazené |
| Denmark | Yderst Hemmeligt | Hemmeligt | Fortroligt | Til Tjenestebrug Foreign Service: |
| Ecuador | Secretisimo | Secreto | Confidencial | Reservado |
| Egypt | Sirriy lil-Ġāyah سري للغاية |
Sirriy Ǧiddan سري جداً |
Khāṣ خاص |
Maḥzūr محظور |
| El Salvador | Ultra Secreto | Secreto | Confidencial | Reservado |
| Estonia | Täiesti salajane | Salajane | Konfidentsiaalne | Piiratud |
| Ethiopia | Yemiaz Birtou Mistir | Mistir | Kilkil | |
| Finland | Erittäin salainen (TLL I) | Salainen (TLL II) | Luottamuksellinen (TLL III) | Viranomaiskäyttö (TLL IV) |
| France | Très secret défense | Secret défense | Confidentiel défense | Diffusion restreinte |
| Germany | Streng Geheim | Geheim | VS-Vertraulich | VS-Nur für den Dienstgebrauch |
| Greece | Άκρως Απόρρητον | Απόρρητον | Εμπιστευτικόν | Περιορισμένης Χρήσης |
| Guatemala | Alto Secreto | Secreto | Confidencial | Reservado |
| Haiti | Top Secret | Secret | Confidential | Reserve |
| Honduras | Super Secreto | Secreto | Confidencial | Reservado |
| Hong Kong | Top Secret, 高度機密 | Secret, 機密 | Confidential, 保密 | Restricted, 內部文件/限閱文件 |
| Hungary | Szigorúan Titkos | Titkos | Bizalmas | Korlátozott Terjesztésű |
| India (Hindi) | परम गुप्त (Param Gupt) | गुप्त (Gupt) | गोपनीय (Gopniya) | प्रतिबंधित/सीमित (Pratibandhit/seemit) |
| India (English) | Top Secret | Secret | Confidential | Restricted |
| Indonesia | Sangat Rahasia | Rahasia | Rahasia Dinas | Terbatas |
| Iran | Bekolli serri به کلّى سرّى | Serri سرّى | Kheili Mahramaneh خيلى محرمانه | Mahramaneh محرمانه |
| Iraq | Sirriy lil-Ġāyah سري للغاية |
Sirriy سري |
Khāṣ خاص |
Maḥdūd محدود |
| Iceland | Algert Leyndarmál | Leyndarmál | Þjónustuskjal | Trúnaðarmál |
| Ireland (Irish language) | An-sicreideach | Sicreideach | Runda | Srianta |
| Israel | Sodi Beyoter סודי ביותר |
Sodi סודי |
Shamur שמור |
Mugbal מוגבל |
| Italy | Segretissimo | Segreto | Riservatissimo | Riservato |
| Japan | Kimitsu, 機密 | Gokuhi, 極秘 | Hi, 秘 | Toriatsukaichuui, 取り扱い注意 |
| Jordan | Maktūm Ǧiddan مكتوم جداً |
Maktūm مكتوم |
Sirriy سري |
Maḥdūd محدود |
| Korea, South | I(Il)-Kup Bi Mil, 1급비밀 | II(I)-Kup Bi Mil, 2급비밀 | III(Sam)-Kup Bi Mil, 3급비밀 | Dae Woi Bi, 대외비 |
| Korea, North | Unknown, 익명의 | Unknown, 익명의 | Unknown, 익명의 | Unknown, 익명의 |
| Laos | Lup Sood Gnod | Kuam Lup | Kuam Lap | Chum Kut Kon Arn |
| Latvia | Sevišķi slepeni | Slepeni | Konfidenciāli | Dienesta vajadzībām |
| Lebanon | Tres Secret | Secret | Confidentiel | |
| Lithuania | Visiškai Slaptai | Slaptai | Konfidencialiai | Riboto Naudojimo |
| Malaysia | Rahsia Besar | Rahsia | Sulit | Terhad |
| Mexico | Ultra Secreto | Secreto | Confidencial | Restringido |
| Montenegro | Strogo Tajno | Tajno | Povjerljivo | Interno |
| Netherlands[15] | Zeer Geheim | Geheim | Vertrouwelijk | Departementaal Vertrouwelijk |
| New Zealand | Top Secret | Secret | Confidential | Restricted |
| Nicaragua | Alto Secreto | Secreto | Confidencial | Reservado |
| Norway | STRENGT HEMMELIG | HEMMELIG | KONFIDENSIELT | BEGRENSET |
| Pakistan (Urdu) | Intahai Khufia | Khufia | Sigh-e-Raz | Barai Mahdud Taqsim |
| Pakistan (English) | Top Secret | Secret | Confidential | Restricted |
| Paraguay | Secreto | Secreto | Confidencial | Reservado |
| Peru | Estrictamente Secreto | Secreto | Confidencial | Reservado |
| Philippines | Top Secret | Secret | Confidential | Restricted |
| Poland | Ściśle tajne | Tajne | Poufne | Zastrzeżone |
| Portugal | Muito Secreto | Secreto | Confidencial | Reservado |
| Romania | Strict Secret de Importanţă Deosebită | Strict Secret | Secret | Secret de serviciu |
| Russia | Особой важности (вариант: Совершенно Секретно (Sovershenno Sekretno)) |
Совершенно секретно (вариант: Секретно (Sekretno)) |
Секретно (вариант: Не подлежит оглашению (Конфиденциально) (Ne podlezhit oglasheniyu (Konfidentsial'no)) |
Для Служебного Пользования (ДСП) (Dlya Sluzhebnogo Pol'zovaniya) |
| Saudi Arabia | Saudi Top Secret | Saudi Very Secret | Saudi Secret | Saudi Restricted |
| Serbia | Latin: Državna tajna Cyrillic: Државна тајна |
Latin: Strogo poverljivo Cyrillic: Строго поверљиво |
Latin: Poverljivo Cyrillic: Поверљивo |
Latin: Interno Cyrillic: Интерно |
| Singapore | Top Secret | Secret | Confidential | Restricted |
| Slovak Republic | Prísne tajné | Tajné | Dôverné | Vyhradené |
| Slovenija | Strogo tajno | Tajno | Zaupno | Interno |
| Spain | Secreto | Reservado | Confidencial | Difusión Limitada |
| Sweden | Kvalificerat Hemlig (KH); Hemlig/Top Secret (H/TS) | Hemlig (H); Hemlig/Secret H/S) | Hemlig/Confidential (H/C) | Hemlig/Restricted (H/R) |
| Switzerland | Geheim / Secret | Vertraulich / Confidentiel | Dienstlich / Interne au service | |
| Thailand | Lap thi sut (ลับที่สุด) | Lap mak (ลับมาก) | Lap (ลับ) | |
| Turkey | Çok Gizli | Gizli | Özel | Hizmete Özel |
| South Africa (English) | Top Secret | Secret | Confidential | Restricted |
| South Africa (Afrikaans) | Uiters Geheim | Geheim | Vertroulik | Beperk |
| Ukraine | Особливої важливості | Цілком таємно | Таємно | Для службового користування |
| United Kingdom | TOP SECRET | SECRET | CONFIDENTIAL | RESTRICTED |
| United States | Top Secret | Secret | Confidential | For Official Use Only |
| Uruguay | Ultra Secreto | Secreto | Confidencial | Reservado |
| Vietnam | Tuyệt Mật | Tối Mật | Mật | Phổ Biến Hạn Chế |
| NATO | Cosmic Top Secret | NATO Secret | NATO Confidential | NATO Restricted |
| European Union (EU) | TRES SECRET UE / EU TOP SECRET | SECRET UE / EU SECRET | CONFIDENTIEL UE / EU CONFIDENTIAL | RESTREINT UE / EU RESTRICTED |
| Western European Union (WEU) | FOCAL TOP SECRET | WEU SECRET | WEU CONFIDENTIAL | WEU RESTRICTED |
| Euratom | EURA TOP SECRET | EURA SECRET | EURA CONFIDENTIAL | EURA RESTRICTED |
Original source: NISPOM Appendix B[16] ¹ In addition, Finland uses label Salassa pidettävä, "to be kept secret" for information that is not classified but must not be revealed on some other basis than national security. (E.g. privacy, trade secrets etc.)
Private corporations often require written confidentiality agreements and conduct background checks on candidates for sensitive positions.[17] In the U.S. the Employee Polygraph Protection Act prohibits private employers from requiring lie detector tests, but there are a few exceptions. Policies dictating methods for marking and safeguarding company-sensitive information (e.g. "IBM Confidential") are common and some companies have more than one level. Such information is protected under trade secret laws. New product development teams are often sequestered and forbidden to share information about their efforts with un-cleared fellow employees, the original Apple Macintosh project being a famous example. Other activities, such as mergers and financial report preparation generally involve similar restrictions. However, corporate security generally lacks the elaborate hierarchical clearance and sensitivity structures and the harsh criminal sanctions that give government classification systems their particular tone.
The Traffic Light Protocol[18][19] was developed by the G8 countries to enable the sharing of sensitive information between government agencies and corporations. This protocol has now been accepted as a model for trusted information exchange by over 30 other countries. The protocol provides for four "information sharing levels" for the handling of sensitive information.