Classified government documents are federal records whose release could damage national security, and the government protects them at three levels — Confidential, Secret, and Top Secret — under Executive Order 13526. Access is limited to people who hold a matching security clearance and have a demonstrated need to know the specific information. Most records are automatically declassified after 25 years, with narrow exemptions that push a small subset out to 50 or 75 years.
What Qualifies as Classified
Not every sensitive record can be classified. Executive Order 13526 sets four conditions that must all be met: an authorized official makes the decision, the information is owned or controlled by the federal government, it falls into one of eight specific subject categories, and the official can identify or describe the specific harm to national security that release would cause.1National Archives. Executive Order 13526 Embarrassment or political inconvenience is not a lawful basis.
The eight eligible categories are military plans, weapons systems, or operations; foreign government information shared in confidence; intelligence activities, sources, and methods; U.S. foreign relations and diplomatic activities; scientific, technological, or economic matters tied to national security; nuclear materials or facilities safeguarding programs; vulnerabilities or capabilities of national security systems and infrastructure; and weapons of mass destruction. Information that doesn’t fit at least one of these categories cannot be classified, no matter how sensitive it seems.2National Archives. Executive Order 13526a> The administrative procedures agencies must follow appear in 32 CFR Part 2001.3eCFR. 32 CFR Part 2001 – Classified National Security Information
The Three Classification Levels
Each level is defined by the severity of harm that unauthorized disclosure would cause:
- Top Secret covers information whose release could reasonably be expected to cause “exceptionally grave damage” to national security, such as strategic defense plans or the identities of critical intelligence sources.
- Secret covers information whose disclosure could cause “serious damage.” Most classified documents fall in this tier.
- Confidential is the lowest level and applies when unauthorized release could cause “damage,” though less severe than the higher tiers.
Every classified document carries markings showing the level, which portions are classified, and the basis for classification.4The White House. Executive Order 13526 – Classified National Security Information
Nuclear Information Is a Separate Track
Nuclear weapons information doesn’t run through Executive Order 13526 at all. Under the Atomic Energy Act, “Restricted Data” — covering nuclear weapon design and manufacture, production of special nuclear material, and the use of that material to generate energy — is “born classified” and protected automatically from the moment it exists. When information relates more to military operations than to weapon design, the Departments of Energy and Defense can jointly move it into a category called Formerly Restricted Data, which changes handling but does not release it to the public. Penalties for unauthorized disclosure of Restricted Data can reach life imprisonment when done with intent to harm the United States.
Original vs. Derivative Classification
There are two ways a document becomes classified. Original classification happens when an official specifically designated as an “original classification authority” makes the initial judgment that information meets the criteria. Their name or position appears on the document. This is the rarer path.
Derivative classification is far more common. It happens whenever someone incorporates, paraphrases, or restates already-classified information into a new document. An analyst who writes a briefing drawing from three classified reports has produced a derivatively classified document, and must carry forward the highest classification markings from the source material and list those sources.1National Archives. Executive Order 13526 Anyone applying derivative markings must complete training at least every two years or lose the authority to do so. Derivative classification is where overclassification most often occurs, because marking something higher than necessary feels safer.
Who Can Access Classified Information
A clearance alone doesn’t grant access. The government also requires a “need to know” tied to a person’s assigned duties, so someone with a Top Secret clearance cannot freely browse classified databases.
Background investigations run on a five-tier scale:
- Tier 1: basic checks for non-sensitive positions
- Tier 2: moderate-risk public trust positions
- Tier 3: Secret-level clearances and non-critical sensitive positions
- Tier 4: high-risk public trust positions
- Tier 5: Top Secret clearances and eligibility for Sensitive Compartmented Information
Higher tiers involve deeper review of financial records, foreign contacts, travel, and personal references, and the tolerance for ambiguity narrows sharply at Tier 5.
Sensitive Compartmented Information sits above Top Secret. SCI access is granted program by program, and each “compartment” has its own access list. Approval for one compartment does not carry over to another. Each requires a separate need-to-know determination, an indoctrination briefing, and a nondisclosure agreement.
How Classified Documents Are Protected
Paper documents must be stored in security containers approved by the General Services Administration, each bearing a GSA approval or recertification label.5General Services Administration. Security Containers SCI and certain other highly sensitive materials must be handled inside a Sensitive Compartmented Information Facility, or SCIF: a purpose-built room with reinforced walls, controlled access, and protections against electronic eavesdropping.6Office of the Director of National Intelligence. Technical Specifications for Construction and Management of SCIFs
Classified digital traffic runs only on encrypted networks that are physically separated from the public internet. Any connection between a classified system and an unclassified one, even accidental, triggers a security incident. Personal devices with recording or transmitting capabilities are generally prohibited from SCIFs unless specific technical countermeasures are in place.
Private contractors handling classified material must follow the National Industrial Security Program Operating Manual in 32 CFR Part 117.7Defense Counterintelligence and Security Agency. 32 CFR Part 117 NISPOM Rule The company itself needs a facility clearance, individual employees need personnel clearances, and cleared personnel must report foreign travel and foreign contacts. The Defense Counterintelligence and Security Agency runs compliance assessments.
Penalties for Mishandling
Federal law treats unauthorized handling of classified material seriously, and multiple statutes address different conduct.
- Gathering or transmitting defense information under 18 U.S.C. § 793 covers everything from willfully sharing national defense information with unauthorized people to losing classified documents through gross negligence. Maximum penalty is 10 years, a fine, or both.8Office of the Law Revision Counsel. 18 USC 793 – Gathering, Transmitting or Losing Defense Information
- Disclosure of classified communications intelligence under 18 U.S.C. § 798 carries up to 10 years, a fine, or both, plus mandatory forfeiture of property derived from or used to facilitate the violation.9Office of the Law Revision Counsel. 18 USC 798 – Disclosure of Classified Information
- Unauthorized removal and retention under 18 U.S.C. § 1924 targets officers, employees, or contractors who knowingly remove classified documents and keep them at an unauthorized location. Maximum penalty is 5 years, a fine, or both.10Office of the Law Revision Counsel. 18 USC 1924 – Unauthorized Removal and Retention of Classified Documents or Material
Administrative consequences often bite before criminal charges do: loss of clearance, termination, and a record that effectively closes off any future work requiring sensitive access. Relatively few mishandling cases actually result in prosecution.
How Classified Documents Become Public
Executive Order 13526 sets a default rule: records with permanent historical value are automatically declassified at 25 years, unless an agency head has specifically exempted them.4The White House. Executive Order 13526 – Classified National Security Information Exemptions are limited to nine specific categories, including information that would reveal a confidential human source, compromise weapons of mass destruction technology, expose current military war plans, or violate a treaty obligation.
Exempted records face a second deadline at 50 years. Only two categories survive: the identity of confidential human intelligence sources and key design concepts for weapons of mass destruction. In extraordinary cases, an agency head can seek to hold information past 50 years, but the final ceiling is 75 years.11Government Publishing Office. Executive Order 13526 of December 29, 2009 – Classified National Security Information
The National Declassification Center at the National Archives coordinates review of records transferred to the Archives when multiple agencies’ equities are involved.12eCFR. 36 CFR Part 1260 Subpart C – The National Declassification Center The Public Interest Declassification Board, a bipartisan body of nine members appointed by the President and congressional leaders, advises on promoting public access to significant national security records.13National Archives. Public Interest Declassification Board – Members The board itself cannot declassify records.
Challenging Classification
Anyone with a clearance and authorized access to specific classified information can challenge how it is classified. Under 32 CFR 2001.14, the challenge only needs to be in writing, and can be as simple as asking why the information is classified or why at a particular level.14eCFR. Classification Challenges Agencies must protect challengers from retaliation.
For people outside government, the main path is Mandatory Declassification Review. If an agency denies the request, you appeal within the agency and then to the Interagency Security Classification Appeals Panel, ISCAP. The deadline to appeal to ISCAP is 60 days from the agency’s final decision. If the agency never responds, you can appeal directly to ISCAP after one year on the initial request or 180 days on an internal appeal, with a 60-day window after those deadlines expire.15National Archives. Mandatory Declassification Review
Requesting Classified Records
Two request paths are available. A Freedom of Information Act request can be filed with any federal agency and covers all types of records. A Mandatory Declassification Review request specifically asks the agency to evaluate whether the information still meets the standards for protection under Executive Order 13526. MDR is often more useful for classified material because it forces the agency to apply current declassification standards, while FOIA lets the agency invoke the national security exemption and withhold the record.
Under FOIA, agencies must respond within 20 business days, though that deadline is frequently missed for complex searches.16Office of the Law Revision Counsel. 5 USC 552 – Public Information FOIA is decentralized: each of more than 100 federal agencies handles its own requests, so you must send the request to the agency that holds the records.17FOIA.gov. Freedom of Information Act Frequently Asked Questions
The biggest reason requests fail is that they’re too broad. Asking for “all documents related to CIA operations in Southeast Asia” will typically come back with a demand to narrow the scope. Effective requests identify the agency and office, provide date ranges, reference document titles or subject keywords when possible, and describe the records precisely enough that a records officer can find them. Presidential libraries use NA Form 14020 for MDR requests tied to presidential records.
FOIA fees vary by requester. Commercial requesters can be charged for search time, review, and duplication. Educational institutions, noncommercial scientific organizations, and news media pay only for duplication beyond the first 100 pages. Everyone else gets the first two hours of search time and first 100 pages of duplication at no charge. Fee waivers are available when disclosure would significantly contribute to public understanding of government operations, but not for requests that primarily serve a commercial interest.
Glomar Responses
Sometimes an agency refuses to confirm or deny that responsive records exist at all. This is a Glomar response, named after a 1970s case involving the CIA and a ship called the Glomar Explorer. Courts have limited this response to narrow circumstances where even acknowledging the records would cause harm under a FOIA exemption, and agencies must provide specific evidence rather than boilerplate.
You can appeal a Glomar denial administratively within 90 days. If the specific agency you’re asking has already publicly acknowledged the records exist, it has waived the ability to Glomar you. Acknowledgments by other agencies don’t count: if the CIA has confirmed a program publicly but you’re asking the Department of Defense for related records, DOD can still issue a Glomar response if it has not itself confirmed its involvement.