How is foreign government information protected in Foreign Military Sales?

Foreign government information (FGI) is information that has been provided by a foreign government or international organization, or jointly produced, with the expectation that the information will be treated “in confidence.” The information may be classified or unclassified. In addition to TOP SECRET, SECRET, and CONFIDENTIAL, many foreign governments have a fourth level of security classification, RESTRICTED, as well as CUI that is provided in confidence.

As a result of numerous international security and program agreements, the NATO security agreements obligate member nations to adopt common standards of protection. U.S. national policy affords FGI a degree of protection equivalent to that provided to it by the originating government or international organization. Since foreign government accountability and control measures often exceed those of the U.S., the U.S. applies separate security procedures to protect FGI. Because most exchanges are with NATO and its members, the NATO standards are used as the baseline for U.S. procedures for protecting FGI.

FGI, including RESTRICTED and foreign government CUI, must be controlled and managed under E.O. 13526 in order to receive protection equivalent to that provided by the originating government or organization, as stipulated in E.O. 13526 and international agreements. FGI that is classified by the originating government or organization will be marked with the equivalent U.S. classification, if it is not already marked in English, and the identity of the originating government or organization. Foreign government RESTRICTED and CUI are to be marked, “Handle as CONFIDENTIAL–Modified Handling Authorized.” FGI cannot be provided to third country entities or used for a purpose other than that for which it was provided without the consent of the originating government or organization. It must receive protection commensurate with that provided by the originating government or organization. The procedures for handling FGI are contained in two national policy documents, E.O. 13526, the Presidential directive on safeguarding classified national security information, and DoDM 5200.01.

Basic handling procedures for FGI are as follows:

• Storage: The same as U.S. information of the same classification, but FGI is to be stored separately. FGI that is marked “Handle as CONFIDENTIAL–Modified Handling Authorized” is stored in the same manner as U.S. CUI, e.g., in a locked desk or file cabinet
• Access: Using the need-to-know principle, no access by third country persons without the prior consent of the originating country or organization
• Transmission: The same as U.S. classified information of the same classification level; however, express commercial carriers cannot be used. Receipts are required for international transfers wherever they occur, although exceptions are made for RESTRICTED information. There are no receipts for CUI
• Records: TOP SECRET–receipt, dispatch, internal distribution, annual inventory, and destruction (two persons); SECRET–receipt, dispatch, internal distribution, and destruction; CONFIDENTIAL–receipt and dispatch, and as required by originator