The Friedman correspondence files were selected because references to these files in The Puzzle Palace indicated that these files were open to the public. As noted, NSA had had an explicit agreement with the Library that portions of the Friedman correspondence which continue to be sensitive would be closed to the public. This agreement was an outcome of a prior review of the Friedman collection conducted by NSA. NSA learned at the April 1983 review of the Friedman collection that a former archivist of the Library had opened the collection to the public without obtaining the approval of the Library's authorities or advising NSA of his intention to open these papers to the public. The files in the Carter collection relative to his years as Director, NSA, were chosen for review because they were likely to contain information General Carter derived from his conduct of official duties at NSA.

"4)

Does NSA have any ownership or other rights with respect to any papers in the Marshall Library Collection?"

There are some materials on loan to the Marshall Foundation from NSA for which the Government maintains a right of ownership. Additionally, all information which is derived from the performance of governmental functions which is classified, classifiable, or unclassified but protected against disclosure by statute, may be protected by the government until such time as that information

Ino longer is officially declassified or the government otherwise indicates

that the information is required to be protected. NSA is responsible for ensuring the protection of such information when it concerns NSA activities. The authority underlying NSA's responsibilities is briefly discussed in the answer to paragraph 8, infra.

"5) The New York Times reported that some papers were withdrawn from public files at the request of NSA."

"a) Were any of the papers reviewed by NSA already
Had any of the papers been declassified?"

classified?

Some of the papers reviewed were already classified. Some of the materials in the Friedman collection which were reviewed by NSA representatives in April had been declassified during previous reviews by NSA. No materials from the Carter collection had been declassified since there had been no previous reviews of that collection.

"b) Did NSA classify any papers in the Marshall Library? If so, how many pages were classified? On what authority were these papers classified? Please be specific with respect to the

classification rules in Executive Order 12356."

One technical monograph in the Friedman collection which had been previously declassified was found to contain infor

mation which, if disclosed, could cause damage to the national security and, thus, should have been maintained in a classified status. There was no indication at the time of the review that this document had been disclosed to the public in fact. The section of Executive Order 12356 governing this action is Section 1.6 (c).

In addition to this monograph, some other documents in the collections were marked by the NSA representatives as classified or, in the case of one document, had its existent classification marking upgraded. The documents were marked or upgraded pursuant to Executive Order 12356, Section 1.3.

We did not maintain a record of how many pages were

marked as classified.

"c)

Were any papers marked 'For Official Use Only'? If so, how many? What is the significance of the designation 'For Official Use Only'?"

Several papers in the collections contained information of a kind which should be marked "For Official Use Only". Information marked "For Official Use Only" is a kind which has not been given a security classification pursuant to the criteria of a classification Executive Order, but which may be withheld from the public for one or more reasons cited in Exemptions 2 through 9 of the Freedom of Information Act (FOIA). The principal basis of NSA's use of this marking is to designate information permitted to be protected by Section 6 of The National Security Agency Act of 1959 (50 U.S.C. $402 note, Public Law 86-36). This statute protects information related to the functions, activities, and organization of NSA as well as certain information concerning . its personnel. This statute operates to trigger the applicability of FOIA exemption 3 which provides for the exemption from disclosure under the FOIA information specifically protected by statute.

Of the materials identified in the review as containing such information some were marked as "For Official Use Only", but a specific count of those materials was not kept. It was recommended to the Library officials that all the materials identified as "For Official Use Only" be kept closed to the public.

"d)

Did NSA request that any unclassified papers be

removed from the public files? If so, why?"

At the time the NSA representatives conducted their review in April, the materials were located in the secure vault, i.e., a place closed to the public. The Carter collection had been closed to the public prior to NSA's review. It was not known, at the time of the review, which papers had previously

been open to public view or which papers had actually been viewed by the public. NSA representatives did request that the materials identified as containing classified information or information "For Official Use Only" be kept closed to the public because the materials so identified required protection pursuant to the authorities already cited.

"e) Did NSA physically remove any papers from the Marshall Library collection?"

NO.

"f) Library officials told the New York Times that NSA requested that some documents should be put in a vault.

Why?"

As noted, all the materials reviewed were already in a vault at the time of the review. The request that certain materials be kept closed to the public amounted to a request that these documents remain in the vault an action already taken by the Library.

"g) On what basis did NSA determine that some papers in the Marshall Library collection should be treated as if they were classified, placed in a vault, or simply removed from public access?"

Both Executive Order 12356 and Public law 86-36 applied to the classified and sensitive materials, respectively, as set out in our responses to questions 5b and 5c, above.

"6) Did NSA review the security arrangements at the Marshall Library to determine if they afforded sufficient protection for. information deemed to be sensitive? Did NSA ask the Library to restrict access to individuals approved by NSA or individuals with security clearances?"

The security arrangements, clearances and facility at the Marshall Library were established and are certified by the U.S. Army. NSA accepts the Army's determination as adequate. Such arrangements presuppose restricting access to classified materials to cleared individuals. NSA made recommendations to the Library that certain materials be maintained as closed to the public.

"7) The New York Times article quoted a letter from you to Marshall S. Carter as stating that the visit to the Marshall Library by NSA officials was 'part of a continuing review of research materials used by author James Bamford'."

"a) What is the nature and extent of this review?"

After the publication of The Puzzle Palace, a review of the source material cited by the author was undertaken by

NSA. This review was commenced in order (i) to identify classified or otherwise protected information compromised in the book, if any; (ii) to take all appropriate security countermeasures, if any compromise had occurred; (iii) to identify any unauthorized disclosures appropriate for further investigation; and (iv) to gather information pertinent to assessments of current information security practices. This review process was almost entirely limited to a review of documents cited by the author. No institutions other than the Marshall Library were contacted and no documents were requested to be removed from public access as a result of this review except those found in the Friedman and Carter collections which were enumerated in our answers to question 5, above.

This review was was consistent with our responsibility to ensure the protection of information relating to cryptology that is derived from the performance of official duties. As part of its routine responsibilities and functions, NSA conducts reviews of published information to determine if classified or protected information has been improperly disclosed.

"b) What other institutions or individuals have been contacted by NSA as part of this review?"

Only former NSA employees and officials have been contacted as part of our review effort. No other institutions have been contacted.

"c) Has NSA requested that other papers be removed from public access? Please describe any such requests."

Our reviews stemming from the publication of Bamford's book have not caused us to make any such requests of any individuals or organizations except the requests of the Marshall Library.

"d) Are there any other ongoing or completed reviews of materials other than those used by James Bamford?"

As part of our responsibility to protect classified and sensitive information related to NSA's operations, we frequently review materials intended to be published I often at the explicit request of an author.

"8) Does NSA have any authority to classify information in private papers? From what provision of law or Executive Order does this authority derive?"

The papers in the Friedman and Carter collections deemed to be classified are those containing information about NSA functions and activities derived from their official duties with the

Agency that is classified under Executive Order 12356. NSA officials exercise classification authority under Executive Order 12356, as implemented by DOD Directive No. 5200.1, as the agency or successor agency having cognizance of the cryptologic functions and activities involved.

Under 18 U.S.C. 798 (b) the Secretary of Defense may determine the persons authorized to receive classified cryptologic information. Under Executive Order 12333--as under predecessor orders--the Secretary of Defense conducts, as the executive agent of the United States Government, signals intelligence and communications security activities. The same order authorizes the National Security Agency to execute the Secretary's responsibilities to conduct signals intelligence and communications security activities, and authorizes the Agency to protect by appropriate means signals intelligence and communications security information within its cognizance. Further, Section 6 of the National Security Agency Act of 1959, authorizes NSA to protect from disclosure information regarding the organization, functions and activities of NSA and the persons employed therein.

The law recognizes that the U.S. Government, through NSA, may properly seek to protect information and data of the kinds within the ambit of the statutes and Executive Orders cited above, when such information is derived or acquired through an affiliation with the Government regardless of whether the information is contained in official or private papers. The law also recognizes that individuals provided access to such information, i.e., individuals placed in positions of trust and confidence in respect to the Government, have a fiduciary obligation to prevent the disclosure of such information or data outside the channels authorized by the government. Snepp v. United States 444 U.S.. 507 (1980). Individuals affiliated with NSA sign secrecy oaths in which they explicitly accept and acknowledge their obligations regarding protected information and data acquired through. association with NSA.

"9) Does NSA have any authority to restrict disclosure of information in private papers if the information is not subject to classification under Executive Order 12356?"

The authority of NSA under Section 6 of the National Security Agency Act of 1959 to protect against disclosure information, derived from the conduct of official duties, about its organization, functions, activities, and personnel is not limited to classified information or information contained in official documents. It applies as well to information of those kinds that is classifiable but not yet formally classified under Executive Order 12356 and to other information that meets the statutory criteria for protection.