? on U / FOUO

[RedFox24]

OK here is my question presented to the best of my ability to express such.

I have had/taken/passed the CAP on line U / FOUO training a long time ago so it escapes me now exactly whom wrote/sponsored/authored/endorsed the training.  Other than CAP radio stuff and information passed with the base for encampment planning purposes I have never come upon anything that was U / FOUO so my question that follows has never been a concern.   

Was that training a CAP training or was that a US Government training?  As in does my CAP FOUO count/require/duplicate/imply U / FOUO for any other US Government agency using FOUO?

So lets say that:  You are given a document that is clearly marked U / FOUO by a person who is 1)  not in or affiliated with CAP/USAF or any military branch  2)  has nothing to do with CAP/USAF missions or such 3)  have no idea you have U / FOUO training and 4) you have no idea that they have had the training. 

What is your responsibility or obligation under your CAP FOUO training at this point? 

Just curious...............

[cnitas]

 
I suppose it depends on the nature of what in in the document. 

Is it is a cadet training plan for next weekend, or is it a manual on us warfighting tactics?

Unclassified means unclassified.  If the information is unrelated to you, your squadron, or your business, just throw it away.

[RiverAux]

I'm beginning to see that printed on CAP documents as a matter of routine.

The training was CAP training and not relevant to anyone else. 

[es_g0d]

Only things that should be FOUO should be marked as such.  Marking everything to that level just makes it painful in the long run.

Other examples of information that is FOUO are social security numbers.  They're not classified, but if you have a roster with that number on it then you need to protect that information for (hopefully) obvious reasons. 

I think a reasonable litmus test might be, "would you want this information posted on a website?"  If that's ok, then don't bother making it FOUO. 

Thankfully, we deal with precious little FOUO in CAP.

[MikeD]

Other federal agencies define FOUO as SBU (Sensitive but Unclassified) and it's a PITA...  Data needs to be encrypted at all times, you need to like set up the printer so that there's a long enough delay for you to get to the printer before it prints, kept in a locked door in a locked room, etc.

[Short Field]

You just hit a personal pet peeve of mine.   IMHO, the CAP OPSEC training did not do a good job of explaining FOUO and Critical Information and just confuses the issue.  It lumps a lot of stuff together without giving a clear description of each type of information.  It does not make a clear distinction between Critical Information and FOUO.  To the best of my understanding (and review of the OPSEC briefing slides and video), FOUO is used for (1) CAP radio frequencies, (2) some CAP missions, and (3) non-classified but sensitive DoD information.  As examples, the briefing specifically identifies CAP radio frequencies and exercise/operational plans.   IIRC, a older version of the briefing identified the missions/exercises as being with the USAF, not your monthly SAREX.

Pay attention to where the briefing lists what publicly accessible web sites will NOT contain.  The list includes FOUO information, Sensitive Information, Plans, Planned Deployments, and Personal Information (SSANs and Home phone numbers).  That implies that FOUO is NOT Sensitive Information, Plans, Planned Deployments, and Personal Information (SSANs and Home phone numbers).  The briefing states that FOUO will be stored in a LOCKED desk, room, or cabinet unless Government or Government-contract building security is provided.  Electronic FOUO transmission should be by approved SECURE comms systems.  Your e-mail account and internet based websites are NOT secure comm systems.  

Bottom Line:  If you get something marked FOUO by e-mail, then it is either not FOUO or the person sending it to needs to be reported for a security violation.   Critical Information that is not FOUO still needs to be protected - but that just means don't broadcast it to the world.  Critical Information should be limited to only people with a need to know.  That is what the OPSEC training is all about.  I am now seeing emails from people in our wing who have included the U/FOUO statement as part of their signature tag on all their emails.  Duh....rant over.

[RedFox24]

Short Field, I hear you loud and clear, which is why I am asking the question. 

OK let me take this a step further with two different scenarios.

1.  Say I got a U / FOUO document of some government agency from a person who is not with that agency.  If I read the answers so far, then I just throw it in the trash and carry on.  I means nothing to me, I am not with that Gov Agency and am not interested in the document.  So even though I am FOUO "compliant" with CAP it means nothing outside CAP?

Example:  I am given a document from a government agency that is marked FOUO by a business man whom I am doing business with, showing me how some situation could effect my business.  Neither he nor I are employed or contracted by that Gov Agency. 

2.  Say I am given a FOUO CAP document from a person who is not in CAP/USAF. Then what?  This does mean something to me as a CAP member but what is my responsibility at this point with a non CAP member.

Example:  I am given a CAP frequency list from a non CAP member, find the Region Comms Plan on a Website, read our new frequencies in a magazine or on a blog with the discussion of what FOUO means in relationship to the document they posted.  You tell the squadron, group or wing DC and their answers is "that's an old list".  Well it might be, then again it matches the list you can down load from E Services...............So...........

So, (U) unclassified means just that. 

FOUO means official use within the context of me being able to see the information when some one higher up the chain deems me "in the need to know". 

Otherwise, I have no obligation to be "secure" or "responsible" for anyone else misuse of U / FOUO because the document or information is neither sensitive or secure. 

Regardless of or from whom the document comes from, inside or outside of CAP, my FOUO training with R Lee only applies to what command deems necessary for me to know.....and I am to safe guard what they give or tell me............not what others might give me that is FOUO.

Clear as mud?

Maybe I am asking to much or thinking to much, but it makes me wonder if our FOUO training really means anything outside of CAP Command deciding whom they want to tell what to. 

[cnitas]

I think in your example, you throw it in the unlocked trashcan.  You do not hold a security clearance and the information is unclassified.  If it is truly sensitive information and you have a 'need to know' you treat it as such. 

What is your answer in this case?:
Suppose someone hands you a document clearly labeled 'TOP SECRET' - 'American Red Cross CEO Eyes Only' - 'Destroy after Use'

You of course immediatly fold the document so it cannot be read, but now you have a problem.

You got the document through a trusted non-AOPA source and you have no security clearance.   Does your FOUO training compel you to do anything? 

[jb512]

Open and read it first.

[desertengineer1]

CAP did an extremely poor job of implementing FOUO, and IMHO, the mandate of U//FOUO is even worse.

Social Security numbers are Privacy Act.  Frequencies are FOUO (OPSEC).

I've tried to correct the misconceptions and misinformation constantly over the years - in both military (unit security manager) and CAP.  I don't know whhere the breakdown is.  Could be lack of leaders who are formally trained in DoD 5200-22R (or AFI 31-401).  Could be the herding instinct.  Could be that no one really cares and they want to be lazy - take the easy way instead of the right way (my vote).

I cringe every time I see a document with such markings.

FOUO is NOT a classification.  Let me repeat that again.  IT IS NOT A CLASSIFICATION STATEMENT.  Why can't people get this simple concept?  How many times do I have to repeat this?

http://www.hropensacola.navy.mil/hropdirectives/hropinst5720.1.pdf

FOUO signifies the information meets exemption(s) for release under FOIA.  Handling instructions, per DoD 5200-22R (and others in the same seiries) require handling instructions stated seperately by the originator of the information.  In other words, if you are to follow the REAL rules, you have to specify handling instructions.

For the "U", I got nothing.  Again, I've been hounding everyone about this for years.  It's already unclassified.  Why are you marking it U//FOUO.  You as an organization look like a collection of idiots to Security folk when you mandate such.

This is like me calling you one afternoon and saying, "Hey, Mike, let's go to lunch in my car car".

See this:  http://afsf.lackland.af.mil/Organization/AFXOF/Interim%20Guidance-Safeguard-Atch%202.pdf

Of course, if anyone cares enough to actually read the rules, you can go here to the -1R: 

http://www.dtic.mil/whs/directives/corres/pdf/520001r.pdf


Frequencies are another issue which we did an even more sad job of explaining.  Frequencies are deemed Critical Information items (reference AFI 10-701), or "CI".  As with Privacy Act infomation, the OPSEC process final steps require organizations to identify and protect CI, by developing local policies (OI's here in the AF side).  CAP's continuing mistake is to not inform or train members of the OPSEC evaluation and reporting process we follow as a requirement of AFI 10-701.  This, in-turn, accelerates the misinformation and rumor mills.

CAP needs to either formally follow 10-701 or discard it: 

http://www.e-publishing.af.mil/shared/media/epubs/AFI10-701.pdf

See my previous rant here:

http://captalk.net/index.php?topic=147.40

[jimmydeanno]

For the "U", I got nothing.  Again, I've been hounding everyone about this for years.  It's already unclassified.  Why are you marking it U//FOUO.  You as an organization look like a collection of idiots to Security folk when you mandate such.

Please see example: http://www.firearmscoalition.org/images/news/hsa-rightwing-extremism-09-04-07.pdf
(Please note that I am not commenting on the study itself, but the bottom of the cover)

This document, released by the DHS states "UNCLASSIFIED // FOR OFFICIAL USE ONLY" on the bottom.  Also states U//FOUO before any of the text. Does that make them look like a collection of idiots?

Either way, I think that there is very little if anything that the average CAP member would come into contact with that would be labeled with anything.  In all honesty I think we've gone off the deep end with OPSEC, etc.  Because we haven't provided real training on the subject nobody knows exactly what it means so everyone is hyper sensitive and wants to stamp everything FOUO. 

I get e-mails from people in CAP for Wing Conferences, etc that say "UNCLASSIFIED // FOUO" - give me a break, it's a wing conference.

I've said this before, but I used to work on Langley AFB.  I had to attend OPSEC training before I could start my job.  It consisted of a 10 slide powerpoint printed off.  I sat down, the lady said, "read this and when you're done sign here."  That's it, 5 minutes of my time.

Those 10 slides were more than enough to tell me that if it says "SECRET" on it I shouldn't pass it around.  It also made it quite clear that I wasn't someone who would be doing the classification, so just look for the right colors.

YMMV.

[heliodoc]

^^^^ :clap: :clap:

AGAIN CAP needs to follow 'the rules" by the AFI

CAP also needs someone at NHQ with REAL FOUO background to diseminate (sp) the real deal rather than every CAPtalker assuming they KNOW what is FOUO

AND whether its UNCLAS or FOUO is just throwing in the trash can going to do it???

With all the security risks.......shred or rip into small pieces.... I would think CAPers would know how to do that....

[heliodoc]

Yep jimmydeanno

CAP HAS gone overboard on FOUO ....Wing Conference docs FOUO??? WTF?  Wow

This is type of thing that makes CAP look like the Keystone Kops

CAP and FOUO ??   really??

[RedFox24]

Then if I may be so bold as to say:  Once again NHQ and others along the chain want to play "military", be "military" and act more important then we/they are, who have no concept of what they are talking about or doing in the name of "looking good" for someone else.

As I suspected, FOUO was just another check box on the membership sqrt and another gross waste of my time that I will never get back from CrAP (I think my wife would approve of me using her r here).

Out.

[desertengineer1]

Please see example: http://www.firearmscoalition.org/images/news/hsa-rightwing-extremism-09-04-07.pdf
(Please note that I am not commenting on the study itself, but the bottom of the cover)

This document, released by the DHS states "UNCLASSIFIED // FOR OFFICIAL USE ONLY" on the bottom.  Also states U//FOUO before any of the text. Does that make them look like a collection of idiots?

Yes, it does.  It broadcasts to everyone that the organization isn't following DoD rules, either by ignorance or "I'll do what I want to because I said so" factors.

It doesn't meet DoD directives.

See again:

http://www.hropensacola.navy.mil/hropdirectives/hropinst5720.1.pdf
(Example of a GREAT policy letter that follows DoD 5200 to the letter.  DoD mandates the law.  Organizations mandate compliance by OI's and policy letters - if not specified individually. Refer to AFI 10-701.  "Commanders will ....")

http://afsf.lackland.af.mil/Organization/AFXOF/Interim%20Guidance-Safeguard-Atch%202.pdf
(Another GREAT example of an attempt by a unit [presumably the USM] to do the right thing instead of the easy, wrong thing.  Hats off to whoever wrote this.  It is absolutely correct.)

http://www.dtic.mil/whs/directives/corres/pdf/520001r.pdf
(The founding 5200 directive.  One should NEVER do anything relating to security before reading and understanding this series)

http://www.e-publishing.af.mil/shared/media/epubs/AFI10-701.pdf

AF OPSEC Program.  Note the chapter on OPSEC Unit Assessments - this is where the CAP frequency policy came from.  I assume (because no one I've asked knows) the frequency policy came out of some assessment somewhere (CAP-USAF or AFNORTH) and frequencies were added to the CI list.  Would have been nice if NHQ actually explained why in the policy letter.  Again, easy vs. right.

[Short Field]

With all the security risks.......shred or rip into small pieces.... I would think CAPers would know how to do that....

:clap:  :clap:  :clap:  Shred or burn and you never have to worry.  DoD 5200 was my bible for several decades.  We marked paragraphs and pages Unclassified when they were in a classified document.   Unclassified documents were never marked Unclassified.

[Captain Morgan]

OK here is my question presented to the best of my ability to express such.

I have had/taken/passed the CAP on line U / FOUO training a long time ago so it escapes me now exactly whom wrote/sponsored/authored/endorsed the training.  Other than CAP radio stuff and information passed with the base for encampment planning purposes I have never come upon anything that was U / FOUO so my question that follows has never been a concern.   

Was that training a CAP training or was that a US Government training?  As in does my CAP FOUO count/require/duplicate/imply U / FOUO for any other US Government agency using FOUO?

So lets say that:  You are given a document that is clearly marked U / FOUO by a person who is 1)  not in or affiliated with CAP/USAF or any military branch  2)  has nothing to do with CAP/USAF missions or such 3)  have no idea you have U / FOUO training and 4) you have no idea that they have had the training. 

What is your responsibility or obligation under your CAP FOUO training at this point? 

Just curious...............

Like maybe a recent HSA document that's been in the news? ...

[N Harmon]

It broadcasts to everyone that the organization isn't following DoD rules, either by ignorance or "I'll do what I want to because I said so" factors.

How about, isn't following DoD rules because it isn't part of DoD (DHS is a separate department in the executive branch).

Civil Air Patrol, on the other hand, should be adopting DoD policy. Not just because we would avoid having to reinvent the wheel, but because it demonstrates that we take OpSec seriously and that we can be trusted with sensitive information.

[Larry Mangum]

Either way, I think that there is very little if anything that the average CAP member would come into contact with that would be labeled with anything. 

Actually there are a few things that we do that could be considered CI information.  When we fly intercept missions in support of the Western Air Defense Sector, we are provided information that is not to be disseminated to the public or discussed openly as it could potentially, compromise the sorties. Especially when it is suppose to be a no notice exercise of the alert crews. 

The same could be said in regards to Counter Drug, in regards to frequencies and operations.

So while CAP may have handled the training rather poorly, we in fact are privy, depending upon your row to information that could compromise an exercise or operation all the time.

[PhoenixRisen]

So, on my squadron's website, I've got a password-protected member's only section.  The login page contains the standard 18 United States Code Section 2511 warning required by CAPR 110-1.

Within this section, I've a roster for our membership which contains names, addresses, phonenumbers, etc.  According to the OPSEC briefing, "Personal Information" is it's own bullet under "information not to be stored in publically accessable areas" - which it's not.

Am I good here?  Do I need to put some form of marking somewhere?  Mark the whole page?  Mark just the area with the rosters?  The documents themselves?  If something needs to be marked somewhere - should I just stick with what CAP says (i.e. U//FOUO), despite the discussion on the redundancy and stupidity of that specific qualification)?

[Short Field]

^^^ Look at eServices on the Member Search (restricted) module.  The top of the page states "For Offical CAP Use Only All other use is prohibited".  If it is good enough for National, it should work for you.  The info is NOT U/FOUO.

[desertengineer1]

So, on my squadron's website, I've got a password-protected member's only section.  The login page contains the standard 18 United States Code Section 2511 warning required by CAPR 110-1.

Within this section, I've a roster for our membership which contains names, addresses, phonenumbers, etc.  According to the OPSEC briefing, "Personal Information" is it's own bullet under "information not to be stored in publically accessable areas" - which it's not.

Am I good here?  Do I need to put some form of marking somewhere?  Mark the whole page?  Mark just the area with the rosters?  The documents themselves?  If something needs to be marked somewhere - should I just stick with what CAP says (i.e. U//FOUO), despite the discussion on the redundancy and stupidity of that specific qualification)?

According to AFI 33-332 (to which CAP is supposed to be also following in their regs) this is PII, which must be marked FOUO.

http://www.e-publishing.af.mil/shared/media/epubs/AFI33-332.pdf

HOWEVER, notice the reg only states it to be marked FOUO, not U//FOUO.  Again, this is an example of CAP doing a boneheaded herding instinct action rather than the correct one.

Yeah, this is splitting hairs between what DoD says vs. CAP.  I personally mark documents according to 5200-1R, AFI30-401, and AFI33-332, and forgo the "U".  It's already U.

From 33-332 Chapter 12:

12.1.3. Personal Information That Requires Protection. Following are some examples of information
that is not releasable without the written consent of the subject. This list is not all-inclusive.
12.1.3.1. Marital status (single, divorced, widowed, separated).
12.1.3.2. Number, name, and sex of dependents.
12.1.3.3. Civilian educational degrees and major areas of study (unless the request for the information
relates to the professional qualifications for Federal employment).
12.1.3.4. School and year of graduation.
12.1.3.5. Home of record.
12.1.3.6. Home address and phone.
12.1.3.7. Age and date of birth (year).
12.1.3.8. Present or future assignments for overseas or for routinely deployable or sensitive units.
12.1.3.9. Office and unit address and duty phone for overseas or for routinely deployable or sensitive
units.

[PhoenixRisen]

Roger.  Thanks!

[rebowman]

Very little of what CAP does can actually be considered FOUO - very little....

** CAP personnel information should be marked FOUO.  And, some of our ES/ HS missions.

Only documents that meet the following can be considered FOUO:

"related solely to the internal personnel rules and practices of an agency."

information "specifically exempted from disclosure by statute."

"trade secrets and commercial or financial information obtained from a person that is privileged or confidential."

"inter-agency or intra-agency memorandums or letters which would not be available by law to a party ... in litigation with the agency."

"personnel and medical files and similar files" when the disclosure of such information "would constitute a clearly unwarranted invasion of personal privacy."

"records or information compiled for law enforcement purposes, but only to the extent that production of such law enforcement records or information ... could reasonably be expected to interfere with enforcement proceedings."

"records or information compiled for law enforcement purposes (the disclosure of which) would deprive a person of a right to a fair trial or an impartial adjudication.

personal information in law enforcement records the disclosure of which "could reasonably be expected to constitute an unwarranted invasion of personal privacy.

"records or information compiled for law enforcement purposes which could reasonably be expected to disclose the identity of a confidential source and information furnished by a confidential source."

to all law enforcement information which "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcements investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

necessary to protect the physical safety of "any individual" when disclosure of information about him "could reasonably be expected to endanger his life or physical safety."

"contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions."

"geological and geophysical information an data, including maps, concerning wells."

[heliodoc]

Nice list rebowman

Now let's see ALL those CAP OPSEC frenzied folks tear down the list

Wait!  Most here all have been thru a law school or know more than the folks held real security clearances!!!

[desertengineer1]

Very little of what CAP does can actually be considered FOUO - very little....

** CAP personnel information should be marked FOUO.  And, some of our ES/ HS missions.

Only documents that meet the following can be considered FOUO:

"related solely to the internal personnel rules and practices of an agency."

This meets 5 U.S.C Sect 552,  (b)2, if it is Government information.  Data solely for CAP corporate purposes may be exempted under other laws and practices, but shouldn't be marked FOUO, since it is a government term.  Such data should be marked "CAP Proprietary" or equiv.

Sect (b)2:

(b)(2) EXEMPTION - Internal Personnel Rules and Practices

This exemption exempts from mandatory disclosure records "related solely to the internal personnel rules and practices of an agency." Courts have interpreted the exemption to encompass two distinct categories of information:

(a) internal matters of a relatively trivial nature--sometimes referred to as "low2" information; and

(b) more substantial internal matters, the disclosure of which would risk circumvention of a legal requirement--sometimes referred to as "high 2" information.

information "specifically exempted from disclosure by statute."

This is exemption (b)3:

(b)(3) EXEMPTION - Information Specifically Exempted by Other Statutes

This exemption incorporates the disclosure prohibitions that are contained in various other federal statutes. As originally enacted in 1966, Exemption 3 was broadly phrased so as to simply cover information "specifically exempted from disclosure by statute." The new Exemption 3 statute prohibits agencies from releasing under the FOIA any proposal "submitted by a contractor in response to the requirements of a solicitation for a competitive proposals," unless that proposal "is set forth or incorporated by reference in a contract entered into between the agency and the contractor that submitted the proposal."

"trade secrets and commercial or financial information obtained from a person that is privileged or confidential."

This is exemption (b)4, handling instruction rules should be defined by the owner (CAP corporate) with reasons why.  This is a common mistake among our leadership.  If I make everything FOUO (or proprietary), it's easier.  As I said before, easy commonly becomes incorrect, and can do more harm in teh long run.

(b)(4) EXEMPTION - Trade Secrets, Commercial or Financial Information

This exemption protects "trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential." This exemption is intended to protect the interest of both the government and submitter of information.

"inter-agency or intra-agency memorandums or letters which would not be available by law to a party ... in litigation with the agency."

This is exemption (b)(5).

(b)(5) EXEMPTION - Privileged Interagency or Intra-Agency Memoranda or Letters<

This exemption protects "inter-agency or intra-agency memorandums of letters which would not be available by law to a party ...in litigation with the agency." As such, it has been construed to "exempt those documents, and only those documents, normally privileged in the civil discovery context."

"personnel and medical files and similar files" when the disclosure of such information "would constitute a clearly unwarranted invasion of personal privacy."

This, I believe, is (b)(6), but has recently been further strengthened by HIPA.

(b)(6) EXEMPTION - Personal Information Affecting an Individual's Privacy

This exemption permits the government to withhold all information about individuals in "personnel and medical files and similar files" when the disclosure of such information " would constitute a clearly unwarranted invasion of personal privacy." This exemption cannot be invoked to withhold from a requester information pertaining to the requester.

"records or information compiled for law enforcement purposes, but only to the extent that production of such law enforcement records or information ... could reasonably be expected to interfere with enforcement proceedings."

"records or information compiled for law enforcement purposes (the disclosure of which) would deprive a person of a right to a fair trial or an impartial adjudication.

personal information in law enforcement records the disclosure of which "could reasonably be expected to constitute an unwarranted invasion of personal privacy.

"records or information compiled for law enforcement purposes which could reasonably be expected to disclose the identity of a confidential source and information furnished by a confidential source."

to all law enforcement information which "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcements investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

necessary to protect the physical safety of "any individual" when disclosure of information about him "could reasonably be expected to endanger his life or physical safety."

All of these are in the LE section, individually.  DoD 5200 also lays the rules for this as "Law Enforcement Sensitive"  Our work with CN requires additional statments and training so our members fully understand thier responsibilities here.  Failure to comply can get people killed.  of all the missions we do, I worry about this the most.


(b)7 EXEMPTION - Investigatory Records Compiled for Law Enforcement Purposes

As amended, this exemption protects from disclosure "records or information compiled for law enforcement purposes.

EXEMPTION 7(A) Records or information that could reasonably be expected to interfere with enforcement proceedings. This exemption authorizes the withholding of "records or information compiled for law enforcement purposes, but only to the extent that production of such law enforcement records or information ... could reasonably be expected to interfere with enforcement proceedings."

EXEMPTION 7(B) Disclosure which would deprive a person of a fair trial or an impartial adjudication. Records that would prevents prejudicial pretrial publicity that could impair a court proceeding, protects "records or information compiled for law enforcement purposes [the disclosure of which] would deprive a person of the right to a fair trial or an impartial adjudication."

EXEMPTION 7(C) Personal Information in Law Enforcement Records. This exemption provides protection for personal information in law enforcement records. This exemption is the law enforcement counterpart to Exemption 6, providing protection for law enforcement information the disclosure of which "could reasonably be expected to constitute an unwarranted invasion of personal privacy."

EXEMPTION 7 (D) Identity of a Confidential Source. This exemption provides protection for "records or information compiled for law enforcement purposes [which] could reasonably be expected to disclose the identity of a confidential source --including a State, local, or foreign agency or authority or any private institution which furnished information on a confidential basis--and, in the case of a record or information compiled by a criminal law enforcement authority in the course of a criminal investigation, or by an agency conducting a lawful national security intelligence investigation, information furnished by a confidential source."

EXEMPTION 7(E) Circumvention of the Law. This exemption affords protection to all law enforcement information which "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

EXEMPTION 7(F) Physical Safety to Protect a wide Range of Individuals. This exemption permits the withholding of information necessary to protect the physical safety of a wide range of individuals. Whereas Exemption 7(F) previously protected records that "would ...endanger the life or physical safety of law enforcement personnel," the amended exemption provides protection to "any individual when disclosure of information about him or her "could reasonably be expected to endanger [his/her] life or physical safety."

"contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions."

This is (b)8 - wording is as it is in USC.

"geological and geophysical information an data, including maps, concerning wells."

As worded in the USC.  I wish they had been more detailed why this is.  Anyone can buy a topo map and seem to be in violation.  But I think "wells" means energy, not water, and information tied to proprietary and other data such as national defense, prison yards, critical infrastructure, and the like.  The US Govt has a large investment in domestic energy companies, and has been lobbied heavily for protection of the same.  I learned some of the data I work with was marked Secret (the actual data, not the subject), rumored to be classified because it could be exploited by energy companies.  The difference between publicly known or observable, and that which needs to be protected usually will have proprietary ties to other DoD statutes.  But IMHO this section has little teeth.  If it did, we wouldn't be able to see Area 51 (and a few other interesting sights) on Google Maps.

[ol'fido]

^^^^

I think I speak for a lot of us when I say....HUH?

[rebowman]

^^^^

I think I speak for a lot of us when I say....HUH?

If documents do not contain information on any of the above FOIA exemptions, then the document CANNOT be marked FOUO. 

[N Harmon]

If documents do not contain information on any of the above FOIA exemptions, then the document CANNOT be marked FOUO.

The Civil Air Patrol is not an instrumentality of the federal government and therefore is not subject to FOIA. Which makes pretty much makes everything of ours open to being marked FOUO?

[Spike]

The Civil Air Patrol is not an instrumentality of the federal government and therefore is not subject to FOIA. Which makes pretty much makes everything of ours open to being marked FOUO?

CAP is an "instrumentality" of the FED when performing AFAM's, and other situations when hired out to other FED Agencies. 

Go to Pubs and Forms section of CAP's website, and read the material listed under "other publications".

Reading is a powerful tool, when you want to present facts!

[FW]

^^^^

I think I speak for a lot of us when I say....HUH?

If documents do not contain information on any of the above FOIA exemptions, then the document CANNOT be marked FOUO.

 

OK, let's go back to "CAP 101"  (that's CAP for beginners)

1.  CAP is a non profit corporation
2.  CAP is NOT in any way part of the government
3.  To protect the members when on AFAMs (USAF authorized missions), CAP is considered an "instrumentality of the government".  This allows members who are killed or injured some federal benefits.
4.  Any corporate information that is considered "sensitive" by the corporation may be labeled "FOUO".  
5.  Some missions require "confidential" labels when directed by our customers
6.  CAP is not required to adhere to "FOIA" statutes
7.  Any other "explanations" to the contrary are pure fictions.  

[N Harmon]

CAP is an "instrumentality" of the FED when performing AFAM's, and other situations when hired out to other FED Agencies. 

Go to Pubs and Forms section of CAP's website, and read the material listed under "other publications".

Reading is a powerful tool, when you want to present facts!

Do you happen to have a direct cite? Because according to CAP General Counsel, we most certainly are not an instrumentality of the Federal Government and thus not subject to FOIA:

http://capnhq.custhelp.com/cgi-bin/capnhq.cfg/php/enduser/std_adp.php?p_faqid=233

[sardak]

^^^^^
Title 10 US Code Section 9442 (b)(2)
The Civil Air Patrol shall be deemed to be an instrumentality of the United States with respect to any act or omission of the Civil Air Patrol, including any member of the Civil Air Patrol, in carrying out a mission assigned by the Secretary of the Air Force.

Mike

[desertengineer1]

OK, let's go back to "CAP 101"  (that's CAP for beginners)

1.  CAP is a non profit corporation
2.  CAP is NOT in any way part of the government
3.  To protect the members when on AFAMs (USAF authorized missions), CAP is considered an "instrumentality of the government".  This allows members who are killed or injured some federal benefits.
4.  Any corporate information that is considered "sensitive" by the corporation may be labeled "FOUO".  
5.  Some missions require "confidential" labels when directed by our customers
6.  CAP is not required to adhere to "FOIA" statutes
7.  Any other "explanations" to the contrary are pure fictions.  

NEGATIVE on 2 and 6.  How does "NOT in any way" explain USAF GS12 Liaison officers, IMA's or CAP-USAF?  Nice try.

Missions for DoD Customers that DO NOT meet exemptions will fall under FOIA, but will be handled by CAP-USAF (or their designated council).

5 will based on individual customer requirements, but if they are DoD or use any DoD classified information, they (and CAP if we are brought in the picture) must adhere to DoD 5200.  If you have ever signed an SF312, it is in blood until you assume room temperature.

7?  Not wasting much more time on this one.  If you don't take the time to read the rules (or take the training), stay out of the argument.

[FW]

^you're serious, aren't you DE1
I appreciate your thoughts on my post however, I'll stick with my statements.

Please don't confuse CAP with CAP-USAF. They are two different organizations which happen to work in symbiosis.  

CAP = Civilian non profit
CAP-USAF = Military.... Govt..... and, all that goes with it.

FOIA requirements are for CAP-USAF; as for budgetary requirements imposed by OMB circulars...... NOT CAP, thank you.

I sign many documents for CAP, the CAP/CFO and EX even sign more. They don't deal with FOIA, nor does our GC.  I could care less about it, as CAP IS NOT BOUND BY IT.

Nice try. Anyone else want to chime in on this?  

[Spike]

Nice try. Anyone else want to chime in on this?  

FOIA applies to CAP documents that are in possession by the USAF.  Such as AFAM material pertaining to funded missions, etc.  ONLY those CAP documents held by USAF though.  As a private Corporation I was under the impression that CAP only need to produce documents for public review pertaining to those outlined by the Federal Government governing openness and transparency.

This may be where people get confused.  CAP=business, CAP-USAF=FED.

FW....I agree with you.  I wish people would take time to read the documents they cite when backing up their beliefs.  Lets use FACT, not opinions or beliefs, and we will all be better off!

[RiverAux]

Just to throw a monkey wrench into the argument, some states have Freedom of Information Act laws that very well could apply to CAP depending on exactly how that law was written and what support, if any, CAP gets from the state. 

[FW]

Good point, River.  Some states consider "their" CAP as a state agency.  Some states support a CAP wing with a grant.  In either case, the only "reporting" requirement I know of is an accounting  of that support.  The report goes back to the state which, in turn, may report to the public.  CAP has no direct obligation to report to anyone other than it's members (or it's sponsor).   

IMHO, the term "FOUO" is a generally accepted one;  used for correspondence or information deemed to be kept within the organization.  Membership info, SS#'s are considered as "FOUO" in CAP.  Certain information pertaining to Radio Freqs, CN information, etc are also considered "FOUO".   There may be other reasons why "FOUO" may be found on information but, I think I'm beating this horse blanket a bit too much.

[RiverAux]

CAP has no direct obligation to report to anyone other than it's members (or it's sponsor).   

Depending on how the state law was written the general public may have a right to request documents from CAP.  It would be interesting to see what happened in such a state if a FOUO document was requested and we refused...

[RedFox24]

While I appreciate all the debate my original question still goes unanswered.

What obligation, if any, does a member of CAP have with FOUO marked documents given to them outside the CAP food chain regardless of if it is related to CAP or to another government agency. 

You all haven't answered the question, just debated the concept of FOUO.  What it means or doesn't mean and what is or is not really FOUO. 

From the debate it would appear that I have no obligation with anything marked FOUO, inside or outside of CAP, because FOUO means really nothing other than it is something that someone, real or imagined, has deemed "sensitive" or makes them feel real important or military by using FOUO on everything. 

However if you go take the FOUO training on line from CAP and then disagree with it, you automatically generate an email to your Wing CC and Squadron CC that you cant be around "sensitive" materials and you can retake the training in 6 weeks.

So FOUO training means nothing other than it is one of the silly check box membership requirements that HQ has developed to make us look like we are playing military again.  More fluff and window dressing over substance, again.

BTW this post is FUOUO (U being Un-) which is how I am going to start making my CAP correspondence with those who insist on using FOUO. 

[Spike]

So FOUO training means nothing other than it is one of the silly check box membership requirements that HQ has developed to make us look like we are playing military again.  More fluff and window dressing over substance, again.

BTW this post is FUOUO (U being Un-) which is how I am going to start making my CAP correspondence with those who insist on using FOUO. 

^ Since CAP is a business (YES it really is a business), anything you disclose that had been stamped "For Official Use Only" and in some way hurts the business you can be held liable.

We all forget that we are no more than "employees" in a non profit BUSINESS.  Let me say that again, all of us are unpaid employees in a non profit business.

You may not agree with what I just said, but it is FACT.  Don't believe anything different.

You singed your volunteer contract (membership application), and it states: "I voluntarily subscribe to the objectives and purposes of the Civil Air Patrol and agree to be guided by CAP Core Values, Ethics Policies, Constitution & Bylaws, Regulations and all applicable Federal, State, and Local Laws" AND: "I agree to abide by the decisions of those in authority of the Civil Air Patrol".

If you released "official use only" material in a for profit business and it hurt them monetarily you would be fired, and they may come after you in a civil trial.

SO by all means don't follow the rules of the corporation.  You are showing your arrogance and uselessness to both our Cadets and those in your chain of command.  I fully expect that if you can not follow something as simple as FOUO guidelines you can not follow other rules, and you need to resign as soon as possible.

[MIGCAP]

1.  CAP is a non profit corporation

So long as you don't forget the "sponsored and chartered by Congress, part"

2.  CAP is NOT in any way part of the government.

Not True, This is simply a fight you are going to lose in court, any judge and/or jury is going to consider folks in AF "style" uniforms, flying aircraft bought by the taxpayers, driving vans bought by the taxpayer, performing missions assigned by the DoD to be part of the government.

3.  To protect the members when on AFAMs (USAF authorized missions), CAP is considered an "instrumentality of the government".  This allows members who are killed or injured some federal benefits.

True, however you can't have it both ways either you are an instrumentality or your not.  When you are an instrumentality you are part of the government.  Members of the jury, I submit that this person, in an Air Force Uniform, flying an Air Force Aircraft (with permission), and being covered by Air Force Insurance, and having been dispatched by the USAF, should not really be considered as having anything to do with the Air Force.  (sure were going to win that one)

4.  Any corporate information that is considered "sensitive" by the corporation may be labeled "FOUO".  

Absolutely incorrect.  No "private" corporation can classify something FOUO unless it is derived from a government contract, or government provided information.  Private corporations use terms like "Company Private" or "proprietary" which are enforced within the company and respected by the customers.

5.  Some missions require "confidential" labels when directed by our customers.

Absolutely wrong.  CAP, as a corporation has no security officer, no corporate clearance, no CAGE Code, no ability to receive, process, store, or disseminate "confidential" information.

6.  CAP is not required to adhere to "FOIA" statutes.

See answer(s) above. we sure as hell are.

7.  Any other "explanations" to the contrary are pure fictions.  

I'm afraid the only fiction here is that CAP has done anything to establish a security program.  Their answer to a good government customer question about what would happen if we needed to share classified information with you? Has been to "make up" an incorrect training class concerning FOUO, require everyone to take it, and build yet more little kingdom within the organization to make folks feel important, and preserve the corporate overhead.

CAP does not have anything that is legally FOUO. If we want to be a corporation then we need to tell the government to kiss off. If we want to be the USAF Aux, then we need to get rid of the Corporation mentality, and become the USAF Aux full time.  If we want to have the tax exempt status for our folks then we need about a three person membership support office.  Our fundamental problem is that we have never decided what CAP whats to be when we grow up. Therefore, we simply will never amount to anything.  We have instead chosen to make up rules to appear to be important, feather the corporate nest, and stagnate.

[RedFox24]

Spike, are you the CS for the Wing here because that is the same arrogant non answer that he gives.

If you could read, you would see that the original question was my trying to find out what my OBLIGATIONS were when presented with what I believed to be a breach of FOUO.  Again learn to read before you shoot your fingers off on the key board.    

That is the problem with CrAP right now, no one wants to give a straight answer on anything.  Every answer is laced with opinion and innuendo.  There is no training or teaching or mentoring, just check boxes.  And scorn and ridicule from people like you when someone ask a question.  

A member takes the training on line agrees and then what?  Same with ORM, Equal Opportunity, and others.  If I disagree I can't participate, but if I agree and then come upon an instance where that training is violated then what?  Call the IG?  Call the Wing Commander?  Call the local Mall Cop?  Sure some of the guidelines are spelled out but not all.

So Spike what is the answer to the question, according to the CAP regs and training you took, assuming you took it?  After all you seem to be the FOUO lawyer all at once.  

[FW]

Red, I like your style  ,

CAP is limited in its ability to do anything to a member who "violates"  FOUO information.  Most severe penalty is loss of membership.  However, violation of information deemed FOUO by an outside govt. agency working with CAP; for instance the state ANG, is a different story.    Before you get such information, you agree to abide by the rules.  Breaking those rules is not good.  Prosecution by the attorney general is always an option.  However, CAP has nothing to do with this kind of enforcement.

"FOUO training" is just understanding some information should not be shared.  No one in a black van will come to get you if you forget.  (well.... maybe a white one  )

I hope I made things a bit clearer to you.

[Eclipse]

So by all means don't follow the rules of the corporation.  You are showing your arrogance and uselessness to both our Cadets and those in your chain of command.  I fully expect that if you can not follow something as simple as FOUO guidelines you can not follow other rules, and you need to resign as soon as possible.

It is somewhat of an interesting dynamic that the same people who have voluntarily joined an organization find no end to the ways in which even the most basic rules and requests can be thwarted in the vein of "you can't tell me what to do..." and "I'm only a volunteer...", etc.

No wonder we can't get along and agree on the big issues if we can't get members to understand and comply with the small, relatively trivial stuff.

If someone wants a document or information to remain private to the group it is being sent to, respect that and move on.
Lawyering up about it is a waste of everyone's time.

[FW]

MIGCAP, did you wake up on the wrong side of the bed this morning?

I'm not a lawyer however, I've stayed at a Holiday Inn Express quite a few times over the years......

Your responses to my previous post, while entertaining, have no basis in reality.  To date, there has never been any judicial or official ruling by any govt. branch that CAP is a governmental agency.  

"FOUO" has been found in documents of many private corporations, clubs, fraternal organizations, parents, teachers, and a host of others who wish to keep written correspondence closely held.  As has been said before, "lighten up".

[RedFox24]

FW

Thank you.  

We take the "training" to abide by the rules.  We work to keep the rules, we work to insure that we operate with the guidelines of that "training" to the best of our ability.  And we work to see that we abide by not only the rule but the spirit of the rule.  

FOUO or not.

In the program or not.

As a member, not a volunteer, I have what I believe to be obligations that I take very seriously.  I have to many years invested in this organization not to take those obligations seriously.  However I don't see that others take or make any effort anymore to see that those obligations are a part of their membership.

Ok, better quit here before I get banned from the board.............

Just make sure when you come to get me in that white van that you check the air pressure in the tires first!!!

RRR

[Spike]

Spike, are you the CS for the Wing here because that is the same arrogant non answer that he gives.

If you could read, you would see that the original question was my trying to find out what my OBLIGATIONS were when presented with what I believed to be a breach of FOUO.  Again learn to read before you shoot your fingers off on the key board.    

Red......when you wrote that you were not going to follow the rules, you voided your original question, and presented a new issue to respond to.  

I have no obligation to respond to your original question after you tell ALL OF US that it does not matter since you are going to do something that would go against our logical responses.

You had your answer the moment you wrote your original question, you just don't like the fact that you have to follow FOUO guidelines and are looking for others to back you up.

RedFox, don't play people like they can not read into your questions and discover your real motives.

Now you will bash me and tell me that wasn't your real motive, and that you were genuinely interested in a answer, when in fact the answer you will reference is on the Knowledgebase already and you will twist that answer to support your belief.

I read the posts, I got my answer out of your original question.  I decided to respond to more intelligent questions further down in the thread.

Red Fox, I suggest you read more slowly next time.  You obviously skimmed the material, and have no clue what it means.

Bash Away......but I already expected that from you, a person looking for a fight either about your subject or some other skewed tangent!

[AlphaSigOU]

Here's an explanation on U//FOUO - and this is from the CAP NTC website:

SO WHAT EXACTLY DOES "FOR OFFICIAL USE ONLY" MEAN?

One of the most commonly encountered questions we get deals with the real meaning of "For Official Use Only" and the implications for storage, transmittal, and disposal. The following information, while not formal policy, will hopefully help steer you straight.

First, off, "FOUO" is primarily a Department of Defense phrase/acronym. Other government departments use it, but many have also come up with their own, similar phrases, to include "Sensitive but Unclassified," or "Law Enforcement Sensitive," or just "Official Use Only." While this discussion only covers FOUO, it hopefully might also answer questions relating to these other, similar markings.

"Unclassified//For Official Use Only" (abbreviated to U//FOUO) is a handling instruction, as opposed to a true classification marking. It is used only for documents or products which contain material which is exempt from release under the Freedom of Information Act. That is, U//FOUO cannot be gratuitously placed on any document simply as a means of better controlling the content.(emphasis mine - CEC)

For any document/product correctly bearing the U//FOUO handling instruction, certain safeguards must be taken. Generally speaking, the material should be treated as if it were classified CONFIDENTIAL. This means it cannot be discarded in the open trash, made available to the general public, or posted on an uncontrolled website. It can, however, be shared with individuals with a need to know the content, while still under the control of the individual possessing the document or product. For example, U//FOUO material relating to security precautions during overseas assignments may be shared with family members at home. The material should then be returned to the government office and be properly retained or destroyed. Wherever possible, U//FOUO information should not be passed over unencrypted communications lines (e.g., open phones, non-secure fax, personal e-mails). If no secure communications are available for transmission, U//FOUO material may be sent via unprotected means, with supervisory approval after risk has been assessed.

Unfortunately, it appears people are getting hung up on 'secret squirrel' pseudo-classifications. I'll hafta agree the CAP OPSEC training isn't the greatest in the world - there is far better available from the Interagency OPSEC Support Staff (www.ioss.gov). Tacking on legal confidentiality disclaimers on an email when none are needed just tells the world 'Look at ME! I'm important!!!' There is a time and a place for them, and routine emails aren't one of them. But I'll shut up and color, lest I get slapped.

[Short Field]

Unfortunately, it appears people are getting hung up on 'secret squirrel' pseudo-classifications.

Or they just like showing people they really don't know what they are doing.   The negative there is that it makes some folks question what else they are doing wrong.....

[AlphaSigOU]

Unfortunately, it appears people are getting hung up on 'secret squirrel' pseudo-classifications.

Or they just like showing people they really don't know what they are doing.   The negative there is that it makes some folks question what else they are doing wrong.....

Exactimundo... 

[ol'fido]

It all boils down to ... Let's quit worrying about the ants while the elephants are stomping us to death.

[Short Field]

Exactimundo...