Thanks to a FOIA request by Joseph Durso, pointed out to me by @manhack, there is an updated public copy of the Intelligence Community - Markings System Register and Manual that I last wrote about in 2014. In this post, I’ll analyze the major changes compared to the 2013 version of the Manual.
The FOIA request was submitted in December 2019 and received in July 2021, and the responsive record is dated December 2016. The Manual is reviewed and updated at least annualy, so this indicates that there have not been major changes in the three years between 2016 and 2019. The request timeline also shows how long it can take to receive requested records.
The most substantial change to the U.S. Intelligence Community markings system is the retirement of two top-level control systems: ENDSEAL and KLONDIKE.
The ENDSEAL Control System was closely associated with the SI Control System, which protects signals intelligence. According to the 2013 Manual, any information marked with EL also required marking it SI. Now the ENDSEAL Control System and marking have been retired and the ENDSEAL compartments, ECRU and NONBOOK, are now compartments of SI.
On the updated marking template for ECRU, there are some interesting new details that further confirm the analysis in an earlier post on ENDSEAL:
The definition for ECRU has been updated to read, “An ECI used to protect technical data derived from exploitation of a high interest signal.”
Also a note on the page reads, “NIA in coordination with NSA are working on this transition” from ENDSEAL to NI. In this context, the NIA is likely the Naval Intelligence Activity.
The definition for NONBOOK remains unchanged: “An SI compartment used for sensitive intelligence products intended for dissemination to IC consumers.”
There are also new classification guides for ECRU and NONBOOK under the SI Control System, for reference for further guidance.
The KLONDIKE Control System is related to geospatial intelligence. In the 2013 Manual, KLONDIKE is described as “a sensitive compartmented information (SCI) control system designed to protect sensitive Geospatial Intelligence.” And TALENT KEYHOLE is “designed to protect information and activities related to space-based collection of imagery, signals, measurement and signature intelligence, certain products, processing, and exploitation techniques, and the design, acquisition and operation of reconnaissance satellites.”
It is likely that the close association of these two control systems led to their merging, because administering separate SCI control systems is more complex than separate compartments within a single SCI control system. In the 2016 Manual, all of KLONDIKE’s three declared compartments, BLUEFISH, IDITAROD, and KANDIK, are now a part of the TALENT KEYHOLE Control System. Accordingly, the documentation for further guidance was updated to reference updated marking guides.
The 2016 Manual gives classifiers guidance as to when legacy-marked intelligence must be re-marked. With the retirement of the standalone HCS marking in 2013, and now KDK and EL in 2016, there is likely a lot of material that bears the old markings. According to the Manual, an intelligence producer must re-mark material:
As an example, IC employees are instructed to re-mark legacy KLONDIKE material as TK, e.g. changing from KDK-BLFH to TK-BLFH.
The 2016 marking template for the TALENT KEYHOLE Control System has a new, fully redacted paragraph compared to the 2013 version. The Change Log gives a hint as to the redacted information: a definition for “GEOCAP”.
This term is referenced in DOD 5200.01, Volume 2, Effective July 28, 2020 but only in an example. In the example, it shows a marking line as S//TK-G//NF to indicate SECRET//TALENT KEYHOLE-GEOCAP//NOFORN.
A job posting expands the acronym to Geospatial-Intelligence Controlled Access Program. But other than that, little information is publicy available.
In the 2016 Manual, there is more discussion around machine-readable marking systems. The IC appear to have developed an electronic access control mechanism that enforces permissions based on classification markings. This system is called “Access Rights and Handling”. The 2016 Manual has a table listing which markings affect access control decisions by automated software and which do not.
In addition, The 2013 Manual’s Annex D - Automated Marking System Guidance for ODNI Developers was removed. It appears to have been formalized and replaced with IC Standard (ICS) 2008-500-05, “the required automated system for IC classifiers to create, apply, store, and reuse classification and control markings in TS SCI email and MS Office products” (p13).