foreigndisclosure.com

I am a big fan of technology and I try to leverage it as frequently as possible.  I am all about saving time and effort, so when an well-meaning engineer or software designer approaches me with how he or she plans to automate the foreign disclosure release process, I am all ears.  What I try to explain to these folks is that the foreign disclosure process more art form than mathematical equations in a lot of cases.  That being said, I’d be interested in knowing what foreign disclosure automation technology is out there.  If you know of any software out that you would recommend, please send me a link.

Every so often an FDO will get an urgent disclosure request for a product and the FDO knows just by looking at the source of the information that he/she has no shot of ever getting the information cleared in time for release.  Instead of just saying that it can’t be done, consider using the Internet for quick search.  You would be amazed at how much of the information we consider to be sensitive is actually available in the open source environment.  If you can find the information you need in the open press, it can be used in place of the original reference.  Bottom line is not to give up with seeing if it is available somewhere else.

Conferences can be great for sharing information among a wide variety of personnel and organizations however they are also a great venue for sharing a little bit too much information.  When your receive a disclosure request to review documents, talking points, and slides, here are a few tips.

1. If at all possible, avoid distributing electronic copies of conference material.  There a whole lot more ways for extra information to sneak into an electronic briefing than a hardcopy one.  If you must have softcopy make sure you PDF the document to help eliminate any hidden data.

2. Ask the briefer who will be attending the event. If the briefing is going to be held at a secure location by cleared individuals thats one thing. If the briefer is going to an international event, like an open defense contracting expo, that is something different.  The key here is to do your best to find out exactly who the audience is for this briefing or presentation.

3. Try not to fall into what I call the “Last Minute Hurry Up” trap. When you know there is a conference or large event coming, always set a cut-off date for disclosure review. If you give an analyst or author the opportunity to write up til the very last minute, they will.  Set a hard date for when material has to be in for review and stick to it.  Mistakes happen when the process is rushed.

4. When dealing with conferences, or any major information exchange, it is always important to have another person to give you a disclosure sanity check on the information you are clearing.  Now realizing that you are probably the only FDO in your organization, you can still usually find a sharp security person or analyst who can put another set of eyes on your documents.  I used to think I didn’t need another person to review my work, now I look forward to it. Its a cheap and easy CYA.

5. If your organization is holding a conference, make sure you get your POC information in the conference announcement message. Let the attendees know that you will be the FDO POC for all briefings and that they are due to you by a certain date.  If an attendee is bringing information and his/her organization does not have an FDO, offer to review the documents for them.  By getting your contact info into the conference message you will avoid the last minute review requests.

This may sound like common sense but when dealing with disclosure and release decisions, you should always keep excellent records.  If you are in a positon to make, or support, foreign disclosure decisions you need to be able to revisit those decisions weeks and months later. 

Another thing to consider is the importance of “Official” documentation. In this age of phone and email connectivity, we tend to think that any communication is “Official” if it comes from another office or agency.  If possible, do a Memorandum For Record (MFR) for each decision that you do and try to get other disclosure officials who are providing you input, to do the same. 

I have known a number of FDO’s over the years but the best ones were always great record keepers.

Depending on what governmental organization you work for, you may deal information in a wide variety of formats.  One thing to remember is that some organizations may have multiple sections and classification levels within the same document. This is called a “Tearline”.  The idea being that you could tear it off and give it to someone.  To make sure you are sharing the maximum amount of information possible, always check for a tearline.