Classification by Compilation: Mosaic Theory, Marking, and Penalties

Classification by compilation is the practice of treating a set of individually unclassified pieces of information as classified once they are combined, because the combination reveals something sensitive that no single piece reveals on its own. Executive Order 13526 authorizes this in Section 1.7(e): a compilation of unclassified items can be classified when the assembled data exposes a new association or relationship that meets the order’s standards for protection.¹ A ship’s departure date and a satellite’s overhead schedule may each be harmless on their own; together they can expose a surveillance operation. That is the situation the rule exists to handle.

The Mosaic Theory Behind the Rule

The logic comes from what intelligence professionals call the mosaic theory. An analyst can take scattered, publicly available facts and assemble them into a picture that was never meant to be seen. The Supreme Court accepted this reasoning in CIA v. Sims (1985), observing that foreign intelligence services have “the capacity to gather and analyze any information that is in the public domain and the substantial expertise in deducing the identities of intelligence sources from seemingly unimportant details.”² The Court held that even “superficially innocuous information” can be withheld if it might allow someone to identify an intelligence source or reconstruct a sensitive operation.

Section 1.7(e) sets two conditions. The compiled information must reveal an additional association or relationship whose unauthorized disclosure could reasonably be expected to damage national security. And that association must not already be apparent from any of the individual items standing alone.¹ What matters is what emerges from the combination, not the sensitivity of any single data point. Six months of troop movements, a set of budget line items that reveals a program’s true scope, or technical specifications that individually describe common equipment but collectively expose a weapons system’s capabilities can each trigger the provision.

Federal regulations reinforce the framework. The classification rules applied by certain federal agencies state that “certain information which would otherwise be unclassified may require classification when associated with other unclassified or classified information,” and require any classification on this basis to be supported by a written explanation kept with the file.³ That written-explanation requirement is what separates a legitimate compilation classification from a vague assertion that some collection of facts might, hypothetically, be sensitive.

Who Can Actually Make the Call

Deciding that a collection of unclassified data is now classified is not a judgment any government employee can make. The power belongs to officials known as Original Classification Authorities. Under Section 1.3 of Executive Order 13526, original classification authority may be exercised only by the President, the Vice President, agency heads designated by the President, and subordinate officials who receive a specific written delegation.⁴ Those delegations must be “limited to the minimum required to administer” the order, and each one must identify the official by name or position.¹

When such an official classifies a compilation, a general claim of risk is not enough. The authority must identify or describe the specific damage to national security that unauthorized disclosure could reasonably be expected to cause. The information must also fit one of the categories the order recognizes: military operations, intelligence activities and methods, foreign relations, scientific or technological matters tied to national security, and a handful of others.⁴ “This could help our adversaries” does not clear the bar. The authority has to connect the compiled data to a concrete harm.

How a Compiled Document Gets Marked

Once an Original Classification Authority makes the decision, it gets written into a security classification guide so that everyone else handling the same type of information knows how to treat it. Section 2.2 requires agencies with original classification authority to produce these guides, each approved in writing by an official who both supervises the information and can classify at the highest level the guide prescribes.⁵

Marking a compilation on paper takes some care. Each portion of a document (a paragraph, chart, bullet, or table) carries its own classification marking. When every portion is unclassified but the whole document is classified because of the combination, a reader needs to see why. The Information Security Oversight Office directs that each portion be marked with its own level, the document’s overall banner reflect the higher level the compilation creates, and a statement appear on the front page explaining why the overall classification exceeds any individual portion.⁶ The practical result is a memo where every paragraph reads “(U)” for unclassified while a “SECRET” banner runs across the top, with a note pointing to the classification guide section that treats the combination as classified.

The Derivative Classifier Problem

Most people who work with classified information are not Original Classification Authorities. They are derivative classifiers, applying markings based on decisions someone else already made. Under Section 2.1 of Executive Order 13526, anyone who reproduces, extracts, or summarizes classified information must carry the appropriate markings forward, without needing original classification authority to do so.⁷

This is where compilations get dangerous. A derivative classifier pulling data from several unclassified sources may not realize the combination triggers a classification, because none of the source documents carries a marking. The order tries to address the risk by requiring derivative classifiers to complete training on classification principles at least once every two years; officials who miss that window lose their authority to apply derivative markings until they finish it.⁷ The order also encourages classified addenda when the classified content is only a small part of a larger document, so the unclassified portions can circulate freely. For a compilation, that often means peeling the sensitive data points into a classified annex.

How Long a Compilation Stays Classified

A classified compilation does not stay classified forever. Section 1.5 of Executive Order 13526 requires the Original Classification Authority to set a specific date or event for automatic declassification at the time of the original decision. If none can be determined, the default is 10 years from the date of the decision. The maximum is 25 years, with narrow exceptions for information that would reveal confidential human intelligence sources or key weapons design concepts.⁷ No information may remain classified indefinitely, and older documents carrying open-ended instructions have to be declassified under the current order’s procedures.

The order also lists uses of classification that are flatly off-limits. Section 1.7(a) prohibits classifying information to conceal legal violations, prevent embarrassment, restrain competition, or delay the release of information that does not require protection.¹ Those prohibitions apply just as strongly to compilations. An agency cannot put a classification banner on a stack of embarrassing budget documents by claiming the collection is sensitive. The compiled data must genuinely meet the national security standard.

Getting a Classified Compilation Released

The Freedom of Information Act gives anyone the right to request government records, but classification by compilation is a hard obstacle. Exemption 1, at 5 U.S.C. § 552(b)(1), lets the government withhold records that are “specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy” and are “in fact properly classified pursuant to such Executive order.”⁸ When a request targets what the government considers a classified compilation, the agency typically withholds the whole set, arguing that releasing even the individually unclassified items would let the requester reconstruct the sensitive picture.

Courts defer heavily to agencies on these calls. The Supreme Court in CIA v. Sims held that classification decisions by intelligence officials “are worthy of great deference given the magnitude of the national security interests and potential risks at stake,” and that judges are not positioned to second-guess officials familiar with “the whole picture.”² In practice, agencies usually prevail on Exemption 1 claims when they follow the correct procedures and offer a logical explanation for the compilation’s sensitivity.

A separate path is the mandatory declassification review under Section 3.5. Anyone can send a written request to the agency asking that specific classified information be reviewed for declassification. The description has to be detailed enough that the agency can locate the material without unreasonable effort, and the request must ask for the release of all reasonably segregable material.⁹ If the agency denies it, an internal appeal comes first. After that appeal, or if the agency simply fails to answer (one year for an initial decision, 180 days for an appeal), the requester can take the case to the Interagency Security Classification Appeals Panel, with 60 days to file from the final agency decision or the missed deadline.¹⁰

The panel is not a rubber stamp. According to the National Archives, additional information is declassified in roughly 60 percent of the cases it reviews. That figure makes the appeal worth pursuing, especially for compilation classifications where the underlying data points are individually unclassified and the argument for the combination’s sensitivity may have weakened with time. One constraint: a FOIA request and a mandatory declassification review request cannot cover the same information at the same time.

Penalties for Mishandling

A compilation classified under Executive Order 13526 carries the same legal weight as any other classified material. Under 18 U.S.C. § 793, anyone who gathers, transmits, or through gross negligence allows the loss of defense information faces up to 10 years in federal prison, a fine, or both.¹¹ The same penalty reaches anyone who conspires to violate these provisions when at least one conspirator takes a concrete step toward the plan.

The compilation setting adds risk that people underestimate. Someone who would never dream of emailing a Top Secret document might not think twice about sending five separate unclassified data points in a single message. If a classification guide treats those five points as a classified compilation, the email is now classified information moving across an unclassified system. That is exactly the mistake the biennial training requirement exists to prevent.

The Same Idea in Trade Secret Law

The principle that a collection of individually available facts can become something worth protecting reaches beyond national security. Federal trade secret law applies the same logic to commercial information. Under the Defend Trade Secrets Act, 18 U.S.C. § 1839 explicitly includes “compilations” in its definition of a trade secret, alongside formulas, patterns, designs, and processes.¹² A customer list built from public names, a pricing database assembled from market research, or a combined set of manufacturing tolerances can all qualify, provided the owner took reasonable steps to keep the compilation secret and the compilation derives independent economic value from not being generally known or readily ascertainable. The parallel is more than superficial: both bodies of law recognize that assembling information can produce something more sensitive than the sum of its parts. The remedies differ. Classification restricts access outright; commercial law compensates the owner after misappropriation and tries to stop further spread.¹³

1
National Archives. Executive Order 13526
2
Library of Congress. CIA v. Sims, 471 U.S. 159 (1985)
3
eCFR. 12 CFR 403.3 – Classification Principles and Authority
4
Government Publishing Office. Executive Order 13526 – Classified National Security Information
5
National Archives. Executive Order 13526 – Classified National Security Information
6
Information Security Oversight Office (ISOO). ISOO Training Tip 15 – Classification by Compilation
7
GovInfo. 3 CFR Executive Order 13526 – Classified National Security Information
8
Office of the Law Revision Counsel. 5 USC 552 – Public Information
9
National Archives. Mandatory Declassification Review
10
eCFR. 32 CFR 2003.13 – Appeals of Agency Decisions Denying Declassification Under Mandatory Review
11
Office of the Law Revision Counsel. 18 U.S. Code 793 – Gathering, Transmitting or Losing Defense Information
12
Office of the Law Revision Counsel. 18 USC 1839 – Definitions
13
Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings