Executive Order 13526, signed by President Barack Obama on December 29, 2009, is the presidential directive that governs how the federal government classifies, protects, and eventually releases national security information. It replaced Executive Order 12958 and its 2003 amendments, and it remains the foundational rulebook for every executive-branch agency that handles sensitive records. The order sets three classification levels, limits who can classify, requires that nearly all classified records eventually become public, and forbids using the system to hide embarrassing or illegal conduct.1National Archives. Executive Order 13526 – Classified National Security Information
The Three Classification Levels
Every piece of classified information falls into one of three tiers, distinguished by how much damage its unauthorized release could cause.
- Top Secret applies when disclosure could reasonably be expected to cause exceptionally grave damage to national security.
- Secret applies when disclosure could reasonably be expected to cause serious damage.
- Confidential applies when disclosure could reasonably be expected to cause damage.
At every level, the official making the decision must be able to identify or describe the specific harm disclosure would cause. A vague sense that something ought to be secret does not meet the standard. The information also has to be owned by, produced by or for, or under the control of the federal government before any marking can be applied.
What Can and Cannot Be Classified
Section 1.4 lists the only eight subject-matter categories in which classification is permitted:
- Military plans, weapons systems, or operations
- Foreign government information
- Intelligence activities, sources, methods, or cryptology
- Foreign relations or foreign activities of the United States, including confidential sources
- Scientific, technological, or economic matters relating to national security
- Programs for safeguarding nuclear materials or facilities
- Vulnerabilities or capabilities of systems, installations, infrastructure, or protection services relating to national security
- Development, production, or use of weapons of mass destruction
Information that does not fit squarely within at least one category cannot be classified, no matter how sensitive someone considers it.2National Archives. Executive Order 13526 – Classified National Security Information
Section 1.7 then draws hard lines around what classification may never be used for. Information may not be classified, kept classified, or shielded from declassification to conceal violations of law, inefficiency, or administrative error. It may not be classified to prevent embarrassment to any person, organization, or agency, to restrain competition, or to delay the release of information that does not genuinely require protection in the interest of national security. These prohibitions give teeth to the rest of the order. An official who stamps a document “Secret” to bury an embarrassing internal report is not making a bad judgment call; that official is violating a direct presidential directive and can face the sanctions described below.
Who Has Authority to Classify
The power to decide, for the first time, that information warrants classification is called Original Classification Authority. Under Section 1.3, only three categories of officials hold it: the President and Vice President; agency heads and officials specifically designated by the President in the Federal Register; and subordinate officials who receive a written delegation from one of those officials, limited to those with a demonstrated and frequent need to classify. Before exercising the authority, every official must complete training on the order’s standards, including safeguarding rules and the sanctions that apply for errors. Agency heads must remove the classification authority of anyone who shows reckless disregard or a pattern of mistakes.
Most classified documents, though, are not the product of an original decision. They come from derivative classification, which is the process of incorporating existing classified information into a new document and marking that new document consistently with the source material. A staff officer writing a briefing that quotes from a Top Secret intelligence report must mark the briefing at least Top Secret and carry forward the source’s declassification instructions. Derivative classifiers do not need Original Classification Authority, but Department of Defense policy requires them to complete training annually.3Defense Counterintelligence and Security Agency. Derivative Classification The distinction matters because getting derivative markings wrong can strip protection from sensitive material or lock up information that should be available to a wider audience.
How Classified Records Get Released
One of the order’s core principles is that secrecy is not permanent. Section 3.3 sets an automatic declassification rule: all classified records that are more than 25 years old and have been determined to have permanent historical value must be automatically declassified on December 31 of the year that marks 25 years from their creation. This happens whether or not anyone individually reviews the records.
Agency heads can exempt specific information from the 25-year rule, but only if release would clearly and demonstrably damage national security in one of nine defined ways. The exemption categories cover information that would reveal a confidential human source, assist in developing weapons of mass destruction, compromise cryptologic systems, expose active military war plans, cause serious harm to foreign relations, impair protection of the President and other officials, or violate a treaty or statute prohibiting unilateral declassification.4National Archives. Exemptions from Automatic Declassification Even exempted records face a deadline. Unless the information involves a confidential human source, human intelligence source, or weapons of mass destruction design concepts, agencies must set a declassification date or event no later than 75 years from the date of the record.
Mandatory Declassification Review
Anyone, inside or outside the government, can ask a federal agency to review specific classified information for possible release. The request has to describe the document with enough specificity that the agency can locate it with a reasonable amount of effort.5National Archives. Mandatory Declassification Review A few limits apply: the information cannot be the subject of pending litigation, cannot have been reviewed for declassification within the past two years, and the requester cannot file a Freedom of Information Act request for the same material at the same time. If the agency denies release, the requester can appeal to the Interagency Security Classification Appeals Panel, which has historically overturned a large majority of the agency decisions it has reviewed.
Classification Challenges from Inside
Section 1.8 gives any authorized holder of classified information the right to challenge a classification decision they believe, in good faith, to be improper. If the agency does not provide a full response within 120 days, the challenger can escalate to the Interagency Security Classification Appeals Panel. The mechanism exists so classification does not become a one-way ratchet where information can only ever grow more restricted.
Access, Clearances, and Need to Know
Section 4.1 sets three conditions for access to classified information. A person must have received a favorable eligibility determination (commonly called a security clearance) based on a background investigation. The person must have signed an approved nondisclosure agreement. And the person must have a need to know the specific information for their official duties.
That last requirement is where the system is most often misunderstood. Holding a Top Secret clearance does not open every Top Secret document in the government. The clearance means an investigation found no disqualifying issues; need-to-know separately limits access to the information that is actually relevant to the person’s job.
Oversight: ISOO and the Appeals Panel
The Information Security Oversight Office, housed within the National Archives and operating under the direction of the Archivist of the United States, is the government’s primary watchdog over the classification system. Under Section 5.2, its director develops implementing directives, oversees agency compliance, conducts on-site reviews, and reports at least annually to the President on the state of the classification system. Those annual reports, with government-wide statistics on classification activity and costs, are published on the ISOO website.6National Archives. ISOO Reports
The Interagency Security Classification Appeals Panel, established under Section 5.3, is the appellate body for classification disputes. It hears appeals from government employees challenging classification decisions, rules on appeals from members of the public whose Mandatory Declassification Review requests were denied, and approves or denies agency requests for exemptions from automatic declassification. The panel includes representatives from the Departments of State, Defense, and Justice, along with the National Security Council, the Office of the Director of National Intelligence, and the National Archives.
Penalties for Violations
Section 5.5 spells out the consequences for violating the order. The sanctions reach anyone who knowingly, willfully, or negligently discloses properly classified information to unauthorized persons, classifies information in violation of the order, creates or continues a special access program that does not meet the order’s requirements, or otherwise contravenes the order or its implementing directives.7govinfo. Executive Order 13526 – Classified National Security Information Administrative sanctions include reprimand, suspension without pay, removal from employment, termination of classification authority, and loss or denial of access to classified information. At a minimum, anyone who shows reckless disregard or a pattern of errors must have their classification authority promptly removed.
Deliberate unauthorized disclosure can also trigger criminal prosecution under several federal statutes. Under 18 U.S.C. § 793, unlawfully transmitting or retaining defense information carries a sentence of up to ten years.8Office of the Law Revision Counsel. 18 U.S. Code 793 – Gathering, Transmitting or Losing Defense Information Under 18 U.S.C. § 798, knowingly disclosing classified information related to communications intelligence or cryptographic systems also carries up to ten years.9Office of the Law Revision Counsel. 18 U.S. Code 798 – Disclosure of Classified Information The most severe penalties fall under 18 U.S.C. § 794, which covers transmitting defense information to a foreign government with intent to harm the United States or benefit a foreign nation. That offense is punishable by any term of years, life imprisonment, or death.10govinfo. 18 U.S. Code 794 – Gathering or Delivering Defense Information to Aid Foreign Government