EPA Does Not Adequately Follow National Security Information Classification Standards

Our review of both originally and derivatively classified documents generated by three offices found that the EPA does not sufficiently follow national security information classification standards. Of the two originally classified documents we reviewed, portions of one needed different classification levels and the other contained numerical data that was incorrectly transferred from another document. The National Homeland Security Research Center in the Office of Research and Development agreed to correct the documents. We also noted that the approved classification guide and the three guides under review had narrow scopes, which limits their usefulness. The three proposed guides have been in the approval process for 12 months when it must take no more than 30 days. Additionally, the declassification process needs clarity since the one pending declassification request has also been in the approval process for almost a year when it should take no more than 60 days. None of the 19 derivatively classified documents we reviewed completely met the requirements of Executive Order 13526 and the implementing regulations. The derivative classifiers did not include some required information and did not correctly transfer information from the source documents. As a result, those who later access the information may not know how to protect it or be able to properly identify or use it as a source for their own derivative decision. A lack of training for derivative classifiers and incorrect information in the annual refresher training given to all clearance holders contributed to the classification problems noted. The EPA had not promptly updated guidance. Not all cleared employees who needed an element relating to designation and management of classified information as part of their performance evaluation had such an element.