Who decides what stays secret and who gets to put a label on it?
Most of us have heard the phrase “classified information” in movies, news reports, or a coworker’s whispered warning. But the reality behind that red‑tape is a tangle of agencies, statutes, and sometimes plain old human judgment. Let’s pull back the curtain and see who actually designates whether something is classified—and at what level.
What Is Information Classification
When we talk about “information classification” we’re not just talking about a sticky note that says “Top Secret.” It’s a formal process that decides whether a piece of data can be shared openly, or whether it needs protection because its disclosure could harm national security, diplomatic relations, or even public safety Less friction, more output..
In the United States, the system rests on three core levels:
- Confidential – the lowest tier; unauthorized release could cause damage.
- Secret – a step up; disclosure could cause serious damage.
- Top Secret – the highest; exposure could cause exceptionally grave damage.
There are also Sensitive Compartmented Information (SCI) and Special Access Programs (SAP) that sit on top of those three, but the basic three‑tier ladder is the foundation most people encounter Small thing, real impact..
The Legal Backbone
The classification framework isn’t a corporate policy you can tweak on a whim. It’s anchored in law: Executive Order 13526 (the current governing EO) and the Atomic Energy Act for nuclear‑related material. Now, those documents spell out who can classify, what can be classified, and how the levels are determined. In practice, the language is dense, but the takeaway is simple—only certain officials, acting under specific authority, can slap a classification label on something.
Not obvious, but once you see it — you'll see it everywhere Worth keeping that in mind..
Why It Matters
If you think classification is just bureaucratic red tape, think again. The stakes are huge:
- National security: A leaked blueprint of a missile system could tip the balance of power.
- Personal safety: Wrongly classified personal data can put whistleblowers or informants in danger.
- Government credibility: Over‑classification chokes transparency and fuels public distrust.
When the wrong person makes a classification decision, the fallout can be catastrophic. The Pentagon Papers, the Snowden leaks, and countless smaller incidents show how a single misstep can ripple through politics, law, and everyday life Practical, not theoretical..
How Designation Works
Understanding who does the labeling is easier once you see the process laid out. Below is a step‑by‑step walk‑through of the typical chain of authority.
1. Originating Authority
The originating authority is the person or office that first creates the information. Even so, think of a defense analyst drafting a report on a new radar system. That analyst doesn’t decide the classification level on their own—unless they hold a specific clearance and are designated as a Classifying Official (CO). Most often, the analyst forwards the draft to their supervisor, who is the CO.
Key point: Only a CO—someone specifically granted classification authority by law or regulation—can officially designate a classification level Worth keeping that in mind..
2. Classification Guidance
Before the CO makes a call, they consult classification guides. These are documents that map subject matter to the appropriate level. As an example, the Department of Defense publishes the Manual for the Classification of Intelligence Information (MCI) that says any data about “nuclear weapons design” is automatically Top Secret.
The official docs gloss over this. That's a mistake Worth keeping that in mind..
Guides keep the process from being a free‑for‑all. They also help avoid over‑classification, a chronic problem where information gets a higher label than necessary, slowing down collaboration.
3. Determining the Level
The CO asks three questions—often called the “damage” test:
- Could unauthorized disclosure cause damage? If yes, it’s at least Confidential.
- Could the damage be serious? If yes, bump it to Secret.
- Could the damage be exceptionally grave? If yes, it’s Top Secret.
If the answer is “yes” to all three, you have a Top Secret item. The CO documents the rationale in a Classification Marking—a short statement that appears on the document’s header/footer The details matter here..
4. Marking and Controlling
Once the level is set, the document gets a classification marking (e.g., “//TOP SECRET//”) and is entered into a records management system that enforces handling rules: who can view it, how it can be transmitted, and when it must be de‑classified No workaround needed..
5. Review and De‑classification
Classifications aren’t forever. Think about it: a Security Classification Guide (SCG) often includes a review date—usually 10, 15, or 25 years out. At that point, a Designated De‑classifier (often the same CO or a senior official) must re‑evaluate whether the information still warrants protection Worth knowing..
Who Actually Holds the Power
Now that the workflow is clear, let’s name the players who can actually designate a classification level.
Federal Executive Branch
- President – ultimate authority; can issue an EO that changes classification policy.
- Agency Heads – each cabinet‑level department (DoD, State, Energy, etc.) designates senior officials as COs.
- Classifying Officials (COs) – individuals granted authority by their agency. In the DoD, this includes certain generals, admirals, and senior civilian staff. In the Intelligence Community (IC), it’s often the Director of National Intelligence (DNI) or agency heads like the CIA Director.
Military Chain
Within the armed services, Commanders at the O‑6 level (colonel/captain) and above can act as COs for operational information. They often delegate to Deputy COs for day‑to‑day decisions And it works..
Intelligence Community
The IC has a unique hierarchy:
- Director of National Intelligence (DNI) – final say on Sensitive Compartmented Information (SCI) and Special Access Programs (SAP).
- Agency Heads – CIA, NSA, DIA, etc., each appoint their own COs for agency‑specific material.
- Compartment Managers – for SCI, a Compartmented Information Facility (CIF) manager decides who gets access to a particular “compartment” of data.
Nuclear Weapons Complex
Because of the Atomic Energy Act, the Secretary of Energy (via the National Nuclear Security Administration) and the Secretary of Defense share authority over Restricted Data and Formerly Restricted Data. Only a Designated Classification Authority (DCA) in those departments can label nuclear‑related info as Top Secret.
Contractors and Private Sector
Do contractors ever classify? Not directly. That said, when a private company works on a classified contract, it must appoint a Facility Security Officer (FSO) who ensures the contractor’s staff follow the agency’s classification rules. The actual designation still comes from the government CO, but the FSO acts as the gatekeeper on the contractor side But it adds up..
Common Mistakes / What Most People Get Wrong
Even seasoned professionals slip up. Here are the pitfalls you’ll hear about at every security briefing.
- Assuming “any government employee can classify.” Only COs have the legal authority. A junior analyst can recommend a classification, but the final stamp must come from a CO.
- Confusing “sensitive but unclassified” (SBU) with “classified.” SBU, PII, and other markings are handling designations, not classification levels. They don’t trigger the same legal protections.
- Over‑classifying to “play it safe.” This creates bottlenecks, erodes trust, and can even be a violation of the Anti‑Classified Information Management Act (yes, that exists).
- Leaving classification marks off the document. A missing header/footer doesn’t make the info unclassified; it just makes it improperly marked, which is a punishable offense.
- Assuming de‑classification is automatic after a set time. The law requires a formal review; otherwise the info stays classified forever.
Practical Tips – What Actually Works
If you’re a CO, a manager, or just someone handling potentially classified material, these habits can save you headaches.
- Keep the guides handy. Bookmark your agency’s classification guide and review it before you label anything.
- Document your reasoning. A one‑sentence note like “Based on DoD MCI, paragraph 4.2, the data could cause serious damage if disclosed” is gold during audits.
- Use the “need‑to‑know” principle. Even if someone has the clearance, they don’t automatically get access. Limit distribution to the smallest group required.
- Set reminders for review dates. Most records systems let you tag a de‑classification date—use it.
- Train your team. A quick 15‑minute refresher on the three‑question damage test can prevent a cascade of mistakes.
- Don’t rely on intuition alone. If you’re unsure, consult a senior CO or the agency’s Classification Authority Office (CAO).
- When in doubt, err on the lower side—but document why. It’s better to have a Confidential label that later gets upgraded than a Top Secret tag that was never justified.
FAQ
Q: Can a President’s executive order change the classification levels?
A: Yes. The President can issue an EO that redefines what constitutes “damage” or adds new classification categories, and all agencies must follow it.
Q: Do state or local governments have classification authority?
A: Generally no. Only federal officials can classify under U.S. law. State agencies can label information as “restricted,” but that isn’t the same as a federal classification level.
Q: What happens if a non‑CO mistakenly marks something as classified?
A: The document is still treated as classified, but the error can trigger an investigation. The CO who receives the material must either re‑classify it properly or de‑classify it.
Q: Are there any “automatic” classifications?
A: Certain categories—like nuclear weapons design—are automatically Top Secret under the Atomic Energy Act, regardless of who writes the document.
Q: How does the “need‑to‑know” rule interact with clearance levels?
A: Clearance is a baseline—you must have at least the level of the information. “Need‑to‑know” is an additional filter: you only get access if your job requires it.
Wrapping It Up
The short version? So classification isn’t a random label slapped on a file by whoever feels like it. It’s a tightly regulated decision made by designated officials—COs, agency heads, and a handful of senior leaders—who follow legal guidance, assess potential damage, and document their reasoning. When the chain works, it protects the nation without choking the flow of information. When it breaks, the fallout is felt in headlines, courtrooms, and sometimes on the front lines Simple, but easy to overlook..
So next time you see a “//SECRET//” banner on a document, remember the web of authority behind it: a law, a guide, a person with the right clearance, and a series of checks designed to keep the right secrets, in the right hands, for the right amount of time. And if you ever find yourself on the other side of that banner, you’ll know exactly who decided it got there—and why it matters.
Counterintuitive, but true Small thing, real impact..
