Managing security classified records in international organizations
Introduction
Organizations are responsible to their members and stakeholders for the safe management and effective exchange of confidential records produced by or entrusted to them. The key principles of this obligation are often stated in the founding treaties or supplementary agreements of international organizations. At the same time, organizations are accountable to stakeholders and to the public for upholding the principles of transparency and access to information about their decisions and activities. These requirements are balanced against privacy and security needs. This chapter argues that the challenges of managing security classified records (SCRs)4 for international organizations are both ethical and methodological in nature. Ethical considerations are at the root of both access and privacy obligations, and necessarily inform the methodological design of a classified records framework. Many of the challenges of managing SCRs relate directly to the work of information, records, and archival professionals, and call for close coordination with related professionals, such as information security and data protection professionals. Moreover, international organizations are unique players on the global stage. Whether intergovernmental or non-governmental, they regularly handle confidential records related to member states and governments, programme beneficiaries, and diverse types of organizations and entities. Therefore, they operate within a complex and distinct legal and functional space that has implications for the management of security classified records.
In addition to discussing the definition of classified records, the chapter examines the challenges, principles, and policies of managing, protecting, and providing access to SCRs in every aspect of their lifecycle, incorporating records and information management requirements for SCRs. A checklist tool designed to support organizations in developing policies and procedures for managing SCRs is included in Appendix 8.1 of the chapter. A set of minimum descriptive metadata for security classified records is in Appendix 8.2, follwed by categories of roles and responsibilities for managing security classified records in Appendix 8.3.5
Sources and background
This study was originally conducted in the framework of the InterPARES Trust study Managing Security Classified Records in International Organizations (TR.04).’ The chapter draws on an analysis of records and information security policies of international organizations, as well as a literature review. The literature review includes government sources and articles from security, legal, and archival perspectives. Within the reviewed literature, there is little focus on classified records within international organizations; the literature that does directly address international organizations focuses on a variety of issues, but rarely on the practical aspects of managing SCRs. The gaps in the published work on this topic demonstrate the need for more research and discourse on the topic of SCRs within international organizations.
The sample of policies analysed includes 31 anonymized policies published or updated between 1996 and 2017. The policies belong to 16 anonymized international organizations ranging in size, scope, and type, with 67% forming part of either the United Nations system or the European Union organizations. The organizations are largely located in Europe and North America, with one organization located in Africa. Future studies could expand on the geographical scope and organizational diversity of this initial sample. The organizations are intergovernmental or non-governmental and reflect a spectrum of missions, from humanitarian assistance, development and financial agents, security organizations, and research or domain-specific organizations. The types of policies analysed include information security and/or sensitivity classification; archives and records management; personal data protection; public disclosure and access to information; organizational security; and information technology systems policies.
Defining security classified records
Although seemingly a basic concept, the term “classified records” may be left ill-defined in literature, yet requires clear definition when employed in organizational settings. It is generally understood that classified records, also variously referred to as restricted, confidential, or sensitive records, contain confidential or sensitive information with restrictions about who may see it; for this reason, SCRs are governed and managed differently.7 However, even within a given organization, the lack of clarity about what constitutes classified records and what does not may cause issues.8
Both the policy analysis and literature review show that, on a broad level, classified records are defined as any information regardless of its format that, if disclosed, is deemed to potentially cause a degree of harm - hence the notion of security that attaches to them — and therefore stringent access restrictions and management controls are placed on them. For this reason, SCRs have a separate identity and constitute a body of records that are distinct from public and nonclassified records. The majority of policies on SCRs include an internal definition of “classified information,” which manifests as ascending levels of security classification.
In many organizations, access to restricted records is not only confined to information that is classified for security purposes. For example, personnel information is also restricted, but for privacy purposes. Security classified records are distinct because of why they are kept restricted. Aftergood indicates that classified records pertain to “that body of information which, if disclosed, could actually damage national security in some identifiable way.”9 At the same time, some organizations may not recognize this distinction in their policies, and handling rules may be the same whether a record is restricted for security or for other reasons of privacy. For a more detailed discussion of this issue, see pp. 182—183.
