Disclosing classified information to foreign interests

← All Insights

1. When disclosure is an export

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, has a section on international programs (32 CFR 117.19(a)). It starts from export law. Transferring articles, services and related data to a foreign person, inside or outside the United States, or moving them to any destination outside U.S. jurisdiction, is an export (32 CFR 117.19(b)(1)). Most exports fall under the Arms Export Control Act, the Export Control Reform Act of 2018 or the Atomic Energy Act. The section applies to exports that involve classified information.

2. Security agreements between governments

Bilateral security agreements, such as General Security of Information Agreements and General Security of Military Information Agreements, are negotiated with various foreign governments (32 CFR 117.19(b)(2)(i)). Some governments ask for confidentiality, so there is no public list. Each agreement requires both governments to give substantially the same protection to classified information released by the other. It limits use of each government’s information, including third-party transfers and proprietary rights.

An agreement does not commit the governments to share classified information, and it is not authority to release classified material. It partly satisfies the Arms Export Control Act requirement that a recipient government agree to protect U.S. classified defense articles and information. The cognizant security agency (CSA) gives contractors a way to access classified general security agreements for official purposes (32 CFR 117.19(b)(2)(ii)). Separate industrial security agreements with certain governments set the procedures for foreign government classified information provided to U.S. industry and U.S. Government classified information provided to foreign defense industry (32 CFR 117.19(b)(2)(iii)).

3. Authorization to disclose

The government contracting activity (GCA) provides disclosure guidance (32 CFR 117.19(b)(3)). Contractors disclose non-public U.S. Government information to foreign persons only as the contract specifies, and not at all if it is silent (32 CFR 117.19(b)(3)(i)). Authorization may take the form of an export license or other export authorization (32 CFR 117.19(b)(3)(ii)). Guidance from a previous contract or program may not be reused unless the GCA or the licensing authority says so in writing (32 CFR 117.19(b)(3)(iii)).

Under an international agreement, contractors disclose nothing until the participating government has signed and disclosure guidance and security arrangements are in place. The export of technical data under such agreements may be exempt with approval from the Department of State or the Department of Commerce (32 CFR 117.19(b)(3)(iv)(A)). Foreign nationals attending a classified gathering must have the right export license, disclosure authority and security assurance on file (32 CFR 117.19(b)(3)(iv)(B)). During visits by foreign nationals to the contractor, disclosure is limited to the information authorized for the approved visit and any export authorization (32 CFR 117.19(b)(3)(iv)(C)). Classified articles temporarily exported for demonstration remain under U.S. control and need an export authorization under the International Traffic in Arms Regulations or the Export Administration Regulations (32 CFR 117.19(b)(3)(iv)(D)).

4. Direct commercial arrangements

Disclosure may be authorized under a direct commercial sale with the appropriate export authorization (32 CFR 117.19(b)(4)(i)). Such arrangements include sales, loans, leases or grants of classified items, including sales under a government agency financing program. For a foreign government requirement, the contractor should consult U.S. in-country officials, normally the security assistance or armaments cooperation office or the commercial counselor (32 CFR 117.19(b)(4)(ii)).

Before proposing anything to a foreign interest that will eventually involve U.S. classified information, the contractor obtains government disclosure authorization (32 CFR 117.19(b)(4)(ii)(A)). That authorization is not export authorization, which must come from the appropriate regulator (32 CFR 117.19(b)(4)(ii)(B)). Before contracting with a foreign entity, the contractor asks the CSA to obtain a facility clearance assurance from the foreign entity’s government (32 CFR 117.19(b)(4)(iii)).

5. Agreements with foreign contractors

A U.S. contractor may be authorized to make an agreement involving classified information with a foreign contractor, such as a subcontract, a manufacturing license agreement or a technical assistance agreement (32 CFR 117.19(b)(5)(i)). Its empowered official verifies that the information can be released to a foreign person. Security provisions and classification guidance go into the agreement, and a signed copy goes to the CSA (32 CFR 117.19(b)(5)(ii) and 32 CFR 117.19(b)(5)(iii)). Any additional arrangements the export authorization requires are added (32 CFR 117.19(b)(5)(iv)). The contractor keeps a record of the source of the classified information used, with its copy of the export authorization (32 CFR 117.19(b)(5)(v)).

6. The required security clauses

Every contract and subcontract involving classified information awarded to a foreign contractor carries prescribed clauses, with contract-specific details such as the applicable country and disposition filled in where the text is bracketed (32 CFR 117.19(b)(5)(vi)). The recipient may not release the information to a third party without disclosure and export authorization, as appropriate. It must give the information protection equivalent to that of the releasing government, and may not use it for other purposes without written consent (32 CFR 117.19(b)(5)(vi)(A)). Transfers go through government channels or others the two governments specify in writing, and only to cleared people with an official need (32 CFR 117.19(b)(5)(vi)(B)).

The recipient re-marks material with its own government’s equivalent markings, classifies generated material under the specification, and reports known or suspected losses or unauthorized disclosures to its security authorities (32 CFR 117.19(b)(5)(vi)(C) to 32 CFR 117.19(b)(5)(vi)(E)). Further release to another contractor needs approval by the U.S. or partner security authorities, or prior written U.S. consent for a third-country contractor (32 CFR 117.19(b)(5)(vi)(F)). Disposition at completion is stated in the contract, and the recipient flows substantially conforming provisions, including the flowdown itself, into its subcontracts that involve the classified information (32 CFR 117.19(b)(5)(vi)(G) and 32 CFR 117.19(b)(5)(vi)(H)).

Contractors report to the CSA any violation of administrative security procedures or export control regulations that could expose classified information to compromise by foreign visitors or foreign national employees (32 CFR 117.19(h)). How material physically crosses borders is covered in international transfers of classified material.

Key terms

Export	A transfer to a foreign person or out of U.S. jurisdiction.
Bilateral security agreement	An agreement on reciprocal protection of classified information.
Disclosure authorization	Government approval to disclose, separate from export authorization.
Direct commercial arrangement	A sale, loan, lease or grant of classified items made commercially.
Facility clearance assurance	A foreign government’s confirmation that its entity is cleared.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

International programs bring disclosure questions into the field. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.