(a) The organization of the OIG includes the Headquarters located in Arlington, Virginia, consisting of the Inspector General, Deputy Inspector General, the Offices of the Assistant Inspector General (AIG) for Analysis and Followup, the AIG for Audit Policy and Oversight, the AIG for Auditing with its subordinate field elements located throughout the Continental United States (CONUS), the AIG for investigations with its field elements located throughout the CONUS and Europe, the AIG for Administration and Information Management, the AIG for Departmental Inquiries, the AIG for Inspections, and the Director, IG Regional Office-Europe (IGROE) located in Wiesbaden, Germany. The IGROE has representatives assigned from the Offices of the AIG for Investigations, the AIG for Inspections, the AIG for Auditing and the AIG for Departmental Inquiries, who fulfill the missions of their respective components.
(b) The ``Organization and Staff Listing'' (Inspector General, Defense List (IGDL) 1400.7), \6\ provides organization charts for the OIG elements and mailing addresses of all OIG operating locations and will be made available to the public upon written request.---------------------------------------------------------------------------
\6\ See footnote 1 to Sec. 295.5(i).---------------------------------------------------------------------------
(c) As an independent and objective office in the Department of Defense (DoD) the mission of the OIG is to:
(1) Conduct, supervise, monitor, and initiate audits, inspections and investigations relating to programs and operations of the DoD.
(2) Provide leadership and coordination and recommend policies for activities designed to promote economy, efficiency, and effectiveness in the administration of, and to prevent and detect fraud and abuse in, such programs and operations.
(3) Provide a means for keeping the Secretary of Defense and the Congress fully and currently informed about problems and deficiencies relating to the administration of such programs and operations and the necessity for and progress of corrective action.
(4) Further information regarding the responsibilities and functions of the IG is encompassed in Public Law 95-452, the ``Inspector General Act of 1978,'' as amended and 32 CFR part 373.
Sec. Appendix A to Part 295--For Official Use Only (FOUO)
I. General Provisions
A. General
Information that has not been given a security classification pursuant to the criteria of an Executive Order, but which may be withheld from the public for one or more of the reasons cited in FOIA exemptions (b)(2) through (b)(9) shall be considered as being for official use only. No other material shall be considered or marked ``For Official Use Only'' (FOUO), and FOUO is not authorized as an anemic form of classification to protect national security interests.
B. Prior FOUO Application
The prior application of FOUO markings is not a conclusive basis for withholding a record that is requested under the FOIA. When such a record is requested, the information in it shall be evaluated to determine whether, under current circumstances, FOIA exemptions apply in withholding the record or portions of it. If any exemption or exemptions apply or applies, it may nonetheless be released when it is determined that no governmental interest will be jeopardized by its release.
C. Historical Papers
Records such as notes, working papers, and drafts retained as historical evidence of actions enjoy no special status apart from the exemptions under the FOIA.
D. Time To Mark Records
The marking of records at the time of their creation provides notice of FOUO content and facilitates review when a record is requested under the FOIA. Records requested under the FOIA that do not bear such markings, shall not be assumed to be releasable without examination for the presence of information that requires continued protection and qualifies as exempt from public release.
E. Distribution Statement
Information in a technical document that requires a distribution statement pursuant to DoD Directive 5230.24, \1\ ``Distribution Statements on Technical Documents'', shall bear that statement and may be marked FOUO, as appropriate.---------------------------------------------------------------------------
\1\ Copies may be obtained, at cost, from the National Technical Information Service, 5285 Port Royal Road, Springfield, VA 22161.---------------------------------------------------------------------------
II. Markings
A. Location of Markings
(1) An unclassified document containing FOUO information shall be marked ``For Official Use Only'' at the bottom on the outside of the front cover (if any), on each page continuing FOUO information, and on the outside of the back cover (if any).
(2) Within a classified document, an individual page that contains both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page.
(3) Within a classified document, an individual page that contains FOUO information but no classified information shall be marked ``For Official Use Only'' at the bottom of the page.
(4) Other records, such as, photographs, films, tapes, or slides, shall be marked ``For Official Use Only'' or ``FOUO'' in a manner that ensures that a recipient or viewer is aware of the status of the information therein.
(5) The FOUO material transmitted outside the Department of Defense requires application of an expanded marking to explain the significance of the FOUO marking. This may be accomplished by typing or stamping the following statement on the record prior to transfer: This document contains informationEXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions . . . . . apply
III. Dissemination and Transmission
A. Release and Transmission Procedures
Until FOUO status is terminated, the release and transmission instructions that follow apply:
(1) The FOUO information may be disseminated within DoD Components and between officials of DoD Components and DoD contractors, consultants, and grantees to conduct official business for the Department of Defense. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure. Transmittal documents shall call attention to the presence of FOUO attachments.
(2) The DoD holders of FOUO information are authorized to convey such information to officials in other departments and agencies of the executive and judicial branches to fulfill a Government function, except to the extent prohibited by the Privacy Act. Records thus transmitted shall be marked ``For Official Use Only'', and the recipient shall be advised that the information has been exempted from public disclosure, pursuant to the FOIA, and that special handling instructions do or do not apply.
(3) Release of FOUO information to Members of Congress is governed by DoD Directive 5400.4, \2\ ``Provision of Information to Congress''. Release to the GAO is governed by DoD Directive 7650.1, \3\ ``General Accounting Office Access to Records''. Records released to the Congress or GAO should be reviewed to determine whether the information warrants FOUO status. If not, prior FOUO markings shall be removed or effaced. If withholding criteria are met, the records shall be marked FOUO and the recipient provided an explanation for such exemption and marking. Alternatively, the recipient may be requested, without marking the record, to protect against its public disclosure for reasons that are explained.---------------------------------------------------------------------------
\2\ See footnote 1 to section I.E. of this appendix.
\3\ See footnote 1 to section I.E. of this appendix.---------------------------------------------------------------------------
B. Transporting FOUO Information
Records containing FOUO information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, FOUO information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of FOUO Directives or testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail.
C. Electrically Transmitted Messages
Each part of electrically transmitted messages containing FOUO information shall be marked appropriately. Unclassified messages containing FOUO information shall contain the abbreviated ``FOUO'' before the beginning of the text. Such messages shall be transmitted in accordance with communications security procedures in ACP-121 (United States Supplement 1) for FOUO information.
IV. Safeguarding FOUO Information
A. During Duty Hours
During normal working hours, records determined to be FOUO shall be placed in an out-of-sight location if the work area is accessible to non-governmental personnel.
B. During Non-Duty Hours
At the close of business, FOUO records shall be stored so as to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S. Government or government-contractor internal building security is provided during nonduty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases. FOUO records that are subject to the provisions of Public Law 86-36, National Security Agency Act shall meet the safeguards outlined for that group of records.
V. Termination, Disposal and Unauthorized Disclosures
A. Termination
The originator or other component authority, e.g., initial denial and appellate authorities, shall terminate ``For Official Use Only'' markings or status when circumstances indicate that the information no longer requires protection from public disclosure. When FOUO status is terminated, all known holders shall be notified, to the extent practical. Upon notification, holders shall efface or remove the ``For Official Use Only'' markings, but records in file or storage need not be retrieved solely for that purpose.
B. Disposal
(1) Nonrecord copies of FOUO materials may be destroyed by tearing each copy into pieces to preclude reconstructing, and placing them in regular trash containers. When local circumstances or experience indicates that this destruction method is not sufficiently protective of FOUO information, local authorities may direct other methods but give due consideration to the additional expense balanced against the degree of sensitivity of the type of FOUO information contained in the records.
(2) Record copies of FOUO documents shall be disposed of in accordance with the disposal standards established under 44 U.S.C. chapter 33, as implemented by Inspector General Defense Manual (IGDM) 5015.2, \4\ ``Records Management Program''.---------------------------------------------------------------------------
\4\ Copies may be obtained, if needed, from the Information and Operations Support Directorate, Publications Management Branch, room 420, 400 Army Navy Drive, Arlington, VA 22202-2884.---------------------------------------------------------------------------
C. Unauthorized Disclosure
The unauthorized disclosure of FOUO records does not constitute an unauthorized disclosure of DoD information classified for security purposes. Appropriate administrative action shall be taken, however, to fix responsibility for unauthorized disclosure whenever feasible, and appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of FOUO information that is protected by the Privacy Act may also result in civil and criminal sanctions against responsible persons. The DoD Component that originated the FOUO information shall be informed of its unauthorized disclosure.
Sec. Appendix B to Part 295--Exemptions
I. General
The exemptions listed apply to categories of records that may be withheld in whole or in part from public disclosure, unless otherwise prescribed by law. A discretionary release (see also Sec. 295.5(e) of this part) to one requester may preclude the withholding of the same record under a FOIA exemption if the record is subsequently requested by someone else. In applying the exemptions, the identity of the requester and the purpose for which the record is sought are irrelevant with the exception that an exemption may not be invoked where the particular interest to be protected is the requester's interest. The examples provided of the types of records that may be exempted from release are not at all inclusive.
II. FOIA Exemptions
A. Exemption (b)(1).
Those properly and currently classified in the interest of national defense or foreign policy, as specifically authorized under the criteria established by executive order and implemented by regulations, such as DoD 5200.1-R \1\ (32 CFR part 159a), ``Information Security Program Regulation''. Although material is not classified at the time of the FOIA request, a classification review may be undertaken to determine whether the information should be classified. The procedures in DoD 5200.1-R, section 2-204f, apply, In addition, this exemption shall be invoked when the following situations are apparent:---------------------------------------------------------------------------
\1\ Copies may be obtained, at cost, from the National Technical Information Service, 5285 Port Royal Road, Springfield, VA 22161.---------------------------------------------------------------------------
(1) The fact of the existence or nonexistence of a record would itself reveal classified information. In this situation, the OIG shall neither confirm nor deny the existence or nonexistence of the record being requested. A ``refusal to confirm or deny'' response will be used consistently, not only when a record exists, but also when a record does not exist. Otherwise, the pattern of using a ``no record'' response when a record does not exist will itself disclose national security information.
(2) Information that concerns one or more of the classification categories established by executive order and DoD 5200.1-R (32 CFR part 159a) shall be classified if its unauthorized disclosure, either by itself or in the context of other information, reasonably could be expected to cause damage to the national security.
B. Exemption (b)(2)
Those related solely to the internal personnel rules and practices of DoD or the OIG. This exemption has two profiles, high (b)(2) and low (b)(2).
(1) Records qualifying under high (b)(2) are those containing or constituting statutes, rules, regulations, orders, manuals, directives, and instructions the release of which would allow circumvention of these records, thereby substantially hindering the effective performance of a significant function of the DoD or OIG. Examples include:
(a) Those operating rules, guidelines, and manuals, for DoD and OIG investigators, inspectors, auditors, or examiners that must remain privileged in order for the OIG to fulfill a legal requirement.
(b) Personnel and other administrative matters, such as examination questions and answers used in training courses or in the determination of the qualification of candidates for employment, entrance on duty, advancement, or promotion.
(c) Computer software meeting the standards of Sec. 295.3(c) of this part, the release of which would allow circumvention of a statute or DoD rules, regulations, orders, manuals, directives, or instructions. In this situation, the use of the software must be closely examined to ensure a circumvention possibility exists.
(2) Records qualifying under the low (b)(2) profile are those that are trivial and housekeeping in nature for which there is no legitimate public interest or benefit to be gained by release, and it would constitute an administrative burden to process the request in order to disclose the records. Examples include: rules of personnel's use of parking facilities or regulation of lunch hours, statements of policy as to sick leave, and trivial administrative data such as file numbers, mail routing stamps, initials, data processing notations, brief references to previous communications, and other like administrative markings.
C. Exemption (b)(3)
Those concerning matters that a statute specifically exempts from disclosure by terms that permit no discretion on the issue, or in accordance with criteria established by that statute for withholding or referring to particular types of matters to be withheld. Examples of statutes are:
(1) National Security Agency Act information exemption, Public Law 86-36, section 6.
(2) Patent Secrecy, 35 U.S.C. 181-188. Any records containing information relating to inventions that are the subject of patent applications on which Patent Secrecy Orders have been issued.
(3) Restricted Data and Formerly Restricted Data, 42 U.S.C. 2162.
(4) Communication intelligence, 18 U.S.C. 798.
(5) Authority to Withhold from Public Disclosure Certain Technical Data, 10 U.S.C. 130, and 32 CFR part 250.
(6) Confidentiality of Medical Quality Records: Qualified Immunity Participants, 10 U.S.C. 1102.
(7) Physical Protection of Special Nuclear Material: Limitation on Dissemination of Unclassified Information, 10 U.S.C. 128.
(8) Protection of Intelligence Sources and Methods, 50 U.S.C. 403(d)(3).
D. Exemption (b)(4)
Those containing trade secrets or commercial or financial information that the OIG receives from a person or organization outside the Government with the understanding that the information or record will be retained on a privileged or confidential basis in accordance with the customary handling of such records. Records within the exemption must contain trade secrets, or commercial or financial records, the disclosure of which is likely to cause substantial harm to the competitive position of the source providing the information; impair the Government's ability to obtain necessary information in the future; or impair some other legitimate Government interest. Examples include:
(1) Commercial or financial information received in confidence in connection with loans, bids, contracts, or proposals, as well as other information received in confidence or privileged, such as trade secrets, inventions, discoveries, or other proprietary data. See also 32 CFR part 286h, ``Release of Acquisition-Related Information''.
(2) Statistical data and commercial or financial information concerning contract performance, income, profits, losses, and expenditures, if offered and received in confidence from a contractor or potential contractor.
(3) Personal statements given in the course of inspections, investigations, or audits, when such statements are received in confidence from the individual and retained in confidence because they reveal trade secrets or commercial or financial information normally considered confidential or privileged.
(4) Financial data provided in confidence by private employers in connection with locality wage surveys that are used to fix and adjust pay schedules applicable to the prevailing wage rate of employees within the Department of Defense.
(5) Scientific and manufacturing processes or developments concerning technical or scientific data or other information submitted with an application for a research grant, or with a report while research is in progress.
(6) Technical or scientific data developed by a contractor or subcontractor exclusively at private expense, and technical or scientific data developed in part with Federal funds and in part at private expense, wherein the contractor or subcontractor has retained legitimate proprietary interest in such data in accordance with title 10, U.S.C. 2320-2321 and DoD Federal Acquisition Regulation Supplement (DFARS), subpart 27.4 (see section C.(5) of this appendix).
(7) Computer software meeting the conditions of Sec. 295.3(c), which is copyrighted under the Copyright Act of 1976 (17 U.S.C. 106), the disclosure of which would have an adverse impact on the potential market value of a copyrighted work.
E. Exemption (b)(5)
Except as provided in subsections (2) through (5), below, internal advice, recommendations, and subjective evaluations, as contrasted with factual matters, that are reflected in records pertaining to the decision-making process of an agency, whether within or among agencies (as defined in 5 U.S.C. 552(e)), DoD Components or OIG components. Also exempted are records pertaining to attorney-client privilege and the attorney work-product privilege.
(1) Examples include:
(a) The nonfactual portions of staff papers, to include after-action reports and situation reports containing staff evaluations, advice, opinions, or suggestions.
(b) Advice, suggestions, or evaluations prepared on behalf of the Department of Defense by individual consultants or by boards, committees, councils, groups, panels, conferences, commissions, task forces, or other similar groups that are formed for the purpose of obtaining advice and recommendations.
(c) Those non-factual portions or evaluations by DoD or OIG Components personnel of contractors and their products.
(d) Information of a speculative, tentative, or evaluative nature of such matters as proposed plans to procure, lease or otherwise acquire and dispose of materials, real estate, facilities or functions, when such information would provide undue or unfair competitive advantage to private personal interests or would impede legitimate Government functions.
(e) Trade secret or other confidential research development, or commercial information owned by the Government, where premature release is likely to affect the Government's negotiating position or other commercial interests.
(f) Records that are exchanged among agency personnel and within and among DoD Components or agencies as part of the preparation for anticipated administrative proceeding by an agency or litigation before any Federal, state, or military court, as well as records that qualify for the attorney-client privilege.
(g) Those portions of official reports of inspection, reports of the Inspector General, audits, investigations, or surveys pertaining to safety, security, or the internal management, administration, or operation of one or more DoD Components, when these records have traditionally been treated by the courts as privileged against disclosure in litigation.
(h) Computer software meeting the standards of Sec. 295.3(c), which is deliberative in nature, the disclosure of which would inhibit or chill the decision-making process. In this situation, the use of software must be closely examined to ensure its deliberative nature.
(i) Planning, programming, and budgetary information which is involved in the defense planning and resource allocation process.
(2) If any such intra or interagency record or reasonably segregable portion of such record hypothetically would be made available routinely through the ``discovery process'' in the course of litigation with the agency, i.e., the process by which litigants obtain information from each other that is relevant to the issues in a trial or hearing, then it should not be withheld from the general public even though discovery has not been sought in actual litigation. If, however, the information hypothetically would only be made available through the discovery process by special order of the court based on the particular needs of a litigant, balanced against the interests of the agency in maintaining its confidentiality, then the record or document need not be made available under this part. Consult with legal counsel to determine whether exemption 5 material would be routinely made available through the discovery process.
(3) Intra or interagency memoranda or letters that are factual, or those reasonably segregable portions that are factual, are routinely made available through ``discovery,'' and shall be made available to a requester, unless the factual material is otherwise exempt from release, inextricably intertwined with the exempt information, so fragmented as to be uninformative, or so redundant of information already available to the requester as to provide no new substantive information.
(4) A direction or order from a superior to a subordinate, though contained in an internal communication, generally cannot be withheld from a requester if it constitutes policy guidance or a decision, as distinguished from a discussion of preliminary matters or a request for information or advice that would compromise the decision-making process.
(5) An internal communication concerning a decision that subsequently has been made a matter of public record must be made available to a requester when the rationale for the decision is expressly adopted or incorporated by reference in the record containing the decision.
F. Exemption (b)(6)
Information in personnel and medical files, as well as similar personal information in other files, that, if disclosed to the requester would result in a clearly unwarranted invasion of personal privacy. Release of information about an individual contained in a Privacy Act System of records would constitute a clearly unwarranted invasion of privacy is prohibited, and could subject the releaser to civil and criminal penalties.
(1) Examples of other files containing personal information similar to that contained in personnel and medical files include:
(a) Those compiled to evaluate or adjudicate the suitability of candidates for civilian employment or membership in the Armed Forces, and the eligibility of individuals (civilian, military, or contractor employees) for security clearances, or for access to particularly sensitive classified information.
(b) Files containing reports, records, and other material pertaining to personnel matters in which administrative action, including disciplinary action, may be taken.
(2) Home addresses are normally not releasable without the consent of the individuals concerned. In addition, the release of lists of DoD military and civilian personnel's names and duty addresses who are assigned to units that are sensitive, routinely deployable, or stationed in foreign territories can constitute a clearly unwarranted invasion of personal privacy.
(a) Privacy interest. A privacy interest may exist in personal information even though the information has been disclosed at some place and time. If personal information is not freely available from sources other than the Federal Government, a privacy interest exists in its nondisclosure. The fact that the Federal Government expended funds to prepare, index and maintain records on personal information, and the fact that a requester invokes FOIA to obtain these records indicates the information is not freely available.
(b) Published telephone directories, organizational charts, rosters and similar materials for personnel assigned to units that are sensitive, routinely deployable, or stationed in foreign territories are withholdable under this exemption.
(3) This exemption shall not be used in an attempt to protect the privacy of a deceased person, but it may be used to protect the privacy of the deceased person's family.
(4) Individuals' personnel, medical, or similar file may be withheld from them or their designated legal representative only to the extent consistent with DoD Directive 5400.11 (32 CFR part 286a).
(5) A clearly unwarranted invasion of the privacy of the persons identified in a personnel, medical or similar record may constitute a basis for deleting those reasonably segregable portions of that record, even when providing it to the subject of the record. When withholding personal information from the subject of the record, legal counsel should first be consulted.
G. Exemption (b)(7)
Records or information compiled for law enforcement purposes; i.e., civil, criminal, or military law, including the implementation of executive orders or regulations issued pursuant to law. This exemption may be invoked to prevent disclosure of documents not originally created for, but later gathered for law enforcement purposes.
(1) This exemption applies, however, only to the extent that production of such law enforcement records or information could result in the following:
(a) Could reasonably be expected to interfere with enforcement proceedings.
(b) Would deprive a person of the right to a fair trial or to an impartial adjudication.
(c) Could reasonably be expected to constitute an unwarranted invasion of personal privacy of a living person, including surviving family members of an individual identified in such a record.
(i) This exemption also applies when the fact of the existence or nonexistence of a responsive record would itself reveal personally private information and the public interest in disclosure is not sufficient to outweigh the privacy interest. In this situation, the OIG shall neither confirm nor deny the existence or nonexistence of the record being requested.
(ii) A ``refusal to confirm or deny'' response must be used consistently, not only when a record exists, but also when a record does not exist. Otherwise, the pattern of using a ``no records'' response when a record does not exist and a ``refusal to confirm or deny'' when a record does exist will itself disclose personally private information.
(iii) Refusal to confirm or deny should not be used when (1) the person whose personal privacy is in jeopardy has provided the requester with a waiver of his or her privacy rights; or (2) the person whose personal privacy is in jeopardy is deceased, and the OIG is aware of that fact.
(d) Could reasonably be expected to disclose the identity of a confidential source, including a source within the Department of Defense, a State, local, or foreign agency or authority, or any private institution which furnishes the information on a confidential basis.
(e) Could disclose information furnished from a confidential source and obtained by a criminal law enforcement authority in a criminal investigation or by an agency conducting a lawful national security intelligence investigation.
(f) Would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law.
(g) Could reasonably be expected to endanger the life or physical safety of any individual.
(2) Examples include:
(a) Statements of witnesses and other material developed during the course of the investigation and all materials prepared in connection with related government litigation or adjudicative proceedings.
(b) The identity of firms or individuals being investigated for alleged irregularities involving contracting with Department of Defense when no indictment has been obtained nor any civil action filed against them by the United States.
(c) Information obtained in confidence, expressed or implied, in the course of a criminal investigation by a criminal law enforcement agency or office within a DoD Component, or a lawful national security intelligence investigation conducted by an authorized agency or office within a DoD Component. National security intelligence investigations include background security investigations and those investigations conducted for the purpose of obtaining affirmative or counterintelligence information.
(3) The right of individual litigants to investigative records currently available by law (such as, the Jencks Act, 18 U.S.C. 3500) is not diminished.
(4) When the subject of an investigative record is the requester of the record, it may be withheld only as authorized by DoD Directive 5400.11 (32 CFR part 286a).
(5) Exclusions. Excluded from the above exemptions are the following two situations as applicable to the Department of Defense and the OIG:
(a) Whenever a request is made which involves access to records or information compiled for law enforcement purposes, and the investigation or proceeding involves possible violation of criminal law where there is reason to believe that the subject of the investigation or proceeding is unaware of its pendency, and the disclosure of the existence of the records could reasonably be expected to interfere with enforcement proceedings, the OIG may, during only such times as that circumstance continues, treat the records or information as not subject to the FOIA. In such situation, the response to the requesters will state that no records were found.
(b) Whenever informant records maintained by a criminal law enforcement organization within the OIG under the informant's name or personal identifier are requested by a third party using the informant's name or personal identifier, the OIG may treat the records as not subject to the FOIA, unless the informant's status as an informant has been officially confirmed. If it is determined that the records are subject to exemption (b)(7), the response to the requester will state that no records were found.
H. Exemption (b)(8)
Those contained in or related to examination, operation or condition reports prepared by, on behalf of, or for the use of any agency responsible for the regulation or supervision of financial institutions.
I. Exemption (b)(9)
Those containing geological and geophysical information and data (including maps) concerning wells.