Special access programs (SAPs) in the U.S. Federal Government are security protocols that provide highly classified information with safeguards and access restrictions that exceed those for regular (collateral) classified information. SAPs can range from black projects to routine but especially-sensitive operations, such as COMSEC maintenance or presidential transportation support. In addition to collateral controls, a SAP may impose more stringent investigative or adjudicative requirements, specialized nondisclosure agreements, special terminology or markings, exclusion from standard contract investigations (carve-outs), and centralized billet systems.[1] Within the Department of Defense, SAP is better known as "SAR" by the mandatory Special Access Required (SAR) markings.
Shortly before America's involvement in World War II Franklin D. Roosevelt signs Executive Order 8381, creating the three security levels for his country's most important documents- Restricted, Confidential, and Secret.[2]
After the conclusion of World War II, President Harry S. Truman issues Executive order 10104, and creates the "Top Secret classification" designation.[3]
Dwight D. Eisenhower issues Executive order 10501. It drops the "restricted" classification level. It removes classification authority from 28 government entities and limits its use in 17 more. There are now explicit guidelines for the remaining three classification levels to prevent a systematic flood of classified documents coming from the Pentagon and other agencies. The Pentagon responds by creating its own "special access" labels to further insulate classified information from outside influence.[4][5]
In Executive Order number 11652 Richard M. Nixon legitimizes the use of special access controls and the "special access program" is finally made official.[5][6]
Two types of SAP exist – acknowledged and unacknowledged. The existence of an acknowledged SAP may be publicly disclosed, but the details of the program remain classified. An unacknowledged SAP (or USAP) is made known only to authorized persons, including members of the appropriate committees of the United States Congress. Waived SAPs are a subset of unacknowledged SAPs in the Department of Defense. These SAPs are exempt by statutory authority of the Secretary of Defense from most reporting requirements and, within the legislative branch, the only persons who are required to be informed of said SAPs are the chairpersons and ranking committee members of the Senate Appropriations Committee, Senate Armed Services Committee, House Appropriations Committee, and the House Armed Services Committee.[7] Oftentimes, this notification is only oral.[8][9]
There are three categories of SAPs within the Department of Defense:[10]
Only the Director of National Intelligence may create IN-SAPs. Sensitive Compartmented Information (SCI) control systems may be the most well-known intelligence SAPs. The treatment of SCI is singular among SAPs, and it seems there is some disagreement within the government as to whether or not SCI is a SAP. Defense Department sources usually state that it is,[11] and at least one publication refers to a separate SCI-SAP category alongside the three listed above.[12] The Intelligence Community, drawing on the DNI's statutory responsibility to protect intelligence sources and methods, finds a legal basis for SCI separate from that of SAPs, and consequently consider SCI and SAPs separate instances of the more general controlled access program.[13]
SAP documents require special marking to indicate their status. The words SPECIAL ACCESS REQUIRED, followed by the program nickname or codeword, are placed in the document's banner line.
Abbreviations may be used for either element. Portion markings use SAR and the program's abbreviation. For example, a secret SAP with the nickname MEDIAN BELL would be marked SECRET//SPECIAL ACCESS REQUIRED-MEDIAN BELL. Portions would be marked (S//SAR-MB).[14]
Multiple SAPs are separated by slashes.
Compartments within SAPs may be denoted by a hyphen, and are listed alphanumerically. Subcompartments are separated by spaces, and are also listed alphanumerically. Markings do not show the hierarchy beyond the sub-compartment level. Sub-sub-compartments are listed in the same manner as sub-compartments.[15] A more complex banner line with multiple SAPs and subcompartments might read TOP SECRET//SAR-MB/SC-RF 1532-RG A691 D722.[16]
Older documents used different standard for marking. The banner line might read SECRET//MEDIAN BELL//SPECIAL ACCESS REQUIRED, and the portion marking would read (S//MB).[17] Other variations move the special access warning to a second line, which would read MEDIAN BELL Special Control and Access Required (SCAR) Use Only or some other phrase directed by the program security instructions.[18]
SAP access ergo policy on classified security categories de facto is understood informally as described as those who need to know have access, access is "on a need to know basis".[19] A SAP can only be initiated, modified, and terminated within their department or agency; the Secretary of State, Secretary of Defense, Secretary of Energy, Secretary of Homeland Security, the Attorney General, the Director of National Intelligence; their principal deputies (e.g. the Deputy Secretary of State in DoS and the Deputy Secretary of Defense in DoD); or others designated in writing by the President.[20] These offices are better known as 'classification authorities.' They retain the right to declassify or revise classification levels.
The U.S. Secretary of Defense is obliged to submit a report, submitted not later than the 1st of March for each year, to the defense committee on special access programs.[21]
The following national or international SAPs, unless otherwise noted, are identified in 32 CFR 154.17: