9/11 Commission Staff

Security Briefing
June 11,2003

AREAS OF SECURITY
Personnel Security
Physical Security
Information (computer) Security

1. Classified discussions

a. CONFIRM that the individual(s) with whom you are speaking are
appropriately cleared. Always ask. Before meetings on classified topics,
make sure that you know the clearances of everyone in the room.

b. Clearance certification. Before visiting other agencies where you plan to

review classified material, make sure that the Security Officerhas
transferred your clearances to his counterpart beforehand.

c. ONLY in approved space(s)

i. You may have conversations at the TS/SCI level only in a SCIF.

When GS A is established at the SECRET level, you may have
conversations at the SECRET level.

ii. Sound attenuation/windows (visual), etc . Even in a SCIF, please

be_attuned to your environment. You cannot have conversations
about classified material within the presence of a person who is not
cleared. Please keep blinds partially closed - allowing in light,
but not surveillance of your office from the exterior. GS A —
please disregard the previous sentence!

2. Couriering classified documentation

a. Approved couriers are (or soon will be) in place. Couriers to provide
documents to K St or GSA are the preferred approach for transporting
documents. A regular courier schedule will soon be established.

b. Hand-carry responsibilities. The Commission has a few locked bags, and

soon will have more. Locked bags are for direct point-to-point transit only
— to bring documents back to an office for log in and appropriate storage.
Documents in a locked bag must be wrapped and sealed and marked with
appropriate classification markings. If a locked bag is not used,
documents must be double wrapped and sealed, with the inner wrapping
containing appropriate classification markings and the outer wrapping
containing your name/commission address/ phone number.
3. Escorting uncleared personnel. All uncleared visitors must be escorted and under
direct line-of-sight observation by cleared personnel at all times. This includes
the char force, repairmen, deliverymen, etc. Also, classified conversations must
cease in their presence, and classified materials must be removed/ covered.

4. Document handling/TRASH/Destruction. Unclassified paper should be put in

cardboard boxes next to printers/copiers/faxes for destruction. The Security
Officer will soon place clearly identifiable red containers in these same locations
for all CLASSIFIED documents and will implement a regular schedule of
document destruction.

5. Secure area (never left unattended and unsecured). Classified materials must be
secured or under the positive, continuous control of a cleared person at all times.
They should not be left on desks or unattended for any period of time. While
SCIF rules provide for open storage of classified materials, this is not prudent in
our current work environment.

If you are the last one leaving the space, make sure you-secure the area. If you
leave for 15 minutes or less, you may just spin the lock. If you are leaving the
building, you must spin the lock and set the alarm. These same rules~will also
soon apply at the GSA space.

6. Classified/UNCLASSIFIED Fax Concerns/LOGS. Please log in all faxes, both

classified and unclassified. This record-keeping will protect us. Also, with
classified faxes, it is prudent to call your addressee immediately beforehand, to
make sure they are presenUo receive your fax.

1. COMPUTERS. No floppy disks or CD-ROMs or other electronic media or

devices are allowed in a SCIF without the explicit approval of the Security
Officer. All such materials brought into a SCIF must be under the control of the
Security Officer or handled in accordance with his direction.

a. Classified computer use. We will have a briefing on computer issues next

week. Suffice it to say here, all documents on the classified system must
have appropriate classification headers and footers and portion markings.

b. Unclassified computer use. Any classified materials inadvertently

introduced onto an unclassified system must be brought to the attention of
the Security Officer.

c. Passwords. Must never be shared.

8. Downloading software. Simple guidance: do not download software. All

software downloading must be approved and handled by the Security Officer.

a. Softcopy transfer
 i. Classified to unclassified/Unclassified to classified. Will be
handled by the Security Officer. A-drives on all classified
systems in your office should be locked.

ii. Computer virus. An additional reason for the Security officer to

handle document transfers from system to system is to prevent the
introduction of viruses into our systems.

9. Foreign travel notification requirement (different for personal and business).

Business travel to a foreign country does not require prior notification to the
Security Officer. Personal foreign travel requires written notice (dates,
itineraries) to the Security Officer (can be done via e-mail). Also, it is prudent to
inform the Security Officer of significant contacts with foreigners outside of the
workplace, whether at home or on travel.

10. Notes & classification marking. Please be sure to mark your notes with
appropriate classification markings (headers and footers) and portion markings, if!
possible.

11. Cover Sheets. All classified documents should have appropriate cover sheets
(SECRET, TOP SECRET, etc.). Please get appropriate cover sheets from Diana
Campagna or from Lisa Sullivan.

12. Cell Phones. Are not permitted in a SCIF. They must be placed at the front, and
batteries must be removed.

WHEN IN DOUBT—ASK