Why do US Presidents seem to have difficulty in complying with the laws on returning classified documents?

Question

Why do US Presidents seem to have difficulty in complying with the laws on returning classified documents?

One might expect that Presidents would have sufficient assistance in running their offices that a "compliance officer" would be in a position to ensure that all the rules are followed.

On the other hand, perhaps those who rise to the top of the political ladder have a disregard for what might be seen as petty bureaucratic rules.

It is difficult for those of us who see only the polished face an administration presents to the world or cinematic dramatisations of life in centres of power to understand what working conditions are actually like.

Does anyone have any practical insights into the circumstances that apparently make compliance difficult?

Answer 1

Because security compliance is in general difficult in all but the lowest-security environments.

Good compliance takes two things: systems/people to track and support compliance and, even more importantly, users who are willing to assume (or can be coerced into assuming) the cost of compliance.

For someone in an executive position, these costs can be indirect, such as hiring flunkies to track what documents have gone where, and audit piles of documents, to make sure that they all go to the correct places and not where they shouldn't, which generally just cost money (and time they could spend working on other things). Or they may be direct, such as taking five minutes instead of two minutes to send an e-mail, or being out of e-mail communication with certain people for significant parts of the day.

Though end users can often clearly see the costs of security, they're not usually in a position to make good judgements about the cost/risk tradeoff. So it generally falls to security officers to do that. But for two reasons security officers generally have personal a incentive towards higher security than is the best compromise for the organisation: it doesn't cost them directly (only the organisation and its users) and it provides a healthy amount of CYA (you can attempt to blame the users rather than your system for a security breach). End users know this, and tend to be suspicious that costly security measures are, as you put it, "petty bureaucratic rules."

Thus, for end users in positions of power who are focused on "getting the job done" you can expect that they will fail to comply with security rules from time to time, sometimes for good reasons and sometimes not. (And often without being able to tell the difference.) If this happens to be combined with security system designers and officers are are not well focused on minimising the end-user costs of security as much as possible (within the constraints of achieving an appropriate security tradeoff), the situation is even worse because security really is getting too much in the way of business. And sadly, you don't get security folks saying, "how can I make this easier and more convenient for the end users" nearly as often as you should.

As someone who works in IT security myself, I look at situations like Hilary Clinton having that dreadfully insecure e-mail server set up and think, "it was completely predictable that she and her team might do something like that." The security folks should have seen that coming and mitigated, both by themselves doing whatever they could to make the systems they offered more convenient and by working with the folks in the team who had complaints, showing that they understood the problem, and providing whatever support they could to make life easier. From a distance, anway, it looks like a classic case of, "I just make things 'secure'; user issues are not my problem" which is pretty much guaranteed to produce security issues.

It does take some co-operation from the end users themselves, of course. (Training them so that they understand the issues can help with this.) If someone misplaces documents and then later helps return them, that should certainly spur an examination of what happened and how users and security system designers can co-operate better to reduce such incidents in the future. But if someone is deliberately keeping hold of documents where they ought not be, and not co-operating with fixing the problem, you have a very different issue. (Essentially, that "user" is now an "adversary.")

Answer 2

I am not in that world, but I have been curious how the nation protects its secrets, so am a bit familiar with what is publicly known about how classified information is handled.

Overclassification

As a high level politician, especially one working anywhere near the national security space, the amount of classified documents they must handle can safely be assumed to be absolutely absurd. There are several underlying causes of this:

1. Inappropriate original classification - This has been a concern expressed for a while. Even resulting in the occasional congressional hearing. The rules for how to handle different categories of information are not discretionary. If there are documents that an original classifier doesn't believe ought to be made public, but can't find a way to fit under any of the CUI (confidential unclassified) categories, the temptation to find a national security justification and slap a classification on it is likely to be overwhelming. And if you do an Internet search for 'overclassification' you can see that there has been an enormous amount of discussion on this.

2. Documents take on the classification if a fragment within them does - Obviously, it wouldn't make much sense to treat a classified document highly securely, but then say 'it is okay to take a couple of sentences out of that document, and put it in a public document'. While every paragraph is marked with whether the content of that paragraph is classified (and, if so, what level), the entire document gets wrapped and has to be handled with the highest level of classification as it contains. So, even an incidental inclusion of some classified information on, say a profile of a foreign leader, that otherwise relies on public sources, results in the entire profile having to treated as classified.

3. Derivative classification - If any new information is created (from inference, say) from classified information, then, by default, that new information is also classified at the same level. There are many more people authorized to determine that derived information is classified than original information. And, as far as I'm aware, only an original classifier can look at the derived information and say 'yeah, this is abstracted away enough that it wouldn't harm national security for the public to know about this'.

Onerous Rules

The rules can be found here, which are hard to summarize, but, in short, are rather onerous (there are more procedures for SCI information, but I don't see an easy reference for them). Tracking, marking, which areas you're allowed to look at the information in, etc. start becoming a real pain and take effort when already in a highly stressful job. This is especially true when talking about the most highly protected information. Want to look at SCI? Take it to a special room built like a safe. Want to electronically access classified information? Go to that same room and use a computer that can never be plugged into the Internet for its entire life. Leave all your own electronics with storage or transmission capability outside the room. Cell phone? Outside. MP3 player? Outside. Wireless car keys? Outside. Smart watch? Outside. Walkman with CD-ROMs? Okay (but such fixed form devices without wireless or storage capability are becoming increasingly difficult to find).

So, in combination with overclassification, you have an enormous temptation: many of the documents you need to do your work can only be reviewed in areas where you have to leave your creature comforts behind. And once you start violating the rules, there really isn't a set procedure for how to handle partially following the rules. So, minor errors start racking up into egregious ones. In general, the rank and file respects that they have to follow all of the rules, even if inconvenient and seemingly unnecessary. However, history has shown time and again that the higher up you go in an organization, the more likely you are to find folks who think they are above the rules.

Even someone trying to follow the rules in good faith though, I could see having difficulty when the sheer volume of classified documents they are dealing with gets large enough. Keep in mind that they will almost certainly need a combination of classified and unclassified documents to have all the information that they need to make their decision. But, at the end of the administration, all of the classified documents need to go into one pile and all of the unclassified documents need to go into a different pile. And while turning in the former pile is a very big deal, the latter is a much smaller issue. With all of the work required to transition a government, it really isn't that surprising that some politicians would decide to just take the unclassified documents to their post-presidency home and sort it out from there. I doubt that they intentionally take the classified documents. And the sleeve on the document ought to make it extremely obvious that something is a classified document. But, if things get intermingled enough, it is unacceptable but, perhaps, understandable that some classified documents slip in.

Lax enforcement

It is extremely rare for high level government employees and politicians to get prosecuted for negligence in handling of classified documents. And, even for the rank and file, I suspect that a litany practical considerations end up resulting in the more typical response to negligent handling of classified information being the pulling of one's clearance (which can be done administratively) instead of a full blown criminal prosecution (which is what would be needed to fine or jail someone). When you are, say, a career intelligence officer, this is no small threat. Your career is over if your clearance gets pulled. Best case scenario, maybe you can join a private company's threat assessment department. But, you'll never work for the government again. If you are a politician though? Presidents don't need clearances. Pull Hillary Clinton or Donald Trump's clearance (assuming the latter ever had one), and it would barely impact their life, and certainly wouldn't impair their ability to run for or hold the office of the presidency. Even for a lower level politician doesn't impact your life as much as it does for the rank and file. If you are a Congressman or Senator and get your clearance pulled, that probably gets you kicked off the intelligence committee, but you probably have a buddy on the budget committee who is willing to trade committee assignments with you, the trajectory of your life barely changes, except for the scandal.

No built in constituency to fix

The media still dictates a lot of the conversation on things, especially when it doesn't have an obvious left-right breakdown. And, while the media is highly interested in getting access to classified information in the interest of 'transparency', it has remarkably little interest in how classified information is supposed to be handled (even though a surprisingly large number of those procedures are public information). One of the effects of this is that the conversation surrounding classified information on Hillary Clinton's email server centered around the fact that it was her personal server. Barely mentioned was the fact that any classified file ending up on any unclassified server (including her official State Department email address) represents an enormous breach for which multiple layers of protection are built in to prevent. The government has created a completely separate Internet for handling classified information and a variety of technical controls are designed to prevent classified documents from ending up outside of that network. It isn't as if someone just attached the document to an email and fired it off. It is hard to imagine anything other than an intentional bypass of security controls (not necessarily by Hillary Clinton) occurred. But, the folks responsible for informing the public (the media) were far more outraged about the fact that the personal server wouldn't be subject to FOIA than the egregious bypass of security controls implied by classified information ending up on an unclassified server. Which is unfortunate, as I think it leave the public believing that classified information (at least at the Secret level) is handled in a much more casual manner than it actually is.

Opposite the media, you have the folks who actually deal with classified information. Who, in general, tend to be a much more tight lipped lot. While the laws, contracts, etc. are all explicit that classification is not meant to prevent political advocacy, the folks who go into classified work tend to self-select as being quieter and less willing to talk about their work (you don't do classified work for the glory and public accolades). They also have a healthy level of paranoia derived from the fact that they are aware that the nation's adversaries are spending billions of dollars a year trying to obtain scraps of the knowledge in their head. At a lower level, most want to stay 'below the radar'. While it is likely totally impossible to prevent, say, China from finding out that they hold a clearance (especially when the OPM loses the entire nation's clearance applications in a hack), that doesn't mean that they want to make it easy for anyone doing a Google search to realize that they are a target to cozy up to. Of course, the folks most highly impacted by classification mishandling (informants and agents under illegal cover) are also most desperate not be found out to be related to classified information at all.

And, in a perverse way, the broken parts work for the folks most intimately involved in it. Folks holding a clearance can generally command salaries 10-20% higher than their peers, which is at least partially driven by the level of demand for cleared personnel thanks to overclassification. And the onerous requirements suit large government contractors just fine, as it keeps smaller competitors from competing with them (where 'smaller competitor' could also mean giant company that is the market leader in the private market, but unable/unwilling to put its entire campus under all the mandated controls in order to pursue a relatively small contract).