<html> <p>Imagine spray painting every speed limit sign in town and telling an officer who pulled you over that you “decontrolled the data” and no longer have to follow posted regulations. You will get arrested.
<p>Can you head to your local hardware store, grab a few bottles of spray paint, g and head out to paint every speed limit sign, you “Decontrol the regulations and make regulation less burdensome?”</p>
<p>Of course not, especially in a school zone, extra speed regulations apply and as a licensed driver you have signed a social contract to know and uphold the laws.</p>
<p>Yet a good many small manufacturers thinks they can redact legacy distribution statements, or more likely receive documents with legacy markings and distribution statements redacted from a prime and confidently say they don't have CUI.</p>
<p>The controlling label, originator, legacy markings, and distribution statements do not make CUI Controlled Unclassified Information. Being Controlled Unclassified Information makes data CUI.</p>
<p>These methods to decontrol, or what some erroneously refer to as declassify CUI through redaction as about as effective as spray painting a speed limit sign.</p>
<h2>History of Distribution Statements</h2>
DoDI 5230.24
<h2>The Flawed Logic</h2>
<p> Since DoD Guidance says the presence of a distribution statements means a legacy document equals data requiring CUI protection, redacting that distribution statement means the data does not need a CUI label and thus 171 protection. </p>
<p>This is the same as saying if I paint over the speed limit sign this road has no speed limit.</p>
<h2>Distribution Statements and CUI</h2>
<blockquote>he originator or other competent authority (e.g., initial FOIA denial and appellate authorities) will terminate the CUI status of specific information when the information no longer requires protection from public disclosure. When the CUI status of information is terminated in this manner, all known holders will be notified by email or other means. Upon notification, holders will remove the CUI markings. Holders will not need to retrieve records on file solely for this purpose. Information with a terminated CUI status will not be publicly released without review and approval in accordance with DoDIs 5230.09, 5230.29, and 5400.04.“</blockquote>
<blockquote>“Legacy CUI technical documents and materials requiring export control have used distribution statements in accordance with DoDI 5230.24 in order to address the shared responsibility between the DoD and its contractors to safeguard this information. This was done for legacy CUI creation, transmission, receipt, storage, distribution, decontrol, and approved disposition authorities, including destruction.”</blockquote>
<h3>Contractor Responsibility with Redacted Distribution Statement</h3>
<h2>How CUI Gets decontrolled</h2> <h2>Dissagregation and DFARS</h2> </html>