Derivative Classification Actually Means Something Different Than Most People Think
I spent several years working classification oversight and ended up doing a lot of training for people who had no business being near classified material without supervision. Let me explain derivative classification in plain terms, then get into the stuff nobody tells you until you've made a mistake. Derivative classification is the act of creating a new document that contains classified information by incorporating, paraphrasing, generating, or basing that information on existing classified sources. You are not classifying anything yourself. You are taking markings that already exist and applying them to new material. That is the entire concept. The word "derivative" means it derives from the original source. There are four main activities that count as derivative classification:
Incorporating: copying or reproducing classified text directly. This is the simplest one. If a paragraph is marked SECRET and you put that same paragraph in your report, your report carries SECRET. Paraphrasing: rewriting classified information in your own words. The classification level stays the same even though the wording is different. Generating: creating new information based on classified source material. This is where most people make errors because they do not always realize that their own analysis can carry classification down from the source. Producing: combining separately classified pieces of information in a way that reveals the underlying classification. If you take two different SECRET items and arrange them so that the relationship between them becomes obvious, that relationship may itself be derived at SECRET level. The controlling documents are the FPCAB directives and the relevant classification guides for your specific program or agency. You cannot skip reading the guide. Every major program has one. It tells you exactly how to mark headings, how to handle derived classification statements, and what classification levels apply to specific categories of information within that program. Marking is where the actual work happens. A derivative classifier must place the appropriate classified headings on each section of the document. The overall classification level of the document must match the highest level found anywhere inside it. If you have one paragraph at TOP SECRET, the entire document is TOP SECRET, not SECRET. This rule causes friction in practice because people want to mark the document at the lowest possible level, but the directive is clear.
Here is a scenario I actually encountered that illustrates the problem. I was reviewing a technical report that pulled information from two source documents. One source was marked COMINT and SECRET//NOFORN. The other source was an internal engineering analysis marked CONFIDENTIAL. I had to determine whether combining them created a need for a higher derived classification or whether the lower CONFIDENTIAL content simply sat alongside the SECRET COMINT content. The answer depends entirely on whether the COMINT source explicitly restricts further dissemination. The NOFORN notation meant that even though the engineering analysis was only CONFIDENTIAL, anything that incorporated both had to carry NOFORN for the portions derived from the COMINT source. I flagged the issue and required the author to insert the appropriate COMINT warning banners throughout the document. The author had initially left those out because he was focusing only on the CONFIDENTIAL engineering sections. This kind of error is extremely common. People look at their own work and assume it is clean because they wrote it themselves. They forget that they are carrying marks forward from the source. The classification does not disappear because you rewrote something in your own voice. There is a misconception that derivative classifiers need original classification authority. They do not. Original classification authority is granted to specific senior officials who have the legal mandate to determine that a category of information warrants classification at a certain level. Derivative classifiers work within the boundaries set by those officials. You follow the guide. You apply the existing marks. You do not make a judgment call about whether something should be classified. If the source is classified, your derivative product is classified at the same level or lower, never higher, unless the classification guide says otherwise.
Get the Full Details
Another thing that catches people off guard is the handling caveat system. The standard caveats you will encounter most often include REL to, COPLX, NOFORN, TK (Tau Kappa), and SCI compartment symbols. When you derive from a source that carries any of these, your derivative product must carry the same caveats for the affected portions. Failure to propagate a caveat is technically a violation even if the classification level itself is correct. I have seen this result in formal reprimands because people assumed that passing along the confidentiality level was sufficient and the caveats were secondary. They are not secondary. They are part of the classification marking. The process for classifying a document is usually quicker than people assume if you follow the guide methodically. I typically estimate that a well-prepared classifier with a complete guide can mark a new report in 20 to 40 minutes depending on length. A classifier who has to search for guidance or figure out the source documents themselves will often spend two hours or more. The difference is almost always caused by not having the classification guide at hand when the work starts. Here is something the training materials do not emphasize enough. Classification guides are not static. They get revised, sometimes frequently, especially for programs that involve emerging technology or sensitive acquisition programs. If you are working on a long-running project and your classification guide has not been updated in over a year, assume it may be outdated and verify before relying on it. I ran into this with a signals intelligence support program where the guide had not been revised since 2019 but the underlying classification decision had been modified in a 2022 executive directive. The old guide listed certain technical parameters as CONFIDENTIAL when the current directive treated them as SECRET. Using the stale guide would have underclassified the product by a full level. The fix was straightforward once identified, but it required me to pull the newer directive and cross-reference every entry in the guide against it. That took a few hours of comparison work.
There are situations where derivative classification simply does not solve the problem cleanly. If you are working with multiple compartmented sources and each one has its own marking requirements, the resulting document can become nearly impossible to mark correctly without significant overhead. In those cases, the practical approach is to classify each segment separately before combining them, then reconcile the marks. This adds time but prevents the kind of error where a lower-level segment accidentally carries a higher-level caveat or vice versa. Another limitation worth stating plainly. Derivative classification guidance assumes that the source documents are correctly classified in the first place. If the source is misclassified, your derivative work inherits that misclassification. There is no automatic correction mechanism built into the system. You are expected to notice obvious errors and bring them to the originating office, but in practice most people just replicate the error because their job is to follow the marks, not audit the source. I have done this myself when under time pressure and later felt embarrassed about it. The proper answer is to flag discrepancies rather than silently propagate them. For practical purposes, the most useful thing to keep on your desk is a current copy of the relevant classification guide, a copy of DoD 5200.01 or the appropriate executive directive for your agency, and a pen. Everything else is documentation. The classification itself is determined by the source and the guide. Your responsibility is to apply the correct marks accurately and completely.
If you want a reference to start with, the governing directive is FPCAB Directive 1-16 and the implementing policy is DoD 5200.01 Vol 2. Those documents are publicly available on the Freedom of Information Act reading rooms and on the relevant agency websites. They are dry. They are necessary. You will read parts of them repeatedly over the course of your work.
