Willfulness and the Harm of Unlawful Retention of National Security Information

Discussions of the Espionage Act usually focus on the public’s conception of “spying.” Spies steal information that their government seeks to keep secret and disclose that information to other governments. A common acronym, “MICE,” describes the common motivations for spying: money, ideology, compromise, and ego.

The Espionage Act, however, covers a broader set of conduct that can compromise U.S. national security. The original Act, enacted as the United States entered the First World War, included the precursors to prohibitions against undisclosed foreign-government activities in the United States.

The Espionage Act also prohibits taking or possessing national security-related information from the government and keeping it in an unauthorized location. This article explains how some criminal law protections for national security information interact with Executive Branch decisions to protect information based on national security concerns, and how those protections apply in cases where a defendant stole and kept national security information, even if the defendant did not disclose that information to an unauthorized recipient.

To the uninitiated, taking national security information from its authorized location and keeping it in an unauthorized location may seem like a ministerial or administrative violation without much substantive consequence. But to the national security professional—and to the national security professional’s counterparts in adversarial services—such theft constitutes a profound compromise of security.

Authorized locations for the storage of national security information are approved because they are secure and because they facilitate the government’s control over, and tracking of, individuals who access that information—for example, as then-Assistant Attorney General John Demers stated, when Nghia Hoang Pho stole highly classified information and retained it at an unauthorized location, he “placed at risk our intelligence community’s capabilities and methods, rendering some of them unusable.”

Then-Director of the National Security Agency Adm. Michael Rogers reinforced that point: “If classified information is not handled or stored according to strict rules, then the government cannot be certain that it remains secret. Once the government loses positive control over classified material, the government must often treat the material as compromised.” As the Government recently reiterated, simply removing national security information from its secure location thus deprives the government of that control and awareness of where the information has gone.

It is, of course, easier for an enemy to access information in a non-secure location. But even absent evidence that anyone obtained that information, the simple fact that they could have, and that the U.S. government would not know, presents a serious problem. Imagine not knowing whether an adversary knows a secret communications code, a cutting-edge military capability, or the identities of intelligence officers or their human sources. That kind of knowledge by an enemy could put lives and national security at risk.

Recognizing the harm that unlawfully taking and keeping nonpublic national security information can cause, the legislative and executive branches have both prohibited such conduct. The executive branch generally protects national security information by “classifying” it. The classification of information is currently governed by Executive Order 13526. Classified information is information that a high-level executive branch official or their designee has determined requires protection for national security reasons.

Not just any information can be classified, and information cannot be classified for just any reason. Information can be classified only if it was produced by or for the U.S. government, and it may not be classified to avoid embarrassment or to frustrate transparency efforts.

Moreover, the level of classification depends on the level of harm that unauthorized disclosure of the information reasonably could be expected to cause: information may be classified Top Secret if its unauthorized disclosure reasonably could be expected to cause exceptionally grave damage to national security; Secret if its unauthorized disclosure reasonably could be expected to cause serious damage to national security; and Confidential if its unauthorized disclosure reasonably could be expected to cause damage to national security. Executive Order 13526 imposes requirements for marking classified information so it can be identified, restrictions on access to classified information, and other rules to protect classified information from unauthorized disclosure.

Laws and regulations prescribe how classified information must be stored and communicated. Under Executive Branch rules, classified information may not be disclosed to individuals without a security clearance that corresponds to the level of classification and a need to know the information being disclosed. Classification is thus a form of protection that the government applies to information that requires safeguarding for national security reasons. Processes exist for challenging the classification of information, communicating classified information to appropriate oversight bodies, and even for providing classified information to criminal defense teams when due process so requires.

Congress has enacted a series of prohibitions against stealing national security information and disclosing it to an unauthorized recipient. Legislative protection of national security information dates back to the 1917 Espionage Act. The crime most commonly charged for unlawfully possessing such information is Title 18, United States Code, Section 793(e). As described in greater detail below, one key concept in the Espionage Act is “information relating to the national defense,” which is often known by the shorthand “national defense information” (NDI). Whereas Section 794 prohibits outright espionage—the disclosure of NDI to a foreign government—Section 793(e) prohibits retaining such information or disclosing it to any unauthorized recipient. Notably, Section 793(e) provides the same penalty for retaining NDI as it does for disclosing it to an unauthorized party (presumably an entity other than a foreign government). 

Section 793(e) contains several terms that are important to understand. The absence of one word—“classified”—is also significant. The statute provides, in part, that:

Whoever having unauthorized possession of, access to, or control over any document . . . relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it . . . Shall be fined under this title or imprisoned not more than ten years, or both.

As noted above, the statute does not mention “classified” information. Rather, it refers to documents and other material, or information “relating to the national defense.” That phrase has its roots in the original Espionage Act, which was enacted before the system of classification existed.

This type of information is generally referred to as NDI. NDI is not defined in any statute, but courts have described it as information that relates to national defense, construed broadly, and that is “closely held” by the government—in other words, information that the government has taken steps to protect from public disclosure. The Fourth Circuit and some other courts add the requirement that unauthorized disclosure of NDI could potentially harm the United States. See, e.g., United States v. Morison, 844 F.2d 1057, 1071-72 (4th Cir. 1988).

The definition of NDI is very similar to the criteria for classifying information, but while the decision of whether to classify information is a function of the Executive Branch, the question of whether information is NDI is reserved for the trier of fact at trial. In a Section 793(e) prosecution, the government must therefore prove beyond a reasonable doubt that the information underlying the charge meets the NDI definition. In other words, proving that information is classified can largely consist of explaining that the government kept national security information closely held, but proving that it is NDI requires prosecutors to present evidence of why.

Critically, not just any retention of NDI is illegal. Section 793(e) only punishes a defendant who unlawfully retains NDI “willfully.” Willful retention is not accidental, negligent, or reckless. Rather, a defendant only retains NDI willfully if he or she knows he or she possesses it and knows that such possession is prohibited due to the nature of the information. See, e.g., United States v. Hitselberger, 991 F. Supp.2d 101, 106-07 (D. D.C. 2013).

Willfulness is one of the most difficult culpable mental states for a prosecutor to prove and, as with any element of a crime, prosecutors must prove it beyond a reasonable doubt. Any argument that Section 793(e) punishes administrative errors or carelessness is therefore meritless.

The fact that information is classified does not prove that it is NDI. To be sure, because it is illegal to disclose classified information to the public or to an unauthorized recipient, the fact that information is classified can help prove that it meets the “closely held” prong of the NDI definition. A defendant’s training in the handling of classified information and standard markings on classified documents can help establish willfulness. But a jury may not find that information is NDI solely because it is classified. Instead, the government must prove the relationship of the NDI to national defense and, in some courts, the potential harm that could result from its disclosure.

It is therefore possible that information could be classified by the Executive Branch but not qualify as NDI to a trier of fact. It is also possible that information related to national defense that the government safeguards through a means other than formal classification could be NDI—but prosecutors would still have to prove the willfulness requirement of Section 793(e) to obtain a conviction.

One quirk of Section 793(e) is the inclusion of a heightened scienter requirement regarding “information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation.” That clause appears at the end of a list of tangible forms of NDI, omitted from the quoted statute above, and refers only to intangible information.

Although defendants sometimes argue that prosecutors prove that additional element—which prosecutors could do in virtually every Section 793(e) prosecution—case law and standard statutory interpretation make clear that the added scienter element does not apply in cases involving unlawful retention of, for example, documents (including electronically stored documents) containing NDI. See United States v. Rosen, 445 F. Supp.2d 602, 625-26 (E.D. Va. 2006).

Section 793(e) also refers to a defendant’s “unauthorized” possession of NDI, in contrast to Section 793(d), which applies when defendants “lawfully” possess it. The explanation here is simple. To lawfully possess NDI, a defendant must be authorized to access it and must keep it in an authorized location. Once a defendant, even one with an appropriate security clearance and a need to know the information, removes NDI from an authorized location, that defendant no longer lawfully possesses it.  

The prosecution of Harold T. Martin, III, an intelligence contractor, provides an example of how many of these elements may be satisfied. When the FBI searched Martin’s residence and vehicle pursuant to a search warrant, agents found a vast quantity of classified information. The prosecutors selected twenty documents—some in digital form and some on paper—to predicate individual counts under Section 793(e). As Martin acknowledged when he pled guilty, over the course of his military and intelligence career he had received training on identifying classified information, the significance of classification, and rules governing handling and disclosure of classified information.

That training helped establish Martin’s awareness that retaining classified documents in his residence and vehicle was prohibited for national security reasons. As part of his plea agreement, Martin pled guilty to possessing one such document, which he acknowledged bore the requisite relationship to national security and was closely held by the government, and that its unauthorized disclosure could potentially be damaging to the United States or helpful to its enemies, and thus willfully retained NDI.

Before pleading guilty, Martin argued that the government was required to prove not only that he retained documents containing NDI without authorization and that he knew he was retaining NDI unlawfully, but that he knew specifically that the twenty charged documents were among what the court described as a “tremendous” volume of hard-copy and digital material. The government responded that the willfulness element required prosecutors to prove only that Martin knew that he unlawfully possessed NDI and that the twenty charged documents were among the mass of NDI documents he retained. The court agreed with the government. It is therefore no defense that a defendant illegally possessed so much NDI that he or she did not know exactly which NDI he or she unlawfully retained.

A newer statute, Section 1924, which Congress recently upgraded from a misdemeanor to a felony, incorporates a classification element instead of NDI. Arguably, to convict a defendant under Section 1924, prosecutors would only need to prove that the government had classified the information at issue, without having to prove substantively how the information related to national security and perhaps without even revealing the information to a jury—although this has not been tested and in any event might not be an effective trial strategy. In any event, Section 1924 in some ways reads as a modern version of Section 793(e). It applies only to U.S. government officers, employees, contractors, and consultants who obtain classified documents or materials, as defined in Executive Order 13526.

Presumably because such individuals would, like Martin, receive training related to classified information, the statute requires proof only that a defendant knowingly—not willfully—removed those documents or materials without authority and with the intent to keep them in an unauthorized location. A Section 1924 prosecution could therefore theoretically be much more streamlined than a Section 793(e) prosecution because the government would not have to prove the higher mental state of willfulness.

Prosecutors also potentially would not have to present evidence regarding how the information related to national defense, why the government kept it closely held, or how adversaries of the United States could use it. Such proof can require disclosing to a trier of fact additional classified information and sophisticated expert testimony, so eliminating the need to submit that type of evidence can have a significant impact. 

Other criminal statutes also incorporate Executive Branch protections for information. Those statutes generally penalize disclosure of such information or acquisition of such information with the intent to make nefarious use of it, but not simple possession. For example, the Atomic Energy Act covers “Restricted Data,” which relates to atomic weapons and nuclear energy material that could be used for proliferation. It prohibits disclosing such data with the belief or intent that such data will be used to harm the United States or help a foreign nation. It also prohibits acquiring such data, but only if done with the intent to harm the United States or help a foreign nation. Absent evidence of such intent, prosecutors charging a defendant who unlawfully retained Restricted Data would have to rely on Section 793(e).

Accordingly, convicting a defendant of retaining national security information, without any indication that the defendant gathered that information on behalf of another actor or intended to disclose it, generally will require proof that the particular defendant knew or should have known that simply removing that information from its authorized, secure location presented a national security threat.

The willfulness requirement of Section 793(d) and (e) demands proof that the defendant was aware that removing and retaining the materials violated national security rules. Section 1924 applies only to government employees and other personnel whose jobs required them to handle classified information, and it essentially assumes based on their training and security indoctrination that they knew that removal of classified information violated national security rules. A conviction under either Section 793(d) and (e) or Section 1924 demonstrates that a defendant did not retain national security material by mistake or out of ignorance, but rather did so with full awareness of the damage that exposing that material to unauthorized recipients could cause.