Doc. 11302 Report 3.2.3.4. Preserving secrecy and NATO Security Policy 160. Our source’s use of the expression “need-to-know” encapsulates one of the means used to keep the HVD programme in Europe secret.132Through discussion with several other sources we have established that classified information about the bilateral arrangements between the CIA and its partner services in Poland and Romania was treated according to a strict security-of-information regime drawn from the terms of NATO’s Security Policy. 161. Under the terms of the NATO Security Policy,133“individuals in NATO nations … shall only have access to NATO classified information for which they have a need-to-know. No individual is entitled solely by virtue of rank or appointment or PSC [Personnel Security Clearance] to have access to NATO classified information”. 134In the context of the HVD programme, according to a senior CIA official, the CIA classified its operational information into “tiny little pieces”, each of which would be assessed separately under the “need-to-know” principle in order to prevent any single foreign official from seeing the “bigger picture” of what was actually happening: “The agency could be bringing UBL [Usama bin Laden] himself from an airplane into a prison in your country, but on every tiny little piece of the classified operational information, if we figure you don’t need to know that information then frankly, as an individual, you will never know it.” 162. The body that generates any piece of classified information retains what is known as “originator control”,135an undisputed right to set parameters as to which individuals receive the information, how they are briefed, what they are allowed to do with the information, and whether the information will ever be declassified, or have its classification reduced.136It is generally accepted that “the principle of originator control trumps the need-to-know principle”;137otherwise put, based on this principle, the CIA was able to exclude from the information loop even those individuals (specifically, some politicians) whom it might have perceived to have a genuine need to know the “bigger picture”. 163. Finally, the CIA’s choice of its “point men” in Poland and Romania – key individuals in each country who vouched for absolute, unwavering adherence to the rules by their own national services – reflected the same considerations of “loyalty, trustworthiness and reliability”138integral to NATO rules on personnel security. When discussing the kinds of people as their liaisons, our CIA sources referred to relationships of “trust developed over decades” and interpretations of national security issues that were “99% in harmony with one another”. 164. By preserving the secrecy of the covert HVD programme on a NATO-compliant basis, the CIA achieved several of its central objectives: it hand-picked the services and the “point men” it would work with in the countries in question; it limited to an absolute minimum the number of Polish and Romanian counterparts who 132. We initially probed into the means used to keep the HVD programme secret because of a tip-off from an insider source. The source had indicated that the NATO framework “holds the key” to understanding the European dimension of the programme, in terms of both “physical security and security of information”. 133. See NATO, Security within the North Atlantic Treaty Organisation, 17 June 2002, supra note 73. The policy is designed to ensure that a “common degree of protection” is applied both to NATO’s own information and to information exchanged among NATO members on a bilateral level. Both categories of information are referred to as “NATO classified information” in the context of this policy. 134. Ibid., in Enclosure “C” – Personnel Security, at the section entitled “Application of the ‘Need-to-Know’ Principle”, p. 2, paragraph 6. In a handbook accompanying an earlier version of the policy, this “fundamental principle” was reiterated to mean that information should be limited in its distribution for work purposes only, and not “merely because a person occupies a particular position, however senior”. See NATO Security Committee, “A Short Guide to the Handling of Classified Information”, Document AC/35-WP/14:4, Brussels, 22 August 1958. 135. Ibid., in Enclosure “B” – Basic Principles and Minimum Standards of Security, at the section entitled “Basic Principles”, p. 3, paragraph 9.g. 136. Ibid. See, inter alia, Enclosure “B” – Basic Principles and Minimum Standards of Security, at the section entitled “Basic Principles”, p. 2, paragraph 9.b: “classified information shall be disseminated solely on the basis of the principle of need-to-know to individuals who have been briefed on the relevant security procedures … only security cleared individuals shall have access”. 137. See Alasdair Roberts, “NATO, Secrecy and the Right to Information”, supra note 56, at p. 89. 138. Ibid., in Enclosure “B” – Basic Principles and Minimum Standards of Security, at the section entitled “Personnel Security”, p. 4, paragraph 11; see also the supporting provisions in Enclosure “C” – Personnel Security, pp. 1-4. In the previous version of the NATO policy, C-M(55)15(Final) as reissued in 1964, anyone receiving a security clearance was assessed to have shown “unquestioned loyalty [and] such character, habits, associated and discretion as to cast no doubt upon their trustworthiness”. 33