A unit’s or an exquisite sensors exact and current position on the battlefield is about as sensitive as information gets while the unit is actually sitting there, lethal in the most literal sense if the wrong people learn it, and more or less worthless a week later once everyone has moved on. A war plan can stay dangerous for thirty years, a source can be exposed and killed decades after the fact, but the position of that person/thing is the opposite - almost all of its value is packed into a few hours. So I got curious about how the system actually handles a secret whose whole point is that as time goes on, that part of the secret becomes less and less important to protect..

Take the obvious vehicle for that position report: the radio it goes out over. You’d assume the radio is itself a classified object given what runs through it, but it generally isn’t. In US military terms a tactical radio is handled as a Controlled Cryptographic Item, which is unclassified but accounted for and controlled, and the public doctrine says so in as many words: an unkeyed set is “sensitive but unclassified COMSEC equipment”. It’s kept unclassified on purpose, because that’s exactly what lets you bolt one into every vehicle and hand it to an operator who was never cleared for the traffic it will carry.

What changes its status is the key. Load a classified key and, in the doctrine’s words, the device “assumes the security classification of the key and the material or information it protects”; take the key out and it goes back to being an unclassified controlled box. So the secret was never really the radio at all, it’s the key and the content, and the radio only borrows a classification for as long as the key is sitting inside it..

Which is where the life of the secret actually gets engineered. A key has a cryptoperiod, which NIST defines as “the time span during which a specific key is authorized for use”, and one of the things that sets its length is, in their own words, “the security life of the data” - the lifespan of the thing you are protecting, which they spell out as “10 minutes, 10 days, or 10 years”. For a live radio link that protection interval can be, and this is the word they use, “negligible”. So the position report’s short life isn’t handled by stamping something clever on the report, it’s handled by giving the key that protects it a deliberately short life and then cycling it..

The classification itself never really carries any of this. A classification level, as I have gone on about in the earlier posts, is a judgement about how bad a compromise would be, not how long it matters. Executive Order 13526 (another American one), the order that runs the American system, defines its three levels purely by expected damage and treats duration as a separate thing the classifier fills in, with the backstop rule that nothing may stay classified indefinitely. Duration is present, but it sits off to the side, it isn’t part of the level.

Almost every time-rule I can find across countries protects information for long enough. Cryptography has to outlast the secret, keys get renewed if the data will outlive them, and so on. What you very rarely see written down is the other direction, protect it only as briefly as it’s worth protecting and then deliberately stop. The decaying half of the idea, the mission-secret half, gets engineered constantly in the key layer and almost never stated in the classification rules themselves.

With one striking exception, as far as I can tell. Czech law (Act 412/2005) has a category it calls tactical information, defined roughly as classified information whose grounds for classification “exist only for a short period of time”, and which, up to SECRET, can be protected by a lighter set of risk-assessed measures rather than the full apparatus. That is more or less the mission-secret idea written straight into a national statute, and it’s the only clean example of it I’ve come across.

So maybe, we should all be more like the Czechs?