FOR OFFICIAL USE ONLY Army Regulation 380–40 Security Safeguarding and Controlling Communications Security Material Distribution Restriction Statement. This publication contains technical or operational information that is for official Government use only. Distribution is limited to Government agencies or their contractors. Requests from outside the Government for release of this publication under the Freedom of Information Act will be referred to the Commanding General, U.S. Army Intelligence and Security Command, (IACSF–FI), Fort George G. Meade, MD 20755–5995. Requests from outside of the Government for release of this publication under the Foreign Military Sales program must be made to the Deputy Chief of Staff, G–2 (DAMI–CDS), 1000 Army Pentagon, Washington, DC 20310–1000. Destruction Notice. Destroy by any method that will prevent disclosure of contents or reconstruction of the document. Rapid Action Revision (RAR) Issue Date: 24 April 2013 Headquarters Department of the Army Washington, DC 9 July 2012 FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY SUMMARY of CHANGE AR 380–40 Safeguarding and Controlling Communications Security Material This rapid action revision, dated 24 April 2013- o Updates responsibilities for Commanding General, U.S. Army Intelligence and Security Command; Commanders, Army commands, Army service component commands, and direct reporting units; command security officers; commanders at all levels; and individual users (paras 1-8, 1-11, 1-12, 1-13, and 1-16). o Provides expanded policy and guidance for administering the Counterintelligence Scope Polygraph Program in support of the Department of the Army Cryptographic Access Program (chap 7). o Requires use of the U.S. Diplomatic Courier Service when shipping to foreign locations where controlled cryptographic items would be subject to foreign customs or postal inspection and clarifies the conditions and criteria under which controlled cryptographic items may be shipped using the Defense Courier Service mode of transportation (para 8-39). o Makes administrative changes (throughout). FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY Headquarters *Army Regulation 380–40 Department of the Army Washington, DC 9 July 2012 Effective 9 August 2012 Security Safeguarding and Controlling Communications Security Material otherwise stated. It also applies to non- Army internal control process. This Army elements that include, but are not regulation contains internal control provi- l i m i t e d t o , c o n t r a c t o r s , c o n s u l t a n t s , a n d sions in accordance with AR 11–2 and licensees. Its specific requirements apply identifies key internal controls that must to all communications security material in be evaluated (see appendix E). physical and electronic form used to se- c u r e n a t i o n a l s e c u r i t y s y s t e m s . D u r i n g S u p p l e m e n t a t i o n . S u p p l e m e n t a t i o n o f mobilization or national emergency, the this regulation and establishment of com- proponent may modify chapters and poli- mand and local forms are prohibited with- cies contained in this regulation. out prior approval from the Deputy Chief Proponent and exception authority. of Staff, G–2 (DAMI–CDS), 1000 Army The proponent of this regulation is the Pentagon, Washington, DC 20310–1000. Deputy Chief of Staff, G–2. The propo- nent has the authority to approve excep- Suggested improvements. Users are tions or waivers to this regulation that are invited to send comments and suggested consistent with controlling law and regu- improvements on DA Form 2028 (Recom- History. This publication is a rapid action lations. The proponent may delegate this m e n d e d C h a n g e s t o P u b l i c a t i o n s a n d revision (RAR). This RAR is effective 24 approval authority, in writing, to a divi- Blank Forms) directly to the Headquar- M a y 2 0 1 3 . T h e p o r t i o n s a f f e c t e d b y t h i s sion chief within the proponent agency or t e r s , D e p a r t m e n t o f t h e A r m y , D e p u t y RAR are listed in the summary of change. its direct reporting unit or field operating Chief of Staff, G–2 (DAMI–CDS), 1000 S u m m a r y . T h i s r e g u l a t i o n p r e s c r i b e s agency, in the grade of colonel or the A r m y P e n t a g o n , W a s h i n g t o n , D C A r m y p o l i c y f o r t h e s a f e g u a r d i n g a n d civilian equivalent. Activities may request 20310–1000. c o n t r o l l i n g o f c o m m u n i c a t i o n s s e c u r i t y a waiver to this regulation by providing Distribution. This regulation is available material. Also, this regulation implements justification that includes a full analysis of National Security Directive 42, Executive t h e e x p e c t e d b e n e f i t s a n d m u s t i n c l u d e in electronic media only and is intended Order 12333, the Committee on National f o r m a l r e v i e w b y t h e a c t i v i t y ’ s s e n i o r for command levels C, D, and E for the Security Systems Policy Number 1, the legal officer. All waiver requests will be Active Army, the Army National Guard/ Committee on National Security Systems e n d o r s e d b y t h e c o m m a n d e r o r s e n i o r A r m y N a t i o n a l G u a r d o f t h e U n i t e d Instruction 4005, DODI 5205.08, and por- leader of the requesting activity and for- States, and the U.S. Army Reserve. tions of DODI 8523.01. warded through their higher headquarters t o t h e p o l i c y p r o p o n e n t . R e f e r t o A R Applicability. This regulation applies to 25–30 for specific guidance. t h e A c t i v e A r m y , t h e A r m y N a t i o n a l Guard/Army National Guard of the United States, and the U.S. Army Reserve, unless Distribution Restriction Statement. This publication contains technical or operational information that is for official Government use only. Distribution is limited to Government agencies or their contractors. Requests from outside the Government for release of this publication under the Freedom of Information Act will be referred to the Commanding General, U.S. Army Intelligence and Security Command, (IACSF–FI), Fort George G. Meade, MD 20755–5995. Requests from outside of the Government for release of this publication under the Foreign Military Sales program must be made to the Deputy Chief of Staff, G–2 (DAMI–CDS), 1000 Army Pentagon, Washington, DC 20310–1000. Destruction Notice. Destroy by any method that will prevent disclosure of contents or reconstruction of the document. *This regulation supersedes AR 380–40, dated 30 June 2000. This edition publishes a rapid action revision. AR 380–40 • 9 July 2012/RAR 24 April 2013 i FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY Contents (Listed by paragraph and page number) Chapter 1 Introduction, page 1 Section I General, page 1 Purpose • 1–1, page 1 References • 1–2, page 1 Explanation of abbreviations and terms • 1–3, page 1 Responsibilities • 1–4, page 1 Section II Responsibilities, page 1 The Deputy Chief of Staff, G–2 • 1–5, page 1 The Chief Information Officer/G–6 • 1–6, page 2 Deputy Chief of Staff, G–4 • 1–7, page 2 The Commanding General, U.S. Army Intelligence and Security Command • 1–8, page 2 The Commanding General, U.S. Army Materiel Command • 1–9, page 2 Commanding General, U.S. Army Training and Doctrine Command • 1–10, page 3 Commanders of Army commands, Army service component commands, and direct reporting units • 1–11, page 3 Command Security Officers (G–2 or S–2) • 1–12, page 3 Commanders at all levels • 1–13, page 4 Directors of Headquarters, Department of the Army agencies and commanders of Army commands, installations, and activities • 1–14, page 5 Communications security account manager • 1–15, page 5 Individual users • 1–16, page 5 Chapter 2 Communications Security Material Control System, page 5 Requirements for communications security material • 2–1, page 5 Communications security account manager • 2–2, page 5 Communications security account manager duties and functions • 2–3, page 7 Communications security accounts • 2–4, page 7 Deployment of communications security accounts • 2–5, page 8 Electronic Key Management System • 2–6, page 8 Electronic Key Management System communications security accounts • 2–7, page 8 Access to communications security material • 2–8, page 9 Accessing, viewing by, and releasing of communications security material to foreign nationals • 2–9, page 11 Top secret communications security material • 2–10, page 11 Use of no-lone zones • 2–11, page 11 Communications security software, encrypted key, and JOSEKI • 2–12, page 12 Dissemination of communications security material • 2–13, page 12 Minimum item accounting requirements • 2–14, page 12 Reporting and accounting for communications security material • 2–15, page 13 Accounting legend code 6 • 2–16, page 13 Generating and accounting for accounting legend code 6 material • 2–17, page 13 Generating and accounting for accounting legend code 7 material • 2–18, page 13 Inventory requirements • 2–19, page 13 Issuing • 2–20, page 14 Removable storage devices • 2–21, page 14 Using communications security material • 2–22, page 14 Communications security operational precautions (safeguards) • 2–23, page 14 Protecting passwords • 2–24, page 15 ii AR 380–40 • 9 July 2012 FOR OFFICIAL USE ONLY FOR OFFICIAL USE ONLY Contents—Continued Classified communications security information • 2–25, page 15 Hand receipting communications security material • 2–26, page 15 Protective technology • 2–27, page 15 Reproduction of communications security material • 2–28, page 16 Communications security equipment modification • 2–29,