The Pentagon wants Congress to give it a new power to keep unclassified records out of public view, a change that would reach reporters, watchdog groups and any contractor or citizen who files a Freedom of Information Act request with the military. The Department of War (DoW) has submitted a legislative proposal to create a FOIA exemption for controlled unclassified information (CUI), according to SmallGovCon's Oct. 1, 2026 analysis. CBS News reported that the proposal went to Congress in late June for possible inclusion in legislation this year.
How Would the CUI Exemption Work?
The proposal does not cover every record marked CUI. Under the text SmallGovCon describes, DoW could withhold information only after a written determination that the material meets several tests at once. The information must be CUI. It must also qualify as what the proposal calls "Department of Defense national security information." And the public interest in disclosure must not outweigh the harm to DoD from release.
The proposal defines that second category as national defense information that, if disclosed, would reveal vulnerabilities in DoD operations or programs. Those vulnerabilities would have to be ones that, if exploited, would likely significantly disrupt or damage DoD operations or protected programs. SmallGovCon quotes the proposal's stated purpose: "This proposal would protect Department of Defense national security information from public disclosure where the information would reveal vulnerabilities in Department of Defense national defense operations or programs to potential adversaries."
The text includes one accountability feature. Each determination must be in writing with a statement of its basis, and SmallGovCon reports that the determinations and statements would be available to the public on request. A requester denied a record would therefore be able to ask to see the reasoning behind the denial.
Why Does the Pentagon Say It Needs This?
The Pentagon frames the change as a matter of consistency. SmallGovCon says the proposal argues that more uniform protection for CUI-designated information would "greatly reduce complexity" and produce more consistent withholding decisions. Joe Valdez, the acting Pentagon press secretary, gave CBS News a similar account: "The legislative proposal seeks a statutory FOIA exemption for certain CUI that implicates national security interests to provide more uniform protection and more consistent withholding decisions for such information."
That argument rests on the way CUI works today. The National Archives oversees the CUI program, and CBS reports that it has repeatedly said a CUI designation does not affect whether a record can be released under FOIA. Agencies that want to withhold a CUI-marked record currently have to rely on one of FOIA's nine statutory exemptions. A new exemption keyed to CUI would add a tenth path that ties withholding to a defense-specific determination.
What Do Critics Say About the Gap in the Pentagon's Case?
CBS reports that the proposal does not explain why the existing FOIA exemptions are insufficient. That omission is the center of the criticism. CBS adds that much of the information the Pentagon says it wants to protect is already shielded under existing law, naming export-controlled technologies, protected critical infrastructure information, certain nuclear records, procurement-sensitive data and intelligence-related information, all of which agencies already rely on to withhold records under FOIA.
Brett Max Kaufman, senior counsel at the ACLU Center for Democracy, told CBS News by email: "The last thing the government needs is a new power to withhold information under the FOIA." Greg Williams, director of the Center for Defense Information at the Project On Government Oversight (POGO), called the proposal "a significant concern" and told CBS: "Ask yourself, you know, if you're going to mark something as 'controlled unclassified information' for national security concerns, why wouldn't you classify it?"
CBS adds two details that widen the stakes. First, the proposal would let DoD block state and local governments from releasing covered records under their own open-records laws. A federal exemption would then reach beyond federal FOIA offices into city halls, county sheriffs and state agencies that hold copies of Pentagon-related documents. Second, CBS notes the FOIA Improvement Act of 2016 requires agencies to show foreseeable harm before withholding many records. The proposal's own test asks DoW to weigh the public interest against the harm to DoD.
CBS's reporting is dated July 15, 2026, so the proposal itself is not new. SmallGovCon's Oct. 1 post shows it is still being discussed. CBS said it was unclear whether the proposal would be included, because the House and Senate had already completed their markups of the annual defense policy bill. We could not read the primary proposal document, so this account relies on the two outlets' descriptions of its text.
What It Means for Contractors
Contractors sit on both sides of this proposal. Companies that handle CUI for the Department have an interest in protecting sensitive technical data, and a uniform exemption could give them more predictable treatment when a requester asks for records that mention their programs. The Pentagon's consistency argument speaks to that concern.
The same change could narrow what competitors, journalists and watchdogs learn about how contracts are run. FOIA requests are one way outsiders obtain performance records, program documents and correspondence. If DoW can invoke a new exemption by written determination, fewer of those records may reach the public, and the visible record of how a program is performing could thin out.
Several points are worth tracking as the proposal moves:
- The definition of vulnerability. The test turns on information that would reveal vulnerabilities likely to cause significant disruption or damage. How tightly Congress words that standard will decide how many records qualify.
- The public-interest balance. The proposal requires DoW to conclude that disclosure harm outweighs the public interest. Who reviews that conclusion, and how, is not described in the sources we read.
- The written-determination record. Because determinations and statements of basis would be available on request, requesters could build a picture of how the exemption is used. Contractors could see their programs' records addressed in those determinations.
- State and local reach. Firms that supply records to state and local customers may find those records covered if the preemption language survives.
For now the proposal is a request, not law. Congress has not acted on it in the reporting we reviewed, and the proposal does not explain why current exemptions fall short. Contractors that handle CUI should watch the text that emerges from any defense authorization or related bill, because the final definitions will determine whether this exemption protects a narrow set of vulnerability data or a far broader share of unclassified records.
