Intelligence agencies release records to the public chiefly through the Freedom of Information Act and mandatory declassification review, both governed by published regulation, and the Central Intelligence Agency's own processing rules were last rewritten in a final rule published April 17, 2023, per the Federal Register. The machinery is procedural: filing rules, processing steps, fees, appeals, and age-based declassification.
What rules govern an intelligence agency's public releases?
The procedural baseline is regulation. On April 17, 2023, the CIA issued its final rule on FOIA regulations covering the requirements for filing FOIA requests and the agency's procedures for processing and reviewing such requests, closing out a proposed rule submitted for comment on July 1, 2022 under the FOIA Improvement Act of 2016, per the Federal Register notice. The rule sits in the Code of Federal Regulations at 32 CFR Part 1900, Public Access to CIA Records under the Freedom of Information Act.
The codified regulation is organized the way the process actually runs. Its table of sections covers, in order: authority and purpose; definitions; contacts for general information and requests; requirements as to form and content for filing; fees for record services and fee estimates as a pre-request option; processing of requests for records; action and determination by originators or any interested party; payment of fees, notification of decision, and the right of appeal; procedures for business information; procedures for information concerning other persons; allocation of resources and agreed extensions of time; and requests for expedited processing, per the codified regulation published on govinfo. Every one of those sections is a step where a request can advance, stall, or narrow.
How does declassification differ from FOIA?
Declassification operates on the record, not on the requester's initiative. The executive order titled Classified National Security Information established the framework agencies implement through their own rulemakings. The Commerce Department's 2020 final rule, for example, updated its delegation of authority for implementing the executive order, covering designations of Original Classification Authorities, the designation of classification levels and durations, the process for mandatory reviews of information subject to declassification, and the process and conditions for allowing access to classified information by individuals outside the government, per that rule.
The two tracks differ in leverage and in what they can deliver, and requesters with a choice between them should match the tool to the target:
| Feature | FOIA request | Mandatory declassification review |
|---|---|---|
| Who initiates | Any requester | Any requester naming specific records |
| Question asked | Do releasable records exist and can they be disclosed? | Does the information still meet the standards for continued classification? |
| Key procedural safeguards | Filing form and content rules, fee estimates, notification of decision, administrative appeal | Review against declassification standards, appeal as defined by the governing order and agency rules |
| Typical outcome | Release, redacted release, or denial with citations to the regulation | Declassification in whole, in part, or reaffirmation of classification |
What does the codified regulation cover, step by step?
Read in order, the sections of 32 CFR Part 1900 describe the life of a request. The general provisions define authority, terms, and the official contact point. The filing provisions set preliminary information and the requirements as to form and content — the difference between a request an agency can act on and one it must return for clarification. The fee provisions cover both fees for record services and a pre-request fee estimate, a structure that lets a requester learn the likely cost before committing.
The processing provisions govern what happens next: how requests for records are processed, how originators or interested parties act on determinations, when fees are collected, how the decision is notified, and the right of appeal. The administrative provisions then handle the special cases — business information submitted to the agency, and records concerning other persons — together with allocation of resources, agreed extensions of time, and requests for expedited processing. Finally, a dedicated set of sections governs administrative appeals, closing the loop the filing provisions opened.
Two design choices stand out against other agencies' FOIA rules. The regulation explicitly provides for agreed extensions of time, formalizing negotiation over schedules rather than leaving requesters to guess. And the fee estimate option front-loads cost information, which for researchers planning multi-request projects is often the difference between a scoped program of requests and a single expensive one.
What can a requester actually expect?
The documented process for a public-records request to an intelligence agency runs in a fixed order:
- File the request in the form and content the agency's regulation prescribes, clearly describing the records sought, using the published contact point for general information and requests.
- The agency processes the request under its published procedures, which include a fee estimate option before work begins and provisions for agreed extensions of time.
- Exempt material is withheld or released with redactions; originators or interested parties may act on determinations as the regulation provides, and the agency notifies the requester of its decision.
- The requester may pursue the administrative appeal defined in the regulation and may request expedited processing where the regulation's criteria are met.
Two of the codified sections deserve attention because they shape outcomes quietly. The procedures for business information govern how proprietary material submitted to the agency is handled in disclosure. The procedures for information concerning other persons govern what happens when records a requester seeks contain personal information about third people — a category that in intelligence files is the rule rather than the exception, and a frequent source of redaction.
Why do redactions dominate intelligence releases?
The regulation's own structure explains much of the black ink. Provisions for business information and for information concerning other persons exist because intelligence files are rarely about one subject alone: a record responsive to a request will typically name sources, foreign individuals, and counterpart organizations, and each of those categories triggers a protection review before any disclosure. A release decision is therefore rarely a yes-or-no on the document; it is a passage-by-passage determination.
For intelligence agencies specifically, the declassification track carries a procedural weight it lacks elsewhere, because so much of the archival record never passed through an ordinary agency's disclosure system. The declassification track adds its own layer. Reviews under the executive order framework ask whether information still meets classification standards, and aging does not by itself declassify — sources and methods can remain sensitive long after the events they concern. The practical consequence, visible across agencies' released-record collections, is that the oldest documents often read most cleanly, while recent-era releases arrive heavily marked.
What is unknown?
Neither the CIA's 2023 rule nor the codified regulation publishes current backlog or release-volume figures, so requesters cannot read processing timelines out of the regulations themselves. How much historical material agencies release proactively through electronic reading rooms, and on what schedule, is likewise set by practice and budget rather than by the quoted rules, and the regulations leave release schedules to each agency's own resourcing decisions — including the provisions on allocation of resources and agreed extensions of time that acknowledge capacity limits directly.
What the record shows is the machinery itself: filing rules, processing steps, fee estimates, appeals, expedited-processing criteria, and a declassification track keyed to the record rather than the requester. For anyone studying intelligence history, the practical method the regulations imply is patience with process: describe records precisely, use the fee-estimate option, expect third-person redactions, and reserve the appeal rights the regulation defines for the decisions that matter most.
