Imagine reviewing a document stored on an unclassified computer when you notice a paragraph beginning with a classified portion marking.
The document itself might have no classification banner. Its filename might include "Unclassified." It might have been emailed through ordinary channels or downloaded from a shared repository.
What should happen next?
The answer depends on the actual status of the information, but one principle is clear: the document's storage location and filename do not determine its classification.
A marking discrepancy is a warning, not a final determination
A classified marking appearing in an apparently unclassified document can result from several circumstances.
It might be an instructional example containing synthetic information. It might be an incorrect or obsolete marking. It might have been copied into an otherwise unclassified document.
It could also indicate that classified information has been introduced into an information system not authorized to process it.
These situations require different responses. An end user should not attempt to settle the classification question solely by inspecting the text or relying on a software scanner.
What is classified information spillage?
A classified spill generally occurs when classified information is introduced into an unclassified information system or one operating at an insufficient classification level.
Depending on the circumstances, a spill can affect email systems, shared drives, endpoints, backups, logs, and other connected resources.
Improper handling after discovery can complicate containment and increase the number of affected systems.
What should you do?
If you encounter information reasonably suspected to be classified on an unclassified system:
Stop processing the material. Do not continue distributing, copying, uploading, or examining it beyond what your organization's reporting procedures require.
Report the concern immediately. Contact your designated security manager, Facility Security Officer (FSO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO), as applicable.
Do not attempt your own cleanup. Deleting files, clearing logs, forwarding examples, or independently moving the material can interfere with incident response.
Follow the organization's containment instructions. Authorized security personnel should determine how to isolate affected systems, preserve necessary information, and coordinate required reporting.
Avoid spreading the suspected information while reporting it. Use approved communication channels and provide only the details security personnel request.
DCSA guidance emphasizes prompt notification and coordinated handling rather than ad hoc remediation.
What if the marking was only an example?
That is possible.
Training materials, templates, and documentation may contain illustrative classification markings that do not correspond to actual classified content.
But if the situation is ambiguous, the appropriate response is still to seek an authorized determination rather than assume that the marking is harmless.
Once an authorized reviewer resolves the issue, normal processing can resume in accordance with applicable procedures.
Can automated screening prevent these problems?
Automated marking detection can provide a useful additional check before a document is distributed.
For example, a scanner might identify a classification banner or portion marking that a reviewer overlooked.
But the scanner has important limitations.
It cannot establish whether a marking is genuine, whether information is classified despite being unmarked, or whether a system is authorized to handle particular content.
Importantly, suspected classified material should not be transferred into an unapproved scanner merely to investigate a finding.
Strike Gate is intended as a marking-inspection aid for use with supported materials in authorized environments—not as a classified-information incident-response or declassification tool.
The operational lesson
Organizations should train personnel to recognize potential marking inconsistencies, stop potentially unsafe actions, and know whom to contact.
A useful security workflow combines automated indicators, trained personnel, approved systems, and clear escalation procedures.
The objective is not to make users classification experts. It is to prevent a questionable document from becoming a wider security incident.