FINAL DESTRUCTION OF KEY TAPES IS NOT, AND WILL NOT, BE AUTHORIZED

EVEN IN THE NEW-SPECIFICATION

CROSSCUT SHREDDERS. Key material with a short title beginning with USKAT (T=Tape) will only be authorized for destruction in approved disintegrators, by burning, or in NSA-approved Key Tape-specific Destruction Devices (KTDD). If a COMSEC account holds key tapes and burning is not possible, they MUST acquire an approved disintegrator or an approved KTDD to destroy these key tapes. See paragraph 4.19.4 below for key tape destruction.

4.19.1 (U) Routine Destruction Procedures.

All COMSEC Custodians are required to establish routine destruction procedures for the COMSEC products they manage. Destruction procedures must ensure complete destruction of material and an accurate system of accounting for destroyed material. Size and location of the COMSEC Facility, amount of material, personnel resources, and available destruction facilities will determine local destruction procedures.

TB 380-41

4.19.2 (U) Scheduled Destruction.

a. (U) Keying Material. Destroy all superseded keying material, including key tapes, Modern electronic SDNS/FIREFLY Key such as TACLANE/ FASTLANE, one-time pads, codes and authentication systems and extracts as follows:

(1) (U) All used key must be destroyed immediately after supersession if possible, but no later than 12 hours after supersession. Local

commanders, CONAUTHs, or other responsible officials may grant extensions up to a maximum of 72 hours on a case-by-case basis when fully justified. Except under combat conditions, extensions must be

requested and approved, in writing, and retained on file with the Local

Destruction Report for review by command inspectors and auditors.

(2) (U) It is not required that unused superseded daily or individual key settings be removed from secure storage for the sole purpose of destruction to fulfill the 12-hour

destruction requirement (see paragraph 4.19.2 a [3] below). However, when individual key segments are removed from a canister for use, all previous unused segments that have become superseded will be destroyed within 12 hours. ICP key will be destroyed IAW direction from the ICP manager.

(3) (U) Notwithstanding item (2) above, unused, superseded, keying material must be destroyed not later than 5 days after the supersession date.

Distribution accounts (CLSFs) are required to destroy unused superseded keying material not later than 15 days after supersession; however, more frequent destruction of such material is recommended.

b. (U) Exception to COMSEC Account Destruction Procedures.

(1) (U) Ten-day increments of

operations will be destroyed

immediately after supersession but no later than 12 hours afterward. Local commanders, CONAUTHs, or other responsible officials may grant an extension, in writing, of up to a maximum of 72 hours on a case-by-case basis (see subparagraph 4.19.a.2 [1] above).

(a) (U) The user will destroy this

material. A witness is not necessary and a Destruction Report is not required (see paragraph 4.16.b).

(b) (U) Do not return DRYADS/

OPCODES material to the custodian or other persons who originally issued the key. Any unnecessary retention of material for

administrative purposes increases the possibility of loss or

compromise.

(2) (U) All superseded key, used or unused, which is held in facilities designated as high risk per AR 190-51 by cognizant security officials, will be destroyed immediately after supersession, if possible, but no later than 12 hours after the date the material is

superseded, without exception. All operational COMSEC Facilities deployed outside the U.S., its possessions, and its territories are considered to be Mission Essential or Vulnerable Areas (MEVA).

c. (U) Unused Key Marked “CRYPTO.”

All key marked “CRYPTO” and held in Contingency or Reserve status will be superseded and destroyed IAW AR 380-40.

d. (U) Maintenance and Sample Key.

Maintenance key and sample keying materials that are not designated “CRYPTO” are not regularly superseded. Such material should be destroyed only when it becomes physically unserviceable or is no longer required.

e. (U) Other COMSEC Material. Destroy all COMSEC material other than key (e.g., operating instructions, maintenance manuals)

TB 380-41

destroyed no later than 5 days after posting the amendment. Regardless of extenuating

circumstances, which may justifiably cause short delays in destruction of this category of material, it must be destroyed no later than the 15th day after the date the item was superseded.

f. (U) Allied Publications. Destruction of Allied Publications by U.S. elements will be performed as directed by appropriate NATO and Allied Directives.

4.19.3 (U) Destruction Procedures. Except as noted in paragraph 4.19.2 b. above, destroy key in the presence of a cleared witness having a security clearance equal to or higher than the material being destroyed. The witness is required to participate in a joint inventory, to observe all key being destroyed, and to sign the appropriate disposition record. In unique situations when the operational instructions specifically state signature of a witness is waived, a witness is not required for the

destruction of classified key. The lack of space on a Disposition Record for a witness signature or initials does not constitute a waiver.

4.19.4. (U) Destruction of Paper-Based COMSEC Material and Keying Material, and of Mylar Key Tapes. Destroy keying material by complete burning, or through use of approved pulverizing devices, wet pulping, disintegrators, or chemical alteration.

(U) For physical destruction purposes, Keying material is divided into two

categories: Paper keying material, and Key Tape. Key Tape will not be considered as paper. ALL key tape will be treated as non-paper (i.e., Mylar) material.

a. (U) Burning. Burning is the preferred destruction method for all keying material.

Burning methods and equipment used must have prior approval of the local command’s physical security officer. During the burning process, make sure that combustion is complete and that all material is reduced to a white ash.

When burning key material, the fire and appliances used to generate the fire must be within a contained area and controlled so that no unburned pieces are allowed to escape by fire- generated air drafts or wind currents. Inspect ashes and, if necessary, break up residue and re-burn or reduce to sludge by adding water.

b. (U) Disintegrators. Use of disintegrators (pulverizing machines,

hammermills, or knifemills) for final destruction of paper-based COMSEC keying material is considered to meet the specifications of CNSS No.16, and may continue to be used for destruction of this material. These destruction devices may be used to perform final destruction for printed or punched key tape ONLY IF THE NSA has specifically approved the device, and/or by subsequent HQDA (G-2) documented and approved methods. COMSEC personnel must ensure the disintegrator machine has thoroughly reduced the material to bits or fibers that are too small to be reconstructed. Check the machine and its residue before and after each use. Materials that have been

disintegrated in strict compliance with the policies contained in NCSS No. 16 and this TB are considered destroyed beyond reconstruction.

c. (U) Double-cut Shredders. Effective 1 January 2003, use of previously approved double-cut (crosscut) shredders conforming to the standard defined in NTISSI No. 4004 (i.e., waste particle size of 1/2 “ x 1/32”) were no longer authorized for the terminal destruction of any paper-based COMSEC material, key, or otherwise.

(1) (U) In situations where burning, pulverization, or destruction of paper-based COMSEC material by use of an approved device is not feasible, old-specification crosscut shredders may continue to be used to destroy “non-CRYPTO-marked key” and other paper COMSEC material until the organization takes delivery of a new-specification crosscut shredder, or until 30 September 2003, whichever occurs first.

(2) (U) As of 1 October 2003, a new-specification crosscut shredder, or an approved alternate destruction process, is required for the destruction of all paper-based COMSEC material. The device must meet the new standards and specifications as defined in the NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders (NSA/CSS EPL-02-01, dated 1 August 2002, or later).

TB 380-41

(3) (U) During the period 1 January to 30 September 2003, old-specification crosscut shredders may continue to be used on a temporary basis as a “first step” in the destruction process toward the final destruction of the material. This interim period has been granted to facilitate a smooth transition to the new method of destruction.

(4) (U) After 1 October 2003, when destroying COMSEC material marked

“CRYPTO” (e.g., keying material or key tapes) the use of a crosscut shredder (old or new specification) SHALL NOT be considered as a “final” destruction method and MUST be augmented by additional precautions to ensure the final destruction of the material (see

paragraphs a. and b. below). Use of a destruction device for the final

destruction of Key Tapes (i.e.,

destruction not augmented by additional precautions) will only be authorized in NSA-approved disintegrators, by burning, or in approved Key Tape-specific Destruction Devices (KTDD).

Units that do not have burn facilities, approved disintegrators, or an approved KTDD must comply with the following:

(a) (U) When employing a crosscut shredder as a first step for keying material destruction, some additional precautions are necessary to ensure final “terminal” destruction:

Shredded keying material must not be treated, handled or disposed of as unclassified waste or in any manner that would allow an adversary access to all portions of the shredded keys.

(b) (U) Shredded key shall be retained and stored as collateral classified material for later secure return to a facility which can burn or pulverize the shredded residue.

As an alternative, it can be dispersed in a method that will prevent or preclude collection of all portions of a key segment. A common sense approach should be used to identify

mixed shredded residue down a toilet will prevent collection of all pieces for reconstruction, or dispersing it into the ocean will accomplish the same objective. As a last recourse, shredding amounts of keying

materials, mixing with other shredded material, and loosely dispersing “by hand” in multiple and random trash containers will preclude a systematic collection and reconstruction of the residue.

(5) (U) Wet Pulping. Wet pulping devices may be used ONLY IF they reduce the paper to a state such as that no information can be recovered from the residue (i.e., no pieces larger than 5 mm [0.2 inches] in any dimension). To date, the only approved wet-pulping device is a good quality household blender. The blender will destroy a few sheets of low wet-strength paper at one time.

(6) (U) Electro-Media Material. Material in other than paper form (e.g., magnetic tape, microfiche, microfilm) must be burned, chopped, pulverized or chemically changed so that there is no possibility that information can be physically, electrically, optically, or otherwise reconstructed. Floppy disks will be destroyed IAW AR 380-19.

Examples of preferred destruction methods for electro-media based non-paper key are as follows:

SODIUM NITRATE: WARNING