DETERMINATION OF THE CHIEF MANAGEMENT OFFICER Under the authority delegated to me by the Secretary of Defense, I have determined that the following info1mation is exempt from disclosure under Exemption 3 of the Freedom of fufonnation Act (5 U.S.C. § 552(b)(3)) because it meets the requirements for exemption under 10 U.S.C. § 130e: Project Maven infrastrncture, technical, and program info1mation. HERSHMAN.LISA .W.1544505641 Date: December 18, 2018 Digitally signed by HERSHMAN.LISA.W.1544SOS64 1 Date: 2018.12.1813:47:24 -OS'OO' Lisa W. Hershman Acting Chief Management Officer STATEMENT OF THE BASIS FOR THE DETERMINATION BY THE CHIEF MANAGEMENT OFFICER In accordance with 10 U.S.C. § 130e, I reviewed information regarding Department of Defense (DoD) artificial intelligence information associated with Project Maven. I have determined that this information qualifies as DoD critical infrastructure security information as defined by 10 U.S.C. § 130e(f) because it pertains to the capabilities and limitations of critical defense applications making use of Project Maven’s artificial intelligence technology. Gaining this information about Project Maven, individually or in the aggregate, would enable an adversary to identify capabilities and vulnerabilities in the Department’s approach to artificial intelligence development and implementation. This would further provide an adversary with the information necessary to disrupt, destroy, or damage DoD, technology, military operations, facilities, and endanger the lives of personnel. Project Maven infrastructure information includes artificial intelligence training data, raw data sources, data labeling software and procedures, network management, algorithm development, algorithm test and evaluation, ontology, synthetic data, cloud computing, transfer learning data sources, software tools, software frameworks, hardware components, testing, accreditation, integration, user interfaces, and retraining of Project Maven algorithm-based technology. Project Maven technical information includes research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. Project Maven program information includes information detailing the presence, capability, intent, readiness, timing, relative strengths, relative weaknesses, performance metrics, location, and method of development, testing, and employment of Project Maven algorithmbased technology. I considered the public interest in the disclosure of Project Maven sensitive information and weighed this against the risk of harm that might result if it were to be disclosed. Although there is value in the public release of this information, because the risk of harm that would reasonably result from its disclosure is extremely significant, I have determined that the public interest does not outweigh its protection. Therefore, it should be exempt from disclosure.