How video is secured
AARCV treats video security as a default-deny pipeline that runs on its own. You only get involved for exceptions. This page explains what it does, so you can predict what you will see.
The classification levels, rules and networks shipped with the prototype are placeholders. Your program's security classification guide replaces them. Nothing here is real classification guidance.
Five layers#
- Sanitize. Only frames with an allow-listed receiver in view are kept. Background terrain is replaced, unit markings blurred, burned-in overlays blacked out and container metadata stripped. An unlisted platform stops processing and is purged.
- Screen. Every frame of the finished video is checked again without trusting the sanitizer: overlays clear, banner present, background masked. Up to 5% failing frames are replaced with a REDACTED slate automatically; more and the imagery waits for a security officer.
- Mark. Each product's content (imagery, pilot identity, telemetry) is mapped to a level and controls by the policy. The highest level wins, NOFORN overrides REL TO, and the banner is stamped on every frame.
- Release. A product at or below the automatic release ceiling (CUI by default) whose screen passed is released; others wait for review. Anything above the host network's ceiling is sealed as a possible spillage.
- Custody. Every product's hash and every action on it is recorded in a signed, hash-chained manifest.
Release states#
| State | Meaning |
|---|---|
| released | Can be opened by anyone who passes the rules below. |
| pending_review | Waiting for a security officer. Reviewers can open it; nobody else can. |
| withheld | A reviewer decided it should not be released. Can be purged. |
| sealed | Marked above what this system may hold. Nobody can open it; an audit entry and a high-priority work order are created. |
Who can open what#
Every open and every export passes these rules in order. The first one that fails decides, and the denial is audited with the rule that failed.
- Release: the product is released.
- Network: its marking is within the ceiling of the network you are on or exporting to.
- Clearance: yours is at or above the marking.
- Dissemination: NOFORN and REL TO match your citizenship.
- Role: your role may open this product type. Maintainers get data, not imagery, by default.
- Need to know: a pilot account sees only that pilot's sorties.
Why can't I open a video?#
The message on the page names the rule that failed. The usual causes:
- Pending review: the product is above the automatic release ceiling or failed screening. A security officer will release or withhold it.
- Clearance not recorded: ask a security officer to record your clearance on the Security page.
- Not your sortie: pilot accounts see only their own.
Marking examples#
With the notional default guide: an operational sortie with every sanitizer control on is marked CUI//OPSEC/PRVCY. Turning background replacement off would make its video SECRET//NOFORN, which an unclassified host refuses before processing. Synthetic sorties stay UNCLASSIFIED // SYNTHETIC DEMONSTRATION DATA.