UK Marking - SECRET / TOP SECRET

Detects the UK Government Security Classifications Policy (GSCP) SECRET and TOP SECRET national-security classifications: the verified UK Prefix form (UK SECRET / UK TOP SECRET, applied to assets shared with foreign governments or international organisations), the classification followed by a verified National Caveat handling instruction (SECRET/TOP SECRET - UK EYES ONLY, - UK/US EYES ONLY, - FIVE EYES ONLY, per the GSCP's "CLASSIFICATION - HANDLING INSTRUCTION" additional-marking format — National Caveats apply only to SECRET and TOP SECRET, never OFFICIAL), the distinctive TOP SECRET banner-words phrase, and a UK-government-context-gated bare SECRET banner. Intended to surface content that should not reside on this platform. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence on the UK Prefix form and the National Caveat form: both are verified directly against the current GSCP primary source, structurally distinctive, case-sensitive tokens with low natural-English collision risk. The TOP SECRET banner-words phrase is likewise high confidence (case-sensitive two-word phrase). Bare SECRET alone (75) is a common English word used constantly outside government context (TRADE SECRET, CLIENT SECRET, API SECRET, SECRET MANAGER, SECRET SANTA, etc), so it is the widest tier and is gated by UK central-government/GSCP corroborative evidence plus a dedicated NOT-exclusion for the most common non-government collocations.

Jurisdictions

uk

Regulations

Official Secrets Act 1989

Frameworks

GSCP

Data categories

government, security-classification

Scope

narrow

Risk rating

10

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\bUK[\s-]+(?:TOP[\s-]+)?SECRET\b|\b(?:TOP[\s-]+)?SECRET\b[\s-]+-[\s-]+(?:UK(?:/US)?|FIVE)[\s-]+EYES[\s-]+ONLY\b|\bTOP[\s-]+SECRET\b

Corroborative evidence keywords

HM Government, Cabinet Office, GSCP, national security

Proximity: 300 characters

Should match

• This cable is marked UK SECRET and should not be released without prior agreement from the UK Government. — Verified UK Prefix form — applied to assets shared with foreign governments/international organisations per the GSCP
• Document classified SECRET - UK EYES ONLY, distribution restricted to accredited UK nationals. — Verified National Caveat form — classification followed by the UK EYES ONLY handling instruction, hyphen-separated per GSCP additional-marking format
• The dossier is marked TOP SECRET and held in the secure registry. — TOP SECRET banner-words phrase
• Cover sheet reads TOP SECRET for distribution to cleared staff only. — PDF line-wrap between TOP and SECRET (the banner-words tier tolerates a wrap-inserted newline)
• This SECRET briefing must be handled under Cabinet Office and HMG security requirements. — Gated bare-SECRET form — UK central-government/GSCP corroborative evidence (Cabinet Office, HMG) present within 300 characters

Should not match

• the secret ingredient is a pinch of salt — lowercase English word (case-sensitive exclusion)
• this is top secret information, allegedly — lowercase phrase (case-sensitive exclusion)
• THE COMPANY'S TRADE SECRET RECIPE IS LOCKED IN A VAULT — ALL-CAPS non-government collocation — excluded from the top-level pattern (no TOP/UK-prefix/caveat present) and from the gated bare tier by the TRADE SECRET NOT-group
• OFFICE SECRET SANTA GIFT EXCHANGE SIGN-UP SHEET IS ON THE NOTICE BOARD — ALL-CAPS non-government collocation — excluded from the top-level pattern and from the gated bare tier by the SECRET SANTA NOT-group

Known false positives

• ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare TOP SECRET banner-words tier relies on — any all-caps rendering of the phrase (e.g. a film or product title) can fire with no protective-marking intent. Mitigation: Treat banner-tier-only (85) hits as lower confidence when the surrounding text is itself all-caps; the UK Prefix and National Caveat tiers (both 85, structurally verified) remain the more reliable signal.
• SECRET is an extremely common English word in everyday non-government usage (TRADE SECRET(S), CLIENT SECRET, API SECRET, SECRET MANAGER, SECRET SANTA), all more common in general text than the GSCP classification marking. Mitigation: The bare tier (75) requires UK central-government/GSCP corroborative evidence and excludes this collocation set via a dedicated NOT-group (SECRET SANTA is added to this SIT's exclusion group as a hardening beyond the equivalent nz-marking-secret-topsecret exclusion set, which documents SECRET SANTA only as a residual risk rather than excluding it). SECRET KEY is deliberately NOT excluded, as it is plausible inside genuinely classified COMSEC prose. The UK Prefix, National Caveat, and TOP SECRET banner-words tiers (all 85) are unaffected — they are structurally distinctive and do not require the gate.
• This SIT's vocabulary overlaps with the Australian PSPF and New Zealand PSR marking families: au-marking-secret-topsecret and au-marking-protected ship their own bare SECRET/TOP SECRET tiers ungated apart from noise/collocation NOT-groups (no AU-context requirement), and nz-marking-secret-topsecret ships an equivalent gated bare-SECRET tier and its own TOP SECRET banner-words tier. A genuine UK SECRET or TOP SECRET document will therefore typically co-fire the AU SITs (shared bare-word vocabulary, no jurisdiction gate on their side) and may co-fire the NZ SIT if NZ/PSR corroborative context also happens to be present. Mitigation: Deploy policies should expect this cross-jurisdiction co-fire and treat the SITs as corroborating, not conflicting, signals; do not add a UK-exclusion to the AU/NZ SITs, as that would break their own intended (broader or independently-gated) coverage.
• us-classification-banner uses the Five-Eyes "//" control/dissemination-marking separator (e.g. SECRET//REL TO USA, FVEY), which is structurally distinct from the UK GSCP's own hyphen-separated additional-marking format (CLASSIFICATION - HANDLING INSTRUCTION - CODEWORD - NATIONAL CAVEAT). A UK document using only the native GSCP hyphen format will not co-fire us-classification-banner; a UK document that separately also carries an interoperable Five-Eyes "//"-marked control token would co-fire both, which is expected and correct. Mitigation: No mitigation needed — the two SITs detect genuinely different (if occasionally co-occurring) marking syntaxes.
• Two verified GSCP forms are not implemented as machine-matchable regex: (1) Codewords are single arbitrary CAPITALISED words, centrally allocated per-asset — the GSCP's own worked example literally uses the placeholder text "CODEWORD", which is illustrative, not real recurring vocabulary, so no fixed regex can enumerate genuine codewords; (2) the fully-layered "PREFIX CLASSIFICATION - HANDLING INSTRUCTION - CODEWORD - NATIONAL CAVEAT" form (e.g. the GSCP's own "UK SECRET - CODEWORD - UK EYES ONLY" example) is not matched when a handling instruction or codeword segment sits between the classification and the National Caveat — the caveat-tier regex requires the caveat to follow the classification directly. Mitigation: No mitigation implemented — documented as a known coverage gap rather than guessing at unverified intervening-segment syntax. The direct-adjacency UK Prefix, National Caveat, and TOP SECRET banner-words tiers remain the reliable, verified signals.

References

• Government Security Classifications Policy (GSCP), version 2.0 - GOV.UK