For instance, you can know any two of the following and it might only be FOUO (for official use only):
When a military deployment will happen
Where it will be to
Who will be going
But all three, together, are considered classified. (Trivial case, usually not this small a data set, but this is the concept.)The result is that someone gets apparently safe information from several sources. They put this into a briefing, or talk about it at the bar. The accumulated information is now considered Confidential (or higher), but was developed entirely from non-Confidential (or higher) sources.
>>Where it will be to
>>Who will be going
Having all three aggregated is not classified, but it is critical information (AR530-1, para 1-5, section b(2) [1]). An entire deploying unit is given those 3 bits on information, but the entire unit rarely is 100% on security clearances. EXAMPLE: when 2BCT,25ID deployed in 2004 the entire unit was told when they were deploying and for how long, where they were going, and who units/personnel were going; everyone including that fresh 18y/o 11B PVT that graduated BCT 1 week prior were told.
But yes I agree with you on the first statement about information aggregation.
It pretty much boils down to contact FBI CI (https://www.fbi.gov/about-us/investigate/counterintelligence) or the CI agents on base (if it happened on a military instillation.