An archivist at the Smithsonian National Air and Space Museum sorting through the documents of a former test flight pilot made a startling discovery: papers about an experimental hypersonic aircraft marked “Top Secret.”

At the World Bank, an employee stumbled upon a State Department document concerning 1950s Iran labeled “Secret.”

And at the Organ Historical Society — a group dedicated to the celebration, preservation and study of the pipe organ in the United States — an employee came across World War II-era Navy manuals flagged as “Restricted.”

In each case, the discoveries of apparently classified records set off alarm bells within these private organizations, compelling them to report the documents to the U.S. National Archives and Records Administration to ensure that the national security of the United States had not been compromised. But after quick review, the agency’s Information Security Oversight Office (ISOO) determined that there was no threat and that the records could remain public.

These documents are among at least 100 instances in which classified national security documents have been located outside of government control and reported to the National Archives’s classification office since 2007, according to a document obtained by The Washington Post in response to a Freedom of Information Act request.

Since 2022, when the FBI raided former president Donald Trump’s residence at Mar-a-Lago and charged him with unlawful retention of more than 300 classified records — some of which were found in desk drawers — prosecutors and government officials have warned about the danger of classified records in the “wild.”

The list disclosed to The Post, which summarizes classified information found outside of government control, does contain some instances of documents that were deemed to be highly sensitive and potentially damaging to national security. But for the most part, it shows that private citizens and institutions possess classified information that, much of the time, need not be hidden from the public.

“I don’t want to put a damper on this, but most classified information really isn’t that interesting,” said William Carpenter, associate director of the ISOO, which is in charge of reviewing these cases and deciding whether the records should remain with or be removed from the public.

In more than 40 of the 100 cases disclosed to The Post, Carpenter and his colleagues determined that information had never been classified or could be fully declassified, the record shows. At least 20 of the remaining cases were still under review, according to the document. But even in the dozens of instances in which the office found classified information outside of government control, the material was rarely the stuff of John le Carré’s spy novels.

First established by executive order in 1978, the ISOO derives its authority to recapture sensitive records from a 2010 federal regulation: “Anyone who becomes aware of organizations or individuals who possess potentially classified national security information outside of government control must contact the Director of ISOO for guidance and assistance.”

But determining if a record found in the public domain is classified — and the level of classification — can be complex and challenging. Executive Order 13526, which provides guidelines for classification, includes brief descriptions that are open to interpretation. It states that records should be classified as “Confidential” if they “reasonably could be expected to cause damage” to U.S. national security. “Secret” could cause “serious damage,” and “Top Secret” could bring “exceptionally grave damage.”

In almost all of the cases reported since 2007, individuals or organizations initiated contact with the ISOO after finding one of these eyebrow-raising phrases written or stamped on a document. Employees of research libraries and archives were the most frequent to report finding these records, often while assembling collections for the public.

In dozens of the reported cases, the National Archives office determined with a phone call, email or quick visit that the records were not classified or could be declassified by the Archives or another agency.

Consider the Organ Historical Society’s discovery of operational manuals for tank turrets marked “Restricted” within a collection of documents from M.P. Möller, a pipe organ company. (The organ company contributed to the allied effort in World War II.)

James Wallmann, a pro bono lawyer for the historical society, told The Post that he took a “deep breath” before emailing a description of the records to the ISOO, whose contact information he found online.

Carpenter emailed Wallmann back within days, informing him that the records were no longer classified and could remain in the historical society’s archives. Generally, according to Carpenter, operational military records from the Vietnam War and earlier can be declassified because they pose no risk to U.S. national security.

“We’re just happy that this one had a happy ending,” Wallmann said.

Carpenter, who has responded to the bulk of the inquiries about classified records since 2007, reviewed and declassified the World Bank document about Iran within hours. In less than a month, one of Carpenter’s colleagues determined that the hypersonic aircraft records at the Smithsonian Air and Space museum could be declassified.

The oldest records reported to the ISOO for review were three boxes of World War I records about chemical weapons found in the chemistry department at Ohio State University. In that case, the office determined that the records from the early 1900s were not classified; they are still available to the public.

Though it determined most of the records that it has reviewed to be of no threat, the office identified some cases in which classified records in the public domain could threaten U.S. national security. Those records — some of which described intelligence sources and methods or nuclear weapons — were taken into “temporary custody,” where they are likely to remain.

Some of the repossessed records belonged to high-level officials including former Cabinet members, ambassadors and members of the House and Senate. Among the most sensitive documents flagged for review were those of Edmund S. Muskie, a Democratic U.S. senator from Maine, who also served as secretary of state under President Jimmy Carter.

Those records, which Muskie donated to his alma mater, Bates College, contained information about U.S. intelligence sources related to the Iran-contra scandal as well as offensive and defensive U.S. nuclear war plans. The classification office determined that 98 records in Muskie’s files were improperly taken from government control. But after a review, just “a few” of those records must remain classified, according to the director of the Edmund S. Muskie Archives and Special Collections Library at Bates. (A selection of declassified Muskie records can be viewed on the National Archives’s website.)

The document disclosed to The Post makes no mention of any review by the office of the records retained by Trump at Mar-a-Lago, nor does it include the classified records discovered in the possession of President Joe Biden and former vice president Mike Pence. Because those highly publicized cases included recent presidential-level records, the National Archives chose to refer them to the Justice Department, Carpenter explained.

Though Trump was criminally charged with retaining and failing to deliver national defense documents, a federal judge in Florida dismissed the case, ruling that the appointment of the special counsel was unconstitutional. A different special counsel declined to bring charges against Biden. The Justice Department also declined to charge Pence.

Some have criticized the directive that any American “must” report classified information outside of government control. In one case that led to a firestorm of debate, the National Security Agency (NSA) ordered a library to remove records after the 1982 publication of an award-winning book and exposé of the agency, “The Puzzle Palace” by James Bamford.

Bamford used NSA newsletters and correspondence of former agency directors held by the George C. Marshall Research Library on the campus of the Virginia Military Institute in Lexington, Virginia, to write his book. Even after the library complied with the government’s order, Bamford stood by his decision to publish the NSA “secrets” he found there. In a recent interview with The Post, Bamford said the government’s attempt to control records in the public domain was “outrageous.”

“I published all that stuff and what do you know, the world didn’t come to the end,” he said. “The NSA didn’t get attacked by Russia. Nobody was killed.”

Bamford said he disagrees with the current government instruction that “anyone” who finds a potentially classified document outside of government control “must” contact the National Archives for review. He said it was “sort of Orwellian” for the government “to look over everyone’s shoulder. What are they reading? Is that classified or not?”

Carpenter, speaking generally, disagreed and defended the mission and methods of his office.

“There is a process for the declassification of information in the U.S. government and I follow that process,” he said. “Archivists and individuals who recognize that damage to national security can occur when improper release of classified information happens will follow that process.”

Carpenter acknowledged, however, that the process is open to interpretation and is, at times, tricky. Determining what is of no threat or what should be classified as “Confidential,” “Secret” or “Top Secret” has been a “perennially challenging issue since the dawn of the classification program.”

Each government agency with classification authority has its own guide for how to classify documents, but those are rarely made public. This creates murky circumstances where agencies tend to err on the side of secrecy, advocates for government transparency argue. William Bosanko, the U.S. deputy archivist, once said that officials tasked with determining secrecy joke that “you could easily classify the ham sandwich.”

The National Archives’s own guidance on what to do if you find classified records in your uncle’s attic or university’s archives seems to concede that classified information in the public domain is often harmless: People who discover records marked “Confidential” and “Secret” - but not “Top Secret” - can mail them to the National Archives using the U.S. Postal Service.

Just don’t mail any ham sandwiches.

Ellen Nakashima and Aaron Schaffer contributed to this report.