Automatic declassification is largely governed by executive order in the US. This stems from the fact that the president has more or less unilateral constitutional authority to determine what's classified and what isn't.
More about DOJ automatic declassification, as an example:
Littered with exemptions, determined unilaterally by each federal agency.
Let's look at a few in the context of Crypto AG
> 25X1 – reveal the identity of a confidential human source, a human intelligence source, a relationship with an intelligence or security service of a foreign government or international organization, or a non-human intelligence source; or impair the effectiveness of an intelligence method currently in use, available for use, or under development;
> 25X3 – reveal information that would impair U.S. cryptologic systems or activities;
> 25X6 – reveal information including foreign government information, that would cause serious harm to relations between the U.S. and a foreign government, or to ongoing diplomatic activities of the U.S;
> 25X8 – reveal information that would seriously impair current national security emergency preparedness plans or reveal current vulnerabilities of systems, installations, or infrastructures relating to the national security;
This doesn't require a court or tribunal, it just requires the passing rationale of a random pencil pusher in any agency to stonewall the archivist and anyone else.
But going back to my point, its also easy for it to be true with 70 year old operations like Crypto AG existing, being just discontinued in 2018 and sold to a now screwed entreprenuer
While the geopolitical ramifications continue for a long time more, with this Swiss report not nearly being the end of it, let alone whatever hardware or software they sold.
More about DOJ automatic declassification, as an example:
https://www.justice.gov/archives/open/declassification/decla...