The system for classifying government information is outlined by (surprise, surprise) Executive Order 13526, signed by President Obama Dec. 29, 2009.
Executive order, you say? Somehow, it seems the law on how we go about classifying things ought to come from the legislative branch, if for no more reason than to maintain checks and balance. Letting the executive branch make its own rules for what it will withhold from the public smacks a little of conflict of interest. If the government wants to protect itself from embarrassment on a matter, or from scrutiny, and all it has to do to stop it is to say, "No, you can't look at that," then, it is going to say, "No, you can't look at that."
There are laws that have come from the legislative branch that lend to this issue, the Espionage Act of 1917, the Atomic Energy Act of 1954 and the Intelligence Identities Protection Act of 1982, but there is no comprehensive act that covers all aspects. For that, we are left to President Obama's executive order, which replaced a previous executive order governing classifications. In fact, I understand Obama's is but one in a long line of executive orders on the topic.
Why we allow the executive branch to set the law on this, I do not understand. It is the legislative branch that is to suppose to make the laws. And, allowing the executive branch to make its own rules on what it will make public robs much of the power the public has to monitor government.