It's a common thing, but is also a great example of over classification which is supposed to be avoided (for legal and other reasons, but a primary motivator of

It's a common thing, but is also a great example of over classification which is supposed to be avoided (for legal and other reasons, but a primary motivator of of over classification is just laziness, failure to evaluate what is being produced). There have been efforts to properly qualify software as unclassified (maybe FOUO, or now CUI) and only data as classified (secret or above), but then you have a large contingent of classifiers who still think security through obscurity works. But it's being worked on, maybe one day more will be open source.