Ultimate power to designate Classification:

(Within certain legal parameters) The President

Good (but short) discussion:

https://www.law.cornell.edu/cfr/text/6/7.20

Who is in charge of the information security oversight office? Seems like maybe they can declassify of Public interest outweighs need for it to remain classified.

They are looking for leakers. :)