Around 1999, I wrote a paper about information leakage from blinking LEDs on devices (one DES link encryption box, used by banks, for example, was sending out plaintext on the LEDs).
I was working for a defense contractor at the time on a classified project, and so, following procedures, we submitted the paper to NSA for approval to publish.
It took a year and a half to approve. [1]
Eventually NSA wrote back and said, "No problem! Go ahead and publish." I kind of wonder what they spent all that time doing.
[1] Actually, it didn't quite happen that way. Our paper was approved for publication very quickly, in only a few weeks; we submitted it to the USENIX Security Symposium, where it was immediately accepted. Later, NSA called us back, and in a panic, demanded we withdraw the paper from the conference. I had to apologize to the conference committee; it was terribly embarrassing, and the delay in publishing was two years.