De-orbiting isn't too bad of an option really. While a really large satellite would still have some pieces intact, it by and large will not be completely intact. Furthermore, the most sensitive things on a spacecraft tend to be the computers, antennas, and cameras. Of those, the only remotely likely to survive re-entry is the cameras, most likely only the mirrors from said camera.
Furthermore, most LEO satellites are reasonably well designed to break up. Unprotected aluminum doesn't survive reentry very well, and it is what most LEO satellites are composed of. Practically speaking, one has to design purposely to have anything survive re-entry, otherwise all you get is chunks.
The destruction procedure for classified material for the US in general is explained in NISPOM, which states:
5-705. Methods of Destruction. Classified material may be destroyed by burning, shredding, pulping, melting, mutilation, chemical
decomposition, or pulverizing (for example, hammer mills, choppers,
and hybridized disintegration equipment). Pulpers, pulverizers, or
shredders may be used only for the destruction of paper products. High
wet strength paper, paper mylar, durable medium paper substitute, or
similar water repellent papers are not sufficiently destroyed by
pulping; other methods such as disintegration, shredding, or burning
shall be used to destroy these types of papers. Residue shall be
inspected during each destruction to ensure that classified
information cannot be reconstructed. Crosscut shredders currently in
use capable of maintaining a shred size not exceeding 1/32 inch in
width (with a 1/64 inch tolerance by 1/2 inch in length) may continue
to be used. However, any crosscut shredders requiring replacement of
the unit and/or rebuilding of the shredder blades assembly must be
replaced by a crosscut shredder on the latest NSA Evaluated Products
List of High Security Crosscut Shredders. The list may be obtained
from the CSA. Classified material in microform; that is, microfilm,
microfiche, or similar high data density material; may be destroyed by
burning or chemical decomposition, or other methods as approved by the
While each classified program can add in additional standards, I believe that uncontrolled re-entry of most spacecraft falls within this destruction principal.
Furthermore, the re-entry for any satellite is usually many years after launch, at which point in time the classification parameters aren't as important (Most stuff of this nature can be declassified after 25 years). Of course, the mentioned 390 km orbit doesn't quite fit in to the 25 year range, but I would expect that the satellite's orbit will be raised if possible.
Finally, the re-entry of a satellite can be controlled, it just takes a bit more work and a lot of planning. MIR was successfully deorbited, and I suspect any satellite can be deorbited in a controlled fashion.