Source: https://www.everycrsreport.com/files/20030228_RL31762_21d0e9e001952a9f3b2322debbef34132ad33ff7.html
Timestamp: 2019-04-21 20:13:18+00:00

Document:
The Critical Infrastructure Information Act of 2002 ("CIIA"), to be codified at 6 U.S.C. §§131 - 134, was passed on November 25, 2002 as subtitle B of Title II of the Homeland Security Act (P.L. 107-296, 116 Stat. 2135, sections 211 - 215), and regulates the use and disclosure of information submitted to the Department of Homeland Security (DHS) about vulnerabilities and threats to critical infrastructure. This report examines the CIIA. For further information, see CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation, by [author name scrubbed]. This report will be updated as warranted.
The President's National Strategy for Homeland Security, which proposed the creation of a new Department of Homeland Security (DHS), established as one of the Department's core missions the protection of America's infrastructure.1 The proposal had the new Department responsible for comprehensively evaluating the vulnerabilities of America's critical infrastructure, including food and water systems, agriculture, health systems and emergency services, information and telecommunications, banking and finance, energy (electrical, nuclear, gas and oil, dams), transportation (air, road, rail, ports, waterways), the chemical and defense industries, postal and shipping entities, and national monuments and icons. Working closely with state and local officials, other federal agencies, and the private sector, the proposal had the Department helping to ensure that proper steps are taken to protect high-risk targets. Information sharing between public and private entities about threats and vulnerabilities to critical infrastructures was a central component of the President's proposal which was subsequently introduced by request as H.R. 5005 (Armey), the Homeland Security Act of 2002. Section 204 of H.R. 5005exempted infrastructure vulnerabilities information from disclosure under the Freedom of Information Act (5 U.S.C. § 552), and stated that "Information provided voluntarily by non-federal entities or individuals that relates to infrastructure vulnerabilities or other vulnerabilities to terrorism and is or has been in the possession of the Department [of Homeland Security] shall not be subject to section 552 of title 5, United States Code."
A debate ensued regarding the exemption of critical infrastructure information from the Freedom of Information Act (FOIA). The debate essentially focused on the reconciliation of two public goods that come into conflict, on the one hand, the need to encourage voluntary information sharing, and on the other, the demands of open government. A new FOIA exemption for critical infrastructure information was opposed by civil libertarians and advocates of open government on several grounds. They testified that a new exemption would jeopardize the ability to obtain information about abusive government practices, would cast a shroud of secrecy over one of the Department of Homeland Security's critical functions, and was unnecessary because FOIA exemption 4 protects private companies against disclosures of trade secrets and confidential business information, and can be extended to critical infrastructure material that properly should be withheld from disclosure.
Proponents of a new FOIA exemption for critical infrastructure information testified that private industry would be unwilling to voluntarily share critical infrastructure information with the federal government without assurances that its confidential business information would not be released by the government. Companies worried that if information sharing with the government becomes a reality, FOIA requests for information could prove embarrassing and costly. In addition, companies expressed concern that agency decisions about disclosure of business confidential data were fraught with ambiguity and discretion. There were also concerns expressed by private industry about antitrust and civil liability issues with respect to the willingness of some of those entities to provide information voluntarily to the federal government. Specifically, in congressional hearings industry representatives expressed concern about disclosure under the Freedom of Information Act; third-party liability (e.g., sharing suspected problems about a piece of equipment before its being thoroughly tested and verified); the lack of a defined antitrust exemption for appropriate information sharing concerning infrastructure vulnerabilities; possible disclosure of information under state open records laws; and disclosure of sensitive corporate information to competitors.
When H.R. 5005 was reported out of the House Select Committee on Homeland Security after hearings on the legislation, the Administration's FOIA exemption was modified, and new limitations on the use and disclosure of critical infrastructure information were included in a separate subtitle (Title VII, Subtitle C, sections 721 - 724). The Select Committee on Homeland Security significantly expanded upon the President's proposal for an exemption from FOIA for information on infrastructure vulnerabilities. Section 204 of H.R. 5005 was no longer limited to the exemption from disclosure under FOIA of information on "infrastructure vulnerabilities or other vulnerabilities to terrorism." Its protections now extended to a broad and newly defined category of information – critical infrastructure information voluntarily submitted to the DHS with an express statement of expectation of protection from disclosure. The reported bill included some of the protections sought by industry representatives: it provided exemption from disclosure under FOIA; it provided that covered information would not be used directly in civil actions; it provided that critical infrastructure information would not be used or disclosed by any Federal employee (except to further criminal investigation or prosecution or to disclose the information to Congress or the General Accounting Office); it established that critical infrastructure information provided to a State or local government by DHS may not be made available pursuant to any State or local law requiring disclosure of information or records; and it provided that communications of critical infrastructure information would not be subject to the requirements of the Federal Advisory Committee Act (FACA).
The Senate Governmental Affairs Committee, too, voted to add a FOIA exemption to its bill, S. 2452 (Lieberman, section 198) establishing a Department of Homeland Security. S. 2452, the National Homeland Security and Combating Terrorism Act of 2002, agreed to by the Senate Governmental Affairs Committee on July 25, 2002, exempted a "record" pertaining to the vulnerability of and threats to critical infrastructure (as defined in the USA PATRIOT Act), furnished voluntarily to the Department of Homeland Security, from being made available under FOIA. A record was protected from disclosure if the provider would not customarily make the record available to the public. It also required the provider to certify, in a manner specified by the Department of Homeland Security, that the record is confidential and not customarily made available to the public. Under S. 2452 a record is submitted voluntarily if it was submitted to the Department of Homeland Security "in the absence of authority of the Department requiring that record to be submitted," and it is not submitted or used to satisfy any legal requirement or obligation or to obtain any grant, permit, benefit, or other approval from the federal government. Agencies with which the Department of Homeland Security shares protected records were to be bound by the FOIA exemption. FOIA requests for protected information were to be referred back to the Department of Homeland Security. S. 2452 allowed an agency which had received independently of the Department a record "similar or identical" to that received by the Department, to disclose the record under FOIA. The Senate bill did not preempt state or local disclosure laws if the state or local authority received the information independent of the Department of Homeland Security, nor did it contain civil liability immunity, or criminal penalties. Finally, the Senate bill required the Comptroller General to report to Congress on the implementation and use of its protections.
On November 25, 2002, President Bush signed H.R. 5005, the Homeland Security Act of 2002, P.L. 107-296. The "Critical Infrastructure Information Act of 2002," ("CIIA"), to be codified at 6 U.S.C. § 131 et seq., is found in Subtitle B of Title II of the Homeland Security Act (sections 211 - 215). CIIA consists of a group of provisions that address the circumstances under which the Department of Homeland Security may obtain, use, and disclose critical infrastructure information as part of a critical infrastructure protection program. CIIA establishes several limitations on the disclosure of critical infrastructure information voluntarily submitted to DHS. The CIIA was enacted, in part, to respond to the need for the federal government and owners and operators of the nation's critical infrastructures to share information on vulnerabilities and threats, and to promote information sharing between the private and public sectors in order to protect critical assets. The Homeland Security Act of 2002 adopted sections 721- 725 of H.R. 5005 on critical infrastructure information verbatim. Congress' enactment of the Critical Infrastructure Information Act of 2002 was and continues to be somewhat controversial. The narrower Senate version, S. 2452, was not considered by the full Senate, or the House of Representatives, when Congress enacted the Homeland Security Act on an accelerated schedule. The Homeland Security Act was approved by the House and the Senate expeditiously, with relatively little focus on its FOIA-related provisions. Following is a summary of the new law.
The CIIA includes 4 key definitions: covered federal agency; critical infrastructure information; voluntary; and express statement. Another key definition, critical infrastructure, is defined elsewhere in the Homeland Security Act.
The most important definition in CIIA is that of "critical infrastructure information" because the CIIA protections are triggered only for such information. Critical infrastructures are defined elsewhere in the Homeland Security Act. Section 2(4) of the Homeland Security Act states that critical infrastructure "has the meaning given that term in section 1016(e) of Public Law 107-56 (42 U.S.C. 5195(e))."2 Section 1016(e) of the USA PATRIOT Act defines critical infrastructure as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of these matters."3 This definition is viewed as a broad catch-all provision likely to cover a wide array of activities.
Another important definition is of voluntary. Section 214 of the CIIA protects critical infrastructure information voluntarily submitted to the DHS when accompanied by an express statement of expectation of protection from disclosure. The term "voluntary" with respect to the submittal of critical infrastructure information to a covered federal agency means "the submittal thereof in the absence of such agency's exercise of legal authority to compel access or submission of such information and may be accomplished by a single entity or an Information Sharing and Analysis Organization on behalf of itself or its members"8 The CIIA defines "Information Sharing and Analysis Organizations" as "any formal or informal entity or collaboration created or employed by public or private sector organizations, for purposes of– (A) gathering and analyzing critical infrastructure information . . . (B) communicating or disclosing critical infrastructure information . . . and (C) voluntarily disseminating critical infrastructure information . . . ."9 In addition, the definition of voluntary includes a critical exclusion. A voluntary submission to DHS does not include filings that were also made with the Securities and Exchange Commission or Federal banking regulators, statements made pursuant to the sale of securities, or information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory proceedings. Consequently, information falling within the exclusion would not be protected from disclosure.
Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructures and protected systems, analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement . . . .
According to the Department of Justice, the agency responsible for administering the FOIA, section 214(a)(1) will operate as a new "Exemption 3 statute"14 under FOIA for "critical infrastructure" information that is obtained by the Department of Homeland Security.15 This section eliminates the presumptive right of access by any person—corporate or individual, regardless of nationality—to existing, unpublished DHS records on critical infrastructure information. Unlike FOIA, which specifies nine categories of information that may be exempted from disclosure, and permits rather than requires the withholding of requested information section 214(a)(1)(A) leaves no discretion and requires that critical infrastructure information voluntarily submitted to the DHS not be disclosed under FOIA.
Similarly, the CIIA protects from disclosure critical infrastructure information "not customarily in the public domain" voluntarily submitted to DHS. The Report of the House Select Committee on Homeland Security accompanying H.R. 5005 states that "The Select Committee intends that subtitle C only protect private, security-related information that is voluntarily shared with the government in order to assist in increasing homeland security. This subtitle does not protect information required under any health, safety, or environmental law" (emphasis added).21 It should be noted that section 214(d) provides that "the voluntary submittal to the Government of information or records that are protected from disclosure by the Act shall not be construed as compliance with any legal requirement to submit such information to a federal agency."
Section 214(a)(1)(B) of the CIIA provides that covered information will not be subject to agency rules or judicial doctrine regarding ex-parte communications. The Administrative Procedure Act (APA) establishes the rules for agencies to adhere to with respect to ex parte communications in agency proceedings.22 The APA defines an "ex parte communication" as an "oral or written communication not on the public record with respect to which reasonable prior notice to all parties is not given . . ."23 Section 556(e) of the Administrative Procedure Act incorporates the principle that formal agency adjudications are to be decided solely on the basis of record evidence. It provides that "[t]he transcript of testimony and exhibits, together with all papers and requests filed in the proceeding, constitutes the exclusive record for decision."24 The reason for this "exclusiveness of record" principle is to provide fairness to the parties in order to ensure meaningfully participation. Challenges to the "exclusiveness of record" occur when there are ex parte contacts – communications from an interested party to a decision making official that take place outside the hearing and off the record. Ex parte contact issues arise more frequently in agency adjudications than in judicial proceedings because the latter are almost always made on the record, after an adversary proceeding; however, on the record proceedings are a very small part of the docket in most agency proceedings.
Section 214(a)(1)(C) of the CIIA creates an evidentiary exclusion for protected information. Section 214(a)(1)(C) prohibits the direct use, without the written consent of the information submitter, of protected critical infrastructure information by such agency (DHS), any other Federal, State, or local authority, or third party in any civil action arising under federal or state law if submitted in good faith. This protection is limited to critical infrastructure information that is voluntarily submitted to a covered federal agency [DHS] for use by that agency regarding the security of critical infrastructure and protected systems . . . or other informational purpose, when accompanied by an express statement. This evidentiary limitation does not apply to regulatory or enforcement actions by Federal, State, or local governmental entities, nor to civil actions when the information is obtained independently of the DHS. The courts may also limit application of the evidentiary exclusion in cases of bad faith. Public interest groups are concerned that this provision is very broad, and would shield owners and operators from liability under antitrust, tort, tax, civil rights, environmental, labor, consumer protection, and health and safety laws. However, a Federal entity may separately obtain the critical infrastructure information submitted to the DHS for its critical infrastructure protection program through the use of independent legal authorities, and use such information in any action.29 The CIIA does not limit the ability of governments, entities, or third parties to independently obtain critical infrastructure information or to use critical infrastructure information for limited purposes.
Section § 214(a)(1)(E) of the CIIA specifically mandates that the critical infrastructure information now exempt under the FOIA "shall not, if provided to a State or local government . . . be made available pursuant to any State or local law requiring disclosure of information or records." This statute thus explicitly provides for the "preemption" of state freedom of information laws by federal law.34 It also prohibits State or local governments from disclosing protected critical infrastructure information provided to them by DHS without written consent of the entity submitting the information; prohibits its use for other than critical infrastructure protection, or the furtherance of a criminal investigation or prosecution.
Prior to passage of the critical infrastructure information provisions, meetings of "Information Sharing and Analysis Organizations" (ISAO) could potentially be subject to FACA's requirements. However, the CIIA expressly authorizes ISAOs to voluntarily submit information to the DHS on behalf of itself or its members with the result being that such information will be protected in material respects under the Act from uses and disclosures unrelated to critical infrastructure protection.38 The CIIA defines "Information Sharing and Analysis Organizations" as "any formal or informal entity or collaboration created or employed by public or private sector organizations, for purposes of– (A) gathering and analyzing critical infrastructure information . . . (B) communicating or disclosing critical infrastructure information . . . and (C) voluntarily disseminating critical infrastructure information . . . ."39 For a discussion of information sharing and analysis centers formed by several sectors (e.g., banking and finance, telecommunications, electricity, water, etc.), see CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation, by [author name scrubbed].
Section 214(e) requires the Secretary of DHS to establish procedures for the receipt, care, and storage of critical infrastructure information not later than 90 days after enactment. The Homeland Security Act took effect 60 days after passage; the legislation was enacted on November 25, 2003. In other words, Secretary Ridge is to establish those procedures no later that February 23, 2003. The Secretary of Homeland Security is to consult with the National Security Council and the Office of Science and Technology Policy to establish uniform procedures. In addition, it appears that these DHS procedures will not be subject to agency notice and comment rulemaking requirements for agency regulations under the APA because the CIIA requires the promulgation of agency procedures, not regulations. Moreover, in other sections of the Homeland Security Act, Congress clearly directed that regulations be promulgated. Presumably it would have done the same here if that is what it sought.
Judicial review of agencies' interpretations of statutes entails a significant element of deference, as the Supreme Court emphasized in Chevron U.S.A., Inc. v NRDC.40 In Chevron, the Court prescribed two inquiries that a reviewing court should conduct when reviewing an agency's construction of a statute. The first was whether "Congress has directly addressed the precise question at issue." If so, the court would have to "give effect to the unambiguously expressed intent of Congress." However, if the statute were to prove "silent or ambiguous with respect to the specific issue," the remaining question was whether the agency's answer was "permissible" – or, as the Court phrased it, a "reasonable interpretation." Chevron, in effect, creates a presumption applicable to regulatory schemes in which Congress has delegated power to an agency: to whatever extent the statute remains ambiguous, the reviewing court should presume that Congress has delegated to the agency the task of filling in the gap in some reasonable way.
Section 214(f) contains a provision that makes it a criminal offense for any federal employee to "knowingly . . . disclose . . . any critical infrastructure information [that is] protected from disclosure" under it, without proper legal authorization.
"(f) PENALTIES- Whoever, being an officer or employee of the United States or of any department or agency thereof, knowingly publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law, any critical infrastructure information protected from disclosure by this subtitle coming to him in the course of this employment or official duties or by reason of any examination or investigation made by, or return, report, or record made to or filed with, such department or agency or officer or employee thereof, shall be fined under title 18 of the United States Code, imprisoned not more than 1 year, or both, and shall be removed from office or employment."
In light of the fact that the underlying purpose of the CIIA is to promote voluntary information sharing on threats and vulnerabilities to critical infrastructure through the establishment of a statutory scheme designed to protect against unauthorized disclosures of confidential business information, it is arguable that the criminal penalties for unauthorized disclosure of protected information were intended to apply to Congress. However, if Congress had thought it was including itself, then disclosure from "an officer or employee of the United States" to Congress might arguably not be a "disclosure" at all, just information shared between one officer of the United States and another officer of the United States, and one could argue that the exception permitting disclosure to Congress wouldn't have been necessary.
Another consideration that supports the conclusion that Congress is not subject to the criminal penalty provision is the fact that one of the penalties is "removal from employment." This argues against the provision applying to Congress, since a Member of Congress cannot be removed by statutory fiat, but only by the Constitutional process set out in Article I, Section 5 of the Constitution, that is, expulsion. Even though the plain meaning of "an officer or employee of the United States" could reasonably be interpreted to include Members of Congress, the Supreme Court had interpreted 18 U.S.C. 1001, prohibiting false statements in any matter before any agency or department of the United States, as not applying to Congress or the courts after more than 40 years of applying it to statements before some congressional entities.55 Congress had to amend it to expressly include Congress.56 In light of the Hubbard precedent it would appear unlikely that the term "officer or employee of the United States" would be construed by a court as applying to Congress without more definitions or legislative history.
Section 214(g) of the CIIA authorizes the federal government to provide advisories, alerts, and warnings to relevant companies, targeted sectors, other government entities, or the general public regarding potential threats to critical infrastructure. In issuing a warning, the federal government must protect from disclosure the source of any voluntarily submitted critical infrastructure information that forms the basis for the warning, or information that is proprietary, business sensitive, or otherwise not appropriately in the public domain.
Section 215 of CIIA expressly provides that a private right of action for enforcement of the Act is not created. Many federal statutes contain a private right of action, usually express but occasionally implied, which authorizes suits against the United States.
A Legislative Proposal to Create a New Cabinet Department of Homeland Security, H. Doc. 107-227 (June 18, 2002).
P.L. 107-296, § 2(4), 116 Stat. 2140.
P.L. 107-56, § 1016(e), 42 U.S.C. 5195(e).
See the "Issues and Concerns" section of CRS Report RL31547, Critical Infrastructure Information Disclosure and Homeland Security, by [author name scrubbed] and [author name scrubbed].
P.L. 107-296, 116 Stat. 2135, § 212(2); See also id. at § 214(c) (adding that the provision does not apply to "independently obtained information").
148 Cong. Rec. H5845 (July 26, 2002).
P.L. 107-296, 116 Stat. 2135, § 214(a)(1)(A) (to be codified at 6 U.S.C. § 133(a)(1)(A)).
Under exemption 3 of the FOIA, information protected from disclosure under other statutes is also exempt from public disclosure provided that such statute requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or establishes particular criteria for withholding or refers to particular types of matters to be withheld. Unlike other FOIA exemptions, if the information requested under FOIA meets the withholding criteria of exemption 3, the information must be withheld. See 5 U.S.C. § 552(b)(3).
Department of Justice, "Homeland Security Law Contains New Exemption 3 Statute," FOIA Post (2003).
975 F.2d 871, 879-80 (D.C. Cir. 1992)(en banc)("Critical Mass II"), cert. denied, 113 S. Ct. 1579 (1993).
Department of Justice, "OIP Guidance: The Critical Mass Distinction Under Exemption 4," FOIA Update, Vol. XIV, No. 2, at 3-5.
Exec. Order No. 12,600, 3 C.F.R. 235, reprinted in 5 U.S.C. § 552 note.
H. Rep. No. 107-609, Homeland Security Act of 2002, p. 116.
5 U.S.C. § 551 et seq.
For an example of a statute which modifies the APA rules with respect to ex parte communications, see 49 U.S. C. 11324.
Subsection § 214(c) provides: "(c) INDEPENDENTLY OBTAINED INFORMATION- Nothing in this section shall be construed to limit or otherwise affect the ability of a State, local, or Federal Government entity, agency, or authority, or any third party, under applicable law, to obtain critical infrastructure information in a manner not covered by subsection (a), including any information lawfully and properly disclosed generally or broadly to the public and to use such information in any manner permitted by law.
The White House, Statement by the President on H.R. 5005, the Homeland Security Act of 2002 (Nov. 25, 2002).
See 5 U.S.C. § 552a(b)(9-10)("(9) to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (10) to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office;").
See CRS Report RL31730, Privacy: Total Information Awareness Programs and Related Information Access, Collection, and Protection Laws, by [author name scrubbed].
See also Freedom of Information Act Guide & Privacy Act Overview (May 2002), at 563-64 (discussing operation of "preemption doctrine" in FOIA context).
See Fed. Evid. Rule 501.
5 U.S.C. App. 2, § 3(2).
18 U.S.C. § 1905 (Whoever, being an officer or employee of the United States or of any department or agency thereof, any person acting on behalf of the Office of Federal Housing Enterprise Oversight, or agent of the Department of Justice as defined in the Antitrust Civil Process Act (15 U.S.C. 1311-1314), publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; or permits any income return or copy thereof or any book containing any abstract or particulars thereof to be seen or examined by any person except as provided by law; shall be fined under this title, or imprisoned not more than one year, or both; and shall be removed from office or employment.").
Codified, as amended, at 5 U.S.C. § 1201 et seq.
5 U.S.C. § 2302. See CRS Report 97-787, Whistleblower Protections for Federal Employees, (May 18, 1998) by [author name scrubbed]; and CRS Video Tape MM70034, Proposed Department of Homeland Security: Freedom of Information Act Exemptions, Whistleblower Protection Act, and Information Sharing by [author name scrubbed], Paige Whitaker, and Elizabeth Bazan. Online Video. (September 25, 2002).
5 U.S.C. § 2302(a)(2)(B). Legislative branch employees would not fall within this definition.
5 U.S.C. § 2302(b)(8)(B)(emphasis added).
P.L. 107-296, § 883. For information on the DHS Inspector General's reporting requirements to Congress, see CRS Report RS21251, Analysis of President's Proposal Concerning the Office of Inspector General for the Proposed Department of Homeland Security. See also Homeland Security Act of 2002 Amendments, Sec. 104 (Inspector General of the Department of Homeland Security) in the H. Conference Rep. on H.J.Res. 2, Consolidated Appropriations Resolution, 2003, 149 Cong. Rec. H846 (Feb. 12, 2003).
H.Rept. 107-609, Part 1 at 116.
Hubbard v. U.S., 514 U.S. 695 (1995).
See CRS Congressional Distribution Memo CD953350, "Impact of United States v. Hubbard, 115 S.Ct. 1754 (1995), on the Prosecution of False Statements Made in Matters of Concern to the Judiciary and the Congress" (July 13, 1995).
See CRS Report RL30843, Speech or Debate Clause Constitutional Immunity: An Overview, by [author name scrubbed] (pdf).

References: § 552
 § 131
 § 214
 § 2
 § 1016
 § 212
 § 214
 § 214
 § 133
 § 552
 § 552
 § 551
 § 214
 § 552
 § 3
 § 1905
 § 1201
 § 2302
 § 2302
 § 2302
 § 883
 v. 
 v.