Leading up to the passage of the Homeland Security Act of 2002 ( P.L. 107-296 ), a debate ensued regarding the exemption of critical infrastructure information from the Freedom of Information Act, 5 U.S.C. § 552. Both the House and Senate versions of the Homeland Security Act ( H.R. 5005 and S. 2452 , respectively) contained language exempting such information, but the two versions were significantly different. Final passage of the Act included the House language (sections 211 - 215 of P.L. 107-296 ). This report discusses the differences in language and some of the arguments and concerns expressed by both supporters and critics of the exemption. Certain socio-economic activities are vital to the day-to-day functioning and security of the country; for example, transportation of goods and people, communications, banking and finance, and the supply of electricity and water. These activities and services have been referred to as components of the nation's critical infrastructure. Domestic security and our ability to monitor, deter, and respond to outside hostile acts also depend on some of these activities as well as other more specialized activities like intelligence gathering, law enforcement, and military forces. Serious disruption in these activities and capabilities could have a major impact on the country's well-being. In July 1996, President Clinton established the President's Commission on Critical Infrastructure Protection (PCCIP). The Commission was tasked with assessing the vulnerabilities of the country's critical infrastructures and proposing a strategy for protecting them. In its final 1997 report, the Commission stated that the " ... two-way sharing [of] information is indispensable to infrastructure assurance," and that "increasing the sharing of strategic information within each infrastructure, across different sectors, and between sectors and the government will greatly assist efforts of owners and operators to identify their vulnerabilities and acquire tools needed for protection." According to the Commission, the exchange of information is also necessary to develop an analytic capability to examine information about incidents, vulnerabilities, and other intelligence information to determine whether events are related and can be used possibly to recognize or predict an attack. The Commission also noted that there is a reluctance on the part of the private sector and the government to share information related to vulnerabilities or incidents needed to plan for and effect adequate protections. The private sector is reluctant to submit information to the government related to vulnerabilities or incidents that might damage its reputation, weaken its competitive position, lead to costly investigations, be used inappropriately, or expose it to liability as a result of disclosure by the government of confidential business information. The government is reluctant to disclose threat information that might compromise intelligence activities or investigations. The first objective of the Commission's recommended Strategy for Action was to promote a partnership between government and infrastructure owners and operators that would increase the sharing of information relating to infrastructure threats, vulnerabilities, and interdependencies. The Commission proposed developing an Information Sharing and Analysis Center (ISAC) that would consist of government and private sector representatives working together to receive information from all sources, analyze it, draw conclusions about vulnerabilities or incidents within the infrastructures, and inform government and private sector users. It also recognized that, in order to facilitate the exchange of information, the private sector would need assurances that its confidential information would be protected. The Commission noted that this might require that a legal vehicle be established within the critical infrastructure information sharing mechanism that would protect confidential information, and examined the ramifications of different approaches and strategies related to the federal government's protection of private sector information. It briefly discussed some pros and cons associated with the creation of a FOIA exemption 3 statute for critical infrastructure information. Under exemption 3 of the Freedom of Information Act (FOIA), 5 U.S.C. 552, information protected from disclosure under other statutes is also exempt from public disclosure under FOIA. In response to the Commission's report, President Clinton released Presidential Decision Directive No. 63 (PDD-63). The Directive instructed the National Coordinator for Security, Infrastructure Protection and Counter-Terrorism and other government officials to consult with private sector owners and operators of critical infrastructures, and encourage the creation of a private sector information analysis and sharing center as envisaged by the PCCIP. Although the Directive did not address FOIA explicitly, it did direct the National Coordinator to undertake studies to examine: liability issues arising from participation by private sector companies in the information sharing process; existing legislative impediments to information sharing with an eye toward removing those impediments; and the improved protection, including secure dissemination of industry trade secrets, of other confidential business data, law enforcement information and evidentiary material, classified national security information, unclassified material disclosing vulnerabilities of privately owned infrastructures and apparently innocuous information that, in the aggregate, would be imprudent to disclose. The Clinton Administration, however, never adopted a formal position on the desirability of an exemption to FOIA or the necessity for any additional confidentiality protections. In connection with the implementation of PDD-63, a number of industrial sectors which own and/or operate critical infrastructures formed ISACs, and entered into arrangements with the federal government to share information. However, the General Accounting Office reported in April 2001, that very little or no formalized flow of information has occurred from the private sector to the federal government. According to the Director of the National Infrastructure Protection Center, the organization with which industry is to share information, one of the reasons for this is the uncertainty regarding FOIA exemptions. Similarly, the Partnership for Critical Infrastructure Security, a cross-industry group formed to facilitate communication among industry sectors, has stated that it is not clear that any of the existing FOIA exemptions provide the certainty of protection that many companies require before disclosing threat and vulnerability information to the government. In the 106 th Congress, both H.R. 4246 (Davis/Moran) and S. 3188 (Kyl) included an exemption from FOIA for cyber security information voluntarily provided to the federal government, and prohibited the information from being used, by either the federal government or a third party, in any civil action. Neither bill was reported out of committee. During the 107 th Congress, two bills were introduced with many of the same provisions: H.R. 2435 (Davis) and S. 1456 (Bennett/Kyl) would have exempted information voluntarily submitted to the federal government in connection with critical infrastructure protection from FOIA, and provided protection against civil action. Both bills remained in committee. In an effort to reconcile the two bills, S. 1456 was modified, taking some of the House language. The rewritten bill, however, was never introduced. The Bush Administration offered qualified support for both bills. In President Bush's initial proposal to establish a new Department of Homeland Security, part of which proposed establishing a critical infrastructure protection function, a FOIA exemption was included for information held by the Department. Subsequently, both the House and Senate bills establishing the new Department ( H.R. 5005 and S. 2452 , respectively) included more detailed language exempting critical infrastructure information from FOIA. The House language also offered more extensive protections: see " Legislative Responses ," below. In 1966, during floor debate on passage of the Freedom of Information Act (FOIA), Representative Rumsfeld quoted James Madison when he said, Knowledge will forever govern ignorance. And a people who mean to be their own governors, must arm themselves with the power knowledge gives. A popular government without popular information or the means of acquiring it, is but a prologue to a farce or a tragedy, or perhaps both. The sentiments expressed by Madison in 1822 are prescient today. The populace desires knowledge about the activities of its government in order to ensure accountability and oversight. The government desires information from owners and operators of critical infrastructures in order to protect persons and assets in the war on terrorism. The terrorist attacks of September 11 have prompted a reevaluation of how to balance public access to information with the need for safety and security. The federal government, since its beginnings, has delegated to agency heads the basic authority to control the papers and documents of their departments. Through the Housekeeping Statute of 1789, federal agencies have kept control of the disclosure of their files. The Administrative Procedure Act (APA) of 1946 had a slight impact upon departmental control of agency information. Instances were documented, however, where both the Housekeeping Statute and the Administrative Procedure Act had been used as excuses for withholding information, and concern mounted that the APA had become a loophole for agency secrecy permitting agency heads to exercise broad, unrestrained powers of a discretionary nature. The Housekeeping Statute was amended to clarify that it does not authorize withholding information from the public or limiting the availability of records to the public. The amendment of the Housekeeping Statute did not produce the results sought by advocates of greater public access to public information. The House Government Information Subcommittee proposed a freedom of information bill that created a right of any person to use the courts to enforce the right of access to federal information. Although the proposal was well received by the press, federal agencies were resistant. The Senate passed S. 1160 in 1965, the House in 1966, and the Freedom of Information Act (FOIA) was signed into law by President Johnson on July 4, 1966. The FOIA was subsequently amended in 1974, 1986, and 1996 for several reasons: ambiguity in the text and legislative history; agency and Department of Justice resistance to broader disclosure; increased oversight by Congress; court interpretations of the statute and its procedural requirements and exemptions; time delays by agencies in responding to requests for access to information and delaying tactics by agencies in litigation; to clarify the scope of the exemptions in response to Supreme Court decisions interpreting the Act's provisions; and to accommodate technological advances related to the methods prescribed for public access. The purpose of the Freedom of Information Act (FOIA) was to ensure by statute citizen access to government information.