The President's National Strategy for Homeland Security, which proposed the creation of a new Department of Homeland Security (DHS), established as one of the Department's core missions the protection of America's infrastructure. The proposal had the new Department responsible for comprehensively evaluating the vulnerabilities of America's critical infrastructure, including food and water systems, agriculture, health systems and emergency services, information and telecommunications, banking and finance, energy (electrical, nuclear, gas and oil, dams), transportation (air, road, rail, ports, waterways), the chemical and defense industries, postal and shipping entities, and national monuments and icons. Working closely with state and local officials, other federal agencies, and the private sector, the proposal had the Department helping to ensure that proper steps are taken to protect high-risk targets. Information sharing between public and private entities about threats and vulnerabilities to critical infrastructures was a central component of the President's proposal which was subsequently introduced by request as H.R. 5005 (Armey), the Homeland Security Act of 2002. Section 204 of H.R. 5005 exempted infrastructure vulnerabilities information from disclosure under the Freedom of Information Act (5 U.S.C. Â§ 552), and stated that "Information provided voluntarily by non-federal entities or individuals that relates to infrastructure vulnerabilities or other vulnerabilities to terrorism and is or has been in the possession of the Department [of Homeland Security] shall not be subject to section 552 of title 5, United States Code." A debate ensued regarding the exemption of critical infrastructure information from the Freedom of Information Act (FOIA). The debate essentially focused on the reconciliation of two public goods that come into conflict, on the one hand, the need to encourage voluntary information sharing, and on the other, the demands of open government. A new FOIA exemption for critical infrastructure information was opposed by civil libertarians and advocates of open government on several grounds. They testified that a new exemption would jeopardize the ability to obtain information about abusive government practices, would cast a shroud of secrecy over one of the Department of Homeland Security's critical functions, and was unnecessary because FOIA exemption 4 protects private companies against disclosures of trade secrets and confidential business information, and can be extended to critical infrastructure material that properly should be withheld from disclosure. Proponents of a new FOIA exemption for critical infrastructure information testified that private industry would be unwilling to voluntarily share critical infrastructure information with the federal government without assurances that its confidential business information would not be released by the government. Companies worried that if information sharing with the government becomes a reality, FOIA requests for information could prove embarrassing and costly. In addition, companies expressed concern that agency decisions about disclosure of business confidential data were fraught with ambiguity and discretion. There were also concerns expressed by private industry about antitrust and civil liability issues with respect to the willingness of some of those entities to provide information voluntarily to the federal government. Specifically, in congressional hearings industry representatives expressed concern about disclosure under the Freedom of Information Act; third-party liability (e.g., sharing suspected problems about a piece of equipment before its being thoroughly tested and verified); the lack of a defined antitrust exemption for appropriate information sharing concerning infrastructure vulnerabilities; possible disclosure of information under state open records laws; and disclosure of sensitive corporate information to competitors. When H.R. 5005 was reported out of the House Select Committee on Homeland Security after hearings on the legislation, the Administration's FOIA exemption was modified, and new limitations on the use and disclosure of critical infrastructure information were included in a separate subtitle (Title VII, Subtitle C, sections 721 - 724). The Select Committee on Homeland Security significantly expanded upon the President's proposal for an exemption from FOIA for information on infrastructure vulnerabilities. Section 204 of H.R. 5005 was no longer limited to the exemption from disclosure under FOIA of information on "infrastructure vulnerabilities or other vulnerabilities to terrorism." Its protections now extended to a broad and newly defined category of information â critical infrastructure information voluntarily submitted to the DHS with an express statement of expectation of protection from disclosure. The reported bill included some of the protections sought by industry representatives: it provided exemption from disclosure under FOIA; it provided that covered information would not be used directly in civil actions; it provided that critical infrastructure information would not be used or disclosed by any Federal employee (except to further criminal investigation or prosecution or to disclose the information to Congress or the General Accounting Office); it established that critical infrastructure information provided to a State or local government by DHS may not be made available pursuant to any State or local law requiring disclosure of information or records; and it provided that communications of critical infrastructure information would not be subject to the requirements of the Federal Advisory Committee Act (FACA). The Senate Governmental Affairs Committee, too, voted to add a FOIA exemption to its bill, S. 2452 (Lieberman, section 198) establishing a Department of Homeland Security. S. 2452 , the National Homeland Security and Combating Terrorism Act of 2002, agreed to by the Senate Governmental Affairs Committee on July 25, 2002, exempted a "record" pertaining to the vulnerability of and threats to critical infrastructure (as defined in the USA PATRIOT Act), furnished voluntarily to the Department of Homeland Security, from being made available under FOIA. A record was protected from disclosure if the provider would not customarily make the record available to the public. It also required the provider to certify, in a manner specified by the Department of Homeland Security, that the record is confidential and not customarily made available to the public. Under S. 2452 a record is submitted voluntarily if it was submitted to the Department of Homeland Security "in the absence of authority of the Department requiring that record to be submitted," and it is not submitted or used to satisfy any legal requirement or obligation or to obtain any grant, permit, benefit, or other approval from the federal government. Agencies with which the Department of Homeland Security shares protected records were to be bound by the FOIA exemption. FOIA requests for protected information were to be referred back to the Department of Homeland Security. S. 2452 allowed an agency which had received independently of the Department a record "similar or identical" to that received by the Department, to disclose the record under FOIA. The Senate bill did not preempt state or local disclosure laws if the state or local authority received the information independent of the Department of Homeland Security, nor did it contain civil liability immunity, or criminal penalties. Finally, the Senate bill required the Comptroller General to report to Congress on the implementation and use of its protections. On November 25, 2002, President Bush signed H.R. 5005 , the Homeland Security Act of 2002, P.L. 107-296 . The "Critical Infrastructure Information Act of 2002," ("CIIA"), to be codified at 6 U.S.C. Â§ 131 et seq., is found in Subtitle B of Title II of the Homeland Security Act (sections 211 - 215). CIIA consists of a group of provisions that address the circumstances under which the Department of Homeland Security may obtain, use, and disclose critical infrastructure information as part of a critical infrastructure protection program. CIIA establishes several limitations on the disclosure of critical infrastructure information voluntarily submitted to DHS. The CIIA was enacted, in part, to respond to the need for the federal government and owners and operators of the nation's critical infrastructures to share information on vulnerabilities and threats, and to promote information sharing between the private and public sectors in order to protect critical assets. The Homeland Security Act of 2002 adopted sections 721- 725 of H.R. 5005 on critical infrastructure information verbatim. Congress' enactment of the Critical Infrastructure Information Act of 2002 was and continues to be somewhat controversial. The narrower Senate version, S. 2452 , was not considered by the full Senate, or the House of Representatives, when Congress enacted the Homeland Security Act on an accelerated schedule. The Homeland Security Act was approved by the House and the Senate expeditiously, with relatively little focus on its FOIA-related provisions. Following is a summary of the new law. The CIIA includes 4 key definitions: covered federal agency; critical infrastructure information; voluntary; and express statement. Another key definition, critical infrastructure, is defined elsewhere in the Homeland Security Act. The most important definition in CIIA is that of "critical infrastructure information" because the CIIA protections are triggered only for such information. Critical infrastructures are defined elsewhere in the Homeland Security Act. Section 2(4) of the Homeland Security Act states that critical infrastructure "has the meaning given that term in section 1016(e) of Public Law 107-56 (42 U.S.C. 5195(e))." Section 1016(e) of the USA PATRIOT Act defines critical infrastructure as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of these matters." This definition is viewed as a broad catch-all provision likely to cover a wide array of activities.