Mutual Non-Disclosure and Use of Information Agreement
to Support Emergency Cyber Mutual Assistance
This Non-Disclosure and Use of Information Agreement (the "Agreement'') is made and entered into as of this 15th day of June, 2016 by and among each entity that executes and delivers the signature page to this Agreement (each, a "Participating Entity" and collectively, the "Participating Entities").
A. Each Participating Entity is participating in a voluntary effort to assist the Electricity Subsector Coordinating Council (ESCC) in developing and implementing one or more industry initiatives to provide cyber emergency assistance to entities in the electric sector (collectively, the “Cyber Mutual Assistance Program”).
B. In connection with the Cyber Mutual Assistance Program, each Participating Entity may voluntarily choose to request from or provide to another Participating Entity emergency cyber mutual assistance in response to a cyber emergency;
C. The development and implementation of any Cyber Mutual Assistance Program, including any request or provision of cyber mutual assistance between Participating Entities, may necessitate the exchange of certain confidential or proprietary information.
NOW, THEREFORE, in consideration of the mutual covenants in this Agreement, the Participating Entities agree as follows:
1. Purpose, Scope, and Definitions. The purpose of this Agreement is to permit each Participating Entity to exchange Confidential Information (as defined below) as needed to pursue the development and implementation of a Cyber Mutual Assistance Program, including any request for or provision of cyber mutual assistance between Participating Entities in response to a cyber emergency or in connection with any Cyber Mutual Assistance Program.
“Confidential Information” under this Agreement consists of:
(i) all information disclosed by any Participating Entity, or any of its employees, directors, officers, affiliates, partners, agents, advisors or other representatives (“Representatives”) pursuant to that Participating Entity’s participation in or contribution to the development or implementation of a Cyber Mutual Assistance Program, including any Participating Entity’s request for or provision of cyber mutual assistance, whether disclosed prior to or following the execution of this Agreement;
(ii) any information or documentation produced by a Participating Entity, or any of its Representatives, under any Cyber Mutual Assistance Program or related to a specific request for or response to cyber mutual assistance, including any analysis of such information, and whether produced prior to or following the execution of this Agreement;
(iii) any aggregation, consolidation, or listing of information or documentation disclosed by one or more Participating Entities, or any of their respective Representatives, pursuant to the development or implementation of a Cyber Mutual Assistance Program including any Participating Entity’s request for or provision of cyber mutual assistance; and
(iv) all observations of equipment (including computer screens) and oral disclosures related to the development of any Cyber Mutual Assistance Program or a specific request for or response to cyber mutual assistance, including the systems, operations, and activities of each Participating Entity, whether such observations or oral disclosures were made prior to or following the execution of this Agreement.
2. Non-Disclosure and Use of Confidential Information. Each Participating Entity agrees (i) to maintain the confidentiality of all Confidential Information obtained, (ii) without the express permission of the Participating Entity providing such information, not to disclose such information to third parties, and (iii) to use such information only for the express purpose of developing and implementing a Cyber Mutual Assistance Program, including in connection with any request for or provision of cyber mutual assistance between Participating Entities. Each Participating Entity shall use the Confidential Information received hereunder only for the purposes identified in Section 1. Notwithstanding the forgoing, a Participating Entity may use and internally share Confidential Information as deemed necessary to respond to an actual or threatened cyber emergency that places, or has the potential to place, the Participating Entity’s cyber systems at risk. Any other use shall be only with the prior written consent of the Participating Entity or Participating Entities that provided the Confidential Information sought to be used.
3. Exemptions to Non-Disclosure. Notwithstanding Sections 1 and 2, a Participating Entity shall not have breached any obligation under this Agreement if the Confidential Information is disclosed to a third party when the Confidential Information:
(a) was in the public domain at the time of such disclosure or is subsequently made available to the public by the Participating Entity who provided the Confidential Information, or otherwise consistent with the terms of this Agreement; or
(b) had been received or independently developed by such Participating Entity at or prior to the time of disclosure through a process other than the development or implementation of the Cyber Mutual Assistance Program; or
(c) is subsequently disclosed to the Participating Entity by a third party without restriction on use and without breach of any agreement or legal duty; or
(d) subject to the provisions of Section 4, is used or disclosed pursuant to statutory duty, such as a public records act request, or an order, subpoena, discovery request, or other lawful process issued by a court or other governmental authority of competent jurisdiction or in a judicial proceeding; or
(e) is disclosed by unanimous agreement of each of the Participating Entity or Participating Entities whose information is subject to such disclosure; or
(f) after the time of its disclosure hereunder, becomes subsequently available to such Participating Entity on a non-confidential basis from a source not known by such Participating Entity to be bound by a confidentiality agreement or secrecy obligation in respect thereof.
4. Notice of Pending Third-Party Disclosure or Unauthorized Disclosure.
(a) In the event that any governmental authority issues an order, subpoena, or other lawful process or a Participating Entity receives a discovery request in a civil proceeding ("Legal Process") requiring the disclosure of any Confidential Information, the Participating Entity receiving such Legal Process shall notify in writing the other Participating Entities within five (5) business days of receipt. The Participating Entity receiving such Legal Process shall not be in violation of this Agreement if it complies with the Legal Process requiring disclosure of the Confidential Information after seven (7) business days following Participating Entity notification, as set forth above.
(b) A Participating Entity shall not disclose any Confidential Information in response to a request under the federal Freedom of Information Act, 5 U.S.C. § 552, as amended, or an equivalent state or local open records law, except as required by law as determined in the written opinion of such Participating Entity’s legal counsel. Upon receipt of a Freedom of Information Act or public records disclosure request, such Participating Entity shall: (i) notify each Participating Entity or Participating Entities whose information is subject to such disclosure request immediately upon receipt of a request for public records that include all or part of the Confidential Information; and (ii) if, in the written opinion of the legal counsel for the Participating Entity receiving the information request, the Confidential Information is not legally required to be disclosed, treat the requested Confidential Information as exempt from disclosure to the extent permitted by applicable law. The Participating Entity receiving the information request shall cooperate with the Participating Entity or Participating Entities whose information is subject to such disclosure request in challenging the request or seeking another appropriate remedy, as necessary. If such challenge to the request is not successful and another remedy is not obtained, only that portion of the Confidential Information that is legally required to be disclosed, as determined in the written opinion of the Participating Entity’s legal counsel, shall be disclosed.
(c) Unauthorized Disclosure: If a Participating Entity becomes aware that Confidential Information has been or likely has been disclosed to a third party in violation of this Agreement, the Participating Entity will immediately notify the Participating Entity in writing that provided the disclosed Confidential Information, provide a description of the information disclosed, and provide reasonable assistance to the Participating Entity that provided the disclosed Confidential Information to recover the Confidential Information and prevent further unauthorized disclosure.
5. Term. This Agreement shall remain in effect as to each Participating Entity unless and until a Participating Entity seeking to withdraw from the agreement provides ten (10) days’ prior written notice to the other Participating Entities, then this Agreement shall terminate with respect to such Participating Entity at the conclusion of such ten (10) day period; provided, however, that termination shall not extinguish any claim, liability, or cause of action under this Agreement existing at the time of termination. The provisions of Sections 1, 2, 3, 4, 5 and 6 shall survive the termination of this Agreement for a period of ten (10) years.
6. Return or Destruction of Confidential Information. Upon termination of this Agreement, all Confidential Information in the possession or control of a Participating Entity and its Representatives that received such information shall be returned to the Participating Entity that disclosed the information, including all copies of such information in any form whatsoever, unless otherwise instructed in writing by the Participating Entity that disclosed the information. Notwithstanding the foregoing, if the Confidential Information is retained in the computer backup system of a Participating Entity, the Confidential Information will be destroyed in accordance with the regular ongoing records retention process of the Participating Entity. In lieu of return, a Participating Entity may certify to the other Participating Entities in writing that all such Confidential Information, in any form whatsoever, has been destroyed. Notwithstanding anything in this paragraph 6 to the contrary, a Participating Entity may retain a record copy of any Confidential Information if required to do so by applicable law. In such an instance, such Participating Entity shall identify in writing the specific Confidential Information retained, and shall provide the affected Participating Entity or Participating Entities with a written commitment to return or destroy the retained Confidential Information upon the expiration of the retention period required by law. The obligation under this Agreement to maintain the confidentiality of all Confidential Information shall continue to apply to such retained Confidential Information for so long as the Participating Entity possesses such Confidential Information.
7. Notices. All notices, requests, demands, and other communications required or permitted under this Agreement shall be in writing, unless otherwise agreed by the Participating Entities, and shall be delivered in person or sent by certified mail, postage prepaid, by overnight delivery, or by electronic mail or electronic facsimile transmission with an original sent immediately thereafter by postage prepaid mail, and properly addressed with respect to a particular Participating Entity, to such Participating Entity’s representative as set forth on such Participating Entity’s signature page to this Agreement. A Participating Entity may from time to time change its representative or address for the purpose of notices to that Participating Entity by a similar notice specifying a new representative or address, but no such change shall be deemed to have been given until such notice is actually received by the Participating Entity being so notified.
8. Complete Agreement; No Other Rights. This Agreement contains the complete and exclusive agreement of the Participating Entities with respect to the subject matter thereof. No change to this Agreement shall be effective unless agreed to in writing by all of the then existing Participating Entities. This Agreement is not intended to create any right in or obligation of any Participating Entity or third party other than those expressly stated herein.
9. No Warranties or Representations. Any Confidential Information disclosed under this Agreement carries no warranty or representation of any kind, either express or implied. A Participating Entity receiving such Confidential Information shall not be entitled to rely on the accuracy, completeness, or quality of the Confidential Information, even for the purpose stated in Section 1.
10. Injunctive Relief. Each Participating Entity agrees that, in addition to whatever other remedies may be available to the other Participating Entities under applicable law, the other Participating Entities shall be entitled to seek injunctive relief with respect to any actual or threatened violation of this Agreement by a Participating Entity or any third party receiving Confidential Information.
11. Choice of Law and Forum. This Agreement shall be governed by and construed in accordance with the laws of the State of New York without giving effect to any choice or conflicts of law provision or rule that would cause the application of laws of any other jurisdiction.
12. Assignment. This Agreement shall be binding upon the Participating Entities, their successors, and assigns. No Participating Entity may assign this Agreement without the prior written consent of the other Participating Entities.
13. Construction of Agreement. Ambiguities or uncertainties in the wording of this Agreement shall not be construed for or against any Participating Entity, but shall be construed in the manner that most accurately reflects the Participating Entities’ intent as of the date they executed this Agreement.
14. Signature Authority. Each person signing below warrants that he or she has been duly authorized by the Participating Entity for whom he or she signs to execute this Agreement on behalf of that Participating Entity.
15. Counterparts. This Agreement may be executed in counterparts, all of which shall be considered one and the same Agreement.
IN WITNESS WHEREOF, the Participating Entities have executed this Agreement as of the date set forth above.
Dated: __________________________ Participating Entity:
By: ___________________________
Name:
Title:
