Collapse to view only § 671. Definitions
- § 671. Definitions
- § 672. Designation of critical infrastructure protection program
- § 673. Protection of voluntarily shared critical infrastructure information
- § 674. No private right of action
§ 671. DefinitionsIn this part:
(1) Agency
(2) Covered Federal agency
(3) Critical infrastructure information
(4) Critical infrastructure protection program
(5) Protected systemThe term “protected system”—
(A) means any service, physical or computer-based system, process, or procedure that directly or indirectly affects the viability of a facility of critical infrastructure; and
(B) includes any physical or computer-based system, including a computer, computer system, computer or communications network, or any component hardware or element thereof, software program, processing instructions, or information or data in transmission or storage therein, irrespective of the medium of transmission or storage.
(6) Voluntary
(A) In general
(B) ExclusionsThe term “voluntary”—
(i) in the case of any action brought under the securities laws as is defined in section 78c(a)(47) of title 15—(I) does not include information or statements contained in any documents or materials filed with the Securities and Exchange Commission, or with Federal banking regulators, pursuant to section 78l(i) of title 15; and(II) with respect to the submittal of critical infrastructure information, does not include any disclosure or writing that when made accompanied the solicitation of an offer or a sale of securities; and
(ii) does not include information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory proceedings.
(Pub. L. 107–296, title XXII, § 2222, formerly title II, § 212, Nov. 25, 2002, 116 Stat. 2150; Pub. L. 114–113, div. N, title II, § 204, Dec. 18, 2015, 129 Stat. 2961; renumbered title XXII, § 2222, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(i), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(M), Dec. 23, 2022, 136 Stat. 3661.)
§ 672. Designation of critical infrastructure protection program
A critical infrastructure protection program may be designated as such by one of the following:
(1) The President.
(2) The Secretary of Homeland Security.
(Pub. L. 107–296, title XXII, § 2223, formerly title II, § 213, Nov. 25, 2002, 116 Stat. 2152; renumbered title XXII, § 2223, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.)
§ 673. Protection of voluntarily shared critical infrastructure information
(a) Protection
(1) In generalNotwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructure and protected systems, analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement specified in paragraph (2)—
(A) shall be exempt from disclosure under section 552 of title 5 (commonly referred to as the Freedom of Information Act);
(B) shall not be subject to any agency rules or judicial doctrine regarding ex parte communications with a decision making official;
(C) shall not, without the written consent of the person or entity submitting such information, be used directly by such agency, any other Federal, State, or local authority, or any third party, in any civil action arising under Federal or State law if such information is submitted in good faith;
(D) shall not, without the written consent of the person or entity submitting such information, be used or disclosed by any officer or employee of the United States for purposes other than the purposes of this part, except—
(i) in furtherance of an investigation or the prosecution of a criminal act; or
(ii) when disclosure of the information would be—(I) to either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee thereof or subcommittee of any such joint committee; or(II) to the Comptroller General, or any authorized representative of the Comptroller General, in the course of the performance of the duties of the Government Accountability Office.1
1 So in original. The period probably should be a semicolon.
(E) shall not, if provided to a State or local government or government agency—
(i) be made available pursuant to any State or local law requiring disclosure of information or records;
(ii) otherwise be disclosed or distributed to any party by said State or local government or government agency without the written consent of the person or entity submitting such information; or
(iii) be used other than for the purpose of protecting critical infrastructure or protected systems, or in furtherance of an investigation or the prosecution of a criminal act; and
(F) does not constitute a waiver of any applicable privilege or protection provided under law, such as trade secret protection.
(2) Express statementFor purposes of paragraph (1), the term “express statement”, with respect to information or records, means—
(A) in the case of written information or records, a written marking on the information or records substantially similar to the following: “This information is voluntarily submitted to the Federal Government in expectation of protection from disclosure as provided by the provisions of the Critical Infrastructure Information Act of 2002.”; or
(B) in the case of oral information, a similar written statement submitted within a reasonable period following the oral communication.
(b) Limitation
(c) Independently obtained information
(d) Treatment of voluntary submittal of information
(e) Procedures
(1) In general
(2) ElementsThe procedures established under paragraph (1) shall include mechanisms regarding—
(A) the acknowledgement of receipt by Federal agencies of critical infrastructure information that is voluntarily submitted to the Government;
(B) the maintenance of the identification of such information as voluntarily submitted to the Government for purposes of and subject to the provisions of this part;
(C) the care and storage of such information; and
(D) the protection and maintenance of the confidentiality of such information so as to permit the sharing of such information within the Federal Government and with State and local governments, and the issuance of notices and warnings related to the protection of critical infrastructure and protected systems, in such manner as to protect from public disclosure the identity of the submitting person or entity, or information that is proprietary, business sensitive, relates specifically to the submitting person or entity, and is otherwise not appropriately in the public domain.
(f) Penalties
(g) Authority to issue warningsThe Federal Government may provide advisories, alerts, and warnings to relevant companies, targeted sectors, other governmental entities, or the general public regarding potential threats to critical infrastructure as appropriate. In issuing a warning, the Federal Government shall take appropriate actions to protect from disclosure—
(1) the source of any voluntarily submitted critical infrastructure information that forms the basis for the warning; or
(2) information that is proprietary, business sensitive, relates specifically to the submitting person or entity, or is otherwise not appropriately in the public domain.
(h) Authority to delegate
(Pub. L. 107–296, title XXII, § 2224, formerly title II, § 214, Nov. 25, 2002, 116 Stat. 2152; Pub. L. 108–271, § 8(b), July 7, 2004, 118 Stat. 814; Pub. L. 112–199, title I, § 111, Nov. 27, 2012, 126 Stat. 1472; renumbered title XXII, § 2224, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(ii), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–286, § 4(a)(18), Dec. 27, 2022, 136 Stat. 4307.)
§ 674. No private right of action
Nothing in this part may be construed to create a private right of action for enforcement of any provision of this chapter.
(Pub. L. 107–296, title XXII, § 2225, formerly title II, § 215, Nov. 25, 2002, 116 Stat. 2155; renumbered title XXII, § 2225, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.)