10 U.S.C. § 130e — Treatment under Freedom of Information Act of certain critical infrastructure security information

(a) Exemption. The Secretary of Defense can exempt Department of Defense critical infrastructure security information from disclosure under section 552(b)(3) of title 5, after writing a determination that (1) the information is Department of Defense critical infrastructure security information, and (2) the public interest in disclosing it doesn't outweigh the reasons to keep it confidential. (b) Designation of Department of Defense Critical Infrastructure Security Information. Besides any other authority to protect information from release, the Secretary can designate information as this kind of critical infrastructure information — even while it's being created — to make sure it isn't shared without authorization. Once designated, it still goes through the subsection (a) determination process to decide whether it's actually exempt from disclosure. (c) Information Provided to State and Local Governments. (1) This kind of information, once covered by a subsection (a) determination or a subsection (b) designation, stays under Department of Defense control even after it's given to a state or local government. (2) (A) A state or local law that would otherwise require disclosure doesn't apply to information covered by a subsection (a) determination. (B) If someone asks a state or local government to disclose information designated under subsection (b) (relying on a state or local law), that government must give the Secretary a chance to run the subsection (a) determination process before deciding whether the (A) protection applies. (d) Transparency. Every determination the Secretary makes under subsection (a) must be written down and explained, and both the determination and the explanation must be available to the public on request. (e) Definition. In this section, "Department of Defense critical infrastructure security information" means sensitive but unclassified information that, if released, would expose weaknesses in Defense Department critical infrastructure — weaknesses that, if exploited, would likely cause serious disruption, destruction, or damage to Defense operations, property, or facilities. This includes information about securing explosives, hazardous chemicals, or pipelines connected to critical infrastructure or protected systems the Department owns or operates (or that are operated on its behalf), vulnerability assessments done for the Department, explosives safety information (including storage and handling), and other site-specific installation security information.