6 U.S.C. § 673 — Protection of voluntarily shared critical infrastructure information

(a) Protection. (1) General rule. Critical-infrastructure information, including who submitted it, that a person or entity voluntarily gives to a covered federal agency for security, protected-systems, analysis, warning, interdependency study, recovery, reconstitution, or another information purpose is protected when accompanied by the statement in paragraph (2). It (A) is exempt from disclosure under section 552 of title 5 (the Freedom of Information Act); (B) is not subject to agency rules or court doctrines about ex parte communications with a decision-maker; (C) may not, without the submitter’s written consent, be used directly by that agency, another federal, State, or local authority, or a third party in a civil case under federal or State law if submitted in good faith; (D) may not, without written consent, be used or disclosed by a United States officer or employee for a purpose outside this part, except (i) to investigate or prosecute a crime, or (ii) to either House of Congress, its committees or subcommittees, or a joint committee or subcommittee on matters within its jurisdiction, or to the Comptroller General or an authorized representative while performing Government Accountability Office duties; (E) when given to a State or local government or agency, (i) may not be made available under a State or local disclosure law, (ii) may not otherwise be disclosed or distributed without the submitter’s written consent, and (iii) may be used only to protect critical infrastructure or protected systems or investigate or prosecute a crime; and (F) does not waive a privilege or protection under law, including trade-secret protection. (2) Express statement. For written information or records, this means a written marking substantially saying: “This information is voluntarily submitted to the Federal Government in expectation of protection from disclosure as provided by the provisions of the Critical Infrastructure Information Act of 2002.” For oral information, it means a similar written statement submitted within a reasonable time after the oral communication. (b) Limit. Communicating critical-infrastructure information to a covered federal agency under this part is not an action subject to title 5, chapter 10. (c) Independently obtained information. This section does not limit a federal, State, or local government entity, agency, authority, or third party from obtaining information under applicable law in a way not covered by (a), including information lawfully and properly disclosed generally or broadly to the public, or from using it in any way the law allows. A permitted use includes disclosure under section 2302(b)(8) of title 5. (d) Voluntary submission does not satisfy another duty. Voluntarily giving the Government information protected by this part does not count as complying with a separate law requiring that information to be submitted to a federal agency. (e) Procedures. (1) The Secretary of Homeland Security, consulting appropriate National Security Council and Office of Science and Technology Policy representatives, must establish uniform procedures for federal agencies to receive, care for, and store voluntarily submitted critical-infrastructure information. The procedures had to be established within 90 days after November 25, 2002. (2) They must include mechanisms for (A) acknowledging receipt; (B) keeping the information identified as voluntarily submitted and subject to this part; (C) caring for and storing it; and (D) protecting and maintaining its confidentiality while allowing sharing within the federal government and with State and local governments and issuing infrastructure warnings, in a way that protects from public disclosure the submitter’s identity and information that is proprietary, business-sensitive, specifically related to the submitter, or otherwise not properly public. (f) Penalties. A United States officer or employee who knowingly publishes, divulges, discloses, or otherwise makes known, beyond what law allows, protected critical-infrastructure information received through employment, official duties, an examination or investigation, or a return, report, or record filed with the officer, employee, department, or agency, may be fined under title 18, imprisoned for up to one year, or both, and must be removed from office or employment. (g) Warnings. The federal government may issue advisories, alerts, and warnings about possible critical-infrastructure threats to relevant companies, targeted sectors, other governments, or the public. It must take appropriate steps to protect from disclosure (1) the source of voluntarily submitted information supporting the warning and (2) proprietary, business-sensitive, submitter-specific, or otherwise nonpublic information. (h) Delegation. The President may delegate to a critical-infrastructure-protection program designated under section 672 authority to enter a voluntary agreement promoting infrastructure security, including an agreement with an Information Sharing and Analysis Organization, or a plan of action as defined in section 4558 of title 50.