In this subtitle:
(1) Agency.--The term ``agency'' has the meaning
given it in section 551 of title 5, United States Code.
(2) Covered federal agency.--The term ``covered
Federal agency'' means the Department of Homeland
Security.
(3) Critical infrastructure information.--The term
``critical infrastructure information'' means
information not customarily in the public domain and
related to the security of critical infrastructure or
protected systems--
(A) actual, potential, or threatened
interference with, attack on, compromise of, or
incapacitation of critical infrastructure or
protected systems by either physical or
computer-based attack or other similar conduct
(including the misuse of or unauthorized access
to all types of communications and data
transmission systems) that violates Federal,
State, or local law, harms interstate commerce
of the United States, or threatens public
health or safety;
(B) the ability of any critical
infrastructure or protected system to resist
such interference, compromise, or
incapacitation, including any planned or past
assessment, projection, or estimate of the
vulnerability of critical infrastructure or a
protected system, including security testing,
risk evaluation thereto, risk management
planning, or risk audit; or
(C) any planned or past operational problem
or solution regarding critical infrastructure
or protected systems, including repair,
recovery, reconstruction, insurance, or
continuity, to the extent it is related to such
interference, compromise, or incapacitation.
(4) Critical infrastructure protection program.--
The term ``critical infrastructure protection program''
means any component or bureau of a covered Federal
agency that has been designated by the President or any
agency head to receive critical infrastructure
information.
(5) Information sharing and analysis
organization.--The term ``Information Sharing and
Analysis Organization'' means any formal or informal
entity or collaboration created or employed by public
or private sector organizations, for purposes of--
(A) gathering and analyzing critical
infrastructure information in order to better
understand security problems and
interdependencies related to critical
infrastructure and protected systems, so as to
ensure the availability, integrity, and
reliability thereof;
(B) communicating or disclosing critical
infrastructure information to help prevent,
detect, mitigate, or recover from the effects
of a interference, compromise, or a
incapacitation problem related to critical
infrastructure or protected systems; and
(C) voluntarily disseminating critical
infrastructure information to its members,
State, local, and Federal Governments, or any
other entities that may be of assistance in
carrying out the purposes specified in
subparagraphs (A) and (B).
(6) Protected system.--The term ``protected
system''--
(A) means any service, physical or
computer-based system, process, or procedure
that directly or indirectly affects the
viability of a facility of critical
infrastructure; and
(B) includes any physical or computer-based
system, including a computer, computer system,
computer or communications network, or any
component hardware or element thereof, software
program, processing instructions, or
information or data in transmission or storage
therein, irrespective of the medium of
transmission or storage.
(7) Voluntary.--
(A) In general.--The term ``voluntary'', in
the case of any submittal of critical
infrastructure information to a covered Federal
agency, means the submittal thereof in the
absence of such agency's exercise of legal
authority to compel access to or submission of
such information and may be accomplished by a
single entity or an Information Sharing and
Analysis Organization on behalf of itself or
its members.
(B) Exclusions.--The term ``voluntary''--
(i) in the case of any action
brought under the securities laws as is
defined in section 3(a)(47) of the
Securities Exchange Act of 1934 (15
U.S.C. 78c(a)(47))--
(I) does not include
information or statements
contained in any documents or
materials filed with the
Securities and Exchange
Commission, or with Federal
banking regulators, pursuant to
section 12(i) of the Securities
Exchange Act of 1934 (15 U.S.C.
781(I)); and
(II) with respect to the
submittal of critical
infrastructure information,
does not include any disclosure
or writing that when made
accompanied the solicitation of
an offer or a sale of
securities; and
(ii) does not include information
or statements submitted or relied upon
as a basis for making licensing or
permitting determinations, or during
regulatory proceedings.
SEC. 213. [6 U.S.C. 132] DESIGNATION OF CRITICAL INFRASTRUCTURE
PROTECTION PROGRAM.
A critical infrastructure protection program may be
designated as such by one of the following:
(1) The President.
(2) The Secretary of Homeland Security.
SEC. 214. [6 U.S.C. 123] PROTECTION OF VOLUNTARILY SHARED CRITICAL
INFRASTRUCTURE INFORMATION.
(a) Protection.--
(1) In general.--Notwithstanding any other
provision of law, critical infrastructure information
(including the identity of the submitting person or
entity) that is voluntarily submitted to a covered
Federal agency for use by that agency regarding the
security of critical infrastructure and protected
systems, analysis, warning, interdependency study,
recovery, reconstitution, or other informational
purpose, when accompanied by an express statement
specified in paragraph (2)--
(A) shall be exempt from disclosure under
section 552 of title 5, United States Code
(commonly referred to as the Freedom of
Information Act);
(B) shall not be subject to any agency
rules or judicial doctrine regarding ex parte
communications with a decision making official;
(C) shall not, without the written consent
of the person or entity submitting such
information, be used directly by such agency,
any other Federal, State, or local authority,
or any third party, in any civil action arising
under Federal or State law if such information
is submitted in good faith;
(D) shall not, without the written consent
of the person or entity submitting such
information, be used or disclosed by any
officer or employee of the United States for
purposes other than the purposes of this
subtitle, except--
(i) in furtherance of an
investigation or the prosecution of a
criminal act; or
(ii) when disclosure of the
information would be--
(I) to either House of
Congress, or to the extent of
matter within its jurisdiction,
any committee or subcommittee
thereof, any joint committee
thereof or subcommittee of any
such joint committee; or
(II) to the Comptroller
General, or any authorized
representative of the
Comptroller General, in the
course of the performance of
the duties of the General
Accounting Office.
(E) shall not, if provided to a State or
local government or government agency--
(i) be made available pursuant to
any State or local law requiring
disclosure of information or records;
(ii) otherwise be disclosed or
distributed to any party by said State
or local government or government
agency without the written consent of
the person or entity submitting such
information; or
(iii) be used other than for the
purpose of protecting critical
infrastructure or protected systems, or
in furtherance of an investigation or
the prosecution of a criminal act; and
(F) does not constitute a waiver of any
applicable privilege or protection provided
under law, such as trade secret protection.
(2) Express statement.--For purposes of paragraph
(1), the term ``express statement'', with respect to
information or records, means--
(A) in the case of written information or
records, a written marking on the information
or records substantially similar to the
following: ``This information is voluntarily
submitted to the Federal Government in
expectation of protection from disclosure as
provided by the provisions of the Critical
Infrastructure Information Act of 2002.''; or
(B) in the case of oral information, a
similar written statement submitted within a
reasonable period following the oral
communication.
(b) Limitation.--No communication of critical
infrastructure information to a covered Federal agency made
pursuant to this subtitle shall be considered to be an action
subject to the requirements of the Federal Advisory Committee
Act (5 U.S.C. App. 2).
(c) Independently Obtained Information.--Nothing in this
section shall be construed to limit or otherwise affect the
ability of a State, local, or Federal Government entity,
agency, or authority, or any third party, under applicable law,
to obtain critical infrastructure information in a manner not
covered by subsection (a), including any information lawfully
and properly disclosed generally or broadly to the public and
to use such information in any manner permitted by law.
(d) Treatment of Voluntary Submittal of Information.--The
voluntary submittal to the Government of information or records
that are protected from disclosure by this subtitle shall not
be construed to constitute compliance with any requirement to
submit such information to a Federal agency under any other
provision of law.
(e) Procedures.--
(1) In general.--The Secretary of the Department of
Homeland Security shall, in consultation with
appropriate representatives of the National Security
Council and the Office of Science and Technology
Policy, establish uniform procedures for the receipt,
care, and storage by Federal agencies of critical
infrastructure information that is voluntarily
submitted to the Government. The procedures shall be
established not later than 90 days after the date of
the enactment of this subtitle.
(2) Elements.--The procedures established under
paragraph (1) shall include mechanisms regarding--
(A) the acknowledgement of receipt by
Federal agencies of critical infrastructure
information that is voluntarily submitted to
the Government;
(B) the maintenance of the identification
of such information as voluntarily submitted to
the Government for purposes of and subject to
the provisions of this subtitle;
(C) the care and storage of such
information; and
(D) the protection and maintenance of the
confidentiality of such information so as to
permit the sharing of such information within
the Federal Government and with State and local
governments, and the issuance of notices and
warnings related to the protection of critical
infrastructure and protected systems, in such
manner as to protect from public disclosure the
identity of the submitting person or entity, or
information that is proprietary, business
sensitive, relates specifically to the
submitting person or entity, and is otherwise
not appropriately in the public domain.
(f) Penalties.--Whoever, being an officer or employee of
the United States or of any department or agency thereof,
knowingly publishes, divulges, discloses, or makes known in any
manner or to any extent not authorized by law, any critical
infrastructure information protected from disclosure by this
subtitle coming to him in the course of this employment or
official duties or by reason of any examination or
investigation made by, or return, report, or record made to or
filed with, such department or agency or officer or employee
thereof, shall be fined under title 18 of the United States
Code, imprisoned not more than 1 year, or both, and shall be
removed from office or employment.
(g) Authority To Issue Warnings.--The Federal Government
may provide advisories, alerts, and warnings to relevant
companies, targeted sectors, other governmental entities, or
the general public regarding potential threats to critical
infrastructure as appropriate. In issuing a warning, the
Federal Government shall take appropriate actions to protect
from disclosure--
(1) the source of any voluntarily submitted
critical infrastructure information that forms the
basis for the warning; or
(2) information that is proprietary, business
sensitive, relates specifically to the submitting
person or entity, or is otherwise not appropriately in
the public domain.
(h) Authority To Delegate.--The President may delegate
authority to a critical infrastructure protection program,
designated under section 213, to enter into a voluntary
agreement to promote critical infrastructure security,
including with any Information Sharing and Analysis
Organization, or a plan of action as otherwise defined in
section 708 of the Defense Production Act of 1950 (50 U.S.C.
App. 2158).