PROTECTING THE HOMELAND BY EXEMPTION: WHY THE CRITICAL INFRASTRUCTURE INFORMATION ACT OF 2002 WILL DEGRADE THE FREEDOM OF INFORMATION ACT

To protect against "cyberterror," the House version of the Homeland Security Act exempts information related to the nation's critical infrastructure from the Freedom of Information Act¹ disclosure requirements. The proposed exemption unnecessarily threatens public access to vital information about health and safety information; information the Freedom of Information Act was designed to guarantee.

Introduction - The Threat of Cyberterror

¶          One of the hottest perceived threats to America in this new age of terrorism is "cyberterror" - terrorism via our own electronic infrastructure. Reports indicate that al Qaeda operatives are researching methods to electronically disable or destroy our nation's infrastructure systems, such as dams, communications systems, and other structures.² In fact, 74% of IT professionals believe an attack on Wall Street or on large banks will almost certainly occur in the next year.³ What makes this vulnerability difficult to patch is the nature of our nation's infrastructure. Eighty-five to 90% of America's critical infrastructure is privately owned, and information regarding its capabilities and weaknesses is not automatically available to the government.⁴

¶          According to industry computer experts, businesses that operate our nation's critical infrastructure currently hesitate to share information with the government about previous Internet attacks because they fear disclosure to the public under the Freedom of Information Act ("FOIA").⁵ Under the FOIA, most agency records must be made available for public review.⁶ Industry experts claim that public knowledge of previous hacker attacks could lead to liability lawsuits against companies that volunteer information.⁷ 

¶          To alleviate these fears, Congress is considering the Critical Infrastructure Information Act of 2002 ("CIIA").⁸ The CIIA is embedded within the House version of the Homeland Security Act of 2002, a politically charged piece of legislation that would lead to the largest reorganization of the federal government since World War II.⁹ To improve information sharing, the CIIA would exempt certain information from being disclosed under the Freedom of Information Act.¹⁰ The CIIA would block requests for information that was voluntarily given by private companies to the government about their own network vulnerabilities and previous hacker attacks.

¶          However, an exemption to the FOIA is unnecessary to improve information sharing. There are already private sector protections embedded in the FOIA, though this is not widely known.¹¹ In addition, the broad language of the proposed exemption may lead to an unintended lack of access to vital information about public health and safety. Furthermore, it is uncertain that this new exemption will do anything to increase public/private collaboration.

The Critical Infrastructure Information Act of 2002

¶          The CIIA, as written in the House version of the Homeland Security Act of 2002, exempts certain information from disclosure under the Freedom of Information Act.¹² To be exempt, the information must be "critical infrastructure information," which is broadly defined as "information not customarily in the public domain and related to the security of critical infrastructure or protected systems."¹³ Examples of critical infrastructure information given in the statute include 1) actual, potential, or threatened interference with critical infrastructure, 2) capabilities and assessments of current systems and their resistibility to attacks, and 3) any operational problems or solutions regarding critical infrastructure.¹⁴ A person or entity must give the information voluntarily to the new Department of Homeland Security to be used by the department for some informational purpose regarding the security of critical infrastructure and protected systems.¹⁵ Protected systems include both physical and computer-based systems that either directly or indirectly affect a facility of critical infrastructure.¹⁶ 

¶          In addition to being exempt from disclosure under the FOIA, information disclosed under the CIIA cannot be used against the submitter in civil litigation (if submitted in good faith),¹⁷ nor be disclosed by any government employee (except in very narrow circumstances, such as a criminal investigation).¹⁸ The CIIA also applies to information provided to state and local governments, nullifying any state laws requiring disclosure.¹⁹

¶          The Homeland Security Act of 2002, including the CIIA provisions, passed the House of Representatives by a vote of 295-132. As of the date of publication, it is under consideration by the Senate.

Would the CIIA Achieve Anything New?

¶          The most cogent argument against the CIIA is that the private sector exemptions are redundant and unnecessary. The Freedom of Information Act contains several exemptions that protect information given to the government by private entities. Although the FOIA embodies a "general philosophy of full agency disclosure"²⁰ in order to create a more informed citizenry,²¹ that goal is balanced by nine statutorily delineated exemptions²² designed to preserve the confidentiality of sensitive information.²³ Included in these exemptions are matters of national defense or foreign policy,²⁴ trade secrets,²⁵ and commercial or financial information given by a person that is privileged or confidential.²⁶ 

¶          In a letter to members of the House, eighteen private businesses and associations expressed their current hesitations to share sensitive information with the government.²⁷ They stated that the uncertainty in the law, namely the Freedom of Information Act and antitrust exemptions, creates a "chilling effect" on information sharing efforts.²⁸

¶          Although the law surrounding the FOIA is generally well settled, on first glance there appears to be credence to these businesses' concerns. The Supreme Court has said, "disclosure, not secrecy, is the dominant objective of the [Freedom of Information] Act."²⁹ The courts agree that the FOIA is to be broadly construed in favor of disclosure, while the nine exemptions are to be construed narrowly.³⁰ 

¶          Even more damaging to public/private collaboration is the generally one-sided nature of the FOIA. If a FOIA information request is denied by a federal agency, the requestor can seek a decree in a U.S. District Court to enjoin the agency to disclose the information.³¹ However, the FOIA is exclusively a disclosure statute and does not afford any private entity a right of action to enjoin an agency from disclosure.³² In addition, if a part of a record contains information exempted under the FOIA, the record still must be disclosed with the exempted information redacted.³³

¶          But, there is a very broad exception to this general rule for information that falls under exemption 4 of the FOIA - trade secrets and confidential commercial or financial information. The Trade Secrets Act³⁴ prohibits agencies from releasing information that falls within exemption 4.³⁵ To bar release of the information, the submitter can bring a "reverse-FOIA" suit under the Administrative Procedure Act.³⁶

¶          The purpose of exemption 4 is "to encourage individuals to provide certain kinds of confidential information to the Government."³⁷ If information is disclosed to the government voluntarily (and is financial or commercial in nature, and obtained by a person), then it will be exempted if "it is the kind of information that would customarily not be released to the public by the person from whom it was obtained."³⁸ For instance, in Critical Mass Energy Project v. Nuclear Regulatory Commission, the D.C. Circuit Court of Appeals held that safety reports voluntarily transmitted to the Nuclear Regulatory Commission ("NRC") on condition of confidentiality should not be released to the public under exemption 4.³⁹ The court emphasized that releasing the documents would undermine the purpose of the exemption, which is to encourage cooperation between the government and people with useful information.⁴⁰ This exemption has precisely the same goal as does the CIIA.

¶          Fears of the private sector are overstated. Reservations about critical business information being disclosed under the FOIA should not prevent disclosure of information about our fundamental infrastructure to the government. Passage of the CIIA is unnecessary for the private sector to begin assisting the administration in its anti-terrorism efforts.

Is the CIIA Loophole Oversized?

¶          In addition, many are concerned that the language of the CIIA is too broad and goes against the very purpose of the FOIA. Four of the nine members of the Select Committee on Homeland Security conveyed their concerns in a minority opinion regarding the potential reach of the CIIA.⁴¹ In the House report on the Homeland Security Act, these four representatives stated that the broad definition of "critical infrastructure" would cover corporations seeking liability protection, and such a result threatens our country's "tradition of open and accountable government.⁴² Ten press organizations have sent their own letter to Congress warning that the proposed exemption "is ripe for misuse and abuse."⁴³ 

¶          Opponents of the proposed exemption fear that reduced accountability will actually lead to weaker protection of our critical infrastructure. Especially in the wake of recent corporate scandals and accounting improprieties, some say that the government should be restricting the privacy of corporate America rather than enlarging it.⁴⁴ Even members of the current administration have misgivings about the proposed exemption. John Malcolm of the Justice Department's Criminal Division says that the loophole would permit a knowingly at fault company to do a "document dump" on the government and free itself from any potential civil prosecution.⁴⁵ 

¶          The language in the House version of the CIIA exempts "critical infrastructure information" from the disclosure requirements of the FOIA. Included in that term's definition is "any planned or past operational problem...regarding critical infrastructure or protected systems."⁴⁶ Representative Schakowsky (D-Ill.), ranking Democrat on the House Government Reform Subcommittee on Governmental Efficiency, has called this language, "a loophole big enough to drive any corporation and its secrets through."⁴⁷

¶          Theoretically, Schakowsky is correct. As currently written, operators of critical infrastructure will be able to submit any information to the government regarding previous attacks in order to become insulated against civil liability related to those attacks. While this language certainly encourages public/private information sharing, it inhibits the public's ability to hold operators of critical infrastructure accountable for their activities through civil action.

¶          Such a result may, in fact, actually decrease private preparedness for future cyberterror attacks. If an operator of critical infrastructure knows it can avoid civil liability for a cyberterror attack by simply submitting information regarding the attack to the Homeland Security Department, it will have less of an economic incentive to invest in preventing future attacks. A decrease in preparedness implies a decrease in security, and illustrates the need for public scrutiny on the preparedness of our critical infrastructure.

Can the Public & Private Sectors Ever Collaborate Voluntarily?

¶          Even if the CIIA in its current form should become law, the biggest roadblock to public/private information sharing still remains: overcoming business interests. The most pertinent concerns to members of the corporate sector are those of its shareholders. For a company to use valuable time, resources and manpower to organize its own information regarding infrastructure capabilities, weaknesses, and previous hacks for the benevolent mission to improve our national security is antithetical to the very nature of a profit-driven organization. While increased public/private sharing may prevent cyberterror attacks in the long-term, it will not increase profits in the short-term - such investments may be hard to come by with the current economic slowdown. The government may find its efforts here wasted without providing some incentive for disclosure.

¶          A more radical option to consider is to require by law all critical infrastructure information to be disclosed to the new Homeland Security Department. Such information would still receive the protections under the FOIA⁴⁸ and the government would receive unfettered access to the information it needs to protect the homeland. Although this would not be a desired market solution, it deserves discussion, especially in light of our perceived infrastructure vulnerability.

Conclusion

¶          With so many issues facing passage of the Homeland Security Act, the Critical Infrastructure Information Act must not be included in its present form. Glaring issues remain with respect to the right of individuals to know what their government is doing and to hold operators of critical infrastructure accountable for their actions. With protections already in place through the Freedom of Information Act, members of the administration and the public need to pressure operators of private infrastructure to willingly contribute as much information to the homeland security effort as is necessary to protect our nation from future cyberterror attacks. Private owners hold the keys to the safety of our critical infrastructure, and therefore must be convinced or compelled to act. However, removing their flaws from the public eye will decrease public scrutiny and reduce private incentives to improve security. Such a result will hinder the overall effectiveness of the Homeland Security Act.

Footnotes