• Attorneys



• Cases and Documents



• Alan Morrison Supreme Court Assistance Project



• Freedom of Information Clearinghouse



• Consumer Justice Project



• Internet Free Speech



• Fellowship and Employment Opportunities



• FAQs



• Litigation Group
  E-Update

FOIA and Homeland Security Issues

Are the computer systems used by your bank vulnerable to computer hackers?  Are dangerous chemicals stored in your community adequately protected against sabotage?  What would happen if electrical power facilities in your area were attacked?

In developing strategies to enhance homeland security, government officials must be concerned with the answers to these and many other questions about the vulnerability of "critical infrastructures" such as water systems, power grids, and computer networks.  Private businesses have information that is relevant to these issues. The information that government officials obtain from businesses can disclose violations of laws that are designed to make these systems more secure, or vulnerabilities that law makers have overlooked and should be pressured to address.

However, many of the businesses that operate critical infrastructures have said that they are reluctant to share the information that they have with government authorities because of the risk of liability, disclosure to the public under the FOIA or state laws, or leaks.  In 2002, these arguments convinced the Bush Administration and Congress to enact legislation that seeks to encourage the voluntary submission of certain information about critical infrastructure vulnerabilities to the Department of Homeland Security.

This legislation, the "Critical Information Infrastructure Act of 2002" (CII Act of 2002), imposes three significant restrictions on the use and disclosure of information that qualifies for protection under the Act: (1) the public cannot obtain access to the information under the FOIA or similar state laws; (2) government officials and private parties cannot use the information in civil action, even if the action concerns issues such as whether the business was at fault or violated applicable legal standards; (3) Federal officers or employees who knowingly "leak" the information in a manner not authorized by law can be prosecuted as criminals.

These restrictions do not apply to all information about critical infrastructures that business submits to the government.  Instead, Congress imposed a series of conditions that information must meet to qualify for protection. See CII Act of 2002, §§ 211-215

Nonetheless, the restrictions on access created by this new law create opportunities for abuse.  Businesses may submit information under the Act to avoid being held accountable for regulatory violations that the government was about to discover.  The law may also keep the public from learning about and debating how to address hazards that exist in facilities like nuclear power plants or chemical plants.  Government officials and businesses that fail to address vulnerabilities in computer systems, telephone networks and other critical infrastructures cannot be held accountable if the information necessary to understand these problems is systematically withheld from the government.

The Department of Homeland Security is charged with adopting regulatory procedures to implement this new law.  The proposed regulations were published for public comment on April 15, 2003.  Public Citizen and the Freedom of Information Clearinghouse have submitted comments that criticize the proposed regulations because the proposals fail to comply with the requirements that Congress imposed and they would restrict access to far more business information than Congress intended. The links below will take you to our comments and other documents on this issue.

• Proposed Regulations for Managing Critical Infrastructure Information Submitted to the Department of Homeland Security, Federal Register,(April 15, 2003)
• Comments on Proposed Regulations for Managing Critical Infrastructure Information Submitted to the Department of Homeland Security (June 16, 2003)

Because Public Citizen does not accept funds from corporations, professional associations or government agencies, we can remain independent and follow the truth wherever it may lead. But that means we depend on the generosity of concerned citizens like you for the resources to fight on behalf of the public interest. If you would like to help us in our fight, click here.