Both the House and Senate versions of the Homeland Security Act ( H.R. These activities and services have been referred to as components of the nation's critical infrastructure. In July 1996, President Clinton established the President's Commission on Critical Infrastructure Protection (PCCIP). The government is reluctant to disclose threat information that might compromise intelligence activities or investigations. The Commission noted that this might require that a legal vehicle be established within the critical infrastructure information sharing mechanism that would protect confidential information, and examined the ramifications of different approaches and strategies related to the federal government's protection of private sector information. 5005 and S. 2452 , respectively) included more detailed language exempting critical infrastructure information from FOIA. The purpose of the Freedom of Information Act (FOIA) was to ensure by statute citizen access to government information. With respect to the Freedom of Information Act, three of the nine exemptions from public disclosure provide possible protections against the release of homeland security and critical infrastructure information: exemption 1 (national security information), exemption 3 (information exempted by statute), and exemption 4 (confidential business information). H.R. 107-296 ). Generally, the legislation has specifically exempted the covered information from disclosure under FOIA, in effect creating an exemption 3 statute for purposes of FOIA. The D.C. The House language prevailed as Title II, Subtitle B, Section 214, in P.L. 5005 and S. 2452 , 107 th Congress . P.L. 107-269 ) exempted from disclosure under FOIA "critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered agency for use by that agency regarding the security of critical infrastructure (as defined in the USA PATRIOT Act) ... , when accompanied by an express statement.... " The Homeland Security Act defines critical infrastructure information to mean "information not customarily in the public domain and related to the security of critical infrastructure or protected systems—
(A) actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct (including misuse of or unauthorized access to all types of communications and data transmission systems) that violates federal, state, or local law, harms interstate commerce of the United States, or threatens public health and safety;
(B) the ability of critical infrastructures or protected systems to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk management planning, or risk audit; or,
(C)any planned or past operational problem or solution regarding critical infrastructure ... including repair, recovery, reconstruction, insurance, or continuity to the extent it relates to such interference, compromise, or incapacitation." 107-296 ) and S. 2452 . These differences included the scope of the information protection; the type of information covered and exempted from FOIA; the definition of a voluntary submission; the other purposes authorized for use or disclosure of the information; the disclosure of information with the consent of the submitter; the permissibility of disclosures of related information by other agencies; immunity from civil liability; preemption; and criminal penalties. Some public interest groups are concerned that the breadth of information that could be exempted from disclosure, combined with the prohibition on use of critical infrastructure information in any civil suit, could give owners or operators of critical infrastructures an "unprecedented immunity" from complying with a variety of laws (i.e., antitrust, tort, tax, civil rights, environmental, labor, consumer protection, and health and safety laws). Another argument made by the public interest groups is that existing FOIA exemptions and case law offer sufficient protections to owner/operators. Conclusion

Compelling arguments existed on both sides of the debate for and against exempting critical infrastructure information from the Freedom of Information Act. The provisions regarding the exemption of Critical Infrastructure Information from FOIA adopted the House language in total.
Critical infrastructures have been defined as those systems and assets so vital to the United States that the incapacity of such systems and assets would have a debilitating impact on the United States. One of the findings of the President's Commission on Critical Infrastructure Protection, established by President Clinton in 1996, was the need for the federal government and owners and operators of the nation's critical infrastructures to share information on vulnerabilities and threats. However, the Commission noted that owners and operators are reluctant to share confidential business information, and the government is reluctant to share information that might compromise intelligence sources or investigations. Among the strategies to promote information sharing was a proposal to exempt critical infrastructure information from disclosure under the Freedom of Information Act.
The Freedom of Information Act (FOIA) was passed to ensure by citizen access to government information. Nine categories of information may be exempted from disclosure. Three of the nine exemptions provide possible protection against the release of critical infrastructure information: exemption 1 (national security information); exemption 3 (information exempted by statute); and exemption 4 (confidential business information). Congress has considered several proposals to exempt critical infrastructure information from FOIA. Generally, the legislation has created an exemption 3 statute, or adopted the exemption 4 D.C. Circuit standard.
Prior to passage of the Homeland Security Act (P.L. 107-296), the House (H.R. 5005) and Senate (S. 2452) bills differed significantly on language providing a FOIA exemption. Differences included the type of information covered and exempted from FOIA; the scope of the protections provided; the authorized uses or disclosures; the permissibility of disclosures of related information by other agencies; immunity from civil liability; preemption; and criminal penalties. The Homeland Security Act (P.L. 107-296, section 214 ) provisions regarding the exemption of critical infrastructure information from FOIA adopted the House language in its entirety.
Public interest groups question the necessity of a FOIA exemption suggesting that existing FOIA exemptions provide sufficient protections.. They also argued that the House language (which passed) was too broad and would allow a wider range of information to be protected (including information previously available under FOIA). They favored the more limited protections proposed in the S. 2452. Public interest groups also expressed concern that the provision which bars use of the protected information in civil actions would shield owners and operators from liability under antitrust, tort, tax, civil rights, environmental, labor, consumer protection, and health and safety laws. Owners and operators of critical infrastructures insisted that current law did not provide the certainty of protection needed. While they viewed the Senate language as a workable compromise, they favored the protections in H.R. 5005. Compelling arguments existed on both sides of the debate for and against exempting critical infrastructure information from the Freedom of Information Act. S. 6, introduced in the 108th Congress, resurrects S. 2452 (107th Congress). This report will be updated as warranted.