	Introduction

The terrorist attacks of September 11 prompted a limiting of public access to government information developed, obtained, or compiled for homeland security purposes. The accumulation of confidential business information from owners and operators of the nation's critical infrastructures, 85% of which is reportedly owned by the private sector, continues to be a critical component of homeland security efforts. Concerns that competitors, terrorists, and other "bad actors" might gain access to security-related information under the Freedom of Information Act (FOIA) prompted new confidentiality protections to promote information sharing between the private sector and the federal government and to prevent disclosure of certain types of security-related information under FOIA. The Aviation and Transportation Security Act of 2001 (ATSA); the Critical Infrastructure Information Act of 2002 in section 214 of the Homeland Security Act of 2002; the Maritime Transportation Security Act of 2002 (MTSA); and the Safe Drinking Water Act (SDWA), as amended by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, exempt certain types of security-related information from disclosure under the Freedom of Information Act. These statutes are examples of what are referred to as FOIA exemption 3 statutes; separate federal statutes prohibiting the disclosure of a certain type of information and authorizing its withholding under FOIA subsection (b)(3). This report describes the current state of the law with regard to the protection of security-related information. The protection of security-related information has developed from a series of laws, regulations, and executive orders. Congress has increasingly enacted exemption 3 statutes containing disclosure prohibitions that are specifically directed toward the Freedom of Information Act (FOIA).
The terrorist attacks of September 11 prompted a reevaluation of how to balance public access to information with the need for safety and security. The accumulation of confidential business information from owners and operators of the nation's critical infrastructures, 85% of which is reportedly owned by the private sector, continues to be an important component of homeland security efforts. Critical infrastructure sectors have been defined to include information technology; telecommunications; chemicals; transportation systems; including mass transit, aviation, maritime, ground/surface, and rail and pipeline systems; emergency services; postal and shipping; agriculture and food; public health and healthcare; drinking water and water treatment systems; energy, including oil and gas and electric power; banking and finance; the defense industrial base; and national monuments and icons. The Freedom of Information Act of 1974 (FOIA) along with other statutes and regulations provide legal authorities for the protection of various types of security-related information. Nevertheless, some owners and operators are hesitant to voluntarily share security-related information with the government because of the possible disclosure of this information to the public. To prohibit public disclosure of security-related information under the Freedom of Information Act and other laws, Congress has drafted and passed legislation designed to remove legal obstacles to information sharing. The Aviation and Transportation Security Act of 2001 (ATSA); the Critical Infrastructure Information Act of 2002 in section 214 of the Homeland Security Act; the Maritime Transportation Security Act of 2002 (MTSA); and the Safe Drinking Water Act (SDWA), as amended by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, each exempt certain types of security-related information from disclosure under the Freedom of Information Act. These statutes are examples of what are referred to as FOIA exemption 3 statutes; separate federal statutes prohibiting the disclosure of a certain type of information and authorizing its withholding under FOIA subsection (b)(3).
This report describes the current state of the law with regard to the protection of security-related information.