FOIA Post (2003): Homeland Security Law Contains New Exemption 3 Statute

Homeland Security Law Contains New Exemption 3 Statute

The law passed by Congress this past fall to establish the new Department of Homeland Security (DHS) -- the Homeland Security Act of 2002, Public Law 107-296 -- includes a provision that will operate as a new "Exemption 3 statute" under the Freedom of Information Act, 5 U.S.C. § 552(b)(3) (2000), for "critical infrastructure" information that is obtained by that new federal department.

Subtitle B of the Homeland Security Act, entitled "Critical Infrastructure Information," consists of a group of provisions that address the circumstances under which the federal government obtains and maintains such information. Section 214 of the Act, which is entitled "Protection of Voluntarily Shared Critical Infrastructure Information," contains the new Exemption 3 statute. It states as follows:

Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructure and protected systems, analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement [as specified below]

(A) shall be exempt from disclosure under section 552 of title 5, United States Code (commonly referred to as the Freedom of Information Act)[.]

Pub. L. No. 107-296, 116 Stat. 2135, § 214(a)(1)(A) (to be codified at 6 U.S.C. § 133(a)(1)(A)).

In connection with this provision, the new law includes an extensive definition of the term "critical infrastructure information," see id. at § 212(3)(A)-(C), and it specifies the types of "express statements" by information submitters that are required to trigger the provision, see id. at § 214(a)(2)(A)-(B), which are not unlike the marking requirements for the submission of business information that are set forth in Executive Order 12,600 in conjunction with Exemption 4. See FOIA Update, Vol. VIII, No. 2, at 2-3. Section 212 of the Act also specifies that "[t]he term 'covered Federal agency' means the Department of Homeland Security." Pub. L. No. 107-296, 116 Stat. 2135, § 212(2); see also id. at § 214(c) (adding that the provision does not apply to "independently obtained information").

Thus, this Exemption 3 statute provides new protection under the FOIA for information pertaining to the nation's critical infrastructure that is voluntarily submitted to the new Department of Homeland Security. It is in a statutory form that is a "growing trend," in that it directly refers to the FOIA and thus is "specifically focused on the prohibition of disclosure under the FOIA" in particular. Freedom of Information Act Guide & Privacy Act Overview (May 2002), at 156-57 (discussing "this more narrow legislative approach to nondisclosure").

Significantly, this legislation also explicitly contemplates the need to ensure consistent, continued protection of all such information even if it is shared with a state or local government in the course of DHS's activities. To cover that circumstance, the Act specifically mandates that the critical infrastructure information now exempt under the FOIA "shall not, if provided to a State or local government . . . be made available pursuant to any State or local law requiring disclosure of information or records." Pub. L. No. 107-296, 116 Stat. 2135, § 214(a)(1)(E)(i); see also id. at § 214(a)(1)(F) (guarding against "waiver of any applicable privilege or protection provided under law"). This statute thus explicitly provides for the "preemption" of state freedom of information laws by federal law with respect to any question of whether there should be public disclosure of such information. See also Freedom of Information Act Guide & Privacy Act Overview (May 2002), at 563-64 (discussing operation of "preemption doctrine" in FOIA context).

Congress's enactment of this Exemption 3 statute was somewhat controversial in that a more limited version of it was developed in the Senate but was not considered by the full Senate, or the House of Representatives, when Congress reconvened for its extraordinary "lame duck" session in November and enacted the Homeland Security Act on an accelerated schedule. The Act was approved by the House and the Senate in rapid succession, as Congress moved quickly to ensure enactment, with relatively little focus on its FOIA-related provisions. It also contains an additional provision that makes it a criminal offense for any federal employee to "knowingly . . . disclose[] . . . any critical infrastructure information [that is] protected from disclosure" under it, without proper legal authorization. Pub. L. No. 107-296, 116 Stat. 2135, § 214(f). In this respect, it is akin to the Privacy Act of 1974, 5 U.S.C. § 552a (2000), and the Trade Secrets Act, 18 U.S.C. § 1905 (2000). See Freedom of Information Act Guide & Privacy Act Overview (May 2002), at 754 & nn.13-14, 926 (discussing criminal prohibitions found in Trade Secrets Act and in Privacy Act subsection (i)(1), respectively).

The new Department of Homeland Security has now become the fifteenth Cabinet Department of the federal government, the newest since the Department of Veterans Affairs was elevated from agency to department status in 1989. As of today, it consists of the Office of the Secretary and an initial staff of administrative components. (See DHS Web site at www.dhs.gov.) Under the timetable established by the Homeland Security Act, existing governmental organizations of other federal departments and agencies will transfer to DHS as of March 1. These include the Transportation Security Agency and the Coast Guard from the Department of Transportation; the Federal Emergency Management Agency; the Customs Service and the Secret Service from the Department of the Treasury; and the Immigration and Naturalization Service from the Department of Justice.

In addition, the Homeland Security Act also transfers the Bureau of Alcohol, Tobacco and Firearms from the Department of the Treasury to the Department of Justice, except for a tax-related portion (approximately 10%) of it that will remain at the Treasury Department. ATF has been renamed the "Bureau of Alcohol, Tobacco, Firearms, and Explosives," as a reflection of its current responsibilities in that latter area, but it likely will continue to be referred to as "ATF." This transfer is effective as of today as well. (posted 1/27/03)

Go to: Main FOIA Post Page// DOJ FOIA Page // DOJ Home Page