6 U.S.C. § 672 — Designation of critical infrastructure pro-

Page 379 TITLE 6—DOMESTIC SECURITY § 673 or materials filed with the Securities and Exchange Commission, or with Fed- eral banking regulators, pursuant to sec- tion 78l(i) of title 15; and (II) with respect to the submittal of critical infrastructure information, does not include any disclosure or writing that when made accompanied the solici- tation of an offer or a sale of securities; and (ii) does not include information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory pro- ceedings. (Pub. L. 107–296, title XXII, § 2222, formerly title II, § 212, Nov. 25, 2002, 116 Stat. 2150; Pub. L. 114–113, div. N, title II, § 204, Dec. 18, 2015, 129 Stat. 2961; renumbered title XXII, § 2222, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(i), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(M), Dec. 23, 2022, 136 Stat. 3661.) Editorial Notes CODIFICATION Section was formerly classified to section 131 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Par. (3). Pub. L. 117–263, § 7143(b)(2)(M)(i), added par. (3) and struck out former par. (3) which defined critical infrastructure information. Pars. (5) to (8). Pub. L. 117–263, § 7143(b)(2)(M)(ii), (iii), redesignated pars. (6) and (7) as (5) and (6), respectively, and struck out former pars. (5) and (8) which defined In- formation Sharing and Analysis Organization and cybersecurity risk and incident, respectively. 2018—Par. (8). Pub. L. 115–278, § 2(g)(9)(B)(i), sub- stituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title’’. 2015—Par. (5)(A). Pub. L. 114–113, § 204(1)(A), inserted ‘‘, including information related to cybersecurity risks and incidents,’’ after ‘‘critical infrastructure informa- tion’’ and ‘‘, including cybersecurity risks and inci- dents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(B). Pub. L. 114–113, § 204(1)(B), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’ and ‘‘, including cybersecurity risks and incidents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(C). Pub. L. 114–113, § 204(1)(C), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’. Par. (8). Pub. L. 114–113, § 204(2), added par. (8). Statutory Notes and Related Subsidiaries SHORT TITLE For short title of this part as the ‘‘Critical Infra- structure Information Act of 2002’’, see section 2221 of Pub. L. 107–296, set out as a note under section 101 of this title. PROHIBITION ON NEW REGULATORY AUTHORITY Pub. L. 114–113, div. N, title II, § 210, Dec. 18, 2015, 129 Stat. 2962, provided that: ‘‘Nothing in this subtitle [sub- title A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title] or the amendments made by this subtitle may be construed to grant the Secretary any authority to promulgate regulations or set stand- ards relating to the cybersecurity of non-Federal enti- ties, not including State, local, and tribal governments, that was not in effect on the day before the date of en- actment of this Act [Dec. 18, 2015].’’ DEFINITIONS Pub. L. 114–113, div. N, title II, § 202, Dec. 18, 2015, 129 Stat. 2956, as amended by Pub. L. 115–278, § 2(h)(1)(A), Nov. 16, 2018, 132 Stat. 4181, provided that: ‘‘In this sub- title [subtitle A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title]: ‘‘(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘appropriate congressional committees’ means— ‘‘(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and ‘‘(B) the Committee on Homeland Security of the House of Representatives. ‘‘(2) CYBERSECURITY RISK; INCIDENT.—The terms ‘cybersecurity risk’ and ‘incident’ have the meanings given those terms in section 2209 of the Homeland Se- curity Act of 2002 [6 U.S.C. 659] [see now 6 U.S.C. 650]. ‘‘(3) CYBER THREAT INDICATOR; DEFENSIVE MEAS- URE.—The terms ‘cyber threat indicator’ and ‘defen- sive measure’ have the meanings given those terms in section 102 [6 U.S.C. 1501]. ‘‘(4) DEPARTMENT.—The term ‘Department’ means the Department of Homeland Security. ‘‘(5) SECRETARY.—The term ‘Secretary’ means the Secretary of Homeland Security.’’ § 672. Designation of critical infrastructure pro- tection program A critical infrastructure protection program may be designated as such by one of the fol- lowing: (1) The President. (2) The Secretary of Homeland Security. (Pub. L. 107–296, title XXII, § 2223, formerly title II, § 213, Nov. 25, 2002, 116 Stat. 2152; renumbered title XXII, § 2223, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 132 of this title prior to renumbering by Pub. L. 115–278. § 673. Protection of voluntarily shared critical in- frastructure information (a) Protection (1) In general Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or enti- ty) that is voluntarily submitted to a covered Federal agency for use by that agency regard- ing the security of critical infrastructure and protected systems, analysis, warning, inter- dependency study, recovery, reconstitution, or other informational purpose, when accom- panied by an express statement specified in paragraph (2)— (A) shall be exempt from disclosure under section 552 of title 5 (commonly referred to as the Freedom of Information Act); (B) shall not be subject to any agency rules or judicial doctrine regarding ex parte communications with a decision making of- ficial; (C) shall not, without the written consent of the person or entity submitting such in-