6 U.S.C. § 673 — Protection of voluntarily shared critical in-

Page 379 TITLE 6—DOMESTIC SECURITY § 673 or materials filed with the Securities and Exchange Commission, or with Fed- eral banking regulators, pursuant to sec- tion 78l(i) of title 15; and (II) with respect to the submittal of critical infrastructure information, does not include any disclosure or writing that when made accompanied the solici- tation of an offer or a sale of securities; and (ii) does not include information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory pro- ceedings. (Pub. L. 107–296, title XXII, § 2222, formerly title II, § 212, Nov. 25, 2002, 116 Stat. 2150; Pub. L. 114–113, div. N, title II, § 204, Dec. 18, 2015, 129 Stat. 2961; renumbered title XXII, § 2222, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(i), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(M), Dec. 23, 2022, 136 Stat. 3661.) Editorial Notes CODIFICATION Section was formerly classified to section 131 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Par. (3). Pub. L. 117–263, § 7143(b)(2)(M)(i), added par. (3) and struck out former par. (3) which defined critical infrastructure information. Pars. (5) to (8). Pub. L. 117–263, § 7143(b)(2)(M)(ii), (iii), redesignated pars. (6) and (7) as (5) and (6), respectively, and struck out former pars. (5) and (8) which defined In- formation Sharing and Analysis Organization and cybersecurity risk and incident, respectively. 2018—Par. (8). Pub. L. 115–278, § 2(g)(9)(B)(i), sub- stituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title’’. 2015—Par. (5)(A). Pub. L. 114–113, § 204(1)(A), inserted ‘‘, including information related to cybersecurity risks and incidents,’’ after ‘‘critical infrastructure informa- tion’’ and ‘‘, including cybersecurity risks and inci- dents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(B). Pub. L. 114–113, § 204(1)(B), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’ and ‘‘, including cybersecurity risks and incidents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(C). Pub. L. 114–113, § 204(1)(C), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’. Par. (8). Pub. L. 114–113, § 204(2), added par. (8). Statutory Notes and Related Subsidiaries SHORT TITLE For short title of this part as the ‘‘Critical Infra- structure Information Act of 2002’’, see section 2221 of Pub. L. 107–296, set out as a note under section 101 of this title. PROHIBITION ON NEW REGULATORY AUTHORITY Pub. L. 114–113, div. N, title II, § 210, Dec. 18, 2015, 129 Stat. 2962, provided that: ‘‘Nothing in this subtitle [sub- title A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title] or the amendments made by this subtitle may be construed to grant the Secretary any authority to promulgate regulations or set stand- ards relating to the cybersecurity of non-Federal enti- ties, not including State, local, and tribal governments, that was not in effect on the day before the date of en- actment of this Act [Dec. 18, 2015].’’ DEFINITIONS Pub. L. 114–113, div. N, title II, § 202, Dec. 18, 2015, 129 Stat. 2956, as amended by Pub. L. 115–278, § 2(h)(1)(A), Nov. 16, 2018, 132 Stat. 4181, provided that: ‘‘In this sub- title [subtitle A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title]: ‘‘(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘appropriate congressional committees’ means— ‘‘(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and ‘‘(B) the Committee on Homeland Security of the House of Representatives. ‘‘(2) CYBERSECURITY RISK; INCIDENT.—The terms ‘cybersecurity risk’ and ‘incident’ have the meanings given those terms in section 2209 of the Homeland Se- curity Act of 2002 [6 U.S.C. 659] [see now 6 U.S.C. 650]. ‘‘(3) CYBER THREAT INDICATOR; DEFENSIVE MEAS- URE.—The terms ‘cyber threat indicator’ and ‘defen- sive measure’ have the meanings given those terms in section 102 [6 U.S.C. 1501]. ‘‘(4) DEPARTMENT.—The term ‘Department’ means the Department of Homeland Security. ‘‘(5) SECRETARY.—The term ‘Secretary’ means the Secretary of Homeland Security.’’ § 672. Designation of critical infrastructure pro- tection program A critical infrastructure protection program may be designated as such by one of the fol- lowing: (1) The President. (2) The Secretary of Homeland Security. (Pub. L. 107–296, title XXII, § 2223, formerly title II, § 213, Nov. 25, 2002, 116 Stat. 2152; renumbered title XXII, § 2223, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 132 of this title prior to renumbering by Pub. L. 115–278. § 673. Protection of voluntarily shared critical in- frastructure information (a) Protection (1) In general Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or enti- ty) that is voluntarily submitted to a covered Federal agency for use by that agency regard- ing the security of critical infrastructure and protected systems, analysis, warning, inter- dependency study, recovery, reconstitution, or other informational purpose, when accom- panied by an express statement specified in paragraph (2)— (A) shall be exempt from disclosure under section 552 of title 5 (commonly referred to as the Freedom of Information Act); (B) shall not be subject to any agency rules or judicial doctrine regarding ex parte communications with a decision making of- ficial; (C) shall not, without the written consent of the person or entity submitting such in- Page 380 TITLE 6—DOMESTIC SECURITY § 673 1 So in original. The period probably should be a semicolon. formation, be used directly by such agency, any other Federal, State, or local authority, or any third party, in any civil action aris- ing under Federal or State law if such infor- mation is submitted in good faith; (D) shall not, without the written consent of the person or entity submitting such in- formation, be used or disclosed by any offi- cer or employee of the United States for pur- poses other than the purposes of this part, except— (i) in furtherance of an investigation or the prosecution of a criminal act; or (ii) when disclosure of the information would be— (I) to either House of Congress, or to the extent of matter within its jurisdic- tion, any committee or subcommittee thereof, any joint committee thereof or subcommittee of any such joint com- mittee; or (II) to the Comptroller General, or any authorized representative of the Comp- troller General, in the course of the per- formance of the duties of the Govern- ment Accountability Office.1 (E) shall not, if provided to a State or local government or government agency— (i) be made available pursuant to any State or local law requiring disclosure of information or records; (ii) otherwise be disclosed or distributed to any party by said State or local govern- ment or government agency without the written consent of the person or entity submitting such information; or (iii) be used other than for the purpose of protecting critical infrastructure or pro- tected systems, or in furtherance of an in- vestigation or the prosecution of a crimi- nal act; and (F) does not constitute a waiver of any ap- plicable privilege or protection provided under law, such as trade secret protection. (2) Express statement For purposes of paragraph (1), the term ‘‘ex- press statement’’, with respect to information or records, means— (A) in the case of written information or records, a written marking on the informa- tion or records substantially similar to the following: ‘‘This information is voluntarily submitted to the Federal Government in ex- pectation of protection from disclosure as provided by the provisions of the Critical In- frastructure Information Act of 2002.’’; or (B) in the case of oral information, a simi- lar written statement submitted within a reasonable period following the oral commu- nication. (b) Limitation No communication of critical infrastructure information to a covered Federal agency made pursuant to this part shall be considered to be an action subject to the requirements of chapter 10 of title 5. (c) Independently obtained information Nothing in this section shall be construed to limit or otherwise affect the ability of a State, local, or Federal Government entity, agency, or authority, or any third party, under applicable law, to obtain critical infrastructure informa- tion in a manner not covered by subsection (a), including any information lawfully and properly disclosed generally or broadly to the public and to use such information in any manner per- mitted by law. For purposes of this section a permissible use of independently obtained infor- mation includes the disclosure of such informa- tion under section 2302(b)(8) of title 5. (d) Treatment of voluntary submittal of informa- tion The voluntary submittal to the Government of information or records that are protected from disclosure by this part shall not be construed to constitute compliance with any requirement to submit such information to a Federal agency under any other provision of law. (e) Procedures (1) In general The Secretary of the Department of Home- land Security shall, in consultation with ap- propriate representatives of the National Se- curity Council and the Office of Science and Technology Policy, establish uniform proce- dures for the receipt, care, and storage by Fed- eral agencies of critical infrastructure infor- mation that is voluntarily submitted to the Government. The procedures shall be estab- lished not later than 90 days after November 25, 2002. (2) Elements The procedures established under paragraph (1) shall include mechanisms regarding— (A) the acknowledgement of receipt by Federal agencies of critical infrastructure information that is voluntarily submitted to the Government; (B) the maintenance of the identification of such information as voluntarily sub- mitted to the Government for purposes of and subject to the provisions of this part; (C) the care and storage of such informa- tion; and (D) the protection and maintenance of the confidentiality of such information so as to permit the sharing of such information with- in the Federal Government and with State and local governments, and the issuance of notices and warnings related to the protec- tion of critical infrastructure and protected systems, in such manner as to protect from public disclosure the identity of the submit- ting person or entity, or information that is proprietary, business sensitive, relates spe- cifically to the submitting person or entity, and is otherwise not appropriately in the public domain. (f) Penalties Whoever, being an officer or employee of the United States or of any department or agency thereof, knowingly publishes, divulges, dis- closes, or makes known in any manner or to any extent not authorized by law, any critical infra- Page 381 TITLE 6—DOMESTIC SECURITY § 677a structure information protected from disclosure by this part coming to him in the course of this employment or official duties or by reason of any examination or investigation made by, or return, report, or record made to or filed with, such department or agency or officer or em- ployee thereof, shall be fined under title 18, im- prisoned not more than 1 year, or both, and shall be removed from office or employment. (g) Authority to issue warnings The Federal Government may provide advisories, alerts, and warnings to relevant com- panies, targeted sectors, other governmental en- tities, or the general public regarding potential threats to critical infrastructure as appropriate. In issuing a warning, the Federal Government shall take appropriate actions to protect from disclosure— (1) the source of any voluntarily submitted critical infrastructure information that forms the basis for the warning; or (2) information that is proprietary, business sensitive, relates specifically to the submit- ting person or entity, or is otherwise not ap- propriately in the public domain. (h) Authority to delegate The President may delegate authority to a critical infrastructure protection program, des- ignated under section 672 of this title, to enter into a voluntary agreement to promote critical infrastructure security, including with any In- formation Sharing and Analysis Organization, or a plan of action as otherwise defined in sec- tion 4558 of title 50. (Pub. L. 107–296, title XXII, § 2224, formerly title II, § 214, Nov. 25, 2002, 116 Stat. 2152; Pub. L. 108–271, § 8(b), July 7, 2004, 118 Stat. 814; Pub. L. 112–199, title I, § 111, Nov. 27, 2012, 126 Stat. 1472; renumbered title XXII, § 2224, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(ii), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–286, § 4(a)(18), Dec. 27, 2022, 136 Stat. 4307.) Editorial Notes REFERENCES IN TEXT The Critical Infrastructure Information Act of 2002, referred to in subsec. (a)(2)(A), is subtitle B (§ 2221 et seq.) of title XXII of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2150, which is classified generally to this part. For complete classification of this Act to the Code, see Short Title note set out under section 101 of this title and Tables. CODIFICATION Section was formerly classified to section 133 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Subsec. (b). Pub. L. 117–286 substituted ‘‘chapter 10 of title 5.’’ for ‘‘the Federal Advisory Committee Act.’’ 2018—Subsec. (h). Pub. L. 115–278, § 2(g)(9)(B)(ii), sub- stituted ‘‘section 672 of this title’’ for ‘‘section 132 of this title’’. 2012—Subsec. (c). Pub. L. 112–199 inserted at end ‘‘For purposes of this section a permissible use of independ- ently obtained information includes the disclosure of such information under section 2302(b)(8) of title 5.’’ 2004—Subsec. (a)(1)(D)(ii)(II). Pub. L. 108–271 sub- stituted ‘‘Government Accountability Office’’ for ‘‘Gen- eral Accounting Office’’. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF 2012 AMENDMENT Amendment by Pub. L. 112–199 effective 30 days after Nov. 27, 2012, see section 202 of Pub. L. 112–199, set out as a note under section 1204 of Title 5, Government Or- ganization and Employees. § 674. No private right of action Nothing in this part may be construed to cre- ate a private right of action for enforcement of any provision of this chapter. (Pub. L. 107–296, title XXII, § 2225, formerly title II, § 215, Nov. 25, 2002, 116 Stat. 2155; renumbered title XXII, § 2225, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes REFERENCES IN TEXT This chapter, referred to in text, was in the original ‘‘this Act’’, meaning Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2135, known as the Homeland Security Act of 2002, which is classified principally to this chapter. For com- plete classification of this Act to the Code, see Short Title note set out under section 101 of this title and Ta- bles. CODIFICATION Section was formerly classified to section 134 of this title prior to renumbering by Pub. L. 115–278. PART C—DECLARATION OF A SIGNIFICANT INCIDENT § 677. Sense of Congress It is the sense of Congress that— (1) the purpose of this part is to authorize the Secretary to declare that a significant in- cident has occurred and to establish the au- thorities that are provided under the declara- tion to respond to and recover from the sig- nificant incident; and (2) the authorities established under this part are intended to enable the Secretary to provide voluntary assistance to non-Federal entities impacted by a significant incident. (Pub. L. 107–296, title XXII, § 2231, as added Pub. L. 117–58, div. G, title VI, § 70602(a), Nov. 15, 2021, 135 Stat. 1267.) § 677a. Definitions For the purposes of this part: (1) Asset response activity The term ‘‘asset response activity’’ means an activity to support an entity impacted by an incident with the response to, remediation of, or recovery from, the incident, including— (A) furnishing technical and advisory as- sistance to the entity to protect the assets of the entity, mitigate vulnerabilities, and reduce the related impacts; (B) assessing potential risks to the critical infrastructure sector or geographic region impacted by the incident, including poten- tial cascading effects of the incident on other critical infrastructure sectors or geo- graphic regions; (C) developing courses of action to miti- gate the risks assessed under subparagraph (B);