6 U.S.C. § 671 — Definitions

Page 378 TITLE 6—DOMESTIC SECURITY § 671 1 So in original. The word ‘‘and’’ probably should not appear. 2 So in original. Probably should be followed by ‘‘and’’. (C) trainings and courses that cover cyber defense strategies for industrial control sys- tems, including an understanding of the unique cyber threats facing industrial con- trol systems and the mitigation of security vulnerabilities in industrial control systems technology; and (D) appropriate consideration regarding the availability of trainings and courses in different regions of the United States; and 1 (2) engage in— (A) collaboration with the National Lab- oratories of the Department of Energy in ac- cordance with section 189 of this title; (B) consultation with Sector Risk Manage- ment Agencies;2 (C) as appropriate, consultation with pri- vate sector entities with relevant expertise, such as vendors of industrial control sys- tems technologies; and (3) consult, to the maximum extent prac- ticable, with commercial training providers and academia to minimize the potential for duplication of other training opportunities. (c) Reports (1) In general Not later than one year after December 23, 2022, and annually thereafter, the Director shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on the Initiative. (2) Contents Each report submitted under paragraph (1) shall include the following: (A) A description of the courses provided under the Initiative. (B) A description of outreach efforts to raise awareness of the availability of such courses. (C) The number of participants in each course. (D) Voluntarily provided information on the demographics of participants in such courses, including by sex, race, and place of residence. (E) Information on the participation in such courses of workers from each critical infrastructure sector. (F) Plans for expanding access to indus- trial control systems education and train- ing, including expanding access to women and underrepresented populations, and ex- panding access to different regions of the United States. (G) Recommendations regarding how to strengthen the state of industrial control systems cybersecurity education and train- ing. (Pub. L. 107–296, title XXII, § 2220E, as added Pub. L. 117–263, div. G, title LXXI, § 7122(a), Dec. 23, 2022, 136 Stat. 3640.) PART B—CRITICAL INFRASTRUCTURE INFORMATION Editorial Notes CODIFICATION Subtitle B of title XXII of Pub. L. 107–296, comprising this part, was originally added as subtitle B of title II of Pub. L. 107–296, and was classified to part B (§ 131 et seq.) of subchapter II of this chapter. Subtitle B of title II of Pub. L. 107–296 was subsequently redesignated sub- title B of title XXII of Pub. L. 107–296 by Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178, and transferred to this part. § 671. Definitions In this part: (1) Agency The term ‘‘agency’’ has the meaning given it in section 551 of title 5. (2) Covered Federal agency The term ‘‘covered Federal agency’’ means the Department of Homeland Security. (3) Critical infrastructure information The term ‘‘critical infrastructure informa- tion’’ has the meaning given the term in sec- tion 650 of this title. (4) Critical infrastructure protection program The term ‘‘critical infrastructure protection program’’ means any component or bureau of a covered Federal agency that has been des- ignated by the President or any agency head to receive critical infrastructure information. (5) Protected system The term ‘‘protected system’’— (A) means any service, physical or com- puter-based system, process, or procedure that directly or indirectly affects the viabil- ity of a facility of critical infrastructure; and (B) includes any physical or computer- based system, including a computer, com- puter system, computer or communications network, or any component hardware or ele- ment thereof, software program, processing instructions, or information or data in transmission or storage therein, irrespective of the medium of transmission or storage. (6) Voluntary (A) In general The term ‘‘voluntary’’, in the case of any submittal of critical infrastructure informa- tion to a covered Federal agency, means the submittal thereof in the absence of such agency’s exercise of legal authority to com- pel access to or submission of such informa- tion and may be accomplished by a single entity or an Information Sharing and Anal- ysis Organization on behalf of itself or its members. (B) Exclusions The term ‘‘voluntary’’— (i) in the case of any action brought under the securities laws as is defined in section 78c(a)(47) of title 15— (I) does not include information or statements contained in any documents Page 379 TITLE 6—DOMESTIC SECURITY § 673 or materials filed with the Securities and Exchange Commission, or with Fed- eral banking regulators, pursuant to sec- tion 78l(i) of title 15; and (II) with respect to the submittal of critical infrastructure information, does not include any disclosure or writing that when made accompanied the solici- tation of an offer or a sale of securities; and (ii) does not include information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory pro- ceedings. (Pub. L. 107–296, title XXII, § 2222, formerly title II, § 212, Nov. 25, 2002, 116 Stat. 2150; Pub. L. 114–113, div. N, title II, § 204, Dec. 18, 2015, 129 Stat. 2961; renumbered title XXII, § 2222, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(i), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(M), Dec. 23, 2022, 136 Stat. 3661.) Editorial Notes CODIFICATION Section was formerly classified to section 131 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Par. (3). Pub. L. 117–263, § 7143(b)(2)(M)(i), added par. (3) and struck out former par. (3) which defined critical infrastructure information. Pars. (5) to (8). Pub. L. 117–263, § 7143(b)(2)(M)(ii), (iii), redesignated pars. (6) and (7) as (5) and (6), respectively, and struck out former pars. (5) and (8) which defined In- formation Sharing and Analysis Organization and cybersecurity risk and incident, respectively. 2018—Par. (8). Pub. L. 115–278, § 2(g)(9)(B)(i), sub- stituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title’’. 2015—Par. (5)(A). Pub. L. 114–113, § 204(1)(A), inserted ‘‘, including information related to cybersecurity risks and incidents,’’ after ‘‘critical infrastructure informa- tion’’ and ‘‘, including cybersecurity risks and inci- dents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(B). Pub. L. 114–113, § 204(1)(B), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’ and ‘‘, including cybersecurity risks and incidents,’’ after ‘‘related to critical infrastructure’’. Par. (5)(C). Pub. L. 114–113, § 204(1)(C), inserted ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure information’’. Par. (8). Pub. L. 114–113, § 204(2), added par. (8). Statutory Notes and Related Subsidiaries SHORT TITLE For short title of this part as the ‘‘Critical Infra- structure Information Act of 2002’’, see section 2221 of Pub. L. 107–296, set out as a note under section 101 of this title. PROHIBITION ON NEW REGULATORY AUTHORITY Pub. L. 114–113, div. N, title II, § 210, Dec. 18, 2015, 129 Stat. 2962, provided that: ‘‘Nothing in this subtitle [sub- title A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title] or the amendments made by this subtitle may be construed to grant the Secretary any authority to promulgate regulations or set stand- ards relating to the cybersecurity of non-Federal enti- ties, not including State, local, and tribal governments, that was not in effect on the day before the date of en- actment of this Act [Dec. 18, 2015].’’ DEFINITIONS Pub. L. 114–113, div. N, title II, § 202, Dec. 18, 2015, 129 Stat. 2956, as amended by Pub. L. 115–278, § 2(h)(1)(A), Nov. 16, 2018, 132 Stat. 4181, provided that: ‘‘In this sub- title [subtitle A (§§ 201–211) of title II of div. N of Pub. L. 114–113, see Short Title of 2015 Amendment note set out under section 101 of this title]: ‘‘(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘appropriate congressional committees’ means— ‘‘(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and ‘‘(B) the Committee on Homeland Security of the House of Representatives. ‘‘(2) CYBERSECURITY RISK; INCIDENT.—The terms ‘cybersecurity risk’ and ‘incident’ have the meanings given those terms in section 2209 of the Homeland Se- curity Act of 2002 [6 U.S.C. 659] [see now 6 U.S.C. 650]. ‘‘(3) CYBER THREAT INDICATOR; DEFENSIVE MEAS- URE.—The terms ‘cyber threat indicator’ and ‘defen- sive measure’ have the meanings given those terms in section 102 [6 U.S.C. 1501]. ‘‘(4) DEPARTMENT.—The term ‘Department’ means the Department of Homeland Security. ‘‘(5) SECRETARY.—The term ‘Secretary’ means the Secretary of Homeland Security.’’ § 672. Designation of critical infrastructure pro- tection program A critical infrastructure protection program may be designated as such by one of the fol- lowing: (1) The President. (2) The Secretary of Homeland Security. (Pub. L. 107–296, title XXII, § 2223, formerly title II, § 213, Nov. 25, 2002, 116 Stat. 2152; renumbered title XXII, § 2223, Pub. L. 115–278, § 2(g)(2)(H), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 132 of this title prior to renumbering by Pub. L. 115–278. § 673. Protection of voluntarily shared critical in- frastructure information (a) Protection (1) In general Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or enti- ty) that is voluntarily submitted to a covered Federal agency for use by that agency regard- ing the security of critical infrastructure and protected systems, analysis, warning, inter- dependency study, recovery, reconstitution, or other informational purpose, when accom- panied by an express statement specified in paragraph (2)— (A) shall be exempt from disclosure under section 552 of title 5 (commonly referred to as the Freedom of Information Act); (B) shall not be subject to any agency rules or judicial doctrine regarding ex parte communications with a decision making of- ficial; (C) shall not, without the written consent of the person or entity submitting such in-