FOIA Post (2003): Homeland Security Law Contains New Exemption 3 Statute

January 27, 2003

Homeland Security

Law Contains New Exemption 3 Statute

The law passed

by Congress this past fall to establish the new Department of Homeland Security

(DHS) -- the Homeland Security Act of 2002, Public Law 107-296 -- includes a

provision that will operate as a new "Exemption 3 statute" under the Freedom

of Information Act, 5 U.S.C. § 552(b)(3) (2000), for "critical infrastructure"

information that is obtained by that new federal department.

Subtitle B of the

Homeland Security Act, entitled "Critical Infrastructure Information," consists

of a group of provisions that address the circumstances under which the federal

government obtains and maintains such information. Section 214 of the Act, which

is entitled "Protection of Voluntarily Shared Critical Infrastructure Information,"

contains the new Exemption 3 statute. It states as follows:


any other provision of law, critical infrastructure information (including

the identity of the submitting person or entity) that is voluntarily submitted

to a covered Federal agency for use by that agency regarding the security

of critical infrastructure and protected systems, analysis, warning, interdependency

study, recovery, reconstitution, or other informational purpose, when accompanied

by an express statement [as specified below]

(A) shall

be exempt from disclosure under section 552 of title 5, United States

Code (commonly referred to as the Freedom of Information Act)[.]

Pub. L. No. 107-296,

116 Stat. 2135, § 214(a)(1)(A)

(to be codified at 6 U.S.C. § 133(a)(1)(A)).

In connection with

this provision, the new law includes an extensive definition of the term "critical

infrastructure information," see id. at § 212(3)(A)-(C), and it specifies

the types of "express statements" by information submitters that are required

to trigger the provision, see id. at § 214(a)(2)(A)-(B), which are

not unlike the marking requirements for the submission of business information

that are set forth in Executive Order 12,600 in conjunction with Exemption 4.


Update, Vol. VIII, No. 2, at 2-3. Section 212 of the Act also specifies

that "[t]he term 'covered Federal agency' means the Department of Homeland Security."

Pub. L. No. 107-296, 116 Stat. 2135, § 212(2);see also id. at

§ 214(c)

(adding that the provision does not apply to "independently obtained information").

Thus, this Exemption

3 statute provides new protection under the FOIA for information pertaining

to the nation's critical infrastructure that is voluntarily submitted to the

new Department of Homeland Security. It is in a statutory form that is a "growing

trend," in that it directly refers to the FOIA and thus is "specifically focused

on the prohibition of disclosure under the FOIA" in particular. Freedom

of Information Act Guide & Privacy Act Overview (May 2002), at

156-57 (discussing "this more narrow legislative approach to nondisclosure").


this legislation also explicitly contemplates the need to ensure consistent,

continued protection of all such information even if it is shared with a state

or local government in the course of DHS's activities. To cover that circumstance,

the Act specifically mandates that the critical infrastructure information now

exempt under the FOIA "shall not, if provided to a State or local government

. . . be made available pursuant to any State or local law requiring disclosure

of information or records." Pub. L. No. 107-296, 116 Stat. 2135, § 214(a)(1)(E)(i);see also id. at § 214(a)(1)(F) (guarding against "waiver of any applicable

privilege or protection provided under law"). This statute thus explicitly provides

for the "preemption" of state freedom of information laws by federal law with

respect to any question of whether there should be public disclosure of such

information. See also Freedom

of Information Act Guide & Privacy Act Overview (May 2002), at

563-64 (discussing operation of "preemption doctrine" in FOIA context).

Congress's enactment

of this Exemption 3 statute was somewhat controversial in that a more limited

version of it was developed in the Senate but was not considered by the full

Senate, or the House of Representatives, when Congress reconvened for its extraordinary

"lame duck" session in November and enacted the Homeland Security Act on an

accelerated schedule. The Act was approved by the House and the Senate in rapid

succession, as Congress moved quickly to ensure enactment, with relatively little

focus on its FOIA-related provisions. It also contains an additional provision

that makes it a criminal offense for any federal employee to "knowingly . .

. disclose[] . . . any critical infrastructure information [that is] protected

from disclosure" under it, without proper legal authorization. Pub. L. No. 107-296,

116 Stat. 2135, § 214(f). In this respect, it is akin to the Privacy Act of

1974, 5 U.S.C. § 552a (2000), and the Trade Secrets Act, 18 U.S.C. § 1905 (2000).

See Freedom of Information Act Guide & Privacy Act Overview (May

2002), at 754 & nn.13-14, 926

(discussing criminal prohibitions found in Trade Secrets Act and in Privacy

Act subsection (i)(1), respectively).

The new Department

of Homeland Security has now become the fifteenth Cabinet Department of the

federal government, the newest since the Department of Veterans Affairs was

elevated from agency to department status in 1989. As of today, it consists

of the Office of the Secretary and an initial staff of administrative components.

(See DHS Web site at

Under the timetable established by the Homeland Security Act, existing governmental

organizations of other federal departments and agencies will transfer to DHS

as of March 1. These include the Transportation Security Agency and the Coast

Guard from the Department of Transportation; the Federal Emergency Management

Agency; the Customs Service and the Secret Service from the Department of the

Treasury; and the Immigration and Naturalization Service from the Department

of Justice.

In addition, the

Homeland Security Act also transfers the Bureau of Alcohol, Tobacco and Firearms

from the Department of the Treasury to the Department of Justice, except for

a tax-related portion (approximately 10%) of it that will remain at the Treasury

Department. ATF has been renamed the "Bureau of Alcohol, Tobacco, Firearms,

and Explosives," as a reflection of its current responsibilities in that latter

area, but it likely will continue to be referred to as "ATF." This transfer

is effective as of today as well.   (posted 1/27/03)

Go to: Main

FOIA Post Page// DOJ FOIA Page //

DOJ Home Page

Updated August 6, 2014