---
kind: "section"
citation: "6 U.S.C. § 673"
title: "6"
title_heading: "Domestic Security"
number: "673"
heading: "Protection of voluntarily shared critical infrastructure information"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/673"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part B — Critical Infrastructure Information"
---

# §673. Protection of voluntarily shared critical infrastructure information

- (a) **Protection—**
  - (1) **In general—** Notwithstanding any other provision of law, [critical infrastructure information](/usc/6/650.md?p=4) (including the identity of the submitting person or [entity](/usc/6/301c.md?p=2)) that is voluntarily submitted to a [covered Federal agency](/usc/6/671.md?p=2) for use by that [agency](/usc/6/650.md?p=1) regarding the security of [critical infrastructure](/usc/6/101.md?p=4) and [protected systems](/usc/6/671.md?p=5), analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement specified in [paragraph (2)](#a-2)—
    - (A) shall be exempt from disclosure under [section 552 of title 5](/usc/5/552.md) (commonly referred to as the Freedom of Information Act);
    - (B) shall not be subject to any [agency](/usc/6/650.md?p=1) rules or judicial doctrine regarding ex parte communications with a decision making official;
    - (C) shall not, without the written consent of the person or [entity](/usc/6/301c.md?p=2) submitting such information, be used directly by such [agency](/usc/6/650.md?p=1), any other Federal, [State](/usc/6/101.md?p=17), or local authority, or any third party, in any civil action arising under Federal or [State](/usc/6/101.md?p=17) law if such information is submitted in good faith;
    - (D) shall not, without the written consent of the person or [entity](/usc/6/301c.md?p=2) submitting such information, be used or disclosed by any officer or employee of the [United States](/usc/6/101.md?p=19-A) for purposes other than the purposes of this part, except—
      - (i) in furtherance of an investigation or the prosecution of a criminal act; or
      - (ii) when disclosure of the information would be—
        - (I) to either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee thereof or subcommittee of any such joint committee; or
        - (II) to the Comptroller General, or any authorized representative of the Comptroller General, in the course of the performance of the duties of the Government Accountability Office.[^1]
    - (E) shall not, if provided to a [State](/usc/6/101.md?p=17) or [local government](/usc/6/101.md?p=13) or government [agency](/usc/6/650.md?p=1)—
      - (i) be made available pursuant to any [State](/usc/6/101.md?p=17) or local law requiring disclosure of information or records;
      - (ii) otherwise be disclosed or distributed to any party by said [State](/usc/6/101.md?p=17) or [local government](/usc/6/101.md?p=13) or government [agency](/usc/6/650.md?p=1) without the written consent of the person or [entity](/usc/6/301c.md?p=2) submitting such information; or
      - (iii) be used other than for the purpose of protecting [critical infrastructure](/usc/6/101.md?p=4) or [protected systems](/usc/6/671.md?p=5), or in furtherance of an investigation or the prosecution of a criminal act; and
    - (F) does not constitute a waiver of any applicable privilege or protection provided under law, such as trade secret protection.
  - (2) **Express statement—** For purposes of [paragraph (1)](#a-1), the term “express statement”, with respect to information or records, means—
    - (A) in the case of written information or records, a written marking on the information or records substantially similar to the following: “This information is voluntarily submitted to the Federal Government in expectation of protection from disclosure as provided by the provisions of the Critical Infrastructure Information Act of 2002.”; or
    - (B) in the case of oral information, a similar written statement submitted within a reasonable period following the oral communication.
- (b) **Limitation—** No communication of [critical infrastructure information](/usc/6/650.md?p=4) to a [covered Federal agency](/usc/6/671.md?p=2) made pursuant to this part shall be considered to be an action subject to the requirements of chapter 10 of title 5.
- (c) **Independently obtained information—** Nothing in this section shall be construed to limit or otherwise affect the ability of a [State](/usc/6/101.md?p=17), local, or Federal Government [entity](/usc/6/301c.md?p=2), [agency](/usc/6/650.md?p=1), or authority, or any third party, under applicable law, to obtain [critical infrastructure information](/usc/6/650.md?p=4) in a manner not covered by [subsection (a)](#a), including any information lawfully and properly disclosed generally or broadly to the public and to use such information in any manner permitted by law. For purposes of this section a permissible use of independently obtained information includes the disclosure of such information under [section 2302(b)(8) of title 5](/usc/5/2302.md?p=b-8).
- (d) **Treatment of voluntary submittal of information—** The [voluntary](/usc/6/671.md?p=6-A) submittal to the Government of information or records that are protected from disclosure by this part shall not be construed to constitute compliance with any requirement to submit such information to a [Federal agency](/usc/6/677a.md?p=4) under any other provision of law.
- (e) **Procedures—**
  - (1) **In general—** The [Secretary](/usc/6/641.md?p=3) of the [Department](/usc/6/641.md?p=1) of [Homeland](/usc/6/101.md?p=1) Security shall, in consultation with appropriate representatives of the National Security [Council](/usc/6/681.md?p=2) and the Office of Science and Technology Policy, establish uniform procedures for the receipt, care, and storage by [Federal agencies](/usc/6/677a.md?p=4) of [critical infrastructure information](/usc/6/650.md?p=4) that is voluntarily submitted to the Government. The procedures shall be established not later than 90 days after November 25, 2002.
  - (2) **Elements—** The procedures established under [paragraph (1)](#e-1) shall include mechanisms regarding—
    - (A) the acknowledgement of receipt by [Federal agencies](/usc/6/677a.md?p=4) of [critical infrastructure information](/usc/6/650.md?p=4) that is voluntarily submitted to the Government;
    - (B) the maintenance of the identification of such information as voluntarily submitted to the Government for purposes of and subject to the provisions of this part;
    - (C) the care and storage of such information; and
    - (D) the protection and maintenance of the confidentiality of such information so as to permit the [sharing](/usc/6/650.md?p=26) of such information within the Federal Government and with [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), and the issuance of notices and warnings related to the protection of [critical infrastructure](/usc/6/101.md?p=4) and [protected systems](/usc/6/671.md?p=5), in such manner as to protect from public disclosure the identity of the submitting person or [entity](/usc/6/301c.md?p=2), or information that is proprietary, business sensitive, relates specifically to the submitting person or [entity](/usc/6/301c.md?p=2), and is otherwise not appropriately in the public domain.
- (f) **Penalties—** Whoever, being an officer or employee of the [United States](/usc/6/101.md?p=19-A) or of any [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) thereof, knowingly publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law, any [critical infrastructure information](/usc/6/650.md?p=4) protected from disclosure by this part coming to him in the course of this employment or official duties or by reason of any examination or investigation made by, or return, report, or record made to or filed with, such [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) or officer or employee thereof, shall be fined under [title 18](/usc/18.md), imprisoned not more than 1 year, or both, and shall be removed from office or employment.
- (g) **Authority to issue warnings—** The Federal Government may provide advisories, alerts, and warnings to relevant companies, targeted sectors, other governmental [entities](/usc/6/301c.md?p=2), or the general public regarding potential threats to [critical infrastructure](/usc/6/101.md?p=4) as appropriate. In issuing a warning, the Federal Government shall take appropriate actions to protect from disclosure—
  - (1) the source of any voluntarily submitted [critical infrastructure information](/usc/6/650.md?p=4) that forms the basis for the warning; or
  - (2) information that is proprietary, business sensitive, relates specifically to the submitting person or [entity](/usc/6/301c.md?p=2), or is otherwise not appropriately in the public domain.
- (h) **Authority to delegate—** The President may delegate authority to a [critical infrastructure protection program](/usc/6/671.md?p=4), designated under [section 672 of this title](/usc/6/672.md), to enter into a [voluntary](/usc/6/671.md?p=6-A) agreement to promote [critical infrastructure](/usc/6/101.md?p=4) security, including with any [Information Sharing and Analysis Organization](/usc/6/650.md?p=13), or a plan of action as otherwise defined in [section 4558 of title 50](/usc/50/4558.md).

## Footnotes

[^1]: So in original. The period probably should be a semicolon.

## Source credit

(Pub. L. 107–296, title XXII, § 2224, formerly title II, § 214, Nov. 25, 2002, 116 Stat. 2152; Pub. L. 108–271, § 8(b), July 7, 2004, 118 Stat. 814; Pub. L. 112–199, title I, § 111, Nov. 27, 2012, 126 Stat. 1472; renumbered title XXII, § 2224, and amended Pub. L. 115–278, § 2(g)(2)(H), (9)(B)(ii), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–286, § 4(a)(18), Dec. 27, 2022, 136 Stat. 4307.)

## Notes

### Editorial Notes

### References in Text

The Critical Infrastructure Information Act of 2002, referred to in subsec. (a)(2)(A), is subtitle B (§ 2221 et seq.) of title XXII of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2150, which is classified generally to this part. For complete classification of this Act to the Code, see Short Title note set out under section 101 of this title and Tables.

### Codification

Section was formerly classified to section 133 of this title prior to renumbering by Pub. L. 115–278.

### Amendments

2022—Subsec. (b). Pub. L. 117–286 substituted “chapter 10 of title 5.” for “the Federal Advisory Committee Act.”

2018—Subsec. (h). Pub. L. 115–278, § 2(g)(9)(B)(ii), substituted “section 672 of this title” for “section 132 of this title”.

2012—Subsec. (c). Pub. L. 112–199 inserted at end “For purposes of this section a permissible use of independently obtained information includes the disclosure of such information under section 2302(b)(8) of title 5.”

2004—Subsec. (a)(1)(D)(ii)(II). Pub. L. 108–271 substituted “Government Accountability Office” for “General Accounting Office”.

### Statutory Notes and Related Subsidiaries

### Effective Date of 2012 Amendment

Amendment by Pub. L. 112–199 effective 30 days after Nov. 27, 2012, see section 202 of Pub. L. 112–199, set out as a note under section 1204 of Title 5, Government Organization and Employees.