Skip to Page Content
Home  |  Contact Us  |  Press Room  |  Site Overview  |  Help  |  Login  |  Register
Add to MyNCSL

Protecting Water System Security Information -- 2006 Update


March 2007

By:  Cathy Atkins, Program Principal, National Conference of State Legislatures

Contents

After the attacks of September 11, 2001, states and territories began to assess their open records statutes, usually referred to as Freedom of Information Acts (FOIA), in order to ensure that certain information pertaining to water system infrastructure security was safeguarded from public disclosure where appropriate.  As of this writing, 49 states and territories have protections in place to exempt such information from disclosure; only three appear to have no protection in place and one has protections that seem uncertain.  This document is an update to Protecting Water System Security Information, published by the National Conference of State Legislatures (NCSL) in September 2003.  For that document and the current effort, NCSL conducted an extensive review of state FOIA statutes as they pertain to water system infrastructure.

The information in this document, as in the first publication, is presented in multiple parts.  Part one presents an overview of NCSL's analysis of the status of exemptions from public disclosure requirements for water system security information in each FOIA statute.  Part two is a matrix summary of each state's or territory's exemptions, part three is a narrative summary of each state's or territory's exemptions and part four summarizes relevant state legislation enacted, passed but vetoed or still under consideration during legislative sessions from 2004 through 2006.

As in the original report, the information presented in this report reflects the interpretation of NCSL staff based on a thorough review of state and territory FOIA statutes.  Neither the findings of this report nor the original should be construed as legal opinions of the pertinent state or territory attorney general.

Analysis of Water Security System Exemptions

After completing the statutory analysis of the various FOIAs, NCSL staff determined that 49 states, territories and the District of Columbia appear to have an exemption from public disclosure requirements for water system security information in their FOIA statutes.  Generally, the exemptions fall into one of four categories:

  • States and jurisdictions with exemptions from public disclosure requirements for water system security information that specifically mention vulnerability assessments;
  • States and jurisdiction that have an exemption for information protected by federal or state laws, whether that protection be statutory or judicial in nature;
  • States and jurisdictions that have an exemption for information the release of which reasonably poses a threat to public health and/or security; and
  • States and jurisdictions that have an uncertain exemption status.


Thirty-seven states and the District of Columbia have a specific exemption from public disclosure requirements for vulnerability assessments of water system security to their FOIA law.  Although the wording of the statutes varies greatly, the relevant statute usually provides that vulnerability assessments are not considered to be a public record that is required to be disclosed under the state's FOIA law.  The states are shown in Figure 1.  Six states have provisions exempting such information from disclosure requirements because federal law requires such an exemption.  Those states are listed in Figure 2.  An additional 4 states and the Virgin Islands exempt the disclosure under a general public health or security components of state statutes.  These entities are listed in Figure 3.  Two states and Puerto Rico have an uncertain exemption status.

For the most part, states and jurisdictions with a specific exemption had that in place by the fall of 2003.  Several states and jurisdictions have updated the freedom of information act since 2003 to address specifically certain security procedures, although these may not have mentioned vulnerability assessments, per se.

Figure 1:  States/Jurisdictions That Have Specific Exemptions

Alabama

Georgia

Massachusetts

Rhode Island

Alaska

Idaho

Michigan

Tennessee

Arizona

Illinois

Nebraska

Texas

Arkansas

Indiana

Nevada

Vermont

California

Iowa

New Mexico

Virginia

Colorado

Kansas

North Carolina

Washington

Connecticut

Kentucky

North Dakota

West Virginia

Delaware

Louisiana

Ohio

Wyoming

District of Columbia

Maine

Oklahoma

 

Florida

Maryland

Oregon

 

Figure 2:  States That Have Exemptions for Information Protected by Federal or State Law

Hawaii

Pennsylvania

Mississippi

Utah

New York

Wisconsin

Notes: Wisc. Stat. §19.36(1) provides that information protected by federal or state law is exempt from disclosure.  Additionally, in his veto message regarding SB 8 in 2004, Governor Jim Doyle indicated that he was vetoing the bill because the state's provisions for making such decisions on a case-by-case basis provided the necessary protections for vulnerability assessments and infrastructure security while maintaining the public's right to an open government.

Figure 3:  States That Have Exemptions for Information on the Basis of General Public Health/Security

Missouri

New Jersey

Montana

Virgin Islands

New Hampshire

 

Figure 4: States With No Specific or Otherwise Uncertain Exemption

Minnesota

South Carolina

Puerto Rico

South Dakota

Notes: 

South Carolina provides for the release of information "in accordance with federal provisions" implying that its exemption could possible fall under the federal law category.  However, due to the vagueness of statute, NCSL staff opted to place it in the uncertain category.

NCSL staff was unable to obtain Puerto Rico in English in time to be included; efforts are ongoing to determine the status of exemptions in Puerto Rico.

South Dakota statute provides that records required by law to be kept confidential are exempt from disclosure; however, it is unclear from the statute if that means federal law, state law or both.

Summary of Water System Security Exemptions

Table 1 provides a summary of exemptions from public disclosure requirements for water security information that is found in each state's/jurisdiction's FOIA statute.  The table includes the name of the state/jurisdiction, the statutory citation where the exemption exists, and classification of the type of exemption:  exemption specifically cites vulnerability assessments; pertains to the protection of public health or security generally; is contingent upon exemption under federal or other state/jurisdiction law; or no exemption exists or the status of exemption is unclear.

Table 1:  Summary of Water Security Exemptions

Privately Owned Public Water Supply Systems

As in the first report, one issue that recurred in conducting the analysis for this report is whether statutory protections extend to information held by privately owned public water systems as well as to publicly owned systems.  EPA, states and territories regulate public water systems -- publicly or privately owned -- that have at least 15 service connections or serve at least 25 people for 60 days or more per year.  The Bioterrorism Preparedness Act of 2002 requires every community water system that serves at least 3,300 people to conduct a vulnerability assessment, submit that assessment to EPA and prepare an emergency response plan. 

A narrative discussion of the details of this issue can be found in Protecting Water System Security Information (2003 version).  Figures 5 and 6 provide the exemption information by state/jurisdiction depending on the ownership of the water system.

Figure 5: States/Jurisdictions That Have an Exemption for Privately Owned Public Water Systems

Arizona

Nevada

Arkansas

New Jersey

Delaware

New Mexico

District of Columbia

New York

Florida

North Dakota

Georgia

Ohio

Hawaii

Oklahoma

Idaho

Oregon

Illinois

Pennsylvania

Indiana

Rhode Island

Kansas

Tennessee

Kentucky

Texas

Maine

Utah

Massachusetts

Vermont

Michigan

Virginia

Mississippi

Washington

Missouri

West Virginia

Montana

Wisconsin

Nebraska

 

Source:  National Conference of State Legislatures, April 2006

Figure 6: States That Do Not Have an Exemption for Privately Owned Public Water Systems

Alabama

New Hampshire

California

North Carolina

Connecticut

Louisiana

South Dakota

Minnesota

Wyoming

 

Source:  National Conference of State Legislatures, April 2006.

Narrative Summary of Water Security Exemptions

Table 2 contains summaries of the provisions of FOIA statutes that exempt water security system information from public disclosure requirements.  It includes the jurisdiction, the statutory citation, the type of exemption and a brief narrative description.

Table 2: Descriptions of FOIA Exemptions

Summary of 2004-2006 State Water System Security Bills

Table 3 contains summaries of the provisions of enacted, passed but vetoed and still active state legislation considered during the 20034-2006 legislative sessions that provides an exemption from public disclosure requirements for water system security information.  The bill information has been incorporated into the summaries of state FOIA statutes contained in parts two and three of this report, where relevant.  The information presented in the table includes the state, year of introduction or passage, bill number, bill status and a summary of the bill’s provisions.

Table 3: Summaries of 2004-2006 State Legislation

Appendix A: Specific Statutory Language

Back arrow, return to previous page Water Resources

 

Denver Office: Tel: 303-364-7700 | Fax: 303-364-7800 | 7700 East First Place | Denver, CO 80230 | Map
Washington Office: Tel: 202-624-5400 | Fax: 202-737-1069 | 444 North Capitol Street, N.W., Suite 515 | Washington, D.C. 20001