HF 601 (LSB 2641HV (1) 87)

HOUSE FILE 601

BY  COMMITTEE ON GOVERNMENT OVERSIGHT

(SUCCESSOR TO HSB 185)

A BILL FOR

An Act providing for the confidentiality of certain cyber security and critical infrastructure information developed and maintained by a government body.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 22.7, subsection 50, Code 2017, is amended to read as follows:
   50.  Information concerning cyber security, critical infrastructure, security procedures, or emergency preparedness information developed and maintained by a government body for the protection of governmental employees, visitors to the government body, persons in the care, custody, or under the control of the government body, or property under the jurisdiction of the government body, if disclosure could reasonably be expected to jeopardize such employees, visitors, persons, or property.
   a.  (1)  Such information includes but is not limited to information directly related to vulnerability assessments; information contained in records relating to security measures such as security and response plans, security codes and combinations, passwords, restricted area passes, keys, and security or response procedures; emergency response protocols; and information contained in records that if disclosed would significantly increase the vulnerability of critical physical systems or infrastructures of a government body to attack.
   (2)  For purposes of this subsection, “information concerning cyber security” includes but is not limited to information relating to cyber security defenses, threats, attacks, or general attempts to attack cyber system operations.
   b.  This subsection shall only apply to information held by a government body that has adopted a rule or policy identifying the specific records or class of records to which this subsection applies and which is contained in such a record.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill provides for the confidentiality of certain cyber security and critical infrastructure information developed and maintained by a government body.
   Under current law, information concerning security procedures or emergency preparedness information developed and maintained by a government body for the protection of governmental employees, visitors to the government body, persons in the care, custody, or under the control of the government body, or property under the jurisdiction of the government body, if disclosure could reasonably be expected to jeopardize such employees, visitors, persons, or property must be kept confidential under Code section 22.7 unless otherwise ordered by a court, by the lawful custodian of the records, or by another person duly authorized to release such information. The bill includes cyber security and critical infrastructure information developed and maintained by a government body for such purposes. Information concerning cyber security includes but is not limited to information relating to cyber security defenses, threats, attacks, or general attempts to attack cyber system operations.