SB 1451: Homeland Security; Uniform Information Practices; Critical Infrastructure Information

A BILL FOR AN ACT

RELATING TO CRITICAL INFRASTRUCTURE.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that in order to succeed in the responsibilities of the State to provide homeland security under chapter 128A, Hawaii Revised Statutes, it is necessary to establish protections for critical infrastructure information.

     The purpose of this Act is to establish and specify protections for information that is received or maintained by the office of homeland security regarding the security of critical infrastructure and protected systems, including any analysis, warning, interdependency study, recovery, reconstitution, or other informational purposes.

     SECTION 2.  Chapter 128A, Hawaii Revised Statutes, is amended by adding to part I a new section to be appropriately designated and to read as follows:

     "§128A-    Confidentiality of critical infrastructure information.  (a)  Notwithstanding section 92F-11 and any other law to the contrary, critical infrastructure information received or maintained by the office of homeland security in connection with the Hawaii state critical infrastructure security and resilience program shall be confidential and shall not be disclosed, except as provided in subsection (b).

     (b)  The office of homeland security may share confidential critical infrastructure information received or maintained under subsection (a) with federal, state, and county agencies within the State for the purposes of the security of critical infrastructure and protected systems; provided that the information shall remain confidential and shall not be disclosed by the receiving agency to the public.

     (c)  Nothing contained in this section shall be construed to alter existing rights to access government records subject to chapter 92F from an agency other than the office of homeland security and any state and county agencies receiving confidential critical infrastructure information under subsection (b)."

     SECTION 3.  Section 128A-2, Hawaii Revised Statutes, is amended by adding a new definition to be appropriately inserted and to read as follows:

     ""Critical infrastructure information" means information provided by private entities that is not customarily in the public domain and that, if disclosed, could reveal vulnerabilities in critical infrastructure that, if exploited, would likely result in the significant disruption, destruction, or damage of or to operations, property, or facilities.  "Critical infrastructure information" is related to the security of critical infrastructure or protected systems, including documents, records or other information concerning:

     (1)  Actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct, including the misuse of or unauthorized access to all types of communications and data transmission systems, that violates federal, state, local, or tribal law, harms interstate commerce of the United States, or threatens public health or safety;

     (2)  The ability of any critical infrastructure or protected system to resist interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk-management planning, or risk audit; or

     (3)  Any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent that it is related to the interference, compromise, or incapacitation of the critical infrastructure or protected system."

     SECTION 4.  New statutory material is underscored.

     SECTION 5.  This Act shall take effect on July 1, 2077.

Report Title:

Homeland Security; Uniform Information Practices; Critical Infrastructure Information

Description:

Enhances sharing of critical infrastructure information between infrastructure owners and operators and the state government.  Defines and protects "critical infrastructure information" that is crucial for direct support of the security and resilience of the State.  Provides homeland security partners with reassurance that their proprietary information provided to the state government will be protected from disclosure.  Effective 7/1/2077.  (SD2)

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

A BILL FOR AN ACT

RELATING TO CRITICAL INFRASTRUCTURE.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that in order to succeed in the responsibilities of the State to provide homeland security under chapter 128A, Hawaii Revised Statutes, it is necessary to establish protections for critical infrastructure information.

     The purpose of this Act is to establish and specify protections for information that is received or maintained by the office of homeland security regarding the security of critical infrastructure and protected systems, analysis, warning, interdependency study, recovery, reconstitution or other informational purposes.

     SECTION 2.  Chapter 128A, Hawaii Revised Statutes, is amended by adding to part I a new section to be appropriately designated and to read as follows:

     "§128A-    Confidentiality of critical infrastructure information.  (a)  Notwithstanding section 92F-11 and any other law to the contrary, critical infrastructure information received or maintained by the office of homeland security in connection with the Hawaii state critical infrastructure security and resilience program shall be confidential and shall not be disclosed, except as provided in subsection (b).

     (b)  The office of homeland security may share confidential critical infrastructure information received or maintained under subsection (a) with federal agencies and state and county agencies within the State for the purposes of the security of critical infrastructure of protected systems; provided that the information shall remain confidential and shall not be disclosed by the receiving agency to the public.

     (c)  Nothing contained in this section shall be construed to alter existing rights to access government records subject to chapter 92F from an agency other than the office of homeland security and state and county agencies receiving confidential critical infrastructure information under subsection (b)."

     SECTION 3.  Section 128A-2, Hawaii Revised Statutes, is amended by adding a new definition to be appropriately inserted and to read as follows:

     ""Critical infrastructure information" means information provided by private entities that is not customarily in the public domain and that, if disclosed, would reveal vulnerabilities in critical infrastructure that, if exploited, would likely result in the significant disruption, destruction, or damage of or to operations, property, or facilities.  "Critical infrastructure information" is related to the security of critical infrastructure or protected systems, including documents, records or other information concerning:

     (1)  Actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct, including the misuse of or unauthorized access to all types of communications and data transmission systems, that violates federal, state, local, or tribal law, harms interstate commerce of the United States, or threatens public health or safety;

     (2)  The ability of any critical infrastructure or protected system to resist the interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk-management planning, or risk audit; or

     (3)  Any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent that it is related to the interference, compromise, or incapacitation."

     SECTION 4.  New statutory material is underscored.

     SECTION 5.  This Act shall take effect on July 1, 2077.

Report Title:

Homeland Security; Uniform Information Practices; Critical Infrastructure Information

Description:

Enhances sharing of critical infrastructure information between infrastructure owners and operators and the state government.  Defines and protects "critical infrastructure information" that is crucial for direct support of the security and resilience of the State.  Provides homeland security partners with reassurance that their proprietary information provided to the state government will be protected from disclosure.  Effective 7/1/2077.  (SD1)

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

A BILL FOR AN ACT

RELATING TO CRITICAL INFRASTRUCTURE.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that in order to succeed in the responsibilities of the State to provide homeland security under chapter 128A, Hawaii Revised Statutes, it is necessary to establish protections for critical infrastructure information.

     The purpose of this Act is to establish and specify protections for information that is received or maintained by the office of homeland security regarding the security of critical infrastructure and protected systems, analysis, warning, interdependency study, recovery, reconstitution or other informational purposes.

     SECTION 2.  Chapter 128A, Hawaii Revised Statutes, is amended by adding to part I a new section to be appropriately designated and to read as follows:

     "§128A-     Confidentiality of critical infrastructure information.  (a)  Notwithstanding section 92F-11 and any other law to the contrary, critical infrastructure information received or maintained by the office of homeland security in connection with the Hawaii state critical infrastructure security and resilience program shall be confidential and shall not be disclosed, except as provided in subsection (b).

     (b)  The office of homeland security may share confidential critical infrastructure information received or maintained under subsection (a) with federal agencies and state and county agencies within the State for the purposes of the security of critical infrastructure of protected systems; provided that the information shall remain confidential and shall not be disclosed by the receiving agency to the public.

     (c)  Nothing contained in this section shall be construed to alter existing rights to access government records subject to chapter 92F from an agency other than the office of homeland security and state and county agencies receiving confidential critical infrastructure information under subsection (b)."

     SECTION 3.  Section 128A-2, Hawaii Revised Statutes, is amended by adding a new definition to be appropriately inserted and to read as follows:

     ""Critical infrastructure information" means information that is not customarily in the public domain and is related to the security of critical infrastructure or protected systems, including documents, records or other information concerning:

     (1)  Actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct, including the misuse of or unauthorized access to all types of communications and data transmission systems, that violates federal, state, local, or tribal law, harms interstate commerce of the United States, or threatens public health or safety;

     (2)  The ability of any critical infrastructure or protected system to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk-management planning, or risk audit; or

     (3)  Any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent that it is related to the interference, compromise, or incapacitation."

     SECTION 4.  New statutory material is underscored.

     SECTION 5.  This Act shall take effect upon its approval.

Report Title:

Homeland Security; Uniform Information Practices; Critical Infrastructure Information

Description:

Enhances sharing of critical infrastructure information between infrastructure owners and operators and the state government.  Defines and protects "critical infrastructure information" that is crucial for direct support of the security and resilience of the State.  Provides homeland security partners with reassurance that their proprietary information provided to the state government will be protected from disclosure.

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

STAND. COM. REP. NO. 1021

Honolulu, Hawaii

RE:    S.B. No. 1451

       S.D. 2

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Third State Legislature

Regular Session of 2025

State of Hawaii

Sir:

     Your Committee on Judiciary, to which was referred S.B. No. 1451, S.D. 1, entitled:

"A BILL FOR AN ACT RELATING TO CRITICAL INFRASTRUCTURE,"

begs leave to report as follows:

     The purpose and intent of this measure is to:

     (1)  Enhance sharing of critical infrastructure information between infrastructure owners and operators and the state government;

     (2)  Define and protect "critical infrastructure information" that is crucial for direct support of the security and resilience of the State; and

     (3)  Provide homeland security partners with reassurance that their proprietary information provided to the state government will be protected from disclosure.

     Your Committee received testimony in support of this measure from the Department of Law Enforcement and Office of Information Practices.

     Your Committee received comments on this measure from the Public First Law Center.

     Your Committee finds that chapter 128A, Hawaii Revised Statutes, outlines the duty of the State to provide for homeland security.  Your Committee believes that establishing protections so the Office of Homeland Security may safely access critical infrastructure information is a necessary facet of strengthening homeland security.  This measure will facilitate the protection of the public from terrorism and other threats by providing for the sharing and protection of this critical data.

     Your Committee notes that the additional requirement that critical infrastructure information "would" reveal vulnerabilities in critical infrastructure that, if exploited, would likely result in the significant disruption, destruction, or damage of or to operations, property, or facilities may endanger public safety by providing sensitive information to individuals seeking to cause damage to critical infrastructure.  Therefore, your Committee believes that the requirement should be amended to specify that critical infrastructure information "could" reveal these vulnerabilities.

     Your Committee has amended this measure by:

     (1)  Clarifying that "critical infrastructure information" means certain information that, if disclosed, could reveal certain vulnerabilities in critical infrastructure; and

     (2)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

     As affirmed by the record of votes of the members of your Committee on Judiciary that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 1451, S.D. 1, as amended herein, and recommends that it pass Third Reading in the form attached hereto as S.B. No. 1451, S.D. 2.

Respectfully submitted on behalf of the members of the Committee on Judiciary,

STAND. COM. REP. NO. 285

Honolulu, Hawaii

RE:    S.B. No. 1451

       S.D. 1

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Third State Legislature

Regular Session of 2025

State of Hawaii

Sir:

     Your Committee on Public Safety and Military Affairs, to which was referred S.B. No. 1451 entitled:

"A BILL FOR AN ACT RELATING TO CRITICAL INFRASTRUCTURE,"

begs leave to report as follows:

     The purpose and intent of this measure is to:

     (1)  Enhance sharing of critical infrastructure information between infrastructure owners and operators and the state government;

     (2)  Define and protect "critical infrastructure information" that is crucial for direct support of the security and resilience of the State; and

     (3)  Provide homeland security partners with reassurance that their proprietary information provided to the state government will be protected from disclosure.

     Your Committee received testimony in support of this measure from the Office of Information Practices and Department of Law Enforcement.

     Your Committee received testimony in opposition to this measure from the Public First Law Center.

     Your Committee finds that protecting the State's critical infrastructure is essential to maintaining the safety of the community and the functionality of governmental operations.  The retention and assured protection of critical infrastructure information is crucial for the Office of Homeland Security in supporting the security and resilience of the State.

     However, your Committee acknowledges testimony provided at the public hearing on this measure that raised concerns regarding appropriately striking the balance between protecting sensitive critical infrastructure information and upholding the duty of disclosure of certain information to the public.  Your Committee finds that it is necessary to continue the discussion on this issue with relevant stakeholders and the public to best effectuate the security of the State while promoting transparency.

     Accordingly, your Committee has amended this measure by:

     (1)  Specifying that "critical infrastructure information" means information provided by private entities that is not customarily in the public domain and that, if disclosed, would reveal vulnerabilities in critical infrastructure that, if exploited, would likely result in the significant disruption, destruction, or damage of or to operations, property, or facilities;

     (2)  Inserting an effective date of July 1, 2077, to encourage further discussion; and

     (3)  Making a technical, nonsubstantive amendment for the purposes of clarity and consistency.

     As affirmed by the record of votes of the members of your Committee on Public Safety and Military Affairs that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 1451, as amended herein, and recommends that it pass Second Reading in the form attached hereto as S.B. No. 1451, S.D. 1, and be referred to your Committee on Judiciary.

Respectfully submitted on behalf of the members of the Committee on Public Safety and Military Affairs,