According to documents obtained by OMB Watch, the CII program has received 29 submissions of information for which the submitters requested protections under the CII provisions. DHS approved 22 of those submissions for protection and rejected the other seven submissions as not meeting the program’s requirements. To qualify, the information must address a vulnerability of some critical infrastructure, it must be voluntarily submitted, and it must not exist customarily in the public domain. DHS implies that the seven submissions “deemed non-CII or non protected CII” have been destroyed per agency policy.

Most of the submissions appear to be brief, measuring only a few pages in length, however, at least one submission contained over 300 pages of material. Additionally, it should be noted that the length of the documents reveals nothing about the importance of the information contained within those pages. Even the shortest documents may contain vital information about a vulnerability that threatens a community’s safety, information that now sits in a locked drawer while nothing is done to fix the vulnerability or ensure the community’s safety.

DHS also treated numerous communications between the agency and submitters concerning their CII submissions as protected under the same provisions. This appears to be an extension of the program’s protections from what the agency outlined in its final CII rule.