‘InfraGard’ lets FBI disclose sensitive information to select few

From the Winter 2002 issue of The News Media & The Law, page 27.

When California Gov. Gray Davis issued warnings about terrorist threats on state bridges, he relied on information given to him from three different law enforcement sources and from his brother, Barry, in New York City.

The late October threat turned out to be unfounded.

Davis then faced criticism from state law enforcement officials and some news media for publicizing the threats before the FBI issued assurances that they were authentic.

Although the FBI made no such determination publicly, the agency had already announced the threat to an information-sharing partnership it fosters with some businesses. That is how Barry Davis, who works for Morgan Stanley, and more than 1,700 other business leaders learned about the threat before the general public and even some government leaders. Morgan Stanley is part of InfraGard, a business-government partnership overseen by the FBI’s National Infrastructure Protection Center.

“Just goes to show. It isn’t who you know, but who you work for, that matters,” wrote the San Francisco Chronicle.

The partnership grew from a pilot project started by the FBI’s field office in Cleveland in 1996 to solicit advice from local computer professionals on how to protect critical information systems in the public and private sectors. Today, 56 field offices boast of ties to area businesses to exchange information.

InfraGard, its bylaws say, is committed to a “robust exchange of information” about threats to the infrastructure. But the exchange is just among the members. For example, the FBI sent out a notice to the nearly 1,700 businesses around the country who enjoy membership in InfraGard about the uncorroborated threat, but it did not notify the news media.

The bylaws emphasize secrecy, the careful release of information and the protection of InfraGard members.

InfraGard’s “Interviewing and Publication Policy,” for example, states that, in dealing with the press, “controlling the image of InfraGard being presented can be difficult.” It says that where possible the InfraGard leadership and the local FBI representative should “review submitted questions, agree on the predilection of the answers, and identify the appropriate interviewee.” The local FBI representative and InfraGard member should try to be interviewed together to emphasize the partnership, the policy states.

During an interview with a newspaper, the policy states, the association member should “use simple sentences and basic facts” and “focus answers on the benefits of InfraGard membership.” Questions concerning sensitive information should be avoided, it says, cautioning an interviewee to “NEVER argue with the interviewer.”

The identity of InfraGard members should be protected at all times, the policy states. Names of individual employees or their employers should not be disclosed without the permission of the individual and the employer.

InfraGard also has a code of ethics which addresses information sharing. It calls for education of members and the general public on information security and national information infrastructure issues. It also calls for maintaining the confidentiality of most information obtained through involvement with InfraGard. That includes, but is not limited to, protecting information on the business of a fellow member or company and information identified as “proprietary, confidential or sensitive.”

The code and other information is available online at the InfraGard Web site at www.infragard.net.

But Ray Maviglio, Davis’ spokesman, said the governor, who is not a member of InfraGard, revealed information about the threat because he believed he could “treat the citizens of his state like adults” and that they could make their own decisions about the information.

In a discussion of Davis’ disclosure in early November on ABC’s “Nightline,” Oakland Mayor Jerry Brown, a former California governor himself, said that once the FBI advisory was issued, it might as well have been public.

“An e-mail comes out to hundreds of people, maybe thousands of people, and at the bottom it says, ‘And don’t tell the media’,” Brown said. “As soon as I saw that, I said, ‘This is unreal.'” — RD