4.3 Share and protect information Strategic objective: Advance the timely sharing and protection of information among partners and key stakeholders. Information sharing and information protection are complementary elements of a strong foundation for collaborative efforts to strengthen the resiliency of critical infrastructure. Improved information sharing, in full respect of existing federal, provincial and territorial legislation and policies, will enhance the timely exchange of actionable information on risks as well as information about the overall status of critical assets so that owners and operators, governments, and others can assess risks and take appropriate action. Timely information sharing across governments and critical infrastructure sectors is needed to promote effective risk management and to understand and address critical infrastructure interdependencies. As requested by critical infrastructure stakeholders, improvements in information sharing will include: • a wider range of information products (e.g. risk assessments, incident reports, best practices, lessons learned, assessment tools); • • • improved delivery mechanisms (e.g. web-based critical infrastructure information); improved protection of shared information from unauthorized disclosure; and expanded production of all-hazards risk information products. Consistent with the principles of the Emergency Management Framework for Canada, federal, provincial and territorial governments will aim to be as open as possible about the work each level of government does in emergency management, security and business continuity planning. Information exchange is part of a crucial and continuous process before, during and after a disruption or emergency – it enables a common operating picture among all levels of government and the critical infrastructure sectors. In turn, this leads to improved coherency of action and facilitates a comprehensive approach across the spectrum of prevention, mitigation, preparedness, response and recovery. To improve the quality and usefulness of the information products, members of the sector networks will identify areas of emerging concern and identify priority areas for information products. It is expected that these information products will be used by critical infrastructure partners to improve the resiliency of their key assets and services. Information Protection In light of the many interdependencies in Canadian critical infrastructure, the inappropriate release of sensitive information that poses a risk for a province or local authority would often also constitute a risk for Canada. Exemptions from disclosure for reasons of national security and public safety already exist under federal, provincial and territorial access to and freedom of information legislation. At the federal level, the Government of Canada’s Emergency Management Act, which came into force in 2007, included a consequential amendment to the Access to Information Act to give clear protection to sensitive information provided by critical infrastructure sectors. 9