§ 714. Protection of critical infrastructure; storage facilities for
hazardous substances. 1. Notwithstanding any other provision of law and
subject to the availability of an appropriation, the commissioner of the
division of homeland security and emergency services shall conduct a
review and analysis of measures being taken by the owners and operators
of facilities identified pursuant to paragraph (b) of subdivision two of
this section to protect the security, and cyber security, of critical
infrastructure related to such facilities. The commissioner of the
division of homeland security and emergency services shall have the
authority to review all audits or reports related to the security of
such critical infrastructure, including all such audits or reports
mandated by state and federal law or regulation, including spill
prevention reports and risk management plans, audits and reports
conducted at the request of the department of environmental conservation
or at the request of any federal entity, or any other agency or
authority of the state or any political subdivision thereof, and reports
prepared by owners and operators of such facilities as required in this
subdivision. The owners and operators of such facilities shall, in
compliance with any federal and state requirements regarding the
dissemination of such information, provide access to the commissioner of
the division of homeland security and emergency services to such audits
and reports regarding such critical infrastructure provided, however,
exclusive custody and control of such audits and reports shall remain
solely with the owners and operators of such facilities to the extent
not inconsistent with any other law. For the purposes of this section,
the term "critical infrastructure" has the meaning ascribed to that term
in subdivision five of section eighty-six of the public officers law.

2. To effectuate his or her duties pursuant to this section and
identify risks to the public, the commissioner of the division of
homeland security and emergency services shall:

(a) within six months of the effective date of this section, in
consultation with the commissioner of environmental conservation, the
commissioner of health, and such representatives of the chemical
industry and higher education as may be appropriate, prepare a list that
identifies toxic or hazardous substances, including but not limited to
those substances listed as hazardous to public health, safety or the
environment in regulations promulgated pursuant to article thirty-seven
of the environmental conservation law, as well as those substances for
which the state possesses insufficient or limited toxicological
information but for which there exists preliminary evidence that the
substance or the class of chemicals with similar physical and chemical
properties to which it belongs has the potential to cause death, injury,
or serious adverse effects to human health or the environment, based on
the severity of the threat posed to the public by the unauthorized
release of such substances. Such list will be promulgated in accord with
the provisions of the state administrative procedure act;

(b) upon completion of the list required pursuant to paragraph (a) of
this subdivision, but no later than one hundred twenty days after such
date, in consultation with the commissioner of environmental
conservation, the commissioner of health and such representatives of the
chemical industry and any state, local and municipal officials as may be
appropriate, identify facilities, including facilities regulated
pursuant to title nine and title eleven of article twenty-seven and
article forty of the environmental conservation law, but excluding
facilities that hold liquified petroleum gas for fuel at retail sale as
described in section 112(1)(4)(B) of the Clean Air Act (42 U.S.C.
section 7412(r)(4)(b)) and those facilities that are defined as "water
suppliers" in subdivision one of section eleven hundred twenty-five of
the public health law, which because of their storage of or relationship
to such substances identified pursuant to paragraph (a) of this
subdivision pose risks to the public should an unauthorized release of
such hazardous substances occur; and

(c) require such facilities identified pursuant to paragraph (b) of
this subdivision, as the commissioner so determines, to prepare a
vulnerability assessment of the security measures taken by such
facilities to prevent and respond to the unauthorized release of
hazardous substances as may be stored therein, which assessments the
commissioner of the division of homeland security and emergency services
shall review and consider in light of the seriousness of the risk posed
and vulnerability of such facility and, where appropriate, make
recommendations with respect thereto.

3. (a) On or before June first, two thousand five, the commissioner of
the division of homeland security and emergency services shall make a
preliminary report to the governor, the temporary president of the
senate, the speaker of the assembly, the commissioner of environmental
conservation, the commissioner of health and the chief executive officer
of any such affected facility or his or her designee, and on or before
December thirty-first, two thousand five, and not later than three years
after such date, and every five years thereafter, the commissioner of
the division of homeland security and emergency services shall report to
the governor, the temporary president of the senate, the speaker of the
assembly, the commissioner of environmental conservation, the
commissioner of health and the chief executive officer of any such
affected facility or his or her designee. Such report shall review the
security measures being taken regarding critical infrastructure related
to such facilities, assess the effectiveness thereof, and include
recommendations to the legislature, the department of environmental
conservation or the department of health if the commissioner of the
division of homeland security and emergency services determines that
additional measures are required to be implemented.

(b) Before the receipt of such report identified in paragraph (a) of
this subdivision, each recipient of such report shall develop
confidentiality protocols which shall be binding upon the recipient who
issues the protocols and anyone to whom the recipient shows a copy of
the report in consultation with the commissioner of the division of
homeland security and emergency services, for the maintenance and use of
such report so as to ensure the confidentiality of the report and all
information contained therein, provided, however, that such protocols
shall not be binding upon a person who is provided access to such report
or any information contained therein pursuant to section eighty-nine of
the public officers law after a final determination that access to such
report or any information contained therein could not be denied pursuant
to subdivision two of section eighty-seven of the public officers law.
The commissioner of the division of homeland security and emergency
services shall also develop protocols for such division related to the
maintenance and use of such report so as to ensure the confidentiality
of all sensitive information contained in such report. On each report,
the commissioner of the division of homeland security and emergency
services shall prominently display the following statement: "This report
may contain information that if disclosed could endanger the life or
safety of the public, and therefore, pursuant to section seven hundred
eleven of the executive law, this report is to be maintained and used in
a manner consistent with protocols established to preserve the
confidentiality of the information contained herein in a manner
consistent with law."

(c) The department of environmental conservation shall have the
discretion to require that recommendations of the commissioner of the
division of homeland security and emergency services be implemented by
any owner or operator of a hazardous substances storage facility as
defined in this section.