This bill amends Washington’s public records law (RCW 42.56.420) to add and clarify categories of security-related information that are exempt from public disclosure, expressly including “critical energy infrastructure information in possession of any agency.” The amendment continues to exempt portions of records prepared to prevent, mitigate, or respond to criminal terrorist acts where disclosure would likely threaten public safety; specific vulnerability assessments and emergency/escape response plans for adult and juvenile correctional and civil commitment facilities; portions of safe school plans that identify specific school vulnerabilities; detailed information about computer and telecommunications system security; certain system security and emergency preparedness plans required by listed municipal and county RCWs; and personally identifiable and other security information of employees of private cloud service providers that have Criminal Justice Information Services (CJIS) agreements. The bill also defines key terms for the exemption: “criminal terrorist acts” in the context of acts that significantly disrupt government or the civilian population and manifest extreme indifference to human life; “critical energy infrastructure” as systems and assets whose incapacity or destruction threatens the energy supply such that public health, safety, or general welfare may be jeopardized; and “critical energy infrastructure information” as information about actual, potential, or threatened attacks or compromises that go beyond general location or publicly available data. Affected entities include any agency holding such critical energy infrastructure information, agencies that assemble records on criminal terrorist threats, correctional and civil commitment facilities, school districts, managers of public and private networks, and private cloud providers with CJIS agreements. The extract shows the bill was read for the first time on 02/14/25 but does not include an operative effective date, comparative changes showing what language is newly added versus existing law, or any implementation, appeal, or waiver procedures.

If enacted, the bill lets any state or local agency with information about critical energy systems keep that information out of public records, along with the other security-related categories already covered (for example, certain correctional facility plans, school vulnerability details, network security data, and some private cloud employee information under CJIS agreements). Practically, that will reduce public access to detailed vulnerability or attack-related information about energy infrastructure and similar security records, which is likely to lower the risk those details could be used by malicious actors. The agencies most affected are any that hold energy-infrastructure records and organizations that already manage the listed security records; they will have clearer authority to withhold such material and thus a greater responsibility to identify and protect qualifying documents, which may reduce transparency but help protect public safety. The text provided lacks an operative effective date, implementation steps, or guidance on how agencies must apply the exemption or how the public can challenge withholding, so those practical implementation details remain uncertain.