Box cards are, like cifn2 said, a pre-arranged response to incidents. They are set up for specific locations or sections of communities and list the response companies in the order in which they are due.
A typical card would cover a specified area or a specialized response. For example, Mayberry FD Box # 42 covers the southwest side of town. The first alarm is covered entirely by Mayberry engines, truck and EMS. The second alarm requests an engine from Mt. Pilot, another from Pleasantville and a third from Cocoa Beach, as well as a truck from Gotham and an ambulance from Pineville. This goes on usually up to the 5th alarm.
A small town may have only a single fire Box card, larger towns may have dozens. Some towns have cards specifically for a specific target such as a large high school, hospital or factory.
There are now many specialized box cards, including for large EMS incidents, dive teams, Haz-Mat or trench rescue.
The whole idea is to have a predetermined response to larger incidents that can not be handled by the first response. It allows departments to have an orderly response to assistance calls, reduces free-styling, and keep from stripping neighboring communities of resources.
As for box card security, some agencies have no problem releasing box cards to the public, others find it less appealing. There was an incident a few years ago where someone started requesting box cards from several FD's saying he was doing it for CARMA, but that was not authorized or requested by the club. The CARMA Board put a stop to it and worked with MABAS to clear things up and as a result some agencies removed their box cards from public websites etc.
Box Cards and the MABAS operating protocols are a shining example of how Mutual Aid and Incident Command are supposed to work and it was the basis for several area-wide, statewide and national response plans.