RM16-15 order

157 FERC ¶ 61,123

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

18 CFR Parts 375 and 388

[Docket Nos. RM16-15-000 and RM15-25-001; Order No. 833]

Regulations Implementing FAST Act Section 61003 – Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission

(Issued November 17, 2016)

AGENCY: Federal Energy Regulatory Commission.

ACTION: Final rule.
SUMMARY: The Federal Energy Regulatory Commission (Commission) amends its regulations to implement provisions of the Fixing America’s Surface Transportation Act that pertain to the designation, protection and sharing of Critical Electric Infrastructure Information. Additionally, the Commission amends its regulations addressing Critical Energy Infrastructure Information.

EFFECTIVE DATE: This rule will become effective [INSERT DATE 60 days after publication in the FEDERAL REGISTER].

FOR FURTHER INFORMATION CONTACT:

Nneka Frye

Office of the General Counsel

Federal Energy Regulatory Commission

888 First Street, NE

Washington, DC 20426

(202) 502-6029

[email protected]

Christopher MacFarlane

Office of the General Counsel

Federal Energy Regulatory Commission

888 First Street, NE

Washington, DC 20426

(202) 502-6761

[email protected]

Mark Hershfield

Office of the General Counsel

Federal Energy Regulatory Commission

888 First Street, NE

Washington, DC 20426

(202) 502-8597

[email protected]

SUPPLEMENTARY INFORMATION:

157 FERC ¶ 61,123

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

Before Commissioners: Norman C. Bay, Chairman;

Cheryl A. LaFleur, and Colette D. Honorable.

Regulations Implementing FAST Act Section Docket Nos. RM16-15-000 61003 – Critical Electric Infrastructure

Security and Amending Critical Energy

Infrastructure Information

Availability of Certain North American Electric RM15-25-001

Reliability Corporation Databases to the Commission

ORDER NO. 833

FINAL RULE

(Issued November 17, 2016)

1. The Commission amends 18 CFR sections 375.309, 375.313, 388.112 and 388.113 of its regulations to implement the requirements of the Fixing America’s Surface Transportation (FAST) Act as set forth in section 215A(d)(2) of the Federal Power Act (FPA).¹ The Commission also amends its existing Critical Energy Infrastructure Information procedures. These changes are intended to comply with the FAST Act as well as improve the overall efficiency of the Commission’s procedures for certain infrastructure information that is submitted to, or generated by, the Commission. The amended procedures will be referred to as the Critical Energy/Electric Infrastructure Information (CEII) procedures.

1. Background

   1. Critical Energy Infrastructure Information Regulations

2. Shortly after September 11, 2001, the Commission took steps to protect information that it considered Critical Energy Infrastructure Information.² As a preliminary step, the Commission removed documents from its public files and eLibrary database that were likely to contain detailed specifications about critical infrastructure. The Commission directed the public to use the Freedom of Information Act (FOIA) request process to obtain such information.³ Given that such information would typically be exempt from mandatory disclosure pursuant to FOIA, the Commission determined that it was important to have a process for individuals with a valid or legitimate need to access certain sensitive energy infrastructure information. Thus, in 2003, the Commission

issued a final rule establishing Critical Energy Infrastructure Information regulations.⁴

3. Each year, over 7,000 documents are submitted to the Commission’s eLibrary system as Critical Energy Infrastructure Information. The Commission also receives approximately 200 requests for Critical Energy Infrastructure Information each year. Requests for Critical Energy Infrastructure Information are submitted by, among others, public utilities, gas pipelines, Liquefied Natural Gas (LNG) facilities, hydroelectric developers, academics, landowners, public interest groups, researchers, renewable energy organizations, consultants, and federal agencies.

4. The Commission’s current Critical Energy Infrastructure Information process is designed to limit the distribution of sensitive infrastructure information to those individuals with a need to know in order to avoid having sensitive information fall into the hands of those who may use it to attack the Nation’s infrastructure.

1. FAST Act

5. On December 4, 2015, the President signed the FAST Act into law. The FAST Act, inter alia, added section 215A to the Federal Power Act to improve the security and resilience of energy infrastructure in the face of emergencies. The FAST Act directs the Commission to issue regulations aimed at securing and sharing sensitive infrastructure information. Specifically, FPA section 215A(d)(2) (Designation and Sharing of Critical Electric Infrastructure Information) requires the Commission to “promulgate such regulations as necessary to”:

(A) establish criteria and procedures to designate information as critical electric infrastructure information;

(B) prohibit the unauthorized disclosure of critical electric infrastructure information;

(C) ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy [DOE] who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section; and

(D) taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of critical electric infrastructure information with, between, and by – (i) Federal, State, political subdivision, and tribal authorities; (ii) the Electric Reliability Organization; (iii) regional entities; (iv) information sharing and analysis centers established pursuant to Presidential Decision Directive 63; (v) owners, operators, and users of critical electric infrastructure in the United States; and (vi) other entities determined appropriate by the Commission.⁵

3. Notice of Proposed Rulemaking

6. On June 16, 2016, the Commission issued a Notice of Proposed Rulemaking (NOPR) to amend its regulations to implement the provisions of the FAST Act pertaining to the designation, protection and sharing of CEII.⁶ The proposed amendments included, among other things, the creation of criteria and procedures for designating information as CEII; a specific prohibition on unauthorized disclosure of that information; sanctions for knowing and willful wrongful disclosure of CEII by certain federal personnel; a process for voluntary sharing of CEII; and changes to the existing process for requesting CEII. In response to the NOPR, nineteen entities filed comments and two entities filed reply comments. The Appendix to this Final Rule lists the entities that submitted comments in response to the NOPR.

2. Discussion

7. The Commission adopts the majority of amendments proposed in the NOPR. The Commission determines that the amendments comply with the requirements of the FAST Act and better ensure the secure treatment of CEII. In addition, as discussed below, the Commission modifies or otherwise clarifies certain proposals made in the NOPR based on our review of the comments. In the discussion below, we address the following issues regarding the CEII amendments: (A) scope, purpose, and definitions; (B) criteria and procedures for determining what constitutes CEII; (C) duty to protect CEII; (D) sanctions for unauthorized disclosure of CEII; (E) voluntary sharing of CEII; and (F) requests for access to CEII.

1. Scope, Purpose, and Definitions

NOPR

8. In the NOPR, the Commission proposed to amend section 388.113 to include procedures for submitting, designating, handling, sharing and disseminating Critical Electric Infrastructure Information submitted to or generated by the Commission.⁷ The Commission proposed to define the term “Critical Electric Infrastructure Information”⁸ to include “Critical Energy Infrastructure Information” as defined under the Commission’s current regulations and to refer to both types of information, collectively, as CEII.⁹ The Commission also proposed to delete references to CEII in section 388.112 so that section 388.112 would only address privileged material and all procedures regarding CEII would be in section 388.113.

Comments

9. APPA and MISO maintain that CEII should not include all Critical Energy Infrastructure Information.¹⁰ APPA contends that Congress intended for the Commission to develop a separate process for Critical Electric Infrastructure Information regarding the bulk-power system and that the amended regulations fall “short” of Congress’s intent under the FAST Act because the amended regulations include the voluntary disclosure provisions found in the Commission’s current regulations.¹¹ APPA also asserts that the proposed definition of “critical electric infrastructure” “does not comport well” with section 215A(d)(10) of the FPA, which provides DOE and the Commission with the authority to remove the CEII designation from information regarding the bulk-power system or distribution facilities.¹² MISO contends that the Commission misinterpreted the definition of Critical Electric Infrastructure Information and that not all “Critical Energy Infrastructure Information under the Commission’s regulations is included” in the definition of Critical Electric Infrastructure Information.¹³

10. TAPS and APPA maintain that the Commission should revise the CEII definition to include additional language from the FAST Act. Specifically, TAPS and APPA recommend that the proposed definition of CEII incorporate section 215A(d)(1)(B), which provides that CEII “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.”¹⁴ APPA requests that, if the Commission includes Critical Energy Infrastructure Information in CEII, then the Commission should interpret section 215A(d)(1)(B) to apply to all forms of CEII, including Critical Energy Infrastructure Information.¹⁵ TAPS and APPA also request that the Commission define the term “political subdivision,” as used in section 215A(d)(1)(B), to have the same meaning as the term “political subdivision” in section 201(f) of the FPA, such that the term in section 215A(d)(1)(B) would include any agency, authority or instrumentality of any political subdivision or owned by a political subdivision.¹⁶ TAPS and APPA contend that, absent the clarification, these additional entities may not be considered a “political subdivision” under State laws.¹⁷

11. TAPS recommends that the Commission delete from the definition of Critical Energy Infrastructure Information the requirement that such information be exempt from FOIA.¹⁸ TAPS contends that the existing exemption clause is unnecessary because any materials will be exempt from FOIA pursuant to section 215A(d)(1)(A).¹⁹

12. Other commenters seek clarification on the scope of the CEII definition. Specifically, the Trade Associations request that the Commission clarify whether the name or location of an electric system, asset, owner or operator could be protected under the proposed CEII definition.²⁰ NRECA, similarly, urges the Commission to clarify that material considered Critical Energy Infrastructure Information, such as electric generation, and non-bulk electric system transmission and distribution facilities, would still qualify as CEII under the revised definition in the amended regulations.²¹

13. Powerex requests that the Commission specify whether the new definition of CEII expands the scope of information currently defined as Critical Energy Infrastructure Information.²² Powerex contends that the scope of this proceeding should remain limited to CEII regulations and procedures discussed in the NOPR and, thus, the scope of this proceeding should not extend to other forms of sensitive data.²³ Powerex, further, explains that there may be a tendency to over-designate information as CEII and, therefore, the Commission should recognize that transparency is needed to balance CEII protection against the due process rights of parties participating in Commission proceedings.²⁴

14. TAPS, APPA and the Trade Associations recommend revisions to the CEII Non-Disclosure Agreements (NDA).²⁵ Specifically, TAPS, APPA, and the Trade Associations state that the Commission should expressly incorporate the language from section 215A(d)(1)(B), exempting CEII from public disclosure, into the NDA.²⁶ TAPS requests that the Commission eliminate the State Agency NDA. TAPS contends that “[p]rior to the FAST Act’s express preemption of Sunshine Laws requiring disclosure,” the State Agency NDA was an attempt to impose a contractual nondisclosure requirement for critical energy infrastructure information provided to a State agency. TAPS maintains that, once section 215A(d)(1)(B) is included in the general NDA, the State Agency NDA should be eliminated because it is now unnecessary.²⁷

15. With respect to the proposed edits to sections 388.112 and 388.113 to separate the Commission’s treatment of privileged material from the Commission’s treatment of CEII, MISO suggests that the title for section 388.112 be changed to “Submission and treatment of privileged information” and section 388.113 be changed to “Submission and treatment of Critical Electric Infrastructure Information (CEII).”²⁸

16. The Trade Associations request that the Commission expressly state in the amended regulations that the CEII process is not intended to, and should not be interpreted to, supersede or otherwise affect existing laws, regulations, and agency rules that separately safeguard such data.²⁹

Commission Determination

17. As discussed below, the Commission, with limited modifications, adopts the amendments proposed in the NOPR addressing the scope, purpose and definitions in the CEII regulations. The Commission determines that the amendments are consistent with the requirements of the FAST Act and will result in more secure treatment of CEII.

18. The Commission disagrees with APPA and MISO that the CEII definition should not include Critical Energy Infrastructure Information and that there should be separate processes for electric and non-electric CEII. Our determination is based on the plain language of the FAST Act. Section 215A(a)(3) defines Critical Electric Infrastructure Information to “include information that qualifies as critical energy infrastructure information under the Commission’s regulations.”³⁰ In subsuming the Commission’s existing Critical Energy Infrastructure Information within section 215A’s CEII definition, Congress expressly stated that the definition of CEII includes Critical Energy Infrastructure Information. There is no indication in the language of the FAST Act that Congress intended to limit the types of Critical Energy Infrastructure Information to only electric infrastructure information.³¹

19. Including Critical Energy Infrastructure Information within the definition of CEII is not inconsistent with the provisions of section 215A(d)(10), as APPA maintains. First, section 215A(d)(10) states that removal of a CEII designation may be appropriate when the disclosure of such information “could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities.” (Emphasis supplied.) Thus, it is clear that Congress did not intend for the new Critical Electric Infrastructure Information designation to apply only to the bulk-power system. Second, Critical Energy Infrastructure Information includes information that “relates details about the production, generation, transportation, transmission, or distribution of energy.”³² Such information, even if it concerns non-electric infrastructure, could be used to impair the security or reliability of the bulk-power system, for example by severing gas pipeline connections to electric generation facilities.

20. Moreover, the Commission determines that a single CEII process for Critical Energy/Electric Infrastructure Information is the most efficient way to fulfill the statutory mandate of the FAST Act and to avoid any confusion that could result from different processes for different types of critical infrastructure information.³³ Absent contrary language in the FAST Act, the Commission has discretion in how it administers statutory mandates by regulation.³⁴

21. APPA’s assertion that the Commission is “falling short” of meeting Congress’s intent is without merit. In the proposed regulations, the Commission complies with each provision in section 215A(d)(2) with regard to designating and handling Critical Electric Infrastructure Information. The fact that those rules also apply to Critical Energy Infrastructure Information does not diminish the Commission’s compliance under the FAST Act. Rather, in this regard, the Commission’s determination meets Congress’s intent. Moreover, APPA’s argument that “information related to cyber threats and defensive measures should not be ‘protected’ under a designation regime that also provides for potentially involuntary access by any federal employee . . ., landowners [or]any person who is a participant in a Commission proceeding . . .” and others has no basis in the text of the FAST Act. APPA notably cites to nothing in the FAST Act to support that argument.³⁵ On the contrary, Congress explicitly directed the Commission to include voluntary sharing in the regulations that the Commission is required to promulgate under the FAST Act.³⁶ Further, the implication of APPA’s argument – that cyber information is different from other types of infrastructure information and therefore warrants different rules – fails to take into consideration that the Commission will evaluate each request for CEII, and each decision to voluntarily share CEII, on a case-by-case basis. For example, a person seeking cyber threat information would have to show a different need for the information than a person seeking information for a pipeline facility for a certificate proceeding.

22. The Commission agrees with TAPS and APPA that the Commission’s regulations should incorporate the provision in section 215A(d)(1)(B) that CEII “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.”³⁷ As to TAPS’s and APPA’s request that the Commission define the term “political subdivision,” in section 215A(d)(1)(B) of the FAST Act to be consistent with the definition of that term in FPA section 201(f), Congress did not adopt the definition of “political subdivision” in section 201(f) for the purposes of the FAST Act. However, the Commission believes that the broad language of section 215A(d)(1)(B), as it applies to “any Federal, State, political subdivision or tribal authority,” should encompass the instrumentalities and components of States. Section 215A(d)(1)(B) was included to protect CEII from mandatory disclosure. It would be illogical to provide such protection to States, but not their instrumentalities and components.

23. The Commission disagrees with TAPS that the Commission should delete from the definition of Critical Energy Infrastructure Information the provision that states that Critical Energy Infrastructure Information “[i]s exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552.”³⁸ As we have discussed above, Congress incorporated Critical Energy Infrastructure Information within section 215A’s definition of Critical Electric Infrastructure Information without revision.³⁹ Accordingly, the Commission will retain its current definition of Critical Energy Infrastructure Information.

24. In response to the Trade Associations’ comments seeking clarification if a name or location of a facility should be protected as CEII, the Commission’s current practice is that information that “simply give[s] the general location of the critical infrastructure” or simply provides the name of the facility is not CEII.⁴⁰ However, under certain circumstances, information regarding the location of infrastructure or its name that is not already publicly known could be CEII.⁴¹ Therefore, we clarify that, while as a general matter the location or name of infrastructure is not CEII, a submitter of information to the Commission may ask that non-public information about the location, or the name, of critical infrastructure be treated as CEII. The submitter would have to provide a justification for the request and explain why the information is not already publicly known.

25. In response to NRECA’s request that the Commission clarify that material treated as Critical Energy Infrastructure Information under the Commission’s current regulations would, in most circumstances, be treated as CEII under the amended regulations, we note that such information should continue to qualify as CEII. We also note, however, in response to Powerex’s comment, that it is conceivable that Critical Electric Infrastructure Information may include information that would not fall within the existing definition of Critical Energy Infrastructure Information.⁴²

26. We agree with Powerex’s comment that the Final Rule should only address CEII and not other types of information. In response to Powerex’s concerns about a party’s due process rights, under the amended CEII regulations the Commission will balance the need to protect critical information with the potential need of parties participating in Commission proceedings to access CEII. For example, the Commission’s regulations include a process for parties to access information directly from other parties in a Commission proceeding.⁴³

27. In response to comments from TAPS, APPA, and the Trade Associations, the Commission agrees that the CEII NDA should reference the provision in section 215A(d)(1) that CEII is exempt from disclosure under any Federal, State, political subdivision or tribal law requiring public disclosure. We disagree that the State Agency NDA should be eliminated because it reinforces the minimum protections applicable to CEII that the Commission may provide to states as well as provides for additional protections beyond the exemptions in State public disclosure laws.⁴⁴

28. Finally, the Commission declines to adopt the revision suggested by the Trade Associations to expressly state that the CEII regulations are not intended to supersede other laws, regulations, and agency rules that separately safeguard such data.⁴⁵ This Final Rule and adopted CEII amendments do not purport to supersede any other legal authorities other than the regulations and associated materials specifically amended in this Final Rule.

2. Criteria and Procedures for Determining What Constitutes CEII

   1. General Criteria and Procedures

NOPR

29. Section 215A(d)(2)(A) requires the Commission to “establish criteria and procedures to designate information as critical electric infrastructure information.” In the NOPR, the Commission proposed criteria and procedures for the handling of CEII consistent with section 215A(d)(2)(A).⁴⁶

Comments

30. Commenters request that the Commission provide more detail on what qualifies as CEII.⁴⁷ The Public Interest Organizations, for example, ask the Commission to publish guidelines and criteria for designating information as CEII.⁴⁸ The Public Interest Organizations further recommend that the Commission publish “data tables that provide suggested classifications for common data types.”⁴⁹ HRC asks that the Commission require entities filing CEII to include a public cover letter providing a description of the facility the information relates to and describing the nature of the submission. HRC also contends that information submitted as CEII should include a more detailed description in eLibrary.⁵⁰ HRC contends that this information will better allow the public to understand the basis for the CEII classification.⁵¹ HRC also requests that the Commission develop a procedure whereby the public can request that the Commission review information at the time of submission to ensure that it was properly submitted as CEII.⁵² HRC contends that filing a CEII or FOIA request as a means of triggering the review of CEII classification is burdensome.⁵³

31. WIRAB and APS commented that additional designation guidance is needed in order to avoid submitters’ over-designation of documents as CEII. Specifically, WIRAB and APS recommend that the Commission establish separate criteria for determining when information qualifies as CEII on the basis of national security, economic security or public health or safety.⁵⁴

32. The Trade Associations maintain that the Commission’s regulations should explicitly designate as CEII information “related to compliance with the Reliability Standards as critical electric infrastructure information and exempt it from disclosure under 388.113(f).”⁵⁵ The Trade Associations assert that a blanket presumption that information regarding Reliability Standards compliance is CEII is necessary because it “may … be difficult for a submitter to present, ex ante, a clear justification for meeting the critical electric infrastructure information definition for a particular system or asset, especially if the potential for negative effect could also arise from the disclosure of a combination of sets of information that alone may not meet the CEII definition.”⁵⁶

33. APPA and the Trade Associations raise concerns about how the designation criteria will apply to DOE.⁵⁷ Specifically, they assert that the Commission failed to provide criteria and procedures that would apply to DOE.⁵⁸ Additionally, Peak, Public Interest Organizations, and APPA request that the Commission hold a technical conference on the implementation of the new CEII rules as part of the “consultation with the Secretary” required by FPA section 215A(d)(2).⁵⁹

34. Finally, NRC requests that the Commission establish a generic CEII designation that other federal agencies can use to designate information.⁶⁰ NRC also recommends that the Commission clarify in the Final Rule that other federal agencies “are to establish their own procedures for identifying CEII on an information-specific basis utilizing the FERC’s generic CEII standard.”⁶¹

Commission Determination

35. The Commission is not persuaded that more detailed guidance or additional designation criteria in the CEII regulations are necessary. FPA section 215A(a)(2) defines Critical Electric Infrastructure as “a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.” FPA section 215A(a)(3) includes Critical Energy Infrastructure Information within CEII. We believe that the regulations, as proposed, provide adequate guidance for a submitter or Commission staff to determine whether information is CEII and for the CEII Coordinator to make a determination. In addition, the criteria and designation procedures adopted herein are informed by the Commission’s experience of implementing and administering the Critical Energy Infrastructure Information regulations over the past fifteen years.

36. The Commission does not agree that the scope of CEII should be modified, as suggested by the Trade Associations, to encompass information “related to compliance with the Reliability Standards.” The Trade Associations’ proposal is unduly broad and inconsistent with the FAST Act because it could lead to all infrastructure information, whether critical or not, being treated as CEII. For the same reason, we do not agree that the blanket presumption that information relating to compliance with Reliability Standards is CEII, proposed by the Trade Associations, is appropriate. Like other forms of CEII, however, information on compliance with Reliability Standards may be treated as CEII if the submitter justifies its treatment as CEII under the Commission’s regulations.

37. In response to HRC’s comments that documents listed as CEII could be better described in eLibrary, the level of detail needed for a document description in eLibrary is better addressed in our submission guidelines rather than in our regulations.⁶²

38. In response to HRC’s request for an additional process to obtain a ruling on CEII when it is filed, we believe that such a process is unnecessary, as entities seeking access to information filed as CEII may submit a FOIA or CEII request at any time, including promptly after that information is filed with the Commission. We further conclude that the proposed procedures are adequate for the Commission to process information submitted to the Commission, or generated by the Commission, as CEII.⁶³ As previously noted, the Commission receives over 7,000 CEII submissions a year; reviewing the information at the time of submission, in the absence of a specific request for that information, would be overly burdensome on the Commission’s resources. In response to a CEII request, the CEII Coordinator will review the information to determine whether to designate it as CEII. Further, proposed section 388.113(d)(1)(iv) specifically states that the Commission retains the right to make determinations with regard to any claim of CEII status, at any time.

39. In response to the comments from APPA and the Trade Associations, the Commission declines to revise the regulations to identify specific designation criteria and CEII procedures for DOE. Section 215A(d)(3) of the FAST Act provides that information “may be designated” by the Commission and DOE pursuant to the criteria and procedures that the Commission establishes.⁶⁴ The FAST Act, however, does not compel DOE to make any changes to its regulations in this regard, and as noted in the NOPR, nothing within the Commission’s regulations would limit DOE’s ability to designate CEII in accordance with the FAST Act.⁶⁵ Furthermore, we do not believe a technical conference is necessary to satisfy the requirement for consultation with DOE in the FAST Act.

40. Although the Commission recognizes that other agencies have an obligation to protect certain information in their custody, the FAST Act does not grant other federal agencies the authority to designate information as CEII. Critical Electric Infrastructure Information is specifically defined as information “designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to subsection (d).”⁶⁶ Congress’s intent to limit the designation authority to the Commission and DOE is reinforced by the fact that only the staff of the Commission and DOE are subject to sanctions for unauthorized release under section 215A(d)(2)(C).⁶⁷ However, because NRC has raised valid concerns about the protection of sensitive information of the electric grid in its custody, the Commission will make the following change to the amended scope of section 388.113:

Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information.

41. By this change, the Commission does not limit the discretion of other federal agencies to protect sensitive information in their custody but provides a mechanism for agencies to consult with the Commission’s CEII Coordinator regarding the treatment or designation of such information as CEII.⁶⁸ We believe this change strikes a reasonable balance by recognizing other federal agencies’ discretion to protect their information, while adhering to the statutory framework that limits CEII designation authority to the Commission and DOE.

2. Designation of Submissions to the Commission

NOPR

42. The Commission proposed to treat information submitted with a justification for CEII treatment as CEII, unless the submitter is otherwise notified by the Commission.⁶⁹

Comments

43. APS asks that the Commission “deem” information as CEII at the time an entity submits the information to the Commission.⁷⁰ HRC and Tacoma Power are concerned that “treating” a submission as CEII is not a designation and, as a result, submitting entities may not be able to assert the FOIA exemption when faced with a records request unless and until the Commission makes a CEII designation determination.⁷¹ Tacoma Power further requests that the Commission develop a process for state entities to receive a CEII designation determination so that state entities may assert any FOIA exemption with certainty.⁷²

44. INGAA, NERC, and the Trade Associations request that the Commission change the comment period afforded to submitters of CEII to respond to a request for CEII from five calendar days to five business days, ten working days, or at least 30 calendar days, respectively.⁷³ APS and CEA comment that if the Commission determines that particular information is not CEII, the Commission should provide the submitter with an explanation of why the information does not meet the criteria for designation as CEII.⁷⁴ The Trade Associations also request that the Commission provide a more detailed explanation in instances when CEII is released over an objection from the submitter of the material.⁷⁵

45. MISO, Trade Associations, CEA, and HRC submitted comments recommending changes to the Commission’s processing and evaluation of justification statements that must accompany a submitter’s request for CEII treatment. MISO is concerned that the Commission may automatically make information public if the submission fails to meet the Commission’s regulations. Thus, MISO recommends that amended section 388.113(d)(1) be revised to make clear that failure to provide the justification or other required information will be considered in the determination of whether the information will be maintained as CEII by the Commission, but it will not result in automatic disclosure of the information.⁷⁶

46. The Trade Associations maintain information submitted to the Commission for designation as CEII that ultimately is determined not to be CEII should not automatically be disclosed to the public because such information may be subject to other laws and regulations restricting disclosure of the information.⁷⁷

47. CEA recommends that the Commission provide the submitter with an opportunity to retract a submission and re-submit it with the appropriate justification.⁷⁸

Commission Determination

48. As an initial matter, we correct the statement in the NOPR erroneously stating that under our current practice, “the Commission deems the designation on a submission accepted as submitted.”⁷⁹ Our current practice is to treat information as CEII, and maintain it in our non-public files, when it is submitted with a request for CEII treatment. That practice is reflected in the current and proposed regulations.⁸⁰ Under the regulations adopted in this Final Rule information that is submitted will not be designated CEII until the CEII Coordinator makes such a determination.

49. As to the comments submitted by Tacoma Power, the Commission is not persuaded that a special expedited process for designations in the event a State entity is facing a public records request is needed, because State and local entities may consult with the CEII Coordinator as to whether information that is subject to a State, local, or other type of records request is CEII under the Commission’s regulations.⁸¹

50. In response to the comments from APS and CEA about the procedures for informing a submitter of a potential release or re-designation of CEII, the Commission’s current practices are sufficient to comply with the FAST Act and we maintain those practices under the adopted regulations. The current practice is to provide notice to the submitter if a proposed CEII designation will be rejected or if CEII will be released over an objection. The notification will include an explanation as to why the information does not meet the criteria and the submitter will have an opportunity to comment or seek appropriate relief under amended section 388.113(e)(4).

51. The Commission is not persuaded that it is necessary to make the changes proposed by MISO and CEA regarding treatment of information that is filed in a manner that does not meet our regulations. The amended regulations do not mandate automatic disclosure of the information. Furthermore, even if the Commission were to make information public, the Commission will provide notice to the submitter prior to any determination.⁸²

52. The Commission adopts INGAA’s proposal to change the comment period from five calendar days to five business days, and will change all references in section 388.113 from “calendar” days to “business” days. Allowing more time is not warranted because the issue of whether to release CEII is relatively limited and, as a general matter, the Commission endeavors to respond to requests for CEII as soon as possible. In addition, the Commission notes that submitters can request an extension of that time-period to submit comments to the Commission.

3. Information Included in NERC Databases

NOPR

53. The Commission proposed that information downloaded by Commission staff from private databases that are accessed pursuant to Commission order or regulation will be maintained as non-public information consistent with the Commission’s internal controls.⁸³ The Commission noted that in response to an information request, it will evaluate whether the information is CEII, proprietary information, or otherwise privileged or non-public and will provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.⁸⁴

Comments

54. Most commenters support treating data downloaded from the NERC databases as non-public. NERC agrees with the proposal to treat information downloaded from its databases as non-public, but it seeks clarification as to whether the Commission intends to designate the information as privileged and CEII.⁸⁵ TAPS requests that if the Commission determines to release database information, the manager of the database and the entity whose data would be released should receive notice and an opportunity to comment.⁸⁶

55. The Trade Associations recommend that the Commission treat the NERC databases information that Commission staff does not download as inextricably intertwined with downloaded information and thereby treat all of the information on each database as CEII.⁸⁷ TAPS raises concerns that information that is contained in a database may not be adequately protected from disclosure, because the data “is not being submitted to the Commission, but rather accessed by the Commission.”⁸⁸

CEA requests that the Commission respect Canadian information that may be accessed through any private databases accessible to the Commission.⁸⁹ CEA further comments that the Commission’s information gathering through other databases be restricted to U.S. facility information only.⁹⁰

Commission Determination

56. The Commission adopts the NOPR proposal to treat information downloaded from NERC databases as non-public⁹¹ and to evaluate whether it should be designated as CEII in response to a request for the information or if the Commission determines such information should be disclosed.⁹² In addition, because the CEII designation only applies to information that is submitted to or generated by the Commission, information that Commission staff accesses and reviews, but never takes custody of, cannot be designated as CEII. Therefore, the Commission disagrees with the proposal to treat all of the information in an accessed database as inextricably intertwined CEII.⁹³

57. The Commission clarifies that information downloaded by the Commission or its staff from a non-public NERC database will be treated as non-public information and will be afforded the same treatment as CEII. Thus, in the event the Commission receives a request for the information or the Commission determines such information should be disclosed, the Commission will “provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.”⁹⁴ In response to TAPS’s comments, we clarify that, where practicable, we will notify the database owner and the information owner.⁹⁵

58. Finally, as to CEA’s comment regarding Canadian information on other databases, we believe that CEA’s request goes beyond the scope of this rulemaking proceeding, which is limited to amending the Commission’s regulations regarding CEII.⁹⁶

4. Designation of Commission-Generated Information

NOPR

59. For Commission-generated information, the NOPR explained that the CEII Coordinator, after consultation with the appropriate Commission Office Director, will determine whether the information meets the definition of CEII.⁹⁷ The CEII Coordinator will then determine how long the CEII designation should last and, as appropriate, whether to make any re-designation.⁹⁸

Comments

60. The Trade Associations request that the Commission establish a process in which appropriate stakeholders may participate in the Commission’s CEII designation determinations for Commission-generated information.⁹⁹ The Trade Associations assert that whether the information is submitted to the Commission or not, “owners and operators of that critical infrastructure who will be faced with defending such a potential attack deserve to have input into the determination of whether or not such information should be disclosed.”¹⁰⁰

Commission Determination

61. The Commission determines that there is no need for stakeholder participation in the designation of Commission-generated information. The Commission has the expertise and experience to make determinations about whether Commission-generated information is CEII. And as a practical matter, it would not be appropriate in some circumstances for stakeholders to be privy to Commission-generated information that qualifies as CEII. For example, Commission-generated CEII may contain information that is otherwise non-public or privileged. To the extent that an entity believes that a Commission-generated document contains CEII about its facility, the entity is not precluded from raising that concern with the CEII Coordinator.

5. Segregable Information

NOPR

62. The NOPR recognized that information submitted to the Commission may contain parts that are CEII and parts that may not be CEII. As a result, the NOPR proposed to require entities submitting CEII and Commission staff who generate CEII, to the extent feasible, to segregate the CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) from non-CEII at the time of submission or staff’s generation, respectively.¹⁰¹

Comments

63. HRC and Powerex support the requirement to segregate CEII from non-CEII and encourage efforts to prevent the over-classification of information.¹⁰² TAPS asks the Commission to confirm that submitting a redacted public version of a filing satisfies the requirement to segregate CEII.¹⁰³ Powerex asks the Commission to clarify that derivative analyses performed by governmental entities or their contractors that use or rely on CEII, without more detail, should not be designated as CEII solely based on the fact the analysis relies on or uses CEII.¹⁰⁴

Commission Determination

64. The Commission clarifies that submitting a properly redacted public version of information submitted as CEII meets the requirement established in section 215A(d)(8). Moreover, derivative analyses that use or rely on CEII, without actually containing or disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII.

6. Duration of Designation

NOPR

65. Section 215A(d)(9) provides that information “may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.”¹⁰⁵ The NOPR stated that the five-year designation period will commence upon submission, and the expiration of the five-year period will not automatically trigger the public release of the information unless the Commission determines it is appropriate to do so.¹⁰⁶ The NOPR also stated that the Commission will make a re-designation determination when an entity requests the information; when staff determines a need to remove the designation; or when a submitter requests that the information no longer be treated as CEII.¹⁰⁷ Consistent with current practice, the NOPR proposed that a NDA will require protection of CEII past the expiration of the CEII designation marked on the information and that the recipient of CEII from the Commission must receive prior authorization from the Commission before making any disclosure.¹⁰⁸

66. In the NOPR, the Commission proposed removing the CEII designation when the information no longer could impair the security or reliability of not only the bulk-power system or distribution facilities but also other forms of energy infrastructure.¹⁰⁹ The Commission stated that the Commission would provide notice to the submitter “in the instance where the Commission takes the affirmative step to rescind the designation.”¹¹⁰

Comments

67. Several commenters support the proposal to maintain information as non-public after CEII designations marked on the information expire.¹¹¹ However, Peak requests that the Commission determine at the time of the designation whether the data will lose its protection after the five-year term ends and recommends creating designation categories that include designation timeframes.¹¹² The Trade Associations and APPA ask the Commission to automatically re-designate information, absent objection.¹¹³ Tallgrass requests that a designation remain for the life of a pipeline facility.¹¹⁴ INGAA requests that the Commission never un-designate CEII related to pipeline facilities on its own initiative or unilaterally as long as the facility is in operation.¹¹⁵

68. APS requests clarification on whether the criteria for re-designating CEII are the same as the criteria used for the initial CEII designation.¹¹⁶

69. NRECA and ITC assert that the NOPR is unclear with respect to the notice and comment provisions pertaining to a determination to remove CEII designations. In particular, they urge the Commission to clarify that submitters will receive notice, an opportunity to comment, and appeals rights prior to any determination to remove a CEII designation and prior to any disclosure of the information.¹¹⁷ ITC also states that the NOPR proposal to “notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing prior to the removal of the designation” is insufficient notice. ITC asks the Commission to provide notice and an opportunity to comment not only to the “person who submitted the document” but also to the organization on whose behalf the person submitted the document.¹¹⁸

70. APPA requests that the Commission revise the language in amended section 388.113(e) to ensure that designations made by DOE cannot be removed by the Commission.¹¹⁹

Commission Determination

71. The Commission adopts the NOPR proposal to treat expired CEII as non-public until a re-designation determination is made. Such a process is supported by the majority of commenters and is reasonable given the large volume of CEII presently in the Commission’s files and anticipated to be filed. Consistent with the NOPR’s intent, the Commission will modify the regulatory language in amended section 388.113(e) to indicate that the Commission will treat information as non-public after the CEII designation has lapsed; that no information will be released as non-CEII unless the Commission decides to release the information; and that notice and opportunity for comment will be provided to the submitter prior to any determination that the CEII designation of a submitted document should be removed.

72. We do not adopt the recommendations to automatically re-designate information, designate by category, or designate for the lifetime of a facility. Blanket designations are inconsistent with FPA section 215A(d)(9), which requires the Commission to specifically re-designate information.¹²⁰

73. In response to ITC’s comments that providing notice to the person who submitted the document is insufficient, we clarify that the Commission will provide the person and/or the organization identified on the submission notice an opportunity to comment as well as appeal rights prior to any determination to rescind a CEII designation or release the information.¹²¹

74. With respect to APPA’s comments regarding the Commission’s ability to remove a DOE designation, we clarify that the Commission does not intend to remove any designations that DOE may make. With respect to APS’s request for clarification regarding re-designations, we clarify that the regulations adopted herein do not differentiate between the processes for designating or re-designating information as CEII.

7. Judicial Review of Designation

NOPR

75. The Commission proposed to require a person seeking to challenge a Commission designation determination to file an administrative appeal with the Commission’s General Counsel prior to seeking judicial review in federal district court under section 215A(d)(11).¹²²

Comments

76. HRC contends that the Commission’s administrative appeal requirement should not be mandatory.¹²³ NRECA asserts that the Commission does not have a legal basis for the administrative appeal requirement.¹²⁴ NRECA also recommends that the regulations specify the timeframes in which appeals can be pursued; a timeframe for when a decision on the appeal should be rendered; and that the designation will remain in place until legal challenges have been exhausted.¹²⁵

77. NRECA contends that the Commission must revise the delegation authority provisions in section 375.313 to allow the General Counsel to hear and decide an administrative appeal.¹²⁶

Commission Determination

78. With respect to NRECA and HRC’s comment, Congress directed the Commission to establish criteria and procedures to designate information as CEII, and the mandatory appeal to the Commission’s General Counsel is a procedure that will assist in proper designation of such information. Requiring a party to exhaust administrative remedies prior to taking a matter to court is a standard and basic function of administrative law.¹²⁷ The administrative appeal process gives the Commission an opportunity to correct any error and to ensure that Commission policy has been properly complied with. This process creates efficiency in the administrative process and promotes judicial economy. In addition, the current FOIA and CEII process provides for administrative appeal.¹²⁸

79. In response to NRECA’s suggestion regarding appeal timeframes, the Commission will revise the amended regulations at section 388.113(j) to provide more specificity about the process for submitting an administrative appeal. After receiving a determination that information no longer qualifies as CEII, a submitter may appeal that determination.  To make an appeal, the submitter must file a notice of appeal to the General Counsel, copying the CEII Coordinator, within 5 business days of the date of the determination.¹²⁹  A statement in support of the appeal (a statement providing applicable facts and legal authority) must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the appeal.  A determination denying a request for disclosure or denying a request to designate a document as public may also be appealed.  A notice of appeal is not required for these determinations because information would not be disclosed under the challenged decision.  However, the requester must submit an appeal within 20 business days of the date of the determination by submitting its statement in support of its appeal to the Commission’s General Counsel.¹³⁰ The General Counsel or the General Counsel’s designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal, unless extended pursuant to section 388.110(b)(1), which will equally apply to CEII for purposes of appeals.

80. To avoid any uncertainty, the Commission will amend section 375.309 to include a provision to make clear that the Commission has delegated to the General Counsel authority to make determinations on behalf of the Commission on appeals of designations and determinations regarding CEII.

3. Duty to Protect CEII

NOPR

81. The Commission proposed revisions to strengthen the handling requirements for Commission employees and external recipients of CEII. With respect to Commission staff, the Commission proposed to add section 388.113(h) to require Commissioners, Commission staff, and Commission contractors to comply with the Commission’s internal controls.¹³¹ For external recipients of CEII, the Commission proposed requiring requesters to provide specific information to demonstrate a legitimate need for the information and to include a signed statement attesting to the accuracy of the information provided in any CEII request.¹³² The Commission also proposed that all NDAs minimally require that CEII: (1) will only be used for the purpose it was requested; (2) may only be discussed with authorized recipients; (3) must be kept in a secure place in a manner that would prevent unauthorized access; and (4) must be destroyed or returned to the Commission upon request. The Commission also proposed that the NDA make clear that the Commission may audit compliance with the NDA.

Comments

82. The Trade Associations request that the Commission provide further details of the content and nature of the internal controls and include them in the Commission’s regulations.¹³³ MISO agrees that the Commission should have internal controls and notes that the internal controls should be enforced.¹³⁴

83. Several commenters request that the Commission expand the list of minimum requirements for a NDA. MISO and NRECA note that the NOPR recognizes the need for requesters to protect CEII after the designation has lapsed and recommend that the duty to protect expired CEII be included in the minimum NDA requirements.¹³⁵ MISO, the Trade Associations and APS recommend that the Commission require recipients to report all unauthorized disclosures.¹³⁶ NERC recommends adding to the NDA a requirement that a recipient must destroy or return CEII by specific deadlines.¹³⁷ NERC and the Trade Associations request that submitters be able to enforce the terms of a NDA that covers the submitter’s CEII.¹³⁸

84. In addition to the NDA recommendations stated above, the Trade Associations request that the Commission add the following clauses to the NDA: (1) recipients of CEII shall have information protection policies and procedures to protect the CEII; and (2) an officer of the recipient’s organization, on behalf of the organization, as well as all individuals who will have access to the CEII, shall execute the NDA, which shall specify that the individuals and organization face sanctions for failure to honor the terms of the NDA.¹³⁹

85. APS encourages the Commission to review the current NDA for potential gaps, such as the lack of an obligation to treat CEII with the same degree of care as a requester would treat its own confidential or proprietary information.¹⁴⁰ NRECA asks the Commission to clarify that a NDA is required when an entity receives CEII after the designation expires.¹⁴¹

86. Peak seeks clarification regarding the requirements for keeping CEII in a secure place and manner.¹⁴² Peak explains that recipients of CEII may have different views of what constitutes a “secure place.”¹⁴³

87. The Trade Associations recommend that the Commission adopt a monitoring and enforcement process to discourage unauthorized disclosures and ask for additional language clarifying that “any person or entity found to have used or disclosed CEII in a manner inconsistent with the NDA will lose its access to CEII for an extended period of time.”¹⁴⁴ The Trade Associations and NRECA suggest that the Commission determine that noncompliance with the NDA would subject an individual to penalties of up to $1 million per violation per day.¹⁴⁵

88. NERC requests that the Commission ensure that requesters have not been convicted of criminal activity by performing background checks, reviewing watch lists, and verifying security clearances to prevent inadvertent disclosures of CEII to a person with a criminal record or who is under investigation or on a terrorist watch list.¹⁴⁶

89. NERC also proposes that the Commission include evidentiary criteria to determine whether a requester of CEII is legitimate, and the Trade Associations ask the Commission to conduct risk assessments on all requesters.¹⁴⁷

90. APS urges the Commission to require all requests to include at least two business references and the submission of documentation of authority for organizational requesters.¹⁴⁸ Peak requests that if a CEII request is not for participation in a specific proceeding, the requester should be required to include in its statement of need a “reliability or societal benefit.”¹⁴⁹

Commission Determination

91. We disagree with the Trade Associations’ recommendation that we provide additional details regarding internal controls and that we include internal controls in the Commission’s regulations. The NOPR stated that the internal controls will address “how sensitive information, including CEII, should be handled, marked, and kept.”¹⁵⁰ We find that this statement provides sufficient details regarding the nature of the internal controls. We also conclude that internal controls should not be specified in the Commission’s regulations to allow Commission staff the flexibility to revise such controls as needed.¹⁵¹

92. Amended section 388.113(h)(2) only includes “minimum” requirements for a NDA and is not intended to be exhaustive or preclude other requirements. Under certain circumstances the Commission may add additional provisions to the NDA and submitters may request that additional provisions be added to the NDA.

93. In response to MISO’s and NRECA’s comments, the Commission will amend section 388.113(h)(2) to require a recipient of CEII under a NDA to protect the CEII after a designation lapses as part of the list of minimum requirements of a NDA. In response to the comments by MISO, the Trade Associations and APS, we will also amend section 388.113(h)(2) to add an obligation to require CEII recipients to promptly report all unauthorized disclosures of CEII to the Commission.

94. In response to NRECA’s concern, the Commission clarifies that a requester seeking information past the expiration of the CEII designation marked on the information must still pursue the information through the CEII or FOIA processes. We read NRECA’s comments to apply to situations where an entity requests information that has been submitted to the Commission more than five years prior to the request and the Commission has not made a determination to re-designate the information. In these situations, the CEII Coordinator will make a re-designation determination as part of the response to a request seeking access to information that has a designation determination older than five years. If the information is re-designated as CEII, then it will be processed pursuant to the Commission’s requirements for CEII.

95. The Commission is not persuaded by Peak’s comments that there is a need to clarify what constitutes maintaining CEII in a secure place. We believe that a “secure place,” as articulated in the NDA, has a well-understood meaning, i.e. safe or free from unauthorized access or a risk of loss.

96. The Commission believes that it has sufficient authority to enforce the terms of the NDA and, as a result, it is unnecessary to confer on NERC or others authority to enforce the terms of a NDA.

97. In response to the comments of the Trade Associations and NRECA, the Commission notes that the FAST Act does not require the Commission to develop sanctions for external recipients of CEII. In any event, the general CEII NDA already states that a violation of the NDA may result in civil sanctions for an external recipient of CEII, and it will continue to do so. It is not necessary to list all the various civil sanctions that may apply, as each matter would be reviewed on its own facts. For these reasons, we also decline to adopt the Trade Associations’ recommendation that we add to the minimum requirements of a NDA a provision that CEII recipients may be sanctioned by losing access to CEII for an extended period of time.

98. The Commission agrees that it is important to ensure that requesters of CEII do not pose security risks. CEII requesters have historically fallen into different categories, including individuals known to the Commission with no known risk.¹⁵² The Commission will continue the practice of requiring information needed to verify the legitimacy of a requester on an as-needed basis. As such, there is no need for a CEII requester to demonstrate that there is a “reliability or social benefit” to the request. We believe that our procedures have adequately assessed whether requestors should receive CEII. In addition, we propose additional requirements for a requester to obtain CEII information. Thus, given these procedures, it is not necessary to mandate specific background check criteria in the regulations. Moreover, while the current request form asks for a business reference, we are not persuaded that such a submission is necessary in all instances or that two references are necessary.¹⁵³

4. Sanctions

NOPR

99. Section 215A(d)(2)(C) of the FPA requires the Commission to “ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or DOE who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section.”¹⁵⁴ The Commission proposed sanctioning unauthorized disclosures of CEII by Commission personnel and further noted that DOE will have responsibility for sanctions for unauthorized disclosures by its officers and employees.¹⁵⁵ The Commission also proposed to refer any misconduct by the Chairman or Commissioners to the DOE Inspector General (DOE IG).¹⁵⁶

Comments

100. Several commenters, including APPA and the Trade Associations, point to the absence of stated sanctions for Commissioners in the NOPR and request that the Commission consider whether to impose civil sanctions under section 316A of the FPA and criminal penalties under section 316(b) of the FPA.¹⁵⁷ APPA also recommends that the Commission consider referring unauthorized CEII disclosures by Commissioners to the Department of Justice (DOJ) and that the Commission coordinate with DOE to outline a new or cite an existing procedure that DOE can utilize to sanction its employees.¹⁵⁸ MISO suggests that the Commission’s General Counsel be tasked with referring any willful, unauthorized disclosures to the DOE IG.¹⁵⁹ NRECA asks that a mechanism be put in place for the public to make a referral to the DOE IG if they are aware of any misconduct.¹⁶⁰ MISO and NRECA recommend that the Commission revise its proposed rule to make clear that the Commission “shall” refer any misconduct to the DOE IG and to allow the public to refer matters to the DOE IG.¹⁶¹

Commission Determination

101. As discussed below, we conclude that the sanctions adopted in this Final Rule, as well as other reforms adopted prior to the passage of the FAST Act, provide sufficient deterrents to the unauthorized disclosure of CEII.

102. First, we note that, in addition to the changes adopted in this Final Rule, the Commission has recently made a number of changes to its internal procedures to ensure the protection and security of CEII.

103. The Commission has revised its security classification and ethics training to ensure that Commission employees are aware of their responsibility to protect sensitive nonpublic information. The Commission also has strengthened its protection of CEII and other sensitive, non-public information. For example, the Commission conducted a comprehensive review of its internal information governance procedures, which informed the development of the internal controls referenced in this Final Rule. We believe that these reforms should help protect against unauthorized disclosure of CEII.

104. The Commission has also taken steps to ensure that there are appropriate sanctions in place for certain persons who knowingly and willfully disclose CEII without authorization. With respect to former employees and Commissioners, the Commission has strengthened certain requirements applicable to departing employees and Commissioners by requiring them to certify that they are not unlawfully removing records from the agency. This certification form also identifies and requires a departing employee or Commissioner to acknowledge the potential criminal penalties associated with the unlawful removal or destruction of federal records. While these changes pre-date the passage of the FAST Act, they are an important component of the Commission’s ongoing efforts to protect against improper disclosure of CEII.

105. As to existing Commission officers, employees, and agents, we conclude that the sanctions adopted in this Final Rule are appropriate, as they provide for possible dismissal from federal service and criminal prosecution for improper disclosure of CEII. These sanctions should serve as a deterrent to, and punishment for, improper activity.

106. With respect to Commissioners, we believe it is appropriate that violations be referred to the DOE IG, as that office is equipped to investigate a Commissioner’s actions and impose sanctions on a Commissioner through an independent process outside of the Commission’s enforcement process.¹⁶² For example, it is within the DOE IG’s discretion after concluding its investigation to refer a matter to the DOJ for criminal prosecution Upon becoming aware of a potentially improper disclosure of CEII, the Designated Agency Ethics Official (DAEO) will oversee an examination of those circumstances. If there is reason to believe that an improper disclosure has occurred, the DAEO will refer the matter to the DOE IG.

107. Finally we conclude that there is no need to add a mechanism to our regulations for the public to make a referral to the DOE IG, as the DOE IG has an existing hotline in place for the public.¹⁶³ The Commission will also continue to defer to DOE as to what sanctions would be appropriate for DOE officers and employees.

5. Voluntary Sharing of CEII

NOPR

108. Section 215A(d)(2)(D) of the FPA requires that the Commission:

taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of critical electric infrastructure information with, between, and by — (i) Federal, State, political subdivision, and tribal authorities; (ii) the Electric Reliability Organization; (iii) regional entities; (iv) information sharing and analysis centers established pursuant to Presidential Decision Directive 63; (v) owners, operators, and users of critical electric infrastructure in the United States; and (vi) other entities determined appropriate by the Commission.¹⁶⁴

109. The Commission proposed that it would voluntarily share Commission-generated CEII and CEII submitted to the Commission with individuals or organizations when there is a need to ensure that energy infrastructure is protected.¹⁶⁵ Under this proposal, the Commission may voluntarily share CEII without receiving a request for the CEII.¹⁶⁶ However, the NOPR proposed that all voluntarily shared CEII would be shared subject to an appropriate NDA or Acknowledgement and Agreement.¹⁶⁷ Additionally, the NOPR proposed to require an Office Director or his designee to consult with the CEII Coordinator before voluntarily sharing CEII.¹⁶⁸

110. In the NOPR, the Commission also noted that it retains the discretion to release information as necessary for other federal agencies to carry out their jurisdictional responsibilities.¹⁶⁹

111. The NOPR also proposed that the Commission may impose additional restrictions on how voluntarily shared CEII may be used and maintained.¹⁷⁰ Where practicable, the Commission proposed providing notice of its voluntary sharing of CEII to the submitter of the CEII.¹⁷¹

Comments

112. Several commenters observe that the NOPR only addressed the Commission’s voluntary sharing of CEII and did not establish guidelines for the voluntary sharing of CEII “with, between, and by” other entities.¹⁷² Powerex requests that the Commission facilitate the sharing of CEII between and by owners, operators, and users of the critical electric infrastructure, while still adequately safeguarding CEII.¹⁷³ The Public Interest Organizations and WIRAB recommend that the Commission adopt a “white list” of CEII requesters that the Commission determines do not pose a risk of unauthorized disclosure.¹⁷⁴ They also contend that the Commission should adopt a universal NDA to encourage more sharing between and by non-Commission entities.¹⁷⁵ WIRAB also seeks standardization of NDAs used by NERC, regional entities, and the owners and operators of Critical Electric Infrastructure in the United States.¹⁷⁶

113. The Joint RTOs (ISO New England, Inc. and Southwest Power Pool, Inc.) suggest that the Commission facilitate the sharing of CEII by permitting regional transmission organizations (RTOs), independent system operators (ISOs), and other entities with FERC-approved tariffs or similar agreements to share CEII “between the entities relying on their tariff information-handling commitments.”¹⁷⁷ In response, PJM states that the Commission should reject the Joint RTOs’ proposal, arguing that it is incomplete and overbroad and fails to acknowledge results achieved through the current sharing of CEII.¹⁷⁸ The Joint RTOs, in reply comments, state that their proposal would simply allow ISOs, RTOs, and other entities with Commission-approved tariffs that have planning and operations responsibilities to use those tariffs to facilitate information-sharing.¹⁷⁹

114. NERC generally supports the Commission’s proposal to facilitate voluntary information sharing with NERC, regional entities and information sharing and analysis centers. NERC, nonetheless, requests that the Commission, under appropriate circumstances, share CEII with the Electricity Information Sharing & Analysis Center (E-ISAC) when voluntarily sharing CEII with a governmental entity.¹⁸⁰ NERC asks that the voluntary sharing process include coordination between the CEII Coordinator and certain Commission office staff prior to any disclosure.¹⁸¹

115. APS, the Trade Associations and CEA ask for additional criteria as to how and when the Commission will voluntarily share information.¹⁸²

116. APPA asserts that FPA § 215A(d)(2)(D) directs the Commission only to facilitate voluntary sharing of CEII among electricity subsector stakeholders – not to preemptively share CEII with interested parties.¹⁸³ APPA asserts that when the Commission voluntarily shares submitted information, it effectively forces the entity that submitted the information as CEII to share its information with others, which may reduce the incentive for the entity to voluntarily share CEII with the Commission.¹⁸⁴ APPA recommends that the Commission designate E-ISAC and any other appropriate Information Sharing and Analysis Organizations (ISAOs) as forums through which CEII can be shared under FPA § 215A, and to apply the liability protections of FPA section 215A(f)(3) to those entities.¹⁸⁵ APPA also recommends that the Commission provide protections like those that are utilized by other federal agencies to facilitate information sharing activity.¹⁸⁶

117. The Trade Associations request that the regulations explicitly state that the voluntary sharing of CEII is limited to instances where the Commission has determined that there is a need to “ensure that energy infrastructure is protected.”¹⁸⁷

118. CEA requests that the Commission include language clarifying that the Commission will make every reasonable effort to provide advance notice before sharing CEII and will provide after-the-fact notice if prior notice is not practical.¹⁸⁸ MISO recommends that the Commission adopt regulatory language indicating that “when prior notice is not given, submitters of CEII shall receive notice of a limited release of CEII as soon as practicable.”¹⁸⁹ NRECA requests that the Commission clarify that any disclosure by the Commission on the basis of “voluntary sharing” must be subject to the same notice, comment, and appeal rights provisions that are afforded to submitters in response to CEII requests.¹⁹⁰

119. The Trade Associations state that the proposed regulations could be strengthened by: (1) limiting and defining the circumstances where notice would “not be practicable”; and (2) allowing the submitters an opportunity to provide comments protesting the release of information the Commission proposes to voluntarily share.¹⁹¹

120. Finally, TAPS requests that the Commission revise its delegations to reflect the NOPR’s proposal that Office Directors will engage in voluntary sharing.¹⁹²

Commission Determination

121. Many of the commenters misapprehend how CEII may be voluntarily shared under the FAST Act or otherwise seek to expand the Commission’s CEII sharing program in ways that neither the FAST Act nor the NOPR contemplated. Under FPA section 215A(a)(3), CEII is limited to information that is submitted to, or generated by, the Commission and designated as such by the Commission (or information submitted to, or generated by DOE, and designated as such by DOE).¹⁹³ In voluntarily releasing CEII to a person, the Commission imposes obligations on that person through a NDA. However, the Commission’s CEII rules do not, and are not intended to, address information that an entity has unilaterally determined to be CEII and never submitted to the Commission.¹⁹⁴ In addition, the Commission’s regulations do not cover an entity that has submitted CEII to the Commission but intends to share the same information with others outside of the Commission’s processes. To be clear, an entity that receives CEII from the Commission is subject to the restrictions in the applicable NDA, including restrictions on use and disclosure. However, an entity that submitted the information to the Commission is not subject to a NDA and, as a result, the Commission’s rules do not apply to how that entity may want to share its information.¹⁹⁵ Moreover, an entity may have information that could qualify as CEII, but such information is not CEII under the Commission’s regulations unless it has been submitted to the Commission pursuant to the Commission’s CEII regulations and the Commission has determined it to be CEII.

122. The Final Rule facilitates voluntary sharing by allowing the public to request CEII and by adding to the Commission’s regulations a process whereby staff may share CEII in a proactive manner with a variety of entities. The Commission agrees with PJM’s comments that existing non-public voluntary sharing mechanisms within the energy industry are sufficient to encourage sharing information among the different groups and therefore there is no need for the Commission to establish requirements for sharing within the industry through tariff revisions or otherwise.¹⁹⁶ It is also unnecessary to adopt Public Interest Organizations’ and WIRAB’s recommendation that the Commission establish “whitelists” for third parties to use or to require entities sharing information outside of the Commission’s CEII process to adopt a particular NDA.

123. The Commission agrees with NERC and APPA that the plain language of the statute expressly provides for the voluntary sharing of information with entities like E-ISAC and other ISAOs. Section 215A(d)(2)(iv) concerns the voluntary sharing of CEII with, between, and by “information sharing and analysis centers established pursuant to Presidential Decision Directive 63.” Pursuant to that provision, the Commission anticipates voluntary sharing of information with, between and by E-ISAC and other ISAOs under the appropriate circumstances. Under our current NDAs, CEII recipients may share CEII with other individuals covered by a NDA for the same information.¹⁹⁷ When information is provided in accordance with section 215A(d) the provisions for release from liability in section 215A(f)(3) would apply.

124. The Commission disagrees with APPA that E-ISAC or another ISAO should be designated as a forum to share CEII. The FAST Act does not specify that the Commission should designate E-ISAC, another ISAO, or any other entity as a forum through which CEII can be shared under section 215A. In fact, a plain reading of the statute indicates that Congress designated the Commission as the entity to facilitate this sharing. As such, the Commission declines to take the recommendation of APPA.

125. We disagree with APPA’s assertions that the voluntary sharing provision in the Commission’s regulations effectively requires entities to share CEII with another entity or the Commission.¹⁹⁸ Section 215A(d)(6) explicitly states that an entity is not required to share CEII with the Commission or another entity or person.¹⁹⁹ The voluntary sharing provision does not impose a sharing requirement on entities; instead, it allows the Commission discretion to share, in certain circumstances, CEII that has already been submitted to, or generated by, the Commission.

126. Even if the Commission’s voluntary sharing of information were viewed as the same as a third-party sharing it, the Commission must balance its obligation to disclose information as necessary to carry out its jurisdictional responsibilities against an entity’s possible preference not to have such information disclosed.²⁰⁰ The regulations adopted here achieve that balance. Furthermore, the Fast Act does not place limits on the Commission’s ability to share information in its possession when authorized and necessary to carry out the requirements of the FAST Act or the Commission’s other jurisdictional responsibilities.

127. As noted in the NOPR, in some circumstances, providing notice to a submitter of CEII that its information will be shared under section 215A could hamper the ability of the Commission to act in a timely way.²⁰¹ The Commission, therefore, disagrees with the comments by APPA and NRECA that prior notice must be provided in each instance where the Commissions uses the voluntary sharing provisions of section 215A. However, in response to the comments, the Commission clarifies in amended section 388.113(f) that the Commission will not provide advanced notice only in situations where there is an urgent need to disseminate the information. The Commission will also adopt MISO’s and CEA’s proposal that when prior notice is not given, the Commission will provide submitters of CEII whose information was shared with notice as soon as practicable.

128. The NOPR proposed to require that a consultation between the CEII Coordinator and the appropriate Office Director take place prior to any voluntary sharing of CEII. We disagree with NERC’s proposal to add a requirement that staff from the Commission’s Office of Electric Reliability (OER) and Office of Energy Infrastructure Security (OEIS) be involved in all voluntary sharing consultations because the information in question may not involve OEIS or OER subject matter. However, we note that the CEII Coordinator will consult with Commission staff as appropriate, which could include OER and OEIS staff. The Commission is also not persuaded that it is necessary to provide additional details regarding the factors the Commission will use to determine when voluntary sharing is appropriate. The NOPR specifically proposed that the Commission will voluntarily share “CEII with individuals and organizations that the Commission has determined need the information to ensure that energy infrastructure is protected.”²⁰² Thus, the NOPR provided sufficient details on the circumstances in which the Commission will voluntarily share CEII. Providing more details may unnecessarily restrict the Commission’s ability to voluntarily share needed information.

129. The Commission disagrees with APPA’s suggestion that the regulations should include more developed protections to facilitate information sharing. ²⁰³ The Commission believes that procedures outlined in the NOPR are sufficient to protect CEII that the Commission shares. When the Commission voluntarily shares information, CEII will be shared subject to an appropriate NDA or Acknowledgement and Agreement.²⁰⁴ Moreover, under section 388.113(f), the Commission may impose additional conditions on how the information may be used and maintained that the Commission voluntarily shares.

130. In response to TAPS’s comment, the Commission finds that the CEII Coordinator delegation in section 375.313 is sufficient and does not require separate delegations for Office Directors to voluntarily share CEII. Moreover, existing section 388.113(d)(1) has allowed Commission staff to share Critical Energy Infrastructure Information with facility owners and operators. No such delegated authority has been used for such sharing.

6. Request for Access to CEII

NOPR

131. The Commission proposed to maintain special access procedures for owner-operators of facilities, federal agencies, and intervening parties.²⁰⁵ For intervenors, the Commission proposed to move the existing procedures in section 388.112 to section 388.113 and to eliminate the exemption for certain LNG materials.²⁰⁶ For general requesters, the Commission added a one-year time limit for organizational requests and added back a time requirement for the Commission to process CEII requests.²⁰⁷ The Commission also proposed adding a provision to clarify that the Commission’s CEII regulations should not be construed to require the release of certain non-CEII.²⁰⁸

Comments

132. APPA recommends that the Commission adopt a tiered system with varying levels of access restrictions.²⁰⁹ APPA and the Trade Associations suggest that the Commission create a distinct “need to know” standard to access information related to the bulk-power system.²¹⁰ Under this suggested standard, CEII would only be disclosed when the person or entity seeking the information has a direct “need to know” in order to maintain reliability, safety, or security.²¹¹

133. The Trade Associations recommend that if an academic institution or other members of the public request CEII, the Commission should deny the request and refer the request to the information owner.²¹² Peak, on the other hand, supports data sharing with researchers and asks the Commission to permit researchers to access CEII data.²¹³ Peak also suggests that the Commission consider whether “research institutions with defined cyber security and employee background checks” should have a specific process for obtaining CEII.²¹⁴ WIRAB supports the Commission’s balancing approach for determining who should receive CEII, but WIRAB recommends that the Commission delete the portion of proposed section 388.113(g)(iv) that states that the Commission can deny a request for “other reasons.”²¹⁵

134. Peak recommends that the Commission’s sharing of CEII with owners and operators should not be limited to information related to “its own facility.”²¹⁶

135. Public Interest Organizations support the NOPR’s proposed revisions allowing certain LNG materials to be accessible in proceedings in which there is a right to intervention.²¹⁷ Public Interest Organizations suggest that “the Commission streamline the release of CEII data for intervenors by allowing one request to trigger release of all of an entity’s CEII data.”²¹⁸

136. MISO notes that for purposes of consistency, the Commission should add language already in section 388.112(b)(iv) to amended section 388.113(g)(4) to ensure that, if an objection to a request for disclosure is filed, whether the information is privileged or CEII, “the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority.”²¹⁹

137. Peak asks the Commission to clarify whether the protections proposed in section 388.113(g)(2) regarding the obligation of federal agency recipients to protect CEII in the same manner as the Commission extends to data generated by a federal agency through an analysis of CEII.²²⁰

138. APS requests that the Commission revise amended section 388.113(g)(5)(vi) to require organizational requesters to promptly update/remove individuals from their list of approved individuals.²²¹

139. The Trade Associations and APS state that they are concerned that amended section 388.113(g)(5)(v), which allows an individual under an organizational request to have access to CEII for the remainder of a calendar year, may result in a less robust verification system.²²² WIRAB supports allowing requesters to maintain their validity for the duration of the calendar year.²²³

140. INGAA asks for acknowledgment that the Commission approves of entities providing requested information directly to CEII requesters.²²⁴ INGAA also requests that proposed section 388.113(g)(5)(ix) be modified to add “information on rare species of plants and animals” to the list of items not required to be released through the CEII process.²²⁵

141. Public Interest Organizations ask the Commission to establish a reasonable timeline for the review of and response to CEII requests.²²⁶ APS requests that the Commission add a default twenty-day time period to respond to CEII requests unless the information is needed in fewer than twenty days.²²⁷ NERC suggests that the Commission add a provision indicating that the Commission may toll the response time when there is a need to gather further information from the requester.²²⁸

142. NERC requests that the appeal rights available to requesters be made available to submitting entities to avoid disclosures that might place CEII at risk.²²⁹ TAPS asks for clarification that when conditions are imposed on a receipt of CEII, appeal rights will be granted.²³⁰

Commission Determination

143. APPA and the Trade Associations have not demonstrated a need for the Commission to change its practices and use a tiered system of categories of CEII or a heightened “need to know” standard for bulk-power system information. The Commission will continue to “balance the requestor’s need for the information against the sensitivity of the information.”²³¹ The Commission has utilized this balancing approach effectively in response to Critical Energy Infrastructure Information requests for almost fifteen years. The balancing approach has provided to individuals with a demonstrated need access to information subject to a NDA. However, in some instances, the Commission has balanced a requester’s asserted need for the information against its sensitivity and has determined not to produce certain types of CEII to the requester. The Commission will continue this balancing approach under the Final Rule.

144. As noted above, the FAST Act does not require changes to the Commission’s existing process for accessing information. The CEII Coordinator will continue to evaluate each request individually. In response to Peak’s comments, the Commission notes that the current procedures allow academics to obtain CEII, and that the Commission does, as appropriate in individual rulemakings, consider whether certain categories of information should generally be made available for research.²³² The Commission is not persuaded that any changes should be made to restrict or expand access to CEII by academics.

145. The Commission also disagrees with deleting the term “other reasons” from proposed section 388.113(g)(5)(iv) as there may be other legitimate reasons why the Commission would not permit access to certain CEII in particular situations.

146. The Commission is not persuaded that it needs to adopt Peak’s proposed changes to the owner-operator provision. An owner-operator has a need to obtain CEII about its own facility. To the extent the owner-operator needs other CEII, it can pursue additional information through the regular CEII request process.

147. As to the comment by Public Interest Organizations, the Final Rule maintains the mechanism for interveners to request CEII outside of the CEII process.²³³

148. The Commission agrees with MISO’s change to proposed section 388.113(g)(4), and amends that provision to include all of the language that currently exists in section 388.112(b)(2)(iv) to ensure that if an objection to the disclosure of CEII is filed, the information will not be disclosed until directed by the Commission or a decisional authority.

149. In response to Peak’s comments, the Commission clarifies that a federal agency in receipt of CEII from the Commission must protect that information in the same manner as the Commission. That agency will be required to execute an appropriate Agency Acknowledgment and Agreement. We clarify that derivative analyses that use or rely on CEII, without actually disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII.²³⁴

150. Recognizing that the employment status and circumstances surrounding an individual or organization can change, in response to APS’s comment, the Commission will modify the NDAs to indicate that a recipient of CEII must promptly notify the Commission if any changed conditions, such as a change in employment, occur.

151. Amended section 388.113(g)(5)(v) recognizes that in some instances a requester may request CEII multiple times during a calendar year. In response to comments by APS and Trade Associations regarding the robustness of the requester verifications, the Commission clarifies that each request will be reviewed by balancing the needs of the requester against the sensitivity of the requested information.

152. In response to INGAA’s request, the Commission notes that under the current CEII rules, entities may share information that they submitted to the Commission with a request for CEII treatment (as opposed to CEII that they received from the Commission) directly with other entities, and the Commission will continue to encourage and support such a practice. The Commission adopts INGAA’s recommendation that “information about rare species of plants and animals” be added to the section 388.113(g)(5)(ix) list of items that are not required to be released when the information is inextricably intertwined with CEII.

153. In response to comments by Public Interest Organizations, the Commission is not persuaded that additional clarifications regarding timing are necessary. Section 388.113(g)(5)(vii) of the amended regulations indicates that the time period for responding to CEII requests should mirror the period for responding to FOIA requests. In response to APS’s suggestion of a default time period for the Commission to respond to a request for CEII unless the information is needed sooner, expedited treatment is not needed, as a requester may include a timeframe in which it needs the information, and the Commission will endeavor to respond in that period. The Commission believes that NERC’s recommendation to place language concerning tolling in the CEII regulation is not necessary, as the time requirement for responses to requesters is not binding and the Commission’s practice is to always toll the response period when further information is needed.

154. In response to NERC’s comment regarding appeal rights, the Commission notes that the existing CEII appeals process, which provides appeal rights to the requester, has been effective and there is no compelling need to extend a right to appeal to anyone other than the individual requester. If a submitter believes that its objection to disclosure of its CEII under a NDA has not been fully addressed, the submitter may raise that issue in district court.²³⁵

155. In response to TAPS’s comment, the Commission clarifies that appeal rights apply when it imposes any conditions on receipt of CEII.

3. Information Collection Statement

156. The Paperwork Reduction Act and Office of Management and Budget’s (OMB) implementing regulations require OMB to review and approve certain information collection requirements imposed by agency rule.²³⁶ This Final Rule does not impose any additional information collection requirements. ²³⁷ Therefore, the information collection regulations do not apply to this Final Rule.

4. Environmental Analysis

157. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.²³⁸

158. The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural, or that do not substantially change the effect of the regulations being amended.²³⁹ The actions here fall within this categorical exclusion in the Commission’s regulations.

5. Regulatory Flexibility Act Certification

159. The Regulatory Flexibility Act of 1980 (RFA) requires rulemakings to contain either a description and analysis of the effect that the rule will have on small entities or a certification that the rule will not have a significant economic impact on a substantial number of small entities.²⁴⁰ Rules that are exempt from the notice and comment requirements of section 553(b) of the Administrative Procedure Act are exempt from the RFA requirements. The Final Rule concerns rules of agency procedure and, therefore, an analysis under the RFA is not required.²⁴¹

6. Document Availability

160. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through the Commission’s Home Page (http://www.ferc.gov) and in the Commission’s Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street, NE, Room 2A, Washington, DC 20426.

161. From the Commission’s Home Page on the Internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number of this document, excluding the last three digits, in the docket number field.

162. User assistance is available for eLibrary and the Commission website during normal business hours from FERC Online Support at 202-502-6652 (toll free at 1-866-208-3676) or e-mail at [email protected], or the Public Reference Room at (202) 502-8371, TTY (202) 502-8659. E-mail the Public Reference Room at [email protected].

7. Effective Date and Congressional Notification

163. These regulations are effective 60 days from the date of publication in the Federal Register. The Commission has determined, with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule is not a “major rule” as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996. The Commission will submit the Final Rule to both houses of Congress and to the General Accountability Office.

List of Subjects in 18 CFR Part 375

Authority delegations (Government agencies); Seals and insignia; Sunshine Act.

List of Subjects in 18 CFR Part 388

Confidential business information; Freedom of information.

By the Commission.

( S E A L )

Nathaniel J. Davis, Sr.,

Deputy Secretary.

In consideration of the foregoing, the Commission amends Parts 375 and 388, Chapter I, Title 18, Code of Federal Regulations, as follows:

PART 375— THE COMMISSION

1. The authority citation for part 375 continues to read as follows:

Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645; 42 U.S.C. 7101-7352.

2. In section 375.309, Paragraph (h) is added as follows:

Section 375.309 Delegations to the General Counsel.

* * * * *

(h) Deny or grant, in whole or in part, an appeal of a determination by the CEII Coordinator.

3. In section 375.313, Revising the section heading and paragraphs (a) and (b); Re-designating paragraphs (c) through (e) as paragraphs (d) through (f) and revising newly re-designated paragraphs (d) through (f); and adding a new paragraph (c).

Section 375.313 Delegations to the Critical Energy/Electric Infrastructure Information (CEII) Coordinator.

* * * * *

(a) Receive and review all requests for CEII as defined in section 388.113(c) of this chapter.

(b) Make determinations as to whether particular information fits within the definition of CEII found at section 388.113(c) of this chapter, including designating information, as appropriate.

(c) Make determinations that information designated as CEII should no longer be so designated when the unauthorized disclosure of the information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure.

(d) Make determinations as to whether a particular requester’s need for and ability and willingness to protect CEII warrants limited disclosure of the information to the requester.

(e) Establish reasonable conditions on the release of CEII.

(f) Release CEII to requesters who satisfy the requirements in paragraph (d) of this section and agree in writing to abide by any conditions set forth by the Coordinator pursuant to paragraph (e) of this section.

PART 388— INFORMATION AND REQUESTS

1. The authority citation for part 388 is changed to read as follows:

Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352; 16 U.S.C. 824(o-l).

2. In section 388.112, the title is revised, and paragraphs (a), (b)(1), (b)(2)(i), (b)(2)(vi), (c)(1), and (d)-(e) are revised to read as follows:

Section 388.112 Requests for privileged treatment for documents submitted to the Commission

(a) Scope. By following the procedures specified in this section, any person submitting a document to the Commission may request privileged treatment for some or all of the information contained in a particular document that it claims is exempt from the mandatory public disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552 (FOIA), and should be withheld from public disclosure. For the purposes of the Commission's filing requirements, non-CEII subject to an outstanding claim of exemption from disclosure under FOIA will be referred to as privileged material. The rules governing CEII are contained in 18 CFR 388.113.

(b) Procedures for filing and obtaining privileged material. (1) General Procedures. A person requesting that material be treated as privileged information must include in its filing a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. A person requesting that a document filed with the Commission be treated as privileged in whole or in part must designate the document as privileged in making an electronic filing or clearly indicate a request for such treatment on a paper filing. The cover page and pages or portions of the document containing material for which privileged treatment is claimed should be clearly labeled in bold, capital lettering, indicating that it contains privileged or confidential information, as appropriate, and marked “DO NOT RELEASE.” The filer also must submit to the

Commission a public version with the information that is claimed to be privileged material redacted, to the extent practicable.

(2) Procedures for Proceedings with a Right to Intervene. ***

1. If a person files material as privileged material in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material. This requirement does not apply to material submitted in hearing or settlement proceedings, or if the only material for which privileged treatment is claimed consists of landowner lists or privileged information filed under sections 380.12(f) and 380.16(f) of this chapter.

*****

1. For landowner lists, information filed as privileged under sections 380.12(f) and 380.16(f), forms filed with the Commission, and other documents not covered above, access to this material can be sought pursuant to a FOIA request under section 388.108 of this chapter. Applicants are not required under paragraph (b)(2)(iv) of this section to provide intervenors with landowner lists and the other materials identified in the previous sentence.

(c) Effect of privilege claim. (1) For documents filed with the Commission:

1. The documents for which privileged treatment is claimed will be maintained in the Commission's document repositories as non-public until such time as the Commission may determine that the document is not entitled to the treatment sought and is subject to disclosure consistent with section 388.108 of this chapter. By treating the documents as nonpublic, the Commission is not making a determination on any claim of privilege status. The Commission retains the right to make determinations with regard to any claim of privilege status, and the discretion to release information as necessary to carry out its jurisdictional responsibilities.

2. The request for privileged treatment and the public version of the document will be made available while the request is pending.

*****

(d) Notification of request and opportunity to comment. When a FOIA requester seeks a document for which privilege status has been claimed, or when the Commission itself is considering release of such information, the Commission official who will decide whether to release the information or any other appropriate Commission official will notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing on the request. A copy of this notice will be sent to the requester.

(e) Notification before release. Notice of a decision by the Commission, the Chairman of the Commission, the Director, Office of External Affairs, the General Counsel or General Counsel's designee, a presiding officer in a proceeding under part 385 of this chapter, or any other appropriate official to deny a claim of privilege, in whole or in part, will be given to any person claiming that the information is privileged no less than 5 calendar days before disclosure. The notice will briefly explain why the person's objections to disclosure are not sustained by the Commission. A copy of this notice will be sent to the FOIA requester.

*****

3. Revise section 388.113 to read as follows:

Section 388.113 Critical Energy/Electric Infrastructure Information (CEII)

(a) Scope. This section governs the procedures for submitting, designating, handling, sharing, and disseminating Critical Energy/Electric Infrastructure Information (CEII) submitted to or generated by the Commission. The Commission reserves the right to restrict access to previously filed information as well as Commission-generated information containing CEII. Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information.

(b) Purpose. The procedures in this section implement section 215A of the Federal Power Act, and provide a comprehensive overview of the manner in which the Commission will implement the CEII program.

(c) Definitions. For purposes of this section:

(1) Critical electric infrastructure information means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to section 215A(d) of the Federal Power Act. Such term includes information that qualifies as critical energy infrastructure information under the Commission’s regulations. Critical Electric Infrastructure Information is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act.

(2) Critical energy infrastructure information means specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that:

(i) Relates details about the production, generation, transportation, transmission, or distribution of energy;

(ii) Could be useful to a person in planning an attack on critical infrastructure;

(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and

(iv) Does not simply give the general location of the critical infrastructure.

(3) Critical electric infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.

(4) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters.

(d) Criteria and Procedures for determining what constitutes CEII. The following criteria and procedures apply to information labeled as CEII:

(1) For information submitted to the Commission:

(i) A person requesting that information submitted to the Commission be treated as CEII must include with its submission a justification for such treatment in accordance with the filing procedures posted on the Commission’s website at http://www.ferc.gov. The justification must provide how the information, or any portion of the information, qualifies as CEII, as the terms are defined in paragraphs (c)(1) and (2) of this section. The submission must also include a clear statement of the date the information was submitted to the Commission, how long the CEII designation should apply to the information and support for the period proposed. Failure to provide the justification or other required information could result in denial of the designation and release of the information to the public.

(ii) In addition to the justification required by paragraph (d)(1)(i) of this section, a person requesting that information submitted to the Commission be treated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is claimed in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “DO NOT RELEASE.” The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible. The submitter must also submit to the Commission a public version with the information where CEII is redacted, to the extent practicable.

(iii) If a person files material as CEII in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material.

(iv) The information for which CEII treatment is claimed will be maintained in the Commission’s files as non-public until such time as the Commission may determine that the information is not entitled to the treatment sought. By treating the information as CEII, the Commission is not making a determination on any claim of CEII status. The Commission retains the right to make determinations with regard to any claim of CEII status at any time, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. Although unmarked information may be eligible for CEII treatment, the Commission will treat unmarked information as CEII only if it is properly designated as CEII pursuant to Commission regulations.

(v) The CEII Coordinator will evaluate whether the submitted information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section prior to making a designation as CEII.

(vi) Subject to the exceptions set forth in section 388.113(f)(5), when a CEII requester seeks information for which CEII status has been claimed, or when the Commission itself is considering release of such information, the CEII Coordinator or any other appropriate Commission official will notify the person who submitted the information and give the person an opportunity (at least five business days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. Notice of a decision by the Commission, or the CEII Coordinator to make a release of CEII, will be given to any person claiming that the information is CEII no less than five business days before disclosure. The notice will respond to any objections to disclosure from the submitter that are not sustained. Where applicable, a copy of this notice will be sent to the CEII requester.

(2) For Commission-generated information:

(i) After consultation with the Office Director for the office that created the information, or the Office Director’s designee, the CEII Coordinator will designate Commission-generated information as CEII after determining that the information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section. Commission-generated CEII shall include clear markings to indicate the information is CEII and the date of the designation.

(ii) The Commission will segregate non-CEII from Commission-generated CEII or information that reasonably could be expected to lead to the disclosure of CEII wherever feasible.

(e) Duration of the CEII designation. All CEII designations will be subject to the following conditions:

(1) A designation may last for up to a five-year period, unless re-designated. In making a determination as to whether the designation should be extended, the CEII Coordinator will take into account information provided in response to paragraph (d)(1)(i) of this section, and any other information, as appropriate.

(2) A designation may be removed at any time, in whole or in part, if the Commission determines that the unauthorized disclosure of CEII could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure.

(3) The Commission will treat CEII or documents marked as CEII as non-public after the designation has lapsed until the CEII Coordinator determines to un-designate the information.

(4) If a CEII designation is removed, the submitter will receive notice and an opportunity to comment. The CEII Coordinator will notify the submitter of the information and give the submitter an opportunity (at least five business days) in which to comment in writing prior to the removal of the designation. Notice of a removal decision will be given to any submitter claiming that the information is CEII no less than five business days before disclosure. The notice will briefly explain why the submitter’s objections to the removal of the designation are not sustained by the Commission

(f) Voluntary sharing of CEII. The Commission, taking into account standards of the Electric Reliability Organization, will facilitate voluntary sharing of CEII with, between, and by Federal, state, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission. The process will be as follows:

(1) The Director of any Office of the Commission or his designee that wishes to voluntarily share CEII shall consult with the CEII Coordinator prior to the Office Director or his designee making a determination on whether to voluntarily share the CEII.

(2) Consistent with section 388.113(d) of this Chapter, the Commission retains the discretion to release information as necessary to carry out its jurisdictional responsibilities in facilitating voluntary sharing or, in the case of information provided to other federal agencies, the Commission retains the discretion to release information as necessary for those agencies to carry out their jurisdictional responsibilities.

(3) All entities receiving CEII must execute either a non-disclosure agreement or an acknowledgement and agreement. A copy of each agreement will be maintained by the Office Director with a copy to the CEII Coordinator.

(4) When the Commission voluntarily shares CEII pursuant to this subsection, the Commission may impose additional restrictions on how the information may be used and maintained.

(5) Submitters of CEII shall receive notification of a limited release of CEII no less than five business days before disclosure, except in instances where voluntary sharing is necessary for law enforcement purposes, to maintain infrastructure security, to address potential threats, when notice would not be practicable, and where there is an urgent need to quickly disseminate the information. When prior notice is not given, the Commission will provide submitters of CEII notice of a limited release of the CEII as soon as practicable.

(g) Accessing CEII.

(1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility, excluding Commission-generated information except inspection reports/operation reports and any information directed to the owner-operators, directly from Commission staff without going through the procedures outlined in paragraph (g)(5) of this section. Non-employee agents of an owner/operator of such facility may obtain CEII relating to the owner/operator’s facility in the same manner as owner/operators as long as they present written authorization from the owner/operator to obtain such information. Notice of such requests must be given to the CEII Coordinator, who shall track this information.

(2) An employee of a federal agency acting within the scope of his or her federal employment may obtain CEII directly from Commission staff without following the procedures outlined in paragraph (g)(5) of this section. Any Commission employee at or above the level of division director or its equivalent may rule on requests for access to CEII by a representative of a federal agency. To obtain access to CEII, an agency employee must sign an acknowledgement and agreement, which states that the agency will protect the CEII in the same manner as the Commission and will refer any requests for the information to the Commission. Notice of each such request also must be given to the CEII Coordinator, who shall track this information.

(3) A landowner whose property is crossed by or in the vicinity of a project may receive detailed alignment sheets containing CEII directly from Commission staff without submitting a non-disclosure agreement as outlined in paragraph (g)(5) of

this section. A landowner must provide Commission staff with proof of his or her property interest in the vicinity of a project.

(4) Any person who is a participant in a proceeding or has filed a motion to intervene or notice of intervention in a proceeding may make a written request to the filer for a copy of the complete CEII version of the document without following the procedures outlined in paragraph (g)(5) of this section. The request must include an executed copy of the applicable protective agreement and a statement of the person’s right to party or participant status or a copy of the person’s motion to intervene or notice of intervention. Any person may file an objection to the proposed form of protective agreement. A filer, or any other person, may file an objection to disclosure, generally or to a particular person or persons who have sought intervention. If no objection to disclosure is filed, the filer must provide a copy of the complete, non-public document to the requesting person within five business days after receipt of the written request that is accompanied by an executed copy of the protective agreement. If an objection to disclosure is filed, the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority.

(5) If any requester not described above in paragraph (g)(1)-(4) of this section has a particular need for information designated as CEII, the requester may request the information using the following procedures:

(i) File a signed, written request with the Commission’s CEII Coordinator. The request must contain the following:

(a) Requester's name (including any other name(s) which the requester has used and the dates the requester used such name(s)), title, address, and telephone number; and the name, address, and telephone number of the person or entity on whose behalf the information is requested;

(b) A detailed Statement of Need, which must state: the extent to which a particular function is dependent upon access to the information; why the function cannot be achieved or performed without access to the information; an explanation of whether other information is available to the requester that could facilitate the same objective; how long the information will be needed; whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and an explanation of whether the information is needed expeditiously.

(c) An executed non-disclosure agreement as described in paragraph (h)(2) of this section;

(d) A signed statement attesting to the accuracy of the information provided in the request; and

(e) A requester shall provide his or her date and place of birth upon request, if it is determined by the CEII Coordinator that this information is necessary to process the request.

(ii) A requester who seeks the information on behalf of all employees of an organization should clearly state that the information is sought for the organization, that the requester is authorized to seek the information on behalf of the organization, and that all individuals in the organization that have access to the CEII will agree to be bound by a non-disclosure agreement that must be executed.

3. After the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester’s need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information.

4. If the CEII Coordinator determines that the CEII requester has not demonstrated a valid or legitimate need for the CEII or that access to the CEII should be denied for other reasons, this determination may be appealed to the General Counsel pursuant to section 388.110 of this Chapter. The General Counsel will decide whether the information is properly classified as CEII, which by definition is exempt from release under FOIA, and whether the Commission should in its discretion make such CEII available to the CEII requester in view of the requester’s asserted legitimacy and need.

(v) Once a CEII requester has been verified by Commission staff as a legitimate requester who does not pose a security risk, his or her verification will be valid for the remainder of that calendar year. Such a requester is not required to provide detailed information about himself or herself with subsequent requests during the calendar year. He or she is also not required to file a non-disclosure agreement with subsequent requests during the calendar year because the original non-disclosure agreement will apply to all subsequent releases of CEII.

(vi) An organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section may seek to add additional individuals to the non-disclosure agreement within one (1) year of the date of the initial CEII request. Such an organization must provide the names of the added individuals to the CEII Coordinator and certify that notice of each added individual has been given to the submitter. Any newly added individuals must execute a supplement to the original non-disclosure agreement indicating their acceptance of its terms. If there is no written opposition within five business days of notifying the CEII Coordinator and the submitter concerning the addition of any newly added individuals, the CEII Coordinator will issue a standard notice accepting the addition of these names to the non-disclosure agreement. If the submitter files a timely opposition with the CEII Coordinator, the CEII Coordinator will issue a formal determination addressing the merits of such opposition. If an organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section wants to add new individuals to its non-disclosure agreement more than one year after the date of its initial CEII request, the organization must submit a new CEII request pursuant to paragraph (g)(5)(ii) of this section and a new non-disclosure agreement for each new individual added.

(vii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the FOIA in section 18 CFR 388.108(c).

(viii) Fees for processing CEII requests will be determined in accordance with section 18 CFR 388.109.

(ix) Nothing in this section should be construed as requiring the release of proprietary information, personally identifiable information, cultural resource information, information on rare species of plants and animals, and other comparable data protected by statute or any privileged information, including information protected by the deliberative process privilege.

(h) Duty to protect CEII. Unauthorized disclosure of CEII is prohibited.

(1) To ensure that the Commissioners, Commission employees, and Commission contractors protect CEII from unauthorized disclosure, internal controls will describe the handling, marking, and security controls for CEII.

(2) Any individual who requests information pursuant to paragraph (g)(5) of this section must sign and execute a non-disclosure agreement, which indicates the individual's willingness to adhere to limitations on the use and disclosure of the information requested. The non-disclosure agreement will, at a minimum, require the following: CEII will only be used for the purpose for which it was requested; CEII may only be discussed with authorized recipients; CEII must be kept in a secure place in a manner that would prevent unauthorized access; CEII must be destroyed or returned to the Commission upon request; the Commission may audit the recipient’s compliance with the non-disclosure agreement; CEII provided pursuant to the agreement is not subject to release under either FOIA or Sunshine Laws; a recipient is obligated to protect the CEII even after a designation has lapsed until the CEII Coordinator determines the information should no longer be designated as CEII under subsection (e)(2); and a recipient is required to promptly report all unauthorized disclosures of CEII to the Commission.

(i) Sanctions. Any officers, employees, or agents of the Commission who knowingly and willfully disclose CEII in a manner that is not authorized under this section will be subject to appropriate sanctions, such as removal from the federal service, or possible referral for criminal prosecution. Commissioners who knowingly and willfully disclose CEII without authorization may be referred to the Department of Energy Inspector General. The Commission will take responsibility for investigating and, as necessary, imposing sanctions on its employees and agents.

(j) Administrative Appeals of CEII determinations.

(1) Submitters who receive a determination that the Commission intends to remove a CEII designation may appeal that determination. The submitter must file notice of its intent to appeal that determination within five business days of the determination. The notice of intent to file an appeal must be sent to the General Counsel, with a copy to the CEII Coordinator. A statement in support of the notice of appeal must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the notice of appeal.

(2) Individuals who receive a determination denying a request for the release of CEII, in whole or in part, or a determination denying a request to change the designation of CEII may appeal such determinations. Such appeals must be submitted to the General Counsel within 20 business days of the date of the determination.

(3) The Commission’s General Counsel or the General Counsel’s designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal. If, on appeal, the General Counsel or the General Counsel’s designee upholds the determination in whole or in part, then the General Counsel or the General Counsel’s designee will notify the person submitting the appeal of the availability of judicial review.

(4) The time limits prescribed for the General Counsel or his designee to act on an appeal may be extended pursuant to section 388.110(b)(1).

(5) Prior to seeking judicial review in federal district court pursuant to section 215A(d)(11) of the Federal Power Act, a person who received a determination from the Commission concerning a CEII designation must first appeal the determination to the Commission’s General Counsel.

Note: The following appendix will not appear in the Code of Federal Regulations

Appendix

Initial Comments

Abbreviation Commenter

APPA American Public Power Association

CEA Canadian Electricity Association

HRC Hydropower Reform Coalition

INGAA Interstate Natural Gas Association of America

ITC International Transmission Company d/b/a ITCTransmission, Michigan Electric Company, LLC, ITC Midwest LLC, and ITC Great Plains LLC

Joint RTOs ISO New England, Inc. and Southwest Power Pool, Inc.

MISO Midcontinent Independent System Operator, Inc.

NRECA National Rural Electric Cooperative Association

NERC North American Electric Reliability Corporation

NRC Nuclear Regulatory Commission

Peak Peak Reliability

Powerex Powerex Corp.

Public Interest Organizations Alliance for Affordable Energy, Citizens Action Coalition of Indiana, Inc., Citizens Utility Board, Fresh Energy, Great Plains Institute, Natural Resources Defense Council, Sierra Club Environmental Law Program, Southern Environmental Law Center, Sustainable FERC Project, Union of Concerned Scientists, Utah Clean Energy, VoeSolar, Western Grid Group, Western Resource Advocates, and Wind on the Wires

Tacoma Power City of Tacoma, Department of Public Utilities, Light Division d.b.a. Tacoma Power (Tacoma Power)

Tallgrass Pipelines Rockies Express Pipeline LLC, Tallgrass Interstate Gas, Transmission, LLC, and Trailblazer Pipeline Company LLC

TAPS Transmission Access Policy Study Group

Trade Associations Edison Electric Institute, Electric Power Supply Association, and Electricity Consumers Resource Council

WIRAB Western Interconnection Regional Advisory Board

Reply Comments

Abbreviation Commenter

PJM PJM Interconnection, LLC

Joint RTOs ISO New England, Inc. and Southwest Power Pool, Inc.

1 Fixing America’s Surface Transportation Act, Pub. L. No. 114-94, § 61,003, 129 Stat. 1312, 1773-1779 (2015) (to be codified at 16 U.S.C. 824 et seq.) (FAST Act).

2 See Statement of Policy on Treatment of Previously Public Documents, 97 FERC ¶ 61,030 (2001).

3 5 U.S.C. 552 as amended by the FOIA Improvement Act of 2016, Pub. L. No. 114-185, 130 Stat. 538 (2016); 18 CFR 388.108 (Requests for Commission records not available through the Public Reference Room (FOIA Requests)).

4 Critical Energy Infrastructure Information, Order No. 630, FERC Stats. & Regs. ¶ 31,140, order on reh’g, Order No. 630-A, FERC Stats. & Regs. ¶ 31,147 (2003).

5 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

6 Regulations Implementing FAST Act Section 61003 – Critical Infrastructure Security and Amending Critical Energy Information, 81 FR 43,557 (July 5, 2016), 155 FERC ¶ 61,278 (2016) (NOPR).

7 NOPR, 155 FERC ¶ 61,278 at P 10.

8 Id. P 11. Section 215A(a)(3) of the FAST Act defines Critical Electric Infrastructure Information to mean:

[I]nformation related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to subsection (d). Such term includes information that qualifies as critical energy infrastructure information under the Commission’s regulations. Critical Electric Infrastructure Information is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552, pursuant to section 215A(d)(1)(A) of the Federal Power Act.

9 NOPR, 155 FERC ¶ 61,278 at P 13.

10 See APPA Comments at 5-11; MISO Comments at 5.

11 APPA Comments at 5, 9, 13.

12 Section 215A(d)(10) of the FPA provides that when “the Commission or the [DOE] Secretary, as appropriate, determines that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities” the designation shall be removed.

13 MISO Comments at 4-6.

14 TAPS Comments at 8; APPA Comments at 21-22.

15 APPA Comments at 23.

16 TAPS Comments at 8; APPA Comments at 22. Section 201(f) provides that:

No provision in this subchapter shall apply to, or be deemed to include, the United States, a State or any political subdivision of a State, an electric cooperative that receives financing under the Rural Electrification Act of 1936 (7 U.S.C. 901 et seq.) or that sells less than 4,000,000 megawatt hours of electricity per year, or any agency, authority, or instrumentality of any one or more of the foregoing, or any corporation which is wholly owned, directly or indirectly, by any one or more of the foregoing, or any officer, agent, or employee of any of the foregoing acting as such in the course of his official duty, unless such provision makes specific reference thereto.

16 U.S.C. 824(f)

17 TAPS Comments at 8-9; APPA Comments at 22-23.

18 TAPS Comments at 4-5.

19 Id. at 4.

20 Trade Associations Comments at 16.

21 NRECA Comments at 7.

22 Powerex Comments at 11.

23 Id. at 15.

24 Id. at 12.

25 APPA Comments at 23; TAPS Comments at 9-10; Trade Associations Comments at 32.

26 See id.

27 TAPS Comments at 10; see also Critical Energy Infrastructure Information State Agency Employee Non-Disclosure Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/state-agen-nda.pdf.

28 MISO Comments at 3.

29 See Trade Associations Comments at 26.

30 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

31 For the same reason, we reject MISO’s recommendation that the title for section 388.112 should be changed to “Submission and treatment of privileged information” and that the title for section 388.113 should be changed to “Submission and treatment of Critical Energy Infrastructure Information (CEII).” MISO Comments at 3.

32 18 CFR 388.113(c)(1)(i)).

33 NOPR, 155 FERC ¶ 61,278 at P 14.

34 See Anna Jacques Hosp. v. Burwell, 797 F.3d 1155, 1165 (D.C. Cir. 2015) (holding that “interstitial question[s] of implementation” are left to the discretion of the implementing agency).

35 See APPA Comments at 15.

36 Section 215A(d)(2)(D) states that the Commission “shall promulgate such regulations as necessary to … facilitate voluntary sharing of critical electric infrastructure information…” FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

37 APPA states that there may be instances where an entity could provide CEII to NERC who, in turn, may submit that entity’s information to the Commission or DOE as CEII without notifying the entity. Thus, APPA is concerned the entity may not be aware that the information has been submitted to the Commission and designated as CEII. As a result, APPA suggests that the Commission establish notification procedures so that entities are aware that their information was designated as CEII. APPA Comments at 21-22. We see no need to adopt such a notification process. Section 1505 of NERC’s Rules of Procedure already requires NERC, unless otherwise directed by the Commission or its staff, to notify submitting entities of requests made by the Commission to NERC for the submitting entities’ information.

38 18 CFR 388.113(c)(2)(iii).

39 See Stone v. INS, 514 U.S. 386, 397 (1995) (holding that “[w]hen Congress acts to amend a statute, we presume it intends its amendment to have real and substantial effect”).

40 18 CFR 388.113(c)(1)(iv).

41 For example, the location of an operating transformer is likely publicly known. However, the location of a spare transformer housed in a central location may not be publicly known and, therefore, may qualify as CEII.

42 For example, while Critical Energy Infrastructure Information must satisfy the four-part definition in amended section 388.113(c)(1), Critical Electric Infrastructure Information must meet the definition in amended section 388.113(c)(2).

43 See 18 CFR 388.112(b)(2) and 388.113(g)(4).

44 See supra note 27.

45 See Trade Associations Comments at 26.

46 NOPR, 155 FERC ¶ 61,278 at P 16.

47 Peak Comments at 8-10; Powerex Comments at 12; APS Comments at 5; APPA Comments at 17; WIRAB Comments at 5.

48 Public Interest Organizations Comments at 4.

49 Id. at 5.

50 HRC Comments at 2-3.

51 Id. at 2.

52 Id. at 3.

53 Id.

54 WIRAB Comments at 5; APS Comments at 5.

55 Trade Associations Comments at 12.

56 Id. at 11.

57 APPA Comments at 24-25; Trade Associations Comments at 23.

58 Id.

59 Peak Comments at 6-7; Public Interest Organizations Comments at 5; APPA Comments at 25. WIRAB also requests a technical conference to discuss implementation of the FAST Act. WIRAB Comments at 11.

60 NRC Comments at 1-2.

61 Id. at 2.

62 See CEII Filing Guide, https://www.ferc.gov/resources/guides/filing-guide/file-ceii/ceii-guidelines.asp. The Commission will update the CEII Filing Guide when the proposed regulations become effective.

63 See amended sections 388.113(c) and (d).

64 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

65 NOPR, 155 FERC ¶ 61,278 at P 16 n.12.

66 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

67 Id.

68 For example, the Commission could establish the parameters of the Commission’s role with regard to CEII with another federal agency through a Memorandum of Understanding with that agency.

69 NOPR, 155 FERC ¶ 61,278 at P 19.

70 APS Comments at 6.

71 HRC Comments at 2; Tacoma Power Comments at 4.

72 Tacoma Power Comments at 4.

73 INGAA Comments at 4; NERC Comments at 15; Trade Associations Comments at 19.

74 APS Comments at 6; CEA Comments at 6-7.

75 Trade Associations Comments at 19-20.

76 MISO Comments at 7.

77 Trade Associations Comments at 25-26.

78 CEA Comments at 6-7.

79 NOPR, 155 FERC ¶ 61,278 at P 19.

80 See amended section 388.113(d)(1)(vi).

81 Section 215A(d)(1)(B) states that Critical Electric Infrastructure Information “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.” FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

82 See amended sections 388.113(d)(1)(iv) and 388.113(e)(3)-(4).

83 NOPR, 155 FERC ¶ 61,278 at P 17 n.13(citing Availability of Certain North American Electric Reliability Corporation Databases to the Commission, Order No. 824, 155 FERC ¶ 61,275 (2016)).

84 Id.

85 NERC Comments at 19.

86 TAPS Comments at 5-7.

87 Trade Associations Comments at 15.

88 TAPS Comments at 6.

89 CEA Comments at 4.

90 Id.

91 This is consistent with the statement in Order No. 824 that the Commission “will take appropriate steps, as provided for in our governing statutes and regulations, in handling such information.” Order No. 824, 152 FERC ¶ 61,208 at P 22.

92 The discussion above and our determination address the Trade Associations’ request for clarification of Order No. 824 in Docket No. RM15-25-001.

93 By the same token, information that is not downloaded cannot be disclosed under a FOIA request as the Commission would not possess the information.

94 NOPR, 155 FERC ¶ 61,278 at P 17 n.13.

95 We note that section 1505 of NERC’s Rules of Procedure requires NERC, unless otherwise directed by the Commission or its staff, to provide notice to submitting entities in response to requests for the submitting entities’ information by the Commission.

96 The Commission has addressed the scope of information covered by specific data collection requirements in individual proceedings. For example, in Order No. 824, concerning Commission access to certain NERC databases that include data about both U.S. and Canadian facilities, the Commission revised its regulations to indicate that “Commission access will be limited to data regarding U.S. facilities.” Order No. 824, 155 FERC ¶ 61,275 at P 38.

97 NOPR, 155 FERC ¶ 61,278 at P 21.

98 Id.

99 Trade Associations Comments at 24.

100 Id.

101 NOPR, 155 FERC ¶ 61,278 at P 22.

102 HRC Comments at 3; Powerex Comments at 16-17.

103 TAPS Comments at 14.

104 Powerex Comments at 16.

105 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

106 NOPR, 155 FERC ¶ 61,278 at P 18 n.14 and P 24.

107 Id.

108 Id. P 26.

109 Id. P 27.

110 Id.

111 See, e.g., ITC Comments at 2-3; INGAA Comments at 3; NRECA Comments at 9.

112 Peak Comments at 10-11 (recommending categories such as “transmission and generation outage data, generator-specific forecast data, transmission facility and load status and measurements, specific facility modeling data, and device lists”).

113 Trade Associations Comments at 21-22; APPA Comments at 20.

114 Tallgrass Comments at 3.

115 INGAA Comments at 3.

116 APS Comments at 12.

117 NRECA Comments at 11; ITC Comments at 3-4.

118 ITC Comments at 3.

119 APPA Comments at 26.

120 Section 215A(d)(9) states that information “may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.” FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

121 The Commission will use the relevant service list, where appropriate, to determine the appropriate recipient.

122 NOPR, 155 FERC ¶ 61,278 at P 28.

123 HRC Comments at 3.

124 NRECA Comments at 11; HRC Comments at 3-4.

125 Id.

126 NRECA Comments at 12.

127 See Hidalgo v. FBI, 344 F.3d 1256, 1258-59 (D.C. Cir. 2003) (holding that “exhaustion of administrative remedies is generally required before filing suit in federal court so that the agency has an opportunity to exercise its discretion and expertise on the matter and to make a factual record to support its decision”).

128 NOPR, 155 FERC ¶ 61,278 at P 28.

129 Requiring the submitter to inform the Commission of its intent to appeal within 5 business days will allow the Commission to know sooner than later whether the submitter plans to challenge the decision and, if not, allow the Commission to disclose the information sooner.

130 The Trade Associations suggest that the Commission should issue an order on appeal of any denial of an information owner’s objections to disclosure of CEII pursuant to a NDA. Trade Association Comments at 20. Under our current practice, the decision to disclose CEII pursuant to a NDA is appealable directly to a district court under 5 U.S.C. 552(a)(4)(B). There is no need to establish an additional procedure under the amended regulations that requires the Commission to issue an order on appeal.

131 NOPR, 155 FERC ¶ 61,278 at P 30.

132 Id. PP 33-34. Specifically, the Commission proposed to require a requester to demonstrate: (1) the extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) whether the information is needed expeditiously. Id.

133 Trade Associations Comments at P 36-37. The Trade Associations also state that the Commission should consider expounding on recommendations from the DOE IG.

134 MISO Comments at 8.

135 MISO Comments at 8; NRECA Comments at 10.

136 MISO Comments at 9; Trade Associations Comments at 26; APS Comments at 10.

137 NERC Comments at 14.

138 NERC Comments at 14; Trade Associations Comments at 26.

139 Trade Associations Comments at 26.

140 APS Comments at 9-10.

141 NRECA Comments at 10.

142 Peak Comments at 14-15.

143 Id.

144 Trade Associations Comments at 34.

145 Trade Associations Comments at 35; NRECA Comments at 16-17.

146 NERC Comments at 13-14.

147 NERC Comments at 12-14; Trade Associations Comments at 33.

148 APS Comments at 7-8.

149 Peak Comments at 14.

150 NOPR, 155 FERC ¶ 61,278 at P 30.

151 In developing this Final Rule and the internal controls, the Commission has been cognizant of the recommendations of the DOE Inspector General Report from January 30, 2015 as well as the Commission’s earlier response thereto, which are a matter of public record. See Department of Energy, Office of Inspector General, Inspection Report, Review of Controls for Protecting Nonpublic Information at the Federal Energy Regulatory Commission, DOE/IG-0933 (January 2015), http://energy.gov/ig/downloads/inspection-report-doeig-0933.

152 Requests are typically received from public utilities, gas pipelines, hydro developers, academics, landowners, public interest groups, researchers, renewable energy organizations, and consultants.

153 Electronic CEII Request Form, http://www.ferc.gov/resources/guides/filing-guide/ceii-request.asp.

154 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

155 NOPR, 155 FERC ¶ 61,278 at P 36.

156 Id.

157 See Trade Associations Comments at 40 (noting that CEII protections adopted in the FAST Act were adopted in the context of what many considered to be an inappropriate disclosure of CEII by a former FERC Commissioner); see also APPA Comments at 28. APPA states that the Commission has authority to impose civil penalties against “any person” who violates any provision of any Commission rule and may use criminal penalties under FPA section 316(b) for knowing and willful violations, by “any person” of Commission rules or regulations under the FPA.

158 APPA Comments at 27, 29. APPA also asserts that a DOE employee sanctioned for unauthorized disclosure may be able to challenge their sanction “on grounds that it was not promulgated by the Commission, as directed by Congress.”

159 MISO Comments at 10.

160 NRECA Comments at 16.

161 MISO Comments at 10; NRECA Comments at 16.

162 We note that no commenter has indicated that the DOE IG has insufficient tools to investigate and, as appropriate, pursue sanctions for a Commissioner.

163 See DOE IG Hotline, http://www.energy.gov/ig/services.

164 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776.

165 NOPR, 155 FERC ¶ 61,278 at PP 37-38, 40.

166 Id. P 38.

167 Id. P 40.

168 Id. P 39.

169 Id.

170 Id. P 41.

171 Id. P 42. The Commission noted that it may not be practicable to provide notice to the submitter in instances where voluntary sharing is necessary to maintain infrastructure security, to address a potential threat, or in other exigent circumstances.

172 See, e.g., Peak Comments at 5-6; Powerex Comments at 13-14; APPA Comments at 31; NRECA Comments at 13.

173 Powerex Comments at 13-15.

174 Public Interest Organizations Comments at 8-9; WIRAB Comments at 9.

175 Id.

176 WIRAB Comments at 10.

177 Joint RTOs Comments at 4. MISO also suggests the Commission encourage sharing between planning authorities and transmission planners. See MISO Comments at 10.

178 PJM Reply Comments at 2.

179 Joint RTOs Reply Comments at 2.

180 NERC Comments at 9.

181 Id.

182 APS Comments at 13; Trade Associations Comments at 27; CEA Comments at 5.

183 APPA Comments at 30.

184 Id.

185 APPA Comments at 31-32.

186 Id. at 31-32. For example, APPA proposes that the Commission allow for “source anonymizing” shared CEII or to adopt DHS’s Traffic Light Protocol to ensure information is shared with the correct audience.

187 Trade Associations Comments at 27-28.

188 CEA Comments at 6. NRECA also references the need to provide notice as soon as possible, even if such notice is after the disclosure. See NRECA Comments at 12.

189 MISO Comments at 11.

190 NRECA Comments at 12-13.

191 Trade Associations Comments at 30.

192 TAPS Comments at 12-13.

193 FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1773 (“critical electric infrastructure information means information … generated by or provided to the Commission or other Federal agency … that is designated as critical electric infrastructure information by the Commission or the Secretary pursuant to subsection (d)”).

194 As CEII information has to be designated by the CEII Coordinator or DOE Secretary, information that an entity creates and maintains without providing to the Commission has not been formally designated as CEII.

195 However, other concerns may influence how the entity shares its own information with others.

196 Section 215A(d) requires the Commission “to promulgate [] regulations as necessary” to, inter alia, “facilitate voluntary sharing of critical electric infrastructure information.” FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1776. The FAST Act, therefore, affords the Commission with discretion in this regard and, at least implicitly, recognizes that the Commission may, identify, encourage and support existing processes to facilitate the voluntary sharing of CEII.

197 See, e.g., Critical Energy Infrastructure Information General Non-Disclosure Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf (“A Recipient may only discuss CEII with another Recipient of the identical CEII. A Recipient may check with the CEII Coordinator to determine whether another individual is a Recipient of the identical CEII.”).

198 FAST Act, Pub. L. No. 114-94, § 61,003, 129 Stat. 1312, 1777.

199 Id.

200 The FAST Act does not prohibit the Commission from disclosing any information, nor does it require an entity to produce any information. FAST Act, Pub. L. No. 114-94, section 61,003, 129 Stat. 1312, 1777.

201 NOPR, 155 FERC ¶ 61,278 at P 38.

202 NOPR, 155 FERC ¶ 61,278 at P 37.

203 Id. PP 31-32

204 As noted below, to obtain CEII federal agencies execute an Acknowledgement and Agreement, as opposed to a NDA. See Federal Agency Acknowledgement and Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf.

205 NOPR, 155 FERC ¶ 61,278 at PP 43-49.

206 Id. P 49.

207 Id. PP 50-51.

208 Id. P 52.

209 APPA Comments at 19.

210 APPA Comments at 18; Trade Associations Comments at 27.

211 APPA Comments at 9; Trade Associations Comments at 27.

212 Trade Associations Comments at 32.

213 Peak Comments at 7-8.

214 Id. at 14.

215 WIRAB Comments at 8.

216 Peak Comments at 13.

217 Public Interest Organizations Comments at 9.

218 Id. at 9-10.

219 MISO Comments at 4.

220 Peak Comments at 13.

221 APS Comments at 11; see also Trade Associations Comments at 35.

222 Trade Associations Comments at 35; APS Comments at 10-11.

223 WIRAB Comments at 9.

224 INGAA Comments at 4.

225 Id.

226 Public Interest Organizations Comments at 10 (noting that it often takes 4-6 months to get access to Form No. 715 information through the existing Critical Energy Infrastructure Information process).

227 APS Comments at 8.

228 NERC Comments at 16 (citing 5 U.S.C. 552(a)(6)(B)(ii)).

229 Id. at 18.

230 TAPS Comments at 14.

231 Section 388.113(g)(5)(iii).

232 See, e.g., Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events, 156 FERC ¶ 61,215, at PP 93-95 (2016) (determining that geomagnetically induced current monitoring and magnetometer data will help facilitate geomagnetic disturbance research and concluding that such data typically should not be treated as confidential).

233 See section 388.113(g)(4).

234 See supra P 64.

235 Because the challenge does not relate to the designation of the information, the action would not be under FPA section 215A(d)(11). See supra note 130; see also Cortez III Serv. Corp v. NASA, 921 F.Supp. 8, 11 (D.D.C. 1996) (holding, in a “reverse FOIA” action, that courts have jurisdiction over claims from parties that a release of their information would adversely affect them.”)

236 5 CFR 1320.

237 The current information collection requirements related to requesting access to CEII material are approved by OMB under FERC-603 (OMB Control No. 1902-0197).

238 Regulations Implementing National Environmental Policy Act of 1969, Order No. 486, FERC Stats. & Regs. ¶ 30,783 (1987).

239 18 CFR 380.4(a)(2)(ii).

240 5 U.S.C. 603 (2012).

241 5 U.S.C. 553(b).