81 FR 43557 - Regulations Implementing FAST Act Section 61003-Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information
DEPARTMENT OF ENERGY
Federal Energy Regulatory Commission Federal Register Volume 81, Issue 128 (July 5, 2016)
Federal Energy Regulatory Commission
Federal Register Volume 81, Issue 128 (July 5, 2016)
| Page Range | 43557-43567 | |
| FR Document | 2016-14761 |
[Federal Register Volume 81, Number 128 (Tuesday, July 5, 2016)] [Proposed Rules] [Pages 43557-43567] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2016-14761] [[Page 43557]] ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF ENERGY Federal Energy Regulatory Commission 18 CFR Parts 375 and 388 [Docket No. RM16-15-000] Regulations Implementing FAST Act Section 61003--Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information AGENCY: Federal Energy Regulatory Commission. ACTION: Notice of proposed rulemaking. ----------------------------------------------------------------------- SUMMARY: The Federal Energy Regulatory Commission (Commission) proposes to amend the Commission's regulations to implement provisions of the Fixing America's Surface Transportation Act that pertain to the designation, protection and sharing of Critical Electric Infrastructure Information. Separately, the Commission proposes to amend its regulations that pertain to Critical Energy Infrastructure Information. DATES: Comments are due August 19, 2016. ADDRESSES: Comments, identified by docket number, may be filed in the following ways:Electronic Filing through http://www.ferc.gov. Documents created electronically using word processing software should be filed in native applications or print-to-PDF format and not in a scanned format. Mail/Hand Delivery: Those unable to file electronically may mail or hand-deliver comments to: Federal Energy Regulatory Commission, Secretary of the Commission, 888 First Street NE., Washington, DC 20426. Instructions: For detailed instructions on submitting comments and additional information on the rulemaking process, see the Comment Procedures Section of this document. FOR FURTHER INFORMATION CONTACT: Nneka Frye, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029, [email protected]. Marcos Araus, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-8472, [email protected]. Mark Hershfield, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-8597, [email protected]. SUPPLEMENTARY INFORMATION: I. Introduction 1. On December 4, 2015, the President signed into law the Fixing America's Surface Transportation (FAST) Act.\1\ The FAST Act, inter alia, added section 215A to the Federal Power Act (FPA) to improve the security and resilience of energy infrastructure in the face of emergencies.\2\ The FAST Act directs the Commission to issue regulations aimed at securing and sharing sensitive infrastructure information. Specifically, FPA section 215A(d)(2) (Designation and Sharing of Critical Electric Infrastructure Information) requires the Commission to ``promulgate such regulations as necessary to'': --------------------------------------------------------------------------- \1\ See Fixing America's Surface Transportation, Public Law 114- 94, 129 Stat. 1312 (2015) (to be codified at 16 U.S.C. 824 et seq.) (FAST Act). \2\ Id. 61,003. --------------------------------------------------------------------------- (A) establish criteria and procedures to designate information as critical electric infrastructure information; (B) prohibit the unauthorized disclosure of critical electric infrastructure information; (C) ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy [DOE] who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section; and (D) taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of critical electric infrastructure information with, between, and by--(i) Federal, State, political subdivision, and tribal authorities; (ii) the Electric Reliability Organization; (iii) regional entities; (iv) information sharing and analysis centers established pursuant to Presidential Decision Directive 63; (v) owners, operators, and users of critical electric infrastructure in the United States; and (vi) other entities determined appropriate by the Commission. 2. The Commission proposes to revise 18 CFR 375.313, 388.112, and 388.113 of the Commission's regulations to implement the requirements identified in section 215A(d)(2) of the FPA, as well as other provisions included in the FAST Act. The Commission also proposes modifications to its existing Critical Energy Infrastructure Information process, in part, to comply with the FAST Act. The amended process will be referred to as the Critical Energy/Electric Infrastructure Information (CEII) process. Thus, these changes are intended to comply with the FAST Act as well as improve the overall efficiency of the CEII process for information that is submitted to or is generated by the Commission. II. Background 3. Shortly after the terrorist attacks on September 11, 2001, the Commission took steps to protect information that it considered Critical Energy Infrastructure Information.\3\ As a preliminary step, the Commission removed from its public files and eLibrary document retrieval system documents that were likely to contain detailed specifications of facilities, and directed the public to use the Freedom of Information Act (FOIA) request process to obtain such information.\4\ In 2003, the Commission established its Critical Energy Infrastructure Information procedures for entities outside of the Commission to obtain access to Critical Energy Infrastructure Information, stating that such information would typically be exempt from disclosure pursuant to FOIA.\5\ In particular, the Commission determined that it was important to have a process for individuals with a valid or legitimate need to access certain sensitive energy infrastructure information. --------------------------------------------------------------------------- \3\ See Statement of Policy on Treatment of Previously Public Documents, 66 FR 52,917 (Oct. 18, 2001), 97 FERC ] 61,030 (2001). A large component of what is currently Critical Energy Infrastructure Information was previously publicly available prior to September 11, 2001. \4\ The FOIA process is specified in 5 U.S.C. 552 and the Commission's regulations at 18 CFR 388.108. \5\ Critical Energy Infrastructure Information, Order No. 630, 68 FR 9,857 (Mar. 3, 2003), FERC Stats. & Regs. ] 31,140 (2003), order on reh'g, Order No. 630-A, 68 FR 46,456 (Aug. 6, 2003), FERC Stats. & Regs. ] 31,147 (2003). --------------------------------------------------------------------------- 4. The Commission last revised its Critical Energy Infrastructure Information rules over eight years ago.\6\ However, the Commission indicated that it will revise the Critical Energy Infrastructure Information rules based on a continuing review of its application and effectiveness.\7\ --------------------------------------------------------------------------- \6\ See Critical Energy Infrastructure Information, Order No. 702, 72 FR 63,980 (Nov. 14, 2007), FERC Stats. & Regs. ] 31,258 (2007). \7\ For example, in 2014, the Department of Energy Inspector General initiated a review of the Commission's controls for protecting non-public information. In a report dated January 30, 2015, the DOE Inspector General recommended, among other things, that the Commission take steps to ensure that the Critical Energy Infrastructure Information processes to protect and control non- public information are current and that such policies are disseminated and properly implemented. DOE Inspector General, Inspection Report: Review of Controls for Protecting Nonpublic Information at the Federal Energy Regulatory Commission (Jan. 2015), http://energy.gov/sites/prod/files/2015/02/f19/DOE-IG-0933.pdf (DOE IG Report). --------------------------------------------------------------------------- 5. Over 7,000 documents are submitted to the Commission's eLibrary [[Page 43558]] system as Critical Energy Infrastructure Information each year. The vast majority of submissions and Commission-generated information relates to hydroelectric projects but also includes information regarding natural gas pipeline and electric infrastructure. 6. The Commission receives approximately 200 requests for Critical Energy Infrastructure Information a year. Requests are typically submitted by public utilities, gas pipelines, Liquefied Natural Gas (LNG) facilities, hydroelectric developers, academics, landowners, public interest groups, researchers, renewable energy organizations, consultants, and Federal agencies. 7. The Commission's current Critical Energy Infrastructure Information rules provide a means for entities to obtain Critical Energy Infrastructure Information while ensuring that it is handled in an appropriate and secure manner. The new requirements in section 215A(d) also ensure that Critical Electric Infrastructure Information, which as described below includes Critical Energy Infrastructure Information, can be appropriately shared while also being adequately protected. Thus, the Commission proposes to augment its existing Critical Energy Infrastructure Information process to comply with section 215A(d)(2) and to make other changes described in this NOPR. The Commission proposes to have a single process that would address submitting, designating, handling, sharing, and disseminating CEII that is submitted to or generated by the Commission. The proposed regulations will govern how the Commission and its employees implement the provisions of the FAST Act. III. Revisions To Implement the FAST Act A. Relocating References to CEII From Section 388.112 to Section 388.113 8. The Commission proposes to transfer provisions contained in section 388.112 that are applicable to Critical Energy Infrastructure Information to amended section 388.113. This transfer would include notice and filing requirements. As a result of this change, amended section 388.112 would apply only to information designated as privileged and all of the Commission's CEII procedures will be in section 388.113. B. Scope, Purpose, and Definitions 9. The Commission's current Critical Energy Infrastructure Information process is designed to limit the distribution of sensitive infrastructure information to those individuals with a need to know in order to avoid having sensitive information fall into the hands of those who may use it to attack the nation's infrastructure. Section 388.113(c) of the Commission's regulations defines Critical Energy Infrastructure Information as: specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that: (i) Relates details about the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the general location of the critical infrastructure. 10. To augment the current Critical Energy Infrastructure Information process to comply with FPA section 215A(d), the Commission proposes that the scope and purpose of its regulations be changed to reflect the requirements of the FAST Act. Specifically, the Commission proposes to amend section 388.113(a) to indicate that the section governs the procedures for submitting, designating, handling, sharing, and disseminating CEII submitted to or generated by the Commission. Moreover, the Commission proposes to amend section 388.113(b) to indicate that the purpose of section 388.113 is to provide an overview of the Commission's CEII procedures. 11. Section 215A(a)(3) of the FPA introduces the new term ``Critical Electric Infrastructure Information:'' information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency, other than classified national security information . . . Such term includes information that qualifies as critical energy infrastructure information under the Commission's regulations. As indicated above, the Commission's current procedures for Critical Energy Infrastructure Information apply to information ``about the production, generation, transportation, transmission, or distribution of energy.'' Thus, the FAST Act defines ``Critical Electric Infrastructure Information'' to include not only information regarding the Bulk-Power System but also information regarding other energy infrastructure (i.e., gas pipelines, LNG, oil, and hydroelectric infrastructure) to the extent such information qualifies as Critical Energy Infrastructure Information under the Commission's current regulations. 12. Accordingly, the Commission proposes to revise section 388.113(c) (Definitions) of the Commission's regulations to add the new statutory term Critical Electric Infrastructure Information, as referenced above. The Commission also proposes to add to the regulations the term Critical Electric Infrastructure, which is defined in FPA section 215A(a)(3) as ``a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.'' 13. The Commission proposes to refer to the information under the new regulations as Critical Energy/Electric Infrastructure Information, and to use the abbreviation ``CEII'' for this term.\8\ By referring to the information only as Critical Electric Infrastructure Information, the public, especially those that do not interact with the Commission on a regular basis, may assume that the revised CEII regulations only cover information regarding electric infrastructure and not also information about other energy infrastructure. By using the term Critical Energy/Electric Infrastructure Information, the Commission clearly conveys to the public that the Commission's revised CEII procedures cover more than just electric infrastructure. --------------------------------------------------------------------------- \8\ The abbreviation will be used except where appropriate to address any distinction between the Commission's current regulations and the terms of the FAST Act. --------------------------------------------------------------------------- 14. The Commission complies with section 215A(d) by incorporating the term Critical Electric Infrastructure Information into its regulations as set forth in the statute and treating it as Congress intended. In addition, subsuming Critical Energy Infrastructure Information into the term Critical Electric Infrastructure Information will allow the Commission to have a unitary process for handling CEII and, thereby, avoid any confusion that could result from multiple processes for different types of critical infrastructure information. Avoiding such confusion should better facilitate sharing of CEII as well as help prevent unauthorized disclosures of CEII, which we see as the principal goals of section 215A(d). 15. Section 215A(d)(1)(A) of the FPA states that Critical Electric Infrastructure Information ``shall be exempt from disclosure under [(FOIA)] section 552(b)(3).'' \9\ Accordingly, the Commission proposes to amend its regulations to specify that CEII is [[Page 43559]] exempt from disclosure under FOIA pursuant to section 215A(d)(1)(A).\10\ --------------------------------------------------------------------------- \9\ See 5 U.S.C. 552(b)(3) (protects information ``specifically exempted from disclosure by statute''). \10\ The Commission has relied upon FOIA Exemption 7(F) to protect this type of information from disclosure. See 5 U.S.C. 552(b)(7)(F) (protecting law enforcement information that could reasonably be expected to endanger the life or physical safety of any individual). The Commission will continue to rely on this exemption, as appropriate. --------------------------------------------------------------------------- C. Criteria and Procedures for Determining What Constitutes CEII 16. Section 215A(d)(2)(A) requires the Commission to ``establish criteria and procedures to designate information as critical electric infrastructure information.'' \11\ The proposed processes and procedures are intended to apply to the manner in which the Commission handles CEII that is submitted to or generated by the Commission.\12\ --------------------------------------------------------------------------- \11\ Section 215A(d)(3) gives the Commission and DOE the authority to designate Critical Electric Infrastructure Information. \12\ Section 215A(d)(3) provides that information ``may be designated'' by the Commission or Secretary of Energy as ``critical electric infrastructure information.'' These proposed regulations would only apply to information submitted to or generated by the Commission. Nothing in the preamble or proposed regulations would limit DOE's ability to designate information as it deems appropriate under the FAST Act. --------------------------------------------------------------------------- 17. Accordingly, the Commission proposes to amend section 388.113(d) of its regulations to provide that information submitted to or generated by the Commission is CEII if it meets the definition, and the criteria provided below.\13\ The Commission therefore proposes to merge its existing criteria with the statutory directives in the FAST Act. The Commission further proposes to amend its procedures, as explained below. --------------------------------------------------------------------------- \13\ Information downloaded by Commission staff from private databases that are accessed pursuant to Commission order or regulation will be maintained as non-public information consistent with the Commission's internal controls. See, e.g., Availability of Certain North American Electric Reliability Corporation Databases to the Commission, 155 FERC ] 61,275 (2016). If the Commission receives a request for access to downloaded information, the Commission will evaluate whether the information meets the definition of CEII or is proprietary information or otherwise privileged or non-public and will provide the owner of the database or information (as appropriate) with an opportunity to comment on the request consistent with proposed section 388.113(d)(1)(vi) or sections 388.112(d) and (e). --------------------------------------------------------------------------- 1. Designation of Submissions to the Commission 18. Existing section 388.112(b) requires that a submitter of Critical Energy Infrastructure Information clearly mark the information as CEII and provide a justification for the designation. The Commission will maintain these requirements in section 388.113(d) for CEII. However, in addition to this information, the Commission proposes to include in section 388.113(d) a requirement that each submitter include on the information submitted a clear statement of the date the information was submitted to the Commission, and how long the submitter believes the CEII designation should apply to the information.\14\ The referenced justification that the submitter submits must include an explanation for the period proposed. Such information will assist the Commission in making a determination as to the length of time the information should be designated as CEII. Failure to follow these submission requirements, including failure to provide an adequate justification, could result in denial of the designation and public release of the information. --------------------------------------------------------------------------- \14\ The submitter must clearly indicate this information on the submission in a clear and durable manner. For example, in addition to an appropriate cover sheet, each page should be clearly labeled. The date of submission will start the period for CEII designation. Commission-generated information should also have clear markings. --------------------------------------------------------------------------- 19. Under its current practice, the Commission deems the designation on a submission accepted as submitted, unless the submitter is otherwise notified by the Commission.\15\ The Commission intends to follow that same practice under the new CEII regulations. However, the Commission maintains the discretion to check a submission at the time of submission to ensure that it includes adequate designation information and is properly designated. In sum, the burden will be on the submitting entity to ensure that the information it submits is properly labeled and contains adequate designation information. Although unmarked information may be eligible for CEII treatment, the Commission intends to treat information as CEII only if it is properly designated as CEII pursuant to our regulations. --------------------------------------------------------------------------- \15\ Section 18 CFR 375.313 delegates authority to the Critical Energy Infrastructure Information Coordinator (Coordinator), who is the Director of the Office of External Affairs. As explained below, the Commission proposes to modify this section to reflect the new authority in the FAST Act. --------------------------------------------------------------------------- 20. To ensure that all the requirements concerning CEII are in a single section of the Commission's regulations, the Commission proposes to move the requirements in current section 388.112(b) regarding CEII to section 388.113(d). The Commission believes that it will better protect CEII from unauthorized disclosure as well as facilitate the voluntary sharing of CEII to have a single process to address CEII and for that process to be located in a single section of our regulations. Locating our CEII regulations in the same section of the Commission's regulations will relieve the public from having to review multiple sections of our regulations to find our rules addressing CEII, which may cause confusion. 2. Designation of Commission-Generated Information 21. The Commission proposes to revise section 388.113(d) to specify that, for Commission-generated information, the Office Director for the Commission office in which the Commission-generated information was created, or the Office Director's designee, must consult with the Coordinator to determine whether the information meets the definition of CEII, how long the designation of CEII should last and, as appropriate, any re-designation. The Coordinator will then make the designation determination.\16\ Any CEII that the Commission generates must also be clearly marked as CEII and indicate the date that the information was designated as CEII. This coordination will help ensure that Commission-generated information is handled in an appropriate and consistent manner. --------------------------------------------------------------------------- \16\ Pursuant to section 375.313(d) of the Commission's regulations, the Coordinator is responsible for establishing ``reasonable conditions'' on the release of CEII. --------------------------------------------------------------------------- 3. Segregable Information 22. In many cases, information submitted to the Commission may contain information that is CEII along with information that is not CEII. Section 215A(d)(8) requires the Commission to: segregate critical electric infrastructure information or information that reasonably could be expected to lead to the disclosure of the critical electric infrastructure information within documents and electronic communications, wherever feasible, to facilitate disclosure of information that is not designated as critical electric infrastructure information. Accordingly, the Commission proposes to add a provision to section 388.113(d) that would require the submitter to segregate CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) from non-CEII at the time of submission wherever feasible. The burden would be on the submitter to clearly mark in the submission what is CEII and what is not CEII. The requirement also would apply to Commission-generated CEII.\17\ --------------------------------------------------------------------------- \17\ See proposed 18 CFR 388.113(d)(2) and (3). --------------------------------------------------------------------------- 4. Duration of Designation 23. Section 215A(d)(9) of the FPA states that information ``may not be [[Page 43560]] designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.'' The Commission proposes to add this statement to proposed section 388.113(e). 24. The Commission plans to use the following process to implement the duration of designation provision. At the present time there are almost 200,000 documents labeled as Critical Energy Infrastructure Information in the Commission's eLibrary system. The Commission does not plan to move designated information from its non-public files to its public files after the designation period has passed (i.e., up to five years from date of designation), unless the Commission determines in a particular instance that it is appropriate to do so. The passing of the CEII designation period would not necessarily render designated information suitable for inclusion in the Commission's public files. The Commission plans to determine whether information should be re- designated or alternatively placed in the Commission's public files when an entity requests the information, when staff determines a need to remove the designation, or when a submitter requests that information no longer be treated as CEII.\18\ --------------------------------------------------------------------------- \18\ In the event the Commission re-designates information as CEII, the Commission will re-designate the information as CEII for another five years or a shorter time period, as appropriate. --------------------------------------------------------------------------- 25. The proposed approach is consistent with the FAST Act. Section 215A(d)(9) of the FPA does not require automatic public disclosure of CEII at the end of the initial CEII designation period. Indeed, the FAST Act contemplates that there may be information that warrants continued protection after the initial designation period. Given the volume of CEII in the Commission's files and the expectation that the Commission will continue to receive a substantial amount of CEII each year, this proposed approach strikes a reasonable balance in meeting the designation requirements of the FAST Act. 26. Consistent with the above practice, the Commission proposes that the non-disclosure agreement (NDA) will require any recipient of CEII from the Commission to continue to protect the information past the expiration of the CEII designation marked on the information. Further, the recipient must receive prior authorization from the Commission before making any disclosure of such information. These requirements will enable the Commission to comply with section 215A(d)(10) and determine whether information must be ``specifically re-designated'' as CEII. 27. Section 215A(d)(10) of the FPA provides that when ``the Commission or the [DOE] Secretary, as appropriate, determines that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities'' the designation shall be removed. The Commission proposes to revise section 388.113(e) of the Commission's regulations to provide for removal of the CEII designation when it no longer could impair the security or reliability of not only the Bulk- Power System and distribution facilities but also other forms of energy infrastructure. The Commission will provide notice to the submitter in the instance where the Commission takes the affirmative step to rescind the designation. 5. Judicial Review of Designation 28. Section 215A(d)(11) of the FPA provides that: any determination by the Commission or the [DOE] Secretary concerning the designation of critical electric infrastructure information . . . shall be subject to review . . . in the district court of the United States in the district in which the complainant resides, or has his principal place of business, or in the District of Columbia. The Commission proposes to incorporate this provision into proposed section 388.113(e) of its regulations. In addition, the Commission proposes to require an entity or individual that intends to challenge a Commission designation determination in federal district court to first appeal the decision to the Commission's General Counsel. We believe that requiring an administrative appeal prior to seeking judicial review is appropriate because it would ensure consistency in how the Commission addresses CEII determinations, and is consistent with the current practice for responding to CEII and FOIA requests.\19\ --------------------------------------------------------------------------- \19\ Such a determination is subject to review by an applicable district court and would not be an order subject to rehearing and review under 16 U.S.C. 825l. --------------------------------------------------------------------------- D. Duty To Protect CEII 29. Whether CEII is created by Commission staff or submitted to the Commission by an outside party or a member of the public, section 215A(d)(2)(B) of the FPA requires the Commission to ``prohibit the unauthorized disclosure of critical electric infrastructure information.'' This requirement applies to Commission employees as well as to all individuals to whom the Commission provides CEII. Thus, the Commission proposes to make the following changes to its regulations in proposed section 388.113(h) to ensure CEII is adequately protected. 1. Internal Controls for Commission Employees 30. To ensure that Commission employees appropriately handle CEII, Commission staff is developing an information governance policy and guidelines, which is intended to address how sensitive information, including CEII, should be handled, marked, and kept secure.\20\ Consistent with these guidelines, the Commission proposes to add a provision in proposed section 388.113(h) that would require the Commissioners, Commission staff, and Commission contractors to comply with the Commission's internal controls. The internal controls will address how the Commission and its personnel, including contractors and agents, handle CEII. --------------------------------------------------------------------------- \20\ The DOE IG Report raised concerns with how Commission staff handled, labeled, and tracked Critical Energy Infrastructure Information. DOE IG Report at 2-5, 12. --------------------------------------------------------------------------- 2. Controls for Recipients of CEII 31. Currently, section 388.113(d) requires external recipients of Critical Energy Infrastructure Information to sign an NDA, which imposes conditions on how the information may be used.\21\ The current regulation does not specify the minimum required content of an NDA. --------------------------------------------------------------------------- \21\ See, e.g., General Non-Disclosure Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf. --------------------------------------------------------------------------- 32. The Commission proposes to strengthen the NDA requirements for all the different forms of NDAs the Commission uses to share CEII.\22\ Including these provisions in each type of NDA form that the Commission uses will better protect CEII from unauthorized disclosure. Specifically, the Commission proposes revising its regulations to state in section 388.113(h)(2) that an NDA must minimally require that CEII: (1) Will only be used for the purpose it was requested; (2) may only be discussed with authorized recipients; (3) must be kept in a secure place in a manner that would prevent unauthorized access; (4) [[Page 43561]] must be destroyed or returned to the Commission upon request; and (5) that the Commission may audit compliance with the NDA. These changes would codify and strengthen current NDA terms consistent with FPA section 215A(d). --------------------------------------------------------------------------- \22\ Separate NDAs exist for general users, the media, state agencies, and consultants, and are available at http://www.ferc.gov/legal/ceii-foia/ceii.asp. Federal Agency requesters, as noted below, receive an Agency Acknowledgment and Agreement, which has different terms than the NDAs. --------------------------------------------------------------------------- 33. Moreover, another means to prevent unauthorized disclosure of CEII is to ensure that the CEII is only shared with those who need it. The Commission, therefore, proposes to amend section 388.113(g)(5) to require a person seeking CEII to demonstrate a legitimate need for the information. Thus, the Commission proposes to require a requestor to demonstrate: (1) The extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) whether the information is needed expeditiously. This information will assist the Commission's CEII Coordinator in ``balance[ing] the requestor's need for the information against the sensitivity of the information.'' \23\ A conclusory statement will not satisfy this requirement. --------------------------------------------------------------------------- \23\ See 18 CFR 388.113(d)(4)(iii) and (iv). --------------------------------------------------------------------------- 34. Finally, to ensure that CEII is only disclosed to appropriate individuals, the Commission proposes to amend section 388.113(g)(5)(i)(D) to require the requestor to include a signed statement attesting to the accuracy of the information provided in any request for CEII submitted to the Commission. E. Sanctions 35. Section 215A(d)(2)(C) of the FPA requires the Commission to ``ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section.'' The Commission proposes to add proposed section 388.113(i) to implement this requirement. 36. The Commission proposes that it take responsibility for addressing unauthorized disclosures of CEII in the Commission's possession by Commission personnel.\24\ The Commission may initiate an adverse personnel action, such as a suspension or a removal action, against a Commission employee who makes an unauthorized disclosure of CEII or any other non-public information.\25\ While the Commission may not sanction the Chairman or Commissioners,\26\ it can refer any misconduct by the Chairman or Commissioners to the DOE Inspector General. --------------------------------------------------------------------------- \24\ The Commission anticipates that DOE will take responsibility for sanctions for unauthorized disclosures by its officers, employees, staff, and agents with regard to information in DOE's possession. \25\ See, e.g., 5 U.S.C. Chapter 75 (Adverse Actions). \26\ The Chairman and Commissioners are appointed by the President and may be removed by the President only for inefficiency, neglect of duty, or malfeasance in office. 42 U.S.C. 7171. --------------------------------------------------------------------------- F. Voluntary Sharing of CEII 37. Section 215A(d)(2)(D) of the FPA requires that the Commission: taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of critical electric infrastructure information with, between, and by--(i) Federal, State, political subdivision, and tribal authorities; (ii) the Electric Reliability Organization; (iii) regional entities; (iv) information sharing and analysis centers established pursuant to Presidential Decision Directive 63; (v) owners, operators, and users of critical electric infrastructure in the United States; and (vi) other entities determined appropriate by the Commission. Under this provision, the Commission has authority to share CEII with individuals and organizations that the Commission has determined need the information to ensure that energy infrastructure is protected.\27\ Voluntary sharing applies to both Commission-generated CEII and CEII submitted to the Commission. --------------------------------------------------------------------------- \27\ Section 215A(d)(6) of the FPA makes clear that nothing in the FAST Act ``require[s] a person or entity in possession of critical electric infrastructure information to share such information'' with other individuals and entities; see also Cybersecurity Information Sharing Act of 2015, Public Law 114-113, 129 Stat. 2936 (2015). --------------------------------------------------------------------------- 38. Under this provision, the Commission may share CEII without first receiving a request for the CEII. Section 388.112(c)(i) already provides the Commission with ``the discretion to release information as necessary to carry out its jurisdictional responsibilities.'' The Commission proposes to move this language to section 388.113(f)(2) in the regulations and also note that the Commission retains the discretion to release information as necessary for other federal agencies to carry out their jurisdictional responsibilities. 39. The Commission also proposes to add section 388.113(f)(1) to its regulations to require an Office Director or his designee to consult with the Coordinator prior to the Office Director or his designee making a determination to voluntarily share CEII. The Coordinator will determine whether the information has been appropriately designated as CEII and whether appropriate protective measures are in place to secure its transfer and treatment by the recipient. 40. When the Commission voluntarily shares information, the CEII will be shared subject to an appropriate NDA or Acknowledgement and Agreement.\28\ Thus, the Commission proposes to add language to its regulations in proposed section 388.113(f) to make clear that, after a determination by the Coordinator, the Office Director will provide the proposed recipients of the CEII with the appropriate NDA or Agency Acknowledgement and Agreement for execution and return. The Commission proposes to amend its regulations to require a signed copy of each agreement be maintained by the Office Director with a copy to the Coordinator. --------------------------------------------------------------------------- \28\ As noted below, to obtain CEII Federal Agencies execute an Acknowledgement and Agreement, as opposed to an NDA. See Federal Agency Acknowledgement and Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf. --------------------------------------------------------------------------- 41. The Commission proposes to add to section 388.113(f) of its regulations a statement indicating that the Commission may impose additional restrictions on how the CEII the Commission voluntarily shares may be used and maintained. Given that the Commission anticipates that it will voluntarily share CEII when the Commission believes that the recipients need the information to protect critical infrastructure, the recipients may otherwise have no other legitimate need for the information but to address that event. Thus, it is appropriate to impose additional conditions on use and handling of CEII that the Commission voluntarily shares. 42. Where practicable, when the Commission is considering voluntarily sharing CEII, the Commission will provide notice to the submitter of that information. However, it may not be practicable for the Commission to provide notice to the submitter in instances where voluntary sharing is necessary to maintain infrastructure security, to address a potential threat, or in other exigent circumstances. In such instances, a requirement to give notice to the submitter may be detrimental to the ability of the Commission to timely share CEII with entities that may urgently need the information and could compromise law enforcement [[Page 43562]] operations.\29\ Thus, under these limited circumstances, the Commission will not give the submitter notice of sharing the CEII with others. However, to be clear, any CEII that the Commission voluntarily shares under these circumstances will be handled as CEII subject to an NDA or an Acknowledgement and Agreement and, as explained above, may be subject to additional controls as appropriate. --------------------------------------------------------------------------- \29\ For example, FPA section 215A(e) requires the Commission to share ``timely actionable information regarding grid security with appropriate key personnel of owners, operators, and users of the critical electric infrastructure.'' This information may include classified information as well as CEII. Providing notice and seeking a response from a submitter prior to disclosure of this CEII may hinder the Commission's ability to share ``timely actionable information.'' --------------------------------------------------------------------------- IV. Other Proposed Revisions A. Request for Access to CEII 1. Owner-Operator Requests 43. Existing sections 388.113(d)(1) and (2) permit Critical Energy Infrastructure Information to be released directly to owner/operators outside of the Critical Energy Infrastructure Information process. The DOE IG Report raised concerns that the Commission might not be aware of information released outside of the Critical Energy Infrastructure Information process.\30\ The Commission proposes to maintain this practice but proposes to amend existing sections 388.113(d)(1) and (2), re-designated as proposed sections 388.113(g)(1) and (2), to require Commission staff to inform the Coordinator of such requests prior to the release of any information. --------------------------------------------------------------------------- \30\ See DOE IG Report at 4-5. --------------------------------------------------------------------------- 44. Additionally, the Commission proposes to amend existing section 388.113(d)(1), which allows an owner or operator of a facility to obtain certain CEII concerning its facilities without signing an NDA, to exclude Commission-generated information except inspection reports/ operation reports and any information directed to the owner-operators. Thus, the owners and operators of a facility will be able to obtain inspection reports/operation reports and any information directed to the owner-operators concerning their facilities without going through the CEII process. 45. In Order No. 630, the Commission relieved owners/operators from signing an NDA for Critical Energy Infrastructure Information regarding their own facilities on the basis that ``they have at least as great an incentive to protect this information as the Commission has.'' \31\ We believe that owners/operators will have the same incentive to protect inspection reports/operation reports and any information regarding their own facilities that may contain Commission-generated CEII. --------------------------------------------------------------------------- \31\ Critical Energy Infrastructure Information, Order No. 630, 68 FR 9857 (Mar. 3, 2003), FERC Stats. & Regs. ] 31,140 (2003); order on reh'g, Order No. 630-A, 68 FR 46,456 (Aug. 6, 2003), FERC Stats. & Regs. ] 31,147, at P 57 (2003). --------------------------------------------------------------------------- 2. Federal Agency Requests 46. Existing section 388.113(d)(2) allows any employee of a Federal agency acting within the scope of his or her federal employment to obtain Critical Energy Infrastructure Information without going through the process outlined in existing section 388.113(d)(5), as long as the request is approved by a Commission Division Director or higher. 47. The Commission's practice has been for an employee of another agency to sign an Acknowledgement and Agreement, which states that the agency will protect the Critical Energy Infrastructure Information in the same manner as the Commission and will refer any requests for the information to the Commission. The Commission proposes to maintain and codify this practice in the revised CEII regulations in section 388.113(g)(2). 3. Intervenor Requests 48. Individuals in a complaint proceeding or other proceeding to which a right to intervention exists may need CEII to participate in the proceeding. Where a submitter has provided CEII or other non-public information with its filing, existing section 388.112(b)(2)(i) requires a submitter in the context of a proceeding before the Commission to ``include a proposed form of a protective agreement with the filing'' to facilitate an intervenor's access to information without going through the Critical Energy Infrastructure Information process. Under this provision four categories of information need not be provided subject to such a protective agreement: (1) Landowner lists; (2) privileged information filed under section 380.12(f) or section 380.16(f), which pertain to cultural resources; (3) privileged information filed under section 380.12(m), which pertains to reliability and safety information that must be filed by liquefied natural gas (LNG) facilities; and (4) privileged information filed under section 380.12(o), which pertains to engineering and design material information that must be filed by LNG facilities. 49. However, in Dominion Cove Point LNG, LP,\32\ the Commission directed a party to release pursuant to a protective agreement LNG safety and engineering information not otherwise available under section 388.112(b)(2)(i). Consistent with that decision, the Commission proposes to amend its regulations to eliminate the current exemptions for LNG information identified under section 388.112(b)(2)(i). This change would leave in place the right of any filer or any person to oppose the disclosure. The Commission proposes to move these requirements to section 388.113(g)(4). --------------------------------------------------------------------------- \32\ See Dominion Cove Point LNG, LP, 147 FERC ] 61,202 (2014) (concluding that the protective agreement outlined in section 388.112(b)(2)(i), as opposed to the Critical Energy Infrastructure Information process, was the appropriate mechanism to obtain fourteen identified LNG safety and engineering documents). --------------------------------------------------------------------------- B. Other Considerations for Access to CEII 1. Organizational Requests 50. Existing section 388.113(d)(4)(vi) permits an organization to request CEII for its employees who sign an NDA. With notice to the Commission, the regulation allows the organization to give additional employees access to this CEII, subject to their signing an NDA. The Commission proposes to place a one-year time limit on an organization's ability to add additional employees. After one year from the date of its original request, an organization would have to submit a new CEII request and NDAs pursuant to proposed section 388.113(g)(5)(ii). 2. Timing Requirement 51. An earlier version of the Commission's regulations stated that Critical Energy Infrastructure Information requests would be processed, if possible, within the statutory timeframe for FOIA. The Commission proposes to amend section 388.113(g)(vii) of its regulations to reestablish this requirement for CEII, as the Commission never intended to remove it from the regulations.\33\ --------------------------------------------------------------------------- \33\ This language appears in the April 2007 edition of the Commission's regulations, but does not appear in the April 2008 edition. The preamble to the 2008 regulations does not provide an explanation for the elimination of this provision from the Commission's regulations. Thus, the Commission believes it appropriate to reinstate the requirement. --------------------------------------------------------------------------- 3. CEII Combined With Other Protected Information 52. If CEII and proprietary or other protected information are inextricably intertwined, the Commission has historically withheld from disclosure [[Page 43563]] the intertwined information under FOIA. Consistent with this practice, the Commission proposes to add section 388.113(g)(5)(ix) to clarify that the Commission's CEII regulations should not be construed to require the release of proprietary information, personal information, cultural resource information and other comparable data protected by statute or regulation, or any privileged or otherwise non-public information, including information protected by the deliberative process. 4. CEII Coordinator 53. Under section 375.313, the Commission has delegated to the Coordinator certain authority to address CEII matters. The Commission proposes to amend subsection 375.313(b) to make clear that the Coordinator has designation authority consistent with the FAST Act, and to add a subsection to make clear that the Coordinator has the authority to designate and release information to the public. Moreover, the Commission proposes to change all references in section 375.313 from Critical Energy Infrastructure Information to the acronym CEII. V. Information Collection Statement 54. The Paperwork Reduction Act and Office of Management and Budget's (OMB) implementing regulations require OMB to review and approve certain information collection requirements imposed by agency rule.\34\ This Notice of Proposed Rulemaking does not impose any additional information collection requirements.\35\ Therefore, the information collection regulations do not apply to this Notice of Proposed Rulemaking. --------------------------------------------------------------------------- \34\ 5 CFR 1320. \35\ The current information collection requirements related to requesting access to CEII material are approved by OMB under FERC- 603 (OMB Control No. 1902-0197). --------------------------------------------------------------------------- VI. Environmental Analysis 55. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.\36\ --------------------------------------------------------------------------- \36\ Regulations Implementing the National Environmental Policy Act of 1969, Order No. 486, FERC Stats. & Regs. ] 30,783 (1987). --------------------------------------------------------------------------- 56. The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural, or that do not substantially change the effect of the regulations being amended.\37\ The actions here fall within this categorical exclusion in the Commission's regulations. --------------------------------------------------------------------------- \37\ 18 CFR 380.4(a)(2)(ii). --------------------------------------------------------------------------- VII. Regulatory Flexibility Act Certification 57. The Regulatory Flexibility Act of 1980 (RFA) requires rulemakings to contain either a description and analysis of the effect that the rule will have on small entities or a certification that the rule will not have a significant economic impact on a substantial number of small entities.\38\ Rules that are exempt from the notice and comment requirements of section 553(b) of the Administrative Procedure Act are exempt from the RFA requirements. This Notice of Proposed Rulemaking concerns rules of agency procedure and, therefore, an analysis under the RFA is not required.\39\ --------------------------------------------------------------------------- \38\ 5 U.S.C. 603 (2012). \39\ 5 U.S.C. 553(b). --------------------------------------------------------------------------- VIII. Public Comments 58. The Commission invites interested persons to submit comments on the matters and issues proposed in this notice to be adopted, including any related matters or alternative proposals that commenters may wish to discuss. Comments are due August 19, 2016. Comments must refer to Docket No. RM16-15-000, and must include the commenter's name, the organization they represent, if applicable, and their address in their comments. 59. The Commission encourages comments to be filed electronically via the eFiling link on the Commission's Web site at http://www.ferc.gov. The Commission accepts most standard word processing formats. Information created electronically using word processing software should be filed in native applications or print-to-PDF format and not in a scanned format. Commenters filing electronically do not need to make a paper filing. 60. Commenters that are not able to file comments electronically must send an original of their comments to: Federal Energy Regulatory Commission, Secretary of the Commission, 888 First Street NE., Washington, DC 20426. 61. All comments will be placed in the Commission's public files and may be viewed, printed, or downloaded remotely as described in the Document Availability section below. Commenters on this proposal are not required to serve copies of their comments on other commenters. IX. Document Availability 62. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through the Commission's Home Page (http://www.ferc.gov) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, Washington, DC 20426. 63. From the Commission's Home Page on the Internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number of this document, excluding the last three digits, in the docket number field. 64. User assistance is available for eLibrary and the Commission's Web site during normal business hours from the Commission's Online Support at 202-502-6652 (toll free at 1-866-208-3676) or email at [email protected], or the Public Reference Room at (202) 502- 8371, TTY (202) 502-8659. Email the Public Reference Room at [email protected]. List of Subjects 18 CFR Part 375 Authority delegations (Government agencies); Seals and insignia; Sunshine Act. 18 CFR Part 388 Confidential business information; Freedom of information. By direction of the Commission. Dated: June 16, 2016. Kimberly D. Bose, Secretary. In consideration of the foregoing, the Commission proposes to amend Parts 375 and 388, Chapter I, Title 18, Code of Federal Regulations, as follows: PART 375--THE COMMISSION 0 1. The authority citation for part 375 continues to read as follows: Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645; 42 U.S.C. 7101-7352. 0 2. Amend Sec. 375.313 by: 0 a. Revising the section heading and paragraphs (a) and (b); 0 b. Redesignating paragraphs (c) through (e) as paragraphs (d) through (f) and revising newly redesignated paragraphs (d) through (f); and 0 c. Adding a new paragraph (c). [[Page 43564]] The revisions and addition read as follows: Sec. 375.313 Delegations to the Critical Energy/Electric Infrastructure Information (CEII) Coordinator. * * * * * (a) Receive and review all requests for CEII as defined in Sec. 388.113(c) of this chapter. (b) Make determinations as to whether particular information fits within the definition of CEII found at Sec. 388.113(c) of this chapter, including designating information, as appropriate. (c) Make a determination that information designated as CEII should no longer be so designated when the unauthorized disclosure of the information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other infrastructure. (d) Make determinations as to whether a particular requester's need for and ability and willingness to protect CEII warrants limited disclosure of the information to the requester. (e) Establish reasonable conditions on the release of CEII. (f) Release CEII to requesters who satisfy the requirements in paragraph (d) of this section and agree in writing to abide by any conditions set forth by the Coordinator pursuant to paragraph (e) of this section. PART 388--INFORMATION AND REQUESTS 0 3. The authority citation for part 388 is changed to read as follows: Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352; 16 U.S.C. 824(o-l). 0 4. Amend Sec. 388.112 by revising the section heading and paragraphs (a), (b)(1), (b)(2)(i), (b)(2)(vi), (c)(1), and (d)-(e) to read as follows: Sec. 388.112 Requests for privileged treatment for documents submitted to the Commission. (a) Scope. By following the procedures specified in this section, any person submitting a document to the Commission may request privileged treatment for some or all of the information contained in a particular document that it claims is exempt from the mandatory public disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552 (FOIA), and should be withheld from public disclosure. For the purposes of the Commission's filing requirements, non-CEII subject to an outstanding claim of exemption from disclosure under FOIA will be referred to as privileged material. The rules governing CEII are contained in 18 CFR 388.113. (b) Procedures for filing and obtaining privileged material. (1) General Procedures. A person requesting that material be treated as privileged information must include in its filing a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. A person requesting that a document filed with the Commission be treated as privileged in whole or in part must designate the document as privileged in making an electronic filing or clearly indicate a request for such treatment on a paper filing. The cover page and pages or portions of the document containing material for which privileged treatment is claimed should be clearly labeled in bold, capital lettering, indicating that it contains privileged or confidential information, as appropriate, and marked ``DO NOT RELEASE.'' The filer also must submit to the Commission a public version with the information that is claimed to be privileged material redacted, to the extent practicable. (2) Procedures for Proceedings with a Right to Intervene. * * * (i) If a person files material as privileged material in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material. This requirement does not apply to material submitted in hearing or settlement proceedings, or if the only material for which privileged treatment is claimed consists of landowner lists or privileged information filed under sections 380.12(f) and 380.16(f) of this chapter. * * * * * (vi) For landowner lists, information filed as privileged under sections 380.12(f) and 380.16(f), forms filed with the Commission, and other documents not covered above, access to this material can be sought pursuant to a FOIA request under section 388.108 of this chapter. Applicants are not required under paragraph (b)(2)(iv) of this section to provide intervenors with landowner lists and the other materials identified in the previous sentence. (c) Effect of privilege claim. (1) For documents filed with the Commission: (i) The documents for which privileged treatment is claimed will be maintained in the Commission's document repositories as non-public until such time as the Commission may determine that the document is not entitled to the treatment sought and is subject to disclosure consistent with section 388.108 of this chapter. By treating the documents as nonpublic, the Commission is not making a determination on any claim of privilege status. The Commission retains the right to make determinations with regard to any claim of privilege status, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. (ii) The request for privileged treatment and the public version of the document will be made available while the request is pending. * * * * * (d) Notification of request and opportunity to comment. When a FOIA requester seeks a document for which privilege status has been claimed, or when the Commission itself is considering release of such information, the Commission official who will decide whether to release the information or any other appropriate Commission official will notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. (e) Notification before release. Notice of a decision by the Commission, the Chairman of the Commission, the Director, Office of External Affairs, the General Counsel or General Counsel's designee, a presiding officer in a proceeding under part 385 of this chapter, or any other appropriate official to deny a claim of privilege, in whole or in part, will be given to any person claiming that the information is privileged no less than 5 calendar days before disclosure. The notice will briefly explain why the person's objections to disclosure are not sustained by the Commission. A copy of this notice will be sent to the FOIA requester. * * * * * 0 5. Revise Sec. 388.113 to read as follows: Sec. 388.113 Critical Energy/Electric Infrastructure Information (CEII) (a) Scope. This section governs the procedures for submitting, designating, handling, sharing, and disseminating Critical Energy/ Electric Infrastructure Information (CEII) submitted to or generated by the Commission. The Commission reserves the right to restrict access to previously filed information as well as Commission-generated information containing CEII. (b) Purpose. The procedures in this section implement section 215A of the Federal Power Act, and provide a comprehensive overview of the manner [[Page 43565]] in which the Commission will implement the CEII program. (c) Definitions. For purposes of this section: (1) Critical electric infrastructure information means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to section 215A(d) of the Federal Power Act. Such term includes information that qualifies as critical energy infrastructure information under the Commission's regulations. Critical Electric Infrastructure Information is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552, pursuant to section 215A(d)(1)(A) of the Federal Power Act. (2) Critical energy infrastructure information means specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that: (i) Relates details about the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552, pursuant to section 215A(d)(1)(A) of the Federal Power Act; and (iv) Does not simply give the general location of the critical infrastructure. (3) Critical electric infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters. (4) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters. (d) Criteria and Procedures for determining what constitutes CEII. The following criteria and procedures apply to information labeled as CEII: (1) For information submitted to the Commission: (i) A person requesting that information submitted to the Commission be treated as CEII must include with its submission a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. The justification must provide how the information, or any portion of the information, qualifies as CEII, as the terms are defined in paragraphs (c)(1) and (2) of this section. The submission must also include a clear statement of the date the information was submitted to the Commission, how long the CEII designation should apply to the information and support for the period proposed. Failure to provide the justification or other required information could result in denial of the designation and release of the information to the public. (ii) In addition to the justification required by paragraph (d)(1)(i) of this section, a person requesting that information submitted to the Commission be treated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is claimed in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked ``DO NOT RELEASE.'' The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible. The submitter must also submit to the Commission a public version with the information where CEII is redacted, to the extent practicable. (iii) If a person files material as CEII in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material. (iv) The information for which CEII treatment is claimed will be maintained in the Commission's files as non-public until such time as the Commission may determine that the information is not entitled to the treatment sought. By treating the information as non-public, the Commission is not making a determination on any claim of CEII status. The Commission retains the right to make determinations with regard to any claim of CEII status, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. Although unmarked information may be eligible for CEII treatment, the Commission intends to treat information as CEII only if it is properly designated as CEII pursuant to Commission regulations. (v) The Commission will evaluate whether the submitted information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section prior to making a designation as CEII. (vi) Subject to the exceptions set forth in section 388.113(f)(5), when a CEII requester seeks information for which CEII status has been claimed, or when the Commission itself is considering release of such information, the Commission official who will decide whether to release the information or any other appropriate Commission official will notify the person who submitted the information and give the person an opportunity (at least five calendar days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. Notice of a decision by the Commission, or the CEII Coordinator to make a limited release of CEII, will be given to any person claiming that the information is CEII no less than five calendar days before disclosure. The notice will briefly explain why the submitter's objections to disclosure are not sustained by the Commission. Where applicable, a copy of this notice will be sent to the CEII requester. (2) For Commission-generated information, after consultation with the Office Director for the office that created the information, or the Office Director's designee, the Coordinator will designate the material as CEII after determining that the information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section. Commission-generated CEII shall include clear markings to indicate the information is CEII and the date of the designation. (3) For Commission-generated information, the Commission will segregate non-CEII from CEII or information that reasonably could be expected to lead to the disclosure of CEII wherever feasible. (e) Duration of the CEII designation. All CEII designations will be subject to the following conditions: (1) A designation may last for up to a five-year period, unless re- designated. In making a determination as to whether the designation should be extended, the CEII Coordinator will take into account information provided in response to paragraph (d)(1)(i) of this section, and any other information, as appropriate. (2) A designation may be removed at any time, in whole or in part, if the Commission determines that the unauthorized disclosure of CEII could no longer be used to impair the security or reliability of the bulk-power system [[Page 43566]] or distribution facilities or any other form of energy infrastructure. (3) If such a designation is removed, the submitter will receive notice and an opportunity to comment. The CEII Coordinator will notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing prior to the removal of the designation. Notice of a removal decision will be given to any person claiming that the information is CEII no less than 5 calendar days before disclosure. The notice will briefly explain why the person's objections to the removal of the designation are not sustained by the Commission. (4) Prior to seeking judicial review in district court pursuant to section 215A(d)(11) of the Federal Power Act, an administrative appeal of a determination shall be made to the Commission's General Counsel. (f) Voluntary sharing of CEII. The Commission, taking into account standards of the Electric Reliability Organization, will facilitate voluntary sharing of CEII with, between, and by Federal, state, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission. The process will be as follows: (1) The Director of any Office of the Commission or his designee that wishes to voluntarily share CEII shall consult with the CEII Coordinator prior to the Office Director or his designee making a determination on whether to voluntarily share the CEII. (2) Consistent with section 388.113(d) of this Chapter, the Commission retains the discretion to release information as necessary to carry out its jurisdictional responsibilities in facilitating voluntary sharing or, in the case of information provided to other federal agencies, the Commission retains the discretion to release information as necessary for those agencies to carry out their jurisdictional responsibilities. (3) All entities receiving CEII must execute either a non- disclosure agreement or an acknowledgement and agreement. A copy of each agreement will be maintained by the Office Director with a copy to the CEII Coordinator. (4) When the Commission voluntarily shares CEII pursuant to this subsection, the Commission may impose additional restrictions on how the information may be used and maintained. (5) Submitters of CEII shall receive notification of a limited release of CEII no less than 5 calendar days before disclosure, except in instances where voluntary sharing is necessary for law enforcement purposes, to maintain infrastructure security, to address potential threats, or when notice would not be practicable. (g) Accessing CEII. (1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility, excluding Commission-generated information except inspection reports/operation reports and any information directed to the owner- operators, directly from Commission staff without going through the procedures outlined in paragraph (g)(5) of this section. Non-employee agents of an owner/operator of such facility may obtain CEII relating to the owner/operator's facility in the same manner as owner/operators as long as they present written authorization from the owner/operator to obtain such information. Notice of such requests must be given to the CEII Coordinator, who shall track this information. (2) An employee of a federal agency acting within the scope of his or her federal employment may obtain CEII directly from Commission staff without following the procedures outlined in paragraph (g)(5) of this section. Any Commission employee at or above the level of division director or its equivalent may rule on requests for access to CEII by a representative of a federal agency. To obtain access to CEII, an agency employee must sign an acknowledgement and agreement, which states that the agency will protect the CEII in the same manner as the Commission and will refer any requests for the information to the Commission. Notice of each such request also must be given to the CEII Coordinator, who shall track this information. (3) A landowner whose property is crossed by or in the vicinity of a project may receive detailed alignment sheets containing CEII directly from Commission staff without submitting a non-disclosure agreement as outlined in paragraph (g)(5) of this section. A landowner must provide Commission staff with proof of his or her property interest in the vicinity of a project. (4) Any person who is a participant in a proceeding or has filed a motion to intervene or notice of intervention in a proceeding may make a written request to the filer for a copy of the complete CEII version of the document without following the procedures outlined in paragraph (g)(5) of this section. The request must include an executed copy of the applicable protective agreement and a statement of the person's right to party or participant status or a copy of the person's motion to intervene or notice of intervention. Any person may file an objection to the proposed form of protective agreement. A filer, or any other person, may file an objection to disclosure, generally or to a particular person or persons who have sought intervention. (5) If any requester not described above in paragraph (g)(1)-(4) of this section has a particular need for information designated as CEII, the requester may request the information using the following procedures: (i) File a signed, written request with the Commission's CEII Coordinator. The request must contain the following: (A) Requester's name (including any other name(s) which the requester has used and the dates the requester used such name(s)), title, address, and telephone number; the name, address, and telephone number of the person or entity on whose behalf the information is requested; (B) A detailed Statement of Need, which must state: The extent to which a particular function is dependent upon access to the information; why the function cannot be achieved or performed without access to the information; an explanation of whether other information is available to the requester that could facilitate the same objective; how long the information will be needed; whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and an explanation of whether the information is needed expeditiously. (C) An executed non-disclosure agreement as described in paragraph (h)(2) of this section; (D) A signed statement attesting to the accuracy of the information provided in the request; and (E) A requester shall provide his or her date and place of birth upon request, if it is determined by the CEII Coordinator that this information is necessary to process the request. (ii) A requester who seeks the information on behalf of all employees of an organization should clearly state that the information is sought for the organization, that the requester is authorized to seek the information on behalf of the organization, and that all individuals in the organization that have access to the CEII will agree to be bound by a non-disclosure agreement that must be executed. [[Page 43567]] (iii) After the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information. (iv) If the CEII Coordinator determines that the CEII requester has not demonstrated a valid or legitimate need for the CEII or that access to the CEII should be denied for other reasons, this determination may be appealed to the General Counsel pursuant to section 388.110 of this Chapter. The General Counsel will decide whether the information is properly classified as CEII, which by definition is exempt from release under FOIA, and whether the Commission should in its discretion make such CEII available to the CEII requester in view of the requester's asserted legitimacy and need. (v) Once a CEII requester has been verified by Commission staff as a legitimate requester who does not pose a security risk, his or her verification will be valid for the remainder of that calendar year. Such a requester is not required to provide detailed information about himself or herself with subsequent requests during the calendar year. He or she is also not required to file a non-disclosure agreement with subsequent requests during the calendar year because the original non- disclosure agreement will apply to all subsequent releases of CEII. (vi) An organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section may seek to add additional individuals to the non-disclosure agreement within one (1) year of the date of the initial CEII request. Such an organization must provide the names of the added individuals to the CEII Coordinator and certify that notice of each added individual has been given to the submitter. Any newly added individuals must execute a supplement to the original non- disclosure agreement indicating their acceptance of its terms. If there is no written opposition within five (5) days of notifying the CEII Coordinator and the submitter concerning the addition of any newly added individuals, the CEII Coordinator will issue a standard notice accepting the addition of these names to the non-disclosure agreement. If the submitter files a timely opposition with the CEII Coordinator, the CEII Coordinator will issue a formal determination addressing the merits of such opposition. If an organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section wants to add new individuals to its non-disclosure agreement more than one year after the date of its initial CEII request, the organization must submit a new CEII request pursuant to paragraph (g)(5)(ii) of this section and a new non-disclosure agreement for each new individual added. (vii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the FOIA in section 18 CFR 388.108(c). (viii) Fees for processing CEII requests will be determined in accordance with section 18 CFR 388.109. (ix) Nothing in this section should be construed as requiring the release of proprietary information, personally identifiable information, cultural resource information and other comparable data protected by statute or any privileged information, including information protected by the deliberative process. (h) Duty to protect CEII. Unauthorized disclosure of CEII is prohibited. (1) To ensure that the Commissioners, Commission employees, and Commission contractors protect CEII from unauthorized disclosure, internal controls will describe the handling, marking, and security controls for CEII. (2) Any individual who requests information pursuant to paragraph (g)(5) of this section must sign and execute a non-disclosure agreement, which indicates the individual's willingness to adhere to limitations on the use and disclosure of the information requested. The non-disclosure agreement will, at a minimum, require the following: CEII will only be used for the purpose for which it was requested; CEII may only be discussed with authorized recipients; CEII must be kept in a secure place in a manner that would prevent unauthorized access; CEII must be destroyed or returned to the Commission upon request; and the Commission may audit the Recipient's compliance with the non-disclosure agreement. (i) Sanctions. Any officers, employees, or agents of the Commission who knowingly and willfully disclose CEII in a manner that is not authorized under this section will be subject to appropriate sanctions, such as removal from the federal service, or possible referral for criminal prosecution. Commissioners who knowingly and willfully disclose CEII without authorization may be referred to the Department of Energy Inspector General. The Commission will take responsibility for investigating and, as necessary, imposing sanctions on its employees and agents. [FR Doc. 2016-14761 Filed 7-1-16; 8:45 am] BILLING CODE 6717-01-P
![Federal Register / Vol. 81, No. 128 / Tuesday, July 5, 2016 / Proposed Rules 43557
DEPARTMENT OF ENERGY SUPPLEMENTARY INFORMATION: the FAST Act as well as improve the
overall efficiency of the CEII process for
Federal Energy Regulatory I. Introduction
information that is submitted to or is
Commission 1. On December 4, 2015, the President generated by the Commission.
signed into law the Fixing America’s
Surface Transportation (FAST) Act.1 II. Background
18 CFR Parts 375 and 388
The FAST Act, inter alia, added section 3. Shortly after the terrorist attacks on
[Docket No. RM16–15–000]
215A to the Federal Power Act (FPA) to September 11, 2001, the Commission
Regulations Implementing FAST Act improve the security and resilience of took steps to protect information that it
Section 61003—Critical Electric energy infrastructure in the face of considered Critical Energy
Infrastructure Security and Amending emergencies.2 The FAST Act directs the Infrastructure Information.3 As a
Critical Energy Infrastructure Commission to issue regulations aimed preliminary step, the Commission
Information at securing and sharing sensitive removed from its public files and
infrastructure information. Specifically, eLibrary document retrieval system
AGENCY: Federal Energy Regulatory FPA section 215A(d)(2) (Designation documents that were likely to contain
Commission. and Sharing of Critical Electric detailed specifications of facilities, and
ACTION: Notice of proposed rulemaking. Infrastructure Information) requires the directed the public to use the Freedom
Commission to ‘‘promulgate such of Information Act (FOIA) request
SUMMARY: The Federal Energy regulations as necessary to’’: process to obtain such information.4 In
Regulatory Commission (Commission) (A) establish criteria and procedures 2003, the Commission established its
proposes to amend the Commission’s to designate information as critical Critical Energy Infrastructure
regulations to implement provisions of electric infrastructure information; Information procedures for entities
the Fixing America’s Surface (B) prohibit the unauthorized outside of the Commission to obtain
Transportation Act that pertain to the disclosure of critical electric access to Critical Energy Infrastructure
designation, protection and sharing of infrastructure information; Information, stating that such
Critical Electric Infrastructure (C) ensure there are appropriate information would typically be exempt
Information. Separately, the sanctions in place for Commissioners, from disclosure pursuant to FOIA.5 In
Commission proposes to amend its officers, employees, or agents of the particular, the Commission determined
regulations that pertain to Critical Commission or the Department of that it was important to have a process
Energy Infrastructure Information. Energy [DOE] who knowingly and for individuals with a valid or legitimate
DATES: Comments are due August 19, willfully disclose critical electric need to access certain sensitive energy
2016. infrastructure information in a manner infrastructure information.
that is not authorized under this section; 4. The Commission last revised its
ADDRESSES: Comments, identified by Critical Energy Infrastructure
docket number, may be filed in the and
(D) taking into account standards of Information rules over eight years ago.6
following ways: However, the Commission indicated
• Electronic Filing through http:// the Electric Reliability Organization,
facilitate voluntary sharing of critical that it will revise the Critical Energy
www.ferc.gov. Documents created Infrastructure Information rules based
electronically using word processing electric infrastructure information with,
between, and by—(i) Federal, State, on a continuing review of its application
software should be filed in native and effectiveness.7
applications or print-to-PDF format and political subdivision, and tribal
5. Over 7,000 documents are
not in a scanned format. authorities; (ii) the Electric Reliability
submitted to the Commission’s eLibrary
• Mail/Hand Delivery: Those unable Organization; (iii) regional entities; (iv)
to file electronically may mail or hand- information sharing and analysis centers 3 See Statement of Policy on Treatment of
deliver comments to: Federal Energy established pursuant to Presidential Previously Public Documents, 66 FR 52,917 (Oct.
Regulatory Commission, Secretary of the Decision Directive 63; (v) owners, 18, 2001), 97 FERC ¶ 61,030 (2001). A large
operators, and users of critical electric component of what is currently Critical Energy
Commission, 888 First Street NE., Infrastructure Information was previously publicly
Washington, DC 20426. infrastructure in the United States; and available prior to September 11, 2001.
Instructions: For detailed instructions (vi) other entities determined 4 The FOIA process is specified in 5 U.S.C. 552
on submitting comments and additional appropriate by the Commission. and the Commission’s regulations at 18 CFR
information on the rulemaking process, 2. The Commission proposes to revise 388.108.
5 Critical Energy Infrastructure Information, Order
see the Comment Procedures Section of 18 CFR 375.313, 388.112, and 388.113
No. 630, 68 FR 9,857 (Mar. 3, 2003), FERC Stats.
this document. of the Commission’s regulations to & Regs. ¶ 31,140 (2003), order on reh’g, Order No.
implement the requirements identified 630–A, 68 FR 46,456 (Aug. 6, 2003), FERC Stats. &
FOR FURTHER INFORMATION CONTACT:
in section 215A(d)(2) of the FPA, as well Regs. ¶ 31,147 (2003).
Nneka Frye, Office of the General 6 See Critical Energy Infrastructure Information,
as other provisions included in the
Counsel, Federal Energy Regulatory Order No. 702, 72 FR 63,980 (Nov. 14, 2007), FERC
FAST Act. The Commission also
Commission, 888 First Street NE., Stats. & Regs. ¶ 31,258 (2007).
proposes modifications to its existing 7 For example, in 2014, the Department of Energy
Washington, DC 20426, (202) 502–6029,
Critical Energy Infrastructure Inspector General initiated a review of the
Nneka.frye@ferc.gov.
Information process, in part, to comply Commission’s controls for protecting non-public
Marcos Araus, Office of the General information. In a report dated January 30, 2015, the
with the FAST Act. The amended
Counsel, Federal Energy Regulatory DOE Inspector General recommended, among other
sradovich on DSK3GDR082PROD with PROPOSALS
process will be referred to as the Critical things, that the Commission take steps to ensure
Commission, 888 First Street NE.,
Energy/Electric Infrastructure that the Critical Energy Infrastructure Information
Washington, DC 20426, (202) 502–8472, processes to protect and control non-public
Information (CEII) process. Thus, these
marcos.araus@ferc.gov. information are current and that such policies are
changes are intended to comply with
Mark Hershfield, Office of the General disseminated and properly implemented. DOE
Counsel, Federal Energy Regulatory Inspector General, Inspection Report: Review of
1 See Fixing America’s Surface Transportation,
Controls for Protecting Nonpublic Information at
Commission, 888 First Street NE., Public Law 114–94, 129 Stat. 1312 (2015) (to be the Federal Energy Regulatory Commission (Jan.
Washington, DC 20426, (202) 502–8597, codified at 16 U.S.C. 824 et seq.) (FAST Act). 2015), http://energy.gov/sites/prod/files/2015/02/
mark.hershfield@ferc.gov. 2 Id. 61,003. f19/DOE-IG-0933.pdf (DOE IG Report).
VerDate Sep<11>2014 17:18 Jul 01, 2016 Jkt 238001 PO 00000 Frm 00028 Fmt 4702 Sfmt 4702 E:\FR\FM\05JYP1.SGM 05JYP1](https://thefederalregister.org/doc/81_FR_43685/page/1.svg)
![43558 Federal Register / Vol. 81, No. 128 / Tuesday, July 5, 2016 / Proposed Rules
system as Critical Energy Infrastructure distribution of sensitive infrastructure 12. Accordingly, the Commission
Information each year. The vast majority information to those individuals with a proposes to revise section 388.113(c)
of submissions and Commission- need to know in order to avoid having (Definitions) of the Commission’s
generated information relates to sensitive information fall into the hands regulations to add the new statutory
hydroelectric projects but also includes of those who may use it to attack the term Critical Electric Infrastructure
information regarding natural gas nation’s infrastructure. Section Information, as referenced above. The
pipeline and electric infrastructure. 388.113(c) of the Commission’s Commission also proposes to add to the
6. The Commission receives regulations defines Critical Energy regulations the term Critical Electric
approximately 200 requests for Critical Infrastructure Information as: Infrastructure, which is defined in FPA
Energy Infrastructure Information a specific engineering, vulnerability, or section 215A(a)(3) as ‘‘a system or asset
year. Requests are typically submitted detailed design information about proposed of the bulk-power system, whether
by public utilities, gas pipelines, or existing critical infrastructure that: physical or virtual, the incapacity or
Liquefied Natural Gas (LNG) facilities, (i) Relates details about the production, destruction of which would negatively
hydroelectric developers, academics, generation, transportation, transmission, or affect national security, economic
landowners, public interest groups, distribution of energy; security, public health or safety, or any
researchers, renewable energy (ii) Could be useful to a person in planning combination of such matters.’’
organizations, consultants, and Federal an attack on critical infrastructure; 13. The Commission proposes to refer
(iii) Is exempt from mandatory disclosure to the information under the new
agencies. under the Freedom of Information Act, 5
7. The Commission’s current Critical regulations as Critical Energy/Electric
U.S.C. 552; and
Energy Infrastructure Information rules Infrastructure Information, and to use
(iv) Does not simply give the general location
provide a means for entities to obtain of the critical infrastructure. the abbreviation ‘‘CEII’’ for this term.8
Critical Energy Infrastructure By referring to the information only as
10. To augment the current Critical Critical Electric Infrastructure
Information while ensuring that it is
Energy Infrastructure Information Information, the public, especially those
handled in an appropriate and secure
process to comply with FPA section that do not interact with the
manner. The new requirements in
215A(d), the Commission proposes that Commission on a regular basis, may
section 215A(d) also ensure that Critical
the scope and purpose of its regulations assume that the revised CEII regulations
Electric Infrastructure Information,
be changed to reflect the requirements only cover information regarding
which as described below includes
of the FAST Act. Specifically, the electric infrastructure and not also
Critical Energy Infrastructure
Commission proposes to amend section information about other energy
Information, can be appropriately
388.113(a) to indicate that the section infrastructure. By using the term Critical
shared while also being adequately
governs the procedures for submitting, Energy/Electric Infrastructure
protected. Thus, the Commission
designating, handling, sharing, and Information, the Commission clearly
proposes to augment its existing Critical
disseminating CEII submitted to or conveys to the public that the
Energy Infrastructure Information
generated by the Commission. Commission’s revised CEII procedures
process to comply with section
Moreover, the Commission proposes to cover more than just electric
215A(d)(2) and to make other changes
amend section 388.113(b) to indicate infrastructure.
described in this NOPR. The
that the purpose of section 388.113 is to 14. The Commission complies with
Commission proposes to have a single
provide an overview of the section 215A(d) by incorporating the
process that would address submitting,
Commission’s CEII procedures. term Critical Electric Infrastructure
designating, handling, sharing, and 11. Section 215A(a)(3) of the FPA Information into its regulations as set
disseminating CEII that is submitted to introduces the new term ‘‘Critical forth in the statute and treating it as
or generated by the Commission. The Electric Infrastructure Information:’’ Congress intended. In addition,
proposed regulations will govern how
information related to critical electric subsuming Critical Energy Infrastructure
the Commission and its employees
infrastructure, or proposed critical electrical Information into the term Critical
implement the provisions of the FAST
infrastructure, generated by or provided to Electric Infrastructure Information will
Act. the Commission or other Federal agency, allow the Commission to have a unitary
III. Revisions To Implement the FAST other than classified national security process for handling CEII and, thereby,
Act information . . . Such term includes avoid any confusion that could result
information that qualifies as critical energy from multiple processes for different
A. Relocating References to CEII From infrastructure information under the types of critical infrastructure
Section 388.112 to Section 388.113 Commission’s regulations.
information. Avoiding such confusion
8. The Commission proposes to As indicated above, the Commission’s should better facilitate sharing of CEII as
transfer provisions contained in section current procedures for Critical Energy well as help prevent unauthorized
388.112 that are applicable to Critical Infrastructure Information apply to disclosures of CEII, which we see as the
Energy Infrastructure Information to information ‘‘about the production, principal goals of section 215A(d).
amended section 388.113. This transfer generation, transportation, transmission, 15. Section 215A(d)(1)(A) of the FPA
would include notice and filing or distribution of energy.’’ Thus, the states that Critical Electric Infrastructure
requirements. As a result of this change, FAST Act defines ‘‘Critical Electric Information ‘‘shall be exempt from
amended section 388.112 would apply Infrastructure Information’’ to include disclosure under [(FOIA)] section
only to information designated as not only information regarding the Bulk- 552(b)(3).’’ 9 Accordingly, the
sradovich on DSK3GDR082PROD with PROPOSALS
privileged and all of the Commission’s Power System but also information Commission proposes to amend its
CEII procedures will be in section regarding other energy infrastructure regulations to specify that CEII is
388.113. (i.e., gas pipelines, LNG, oil, and
hydroelectric infrastructure) to the 8 The abbreviation will be used except where
B. Scope, Purpose, and Definitions extent such information qualifies as appropriate to address any distinction between the
Commission’s current regulations and the terms of
9. The Commission’s current Critical Critical Energy Infrastructure the FAST Act.
Energy Infrastructure Information Information under the Commission’s 9 See 5 U.S.C. 552(b)(3) (protects information
process is designed to limit the current regulations. ‘‘specifically exempted from disclosure by statute’’).
VerDate Sep<11>2014 17:18 Jul 01, 2016 Jkt 238001 PO 00000 Frm 00029 Fmt 4702 Sfmt 4702 E:\FR\FM\05JYP1.SGM 05JYP1](https://thefederalregister.org/doc/81_FR_43685/page/2.svg)
![43560 Federal Register / Vol. 81, No. 128 / Tuesday, July 5, 2016 / Proposed Rules
designated as critical electric requirements will enable the This requirement applies to
infrastructure information for longer Commission to comply with section Commission employees as well as to all
than 5 years, unless specifically re- 215A(d)(10) and determine whether individuals to whom the Commission
designated by the Commission or the information must be ‘‘specifically re- provides CEII. Thus, the Commission
Secretary, as appropriate.’’ The designated’’ as CEII. proposes to make the following changes
Commission proposes to add this 27. Section 215A(d)(10) of the FPA to its regulations in proposed section
statement to proposed section provides that when ‘‘the Commission or 388.113(h) to ensure CEII is adequately
388.113(e). the [DOE] Secretary, as appropriate, protected.
24. The Commission plans to use the determines that the unauthorized
disclosure of such information could no 1. Internal Controls for Commission
following process to implement the
longer be used to impair the security or Employees
duration of designation provision. At
the present time there are almost reliability of the bulk-power system or 30. To ensure that Commission
200,000 documents labeled as Critical distribution facilities’’ the designation employees appropriately handle CEII,
Energy Infrastructure Information in the shall be removed. The Commission Commission staff is developing an
Commission’s eLibrary system. The proposes to revise section 388.113(e) of information governance policy and
Commission does not plan to move the Commission’s regulations to provide guidelines, which is intended to address
designated information from its non- for removal of the CEII designation how sensitive information, including
public files to its public files after the when it no longer could impair the CEII, should be handled, marked, and
designation period has passed (i.e., up security or reliability of not only the kept secure.20 Consistent with these
to five years from date of designation), Bulk-Power System and distribution guidelines, the Commission proposes to
unless the Commission determines in a facilities but also other forms of energy add a provision in proposed section
particular instance that it is appropriate infrastructure. The Commission will 388.113(h) that would require the
to do so. The passing of the CEII provide notice to the submitter in the Commissioners, Commission staff, and
designation period would not instance where the Commission takes Commission contractors to comply with
necessarily render designated the affirmative step to rescind the the Commission’s internal controls. The
information suitable for inclusion in the designation. internal controls will address how the
Commission’s public files. The 5. Judicial Review of Designation Commission and its personnel,
Commission plans to determine whether including contractors and agents,
28. Section 215A(d)(11) of the FPA handle CEII.
information should be re-designated or
provides that:
alternatively placed in the 2. Controls for Recipients of CEII
Commission’s public files when an any determination by the Commission or the
entity requests the information, when [DOE] Secretary concerning the designation 31. Currently, section 388.113(d)
of critical electric infrastructure information requires external recipients of Critical
staff determines a need to remove the . . . shall be subject to review . . . in the
designation, or when a submitter Energy Infrastructure Information to
district court of the United States in the
requests that information no longer be sign an NDA, which imposes conditions
district in which the complainant resides, or
treated as CEII.18 has his principal place of business, or in the on how the information may be used.21
25. The proposed approach is District of Columbia. The current regulation does not specify
consistent with the FAST Act. Section the minimum required content of an
The Commission proposes to
215A(d)(9) of the FPA does not require NDA.
incorporate this provision into proposed 32. The Commission proposes to
automatic public disclosure of CEII at section 388.113(e) of its regulations. In
the end of the initial CEII designation strengthen the NDA requirements for all
addition, the Commission proposes to the different forms of NDAs the
period. Indeed, the FAST Act require an entity or individual that
contemplates that there may be Commission uses to share CEII.22
intends to challenge a Commission
information that warrants continued Including these provisions in each type
designation determination in federal
protection after the initial designation of NDA form that the Commission uses
district court to first appeal the decision
period. Given the volume of CEII in the will better protect CEII from
to the Commission’s General Counsel.
Commission’s files and the expectation unauthorized disclosure. Specifically,
We believe that requiring an
that the Commission will continue to the Commission proposes revising its
administrative appeal prior to seeking
receive a substantial amount of CEII regulations to state in section
judicial review is appropriate because it
each year, this proposed approach 388.113(h)(2) that an NDA must
would ensure consistency in how the
strikes a reasonable balance in meeting minimally require that CEII: (1) Will
Commission addresses CEII
the designation requirements of the determinations, and is consistent with only be used for the purpose it was
FAST Act. the current practice for responding to requested; (2) may only be discussed
26. Consistent with the above CEII and FOIA requests.19 with authorized recipients; (3) must be
practice, the Commission proposes that kept in a secure place in a manner that
the non-disclosure agreement (NDA) D. Duty To Protect CEII would prevent unauthorized access; (4)
will require any recipient of CEII from 29. Whether CEII is created by
20 The DOE IG Report raised concerns with how
the Commission to continue to protect Commission staff or submitted to the
Commission staff handled, labeled, and tracked
the information past the expiration of Commission by an outside party or a Critical Energy Infrastructure Information. DOE IG
the CEII designation marked on the member of the public, section Report at 2–5, 12.
sradovich on DSK3GDR082PROD with PROPOSALS
information. Further, the recipient must 215A(d)(2)(B) of the FPA requires the 21 See, e.g., General Non-Disclosure Agreement,
receive prior authorization from the Commission to ‘‘prohibit the http://www.ferc.gov/legal/ceii-foia/ceii/gen-
nda.pdf.
Commission before making any unauthorized disclosure of critical 22 Separate NDAs exist for general users, the
disclosure of such information. These electric infrastructure information.’’ media, state agencies, and consultants, and are
available at http://www.ferc.gov/legal/ceii-foia/
18 In the event the Commission re-designates 19 Such a determination is subject to review by an ceii.asp. Federal Agency requesters, as noted below,
information as CEII, the Commission will re- applicable district court and would not be an order receive an Agency Acknowledgment and
designate the information as CEII for another five subject to rehearing and review under 16 U.S.C. Agreement, which has different terms than the
years or a shorter time period, as appropriate. 825l. NDAs.
VerDate Sep<11>2014 17:18 Jul 01, 2016 Jkt 238001 PO 00000 Frm 00031 Fmt 4702 Sfmt 4702 E:\FR\FM\05JYP1.SGM 05JYP1](https://thefederalregister.org/doc/81_FR_43685/page/4.svg)
![Federal Register / Vol. 81, No. 128 / Tuesday, July 5, 2016 / Proposed Rules 43561
must be destroyed or returned to the Commission may initiate an adverse or his designee making a determination
Commission upon request; and (5) that personnel action, such as a suspension to voluntarily share CEII. The
the Commission may audit compliance or a removal action, against a Coordinator will determine whether the
with the NDA. These changes would Commission employee who makes an information has been appropriately
codify and strengthen current NDA unauthorized disclosure of CEII or any designated as CEII and whether
terms consistent with FPA section other non-public information.25 While appropriate protective measures are in
215A(d). the Commission may not sanction the place to secure its transfer and treatment
33. Moreover, another means to Chairman or Commissioners,26 it can by the recipient.
prevent unauthorized disclosure of CEII refer any misconduct by the Chairman 40. When the Commission voluntarily
is to ensure that the CEII is only shared or Commissioners to the DOE Inspector shares information, the CEII will be
with those who need it. The General.
shared subject to an appropriate NDA or
Commission, therefore, proposes to Acknowledgement and Agreement.28
F. Voluntary Sharing of CEII
amend section 388.113(g)(5) to require a
37. Section 215A(d)(2)(D) of the FPA Thus, the Commission proposes to add
person seeking CEII to demonstrate a
requires that the Commission: language to its regulations in proposed
legitimate need for the information.
section 388.113(f) to make clear that,
Thus, the Commission proposes to taking into account standards of the Electric
after a determination by the
require a requestor to demonstrate: (1) Reliability Organization, facilitate voluntary
sharing of critical electric infrastructure Coordinator, the Office Director will
The extent to which a particular
information with, between, and by—(i) provide the proposed recipients of the
function is dependent upon access to
Federal, State, political subdivision, and CEII with the appropriate NDA or
the information; (2) why the function
tribal authorities; (ii) the Electric Reliability Agency Acknowledgement and
cannot be achieved or performed Organization; (iii) regional entities; (iv) Agreement for execution and return.
without access to the information; (3) information sharing and analysis centers The Commission proposes to amend its
whether other information is available established pursuant to Presidential Decision regulations to require a signed copy of
to the requester that could facilitate the Directive 63; (v) owners, operators, and users
of critical electric infrastructure in the United each agreement be maintained by the
same objective; (4) how long the
States; and (vi) other entities determined Office Director with a copy to the
information will be needed; (5) whether
appropriate by the Commission. Coordinator.
or not the information is needed to
participate in a specific proceeding Under this provision, the Commission 41. The Commission proposes to add
(with that proceeding identified); and has authority to share CEII with to section 388.113(f) of its regulations a
(6) whether the information is needed individuals and organizations that the statement indicating that the
expeditiously. This information will Commission has determined need the Commission may impose additional
assist the Commission’s CEII information to ensure that energy restrictions on how the CEII the
Coordinator in ‘‘balance[ing] the infrastructure is protected.27 Voluntary Commission voluntarily shares may be
requestor’s need for the information sharing applies to both Commission- used and maintained. Given that the
against the sensitivity of the generated CEII and CEII submitted to the Commission anticipates that it will
information.’’ 23 A conclusory statement Commission. voluntarily share CEII when the
will not satisfy this requirement. 38. Under this provision, the Commission believes that the recipients
34. Finally, to ensure that CEII is only Commission may share CEII without need the information to protect critical
disclosed to appropriate individuals, the first receiving a request for the CEII. infrastructure, the recipients may
Commission proposes to amend section Section 388.112(c)(i) already provides otherwise have no other legitimate need
388.113(g)(5)(i)(D) to require the the Commission with ‘‘the discretion to for the information but to address that
requestor to include a signed statement release information as necessary to carry event. Thus, it is appropriate to impose
attesting to the accuracy of the out its jurisdictional responsibilities.’’ additional conditions on use and
information provided in any request for The Commission proposes to move this handling of CEII that the Commission
CEII submitted to the Commission. language to section 388.113(f)(2) in the voluntarily shares.
regulations and also note that the 42. Where practicable, when the
E. Sanctions Commission retains the discretion to Commission is considering voluntarily
35. Section 215A(d)(2)(C) of the FPA release information as necessary for sharing CEII, the Commission will
requires the Commission to ‘‘ensure other federal agencies to carry out their provide notice to the submitter of that
there are appropriate sanctions in place jurisdictional responsibilities. information. However, it may not be
for Commissioners, officers, employees, 39. The Commission also proposes to practicable for the Commission to
or agents of the Commission or the add section 388.113(f)(1) to its provide notice to the submitter in
Department of Energy who knowingly regulations to require an Office Director instances where voluntary sharing is
and willfully disclose critical electric or his designee to consult with the necessary to maintain infrastructure
infrastructure information in a manner Coordinator prior to the Office Director security, to address a potential threat, or
that is not authorized under this in other exigent circumstances. In such
section.’’ The Commission proposes to agents with regard to information in DOE’s
instances, a requirement to give notice
add proposed section 388.113(i) to possession.
25 See, e.g., 5 U.S.C. Chapter 75 (Adverse to the submitter may be detrimental to
implement this requirement. Actions). the ability of the Commission to timely
36. The Commission proposes that it 26 The Chairman and Commissioners are share CEII with entities that may
sradovich on DSK3GDR082PROD with PROPOSALS
take responsibility for addressing appointed by the President and may be removed by urgently need the information and could
unauthorized disclosures of CEII in the the President only for inefficiency, neglect of duty,
compromise law enforcement
Commission’s possession by or malfeasance in office. 42 U.S.C. 7171.
27 Section 215A(d)(6) of the FPA makes clear that
Commission personnel.24 The nothing in the FAST Act ‘‘require[s] a person or 28 As noted below, to obtain CEII Federal
entity in possession of critical electric infrastructure Agencies execute an Acknowledgement and
23 See18 CFR 388.113(d)(4)(iii) and (iv). information to share such information’’ with other Agreement, as opposed to an NDA. See Federal
24 The Commission anticipates that DOE will take individuals and entities; see also Cybersecurity Agency Acknowledgement and Agreement, http://
responsibility for sanctions for unauthorized Information Sharing Act of 2015, Public Law 114– www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-
disclosures by its officers, employees, staff, and 113, 129 Stat. 2936 (2015). agree.pdf.
VerDate Sep<11>2014 17:18 Jul 01, 2016 Jkt 238001 PO 00000 Frm 00032 Fmt 4702 Sfmt 4702 E:\FR\FM\05JYP1.SGM 05JYP1](https://thefederalregister.org/doc/81_FR_43685/page/5.svg)
![Federal Register / Vol. 81, No. 128 / Tuesday, July 5, 2016 / Proposed Rules 43567
(iii) After the request is received, the issue a formal determination addressing Department of Energy Inspector General.
CEII Coordinator will determine if the the merits of such opposition. If an The Commission will take responsibility
information is CEII, and, if it is, whether organization that is granted access to for investigating and, as necessary,
to release the CEII to the requester. The CEII pursuant to paragraph (g)(5)(ii) of imposing sanctions on its employees
CEII Coordinator will balance the this section wants to add new and agents.
requester’s need for the information individuals to its non-disclosure [FR Doc. 2016–14761 Filed 7–1–16; 8:45 am]
against the sensitivity of the agreement more than one year after the BILLING CODE 6717–01–P
information. If the requester is date of its initial CEII request, the
determined to be eligible to receive the organization must submit a new CEII
information requested, the CEII request pursuant to paragraph (g)(5)(ii)
of this section and a new non-disclosure DEPARTMENT OF THE TREASURY
Coordinator will determine what
conditions, if any, to place on release of agreement for each new individual Internal Revenue Service
the information. added.
(iv) If the CEII Coordinator determines (vii) The CEII Coordinator will
26 CFR Part 1
that the CEII requester has not attempt to respond to the requester
demonstrated a valid or legitimate need under this section according to the [REG–133673–15]
for the CEII or that access to the CEII timing required for responses under the
RIN 1545–BN07
should be denied for other reasons, this FOIA in section 18 CFR 388.108(c).
determination may be appealed to the (viii) Fees for processing CEII requests Deemed Distributions Under Section
General Counsel pursuant to section will be determined in accordance with 305(c) of Stock and Rights To Acquire
388.110 of this Chapter. The General section 18 CFR 388.109. Stock; Correction
Counsel will decide whether the (ix) Nothing in this section should be
information is properly classified as construed as requiring the release of AGENCY: Internal Revenue Service (IRS),
CEII, which by definition is exempt proprietary information, personally Treasury.
from release under FOIA, and whether identifiable information, cultural ACTION: Correction to notice of proposed
the Commission should in its discretion resource information and other rulemaking.
make such CEII available to the CEII comparable data protected by statute or
requester in view of the requester’s any privileged information, including SUMMARY: This document contains
asserted legitimacy and need. information protected by the corrections to a notice of proposed
(v) Once a CEII requester has been deliberative process. rulemaking (REG–133673–15) that were
verified by Commission staff as a (h) Duty to protect CEII. Unauthorized published in the Federal Register on
legitimate requester who does not pose disclosure of CEII is prohibited. April 13, 2016 (81 FR 21795). The
a security risk, his or her verification (1) To ensure that the Commissioners, proposed regulations are in regards to
will be valid for the remainder of that Commission employees, and deemed distributions of stock and rights
calendar year. Such a requester is not Commission contractors protect CEII to acquire stock. The proposed
required to provide detailed information from unauthorized disclosure, internal regulations would resolve ambiguities
about himself or herself with controls will describe the handling, concerning the amount and timing of
subsequent requests during the calendar marking, and security controls for CEII. deemed distributions that are or result
year. He or she is also not required to (2) Any individual who requests from adjustments to rights to acquire
file a non-disclosure agreement with information pursuant to paragraph (g)(5) stock.
subsequent requests during the calendar of this section must sign and execute a
year because the original non-disclosure non-disclosure agreement, which DATES: Written or electronic comments
agreement will apply to all subsequent indicates the individual’s willingness to and requests for a public hearing for the
releases of CEII. adhere to limitations on the use and notice of proposed rulemaking
(vi) An organization that is granted disclosure of the information requested. published at 81 FR 21795, April 13,
access to CEII pursuant to paragraph The non-disclosure agreement will, at a 2016 are still being accepted and must
(g)(5)(ii) of this section may seek to add minimum, require the following: CEII be received by July 12, 2016.
additional individuals to the non- will only be used for the purpose for FOR FURTHER INFORMATION CONTACT:
disclosure agreement within one (1) which it was requested; CEII may only Maurice M. LaBrie at (202) 317–5322;
year of the date of the initial CEII be discussed with authorized recipients; concerning the proposed regulations
request. Such an organization must CEII must be kept in a secure place in under sections 860G, 861, 1441, 1461,
provide the names of the added a manner that would prevent 1471, and 1473, Subin Seth, (202) 317–
individuals to the CEII Coordinator and unauthorized access; CEII must be 6942; concerning the proposed
certify that notice of each added destroyed or returned to the regulations under section 6045B,
individual has been given to the Commission upon request; and the Pamela Lew, (202) 317–7053;
submitter. Any newly added individuals Commission may audit the Recipient’s concerning submission of comments,
must execute a supplement to the compliance with the non-disclosure contact Regina Johnson, (202) 317–6901
original non-disclosure agreement agreement. (not toll-free numbers).
indicating their acceptance of its terms. (i) Sanctions. Any officers, employees, SUPPLEMENTARY INFORMATION:
If there is no written opposition within or agents of the Commission who
five (5) days of notifying the CEII knowingly and willfully disclose CEII in Background
sradovich on DSK3GDR082PROD with PROPOSALS
Coordinator and the submitter a manner that is not authorized under The notice of proposed rulemaking
concerning the addition of any newly this section will be subject to (REG–133673–15) that is subject of this
added individuals, the CEII Coordinator appropriate sanctions, such as removal correction is under sections 305 and
will issue a standard notice accepting from the federal service, or possible 1473 of the Internal Revenue Code.
the addition of these names to the non- referral for criminal prosecution.
disclosure agreement. If the submitter Commissioners who knowingly and Need for Correction
files a timely opposition with the CEII willfully disclose CEII without As published, the notice of proposed
Coordinator, the CEII Coordinator will authorization may be referred to the rulemaking (REG–133673–15) contains
VerDate Sep<11>2014 17:18 Jul 01, 2016 Jkt 238001 PO 00000 Frm 00038 Fmt 4702 Sfmt 4702 E:\FR\FM\05JYP1.SGM 05JYP1](https://thefederalregister.org/doc/81_FR_43685/page/11.svg)
Document Created: 2016-07-01 23:49:47
Document Modified: 2016-07-01 23:49:47
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Proposed Rules | |
| Action | Notice of proposed rulemaking. | |
| Dates | Comments are due August 19, 2016. | |
| Contact | Nneka Frye, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029, [email protected] | |
| FR Citation | 81 FR 43557 | |
| CFR Citation | 18
CFR
375 18 CFR 388 | |
| CFR Associated | Authority Delegations (government Agencies); Seals and Insignia; Sunshine Act and Confidential Business Information; Freedom of Information |
2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR