81 FR 93732 - Regulations Implementing FAST Act Section 61003-Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission
DEPARTMENT OF ENERGY
Federal Energy Regulatory Commission Federal Register Volume 81, Issue 245 (December 21, 2016)
Federal Energy Regulatory Commission
Federal Register Volume 81, Issue 245 (December 21, 2016)
| Page Range | 93732-93753 | |
| FR Document | 2016-28322 |
[Federal Register Volume 81, Number 245 (Wednesday, December 21, 2016)] [Rules and Regulations] [Pages 93732-93753] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2016-28322] [[Page 93731]] Vol. 81 Wednesday, No. 245 December 21, 2016 Part II Department of Energy ----------------------------------------------------------------------- Federal Energy Regulatory Commission ----------------------------------------------------------------------- 18 CFR Parts 375 and 388 Regulations Implementing FAST Act Section 61003--Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission; Final Rule Federal Register / Vol. 81 , No. 245 / Wednesday, December 21, 2016 / Rules and Regulations [[Page 93732]] ----------------------------------------------------------------------- DEPARTMENT OF ENERGY Federal Energy Regulatory Commission 18 CFR Parts 375 and 388 [Docket Nos. RM16-15-000 and RM15-25-001; Order No. 833] Regulations Implementing FAST Act Section 61003--Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission AGENCY: Federal Energy Regulatory Commission, Department of Energy. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: The Federal Energy Regulatory Commission (Commission) amends its regulations to implement provisions of the Fixing America's Surface Transportation Act that pertain to the designation, protection and sharing of Critical Electric Infrastructure Information. Additionally, the Commission amends its regulations addressing Critical Energy Infrastructure Information. DATES: This rule will become effective February 21, 2017. FOR FURTHER INFORMATION CONTACT: Nneka Frye, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029, [email protected]. Christopher MacFarlane, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6761, [email protected]. Mark Hershfield, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-8597, [email protected]. SUPPLEMENTARY INFORMATION: 1. The Commission amends 18 CFR 375.309, 375.313, 388.112 and 388.113 of its regulations to implement the requirements of the Fixing America's Surface Transportation (FAST) Act as set forth in section 215A(d)(2) of the Federal Power Act (FPA).\1\ The Commission also amends its existing Critical Energy Infrastructure Information procedures. These changes are intended to comply with the FAST Act as well as improve the overall efficiency of the Commission's procedures for certain infrastructure information that is submitted to, or generated by, the Commission. The amended procedures will be referred to as the Critical Energy/Electric Infrastructure Information (CEII) procedures. --------------------------------------------------------------------------- \1\ Fixing America's Surface Transportation Act, Public Law 114- 94, 61,003, 129 Stat. 1312, 1773-1779 (2015) (to be codified at 16 U.S.C. 824 et seq.) (FAST Act). --------------------------------------------------------------------------- I. Background A. Critical Energy Infrastructure Information Regulations 2. Shortly after September 11, 2001, the Commission took steps to protect information that it considered Critical Energy Infrastructure Information.\2\ As a preliminary step, the Commission removed documents from its public files and eLibrary database that were likely to contain detailed specifications about critical infrastructure. The Commission directed the public to use the Freedom of Information Act (FOIA) request process to obtain such information.\3\ Given that such information would typically be exempt from mandatory disclosure pursuant to FOIA, the Commission determined that it was important to have a process for individuals with a valid or legitimate need to access certain sensitive energy infrastructure information. Thus, in 2003, the Commission issued a final rule establishing Critical Energy Infrastructure Information regulations.\4\ --------------------------------------------------------------------------- \2\ See Statement of Policy on Treatment of Previously Public Documents, 97 FERC ] 61,030 (2001). \3\ 5 U.S.C. 552 as amended by the FOIA Improvement Act of 2016, Public Law 114-185, 130 Stat. 538 (2016); 18 CFR 388.108 (Requests for Commission records not available through the Public Reference Room (FOIA Requests)). \4\ Critical Energy Infrastructure Information, Order No. 630, FERC Stats. & Regs. ] 31,140, order on reh'g, Order No. 630-A, FERC Stats. & Regs. ] 31,147 (2003). --------------------------------------------------------------------------- 3. Each year, over 7,000 documents are submitted to the Commission's eLibrary system as Critical Energy Infrastructure Information. The Commission also receives approximately 200 requests for Critical Energy Infrastructure Information each year. Requests for Critical Energy Infrastructure Information are submitted by, among others, public utilities, gas pipelines, Liquefied Natural Gas (LNG) facilities, hydroelectric developers, academics, landowners, public interest groups, researchers, renewable energy organizations, consultants, and federal agencies. 4. The Commission's current Critical Energy Infrastructure Information process is designed to limit the distribution of sensitive infrastructure information to those individuals with a need to know in order to avoid having sensitive information fall into the hands of those who may use it to attack the Nation's infrastructure. B. FAST Act 5. On December 4, 2015, the President signed the FAST Act into law. The FAST Act, inter alia, added section 215A to the Federal Power Act to improve the security and resilience of energy infrastructure in the face of emergencies. The FAST Act directs the Commission to issue regulations aimed at securing and sharing sensitive infrastructure information. Specifically, FPA section 215A(d)(2) (Designation and Sharing of Critical Electric Infrastructure Information) requires the Commission to promulgate regulations on the following. First, the statute requires the Commission to establish criteria and procedures to designate information as critical electric infrastructure information. Second, the statute requires the Commission to prohibit the unauthorized disclosure of critical electric infrastructure information. Third, the statute requires the Commission to ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy [DOE] who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized by the statute. Fourth, FPA section 215A(d)(2)(D) requires the Commission, taking into account standards of the Electric Reliability Organization, to facilitate voluntary sharing of critical electric infrastructure information. The statute, specifically, directs the Commission to facilitate voluntary sharing with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission.\5\ --------------------------------------------------------------------------- \5\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. --------------------------------------------------------------------------- C. Notice of Proposed Rulemaking 6. On June 16, 2016, the Commission issued a Notice of Proposed Rulemaking (NOPR) to amend its regulations to implement the provisions of the FAST Act pertaining to the designation, protection and sharing of CEII.\6\ The [[Page 93733]] proposed amendments included, among other things, the creation of criteria and procedures for designating information as CEII; a specific prohibition on unauthorized disclosure of that information; sanctions for knowing and willful wrongful disclosure of CEII by certain federal personnel; a process for voluntary sharing of CEII; and changes to the existing process for requesting CEII. In response to the NOPR, nineteen entities filed comments and two entities filed reply comments. The Appendix to this Final Rule lists the entities that submitted comments in response to the NOPR. --------------------------------------------------------------------------- \6\ Regulations Implementing FAST Act Section 61003--Critical Infrastructure Security and Amending Critical Energy Information, 81 FR 43,557 (July 5, 2016), 155 FERC ] 61,278 (2016) (NOPR). --------------------------------------------------------------------------- II. Discussion 7. The Commission adopts the majority of amendments proposed in the NOPR. The Commission determines that the amendments comply with the requirements of the FAST Act and better ensure the secure treatment of CEII. In addition, as discussed below, the Commission modifies or otherwise clarifies certain proposals made in the NOPR based on our review of the comments. In the discussion below, we address the following issues regarding the CEII amendments: (A) Scope, purpose, and definitions; (B) criteria and procedures for determining what constitutes CEII; (C) duty to protect CEII; (D) sanctions for unauthorized disclosure of CEII; (E) voluntary sharing of CEII; and (F) requests for access to CEII. A. Scope, Purpose, and Definitions NOPR 8. In the NOPR, the Commission proposed to amend section 388.113 to include procedures for submitting, designating, handling, sharing and disseminating Critical Electric Infrastructure Information submitted to or generated by the Commission.\7\ The Commission proposed to define the term ``Critical Electric Infrastructure Information'' \8\ to include ``Critical Energy Infrastructure Information'' as defined under the Commission's current regulations and to refer to both types of information, collectively, as CEII.\9\ The Commission also proposed to delete references to CEII in section 388.112 so that section 388.112 would only address privileged material and all procedures regarding CEII would be in section 388.113. --------------------------------------------------------------------------- \7\ NOPR, 155 FERC ] 61,278 at P 10. \8\ Id. P 11 (noting that Section 215A(a)(3) of the FAST Act defines Critical Electric Infrastructure Information to include information that qualifies as critical energy infrastructure information under the Commission's regulations). \9\ NOPR, 155 FERC ] 61,278 at P 13. --------------------------------------------------------------------------- Comments 9. APPA and MISO maintain that CEII should not include all Critical Energy Infrastructure Information.\10\ APPA contends that Congress intended for the Commission to develop a separate process for Critical Electric Infrastructure Information regarding the bulk-power system and that the amended regulations fall ``short'' of Congress's intent under the FAST Act because the amended regulations include the voluntary disclosure provisions found in the Commission's current regulations.\11\ APPA also asserts that the proposed definition of ``critical electric infrastructure'' ``does not comport well'' with section 215A(d)(10) of the FPA, which provides DOE and the Commission with the authority to remove the CEII designation from information regarding the bulk-power system or distribution facilities.\12\ MISO contends that the Commission misinterpreted the definition of Critical Electric Infrastructure Information and that not all ``Critical Energy Infrastructure Information under the Commission's regulations is included'' in the definition of Critical Electric Infrastructure Information.\13\ --------------------------------------------------------------------------- \10\ See APPA Comments at 5-11; MISO Comments at 5. \11\ APPA Comments at 5, 9, 13. \12\ Section 215A(d)(10) of the FPA provides that when ``the Commission or the [DOE] Secretary, as appropriate, determines that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities'' the designation shall be removed. \13\ MISO Comments at 4-6. --------------------------------------------------------------------------- 10. TAPS and APPA maintain that the Commission should revise the CEII definition to include additional language from the FAST Act. Specifically, TAPS and APPA recommend that the proposed definition of CEII incorporate section 215A(d)(1)(B), which provides that CEII ``shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.'' \14\ APPA requests that, if the Commission includes Critical Energy Infrastructure Information in CEII, then the Commission should interpret section 215A(d)(1)(B) to apply to all forms of CEII, including Critical Energy Infrastructure Information.\15\ TAPS and APPA also request that the Commission define the term ``political subdivision,'' as used in section 215A(d)(1)(B), to have the same meaning as the term ``political subdivision'' in section 201(f) of the FPA, such that the term in section 215A(d)(1)(B) would include any agency, authority or instrumentality of any political subdivision or owned by a political subdivision.\16\ TAPS and APPA contend that, absent the clarification, these additional entities may not be considered a ``political subdivision'' under State laws.\17\ --------------------------------------------------------------------------- \14\ TAPS Comments at 8; APPA Comments at 21-22. \15\ APPA Comments at 23. \16\ TAPS Comments at 8; APPA Comments at 22 (citing Section 201(f), which indicates that provisions of that subchapter are not applicable to, among others, the United States, a State or any political subdivision of a State, certain electric cooperatives or any agency, authority, or instrumentality of any one or more of those entities or any corporation wholly owned, directly or indirectly, by any one or more of those entities). 16 U.S.C. 824(f) \17\ TAPS Comments at 8-9; APPA Comments at 22-23. --------------------------------------------------------------------------- 11. TAPS recommends that the Commission delete from the definition of Critical Energy Infrastructure Information the requirement that such information be exempt from FOIA.\18\ TAPS contends that the existing exemption clause is unnecessary because any materials will be exempt from FOIA pursuant to section 215A(d)(1)(A).\19\ --------------------------------------------------------------------------- \18\ TAPS Comments at 4-5. \19\ Id. at 4. --------------------------------------------------------------------------- 12. Other commenters seek clarification on the scope of the CEII definition. Specifically, the Trade Associations request that the Commission clarify whether the name or location of an electric system, asset, owner or operator could be protected under the proposed CEII definition.\20\ NRECA, similarly, urges the Commission to clarify that material considered Critical Energy Infrastructure Information, such as electric generation, and non-bulk electric system transmission and distribution facilities, would still qualify as CEII under the revised definition in the amended regulations.\21\ --------------------------------------------------------------------------- \20\ Trade Associations Comments at 16. \21\ NRECA Comments at 7. --------------------------------------------------------------------------- 13. Powerex requests that the Commission specify whether the new definition of CEII expands the scope of information currently defined as Critical Energy Infrastructure Information.\22\ Powerex contends that the scope of this proceeding should remain limited to CEII regulations and procedures discussed in the NOPR and, thus, the scope of this proceeding should not extend to other forms of sensitive data.\23\ Powerex, further, explains that there [[Page 93734]] may be a tendency to over-designate information as CEII and, therefore, the Commission should recognize that transparency is needed to balance CEII protection against the due process rights of parties participating in Commission proceedings.\24\ --------------------------------------------------------------------------- \22\ Powerex Comments at 11. \23\ Id. at 15. \24\ Id. at 12. --------------------------------------------------------------------------- 14. TAPS, APPA and the Trade Associations recommend revisions to the CEII Non-Disclosure Agreements (NDA).\25\ Specifically, TAPS, APPA, and the Trade Associations state that the Commission should expressly incorporate the language from section 215A(d)(1)(B), exempting CEII from public disclosure, into the NDA.\26\ TAPS requests that the Commission eliminate the State Agency NDA. TAPS contends that ``[p]rior to the FAST Act's express preemption of Sunshine Laws requiring disclosure,'' the State Agency NDA was an attempt to impose a contractual nondisclosure requirement for critical energy infrastructure information provided to a State agency. TAPS maintains that, once section 215A(d)(1)(B) is included in the general NDA, the State Agency NDA should be eliminated because it is now unnecessary.\27\ --------------------------------------------------------------------------- \25\ APPA Comments at 23; TAPS Comments at 9-10; Trade Associations Comments at 32. \26\ See id. \27\ TAPS Comments at 10; see also Critical Energy Infrastructure Information State Agency Employee Non-Disclosure Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/state-agen-nda.pdf. --------------------------------------------------------------------------- 15. With respect to the proposed edits to sections 388.112 and 388.113 to separate the Commission's treatment of privileged material from the Commission's treatment of CEII, MISO suggests that the title for section 388.112 be changed to ``Submission and treatment of privileged information'' and section 388.113 be changed to ``Submission and treatment of Critical Electric Infrastructure Information (CEII).'' \28\ --------------------------------------------------------------------------- \28\ MISO Comments at 3. --------------------------------------------------------------------------- 16. The Trade Associations request that the Commission expressly state in the amended regulations that the CEII process is not intended to, and should not be interpreted to, supersede or otherwise affect existing laws, regulations, and agency rules that separately safeguard such data.\29\ --------------------------------------------------------------------------- \29\ See Trade Associations Comments at 26. --------------------------------------------------------------------------- Commission Determination 17. As discussed below, the Commission, with limited modifications, adopts the amendments proposed in the NOPR addressing the scope, purpose and definitions in the CEII regulations. The Commission determines that the amendments are consistent with the requirements of the FAST Act and will result in more secure treatment of CEII. 18. The Commission disagrees with APPA and MISO that the CEII definition should not include Critical Energy Infrastructure Information and that there should be separate processes for electric and non-electric CEII. Our determination is based on the plain language of the FAST Act. Section 215A(a)(3) defines Critical Electric Infrastructure Information to ``include information that qualifies as critical energy infrastructure information under the Commission's regulations.'' \30\ In subsuming the Commission's existing Critical Energy Infrastructure Information within section 215A's CEII definition, Congress expressly stated that the definition of CEII includes Critical Energy Infrastructure Information. There is no indication in the language of the FAST Act that Congress intended to limit the types of Critical Energy Infrastructure Information to only electric infrastructure information.\31\ --------------------------------------------------------------------------- \30\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. \31\ For the same reason, we reject MISO's recommendation that the title for section 388.112 should be changed to ``Submission and treatment of privileged information'' and that the title for section 388.113 should be changed to ``Submission and treatment of Critical Energy Infrastructure Information (CEII).'' MISO Comments at 3. --------------------------------------------------------------------------- 19. Including Critical Energy Infrastructure Information within the definition of CEII is not inconsistent with the provisions of section 215A(d)(10), as APPA maintains. First, section 215A(d)(10) states that removal of a CEII designation may be appropriate when the disclosure of such information ``could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities.'' (Emphasis supplied.) Thus, it is clear that Congress did not intend for the new Critical Electric Infrastructure Information designation to apply only to the bulk-power system. Second, Critical Energy Infrastructure Information includes information that ``relates details about the production, generation, transportation, transmission, or distribution of energy.'' \32\ Such information, even if it concerns non-electric infrastructure, could be used to impair the security or reliability of the bulk-power system, for example by severing gas pipeline connections to electric generation facilities. --------------------------------------------------------------------------- \32\ 18 CFR 388.113(c)(1)(i)). --------------------------------------------------------------------------- 20. Moreover, the Commission determines that a single CEII process for Critical Energy/Electric Infrastructure Information is the most efficient way to fulfill the statutory mandate of the FAST Act and to avoid any confusion that could result from different processes for different types of critical infrastructure information.\33\ Absent contrary language in the FAST Act, the Commission has discretion in how it administers statutory mandates by regulation.\34\ --------------------------------------------------------------------------- \33\ NOPR, 155 FERC ] 61,278 at P 14. \34\ See Anna Jacques Hosp. v. Burwell, 797 F.3d 1155, 1165 (D.C. Cir. 2015) (holding that ``interstitial question[s] of implementation'' are left to the discretion of the implementing agency). --------------------------------------------------------------------------- 21. APPA's assertion that the Commission is ``falling short'' of meeting Congress's intent is without merit. In the proposed regulations, the Commission complies with each provision in section 215A(d)(2) with regard to designating and handling Critical Electric Infrastructure Information. The fact that those rules also apply to Critical Energy Infrastructure Information does not diminish the Commission's compliance under the FAST Act. Rather, in this regard, the Commission's determination meets Congress's intent. Moreover, APPA's argument that ``information related to cyber threats and defensive measures should not be `protected' under a designation regime that also provides for potentially involuntary access by any federal employee . . ., landowners [or]any person who is a participant in a Commission proceeding . . .'' and others has no basis in the text of the FAST Act. APPA notably cites to nothing in the FAST Act to support that argument.\35\ On the contrary, Congress explicitly directed the Commission to include voluntary sharing in the regulations that the Commission is required to promulgate under the FAST Act.\36\ Further, the implication of APPA's argument--that cyber information is different from other types of infrastructure information and therefore warrants different rules--fails to take into consideration that the Commission will evaluate each request for CEII, and each decision to voluntarily share CEII, on a case-by-case basis. For example, a person seeking cyber threat information would have to show a different need for the information than a person seeking information for a pipeline facility for a certificate proceeding. --------------------------------------------------------------------------- \35\ See APPA Comments at 15. \36\ Section 215A(d)(2)(D) states that the Commission ``shall promulgate such regulations as necessary to . . . facilitate voluntary sharing of critical electric infrastructure information . . .'' FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. --------------------------------------------------------------------------- 22. The Commission agrees with TAPS and APPA that the Commission's regulations should incorporate the [[Page 93735]] provision in section 215A(d)(1)(B) that CEII ``shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.'' \37\ As to TAPS's and APPA's request that the Commission define the term ``political subdivision,'' in section 215A(d)(1)(B) of the FAST Act to be consistent with the definition of that term in FPA section 201(f), Congress did not adopt the definition of ``political subdivision'' in section 201(f) for the purposes of the FAST Act. However, the Commission believes that the broad language of section 215A(d)(1)(B), as it applies to ``any Federal, State, political subdivision or tribal authority,'' should encompass the instrumentalities and components of States. Section 215A(d)(1)(B) was included to protect CEII from mandatory disclosure. It would be illogical to provide such protection to States, but not their instrumentalities and components. --------------------------------------------------------------------------- \37\ APPA states that there may be instances where an entity could provide CEII to NERC who, in turn, may submit that entity's information to the Commission or DOE as CEII without notifying the entity. Thus, APPA is concerned the entity may not be aware that the information has been submitted to the Commission and designated as CEII. As a result, APPA suggests that the Commission establish notification procedures so that entities are aware that their information was designated as CEII. APPA Comments at 21-22. We see no need to adopt such a notification process. Section 1505 of NERC's Rules of Procedure already requires NERC, unless otherwise directed by the Commission or its staff, to notify submitting entities of requests made by the Commission to NERC for the submitting entities' information. --------------------------------------------------------------------------- 23. The Commission disagrees with TAPS that the Commission should delete from the definition of Critical Energy Infrastructure Information the provision that states that Critical Energy Infrastructure Information ``[i]s exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552.'' \38\ As we have discussed above, Congress incorporated Critical Energy Infrastructure Information within section 215A's definition of Critical Electric Infrastructure Information without revision.\39\ Accordingly, the Commission will retain its current definition of Critical Energy Infrastructure Information. --------------------------------------------------------------------------- \38\ 18 CFR 388.113(c)(2)(iii). \39\ See Stone v. INS, 514 U.S. 386, 397 (1995) (holding that ``[w]hen Congress acts to amend a statute, we presume it intends its amendment to have real and substantial effect''). --------------------------------------------------------------------------- 24. In response to the Trade Associations' comments seeking clarification if a name or location of a facility should be protected as CEII, the Commission's current practice is that information that ``simply give[s] the general location of the critical infrastructure'' or simply provides the name of the facility is not CEII.\40\ However, under certain circumstances, information regarding the location of infrastructure or its name that is not already publicly known could be CEII.\41\ Therefore, we clarify that, while as a general matter the location or name of infrastructure is not CEII, a submitter of information to the Commission may ask that non-public information about the location, or the name, of critical infrastructure be treated as CEII. The submitter would have to provide a justification for the request and explain why the information is not already publicly known. --------------------------------------------------------------------------- \40\ 18 CFR 388.113(c)(1)(iv). \41\ For example, the location of an operating transformer is likely publicly known. However, the location of a spare transformer housed in a central location may not be publicly known and, therefore, may qualify as CEII. --------------------------------------------------------------------------- 25. In response to NRECA's request that the Commission clarify that material treated as Critical Energy Infrastructure Information under the Commission's current regulations would, in most circumstances, be treated as CEII under the amended regulations, we note that such information should continue to qualify as CEII. We also note, however, in response to Powerex's comment, that it is conceivable that Critical Electric Infrastructure Information may include information that would not fall within the existing definition of Critical Energy Infrastructure Information.\42\ --------------------------------------------------------------------------- \42\ For example, while Critical Energy Infrastructure Information must satisfy the four-part definition in amended section 388.113(c)(1), Critical Electric Infrastructure Information must meet the definition in amended section 388.113(c)(2). --------------------------------------------------------------------------- 26. We agree with Powerex's comment that the Final Rule should only address CEII and not other types of information. In response to Powerex's concerns about a party's due process rights, under the amended CEII regulations the Commission will balance the need to protect critical information with the potential need of parties participating in Commission proceedings to access CEII. For example, the Commission's regulations include a process for parties to access information directly from other parties in a Commission proceeding.\43\ --------------------------------------------------------------------------- \43\ See 18 CFR 388.112(b)(2) and 388.113(g)(4). --------------------------------------------------------------------------- 27. In response to comments from TAPS, APPA, and the Trade Associations, the Commission agrees that the CEII NDA should reference the provision in section 215A(d)(1) that CEII is exempt from disclosure under any Federal, State, political subdivision or tribal law requiring public disclosure. We disagree that the State Agency NDA should be eliminated because it reinforces the minimum protections applicable to CEII that the Commission may provide to states as well as provides for additional protections beyond the exemptions in State public disclosure laws.\44\ --------------------------------------------------------------------------- \44\ See supra note 27. --------------------------------------------------------------------------- 28. Finally, the Commission declines to adopt the revision suggested by the Trade Associations to expressly state that the CEII regulations are not intended to supersede other laws, regulations, and agency rules that separately safeguard such data.\45\ This Final Rule and adopted CEII amendments do not purport to supersede any other legal authorities other than the regulations and associated materials specifically amended in this Final Rule. --------------------------------------------------------------------------- \45\ See Trade Associations Comments at 26. --------------------------------------------------------------------------- B. Criteria and Procedures for Determining What Constitutes CEII 1. General Criteria and Procedures NOPR 29. Section 215A(d)(2)(A) requires the Commission to ``establish criteria and procedures to designate information as critical electric infrastructure information.'' In the NOPR, the Commission proposed criteria and procedures for the handling of CEII consistent with section 215A(d)(2)(A).\46\ --------------------------------------------------------------------------- \46\ NOPR, 155 FERC ] 61,278 at P 16. --------------------------------------------------------------------------- Comments 30. Commenters request that the Commission provide more detail on what qualifies as CEII.\47\ The Public Interest Organizations, for example, ask the Commission to publish guidelines and criteria for designating information as CEII.\48\ The Public Interest Organizations further recommend that the Commission publish ``data tables that provide suggested classifications for common data types.'' \49\ HRC asks that the Commission require entities filing CEII to include a public cover letter providing a description of the facility the information relates to and describing the nature of the submission. HRC also contends that information submitted as CEII should include a more detailed description in eLibrary.\50\ HRC contends that this information will better allow the public to understand the basis for [[Page 93736]] the CEII classification.\51\ HRC also requests that the Commission develop a procedure whereby the public can request that the Commission review information at the time of submission to ensure that it was properly submitted as CEII.\52\ HRC contends that filing a CEII or FOIA request as a means of triggering the review of CEII classification is burdensome.\53\ --------------------------------------------------------------------------- \47\ Peak Comments at 8-10; Powerex Comments at 12; APS Comments at 5; APPA Comments at 17; WIRAB Comments at 5. \48\ Public Interest Organizations Comments at 4. \49\ Id. at 5. \50\ HRC Comments at 2-3. \51\ Id. at 2. \52\ Id. at 3. \53\ Id. --------------------------------------------------------------------------- 31. WIRAB and APS commented that additional designation guidance is needed in order to avoid submitters' over-designation of documents as CEII. Specifically, WIRAB and APS recommend that the Commission establish separate criteria for determining when information qualifies as CEII on the basis of national security, economic security or public health or safety.\54\ --------------------------------------------------------------------------- \54\ WIRAB Comments at 5; APS Comments at 5. --------------------------------------------------------------------------- 32. The Trade Associations maintain that the Commission's regulations should explicitly designate as CEII information ``related to compliance with the Reliability Standards as critical electric infrastructure information and exempt it from disclosure under 388.113(f).'' \55\ The Trade Associations assert that a blanket presumption that information regarding Reliability Standards compliance is CEII is necessary because it ``may . . . be difficult for a submitter to present, ex ante, a clear justification for meeting the critical electric infrastructure information definition for a particular system or asset, especially if the potential for negative effect could also arise from the disclosure of a combination of sets of information that alone may not meet the CEII definition.''\56\ --------------------------------------------------------------------------- \55\ Trade Associations Comments at 12. \56\ Id. at 11. --------------------------------------------------------------------------- 33. APPA and the Trade Associations raise concerns about how the designation criteria will apply to DOE.\57\ Specifically, they assert that the Commission failed to provide criteria and procedures that would apply to DOE.\58\ Additionally, Peak, Public Interest Organizations, and APPA request that the Commission hold a technical conference on the implementation of the new CEII rules as part of the ``consultation with the Secretary'' required by FPA section 215A(d)(2).\59\ --------------------------------------------------------------------------- \57\ APPA Comments at 24-25; Trade Associations Comments at 23. \58\ Id. \59\ Peak Comments at 6-7; Public Interest Organizations Comments at 5; APPA Comments at 25. WIRAB also requests a technical conference to discuss implementation of the FAST Act. WIRAB Comments at 11. --------------------------------------------------------------------------- 34. Finally, NRC requests that the Commission establish a generic CEII designation that other federal agencies can use to designate information.\60\ NRC also recommends that the Commission clarify in the Final Rule that other federal agencies ``are to establish their own procedures for identifying CEII on an information-specific basis utilizing the FERC's generic CEII standard.'' \61\ --------------------------------------------------------------------------- \60\ NRC Comments at 1-2. \61\ Id. at 2. --------------------------------------------------------------------------- Commission Determination 35. The Commission is not persuaded that more detailed guidance or additional designation criteria in the CEII regulations are necessary. FPA section 215A(a)(2) defines Critical Electric Infrastructure as ``a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.'' FPA section 215A(a)(3) includes Critical Energy Infrastructure Information within CEII. We believe that the regulations, as proposed, provide adequate guidance for a submitter or Commission staff to determine whether information is CEII and for the CEII Coordinator to make a determination. In addition, the criteria and designation procedures adopted herein are informed by the Commission's experience of implementing and administering the Critical Energy Infrastructure Information regulations over the past fifteen years. 36. The Commission does not agree that the scope of CEII should be modified, as suggested by the Trade Associations, to encompass information ``related to compliance with the Reliability Standards.'' The Trade Associations' proposal is unduly broad and inconsistent with the FAST Act because it could lead to all infrastructure information, whether critical or not, being treated as CEII. For the same reason, we do not agree that the blanket presumption that information relating to compliance with Reliability Standards is CEII, proposed by the Trade Associations, is appropriate. Like other forms of CEII, however, information on compliance with Reliability Standards may be treated as CEII if the submitter justifies its treatment as CEII under the Commission's regulations. 37. In response to HRC's comments that documents listed as CEII could be better described in eLibrary, the level of detail needed for a document description in eLibrary is better addressed in our submission guidelines rather than in our regulations.\62\ --------------------------------------------------------------------------- \62\ See CEII Filing Guide, https://www.ferc.gov/resources/guides/filing-guide/file-ceii/ceii-guidelines.asp. The Commission will update the CEII Filing Guide when the proposed regulations become effective. --------------------------------------------------------------------------- 38. In response to HRC's request for an additional process to obtain a ruling on CEII when it is filed, we believe that such a process is unnecessary, as entities seeking access to information filed as CEII may submit a FOIA or CEII request at any time, including promptly after that information is filed with the Commission. We further conclude that the proposed procedures are adequate for the Commission to process information submitted to the Commission, or generated by the Commission, as CEII.\63\ As previously noted, the Commission receives over 7,000 CEII submissions a year; reviewing the information at the time of submission, in the absence of a specific request for that information, would be overly burdensome on the Commission's resources. In response to a CEII request, the CEII Coordinator will review the information to determine whether to designate it as CEII. Further, proposed section 388.113(d)(1)(iv) specifically states that the Commission retains the right to make determinations with regard to any claim of CEII status, at any time. --------------------------------------------------------------------------- \63\ See amended sections 388.113(c) and (d). --------------------------------------------------------------------------- 39. In response to the comments from APPA and the Trade Associations, the Commission declines to revise the regulations to identify specific designation criteria and CEII procedures for DOE. Section 215A(d)(3) of the FAST Act provides that information ``may be designated'' by the Commission and DOE pursuant to the criteria and procedures that the Commission establishes.\64\ The FAST Act, however, does not compel DOE to make any changes to its regulations in this regard, and as noted in the NOPR, nothing within the Commission's regulations would limit DOE's ability to designate CEII in accordance with the FAST Act.\65\ Furthermore, we do not believe a technical conference is necessary to satisfy the requirement for consultation with DOE in the FAST Act. --------------------------------------------------------------------------- \64\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776. \65\ NOPR, 155 FERC ] 61,278 at P 16 n.12. --------------------------------------------------------------------------- 40. Although the Commission recognizes that other agencies have an obligation to protect certain information in their custody, the FAST Act does not grant other federal agencies the authority to designate information as [[Page 93737]] CEII. Critical Electric Infrastructure Information is specifically defined as information ``designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to subsection (d).'' \66\ Congress's intent to limit the designation authority to the Commission and DOE is reinforced by the fact that only the staff of the Commission and DOE are subject to sanctions for unauthorized release under section 215A(d)(2)(C).\67\ However, because NRC has raised valid concerns about the protection of sensitive information of the electric grid in its custody, the Commission revises the amended scope of section 388.113 to state that nothing in this section limits any other Federal agency's ability to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. Further, the section is revised to state that, to the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information (see the last two sentences of paragraph (a) in the regulatory text of section 388.113 in this rule). Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information. --------------------------------------------------------------------------- \66\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776. \67\ Id. --------------------------------------------------------------------------- 41. By this change, the Commission does not limit the discretion of other federal agencies to protect sensitive information in their custody but provides a mechanism for agencies to consult with the Commission's CEII Coordinator regarding the treatment or designation of such information as CEII.\68\ We believe this change strikes a reasonable balance by recognizing other federal agencies' discretion to protect their information, while adhering to the statutory framework that limits CEII designation authority to the Commission and DOE. --------------------------------------------------------------------------- \68\ For example, the Commission could establish the parameters of the Commission's role with regard to CEII with another federal agency through a Memorandum of Understanding with that agency. --------------------------------------------------------------------------- 2. Designation of Submissions to the Commission NOPR 42. The Commission proposed to treat information submitted with a justification for CEII treatment as CEII, unless the submitter is otherwise notified by the Commission.\69\ --------------------------------------------------------------------------- \69\ NOPR, 155 FERC ] 61,278 at P 19. --------------------------------------------------------------------------- Comments 43. APS asks that the Commission ``deem'' information as CEII at the time an entity submits the information to the Commission.\70\ HRC and Tacoma Power are concerned that ``treating'' a submission as CEII is not a designation and, as a result, submitting entities may not be able to assert the FOIA exemption when faced with a records request unless and until the Commission makes a CEII designation determination.\71\ Tacoma Power further requests that the Commission develop a process for state entities to receive a CEII designation determination so that state entities may assert any FOIA exemption with certainty.\72\ --------------------------------------------------------------------------- \70\ APS Comments at 6. \71\ HRC Comments at 2; Tacoma Power Comments at 4. \72\ Tacoma Power Comments at 4. --------------------------------------------------------------------------- 44. INGAA, NERC, and the Trade Associations request that the Commission change the comment period afforded to submitters of CEII to respond to a request for CEII from five calendar days to five business days, ten working days, or at least 30 calendar days, respectively.\73\ APS and CEA comment that if the Commission determines that particular information is not CEII, the Commission should provide the submitter with an explanation of why the information does not meet the criteria for designation as CEII.\74\ The Trade Associations also request that the Commission provide a more detailed explanation in instances when CEII is released over an objection from the submitter of the material.\75\ --------------------------------------------------------------------------- \73\ INGAA Comments at 4; NERC Comments at 15; Trade Associations Comments at 19. \74\ APS Comments at 6; CEA Comments at 6-7. \75\ Trade Associations Comments at 19-20. --------------------------------------------------------------------------- 45. MISO, Trade Associations, CEA, and HRC submitted comments recommending changes to the Commission's processing and evaluation of justification statements that must accompany a submitter's request for CEII treatment. MISO is concerned that the Commission may automatically make information public if the submission fails to meet the Commission's regulations. Thus, MISO recommends that amended section 388.113(d)(1) be revised to make clear that failure to provide the justification or other required information will be considered in the determination of whether the information will be maintained as CEII by the Commission, but it will not result in automatic disclosure of the information.\76\ --------------------------------------------------------------------------- \76\ MISO Comments at 7. --------------------------------------------------------------------------- 46. The Trade Associations maintain information submitted to the Commission for designation as CEII that ultimately is determined not to be CEII should not automatically be disclosed to the public because such information may be subject to other laws and regulations restricting disclosure of the information.\77\ --------------------------------------------------------------------------- \77\ Trade Associations Comments at 25-26. --------------------------------------------------------------------------- 47. CEA recommends that the Commission provide the submitter with an opportunity to retract a submission and re-submit it with the appropriate justification.\78\ --------------------------------------------------------------------------- \78\ CEA Comments at 6-7. --------------------------------------------------------------------------- Commission Determination 48. As an initial matter, we correct the statement in the NOPR erroneously stating that under our current practice, ``the Commission deems the designation on a submission accepted as submitted.'' \79\ Our current practice is to treat information as CEII, and maintain it in our non-public files, when it is submitted with a request for CEII treatment. That practice is reflected in the current and proposed regulations.\80\ Under the regulations adopted in this Final Rule information that is submitted will not be designated CEII until the CEII Coordinator makes such a determination. --------------------------------------------------------------------------- \79\ NOPR, 155 FERC ] 61,278 at P 19. \80\ See amended section 388.113(d)(1)(vi). --------------------------------------------------------------------------- 49. As to the comments submitted by Tacoma Power, the Commission is not persuaded that a special expedited process for designations in the event a State entity is facing a public records request is needed, because State and local entities may consult with the CEII Coordinator as to whether information that is subject to a State, local, or other type of records request is CEII under the Commission's regulations.\81\ --------------------------------------------------------------------------- \81\ Section 215A(d)(1)(B) states that Critical Electric Infrastructure Information ``shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.'' FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776. --------------------------------------------------------------------------- 50. In response to the comments from APS and CEA about the procedures for informing a submitter of a potential release or re- designation of CEII, the Commission's current practices are sufficient to comply with the FAST Act [[Page 93738]] and we maintain those practices under the adopted regulations. The current practice is to provide notice to the submitter if a proposed CEII designation will be rejected or if CEII will be released over an objection. The notification will include an explanation as to why the information does not meet the criteria and the submitter will have an opportunity to comment or seek appropriate relief under amended section 388.113(e)(4). 51. The Commission is not persuaded that it is necessary to make the changes proposed by MISO and CEA regarding treatment of information that is filed in a manner that does not meet our regulations. The amended regulations do not mandate automatic disclosure of the information. Furthermore, even if the Commission were to make information public, the Commission will provide notice to the submitter prior to any determination.\82\ --------------------------------------------------------------------------- \82\ See amended sections 388.113(d)(1)(iv) and 388.113(e)(3)- (4). --------------------------------------------------------------------------- 52. The Commission adopts INGAA's proposal to change the comment period from five calendar days to five business days, and will change all references in section 388.113 from ``calendar'' days to ``business'' days. Allowing more time is not warranted because the issue of whether to release CEII is relatively limited and, as a general matter, the Commission endeavors to respond to requests for CEII as soon as possible. In addition, the Commission notes that submitters can request an extension of that time-period to submit comments to the Commission. 3. Information Included in NERC Databases NOPR 53. The Commission proposed that information downloaded by Commission staff from private databases that are accessed pursuant to Commission order or regulation will be maintained as non-public information consistent with the Commission's internal controls.\83\ The Commission noted that in response to an information request, it will evaluate whether the information is CEII, proprietary information, or otherwise privileged or non-public and will provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.\84\ --------------------------------------------------------------------------- \83\ NOPR, 155 FERC ] 61,278 at P 17 n.13(citing Availability of Certain North American Electric Reliability Corporation Databases to the Commission, Order No. 824, 155 FERC ] 61,275 (2016)). \84\ Id. --------------------------------------------------------------------------- Comments 54. Most commenters support treating data downloaded from the NERC databases as non-public. NERC agrees with the proposal to treat information downloaded from its databases as non-public, but it seeks clarification as to whether the Commission intends to designate the information as privileged and CEII.\85\ TAPS requests that if the Commission determines to release database information, the manager of the database and the entity whose data would be released should receive notice and an opportunity to comment.\86\ --------------------------------------------------------------------------- \85\ NERC Comments at 19. \86\ TAPS Comments at 5-7. --------------------------------------------------------------------------- 55. The Trade Associations recommend that the Commission treat the NERC databases information that Commission staff does not download as inextricably intertwined with downloaded information and thereby treat all of the information on each database as CEII.\87\ TAPS raises concerns that information that is contained in a database may not be adequately protected from disclosure, because the data ``is not being submitted to the Commission, but rather accessed by the Commission.'' \88\ --------------------------------------------------------------------------- \87\ Trade Associations Comments at 15. \88\ TAPS Comments at 6. --------------------------------------------------------------------------- CEA requests that the Commission respect Canadian information that may be accessed through any private databases accessible to the Commission.\89\ CEA further comments that the Commission's information gathering through other databases be restricted to U.S. facility information only.\90\ --------------------------------------------------------------------------- \89\ CEA Comments at 4. \90\ Id. --------------------------------------------------------------------------- Commission Determination 56. The Commission adopts the NOPR proposal to treat information downloaded from NERC databases as non-public \91\ and to evaluate whether it should be designated as CEII in response to a request for the information or if the Commission determines such information should be disclosed.\92\ In addition, because the CEII designation only applies to information that is submitted to or generated by the Commission, information that Commission staff accesses and reviews, but never takes custody of, cannot be designated as CEII. Therefore, the Commission disagrees with the proposal to treat all of the information in an accessed database as inextricably intertwined CEII.\93\ --------------------------------------------------------------------------- \91\ This is consistent with the statement in Order No. 824 that the Commission ``will take appropriate steps, as provided for in our governing statutes and regulations, in handling such information.'' Order No. 824, 152 FERC ] 61,208 at P 22. \92\ The discussion above and our determination address the Trade Associations' request for clarification of Order No. 824 in Docket No. RM15-25-001. \93\ By the same token, information that is not downloaded cannot be disclosed under a FOIA request as the Commission would not possess the information. --------------------------------------------------------------------------- 57. The Commission clarifies that information downloaded by the Commission or its staff from a non-public NERC database will be treated as non-public information and will be afforded the same treatment as CEII. Thus, in the event the Commission receives a request for the information or the Commission determines such information should be disclosed, the Commission will ``provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.'' \94\ In response to TAPS's comments, we clarify that, where practicable, we will notify the database owner and the information owner.\95\ --------------------------------------------------------------------------- \94\ NOPR, 155 FERC ] 61,278 at P 17 n.13. \95\ We note that section 1505 of NERC's Rules of Procedure requires NERC, unless otherwise directed by the Commission or its staff, to provide notice to submitting entities in response to requests for the submitting entities' information by the Commission. --------------------------------------------------------------------------- 58. Finally, as to CEA's comment regarding Canadian information on other databases, we believe that CEA's request goes beyond the scope of this rulemaking proceeding, which is limited to amending the Commission's regulations regarding CEII.\96\ --------------------------------------------------------------------------- \96\ The Commission has addressed the scope of information covered by specific data collection requirements in individual proceedings. For example, in Order No. 824, concerning Commission access to certain NERC databases that include data about both U.S. and Canadian facilities, the Commission revised its regulations to indicate that ``Commission access will be limited to data regarding U.S. facilities.'' Order No. 824, 155 FERC ] 61,275 at P 38. --------------------------------------------------------------------------- 4. Designation of Commission-Generated Information NOPR 59. For Commission-generated information, the NOPR explained that the CEII Coordinator, after consultation with the appropriate Commission Office Director, will determine whether the information meets the definition of CEII.\97\ The CEII Coordinator will then determine how long the CEII designation should last and, as appropriate, whether to make any re-designation.\98\ --------------------------------------------------------------------------- \97\ NOPR, 155 FERC ] 61,278 at P 21. \98\ Id. --------------------------------------------------------------------------- Comments 60. The Trade Associations request that the Commission establish a process in which appropriate stakeholders may [[Page 93739]] participate in the Commission's CEII designation determinations for Commission-generated information.\99\ The Trade Associations assert that whether the information is submitted to the Commission or not, ``owners and operators of that critical infrastructure who will be faced with defending such a potential attack deserve to have input into the determination of whether or not such information should be disclosed.'' \100\ --------------------------------------------------------------------------- \99\ Trade Associations Comments at 24. \100\ Id. --------------------------------------------------------------------------- Commission Determination 61. The Commission determines that there is no need for stakeholder participation in the designation of Commission-generated information. The Commission has the expertise and experience to make determinations about whether Commission-generated information is CEII. And as a practical matter, it would not be appropriate in some circumstances for stakeholders to be privy to Commission-generated information that qualifies as CEII. For example, Commission-generated CEII may contain information that is otherwise non-public or privileged. To the extent that an entity believes that a Commission-generated document contains CEII about its facility, the entity is not precluded from raising that concern with the CEII Coordinator. 5. Segregable Information NOPR 62. The NOPR recognized that information submitted to the Commission may contain parts that are CEII and parts that may not be CEII. As a result, the NOPR proposed to require entities submitting CEII and Commission staff who generate CEII, to the extent feasible, to segregate the CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) from non-CEII at the time of submission or staff's generation, respectively.\101\ --------------------------------------------------------------------------- \101\ NOPR, 155 FERC ] 61,278 at P 22. --------------------------------------------------------------------------- Comments 63. HRC and Powerex support the requirement to segregate CEII from non-CEII and encourage efforts to prevent the over-classification of information.\102\ TAPS asks the Commission to confirm that submitting a redacted public version of a filing satisfies the requirement to segregate CEII.\103\ Powerex asks the Commission to clarify that derivative analyses performed by governmental entities or their contractors that use or rely on CEII, without more detail, should not be designated as CEII solely based on the fact the analysis relies on or uses CEII.\104\ --------------------------------------------------------------------------- \102\ HRC Comments at 3; Powerex Comments at 16-17. \103\ TAPS Comments at 14. \104\ Powerex Comments at 16. --------------------------------------------------------------------------- Commission Determination 64. The Commission clarifies that submitting a properly redacted public version of information submitted as CEII meets the requirement established in section 215A(d)(8). Moreover, derivative analyses that use or rely on CEII, without actually containing or disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII. 6. Duration of Designation NOPR 65. Section 215A(d)(9) provides that information ``may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.''\105\ The NOPR stated that the five- year designation period will commence upon submission, and the expiration of the five-year period will not automatically trigger the public release of the information unless the Commission determines it is appropriate to do so.\106\ The NOPR also stated that the Commission will make a re-designation determination when an entity requests the information; when staff determines a need to remove the designation; or when a submitter requests that the information no longer be treated as CEII.\107\ Consistent with current practice, the NOPR proposed that a NDA will require protection of CEII past the expiration of the CEII designation marked on the information and that the recipient of CEII from the Commission must receive prior authorization from the Commission before making any disclosure.\108\ --------------------------------------------------------------------------- \105\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776. \106\ NOPR, 155 FERC ] 61,278 at P 18 n.14 and P 24. \107\ Id. \108\ Id. P 26. --------------------------------------------------------------------------- 66. In the NOPR, the Commission proposed removing the CEII designation when the information no longer could impair the security or reliability of not only the bulk-power system or distribution facilities but also other forms of energy infrastructure.\109\ The Commission stated that the Commission would provide notice to the submitter ``in the instance where the Commission takes the affirmative step to rescind the designation.'' \110\ --------------------------------------------------------------------------- \109\ Id. P 27. \110\ Id. --------------------------------------------------------------------------- Comments 67. Several commenters support the proposal to maintain information as non-public after CEII designations marked on the information expire.\111\ However, Peak requests that the Commission determine at the time of the designation whether the data will lose its protection after the five-year term ends and recommends creating designation categories that include designation timeframes.\112\ The Trade Associations and APPA ask the Commission to automatically re-designate information, absent objection.\113\ Tallgrass requests that a designation remain for the life of a pipeline facility.\114\ INGAA requests that the Commission never un-designate CEII related to pipeline facilities on its own initiative or unilaterally as long as the facility is in operation.\115\ --------------------------------------------------------------------------- \111\ See, e.g., ITC Comments at 2-3; INGAA Comments at 3; NRECA Comments at 9. \112\ Peak Comments at 10-11 (recommending categories such as ``transmission and generation outage data, generator-specific forecast data, transmission facility and load status and measurements, specific facility modeling data, and device lists''). \113\ Trade Associations Comments at 21-22; APPA Comments at 20. \114\ Tallgrass Comments at 3. \115\ INGAA Comments at 3. --------------------------------------------------------------------------- 68. APS requests clarification on whether the criteria for re- designating CEII are the same as the criteria used for the initial CEII designation.\116\ --------------------------------------------------------------------------- \116\ APS Comments at 12. --------------------------------------------------------------------------- 69. NRECA and ITC assert that the NOPR is unclear with respect to the notice and comment provisions pertaining to a determination to remove CEII designations. In particular, they urge the Commission to clarify that submitters will receive notice, an opportunity to comment, and appeals rights prior to any determination to remove a CEII designation and prior to any disclosure of the information.\117\ ITC also states that the NOPR proposal to ``notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing prior to the removal of the designation'' is insufficient notice. ITC asks the Commission to provide notice and an opportunity to comment not only to the ``person who submitted the document'' but also to the organization on whose [[Page 93740]] behalf the person submitted the document.\118\ --------------------------------------------------------------------------- \117\ NRECA Comments at 11; ITC Comments at 3-4. \118\ ITC Comments at 3. --------------------------------------------------------------------------- 70. APPA requests that the Commission revise the language in amended section 388.113(e) to ensure that designations made by DOE cannot be removed by the Commission.\119\ --------------------------------------------------------------------------- \119\ APPA Comments at 26. --------------------------------------------------------------------------- Commission Determination 71. The Commission adopts the NOPR proposal to treat expired CEII as non-public until a re-designation determination is made. Such a process is supported by the majority of commenters and is reasonable given the large volume of CEII presently in the Commission's files and anticipated to be filed. Consistent with the NOPR's intent, the Commission will modify the regulatory language in amended section 388.113(e) to indicate that the Commission will treat information as non-public after the CEII designation has lapsed; that no information will be released as non-CEII unless the Commission decides to release the information; and that notice and opportunity for comment will be provided to the submitter prior to any determination that the CEII designation of a submitted document should be removed. 72. We do not adopt the recommendations to automatically re- designate information, designate by category, or designate for the lifetime of a facility. Blanket designations are inconsistent with FPA section 215A(d)(9), which requires the Commission to specifically re- designate information.\120\ --------------------------------------------------------------------------- \120\ Section 215A(d)(9) states that information ``may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.'' FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. --------------------------------------------------------------------------- 73. In response to ITC's comments that providing notice to the person who submitted the document is insufficient, we clarify that the Commission will provide the person and/or the organization identified on the submission notice an opportunity to comment as well as appeal rights prior to any determination to rescind a CEII designation or release the information.\121\ --------------------------------------------------------------------------- \121\ The Commission will use the relevant service list, where appropriate, to determine the appropriate recipient. --------------------------------------------------------------------------- 74. With respect to APPA's comments regarding the Commission's ability to remove a DOE designation, we clarify that the Commission does not intend to remove any designations that DOE may make. With respect to APS's request for clarification regarding re-designations, we clarify that the regulations adopted herein do not differentiate between the processes for designating or re-designating information as CEII. 7. Judicial Review of Designation NOPR 75. The Commission proposed to require a person seeking to challenge a Commission designation determination to file an administrative appeal with the Commission's General Counsel prior to seeking judicial review in federal district court under section 215A(d)(11).\122\ --------------------------------------------------------------------------- \122\ NOPR, 155 FERC ] 61,278 at P 28. --------------------------------------------------------------------------- Comments 76. HRC contends that the Commission's administrative appeal requirement should not be mandatory.\123\ NRECA asserts that the Commission does not have a legal basis for the administrative appeal requirement.\124\ NRECA also recommends that the regulations specify the timeframes in which appeals can be pursued; a timeframe for when a decision on the appeal should be rendered; and that the designation will remain in place until legal challenges have been exhausted.\125\ --------------------------------------------------------------------------- \123\ HRC Comments at 3. \124\ NRECA Comments at 11; HRC Comments at 3-4. \125\ Id. --------------------------------------------------------------------------- 77. NRECA contends that the Commission must revise the delegation authority provisions in section 375.313 to allow the General Counsel to hear and decide an administrative appeal.\126\ --------------------------------------------------------------------------- \126\ NRECA Comments at 12. --------------------------------------------------------------------------- Commission Determination 78. With respect to NRECA and HRC's comment, Congress directed the Commission to establish criteria and procedures to designate information as CEII, and the mandatory appeal to the Commission's General Counsel is a procedure that will assist in proper designation of such information. Requiring a party to exhaust administrative remedies prior to taking a matter to court is a standard and basic function of administrative law.\127\ The administrative appeal process gives the Commission an opportunity to correct any error and to ensure that Commission policy has been properly complied with. This process creates efficiency in the administrative process and promotes judicial economy. In addition, the current FOIA and CEII process provides for administrative appeal.\128\ --------------------------------------------------------------------------- \127\ See Hidalgo v. FBI, 344 F.3d 1256, 1258-59 (D.C. Cir. 2003) (holding that ``exhaustion of administrative remedies is generally required before filing suit in federal court so that the agency has an opportunity to exercise its discretion and expertise on the matter and to make a factual record to support its decision''). \128\ NOPR, 155 FERC ] 61,278 at P 28. --------------------------------------------------------------------------- 79. In response to NRECA's suggestion regarding appeal timeframes, the Commission will revise the amended regulations at section 388.113(j) to provide more specificity about the process for submitting an administrative appeal. After receiving a determination that information no longer qualifies as CEII, a submitter may appeal that determination. To make an appeal, the submitter must file a notice of appeal to the General Counsel, copying the CEII Coordinator, within 5 business days of the date of the determination.\129\ A statement in support of the appeal (a statement providing applicable facts and legal authority) must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the appeal. A determination denying a request for disclosure or denying a request to designate a document as public may also be appealed. A notice of appeal is not required for these determinations because information would not be disclosed under the challenged decision. However, the requester must submit an appeal within 20 business days of the date of the determination by submitting its statement in support of its appeal to the Commission's General Counsel.\130\ The General Counsel or the General Counsel's designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal, unless extended pursuant to section 388.110(b)(1), which will equally apply to CEII for purposes of appeals. --------------------------------------------------------------------------- \129\ Requiring the submitter to inform the Commission of its intent to appeal within 5 business days will allow the Commission to know sooner than later whether the submitter plans to challenge the decision and, if not, allow the Commission to disclose the information sooner. \130\ The Trade Associations suggest that the Commission should issue an order on appeal of any denial of an information owner's objections to disclosure of CEII pursuant to a NDA. Trade Association Comments at 20. Under our current practice, the decision to disclose CEII pursuant to a NDA is appealable directly to a district court under 5 U.S.C. 552(a)(4)(B). There is no need to establish an additional procedure under the amended regulations that requires the Commission to issue an order on appeal. --------------------------------------------------------------------------- 80. To avoid any uncertainty, the Commission will amend section 375.309 to include a provision to make clear that the Commission has delegated to the General Counsel authority to make determinations on behalf of the [[Page 93741]] Commission on appeals of designations and determinations regarding CEII. C. Duty to Protect CEII NOPR 81. The Commission proposed revisions to strengthen the handling requirements for Commission employees and external recipients of CEII. With respect to Commission staff, the Commission proposed to add section 388.113(h) to require Commissioners, Commission staff, and Commission contractors to comply with the Commission's internal controls.\131\ For external recipients of CEII, the Commission proposed requiring requesters to provide specific information to demonstrate a legitimate need for the information and to include a signed statement attesting to the accuracy of the information provided in any CEII request.\132\ The Commission also proposed that all NDAs minimally require that CEII: (1) will only be used for the purpose it was requested; (2) may only be discussed with authorized recipients; (3) must be kept in a secure place in a manner that would prevent unauthorized access; and (4) must be destroyed or returned to the Commission upon request. The Commission also proposed that the NDA make clear that the Commission may audit compliance with the NDA. --------------------------------------------------------------------------- \131\ NOPR, 155 FERC ] 61,278 at P 30. \132\ Id. PP 33-34. Specifically, the Commission proposed to require a requester to demonstrate: (1) the extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) whether the information is needed expeditiously. Id. --------------------------------------------------------------------------- Comments 82. The Trade Associations request that the Commission provide further details of the content and nature of the internal controls and include them in the Commission's regulations.\133\ MISO agrees that the Commission should have internal controls and notes that the internal controls should be enforced.\134\ --------------------------------------------------------------------------- \133\ Trade Associations Comments at P 36-37. The Trade Associations also state that the Commission should consider expounding on recommendations from the DOE IG. \134\ MISO Comments at 8. --------------------------------------------------------------------------- 83. Several commenters request that the Commission expand the list of minimum requirements for a NDA. MISO and NRECA note that the NOPR recognizes the need for requesters to protect CEII after the designation has lapsed and recommend that the duty to protect expired CEII be included in the minimum NDA requirements.\135\ MISO, the Trade Associations and APS recommend that the Commission require recipients to report all unauthorized disclosures.\136\ NERC recommends adding to the NDA a requirement that a recipient must destroy or return CEII by specific deadlines.\137\ NERC and the Trade Associations request that submitters be able to enforce the terms of a NDA that covers the submitter's CEII.\138\ --------------------------------------------------------------------------- \135\ MISO Comments at 8; NRECA Comments at 10. \136\ MISO Comments at 9; Trade Associations Comments at 26; APS Comments at 10. \137\ NERC Comments at 14. \138\ NERC Comments at 14; Trade Associations Comments at 26. --------------------------------------------------------------------------- 84. In addition to the NDA recommendations stated above, the Trade Associations request that the Commission add the following clauses to the NDA: (1) Recipients of CEII shall have information protection policies and procedures to protect the CEII; and (2) an officer of the recipient's organization, on behalf of the organization, as well as all individuals who will have access to the CEII, shall execute the NDA, which shall specify that the individuals and organization face sanctions for failure to honor the terms of the NDA.\139\ --------------------------------------------------------------------------- \139\ Trade Associations Comments at 26. --------------------------------------------------------------------------- 85. APS encourages the Commission to review the current NDA for potential gaps, such as the lack of an obligation to treat CEII with the same degree of care as a requester would treat its own confidential or proprietary information.\140\ NRECA asks the Commission to clarify that a NDA is required when an entity receives CEII after the designation expires.\141\ --------------------------------------------------------------------------- \140\ APS Comments at 9-10. \141\ NRECA Comments at 10. --------------------------------------------------------------------------- 86. Peak seeks clarification regarding the requirements for keeping CEII in a secure place and manner.\142\ Peak explains that recipients of CEII may have different views of what constitutes a ``secure place.''\143\ --------------------------------------------------------------------------- \142\ Peak Comments at 14-15. \143\ Id. --------------------------------------------------------------------------- 87. The Trade Associations recommend that the Commission adopt a monitoring and enforcement process to discourage unauthorized disclosures and ask for additional language clarifying that ``any person or entity found to have used or disclosed CEII in a manner inconsistent with the NDA will lose its access to CEII for an extended period of time.'' \144\ The Trade Associations and NRECA suggest that the Commission determine that noncompliance with the NDA would subject an individual to penalties of up to $1 million per violation per day.\145\ --------------------------------------------------------------------------- \144\ Trade Associations Comments at 34. \145\ Trade Associations Comments at 35; NRECA Comments at 16- 17. --------------------------------------------------------------------------- 88. NERC requests that the Commission ensure that requesters have not been convicted of criminal activity by performing background checks, reviewing watch lists, and verifying security clearances to prevent inadvertent disclosures of CEII to a person with a criminal record or who is under investigation or on a terrorist watch list.\146\ --------------------------------------------------------------------------- \146\ NERC Comments at 13-14. --------------------------------------------------------------------------- 89. NERC also proposes that the Commission include evidentiary criteria to determine whether a requester of CEII is legitimate, and the Trade Associations ask the Commission to conduct risk assessments on all requesters.\147\ --------------------------------------------------------------------------- \147\ NERC Comments at 12-14; Trade Associations Comments at 33. --------------------------------------------------------------------------- 90. APS urges the Commission to require all requests to include at least two business references and the submission of documentation of authority for organizational requesters.\148\ Peak requests that if a CEII request is not for participation in a specific proceeding, the requester should be required to include in its statement of need a ``reliability or societal benefit.'' \149\ --------------------------------------------------------------------------- \148\ APS Comments at 7-8. \149\ Peak Comments at 14. --------------------------------------------------------------------------- Commission Determination 91. We disagree with the Trade Associations' recommendation that we provide additional details regarding internal controls and that we include internal controls in the Commission's regulations. The NOPR stated that the internal controls will address ``how sensitive information, including CEII, should be handled, marked, and kept.''\150\ We find that this statement provides sufficient details regarding the nature of the internal controls. We also conclude that internal controls should not be specified in the Commission's regulations to allow Commission staff the flexibility to revise such controls as needed.\151\ --------------------------------------------------------------------------- \150\ NOPR, 155 FERC ] 61,278 at P 30. \151\ In developing this Final Rule and the internal controls, the Commission has been cognizant of the recommendations of the DOE Inspector General Report from January 30, 2015 as well as the Commission's earlier response thereto, which are a matter of public record. See Department of Energy, Office of Inspector General, Inspection Report, Review of Controls for Protecting Nonpublic Information at the Federal Energy Regulatory Commission, DOE/IG-0933 (January 2015), http://energy.gov/ig/downloads/inspection-report-doeig-0933. --------------------------------------------------------------------------- 92. Amended section 388.113(h)(2) only includes ``minimum'' requirements [[Page 93742]] for a NDA and is not intended to be exhaustive or preclude other requirements. Under certain circumstances the Commission may add additional provisions to the NDA and submitters may request that additional provisions be added to the NDA. 93. In response to MISO's and NRECA's comments, the Commission will amend section 388.113(h)(2) to require a recipient of CEII under a NDA to protect the CEII after a designation lapses as part of the list of minimum requirements of a NDA. In response to the comments by MISO, the Trade Associations and APS, we will also amend section 388.113(h)(2) to add an obligation to require CEII recipients to promptly report all unauthorized disclosures of CEII to the Commission. 94. In response to NRECA's concern, the Commission clarifies that a requester seeking information past the expiration of the CEII designation marked on the information must still pursue the information through the CEII or FOIA processes. We read NRECA's comments to apply to situations where an entity requests information that has been submitted to the Commission more than five years prior to the request and the Commission has not made a determination to re-designate the information. In these situations, the CEII Coordinator will make a re- designation determination as part of the response to a request seeking access to information that has a designation determination older than five years. If the information is re-designated as CEII, then it will be processed pursuant to the Commission's requirements for CEII. 95. The Commission is not persuaded by Peak's comments that there is a need to clarify what constitutes maintaining CEII in a secure place. We believe that a ``secure place,'' as articulated in the NDA, has a well-understood meaning, i.e. safe or free from unauthorized access or a risk of loss. 96. The Commission believes that it has sufficient authority to enforce the terms of the NDA and, as a result, it is unnecessary to confer on NERC or others authority to enforce the terms of a NDA. 97. In response to the comments of the Trade Associations and NRECA, the Commission notes that the FAST Act does not require the Commission to develop sanctions for external recipients of CEII. In any event, the general CEII NDA already states that a violation of the NDA may result in civil sanctions for an external recipient of CEII, and it will continue to do so. It is not necessary to list all the various civil sanctions that may apply, as each matter would be reviewed on its own facts. For these reasons, we also decline to adopt the Trade Associations' recommendation that we add to the minimum requirements of a NDA a provision that CEII recipients may be sanctioned by losing access to CEII for an extended period of time. 98. The Commission agrees that it is important to ensure that requesters of CEII do not pose security risks. CEII requesters have historically fallen into different categories, including individuals known to the Commission with no known risk.\152\ The Commission will continue the practice of requiring information needed to verify the legitimacy of a requester on an as-needed basis. As such, there is no need for a CEII requester to demonstrate that there is a ``reliability or social benefit'' to the request. We believe that our procedures have adequately assessed whether requestors should receive CEII. In addition, we propose additional requirements for a requester to obtain CEII information. Thus, given these procedures, it is not necessary to mandate specific background check criteria in the regulations. Moreover, while the current request form asks for a business reference, we are not persuaded that such a submission is necessary in all instances or that two references are necessary.\153\ --------------------------------------------------------------------------- \152\ Requests are typically received from public utilities, gas pipelines, hydro developers, academics, landowners, public interest groups, researchers, renewable energy organizations, and consultants. \153\ Electronic CEII Request Form, http://www.ferc.gov/resources/guides/filing-guide/ceii-request.asp. --------------------------------------------------------------------------- D. Sanctions NOPR 99. Section 215A(d)(2)(C) of the FPA requires the Commission to ``ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or DOE who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section.'' \154\ The Commission proposed sanctioning unauthorized disclosures of CEII by Commission personnel and further noted that DOE will have responsibility for sanctions for unauthorized disclosures by its officers and employees.\155\ The Commission also proposed to refer any misconduct by the Chairman or Commissioners to the DOE Inspector General (DOE IG).\156\ --------------------------------------------------------------------------- \154\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. \155\ NOPR, 155 FERC ] 61,278 at P 36. \156\ Id. --------------------------------------------------------------------------- Comments 100. Several commenters, including APPA and the Trade Associations, point to the absence of stated sanctions for Commissioners in the NOPR and request that the Commission consider whether to impose civil sanctions under section 316A of the FPA and criminal penalties under section 316(b) of the FPA.\157\ APPA also recommends that the Commission consider referring unauthorized CEII disclosures by Commissioners to the Department of Justice (DOJ) and that the Commission coordinate with DOE to outline a new or cite an existing procedure that DOE can utilize to sanction its employees.\158\ MISO suggests that the Commission's General Counsel be tasked with referring any willful, unauthorized disclosures to the DOE IG.\159\ NRECA asks that a mechanism be put in place for the public to make a referral to the DOE IG if they are aware of any misconduct.\160\ MISO and NRECA recommend that the Commission revise its proposed rule to make clear that the Commission ``shall'' refer any misconduct to the DOE IG and to allow the public to refer matters to the DOE IG.\161\ --------------------------------------------------------------------------- \157\ See Trade Associations Comments at 40 (noting that CEII protections adopted in the FAST Act were adopted in the context of what many considered to be an inappropriate disclosure of CEII by a former FERC Commissioner); see also APPA Comments at 28. APPA states that the Commission has authority to impose civil penalties against ``any person'' who violates any provision of any Commission rule and may use criminal penalties under FPA section 316(b) for knowing and willful violations, by ``any person'' of Commission rules or regulations under the FPA. \158\ APPA Comments at 27, 29. APPA also asserts that a DOE employee sanctioned for unauthorized disclosure may be able to challenge their sanction ``on grounds that it was not promulgated by the Commission, as directed by Congress.'' \159\ MISO Comments at 10. \160\ NRECA Comments at 16. \161\ MISO Comments at 10; NRECA Comments at 16. --------------------------------------------------------------------------- Commission Determination 101. As discussed below, we conclude that the sanctions adopted in this Final Rule, as well as other reforms adopted prior to the passage of the FAST Act, provide sufficient deterrents to the unauthorized disclosure of CEII. 102. First, we note that, in addition to the changes adopted in this Final Rule, the Commission has recently made a number of changes to its internal procedures to ensure the protection and security of CEII. 103. The Commission has revised its security classification and ethics training to ensure that Commission employees are aware of their responsibility to protect sensitive [[Page 93743]] nonpublic information. The Commission also has strengthened its protection of CEII and other sensitive, non-public information. For example, the Commission conducted a comprehensive review of its internal information governance procedures, which informed the development of the internal controls referenced in this Final Rule. We believe that these reforms should help protect against unauthorized disclosure of CEII. 104. The Commission has also taken steps to ensure that there are appropriate sanctions in place for certain persons who knowingly and willfully disclose CEII without authorization. With respect to former employees and Commissioners, the Commission has strengthened certain requirements applicable to departing employees and Commissioners by requiring them to certify that they are not unlawfully removing records from the agency. This certification form also identifies and requires a departing employee or Commissioner to acknowledge the potential criminal penalties associated with the unlawful removal or destruction of federal records. While these changes pre-date the passage of the FAST Act, they are an important component of the Commission's ongoing efforts to protect against improper disclosure of CEII. 105. As to existing Commission officers, employees, and agents, we conclude that the sanctions adopted in this Final Rule are appropriate, as they provide for possible dismissal from federal service and criminal prosecution for improper disclosure of CEII. These sanctions should serve as a deterrent to, and punishment for, improper activity. 106. With respect to Commissioners, we believe it is appropriate that violations be referred to the DOE IG, as that office is equipped to investigate a Commissioner's actions and impose sanctions on a Commissioner through an independent process outside of the Commission's enforcement process.\162\ For example, it is within the DOE IG's discretion after concluding its investigation to refer a matter to the DOJ for criminal prosecution. Upon becoming aware of a potentially improper disclosure of CEII, the Designated Agency Ethics Official (DAEO) will oversee an examination of those circumstances. If there is reason to believe that an improper disclosure has occurred, the DAEO will refer the matter to the DOE IG. --------------------------------------------------------------------------- \162\ We note that no commenter has indicated that the DOE IG has insufficient tools to investigate and, as appropriate, pursue sanctions for a Commissioner. --------------------------------------------------------------------------- 107. Finally we conclude that there is no need to add a mechanism to our regulations for the public to make a referral to the DOE IG, as the DOE IG has an existing hotline in place for the public.\163\ The Commission will also continue to defer to DOE as to what sanctions would be appropriate for DOE officers and employees. --------------------------------------------------------------------------- \163\ See DOE IG Hotline, http://www.energy.gov/ig/services. --------------------------------------------------------------------------- E. Voluntary Sharing of CEII NOPR 108. Section 215A(d)(2)(D) of the FPA requires the Commission, taking into account standards of the Electric Reliability Organization, to facilitate voluntary sharing of critical electric infrastructure information. The statute, specifically, directs the Commission to facilitate voluntary sharing with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission.\164\ --------------------------------------------------------------------------- \164\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. --------------------------------------------------------------------------- 109. The Commission proposed that it would voluntarily share Commission-generated CEII and CEII submitted to the Commission with individuals or organizations when there is a need to ensure that energy infrastructure is protected.\165\ Under this proposal, the Commission may voluntarily share CEII without receiving a request for the CEII.\166\ However, the NOPR proposed that all voluntarily shared CEII would be shared subject to an appropriate NDA or Acknowledgement and Agreement.\167\ Additionally, the NOPR proposed to require an Office Director or his designee to consult with the CEII Coordinator before voluntarily sharing CEII.\168\ --------------------------------------------------------------------------- \165\ NOPR, 155 FERC ] 61,278 at PP 37-38, 40. \166\ Id. P 38. \167\ Id. P 40. \168\ Id. P 39. --------------------------------------------------------------------------- 110. In the NOPR, the Commission also noted that it retains the discretion to release information as necessary for other federal agencies to carry out their jurisdictional responsibilities.\169\ --------------------------------------------------------------------------- \169\ Id. --------------------------------------------------------------------------- 111. The NOPR also proposed that the Commission may impose additional restrictions on how voluntarily shared CEII may be used and maintained.\170\ Where practicable, the Commission proposed providing notice of its voluntary sharing of CEII to the submitter of the CEII.\171\ --------------------------------------------------------------------------- \170\ Id. P 41. \171\ Id. P 42. The Commission noted that it may not be practicable to provide notice to the submitter in instances where voluntary sharing is necessary to maintain infrastructure security, to address a potential threat, or in other exigent circumstances. --------------------------------------------------------------------------- Comments 112. Several commenters observe that the NOPR only addressed the Commission's voluntary sharing of CEII and did not establish guidelines for the voluntary sharing of CEII ``with, between, and by'' other entities.\172\ Powerex requests that the Commission facilitate the sharing of CEII between and by owners, operators, and users of the critical electric infrastructure, while still adequately safeguarding CEII.\173\ The Public Interest Organizations and WIRAB recommend that the Commission adopt a ``white list'' of CEII requesters that the Commission determines do not pose a risk of unauthorized disclosure.\174\ They also contend that the Commission should adopt a universal NDA to encourage more sharing between and by non-Commission entities.\175\ WIRAB also seeks standardization of NDAs used by NERC, regional entities, and the owners and operators of Critical Electric Infrastructure in the United States.\176\ --------------------------------------------------------------------------- \172\ See, e.g., Peak Comments at 5-6; Powerex Comments at 13- 14; APPA Comments at 31; NRECA Comments at 13. \173\ Powerex Comments at 13-15. \174\ Public Interest Organizations Comments at 8-9; WIRAB Comments at 9. \175\ Id. \176\ WIRAB Comments at 10. --------------------------------------------------------------------------- 113. The Joint RTOs (ISO New England, Inc. and Southwest Power Pool, Inc.) suggest that the Commission facilitate the sharing of CEII by permitting regional transmission organizations (RTOs), independent system operators (ISOs), and other entities with FERC-approved tariffs or similar agreements to share CEII ``between the entities relying on their tariff information-handling commitments.'' \177\ In response, PJM states that the Commission should reject the Joint RTOs' proposal, arguing that it is incomplete and overbroad and fails to acknowledge results achieved through the current sharing of CEII.\178\ The Joint RTOs, in reply comments, state that their proposal would simply allow ISOs, RTOs, and other entities with [[Page 93744]] Commission-approved tariffs that have planning and operations responsibilities to use those tariffs to facilitate information- sharing.\179\ --------------------------------------------------------------------------- \177\ Joint RTOs Comments at 4. MISO also suggests the Commission encourage sharing between planning authorities and transmission planners. See MISO Comments at 10. \178\ PJM Reply Comments at 2. \179\ Joint RTOs Reply Comments at 2. --------------------------------------------------------------------------- 114. NERC generally supports the Commission's proposal to facilitate voluntary information sharing with NERC, regional entities and information sharing and analysis centers. NERC, nonetheless, requests that the Commission, under appropriate circumstances, share CEII with the Electricity Information Sharing & Analysis Center (E- ISAC) when voluntarily sharing CEII with a governmental entity.\180\ NERC asks that the voluntary sharing process include coordination between the CEII Coordinator and certain Commission office staff prior to any disclosure.\181\ --------------------------------------------------------------------------- \180\ NERC Comments at 9. \181\ Id. --------------------------------------------------------------------------- 115. APS, the Trade Associations and CEA ask for additional criteria as to how and when the Commission will voluntarily share information.\182\ --------------------------------------------------------------------------- \182\ APS Comments at 13; Trade Associations Comments at 27; CEA Comments at 5. --------------------------------------------------------------------------- 116. APPA asserts that FPA 215A(d)(2)(D) directs the Commission only to facilitate voluntary sharing of CEII among electricity subsector stakeholders--not to preemptively share CEII with interested parties.\183\ APPA asserts that when the Commission voluntarily shares submitted information, it effectively forces the entity that submitted the information as CEII to share its information with others, which may reduce the incentive for the entity to voluntarily share CEII with the Commission.\184\ APPA recommends that the Commission designate E-ISAC and any other appropriate Information Sharing and Analysis Organizations (ISAOs) as forums through which CEII can be shared under FPA 215A, and to apply the liability protections of FPA section 215A(f)(3) to those entities.\185\ APPA also recommends that the Commission provide protections like those that are utilized by other federal agencies to facilitate information sharing activity.\186\ --------------------------------------------------------------------------- \183\ APPA Comments at 30. \184\ Id. \185\ APPA Comments at 31-32. \186\ Id. at 31-32. For example, APPA proposes that the Commission allow for ``source anonymizing'' shared CEII or to adopt DHS's Traffic Light Protocol to ensure information is shared with the correct audience. --------------------------------------------------------------------------- 117. The Trade Associations request that the regulations explicitly state that the voluntary sharing of CEII is limited to instances where the Commission has determined that there is a need to ``ensure that energy infrastructure is protected.'' \187\ --------------------------------------------------------------------------- \187\ Trade Associations Comments at 27-28. --------------------------------------------------------------------------- 118. CEA requests that the Commission include language clarifying that the Commission will make every reasonable effort to provide advance notice before sharing CEII and will provide after-the-fact notice if prior notice is not practical.\188\ MISO recommends that the Commission adopt regulatory language indicating that ``when prior notice is not given, submitters of CEII shall receive notice of a limited release of CEII as soon as practicable.'' \189\ NRECA requests that the Commission clarify that any disclosure by the Commission on the basis of ``voluntary sharing'' must be subject to the same notice, comment, and appeal rights provisions that are afforded to submitters in response to CEII requests.\190\ --------------------------------------------------------------------------- \188\ CEA Comments at 6. NRECA also references the need to provide notice as soon as possible, even if such notice is after the disclosure. See NRECA Comments at 12. \189\ MISO Comments at 11. \190\ NRECA Comments at 12-13. --------------------------------------------------------------------------- 119. The Trade Associations state that the proposed regulations could be strengthened by: (1) Limiting and defining the circumstances where notice would ``not be practicable''; and (2) allowing the submitters an opportunity to provide comments protesting the release of information the Commission proposes to voluntarily share.\191\ --------------------------------------------------------------------------- \191\ Trade Associations Comments at 30. --------------------------------------------------------------------------- 120. Finally, TAPS requests that the Commission revise its delegations to reflect the NOPR's proposal that Office Directors will engage in voluntary sharing.\192\ --------------------------------------------------------------------------- \192\ TAPS Comments at 12-13. --------------------------------------------------------------------------- Commission Determination 121. Many of the commenters misapprehend how CEII may be voluntarily shared under the FAST Act or otherwise seek to expand the Commission's CEII sharing program in ways that neither the FAST Act nor the NOPR contemplated. Under FPA section 215A(a)(3), CEII is limited to information that is submitted to, or generated by, the Commission and designated as such by the Commission (or information submitted to, or generated by DOE, and designated as such by DOE).\193\ In voluntarily releasing CEII to a person, the Commission imposes obligations on that person through a NDA. However, the Commission's CEII rules do not, and are not intended to, address information that an entity has unilaterally determined to be CEII and never submitted to the Commission.\194\ In addition, the Commission's regulations do not cover an entity that has submitted CEII to the Commission but intends to share the same information with others outside of the Commission's processes. To be clear, an entity that receives CEII from the Commission is subject to the restrictions in the applicable NDA, including restrictions on use and disclosure. However, an entity that submitted the information to the Commission is not subject to a NDA and, as a result, the Commission's rules do not apply to how that entity may want to share its information.\195\ Moreover, an entity may have information that could qualify as CEII, but such information is not CEII under the Commission's regulations unless it has been submitted to the Commission pursuant to the Commission's CEII regulations and the Commission has determined it to be CEII. --------------------------------------------------------------------------- \193\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1773 (``critical electric infrastructure information means information . . . generated by or provided to the Commission or other Federal agency . . . that is designated as critical electric infrastructure information by the Commission or the Secretary pursuant to subsection (d)''). \194\ As CEII information has to be designated by the CEII Coordinator or DOE Secretary, information that an entity creates and maintains without providing to the Commission has not been formally designated as CEII. \195\ However, other concerns may influence how the entity shares its own information with others. --------------------------------------------------------------------------- 122. The Final Rule facilitates voluntary sharing by allowing the public to request CEII and by adding to the Commission's regulations a process whereby staff may share CEII in a proactive manner with a variety of entities. The Commission agrees with PJM's comments that existing non-public voluntary sharing mechanisms within the energy industry are sufficient to encourage sharing information among the different groups and therefore there is no need for the Commission to establish requirements for sharing within the industry through tariff revisions or otherwise.\196\ It is also unnecessary to adopt Public Interest Organizations' and WIRAB's recommendation that the Commission establish ``whitelists'' for third parties to use or to require entities sharing information outside of the Commission's CEII process to adopt a particular NDA. --------------------------------------------------------------------------- \196\ Section 215A(d) requires the Commission ``to promulgate [- ] regulations as necessary'' to, inter alia, ``facilitate voluntary sharing of critical electric infrastructure information.'' FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. The FAST Act, therefore, affords the Commission with discretion in this regard and, at least implicitly, recognizes that the Commission may, identify, encourage and support existing processes to facilitate the voluntary sharing of CEII. --------------------------------------------------------------------------- [[Page 93745]] 123. The Commission agrees with NERC and APPA that the plain language of the statute expressly provides for the voluntary sharing of information with entities like E-ISAC and other ISAOs. Section 215A(d)(2)(iv) concerns the voluntary sharing of CEII with, between, and by ``information sharing and analysis centers established pursuant to Presidential Decision Directive 63.'' Pursuant to that provision, the Commission anticipates voluntary sharing of information with, between and by E-ISAC and other ISAOs under the appropriate circumstances. Under our current NDAs, CEII recipients may share CEII with other individuals covered by a NDA for the same information.\197\ When information is provided in accordance with section 215A(d) the provisions for release from liability in section 215A(f)(3) would apply. --------------------------------------------------------------------------- \197\ See, e.g., Critical Energy Infrastructure Information General Non-Disclosure Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf (``A Recipient may only discuss CEII with another Recipient of the identical CEII. A Recipient may check with the CEII Coordinator to determine whether another individual is a Recipient of the identical CEII.''). --------------------------------------------------------------------------- 124. The Commission disagrees with APPA that E-ISAC or another ISAO should be designated as a forum to share CEII. The FAST Act does not specify that the Commission should designate E-ISAC, another ISAO, or any other entity as a forum through which CEII can be shared under section 215A. In fact, a plain reading of the statute indicates that Congress designated the Commission as the entity to facilitate this sharing. As such, the Commission declines to take the recommendation of APPA. 125. We disagree with APPA's assertions that the voluntary sharing provision in the Commission's regulations effectively requires entities to share CEII with another entity or the Commission.\198\ Section 215A(d)(6) explicitly states that an entity is not required to share CEII with the Commission or another entity or person.\199\ The voluntary sharing provision does not impose a sharing requirement on entities; instead, it allows the Commission discretion to share, in certain circumstances, CEII that has already been submitted to, or generated by, the Commission. --------------------------------------------------------------------------- \198\ FAST Act, Public Law 114-94, 61,003, 129 Stat. 1312, 1777. \199\ Id. --------------------------------------------------------------------------- 126. Even if the Commission's voluntary sharing of information were viewed as the same as a third-party sharing it, the Commission must balance its obligation to disclose information as necessary to carry out its jurisdictional responsibilities against an entity's possible preference not to have such information disclosed.\200\ The regulations adopted here achieve that balance. Furthermore, the FAST Act does not place limits on the Commission's ability to share information in its possession when authorized and necessary to carry out the requirements of the FAST Act or the Commission's other jurisdictional responsibilities. --------------------------------------------------------------------------- \200\ The FAST Act does not prohibit the Commission from disclosing any information, nor does it require an entity to produce any information. FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1777. --------------------------------------------------------------------------- 127. As noted in the NOPR, in some circumstances, providing notice to a submitter of CEII that its information will be shared under section 215A could hamper the ability of the Commission to act in a timely way.\201\ The Commission, therefore, disagrees with the comments by APPA and NRECA that prior notice must be provided in each instance where the Commissions uses the voluntary sharing provisions of section 215A. However, in response to the comments, the Commission clarifies in amended section 388.113(f) that the Commission will not provide advanced notice only in situations where there is an urgent need to disseminate the information. The Commission will also adopt MISO's and CEA's proposal that when prior notice is not given, the Commission will provide submitters of CEII whose information was shared with notice as soon as practicable. --------------------------------------------------------------------------- \201\ NOPR, 155 FERC ] 61,278 at P 38. --------------------------------------------------------------------------- 128. The NOPR proposed to require that a consultation between the CEII Coordinator and the appropriate Office Director take place prior to any voluntary sharing of CEII. We disagree with NERC's proposal to add a requirement that staff from the Commission's Office of Electric Reliability (OER) and Office of Energy Infrastructure Security (OEIS) be involved in all voluntary sharing consultations because the information in question may not involve OEIS or OER subject matter. However, we note that the CEII Coordinator will consult with Commission staff as appropriate, which could include OER and OEIS staff. The Commission is also not persuaded that it is necessary to provide additional details regarding the factors the Commission will use to determine when voluntary sharing is appropriate. The NOPR specifically proposed that the Commission will voluntarily share ``CEII with individuals and organizations that the Commission has determined need the information to ensure that energy infrastructure is protected.'' \202\ Thus, the NOPR provided sufficient details on the circumstances in which the Commission will voluntarily share CEII. Providing more details may unnecessarily restrict the Commission's ability to voluntarily share needed information. --------------------------------------------------------------------------- \202\ NOPR, 155 FERC ] 61,278 at P 37. --------------------------------------------------------------------------- 129. The Commission disagrees with APPA's suggestion that the regulations should include more developed protections to facilitate information sharing.\203\ The Commission believes that procedures outlined in the NOPR are sufficient to protect CEII that the Commission shares. When the Commission voluntarily shares information, CEII will be shared subject to an appropriate NDA or Acknowledgement and Agreement.\204\ Moreover, under section 388.113(f), the Commission may impose additional conditions on how the information may be used and maintained that the Commission voluntarily shares. --------------------------------------------------------------------------- \203\ Id. PP 31-32 \204\ As noted below, to obtain CEII federal agencies execute an Acknowledgement and Agreement, as opposed to a NDA. See Federal Agency Acknowledgement and Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf. --------------------------------------------------------------------------- 130. In response to TAPS's comment, the Commission finds that the CEII Coordinator delegation in section 375.313 is sufficient and does not require separate delegations for Office Directors to voluntarily share CEII. Moreover, existing section 388.113(d)(1) has allowed Commission staff to share Critical Energy Infrastructure Information with facility owners and operators. No such delegated authority has been used for such sharing. F. Request for Access to CEII NOPR 131. The Commission proposed to maintain special access procedures for owner-operators of facilities, federal agencies, and intervening parties.\205\ For intervenors, the Commission proposed to move the existing procedures in section 388.112 to section 388.113 and to eliminate the exemption for certain LNG materials.\206\ For general requesters, the Commission added a one-year time limit for organizational requests and added back a time requirement for the Commission to process CEII requests.\207\ The Commission also proposed adding a provision to clarify that the Commission's CEII regulations should [[Page 93746]] not be construed to require the release of certain non-CEII.\208\ --------------------------------------------------------------------------- \205\ NOPR, 155 FERC ] 61,278 at PP 43-49. \206\ Id. P 49. \207\ Id. PP 50-51. \208\ Id. P 52. --------------------------------------------------------------------------- Comments 132. APPA recommends that the Commission adopt a tiered system with varying levels of access restrictions.\209\ APPA and the Trade Associations suggest that the Commission create a distinct ``need to know'' standard to access information related to the bulk-power system.\210\ Under this suggested standard, CEII would only be disclosed when the person or entity seeking the information has a direct ``need to know'' in order to maintain reliability, safety, or security.\211\ --------------------------------------------------------------------------- \209\ APPA Comments at 19. \210\ APPA Comments at 18; Trade Associations Comments at 27. \211\ APPA Comments at 9; Trade Associations Comments at 27. --------------------------------------------------------------------------- 133. The Trade Associations recommend that if an academic institution or other members of the public request CEII, the Commission should deny the request and refer the request to the information owner.\212\ Peak, on the other hand, supports data sharing with researchers and asks the Commission to permit researchers to access CEII data.\213\ Peak also suggests that the Commission consider whether ``research institutions with defined cyber security and employee background checks'' should have a specific process for obtaining CEII.\214\ WIRAB supports the Commission's balancing approach for determining who should receive CEII, but WIRAB recommends that the Commission delete the portion of proposed section 388.113(g)(iv) that states that the Commission can deny a request for ``other reasons.'' \215\ --------------------------------------------------------------------------- \212\ Trade Associations Comments at 32. \213\ Peak Comments at 7-8. \214\ Id. at 14. \215\ WIRAB Comments at 8. --------------------------------------------------------------------------- 134. Peak recommends that the Commission's sharing of CEII with owners and operators should not be limited to information related to ``its own facility.'' \216\ --------------------------------------------------------------------------- \216\ Peak Comments at 13. --------------------------------------------------------------------------- 135. Public Interest Organizations support the NOPR's proposed revisions allowing certain LNG materials to be accessible in proceedings in which there is a right to intervention.\217\ Public Interest Organizations suggest that ``the Commission streamline the release of CEII data for intervenors by allowing one request to trigger release of all of an entity's CEII data.'' \218\ --------------------------------------------------------------------------- \217\ Public Interest Organizations Comments at 9. \218\ Id. at 9-10. --------------------------------------------------------------------------- 136. MISO notes that for purposes of consistency, the Commission should add language already in section 388.112(b)(iv) to amended section 388.113(g)(4) to ensure that, if an objection to a request for disclosure is filed, whether the information is privileged or CEII, ``the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority.'' \219\ --------------------------------------------------------------------------- \219\ MISO Comments at 4. --------------------------------------------------------------------------- 137. Peak asks the Commission to clarify whether the protections proposed in section 388.113(g)(2) regarding the obligation of federal agency recipients to protect CEII in the same manner as the Commission extends to data generated by a federal agency through an analysis of CEII.\220\ --------------------------------------------------------------------------- \220\ Peak Comments at 13. --------------------------------------------------------------------------- 138. APS requests that the Commission revise amended section 388.113(g)(5)(vi) to require organizational requesters to promptly update/remove individuals from their list of approved individuals.\221\ --------------------------------------------------------------------------- \221\ APS Comments at 11; see also Trade Associations Comments at 35. --------------------------------------------------------------------------- 139. The Trade Associations and APS state that they are concerned that amended section 388.113(g)(5)(v), which allows an individual under an organizational request to have access to CEII for the remainder of a calendar year, may result in a less robust verification system.\222\ WIRAB supports allowing requesters to maintain their validity for the duration of the calendar year.\223\ --------------------------------------------------------------------------- \222\ Trade Associations Comments at 35; APS Comments at 10-11. \223\ WIRAB Comments at 9. --------------------------------------------------------------------------- 140. INGAA asks for acknowledgment that the Commission approves of entities providing requested information directly to CEII requesters.\224\ INGAA also requests that proposed section 388.113(g)(5)(ix) be modified to add ``information on rare species of plants and animals'' to the list of items not required to be released through the CEII process.\225\ --------------------------------------------------------------------------- \224\ INGAA Comments at 4. \225\ Id. --------------------------------------------------------------------------- 141. Public Interest Organizations ask the Commission to establish a reasonable timeline for the review of and response to CEII requests.\226\ APS requests that the Commission add a default twenty- day time period to respond to CEII requests unless the information is needed in fewer than twenty days.\227\ NERC suggests that the Commission add a provision indicating that the Commission may toll the response time when there is a need to gather further information from the requester.\228\ --------------------------------------------------------------------------- \226\ Public Interest Organizations Comments at 10 (noting that it often takes 4-6 months to get access to Form No. 715 information through the existing Critical Energy Infrastructure Information process). \227\ APS Comments at 8. \228\ NERC Comments at 16 (citing 5 U.S.C. 552(a)(6)(B)(ii)). --------------------------------------------------------------------------- 142. NERC requests that the appeal rights available to requesters be made available to submitting entities to avoid disclosures that might place CEII at risk.\229\ TAPS asks for clarification that when conditions are imposed on a receipt of CEII, appeal rights will be granted.\230\ --------------------------------------------------------------------------- \229\ Id. at 18. \230\ TAPS Comments at 14. --------------------------------------------------------------------------- Commission Determination 143. APPA and the Trade Associations have not demonstrated a need for the Commission to change its practices and use a tiered system of categories of CEII or a heightened ``need to know'' standard for bulk- power system information. The Commission will continue to ``balance the requestor's need for the information against the sensitivity of the information.'' \231\ The Commission has utilized this balancing approach effectively in response to Critical Energy Infrastructure Information requests for almost fifteen years. The balancing approach has provided to individuals with a demonstrated need access to information subject to a NDA. However, in some instances, the Commission has balanced a requester's asserted need for the information against its sensitivity and has determined not to produce certain types of CEII to the requester. The Commission will continue this balancing approach under the Final Rule. --------------------------------------------------------------------------- \231\ Section 388.113(g)(5)(iii). --------------------------------------------------------------------------- 144. As noted above, the FAST Act does not require changes to the Commission's existing process for accessing information. The CEII Coordinator will continue to evaluate each request individually. In response to Peak's comments, the Commission notes that the current procedures allow academics to obtain CEII, and that the Commission does, as appropriate in individual rulemakings, consider whether certain categories of information should generally be made available for research.\232\ The Commission is not persuaded that any [[Page 93747]] changes should be made to restrict or expand access to CEII by academics. --------------------------------------------------------------------------- \232\ See, e.g., Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events, 156 FERC ] 61,215, at PP 93-95 (2016) (determining that geomagnetically induced current monitoring and magnetometer data will help facilitate geomagnetic disturbance research and concluding that such data typically should not be treated as confidential). --------------------------------------------------------------------------- 145. The Commission also disagrees with deleting the term ``other reasons'' from proposed section 388.113(g)(5)(iv) as there may be other legitimate reasons why the Commission would not permit access to certain CEII in particular situations. 146. The Commission is not persuaded that it needs to adopt Peak's proposed changes to the owner-operator provision. An owner-operator has a need to obtain CEII about its own facility. To the extent the owner- operator needs other CEII, it can pursue additional information through the regular CEII request process. 147. As to the comment by Public Interest Organizations, the Final Rule maintains the mechanism for interveners to request CEII outside of the CEII process.\233\ --------------------------------------------------------------------------- \233\ See section 388.113(g)(4). --------------------------------------------------------------------------- 148. The Commission agrees with MISO's change to proposed section 388.113(g)(4), and amends that provision to include all of the language that currently exists in section 388.112(b)(2)(iv) to ensure that if an objection to the disclosure of CEII is filed, the information will not be disclosed until directed by the Commission or a decisional authority. 149. In response to Peak's comments, the Commission clarifies that a federal agency in receipt of CEII from the Commission must protect that information in the same manner as the Commission. That agency will be required to execute an appropriate Agency Acknowledgment and Agreement. We clarify that derivative analyses that use or rely on CEII, without actually disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII.\234\ --------------------------------------------------------------------------- \234\ See supra P 64. --------------------------------------------------------------------------- 150. Recognizing that the employment status and circumstances surrounding an individual or organization can change, in response to APS's comment, the Commission will modify the NDAs to indicate that a recipient of CEII must promptly notify the Commission if any changed conditions, such as a change in employment, occur. 151. Amended section 388.113(g)(5)(v) recognizes that in some instances a requester may request CEII multiple times during a calendar year. In response to comments by APS and Trade Associations regarding the robustness of the requester verifications, the Commission clarifies that each request will be reviewed by balancing the needs of the requester against the sensitivity of the requested information. 152. In response to INGAA's request, the Commission notes that under the current CEII rules, entities may share information that they submitted to the Commission with a request for CEII treatment (as opposed to CEII that they received from the Commission) directly with other entities, and the Commission will continue to encourage and support such a practice. The Commission adopts INGAA's recommendation that ``information about rare species of plants and animals'' be added to the section 388.113(g)(5)(ix) list of items that are not required to be released when the information is inextricably intertwined with CEII. 153. In response to comments by Public Interest Organizations, the Commission is not persuaded that additional clarifications regarding timing are necessary. Section 388.113(g)(5)(vii) of the amended regulations indicates that the time period for responding to CEII requests should mirror the period for responding to FOIA requests. In response to APS's suggestion of a default time period for the Commission to respond to a request for CEII unless the information is needed sooner, expedited treatment is not needed, as a requester may include a timeframe in which it needs the information, and the Commission will endeavor to respond in that period. The Commission believes that NERC's recommendation to place language concerning tolling in the CEII regulation is not necessary, as the time requirement for responses to requesters is not binding and the Commission's practice is to always toll the response period when further information is needed. 154. In response to NERC's comment regarding appeal rights, the Commission notes that the existing CEII appeals process, which provides appeal rights to the requester, has been effective and there is no compelling need to extend a right to appeal to anyone other than the individual requester. If a submitter believes that its objection to disclosure of its CEII under a NDA has not been fully addressed, the submitter may raise that issue in district court.\235\ --------------------------------------------------------------------------- \235\ Because the challenge does not relate to the designation of the information, the action would not be under FPA section 215A(d)(11). See supra note 130; see also Cortez III Serv. Corp v. NASA, 921 F.Supp. 8, 11 (D.D.C. 1996) (holding, in a ``reverse FOIA'' action, that courts have jurisdiction over claims from parties that a release of their information would adversely affect them.'') --------------------------------------------------------------------------- 155. In response to TAPS's comment, the Commission clarifies that appeal rights apply when it imposes any conditions on receipt of CEII. III. Information Collection Statement 156. The Paperwork Reduction Act and Office of Management and Budget's (OMB) implementing regulations require OMB to review and approve certain information collection requirements imposed by agency rule.\236\ This Final Rule does not impose any additional information collection requirements.\237\ Therefore, the information collection regulations do not apply to this Final Rule. --------------------------------------------------------------------------- \236\ 5 CFR part 1320. \237\ The current information collection requirements related to requesting access to CEII material are approved by OMB under FERC- 603 (OMB Control No. 1902-0197). --------------------------------------------------------------------------- IV. Environmental Analysis 157. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.\238\ --------------------------------------------------------------------------- \238\ Regulations Implementing National Environmental Policy Act of 1969, Order No. 486, FERC Stats. & Regs. ] 30,783 (1987). --------------------------------------------------------------------------- 158. The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural, or that do not substantially change the effect of the regulations being amended.\239\ The actions here fall within this categorical exclusion in the Commission's regulations. --------------------------------------------------------------------------- \239\ 18 CFR 380.4(a)(2)(ii). --------------------------------------------------------------------------- V. Regulatory Flexibility Act Certification 159. The Regulatory Flexibility Act of 1980 (RFA) requires rulemakings to contain either a description and analysis of the effect that the rule will have on small entities or a certification that the rule will not have a significant economic impact on a substantial number of small entities.\240\ Rules that are exempt from the notice and comment requirements of section 553(b) of the Administrative Procedure Act are exempt from the RFA requirements. The Final Rule concerns rules of agency procedure and, therefore, an analysis under the RFA is not required.\241\ --------------------------------------------------------------------------- \240\ 5 U.S.C. 603 (2012). \241\ 5 U.S.C. 553(b). --------------------------------------------------------------------------- VI. Document Availability 160. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to [[Page 93748]] view and/or print the contents of this document via the Internet through the Commission's Home Page (http://www.ferc.gov) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, Washington, DC 20426. 161. From the Commission's Home Page on the Internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number of this document, excluding the last three digits, in the docket number field. 162. User assistance is available for eLibrary and the Commission Web site during normal business hours from FERC Online Support at 202- 502-6652 (toll free at 1-866-208-3676) or email at [email protected], or the Public Reference Room at (202) 502- 8371, TTY (202) 502-8659. Email the Public Reference Room at [email protected]. VII. Effective Date and Congressional Notification 163. These regulations are effective February 21, 2017. The Commission has determined, with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule is not a ``major rule'' as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996. The Commission will submit the Final Rule to both houses of Congress and to the General Accountability Office. List of Subjects 18 CFR Part 375 Authority delegations (Government agencies), Seals and insignia, Sunshine Act. 18 CFR Part 388 Confidential business information, Freedom of information. By the Commission. Issued: November 17, 2016. Nathaniel J. Davis, Sr., Deputy Secretary. In consideration of the foregoing, the Commission amends Parts 375 and 388, Chapter I, Title 18, Code of Federal Regulations, as follows: PART 375-- THE COMMISSION 0 1. The authority citation for part 375 continues to read as follows: Authority: 5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645; 42 U.S.C. 7101-7352. 0 2. In Sec. 375.309, paragraph (h) is added as follows: Sec. 375.309 Delegations to the General Counsel * * * * * (h) Deny or grant, in whole or in part, an appeal of a determination by the CEII Coordinator. 0 3. In Sec. 375.313: 0 a. Revise the section heading and paragraphs (a) and (b); 0 b. Redesignate paragraphs (c) through (e) as paragraphs (d) through (f) and revising newly redesignated paragraphs (d) through (f); and 0 c. Add a new paragraph (c). The revisions and addition read as follows: Sec. 375.313 Delegations to the Critical Energy/Electric Infrastructure Information (CEII) Coordinator * * * * * (a) Receive and review all requests for CEII as defined in Sec. 388.113(c) of this chapter. (b) Make determinations as to whether particular information fits within the definition of CEII found at Sec. 388.113(c) of this chapter, including designating information, as appropriate. (c) Make determinations that information designated as CEII should no longer be so designated when the unauthorized disclosure of the information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure. (d) Make determinations as to whether a particular requester's need for and ability and willingness to protect CEII warrants limited disclosure of the information to the requester. (e) Establish reasonable conditions on the release of CEII. (f) Release CEII to requesters who satisfy the requirements in paragraph (d) of this section and agree in writing to abide by any conditions set forth by the Coordinator pursuant to paragraph (e) of this section. PART 388--INFORMATION AND REQUESTS 0 4. The authority citation for part 388 is revised to read as follows: Authority: 5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 U.S.C. 7101-7352; 16 U.S.C. 824(o-l). 0 5. In Sec. 388.112, the section heading, paragraph (a), the heading of paragraph (b), and paragraphs (b)(1), (b)(2)(i), (b)(2)(vi), (c)(1), (d), and (e) are revised to read as follows: Sec. 388.112 Requests for privileged treatment for documents submitted to the Commission (a) Scope. By following the procedures specified in this section, any person submitting a document to the Commission may request privileged treatment for some or all of the information contained in a particular document that it claims is exempt from the mandatory public disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552 (FOIA), and should be withheld from public disclosure. For the purposes of the Commission's filing requirements, non-CEII subject to an outstanding claim of exemption from disclosure under FOIA will be referred to as privileged material. The rules governing CEII are contained in Sec. 388.113. (b) Procedures for filing and obtaining privileged material. (1) General Procedures. A person requesting that material be treated as privileged information must include in its filing a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. A person requesting that a document filed with the Commission be treated as privileged in whole or in part must designate the document as privileged in making an electronic filing or clearly indicate a request for such treatment on a paper filing. The cover page and pages or portions of the document containing material for which privileged treatment is claimed should be clearly labeled in bold, capital lettering, indicating that it contains privileged or confidential information, as appropriate, and marked ``DO NOT RELEASE.'' The filer also must submit to the Commission a public version with the information that is claimed to be privileged material redacted, to the extent practicable. (2) * * * (i) If a person files material as privileged material in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material. This requirement does not apply to material submitted in hearing or settlement proceedings, or if the only material for which privileged treatment is claimed consists of landowner lists or privileged information filed under Sec. Sec. 380.12(f) and 380.16(f) of this chapter. * * * * * [[Page 93749]] (vi) For landowner lists, information filed as privileged under Sec. Sec. 380.12(f) and 380.16(f) of this chapter, forms filed with the Commission, and other documents not covered above, access to this material can be sought pursuant to a FOIA request under Sec. 388.108. Applicants are not required under paragraph (b)(2)(iv) of this section to provide intervenors with landowner lists and the other materials identified in the previous sentence. (c) * * * (1) For documents filed with the Commission: (i) The documents for which privileged treatment is claimed will be maintained in the Commission's document repositories as non-public until such time as the Commission may determine that the document is not entitled to the treatment sought and is subject to disclosure consistent with Sec. 388.108. By treating the documents as nonpublic, the Commission is not making a determination on any claim of privilege status. The Commission retains the right to make determinations with regard to any claim of privilege status, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. (ii) The request for privileged treatment and the public version of the document will be made available while the request is pending. * * * * * (d) Notification of request and opportunity to comment. When a FOIA requester seeks a document for which privilege status has been claimed, or when the Commission itself is considering release of such information, the Commission official who will decide whether to release the information or any other appropriate Commission official will notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. (e) Notification before release. Notice of a decision by the Commission, the Chairman of the Commission, the Director, Office of External Affairs, the General Counsel or General Counsel's designee, a presiding officer in a proceeding under part 385 of this chapter, or any other appropriate official to deny a claim of privilege, in whole or in part, will be given to any person claiming that the information is privileged no less than 5 calendar days before disclosure. The notice will briefly explain why the person's objections to disclosure are not sustained by the Commission. A copy of this notice will be sent to the FOIA requester. * * * * * 0 6. Revise Sec. 388.113 to read as follows: Sec. 388.113 Critical Energy/Electric Infrastructure Information (CEII) (a) Scope. This section governs the procedures for submitting, designating, handling, sharing, and disseminating Critical Energy/ Electric Infrastructure Information (CEII) submitted to or generated by the Commission. The Commission reserves the right to restrict access to previously filed information as well as Commission-generated information containing CEII. Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information. (b) Purpose. The procedures in this section implement section 215A of the Federal Power Act, and provide a comprehensive overview of the manner in which the Commission will implement the CEII program. (c) Definitions. For purposes of this section: (1) Critical electric infrastructure information means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to the Commission or other Federal agency other than classified national security information, that is designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to section 215A(d) of the Federal Power Act. Such term includes information that qualifies as critical energy infrastructure information under the Commission's regulations. Critical Electric Infrastructure Information is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act. (2) Critical energy infrastructure information means specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure that: (i) Relates details about the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure; (iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and (iv) Does not simply give the general location of the critical infrastructure. (3) Critical electric infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters. (4) Critical infrastructure means existing and proposed systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health or safety, or any combination of those matters. (d) Criteria and procedures for determining what constitutes CEII. The following criteria and procedures apply to information labeled as CEII: (1) For information submitted to the Commission: (i) A person requesting that information submitted to the Commission be treated as CEII must include with its submission a justification for such treatment in accordance with the filing procedures posted on the Commission's Web site at http://www.ferc.gov. The justification must provide how the information, or any portion of the information, qualifies as CEII, as the terms are defined in paragraphs (c)(1) and (2) of this section. The submission must also include a clear statement of the date the information was submitted to the Commission, how long the CEII designation should apply to the information and support for the period proposed. Failure to provide the justification or other required information could result in denial of the designation and release of the information to the public. (ii) In addition to the justification required by paragraph (d)(1)(i) of this section, a person requesting that information submitted to the Commission be treated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is claimed in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked ``DO NOT RELEASE.'' The submitter must also segregate those portions of the information that contain [[Page 93750]] CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible. The submitter must also submit to the Commission a public version with the information where CEII is redacted, to the extent practicable. (iii) If a person files material as CEII in a complaint proceeding or other proceeding to which a right to intervention exists, that person must include a proposed form of protective agreement with the filing, or identify a protective agreement that has already been filed in the proceeding that applies to the filed material. (iv) The information for which CEII treatment is claimed will be maintained in the Commission's files as non-public until such time as the Commission may determine that the information is not entitled to the treatment sought. By treating the information as CEII, the Commission is not making a determination on any claim of CEII status. The Commission retains the right to make determinations with regard to any claim of CEII status at any time, and the discretion to release information as necessary to carry out its jurisdictional responsibilities. Although unmarked information may be eligible for CEII treatment, the Commission will treat unmarked information as CEII only if it is properly designated as CEII pursuant to Commission regulations. (v) The CEII Coordinator will evaluate whether the submitted information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section prior to making a designation as CEII. (vi) Subject to the exceptions set forth in paragraph (f)(5) of this section, when a CEII requester seeks information for which CEII status has been claimed, or when the Commission itself is considering release of such information, the CEII Coordinator or any other appropriate Commission official will notify the person who submitted the information and give the person an opportunity (at least five business days) in which to comment in writing on the request. A copy of this notice will be sent to the requester. Notice of a decision by the Commission, or the CEII Coordinator to make a release of CEII, will be given to any person claiming that the information is CEII no less than five business days before disclosure. The notice will respond to any objections to disclosure from the submitter that are not sustained. Where applicable, a copy of this notice will be sent to the CEII requester. (2) For Commission-generated information: (i) After consultation with the Office Director for the office that created the information, or the Office Director's designee, the CEII Coordinator will designate Commission-generated information as CEII after determining that the information or portions of the information are covered by the definitions in paragraphs (c)(1) and (2) of this section. Commission-generated CEII shall include clear markings to indicate the information is CEII and the date of the designation. (ii) The Commission will segregate non-CEII from Commission- generated CEII or information that reasonably could be expected to lead to the disclosure of CEII wherever feasible. (e) Duration of the CEII designation. All CEII designations will be subject to the following conditions: (1) A designation may last for up to a five-year period, unless re- designated. In making a determination as to whether the designation should be extended, the CEII Coordinator will take into account information provided in response to paragraph (d)(1)(i) of this section, and any other information, as appropriate. (2) A designation may be removed at any time, in whole or in part, if the Commission determines that the unauthorized disclosure of CEII could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure. (3) The Commission will treat CEII or documents marked as CEII as non-public after the designation has lapsed until the CEII Coordinator determines to un-designate the information. (4) If a CEII designation is removed, the submitter will receive notice and an opportunity to comment. The CEII Coordinator will notify the submitter of the information and give the submitter an opportunity (at least five business days) in which to comment in writing prior to the removal of the designation. Notice of a removal decision will be given to any submitter claiming that the information is CEII no less than five business days before disclosure. The notice will briefly explain why the submitter's objections to the removal of the designation are not sustained by the Commission (f) Voluntary sharing of CEII. The Commission, taking into account standards of the Electric Reliability Organization, will facilitate voluntary sharing of CEII with, between, and by Federal, state, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission. The process will be as follows: (1) The Director of any Office of the Commission or his designee that wishes to voluntarily share CEII shall consult with the CEII Coordinator prior to the Office Director or his designee making a determination on whether to voluntarily share the CEII. (2) Consistent with paragraph (d) of this section, the Commission retains the discretion to release information as necessary to carry out its jurisdictional responsibilities in facilitating voluntary sharing or, in the case of information provided to other federal agencies, the Commission retains the discretion to release information as necessary for those agencies to carry out their jurisdictional responsibilities. (3) All entities receiving CEII must execute either a non- disclosure agreement or an acknowledgement and agreement. A copy of each agreement will be maintained by the Office Director with a copy to the CEII Coordinator. (4) When the Commission voluntarily shares CEII pursuant to this subsection, the Commission may impose additional restrictions on how the information may be used and maintained. (5) Submitters of CEII shall receive notification of a limited release of CEII no less than five business days before disclosure, except in instances where voluntary sharing is necessary for law enforcement purposes, to maintain infrastructure security, to address potential threats, when notice would not be practicable, and where there is an urgent need to quickly disseminate the information. When prior notice is not given, the Commission will provide submitters of CEII notice of a limited release of the CEII as soon as practicable. (g) Accessing CEII. (1) An owner/operator of a facility, including employees and officers of the owner/operator, may obtain CEII relating to its own facility, excluding Commission-generated information except inspection reports/operation reports and any information directed to the owner-operators, directly from Commission staff without going through the procedures outlined in paragraph (g)(5) of this section. Non-employee agents of an owner/operator of such facility may obtain CEII relating to the owner/operator's facility in the same manner as owner/operators as long as they present written authorization from the owner/operator to obtain such information. Notice of such requests must be given to [[Page 93751]] the CEII Coordinator, who shall track this information. (2) An employee of a federal agency acting within the scope of his or her federal employment may obtain CEII directly from Commission staff without following the procedures outlined in paragraph (g)(5) of this section. Any Commission employee at or above the level of division director or its equivalent may rule on requests for access to CEII by a representative of a federal agency. To obtain access to CEII, an agency employee must sign an acknowledgement and agreement, which states that the agency will protect the CEII in the same manner as the Commission and will refer any requests for the information to the Commission. Notice of each such request also must be given to the CEII Coordinator, who shall track this information. (3) A landowner whose property is crossed by or in the vicinity of a project may receive detailed alignment sheets containing CEII directly from Commission staff without submitting a non-disclosure agreement as outlined in paragraph (g)(5) of this section. A landowner must provide Commission staff with proof of his or her property interest in the vicinity of a project. (4) Any person who is a participant in a proceeding or has filed a motion to intervene or notice of intervention in a proceeding may make a written request to the filer for a copy of the complete CEII version of the document without following the procedures outlined in paragraph (g)(5) of this section. The request must include an executed copy of the applicable protective agreement and a statement of the person's right to party or participant status or a copy of the person's motion to intervene or notice of intervention. Any person may file an objection to the proposed form of protective agreement. A filer, or any other person, may file an objection to disclosure, generally or to a particular person or persons who have sought intervention. If no objection to disclosure is filed, the filer must provide a copy of the complete, non-public document to the requesting person within five business days after receipt of the written request that is accompanied by an executed copy of the protective agreement. If an objection to disclosure is filed, the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority. (5) If any requester not described above in paragraphs (g)(1) through (4) of this section has a particular need for information designated as CEII, the requester may request the information using the following procedures: (i) File a signed, written request with the Commission's CEII Coordinator. The request must contain the following: (A) Requester's name (including any other name(s) which the requester has used and the dates the requester used such name(s)), title, address, and telephone number; and the name, address, and telephone number of the person or entity on whose behalf the information is requested; (B) A detailed Statement of Need, which must state: The extent to which a particular function is dependent upon access to the information; why the function cannot be achieved or performed without access to the information; an explanation of whether other information is available to the requester that could facilitate the same objective; how long the information will be needed; whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and an explanation of whether the information is needed expeditiously. (C) An executed non-disclosure agreement as described in paragraph (h)(2) of this section; (D) A signed statement attesting to the accuracy of the information provided in the request; and (E) A requester shall provide his or her date and place of birth upon request, if it is determined by the CEII Coordinator that this information is necessary to process the request. (ii) A requester who seeks the information on behalf of all employees of an organization should clearly state that the information is sought for the organization, that the requester is authorized to seek the information on behalf of the organization, and that all individuals in the organization that have access to the CEII will agree to be bound by a non-disclosure agreement that must be executed. (iii) After the request is received, the CEII Coordinator will determine if the information is CEII, and, if it is, whether to release the CEII to the requester. The CEII Coordinator will balance the requester's need for the information against the sensitivity of the information. If the requester is determined to be eligible to receive the information requested, the CEII Coordinator will determine what conditions, if any, to place on release of the information. (iv) If the CEII Coordinator determines that the CEII requester has not demonstrated a valid or legitimate need for the CEII or that access to the CEII should be denied for other reasons, this determination may be appealed to the General Counsel pursuant to Sec. 388.110. The General Counsel will decide whether the information is properly classified as CEII, which by definition is exempt from release under FOIA, and whether the Commission should in its discretion make such CEII available to the CEII requester in view of the requester's asserted legitimacy and need. (v) Once a CEII requester has been verified by Commission staff as a legitimate requester who does not pose a security risk, his or her verification will be valid for the remainder of that calendar year. Such a requester is not required to provide detailed information about himself or herself with subsequent requests during the calendar year. He or she is also not required to file a non-disclosure agreement with subsequent requests during the calendar year because the original non- disclosure agreement will apply to all subsequent releases of CEII. (vi) An organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section may seek to add additional individuals to the non-disclosure agreement within one (1) year of the date of the initial CEII request. Such an organization must provide the names of the added individuals to the CEII Coordinator and certify that notice of each added individual has been given to the submitter. Any newly added individuals must execute a supplement to the original non- disclosure agreement indicating their acceptance of its terms. If there is no written opposition within five business days of notifying the CEII Coordinator and the submitter concerning the addition of any newly added individuals, the CEII Coordinator will issue a standard notice accepting the addition of these names to the non-disclosure agreement. If the submitter files a timely opposition with the CEII Coordinator, the CEII Coordinator will issue a formal determination addressing the merits of such opposition. If an organization that is granted access to CEII pursuant to paragraph (g)(5)(ii) of this section wants to add new individuals to its non-disclosure agreement more than one year after the date of its initial CEII request, the organization must submit a new CEII request pursuant to paragraph (g)(5)(ii) of this section and a new non-disclosure agreement for each new individual added. (vii) The CEII Coordinator will attempt to respond to the requester under this section according to the timing required for responses under the FOIA in Sec. 388.108(c). [[Page 93752]] (viii) Fees for processing CEII requests will be determined in accordance with Sec. 388.109. (ix) Nothing in this section should be construed as requiring the release of proprietary information, personally identifiable information, cultural resource information, information on rare species of plants and animals, and other comparable data protected by statute or any privileged information, including information protected by the deliberative process privilege. (h) Duty to protect CEII. Unauthorized disclosure of CEII is prohibited. (1) To ensure that the Commissioners, Commission employees, and Commission contractors protect CEII from unauthorized disclosure, internal controls will describe the handling, marking, and security controls for CEII. (2) Any individual who requests information pursuant to paragraph (g)(5) of this section must sign and execute a non-disclosure agreement, which indicates the individual's willingness to adhere to limitations on the use and disclosure of the information requested. The non-disclosure agreement will, at a minimum, require the following: CEII will only be used for the purpose for which it was requested; CEII may only be discussed with authorized recipients; CEII must be kept in a secure place in a manner that would prevent unauthorized access; CEII must be destroyed or returned to the Commission upon request; the Commission may audit the recipient's compliance with the non-disclosure agreement; CEII provided pursuant to the agreement is not subject to release under either FOIA or Sunshine Laws; a recipient is obligated to protect the CEII even after a designation has lapsed until the CEII Coordinator determines the information should no longer be designated as CEII under paragraph (e)(2) of this section; and a recipient is required to promptly report all unauthorized disclosures of CEII to the Commission. (i) Sanctions. Any officers, employees, or agents of the Commission who knowingly and willfully disclose CEII in a manner that is not authorized under this section will be subject to appropriate sanctions, such as removal from the federal service, or possible referral for criminal prosecution. Commissioners who knowingly and willfully disclose CEII without authorization may be referred to the Department of Energy Inspector General. The Commission will take responsibility for investigating and, as necessary, imposing sanctions on its employees and agents. (j) Administrative appeals of CEII determinations. (1) Submitters who receive a determination that the Commission intends to remove a CEII designation may appeal that determination. The submitter must file notice of its intent to appeal that determination within five business days of the determination. The notice of intent to file an appeal must be sent to the General Counsel, with a copy to the CEII Coordinator. A statement in support of the notice of appeal must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the notice of appeal. (2) Individuals who receive a determination denying a request for the release of CEII, in whole or in part, or a determination denying a request to change the designation of CEII may appeal such determinations. Such appeals must be submitted to the General Counsel within 20 business days of the date of the determination. (3) The Commission's General Counsel or the General Counsel's designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal. If, on appeal, the General Counsel or the General Counsel's designee upholds the determination in whole or in part, then the General Counsel or the General Counsel's designee will notify the person submitting the appeal of the availability of judicial review. (4) The time limits prescribed for the General Counsel or his designee to act on an appeal may be extended pursuant to Sec. 388.110(b)(1). (5) Prior to seeking judicial review in federal district court pursuant to section 215A(d)(11) of the Federal Power Act, a person who received a determination from the Commission concerning a CEII designation must first appeal the determination to the Commission's General Counsel. Note: The following appendix will not appear in the Code of Federal Regulations. Appendix ------------------------------------------------------------------------ Abbreviation Commenter ------------------------------------------------------------------------ Initial Comments: APPA.......................... American Public Power Association. CEA........................... Canadian Electricity Association. HRC........................... Hydropower Reform Coalition. INGAA......................... Interstate Natural Gas Association of America. ITC........................... International Transmission Company d/ b/a ITCTransmission, Michigan Electric Company, LLC, ITC Midwest LLC, and ITC Great Plains LLC. Joint RTOs.................... ISO New England, Inc. and Southwest Power Pool, Inc. MISO.......................... Midcontinent Independent System Operator, Inc. NRECA......................... National Rural Electric Cooperative Association. NERC.......................... North American Electric Reliability Corporation. NRC........................... Nuclear Regulatory Commission. Peak.......................... Peak Reliability. Powerex....................... Powerex Corp. Public Interest Organizations. Alliance for Affordable Energy, Citizens Action Coalition of Indiana, Inc., Citizens Utility Board, Fresh Energy, Great Plains Institute, Natural Resources Defense Council, Sierra Club Environmental Law Program, Southern Environmental Law Center, Sustainable FERC Project, Union of Concerned Scientists, Utah Clean Energy, VoeSolar, Western Grid Group, Western Resource Advocates, and Wind on the Wires. Tacoma Power.................. City of Tacoma, Department of Public Utilities, Light Division d.b.a. Tacoma Power (Tacoma Power). Tallgrass Pipelines........... Rockies Express Pipeline LLC, Tallgrass Interstate Gas, Transmission, LLC, and Trailblazer Pipeline Company LLC. TAPS.......................... Transmission Access Policy Study Group. Trade Associations............ Edison Electric Institute, Electric Power Supply Association, and Electricity Consumers Resource Council. WIRAB......................... Western Interconnection Regional Advisory Board. [[Page 93753]] Reply Comments: PJM........................... PJM Interconnection, LLC. Joint RTOs.................... ISO New England, Inc. and Southwest Power Pool, Inc. ------------------------------------------------------------------------ [FR Doc. 2016-28322 Filed 12-20-16; 8:45 am] BILLING CODE 6717-01-P
![93732 Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations
DEPARTMENT OF ENERGY Act as well as improve the overall need to know in order to avoid having
efficiency of the Commission’s sensitive information fall into the hands
Federal Energy Regulatory procedures for certain infrastructure of those who may use it to attack the
Commission information that is submitted to, or Nation’s infrastructure.
generated by, the Commission. The
18 CFR Parts 375 and 388 B. FAST Act
amended procedures will be referred to
[Docket Nos. RM16–15–000 and RM15–25– as the Critical Energy/Electric 5. On December 4, 2015, the President
001; Order No. 833] Infrastructure Information (CEII) signed the FAST Act into law. The
procedures. FAST Act, inter alia, added section
Regulations Implementing FAST Act 215A to the Federal Power Act to
I. Background improve the security and resilience of
Section 61003—Critical Electric
Infrastructure Security and Amending A. Critical Energy Infrastructure energy infrastructure in the face of
Critical Energy Infrastructure Information Regulations emergencies. The FAST Act directs the
Information; Availability of Certain Commission to issue regulations aimed
2. Shortly after September 11, 2001,
North American Electric Reliability at securing and sharing sensitive
the Commission took steps to protect
Corporation Databases to the infrastructure information. Specifically,
information that it considered Critical
Commission FPA section 215A(d)(2) (Designation
Energy Infrastructure Information.2 As a
and Sharing of Critical Electric
AGENCY: Federal Energy Regulatory preliminary step, the Commission
Infrastructure Information) requires the
Commission, Department of Energy. removed documents from its public files
Commission to promulgate regulations
ACTION: Final rule. and eLibrary database that were likely to
on the following. First, the statute
contain detailed specifications about
The Federal Energy requires the Commission to establish
SUMMARY: critical infrastructure. The Commission
Regulatory Commission (Commission) criteria and procedures to designate
directed the public to use the Freedom
amends its regulations to implement information as critical electric
of Information Act (FOIA) request
provisions of the Fixing America’s infrastructure information. Second, the
process to obtain such information.3
Surface Transportation Act that pertain statute requires the Commission to
Given that such information would
to the designation, protection and prohibit the unauthorized disclosure of
typically be exempt from mandatory
sharing of Critical Electric Infrastructure critical electric infrastructure
disclosure pursuant to FOIA, the
Information. Additionally, the information. Third, the statute requires
Commission determined that it was
Commission amends its regulations the Commission to ensure there are
important to have a process for
addressing Critical Energy Infrastructure appropriate sanctions in place for
individuals with a valid or legitimate
Information. Commissioners, officers, employees, or
need to access certain sensitive energy
agents of the Commission or the
DATES: This rule will become effective infrastructure information. Thus, in
Department of Energy [DOE] who
February 21, 2017. 2003, the Commission issued a final
knowingly and willfully disclose critical
FOR FURTHER INFORMATION CONTACT: rule establishing Critical Energy
electric infrastructure information in a
Nneka Frye, Office of the General Infrastructure Information regulations.4
3. Each year, over 7,000 documents manner that is not authorized by the
Counsel, Federal Energy Regulatory statute. Fourth, FPA section
Commission, 888 First Street NE., are submitted to the Commission’s
eLibrary system as Critical Energy 215A(d)(2)(D) requires the Commission,
Washington, DC 20426, (202) 502– taking into account standards of the
6029, Nneka.frye@ferc.gov. Infrastructure Information. The
Commission also receives Electric Reliability Organization, to
Christopher MacFarlane, Office of the facilitate voluntary sharing of critical
General Counsel, Federal Energy approximately 200 requests for Critical
Energy Infrastructure Information each electric infrastructure information. The
Regulatory Commission, 888 First statute, specifically, directs the
Street NE., Washington, DC 20426, year. Requests for Critical Energy
Infrastructure Information are submitted Commission to facilitate voluntary
(202) 502–6761, sharing with, between, and by Federal,
Christopher.macfarlane@ferc.gov. by, among others, public utilities, gas
pipelines, Liquefied Natural Gas (LNG) State, political subdivision, and tribal
Mark Hershfield, Office of the General authorities; the Electric Reliability
facilities, hydroelectric developers,
Counsel, Federal Energy Regulatory Organization; regional entities;
academics, landowners, public interest
Commission, 888 First Street NE., information sharing and analysis centers
groups, researchers, renewable energy
Washington, DC 20426, (202) 502– established pursuant to Presidential
organizations, consultants, and federal
8597, Mark.hershfield@ferc.gov. Decision Directive 63; owners,
agencies.
SUPPLEMENTARY INFORMATION: 4. The Commission’s current Critical operators, and users of critical electric
1. The Commission amends 18 CFR Energy Infrastructure Information infrastructure in the United States; and
375.309, 375.313, 388.112 and 388.113 process is designed to limit the other entities determined appropriate by
of its regulations to implement the distribution of sensitive infrastructure the Commission.5
requirements of the Fixing America’s information to those individuals with a
Surface Transportation (FAST) Act as C. Notice of Proposed Rulemaking
set forth in section 215A(d)(2) of the 2 See Statement of Policy on Treatment of 6. On June 16, 2016, the Commission
Federal Power Act (FPA).1 The Previously Public Documents, 97 FERC ¶ 61,030 issued a Notice of Proposed Rulemaking
(NOPR) to amend its regulations to
asabaliauskas on DSK3SPTVN1PROD with RULES
Commission also amends its existing (2001).
Critical Energy Infrastructure 3 5 U.S.C. 552 as amended by the FOIA
implement the provisions of the FAST
Improvement Act of 2016, Public Law 114–185, 130 Act pertaining to the designation,
Information procedures. These changes Stat. 538 (2016); 18 CFR 388.108 (Requests for
are intended to comply with the FAST Commission records not available through the protection and sharing of CEII.6 The
Public Reference Room (FOIA Requests)).
1 Fixing America’s Surface Transportation Act, 4 Critical Energy Infrastructure Information, Order 5 FAST Act, Public Law 114–94, section 61,003,
Public Law 114–94, 61,003, 129 Stat. 1312, 1773– No. 630, FERC Stats. & Regs. ¶ 31,140, order on 129 Stat. 1312, 1776.
1779 (2015) (to be codified at 16 U.S.C. 824 et seq.) reh’g, Order No. 630–A, FERC Stats. & Regs. 6 Regulations Implementing FAST Act Section
(FAST Act). ¶ 31,147 (2003). 61003—Critical Infrastructure Security and
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/1.svg)
![Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations 93733
proposed amendments included, among regarding CEII would be in section define the term ‘‘political subdivision,’’
other things, the creation of criteria and 388.113. as used in section 215A(d)(1)(B), to have
procedures for designating information the same meaning as the term ‘‘political
Comments
as CEII; a specific prohibition on subdivision’’ in section 201(f) of the
unauthorized disclosure of that 9. APPA and MISO maintain that CEII FPA, such that the term in section
information; sanctions for knowing and should not include all Critical Energy 215A(d)(1)(B) would include any
willful wrongful disclosure of CEII by Infrastructure Information.10 APPA agency, authority or instrumentality of
certain federal personnel; a process for contends that Congress intended for the any political subdivision or owned by a
voluntary sharing of CEII; and changes Commission to develop a separate political subdivision.16 TAPS and APPA
to the existing process for requesting process for Critical Electric contend that, absent the clarification,
CEII. In response to the NOPR, nineteen Infrastructure Information regarding the these additional entities may not be
entities filed comments and two entities bulk-power system and that the considered a ‘‘political subdivision’’
filed reply comments. The Appendix to amended regulations fall ‘‘short’’ of under State laws.17
this Final Rule lists the entities that Congress’s intent under the FAST Act 11. TAPS recommends that the
submitted comments in response to the because the amended regulations Commission delete from the definition
NOPR. include the voluntary disclosure of Critical Energy Infrastructure
provisions found in the Commission’s Information the requirement that such
II. Discussion current regulations.11 APPA also asserts information be exempt from FOIA.18
7. The Commission adopts the that the proposed definition of ‘‘critical TAPS contends that the existing
majority of amendments proposed in the electric infrastructure’’ ‘‘does not exemption clause is unnecessary
NOPR. The Commission determines that comport well’’ with section 215A(d)(10) because any materials will be exempt
the amendments comply with the of the FPA, which provides DOE and from FOIA pursuant to section
requirements of the FAST Act and better the Commission with the authority to 215A(d)(1)(A).19
ensure the secure treatment of CEII. In remove the CEII designation from 12. Other commenters seek
addition, as discussed below, the information regarding the bulk-power clarification on the scope of the CEII
Commission modifies or otherwise system or distribution facilities.12 MISO definition. Specifically, the Trade
clarifies certain proposals made in the contends that the Commission Associations request that the
NOPR based on our review of the misinterpreted the definition of Critical Commission clarify whether the name
comments. In the discussion below, we Electric Infrastructure Information and or location of an electric system, asset,
address the following issues regarding that not all ‘‘Critical Energy owner or operator could be protected
the CEII amendments: (A) Scope, Infrastructure Information under the under the proposed CEII definition.20
purpose, and definitions; (B) criteria Commission’s regulations is included’’ NRECA, similarly, urges the
and procedures for determining what in the definition of Critical Electric Commission to clarify that material
constitutes CEII; (C) duty to protect CEII; Infrastructure Information.13 considered Critical Energy
(D) sanctions for unauthorized 10. TAPS and APPA maintain that the
Infrastructure Information, such as
disclosure of CEII; (E) voluntary sharing Commission should revise the CEII
electric generation, and non-bulk
of CEII; and (F) requests for access to definition to include additional
electric system transmission and
CEII. language from the FAST Act.
distribution facilities, would still
Specifically, TAPS and APPA
A. Scope, Purpose, and Definitions qualify as CEII under the revised
recommend that the proposed definition
definition in the amended regulations.21
NOPR of CEII incorporate section
13. Powerex requests that the
8. In the NOPR, the Commission 215A(d)(1)(B), which provides that CEII
Commission specify whether the new
proposed to amend section 388.113 to ‘‘shall not be made available by any
definition of CEII expands the scope of
include procedures for submitting, Federal, State, political subdivision or
information currently defined as Critical
designating, handling, sharing and tribal authority pursuant to any Federal,
Energy Infrastructure Information.22
disseminating Critical Electric State, political subdivision or tribal law
Powerex contends that the scope of this
Infrastructure Information submitted to requiring public disclosure of
proceeding should remain limited to
or generated by the Commission.7 The information or records.’’ 14 APPA
CEII regulations and procedures
Commission proposed to define the requests that, if the Commission
discussed in the NOPR and, thus, the
term ‘‘Critical Electric Infrastructure includes Critical Energy Infrastructure
scope of this proceeding should not
Information’’ 8 to include ‘‘Critical Information in CEII, then the
extend to other forms of sensitive data.23
Energy Infrastructure Information’’ as Commission should interpret section
Powerex, further, explains that there
defined under the Commission’s current 215A(d)(1)(B) to apply to all forms of
regulations and to refer to both types of CEII, including Critical Energy 16 TAPS Comments at 8; APPA Comments at 22
information, collectively, as CEII.9 The Infrastructure Information.15 TAPS and (citing Section 201(f), which indicates that
Commission also proposed to delete APPA also request that the Commission provisions of that subchapter are not applicable to,
among others, the United States, a State or any
references to CEII in section 388.112 so 10 See political subdivision of a State, certain electric
APPA Comments at 5–11; MISO Comments
that section 388.112 would only address at 5. cooperatives or any agency, authority, or
privileged material and all procedures 11 APPA instrumentality of any one or more of those entities
Comments at 5, 9, 13.
12 Section
or any corporation wholly owned, directly or
215A(d)(10) of the FPA provides that indirectly, by any one or more of those entities).
asabaliauskas on DSK3SPTVN1PROD with RULES
Amending Critical Energy Information, 81 FR when ‘‘the Commission or the [DOE] Secretary, as
16 U.S.C. 824(f)
43,557 (July 5, 2016), 155 FERC ¶ 61,278 (2016) appropriate, determines that the unauthorized 17 TAPS Comments at 8–9; APPA Comments at
(NOPR). disclosure of such information could no longer be
7 NOPR, 155 FERC ¶ 61,278 at P 10. used to impair the security or reliability of the bulk- 22–23.
18 TAPS Comments at 4–5.
8 Id. P 11 (noting that Section 215A(a)(3) of the power system or distribution facilities’’ the
19 Id. at 4.
FAST Act defines Critical Electric Infrastructure designation shall be removed.
13 MISO Comments at 4–6. 20 Trade Associations Comments at 16.
Information to include information that qualifies as
21 NRECA Comments at 7.
critical energy infrastructure information under the 14 TAPS Comments at 8; APPA Comments at 21–
Commission’s regulations). 22. 22 Powerex Comments at 11.
9 NOPR, 155 FERC ¶ 61,278 at P 13. 15 APPA Comments at 23. 23 Id. at 15.
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/2.svg)
![93734 Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations
may be a tendency to over-designate consistent with the requirements of the fulfill the statutory mandate of the
information as CEII and, therefore, the FAST Act and will result in more secure FAST Act and to avoid any confusion
Commission should recognize that treatment of CEII. that could result from different
transparency is needed to balance CEII 18. The Commission disagrees with processes for different types of critical
protection against the due process rights APPA and MISO that the CEII definition infrastructure information.33 Absent
of parties participating in Commission should not include Critical Energy contrary language in the FAST Act, the
proceedings.24 Infrastructure Information and that there Commission has discretion in how it
14. TAPS, APPA and the Trade should be separate processes for electric administers statutory mandates by
Associations recommend revisions to and non-electric CEII. Our regulation.34
the CEII Non-Disclosure Agreements determination is based on the plain 21. APPA’s assertion that the
(NDA).25 Specifically, TAPS, APPA, and language of the FAST Act. Section Commission is ‘‘falling short’’ of
the Trade Associations state that the 215A(a)(3) defines Critical Electric meeting Congress’s intent is without
Commission should expressly Infrastructure Information to ‘‘include merit. In the proposed regulations, the
incorporate the language from section information that qualifies as critical Commission complies with each
215A(d)(1)(B), exempting CEII from energy infrastructure information under provision in section 215A(d)(2) with
public disclosure, into the NDA.26 TAPS the Commission’s regulations.’’ 30 In regard to designating and handling
requests that the Commission eliminate subsuming the Commission’s existing Critical Electric Infrastructure
the State Agency NDA. TAPS contends Critical Energy Infrastructure Information. The fact that those rules
that ‘‘[p]rior to the FAST Act’s express Information within section 215A’s CEII also apply to Critical Energy
preemption of Sunshine Laws requiring definition, Congress expressly stated Infrastructure Information does not
disclosure,’’ the State Agency NDA was that the definition of CEII includes diminish the Commission’s compliance
an attempt to impose a contractual Critical Energy Infrastructure under the FAST Act. Rather, in this
nondisclosure requirement for critical Information. There is no indication in regard, the Commission’s determination
energy infrastructure information the language of the FAST Act that meets Congress’s intent. Moreover,
provided to a State agency. TAPS Congress intended to limit the types of APPA’s argument that ‘‘information
maintains that, once section Critical Energy Infrastructure related to cyber threats and defensive
215A(d)(1)(B) is included in the general Information to only electric measures should not be ‘protected’
NDA, the State Agency NDA should be infrastructure information.31 under a designation regime that also
eliminated because it is now 19. Including Critical Energy provides for potentially involuntary
unnecessary.27 Infrastructure Information within the access by any federal employee . . .,
15. With respect to the proposed edits definition of CEII is not inconsistent landowners [or]any person who is a
to sections 388.112 and 388.113 to with the provisions of section participant in a Commission proceeding
separate the Commission’s treatment of 215A(d)(10), as APPA maintains. First, . . .’’ and others has no basis in the text
privileged material from the section 215A(d)(10) states that removal of the FAST Act. APPA notably cites to
Commission’s treatment of CEII, MISO of a CEII designation may be appropriate nothing in the FAST Act to support that
suggests that the title for section 388.112 when the disclosure of such information argument.35 On the contrary, Congress
be changed to ‘‘Submission and ‘‘could no longer be used to impair the explicitly directed the Commission to
treatment of privileged information’’ security or reliability of the bulk-power include voluntary sharing in the
and section 388.113 be changed to system or distribution facilities.’’ regulations that the Commission is
‘‘Submission and treatment of Critical (Emphasis supplied.) Thus, it is clear required to promulgate under the FAST
Electric Infrastructure Information that Congress did not intend for the new Act.36 Further, the implication of
(CEII).’’ 28 Critical Electric Infrastructure APPA’s argument—that cyber
16. The Trade Associations request Information designation to apply only to information is different from other types
that the Commission expressly state in the bulk-power system. Second, Critical of infrastructure information and
the amended regulations that the CEII Energy Infrastructure Information therefore warrants different rules—fails
process is not intended to, and should includes information that ‘‘relates to take into consideration that the
not be interpreted to, supersede or details about the production, generation, Commission will evaluate each request
otherwise affect existing laws, transportation, transmission, or for CEII, and each decision to
regulations, and agency rules that distribution of energy.’’ 32 Such voluntarily share CEII, on a case-by-case
separately safeguard such data.29 basis. For example, a person seeking
information, even if it concerns non-
cyber threat information would have to
Commission Determination electric infrastructure, could be used to
show a different need for the
impair the security or reliability of the
17. As discussed below, the information than a person seeking
bulk-power system, for example by
Commission, with limited information for a pipeline facility for a
severing gas pipeline connections to
modifications, adopts the amendments certificate proceeding.
electric generation facilities. 22. The Commission agrees with
proposed in the NOPR addressing the 20. Moreover, the Commission
scope, purpose and definitions in the TAPS and APPA that the Commission’s
determines that a single CEII process for regulations should incorporate the
CEII regulations. The Commission Critical Energy/Electric Infrastructure
determines that the amendments are Information is the most efficient way to 33 NOPR, 155 FERC ¶ 61,278 at P 14.
34 See Anna Jacques Hosp. v. Burwell, 797 F.3d
24 Id.at 12.
asabaliauskas on DSK3SPTVN1PROD with RULES
30 FAST Act, Public Law 114–94, section 61,003,
25 APPA Comments at 23; TAPS Comments at 9–
1155, 1165 (D.C. Cir. 2015) (holding that
129 Stat. 1312, 1776. ‘‘interstitial question[s] of implementation’’ are left
10; Trade Associations Comments at 32. 31 For the same reason, we reject MISO’s to the discretion of the implementing agency).
26 See id.
recommendation that the title for section 388.112 35 See APPA Comments at 15.
27 TAPS Comments at 10; see also Critical Energy
should be changed to ‘‘Submission and treatment of 36 Section 215A(d)(2)(D) states that the
Infrastructure Information State Agency Employee privileged information’’ and that the title for section Commission ‘‘shall promulgate such regulations as
Non-Disclosure Agreement, http://www.ferc.gov/ 388.113 should be changed to ‘‘Submission and necessary to . . . facilitate voluntary sharing of
legal/ceii-foia/ceii/state-agen-nda.pdf. treatment of Critical Energy Infrastructure critical electric infrastructure information . . .’’
28 MISO Comments at 3. Information (CEII).’’ MISO Comments at 3. FAST Act, Public Law 114–94, section 61,003, 129
29 See Trade Associations Comments at 26. 32 18 CFR 388.113(c)(1)(i)). Stat. 1312, 1776.
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/3.svg)
![Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations 93735
provision in section 215A(d)(1)(B) that general location of the critical We disagree that the State Agency NDA
CEII ‘‘shall not be made available by any infrastructure’’ or simply provides the should be eliminated because it
Federal, State, political subdivision or name of the facility is not CEII.40 reinforces the minimum protections
tribal authority pursuant to any Federal, However, under certain circumstances, applicable to CEII that the Commission
State, political subdivision or tribal law information regarding the location of may provide to states as well as
requiring public disclosure of infrastructure or its name that is not provides for additional protections
information or records.’’ 37 As to TAPS’s already publicly known could be CEII.41 beyond the exemptions in State public
and APPA’s request that the Therefore, we clarify that, while as a disclosure laws.44
Commission define the term ‘‘political general matter the location or name of
28. Finally, the Commission declines
subdivision,’’ in section 215A(d)(1)(B) infrastructure is not CEII, a submitter of
to adopt the revision suggested by the
of the FAST Act to be consistent with information to the Commission may ask
Trade Associations to expressly state
the definition of that term in FPA that non-public information about the
that the CEII regulations are not
section 201(f), Congress did not adopt location, or the name, of critical
the definition of ‘‘political subdivision’’ infrastructure be treated as CEII. The intended to supersede other laws,
in section 201(f) for the purposes of the submitter would have to provide a regulations, and agency rules that
FAST Act. However, the Commission justification for the request and explain separately safeguard such data.45 This
believes that the broad language of why the information is not already Final Rule and adopted CEII
section 215A(d)(1)(B), as it applies to publicly known. amendments do not purport to
‘‘any Federal, State, political 25. In response to NRECA’s request supersede any other legal authorities
subdivision or tribal authority,’’ should that the Commission clarify that other than the regulations and
encompass the instrumentalities and material treated as Critical Energy associated materials specifically
components of States. Section Infrastructure Information under the amended in this Final Rule.
215A(d)(1)(B) was included to protect Commission’s current regulations B. Criteria and Procedures for
CEII from mandatory disclosure. It would, in most circumstances, be Determining What Constitutes CEII
would be illogical to provide such treated as CEII under the amended
protection to States, but not their regulations, we note that such 1. General Criteria and Procedures
instrumentalities and components. information should continue to qualify NOPR
23. The Commission disagrees with as CEII. We also note, however, in
TAPS that the Commission should response to Powerex’s comment, that it 29. Section 215A(d)(2)(A) requires the
delete from the definition of Critical is conceivable that Critical Electric Commission to ‘‘establish criteria and
Energy Infrastructure Information the Infrastructure Information may include procedures to designate information as
provision that states that Critical Energy information that would not fall within critical electric infrastructure
Infrastructure Information ‘‘[i]s exempt the existing definition of Critical Energy information.’’ In the NOPR, the
from mandatory disclosure under the Infrastructure Information.42 Commission proposed criteria and
Freedom of Information Act, 5 U.S.C. 26. We agree with Powerex’s procedures for the handling of CEII
552.’’ 38 As we have discussed above, comment that the Final Rule should consistent with section 215A(d)(2)(A).46
Congress incorporated Critical Energy only address CEII and not other types of
Infrastructure Information within information. In response to Powerex’s Comments
section 215A’s definition of Critical concerns about a party’s due process
Electric Infrastructure Information rights, under the amended CEII 30. Commenters request that the
without revision.39 Accordingly, the regulations the Commission will Commission provide more detail on
Commission will retain its current balance the need to protect critical what qualifies as CEII.47 The Public
definition of Critical Energy information with the potential need of Interest Organizations, for example, ask
Infrastructure Information. parties participating in Commission the Commission to publish guidelines
24. In response to the Trade proceedings to access CEII. For example, and criteria for designating information
Associations’ comments seeking the Commission’s regulations include a as CEII.48 The Public Interest
clarification if a name or location of a process for parties to access information Organizations further recommend that
facility should be protected as CEII, the directly from other parties in a the Commission publish ‘‘data tables
Commission’s current practice is that Commission proceeding.43 that provide suggested classifications for
information that ‘‘simply give[s] the 27. In response to comments from common data types.’’ 49 HRC asks that
TAPS, APPA, and the Trade the Commission require entities filing
37 APPA states that there may be instances where Associations, the Commission agrees CEII to include a public cover letter
an entity could provide CEII to NERC who, in turn, that the CEII NDA should reference the providing a description of the facility
may submit that entity’s information to the the information relates to and describing
Commission or DOE as CEII without notifying the provision in section 215A(d)(1) that CEII
entity. Thus, APPA is concerned the entity may not is exempt from disclosure under any the nature of the submission. HRC also
be aware that the information has been submitted Federal, State, political subdivision or contends that information submitted as
to the Commission and designated as CEII. As a tribal law requiring public disclosure. CEII should include a more detailed
result, APPA suggests that the Commission description in eLibrary.50 HRC contends
establish notification procedures so that entities are
aware that their information was designated as CEII. 40 18 CFR 388.113(c)(1)(iv). that this information will better allow
APPA Comments at 21–22. We see no need to adopt 41 For example, the location of an operating the public to understand the basis for
such a notification process. Section 1505 of NERC’s transformer is likely publicly known. However, the
asabaliauskas on DSK3SPTVN1PROD with RULES
Rules of Procedure already requires NERC, unless location of a spare transformer housed in a central 44 See supra note 27.
otherwise directed by the Commission or its staff, location may not be publicly known and, therefore, 45 See
to notify submitting entities of requests made by the may qualify as CEII. Trade Associations Comments at 26.
46 NOPR, 155 FERC ¶ 61,278 at P 16.
Commission to NERC for the submitting entities’ 42 For example, while Critical Energy
47 Peak Comments at 8–10; Powerex Comments at
information. Infrastructure Information must satisfy the four-part
38 18 CFR 388.113(c)(2)(iii). definition in amended section 388.113(c)(1), 12; APS Comments at 5; APPA Comments at 17;
39 See Stone v. INS, 514 U.S. 386, 397 (1995) Critical Electric Infrastructure Information must WIRAB Comments at 5.
48 Public Interest Organizations Comments at 4.
(holding that ‘‘[w]hen Congress acts to amend a meet the definition in amended section
statute, we presume it intends its amendment to 388.113(c)(2). 49 Id. at 5.
have real and substantial effect’’). 43 See 18 CFR 388.112(b)(2) and 388.113(g)(4). 50 HRC Comments at 2–3.
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/4.svg)
![93744 Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations
Commission-approved tariffs that have ‘‘ensure that energy infrastructure is person through a NDA. However, the
planning and operations responsibilities protected.’’ 187 Commission’s CEII rules do not, and are
to use those tariffs to facilitate 118. CEA requests that the not intended to, address information
information-sharing.179 Commission include language clarifying that an entity has unilaterally
114. NERC generally supports the that the Commission will make every determined to be CEII and never
Commission’s proposal to facilitate reasonable effort to provide advance submitted to the Commission.194 In
voluntary information sharing with notice before sharing CEII and will addition, the Commission’s regulations
NERC, regional entities and information provide after-the-fact notice if prior do not cover an entity that has
sharing and analysis centers. NERC, notice is not practical.188 MISO submitted CEII to the Commission but
nonetheless, requests that the recommends that the Commission adopt intends to share the same information
Commission, under appropriate regulatory language indicating that with others outside of the Commission’s
circumstances, share CEII with the ‘‘when prior notice is not given, processes. To be clear, an entity that
Electricity Information Sharing & submitters of CEII shall receive notice of receives CEII from the Commission is
Analysis Center (E–ISAC) when a limited release of CEII as soon as subject to the restrictions in the
voluntarily sharing CEII with a practicable.’’ 189 NRECA requests that applicable NDA, including restrictions
governmental entity.180 NERC asks that the Commission clarify that any on use and disclosure. However, an
the voluntary sharing process include disclosure by the Commission on the entity that submitted the information to
coordination between the CEII basis of ‘‘voluntary sharing’’ must be the Commission is not subject to a NDA
Coordinator and certain Commission subject to the same notice, comment, and, as a result, the Commission’s rules
office staff prior to any disclosure.181 and appeal rights provisions that are do not apply to how that entity may
afforded to submitters in response to want to share its information.195
115. APS, the Trade Associations and
CEII requests.190 Moreover, an entity may have
CEA ask for additional criteria as to how
119. The Trade Associations state that information that could qualify as CEII,
and when the Commission will
the proposed regulations could be but such information is not CEII under
voluntarily share information.182
strengthened by: (1) Limiting and the Commission’s regulations unless it
116. APPA asserts that FPA defining the circumstances where notice has been submitted to the Commission
215A(d)(2)(D) directs the Commission would ‘‘not be practicable’’; and (2) pursuant to the Commission’s CEII
only to facilitate voluntary sharing of allowing the submitters an opportunity regulations and the Commission has
CEII among electricity subsector to provide comments protesting the determined it to be CEII.
stakeholders—not to preemptively share release of information the Commission 122. The Final Rule facilitates
CEII with interested parties.183 APPA proposes to voluntarily share.191 voluntary sharing by allowing the
asserts that when the Commission 120. Finally, TAPS requests that the public to request CEII and by adding to
voluntarily shares submitted Commission revise its delegations to the Commission’s regulations a process
information, it effectively forces the reflect the NOPR’s proposal that Office whereby staff may share CEII in a
entity that submitted the information as Directors will engage in voluntary proactive manner with a variety of
CEII to share its information with sharing.192 entities. The Commission agrees with
others, which may reduce the incentive
Commission Determination PJM’s comments that existing non-
for the entity to voluntarily share CEII
public voluntary sharing mechanisms
with the Commission.184 APPA 121. Many of the commenters within the energy industry are sufficient
recommends that the Commission misapprehend how CEII may be to encourage sharing information among
designate E–ISAC and any other voluntarily shared under the FAST Act the different groups and therefore there
appropriate Information Sharing and or otherwise seek to expand the is no need for the Commission to
Analysis Organizations (ISAOs) as Commission’s CEII sharing program in establish requirements for sharing
forums through which CEII can be ways that neither the FAST Act nor the within the industry through tariff
shared under FPA 215A, and to apply NOPR contemplated. Under FPA section revisions or otherwise.196 It is also
the liability protections of FPA section 215A(a)(3), CEII is limited to
unnecessary to adopt Public Interest
215A(f)(3) to those entities.185 APPA information that is submitted to, or
Organizations’ and WIRAB’s
also recommends that the Commission generated by, the Commission and
recommendation that the Commission
provide protections like those that are designated as such by the Commission
establish ‘‘whitelists’’ for third parties to
utilized by other federal agencies to (or information submitted to, or
use or to require entities sharing
facilitate information sharing activity.186 generated by DOE, and designated as
information outside of the
117. The Trade Associations request such by DOE).193 In voluntarily
Commission’s CEII process to adopt a
that the regulations explicitly state that releasing CEII to a person, the particular NDA.
the voluntary sharing of CEII is limited Commission imposes obligations on that
to instances where the Commission has 194 As CEII information has to be designated by
187 Trade Associations Comments at 27–28.
determined that there is a need to the CEII Coordinator or DOE Secretary, information
188 CEA Comments at 6. NRECA also references
that an entity creates and maintains without
the need to provide notice as soon as possible, even providing to the Commission has not been formally
179 Joint RTOs Reply Comments at 2. if such notice is after the disclosure. See NRECA designated as CEII.
180 NERC Comments at 9. Comments at 12. 195 However, other concerns may influence how
181 Id. 189 MISO Comments at 11.
182 APS Comments at 13; Trade Associations
the entity shares its own information with others.
asabaliauskas on DSK3SPTVN1PROD with RULES
190 NRECA Comments at 12–13.
196 Section 215A(d) requires the Commission ‘‘to
Comments at 27; CEA Comments at 5. 191 Trade Associations Comments at 30.
183 APPA Comments at 30.
promulgate [–] regulations as necessary’’ to, inter
192 TAPS Comments at 12–13.
alia, ‘‘facilitate voluntary sharing of critical electric
184 Id. 193 FAST Act, Public Law 114–94, section 61,003, infrastructure information.’’ FAST Act, Public Law
185 APPA Comments at 31–32.
129 Stat. 1312, 1773 (‘‘critical electric infrastructure 114–94, section 61,003, 129 Stat. 1312, 1776. The
186 Id. at 31–32. For example, APPA proposes that information means information . . . generated by or FAST Act, therefore, affords the Commission with
the Commission allow for ‘‘source anonymizing’’ provided to the Commission or other Federal discretion in this regard and, at least implicitly,
shared CEII or to adopt DHS’s Traffic Light Protocol agency . . . that is designated as critical electric recognizes that the Commission may, identify,
to ensure information is shared with the correct infrastructure information by the Commission or encourage and support existing processes to
audience. the Secretary pursuant to subsection (d)’’). facilitate the voluntary sharing of CEII.
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/13.svg)
![Federal Register / Vol. 81, No. 245 / Wednesday, December 21, 2016 / Rules and Regulations 93753
APPENDIX—Continued
Abbreviation Commenter
Reply Comments:
PJM .......................................... PJM Interconnection, LLC.
Joint RTOs ............................... ISO New England, Inc. and Southwest Power Pool, Inc.
[FR Doc. 2016–28322 Filed 12–20–16; 8:45 am]
BILLING CODE 6717–01–P
asabaliauskas on DSK3SPTVN1PROD with RULES
VerDate Sep<11>2014 19:43 Dec 20, 2016 Jkt 241001 PO 00000 Frm 00023 Fmt 4701 Sfmt 9990 E:\FR\FM\21DER2.SGM 21DER2](https://thefederalregister.org/doc/81_FR_93977/page/22.svg)
Document Created: 2018-02-14 09:12:05
Document Modified: 2018-02-14 09:12:05
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Rules and Regulations | |
| Action | Final rule. | |
| Dates | This rule will become effective February 21, 2017. | |
| Contact | Nneka Frye, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029, [email protected] | |
| FR Citation | 81 FR 93732 | |
| CFR Citation | 18
CFR
375 18 CFR 388 | |
| CFR Associated | Authority Delegations (government Agencies); Seals and Insignia; Sunshine Act; Confidential Business Information and Freedom of Information |
2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR