Federal Register Vol. 83, No.147,

The FAA has determined that notice of, and opportunity for prior public comment on, these amended special conditions is impracticable because these procedures would significantly delay issuance of the design approval and thus delivery of the affected airplane. Additionally, the substance of these special conditions has been published in the Federal Register for public comment in several prior instances with no substantive comments received. Therefore, the FAA has determined that prior public notice and comment are impracticable and unnecessary, and finds that, for the same reasons, good cause exists for adopting these special conditions upon publication in the Federal Register.

We invite interested people to take part in this rulemaking by sending written comments, data, or views. The most helpful comments reference a specific portion of the special conditions, explain the reason for any recommended change, and include supporting data.

We will consider all comments we receive by the closing date for comments. We may change these special conditions based on the comments we receive.

On May 30, 2012, Bombardier applied for an amendment to Type Certificate No. T00003NY to include the new Models BD-700-2A12 and BD-700-2A13 series airplanes. The BD-700-2A12 and BD-700-2A13 series airplanes, are derivatives of the BD-700 currently approved under Type Certificate No. T00003NY, and are business jets with a maximum certified passenger capacity of 19. The maximum takeoff weight of Model BD-700-2A12 airplane is 106,250 lbs. and 104,800 lbs. for the Model BD-700-2A13 airplane.

Under the provisions of title 14, Code of Federal Regulations (14 CFR) 21.101, Bombardier must show that the Model BD-700-2A12 and BD-700-2A13 series airplanes meet the applicable provisions of the regulations listed in Type Certificate No. T00003NY or the applicable regulations in effect on the date of application for the change except for earlier amendments as agreed upon by the FAA.

If the Administrator finds that the applicable airworthiness regulations (i.e., 14 CFR part 25) do not contain adequate or appropriate safety standards for the Model BD-700-2A12 and BD-700-2A13 series airplanes because of a novel or unusual design feature, special conditions are prescribed under the provisions of § 21.16.

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same novel or unusual design feature, these special conditions would also apply to the other model under § 21.101.

In addition to the applicable airworthiness regulations and special conditions, the Bombardier Model BD-700-2A12 and BD-700-2A13 series airplanes must comply with the fuel-vent and exhaust-emission requirements of 14 CFR part 34, and the noise-certification requirements of 14 CFR part 36.

The FAA issues special conditions, as defined in 14 CFR 11.19, in accordance with § 11.38, and they become part of the type certification basis under § 21.101.

The Model BD-700-2A12 and BD-700-2A13 series airplanes will incorporate the following novel or unusual design features:

Fly-by-wire EFCS that will limit pitch and roll functions to prevent the airplane from attaining certain pitch attitudes and roll angles greater than plus or minus 65 degrees, and introduce positive spiral stability introduced for roll angles greater than 30 degrees at speeds below VMO/MMO. This system generates the actual surface commands that provide for stability augmentation and flight control for all three airplane axes (longitudinal, lateral, and directional).

Part 25 of title 14 of the CFR does not specifically relate to flight characteristics associated with fixed attitude limits. Bombardier proposes to implement on the airplanes pitch and roll attitude-limiting functions via the EFCS normal mode. This will prevent the airplane from attaining certain pitch attitudes and roll angles greater than plus or minus 65 degrees. In addition, positive spiral stability, introduced for roll angles greater than 30 degrees at speeds below VMO/MMO, and spiral stability characteristics, must not require excessive pilot strength to achieve bank angles up to the bank-angle limit.

Bombardier requested this amendment, in order to be performance-based rather than prescriptive and to more closely follow the language developed in the Aviation Rulemaking Advisory Committee (ARAC) Flight Test Harmonization Working Group (FTHWG). The FAA concurs with this request.

The basic envelope protection requirement, historically applied, is to not unduly limit the maneuver capability of the airplane, or interfere with its ability to perform maneuvers required for normal and emergency operations. Since the design details used to meet this requirement vary from airplane to airplane, this amendment recognizes and adopts that philosophy for this specific design implementation. The substance of the special conditions is unchanged, in that, for this specific design, the design details support the objective of not unduly limiting the maneuver capability, while also protecting the airplane from adverse attitudes.

These special conditions are in addition to the requirements of § 25.143. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

As discussed above, these special conditions are applicable to the Model BD-700-2A12 and BD-700-2A13 series airplanes. Should Bombardier apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design feature, these special conditions would apply to that model as well.

This action affects only certain novel or unusual design features on one model series of airplanes. It is not a rule of general applicability.

The authority citation for these special conditions is as follows:

In addition to § 25.143, the following requirements apply to the electronic flight-control system (EFCS) pitch- and roll-limiting functions:

1. The pitch-limiting function must not impede normal maneuvering for pitch angles up to the maximum required for normal maneuvering, including a normal, all-engines-operating takeoff, plus a suitable margin to allow for satisfactory speed control.

2. The pitch- and roll-limiting functions must not restrict or prevent attaining pitch attitudes necessary for emergency maneuvering, or roll angles up to 65 degrees. Spiral stability, which is introduced above 30 degrees of roll angle, must not require excessive pilot strength to achieve these roll angles. Other protections, which further limit the roll capability under certain extreme angle-of-attack, attitude, or high-speed conditions, are acceptable, as long as the airplane is able to perform coordinated turns as per § 25.143(h). A roll attitude limit of approximately 45 degrees at high angle-of-attack conditions is acceptable.

3. A reduced roll attitude limit is acceptable at extreme nose down pitch attitudes and beyond the overspeed warning to provide protection against high-speed combined pitch and roll upsets. The airplane should be able to perform operational turns at these speeds. A roll attitude limit of approximately 30 degrees at Vdf/Mdf is considered acceptable.

Discussion

We learned from GE of a quality escape at one of their suppliers. This supplier was performing welds on newly-manufactured components to correct errors introduced in their manufacturing process. These welds were not reviewed or approved by either GE or the FAA. GE's review of manufacturing records determined that these parts include HPT cases installed on GEnx engines. These HPT cases are life limited. The unapproved repairs reduced the material capability of these cases which requires their removal prior to reaching their published Airworthiness Limitation Section life limit. This condition, if not addressed, could result in failure of the HPT case, engine fire, and damage to the airplane. We are issuing this AD to address the unsafe condition on these products.

We reviewed GE Service Bulletin (SB) GEnx-1B S/B 72-0424, Revision 03, dated June 29, 2018 and GEnx-2B S/B 72-0360, Revision 03, dated June 29, 2018. The SBs describe procedures for removing the affected HPT cases from the engine. GE SB GEnx-1B S/B 72-0424 is effective for GEnx-1B engines with the serial numbers of HPT cases listed in that SB. GE SB GEnx-2B S/B 72-0360 is effective for GEnx-2B engines with the serial numbers of HPT cases listed in that SB. This service information is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

We reviewed Inspection 001, Subtask 72-52-01-230-001 of GEnx-1B Cleaning, Inspection, and Repair Manual GEK112862, Rev 27, dated April 30, 2018, and GEnx-2B Cleaning, Inspection, and Repair Manual GEK114120, Rev 20, dated April 30, 2018. These manuals provide guidance for conducting Class A fluorescent penetrant inspections.

We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously is likely to exist or develop in other products of the same type design.

This AD requires removal of the affected HPT cases from service and their replacement with a part eligible for installation.

An unsafe condition exists that requires the immediate adoption of this AD without providing an opportunity for public comments prior to adoption. The FAA has found that the risk to the flying public justifies waiving notice and comment prior to adoption of this rule because the compliance time for the required action is shorter than the time necessary for the public to comment and for us to publish the final rule. Therefore, we find good cause that notice and opportunity for prior public comment are impracticable. In addition, for the reason stated above, we find that good cause exists for making this amendment effective in less than 30 days.

This AD is a final rule that involves requirements affecting flight safety and was not preceded by notice and an opportunity for public comment. However, we invite you to send any written data, views, or arguments about this final rule. Send your comments to an address listed under the ADDRESSES section. Include the docket number FAA-2018-0630 and Product Identifier 2018-NE-25-AD at the beginning of your comments. We specifically invite comments on the overall regulatory, economic, environmental, and energy aspects of this final rule. We will consider all comments received by the closing date and may amend this final rule because of those comments.

We will post all comments we receive, without change, to http://www.regulations.gov, including any personal information you provide. We will also post a report summarizing each substantive verbal contact we receive about this final rule.

We estimate that this AD affects 13 engines installed on airplanes of U.S. registry.

We estimate the following costs to comply with this AD:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. “Subtitle VII: Aviation Programs” describes in more detail the scope of the Agency's authority.

We are issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: “General requirements.” Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This AD is issued in accordance with authority delegated by the Executive Director, Aircraft Certification Service, as authorized by FAA Order 8000.51C. In accordance with that order, issuance of ADs is normally a function of the Compliance and Airworthiness Division, but during this transition period, the Executive Director has delegated the authority to issue ADs applicable to engines, propellers, and associated appliances to the Manager, Engine and Propeller Standards Branch, Policy and Innovation Division.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Is not a “significant rule” under DOT Regulatory Policies and Procedures (44 FR 11034, February 26, 1979),

(3) Will not affect intrastate aviation in Alaska, and

(4) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

1. Pursuant to section 215(d)(5) of the Federal Power Act (FPA), the Commission directs the North American Electric Reliability Corporation (NERC) to develop and submit modifications to the NERC Reliability Standards to augment the mandatory reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES.1 The Commission directs NERC to develop and submit modifications to the Reliability Standards to require the reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's Electronic Security Perimeter (ESP) or associated Electronic Access Control or Monitoring Systems (EACMS).2

2. In the NOPR, the Commission observed that Cyber Security Incidents are presently reported by responsible entities in accordance with Reliability Standard CIP-008-5 (Cyber Security—Incident Reporting and Response Planning).3 However, under the definition of Reportable Cyber Security Incident in Reliability Standard CIP-008-5, responsible entities must only report Cyber Security Incidents if they have “compromised or disrupted one or more reliability tasks.” The Commission explained that the current reporting threshold may understate the true scope of cyber-related threats facing the Bulk-Power System, particularly given the lack of any reportable incidents in 2015 and 2016. To improve awareness of existing and future cyber security threats and potential vulnerabilities, the Commission proposed to direct that NERC develop and submit modifications to the existing Reliability Standards to augment the reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES.

3. As discussed in detail below, the Commission adopts the NOPR proposal. The Commission's directive in this Final Rule consists of four elements intended to augment the current Cyber Security Incident reporting requirement: (1) Responsible entities must report Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS; (2) required information in Cyber Security Incident reports should include certain minimum information to improve the quality of reporting and allow for ease of comparison by ensuring that each report includes specified fields of information; (3) filing deadlines for Cyber Security Incident reports should be established once a compromise or disruption to reliable BES operation, or an attempted compromise or disruption, is identified by a responsible entity; and (4) Cyber Security Incident reports should continue to be sent to the Electricity Information Sharing and Analysis Center (E-ISAC), rather than the Commission, but the reports should also be sent to the Department of Homeland Security (DHS) Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Further, NERC must file an annual, public, and anonymized summary of the reports with the Commission.

4. As discussed below, after considering the comments submitted in response to the NOPR, we conclude that the proposed directive to augment the current reporting requirement for Cyber Security Incidents is appropriate to carry out FPA section 215. As NERC recognizes in its NOPR comments, “[b]roadening the mandatory reporting of Cyber Security Incidents would help enhance awareness of cyber security risks facing entities[,] . . . would create a more extensive baseline understanding of the nature of cyber security threats and vulnerabilities[,] . . . [and] is consistent with recommendations in NERC's 2017 State of Reliability Report.” 4 Our directive is intended to result in a measured broadening of the existing reporting requirement in Reliability Standard CIP-008-5, consistent with NERC's recommendation, rather than a wholesale change in cyber incident reporting that supplants or otherwise chills voluntary reporting, as some commenters maintain. Indeed, as NERC contends, we believe that the new “baseline understanding, coupled with the additional context from voluntary reports received by the E-ISAC, [will] allow NERC and the E-ISAC to share that information broadly through the electric industry to better prepare entities to protect their critical infrastructure.” 5

5. We address in the discussion below concerns raised by commenters regarding elements of the Commission's directive and the burdens the directive might impose if NERC develops requirements that are overly broad. At the outset, we agree with NERC that “because certain requirements in the CIP Reliability Standards already require entities to track data on compromises or attempts to compromise the ESP or EACMS, the additional burden to report that data appears reasonable.” 6 And we do not believe that complying with the augmented reporting requirements that we direct here would be any more burdensome to industry than the alternative, responding to a perpetual data or information request to collect the same information pursuant to Section 1600 of the NERC Rules of Procedure. To ensure that the burden is reasonable with respect to including EACMS in the augmented reporting requirement, NERC should develop requirements based on the function of the EACMS and the nature of the attempted compromise or successful intrusion. Similarly, as discussed below, NERC should develop reporting timelines for Cyber Security Incidents that are commensurate with the adverse or attempted adverse impact to the BES that loss, compromise, or misuse of those BES Cyber Systems could have on the reliable operation of the BES.7 Prioritizing incident reporting will allow responsible entities to devote resources to reporting the most significant Cyber Security Incidents faster than less significant events. With this guidance, we believe that the standard drafting team, in the first instance, is in the best position to develop the specific elements of the directed Reliability Standard requirements.

6. We have considered comments submitted by NERC and others recommending that broadened Cyber Security Incident reporting should be implemented through a request for information or data pursuant to Section 1600 of the NERC Rules of Procedure instead of through Reliability Standard requirements. However, on balance, we believe that broadened mandatory reporting pursuant to Reliability Standard requirements as opposed to a standing data request is more aligned with the seriousness and magnitude of the current threat environment, and more likely to improve awareness of existing and future cyber security threats and potential vulnerabilities. Four main reasons inform our decision. First, a new or modified Reliability Standard will ensure that the desired goals of our directive are met because the Commission will have the ability to review and ultimately approve the standard, as opposed to the opportunity for informal review that the Commission would have of a data request under ROP Section 1600. Second, the Commission has well-defined authority and processes under section 215(e) of the FPA to audit and enforce compliance with a Reliability Standard. Third, we do not anticipate that there will be a need to change the parameters of the Cyber Security Incident report for EACMS because the parameters that we direct below are based on five static functions of EACMS and are not technology specific, so the potential flexibility provided by a Section 1600 data request may not be significantly beneficial. Finally, collecting data through a Reliability Standard is consistent with existing practices; responsible entities are currently required to maintain the types of information that would lead to a reportable Cyber Security Incident pursuant to Reliability Standard CIP-007-6, Requirement R4.1. Nonetheless, should future events require an expedited change in data collection or should NERC desire to collect data outside the scope of the proposed Reliability Standard, NERC could then use the Section 1600 process to supplement information reported under a mandatory Reliability Standard.

7. Accordingly, pursuant to section 215(d)(5) of the FPA, we adopt the NOPR proposal and direct NERC to develop modifications to the Reliability Standards to include the mandatory reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS, as well as modifications to specify the required information in Cyber Security Incident reports, their dissemination, and deadlines for filing reports. We direct NERC to submit the directed modifications within six-months of the effective date of this Final Rule.

8. Section 215 of the FPA requires a Commission-certified Electric Reliability Organization (ERO) to develop mandatory and enforceable Reliability Standards, subject to Commission review and approval. Reliability Standards may be enforced by the ERO, subject to Commission oversight, or by the Commission independently.8 Pursuant to section 215 of the FPA, the Commission established a process to select and certify an ERO,9 and subsequently certified NERC.10

9. On December 21, 2017, the Commission issued a NOPR proposing to direct that NERC develop enhanced Cyber Security Incident reporting requirements. Specifically, pursuant to section 215(d)(5) of the FPA, the NOPR proposed to direct NERC to develop modifications to the Reliability Standards to require the reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS. The proposed directive was based in part on a lack of Reportable Cyber Security Incidents in 2015 and 2016, and NERC's assessment in the 2017 State of Reliability Report that “[w]hile there were no reportable cyber security incidents during 2016 and therefore none that caused a loss of load, this does not necessarily suggest that the risk of a cyber security incident is low.” 11 In addition, the NOPR stated that it agreed with the recommendation by NERC in the 2017 State of Reliability Report to “redefine reportable incidents to be more granular and include zero-consequence incidents that might be precursors to something more serious.” 12

10. In justifying the proposed inclusion of ESPs and associated EACMS within the scope of the enhanced Cyber Security Incident requirement, the NOPR stated that the purpose of an ESP is to manage electronic access to BES Cyber Systems to support the protection of the BES Cyber Systems against compromise that could lead to misoperation or instability in the BES.13 In addition, the NOPR explained that EACMS, which include, for example, firewalls, authentication servers, security event monitoring systems, intrusion detection systems and alerting systems, control electronic access into the ESP and play a significant role in the protection of high and medium impact BES Cyber Systems.14 The NOPR indicated further that, once an EACMS is compromised, an attacker could more easily enter the ESP and effectively control the BES Cyber System or Protected Cyber Asset.

11. The NOPR discussed the scope of the present Cyber Security Incident reporting requirement. The NOPR observed that Reliability Standard CIP-008-5, Requirement R1.2 currently requires that each responsible entity shall document one or more Cyber Security Incident Plan(s) with one or more processes to determine if an identified Cyber Security Incident is a Reportable Cyber Security Incident. And where a Cyber Security Incident is determined to qualify as a Reportable Cyber Security Incident, the NOPR explained that responsible entities are required to notify the E-ISAC with initial notification within one hour from the determination of a Reportable Cyber Security Incident. The NOPR stated, however, that the NERC Glossary defines a Reportable Cyber Security Incident as “[a] Cyber Security Incident that has compromised or disrupted one or more reliability tasks of a functional entity.” The NOPR indicated that the definition of Reportable Cyber Security Incident, insofar as it excludes unsuccessful attempts to compromise or disrupt a responsible entity's core activities, is thus more narrow than the definition of “cybersecurity incident” in FPA section 215(a)(8), which encompasses “a malicious act or suspicious event that disrupts, or was an attempt to disrupt, the operation of those programmable electronic devices and communication networks including hardware, software and data that are essential to the reliable operation of the bulk power system.” 15

12. The NOPR stated that altering the Cyber Security Incident reporting threshold to require reporting of attempts to compromise, instead of only successful compromises, is consistent with information already logged by registered entities pursuant to current monitoring requirements in the Reliability Standards. The NOPR explained that Reliability Standard CIP-007-6, Requirement R4.1, mandates logging of detected successful login attempts, detected failed access attempts, and failed login attempts, and the Guidelines and Technical Basis for Requirement R4.1 states that events should be logged even if access attempts were blocked or otherwise unsuccessful.16

13. In addition to modifying the reporting threshold, the NOPR proposed to direct NERC to modify the Reliability Standards to specify the required information in Cyber Security Incident reports to improve the quality of reporting and allow for ease of comparison by ensuring that each report includes specified fields of information, as well as the deadlines for submitting a report. Specifically, the NOPR proposed that the minimum set of attributes to be reported should include: (1) The functional impact, where possible, that the Cyber Security Incident achieved or attempted to achieve; (2) the attack vector used to achieve or attempt to achieve the Cyber Security Incident; and (3) the level of intrusion achieved or attempted by the Cyber Security Incident. The NOPR explained that knowledge of these attributes regarding a specific Cyber Security Incident will improve awareness of cyber threats to BES reliability. The NOPR also noted that the proposed attributes are the same as attributes already used by DHS for its multi-sector reporting and summarized by DHS in an annual report.17

14. The NOPR also proposed to continue to require that Cyber Security Incident reports be sent to the E-ISAC instead of the Commission, but the NOPR proposed to require that such reports also be sent to ICS-CERT and that NERC file with the Commission an annual, public, and anonymized summary of such reports.

15. Finally, the NOPR sought comment on potential alternatives to modifying the mandatory reporting requirements in the NERC Reliability Standards. Specifically, the NOPR sought comment on whether a request for data or information pursuant to Section 1600 of the NERC Rules of Procedure would effectively address the reporting gap and current lack of awareness of cyber-related incidents among NERC, responsible entities and the Commission, and satisfy the goals of the proposed directive.

16. Pursuant to section 215(d)(5) of the FPA, we adopt the NOPR proposal and direct NERC to develop and submit modifications to the NERC Reliability Standards to augment current mandatory reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES. We direct NERC, subject to the discussion below, to develop and submit Reliability Standard requirements that: (1) Require responsible entities to report Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS; (2) specify the required information in Cyber Security Incident reports; (3) establish deadlines for filing Cyber Security Incident reports that are commensurate with incident severity; and (4) require that Cyber Security Incident reports be sent to ICS-CERT, in addition to E-ISAC, and that NERC file with the Commission an annual, public, and anonymized summary of such reports.

17. Below, we discuss the following matters: (A) The need for broadened mandatory Cyber Security Incident reporting; (B) the threshold for a reportable Cyber Security Incident; (C) the appropriate procedural approach to augment Cyber Security Incident reporting, i.e., new or modified Reliability Standards versus a NERC data request to applicable entities; (D) the content and timing of Cyber Security Incident reports; and (E) other issues.

18. In the NOPR, the Commission indicated that cyber-related event reporting is currently addressed in Reliability Standard CIP-008-5, Requirement R1.2, which requires that each responsible entity shall document one or more Cyber Security Incident Plan(s) with one or more processes to determine if an identified Cyber Security Incident is a Reportable Cyber Security Incident. The NOPR noted that a Cyber Security Incident is defined in the NERC Glossary as: “A malicious act or suspicious event that: (1) compromises, or was an attempt to compromise, the Electronic Security Perimeter or Physical Security Perimeter or (2) disrupts, or was an attempt to disrupt, the operation of a BES Cyber System.”

19. The Commission further explained that where a cyber-related event is determined to qualify as a Reportable Cyber Security Incident, responsible entities are required to notify the E-ISAC with initial notification to be made within one hour from the determination of a Reportable Cyber Security Incident.18 However, the NOPR observed that a Reportable Cyber Security Incident is defined more narrowly in the NERC Glossary than a Cyber Security Incident because the former requires that the incident result in the compromise or disruption of one or more reliability tasks of a functional entity. As the Commission explained, in order for a cyber-related event to be considered reportable under the existing CIP Reliability Standards, it must compromise or disrupt a core activity (e.g., reliability task) of a responsible entity that is intended to maintain BES reliability.19 Therefore, under these definitions, unsuccessful attempts to compromise or disrupt a responsible entity's core activities are not subject to the current reporting requirements in Reliability Standard CIP-008-5 or elsewhere in the CIP Reliability Standards.

20. The NOPR explained that recent NERC State of Reliability Reports indicate that there were no Reportable Cyber Security Incidents in 2015 and 2016. The NOPR also highlighted NERC's conclusion that “[w]hile there were no reportable cyber security incidents during 2016 and therefore none that caused a loss of load, this does not necessarily suggest that the risk of a cyber security incident is low.” 20 The NOPR contrasted the results reported in the NERC reports with the 2016 annual summary of the Department of Energy's (DOE) Electric Disturbance Reporting Form OE-417, which contained four cybersecurity incidents reported in 2016; two suspected cyber attacks and two actual cyber attacks.21 Moreover, the NOPR noted that ICS-CERT responded to fifty-nine cybersecurity incidents within the Energy Sector in 2016.22

21. Based on the comparison of information reported by NERC, DOE, and ICS-CERT, the NOPR concluded that the current reporting threshold in Reliability Standard CIP-008-5 may not reflect the true scope and scale of cyber-related threats facing responsible entities. In particular, the NOPR raised a concern that the disparity in the reporting of cyber-related incidents under existing reporting requirements, in particular the lack of any incidents reported to NERC in 2015 and 2016, suggests a gap in the current reporting requirements. The NOPR highlighted the fact that this concern is echoed in the 2017 NERC State of Reliability Report, which includes a recommendation that NERC and industry should “redefine reportable incidents to be more granular and include zero-consequence incidents that might be precursors to something more serious.” 23 Agreeing with NERC's recommendation in the 2017 State of Reliability report, the NOPR proposed to direct NERC to address the apparent gap in cyber incident reporting.

22. NERC supports improving the reporting of Cyber Security Incidents, stating that “[b]roadening the mandatory reporting of Cyber Security Incidents would help enhance awareness of cyber security risks facing entities.” 24 NERC maintains that enhanced reporting “would create a more extensive baseline understanding of the nature of cyber security threats and vulnerabilities.” 25 NERC notes that broadening the scope of Cyber Security Incident reporting “is consistent with recommendations in NERC's 2017 State of Reliability Report.” 26 While NERC recognizes the need for enhanced Cyber Security Incident reporting, as discussed in the following sections, NERC does not support all aspects of the NOPR, including requiring enhanced cyber incident reporting through a modified Reliability Standard.

23. BPA, ITC, IRC, NYPSC, and NRG also support the NOPR proposal to direct NERC to address the gap in reporting Cyber Security Incidents. As noted by BPA, the current definition of Reportable Cyber Security Incident only addresses successful attempts to compromise or disrupt operations and, therefore, “a broader definition of a Reportable Cyber Security incident is warranted” because “information about certain attempts to compromise will likely better assist the industry in preventing successful cyber attacks.” 27 BPA, ITC, and IRC raise concerns, however, regarding the risk of over-reporting. IRC states that the proposed requirement to report all attempts to compromise an ESP or associated EACMS “needs further clarification.” 28 BPA states that any new reporting requirement “must ensure that the information reported is useful and does not result in under and over reporting of information.” 29 NRG recommends that the term “attempt” should be clarified (i.e., as a more serious risk than a port scan) and “should be provided in technical guidance or glossary definition relating to the context of [the] existing NERC glossary term: Cyber Security Incident.” 30

24. EEI/NRECA, Trade Associations, APS, Chamber, EnergySec, Eversource, Idaho Power, and LPPC do not support the NOPR proposal to direct NERC to address the gap in reporting Cyber Security Incidents. EEI/NRECA, Trade Associations, and Chamber suggest that the Commission support existing voluntary reporting practices as opposed to mandating the reporting of Cyber Security Incidents through the CIP Reliability Standards. EEI/NRECA state that “[s]ignificant resources from responsible entities and government are engaged in [. . .] partnerships” to share threat and vulnerability information.31 EEI/NRECA argue that “[m]andating such sharing will overlap with these voluntary efforts and may harm the partnerships and ability of the programs to enhance cybersecurity for the electric grid.” 32 In addition, EEI/NRECA state that mandating Cyber Security Incident reporting “may weaken the ability of electric companies to participate in these [voluntary reporting] programs by shifting their focus to compliance activity.” 33 Eversource states that the NOPR proposal would “introduce new technical and administrative challenges that will likely impact responsible entities' ability to participate in existing voluntary threat information sharing programs.” 34 LPPC states that whatever action the Commission takes on Cyber Security Incident reporting, it “must be done with an eye towards causing as little disruption to existing information sharing programs as possible.” 35

25. Trade Associations state that while improving Cyber Security Incident reporting is an appropriate objective, “directing new or revised mandatory reliability standards is not the only tool that NERC and the Commission have for achieving that reliability objective.” 36 Trade Associations contend that, in light of the constantly evolving state of cyber security, “the Commission should consider and utilize the most flexible tools to achieve its reliability goals without imposing undue burden on registered entities.” 37

26. APS states that while it “supports the Commission's objectives expressed in the NOPR,” it does not agree that modifying the CIP Reliability Standards is the appropriate solution.38 APS asserts that “the reporting requirements that already exist under Form OE-417 meet the same objectives as the Commission is attempting to satisfy by requiring additional reporting under the CIP Standards as proposed in the NOPR.” 39 APS instead suggests that “the Commission . . . direct NERC to modify the CIP Standards to include a requirement for Responsible Entities to submit copies of its Form OE-417 to the E-ISAC and ICS-CERT.” 40

27. EnergySec states that it is “generally in agreement with the Commission's goal of increasing the frequency and detail of incident reporting,” but raises concerns with the specifics of the NOPR proposal.41 EnergySec maintains that “`compromise' as used in the definition of Reportable Cybersecurity Incident does not necessarily imply harm.” 42 Therefore, EnergySec argues that “an incident should be considered a `compromise' if an attacker has obtained the ability to disrupt, even if no disruption occurs.” 43 EnergySec states further that it believes “that a clarified understanding of the current definition of Reportable Cybersecurity Incident can sufficiently address the Commission's concerns” since it “can be construed to include certain non-impactful incidents, as well as incidents affecting [ESPs] and [EACMS].” 44

28. EnergySec also raises a concern that the NOPR proposal is too broad. EnergySec argues that determining incidents that might facilitate future cyber incidents “would be highly subjective and could easily be construed to include systems and networks that are outside the scope of the Commission's authority.” 45 EnergySec notes that most failed login or access attempts are benign in nature and “the volume of such events is orders of magnitude larger than what would be an appropriate volume for mandatory reporting.” 46 EnergySec states further that while it agrees that successful attacks against ESPs and EACMS should be reported, it does not support including attempted compromise in the reporting requirements since the “[d]etermination of attempted compromise is highly subjective and it would therefore be difficult at best to clearly define within the standards a basis for such determinations.” 47

29. Eversource and Idaho Power do not support the NOPR proposal due to the anticipated increased burden that could result from increased mandatory reporting. Eversource states that “expanding the amount of required information to be reported and increasing the number of recipients of the reports will create undue administrative burdens.” 48 In addition, Eversource contends that “the meaning of an attempted compromise is currently undefined and may impose significant burdens on responsible entities to identify such attempts.” 49 Idaho Power states that even though “additional reporting can provide some visibility into the types of threats that entities face, additional administrative burdens such as reporting requirements reduce the finite resources that entities have to monitor and defend their critical infrastructure.” 50

30. LPPC asserts that the NOPR proposal “may yield a substantial quantity of unhelpful information and confusing analysis, while needlessly burdening Registered Entities.” 51 LPPC states that it supports NERC's request for flexibility in addressing enhanced Cyber Security Incident reporting and concludes that “a technical conference may productively explore the nature and scope of the various programs that currently exist for information sharing regarding threats and the incremental value of any new requirements.” 52 Resilient Societies states that “the modifications proposed to improve the reporting of cybersecurity incidents are unlikely to have any significant positive effect.” 53 Specifically, Resilient Societies states that the proposed reporting parameters are not broad enough because “reporting of malware infection is not necessarily within thresholds set on other criteria, such as `compromise,' `breach,' `impact,' or `disruption.' ” 54 Resilient Societies also suggests that the Commission convene a public technical conference.

31. We adopt the NOPR proposal and, pursuant to section 215(d)(5) of the FPA, direct NERC to develop and submit modifications to the Reliability Standards to augment the mandatory reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES. Comments submitted by NERC and others support our determination that enhanced reporting of Cyber Security Incidents will address an existing gap in Cyber Security Incident reporting and will provide useful information on existing and future cyber security risks, as well as provide entities with better visibility into malicious activity prior to an event occurring. As noted in NERC's comments, “[b]roadening the mandatory reporting of Cyber Security Incidents would help enhance awareness of cyber security risks facing entities.” 55 Similarly, BPA agrees with the directive to include attempted compromises in an enhanced reporting regime, stating that “information about certain attempts to compromise will likely better assist the industry in preventing successful cyber attacks.” 56 Moreover, while the record reflects differing views on whether broadened Cyber Security Incident reporting should be mandatory or voluntary, there is general agreement that improved reporting is an appropriate objective.57

32. Some commenters contend that the directive to require mandatory reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS is vague and requires clarification. Recognizing this concern, NERC states that “[t]he challenge is to scope any additional mandatory reporting requirements in a manner that collects meaningful data about security risks without creating an unduly burdensome reporting requirement.” 58 While we address the threshold for a broadened reporting requirement issue in the next section, as a general matter, we agree with NERC that the scope of any new reporting requirement should be tailored to provide better information on cyber security threats and vulnerabilities without imposing an undue burden on responsible entities. Indeed, the NOPR proposal was not intended to be prescriptive or overly broad, but rather support NERC's efforts to enhance the reporting of Cyber Security Incidents as outlined in NERC's 2017 State of Reliability Report through the standards development process.

33. Some commenters assert that a broadened reporting requirement will overlap, duplicate or otherwise chill voluntary reporting programs, potentially diverting resources away from such programs. Other commenters, however, assert that voluntary reporting does not adequately address the gap identified in the NOPR because voluntary reporting and mandatory reporting under currently-effective Reliability Standard CIP-008-5 have not resulted in adequate reporting of cybersecurity threats to the BES.59 As Appelbaum notes, “[w]ithout mandatory reporting scheme a degraded threat image will result.” 60

34. Based on the record, we are not persuaded that our directive to augment current mandatory reporting requirements will adversely impact existing voluntary information sharing efforts. Instead, we agree with NERC's comment that the new “baseline understanding [resulting from broadened mandatory reporting], coupled with the additional context from voluntary reports received by the E-ISAC, [will] allow NERC and the E-ISAC to share that information broadly through the electric industry to better prepare entities to protect their critical infrastructure.” 61 Moreover, we do not anticipate that the incremental burden of the directed modifications will divert significant resources from other information sharing programs since responsible entities are already required to monitor and log successful login attempts, detected failed access attempts, and failed login attempts under Reliability Standard CIP-007-6, Requirement R4.1. Nor do we anticipate that the incremental burden of complying with the directed Reliability Standards modifications would be significantly more than the burden of responding to a standing data or information request under Section 1600. We also do not believe that broadened mandatory reporting is at cross-purposes with voluntary cybersecurity-related programs offered by DHS and other government agencies. We believe that voluntary programs that focus on cyber response and sharing of cyber threat information across industry are important initiatives that should be supported. However, the comments do not provide a compelling explanation why the broadening of mandatory reporting will supplant or inhibit voluntary programs.

35. While we agree with EnergySec that revisions to the current definition of Reportable Cyber Security Incident could address some aspects of our directive, a modified definition alone would not address the need to specify the required information in Cyber Security Incident reports to improve the quality of reporting and allow for ease of comparison, or establish deadlines for submitting a report to facilitate timely information sharing. Therefore, while we believe that a modified definition of Reportable Cyber Security Incident could address part of the Commission's concerns, additional modifications would be necessary to meet the full scope of our directive.

36. In addition, we do not agree with Resilient Societies that the detection of malware infecting a responsible entity's ESP or associated EACMS would fall outside the new reporting requirement. While Resilient Societies asserts that a malware infection would not meet the threshold of a compromise, breach, impact, or disruption, we believe that it would fall within the parameters of an attempted compromise. As discussed in the next section, however, we believe that it is appropriate for NERC to address the reporting threshold through the standards development process in order to weigh the diverse technical opinions on how to identify the appropriate assets and the level of attempted compromise that warrants reporting. Accordingly, we are not persuaded to convene a technical conference. Rather, persons interested in the development of appropriate detailed parameters of the augmented reporting requirements should participate in the NERC standards development process.

37. In sum, we conclude that the record supports our determination that directing NERC to develop and submit modifications to the Reliability Standards to require the reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP, as well as associated EACMS, is appropriate to carry out FPA section 215. Therefore, pursuant to FPA section 215(d)(5), we direct NERC to develop and submit modifications to the Reliability Standards to include the mandatory reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS. As noted above, we direct NERC to submit the directed modifications within six-months of the effective date of this Final Rule.

38. The NOPR proposed to direct NERC to modify the Reliability Standards to include the mandatory reporting of Cyber Security Incidents that compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS. The NOPR explained that reporting attempts to compromise, instead of only successful compromises, is consistent with current monitoring requirements in Reliability Standard CIP-007-6, Requirement R4.1, which mandates logging of detected successful login attempts, detected failed access attempts and failed login attempts.62 In addition, the NOPR identified other reporting regimes that include attempts within the general definition of a “cyber incident.” Specifically, DHS defines a “cyber incident” as “attempts (either failed or successful) to gain unauthorized access to a system or its data. . . .” 63 The E-ISAC defines a “cyber incident” as including unauthorized access through the electronic perimeter as well as “a detected effort . . . without obvious success.” 64 And ICS-CERT defines a “cyber incident” as an “occurrence that actually or potentially results in adverse consequences. . . .” 65

39. As noted above, an ESP is defined in the NERC Glossary as the “logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol.” The purpose of an ESP is to manage electronic access to BES Cyber Systems to support the protection of the BES Cyber Systems against compromise that could lead to misoperation or instability in the BES. The NOPR explained that since an ESP is intended to protect BES Cyber Systems, it is reasonable to establish the compromise of, or attempt to compromise, an ESP as the minimum reporting threshold.

40. In addition, the NOPR identified an ESP's associated EACMS as another threshold for a Reportable Cyber Security Incident. As explained in the NOPR, EACMS are defined in the NERC Glossary as “Cyber Assets that perform electronic access control or electronic access monitoring of the Electronic Security Perimeter(s) or BES Cyber Systems. This includes Intermediate Systems.” More specifically, EACMS include, for example, firewalls, authentication servers, security event monitoring systems, intrusion detection systems and alerting systems.

41. While the Commission proposed to include EACMS within the scope of the proposed directive, the Commission also sought comment on the possibility of excluding EACMS from the scope of the proposed directive.

42. NERC supports the NOPR proposal to limit the scope of Cyber Security Incident reporting to incidents that compromise or attempt to compromise a responsible entity's ESP or associated EACMS. NERC explains that any new reporting requirements “need to be scoped in a manner that provides for meaningful reporting of cyber security risks but does not unduly burden entities.” 66 Specifically, NERC states:

NERC notes that some EACMS devices “may provide important early indicators of future compromise” and, therefore, NERC states that it “supports including EACMS in the reporting threshold in addition to the ESP and notes that logging attempts to compromise the ESP and some EACMS devices does not impose an unreasonable burden on entities.” 68

43. While NERC supports adopting the compromise or attempt to compromise a responsible entity's ESP or an EACMS associated with an ESP as a threshold for Cyber Security Incident reporting, NERC explains that “there is still a need to refine the scope of the proposed directive to ensure that it would provide meaningful data without overburdening entities.” 69 Specifically, NERC states that there is a need to “outline the parameters of an `attempt to compromise' in order to issue a precise data request.” 70 In particular, NERC states that it “would consider the common understanding of adverse activities that are early indicators of compromise, such as campaigns against industrial control systems, to help refine the parameters.” 71 In addition, NERC notes that EACMS, as defined in the NERC Glossary, include a wide variety of devices that perform control and monitoring functions. NERC states further that it “needs to consider whether to define the reporting threshold to differentiate between the various types of EACMS for reporting purposes.” 72 Therefore, NERC requests that the Commission provide flexibility in refining the threshold for Cyber Security Incident reporting.

44. Trade Associations, APS, BPA, EnergySec, Resilient Societies, IRC, ITC, and NYPSC generally support the reporting threshold proposed in the NOPR, but caution that any new or modified requirements should be properly scoped. Trade Associations state that the NOPR proposal “is potentially overbroad and could result in unduly burdensome reporting requirements that reduce awareness of significant cyber threats.” 73 Trade Associations also contend that a new or revised Reliability Standard “should not include the proposed generic threshold of reporting any incidents that compromise or attempt to compromise an ESP or EACMS.” 74 Instead, Trade Associations recommend that the Commission “give NERC sufficient flexibility to define appropriate reporting thresholds for attempted compromises of an ESP or EACMS.” 75

45. APS asserts that, given the differences among EACMS, it does not support the inclusion of all EACMS or the exclusion of all EACMS from an enhanced reporting requirement. APS states that while it “concurs that the incidents impacting the ESP should certainly be in scope of reporting, it is concerned that the exclusion of EACMS (which includes [Electronic Access Points (EAP)]) results in a likely compromise scenario going unreported.” 76 Specifically, APS notes that “a user's credentials to an Intermediate System, which includes/can be classified as an EAP(s) and/or EACMS, could be compromised.” 77 APS contends that such a compromise would not implicate the ESP, but could impact or attempt to impact a BES Cyber Asset or System. APS states, however, that “there are numerous EACMS for which a compromise scenario would not be critical or allow potential access to an ESP.” 78 Therefore, APS maintains that an evaluation of the functions of various EACMS is needed before they can be included in any reporting requirement.

46. BPA states that a broader definition of a Reportable Cyber Security Incident is necessary since the current definition only addresses actual compromises. BPA avers that “information about certain attempts to compromise will likely better assist the industry in preventing successful cyber attacks.” 79 BPA states that the current definition of a Cyber Security Incident is a good starting point for a revision since it includes attempts to compromise or disrupt. BPA cautions, however, that the current definition of Cyber Security Incident “may be too broad and result in overreporting of information.” 80

47. EnergySec states that it “generally agree[s] that successful attacks against ESPs and EACMS should be within the scope of reporting; [but] disagree[s] with the proposal to include attempted compromise in the reporting requirements.” 81 In addition, EnergySec suggests that monitoring-only systems be excluded from any reporting requirement, stating that “[a]lthough compromise of monitoring systems could assist an attack, such a compromise would not directly permit access.” 82 Resilient Societies states that “[e]xcluding [EACMS] from the Commission directive could exempt reporting of attempted compromises.” 83 IRC states that “adding EACMS to the requirement for mandatory reporting would be beneficial, not only because of their role as a boundary point, but also because EACMS perform other roles that support the BES Cyber Systems.” 84 IRC cautions, however, that “[w]ithout providing further definitions or criteria, the NOPR's proposal to require reporting of all `attempts to compromise' the ESP or EACMS is unclear and potentially unachievable.” 85

48. While ITC generally supports the NOPR proposal, ITC “requests that the Commission refrain from including unsuccessful attempts to compromise an ESP-associated EACMS in the revised definition of a Cyber Security Incident.” 86 ITC notes that responsible entity systems with publicly-visible IP addresses “sustain a regular stream of denial of service attempts, phishing emails, attempted firewall breaches, untargeted and targeted malware, and other common cybersecurity threats for which countermeasures are well-established and which pose a miniscule chance of success.” 87 ITC states that including “attempted compromises of ESP-associated EACMS would appear to require reporting for a sizeable number of these common events.” 88 Therefore, ITC states that while it “supports expanding the definition of Reportable Cyber Incidents to include incidents that compromise, or attempt to compromise, a responsible entity's ESP, ITC would urge the Commission to direct NERC to include only actual breaches of a responsible entity's ESP-associated EACMS, and not attempted-but-unsuccessful compromises.” 89 NYPSC notes that “[f]ailed cyber attacks occur on a continuous basis, all the time. . .” and, therefore, “[a] reporting requirement of every attempted security attack may be overly burdensome for reporting entities.” 90 NYPSC “suggests FERC consider developing clear criteria of the required reporting based on its review of the comments and recommendations from reporting entities.” 91

49. Idaho Power states that “additional reporting requirements do not increase cyber security.” 92 Idaho Power contends that “additional administrative burdens such as reporting requirements reduce the finite resources that entities have to monitor and defend their critical infrastructure.” 93 In addition, Idaho Power states that EACMS “should be excluded from any additional requirements and only BES Cyber Systems and associated devices should be included in any further reporting requirements.” 94

50. Other commenters support expanding the enhanced reporting requirement beyond what was proposed in the NOPR. NRG supports the NOPR proposal to direct NERC to develop modifications to the CIP Reliability Standards to improve the reporting of Cyber Security Incidents. NRG also supports including EACMS as a threshold for reporting. In addition, NRG “recommends that the scope of the NOPR avoid limiting the requirement to High and Medium Impact BES Cyber Systems.” 95 Specifically, NRG notes that the NOPR proposal “would limit the requirement to High and Medium Impact BES Cyber Systems as ESPs and EACMS are not required establishments at Low Impact BES Cyber Systems.” 96 Therefore, NRG states that “any modification to the referenced CIP Reliability Standards should be applicable to all BES Cyber Systems with External Routable Communications.” 97

51. Appelbaum supports the NOPR proposal to include the attempted or actual compromise of an ESP or EACMS in the mandatory reporting requirement. However, Appelbaum “propose[s] the Commission consider adding Physical Security Perimeters and Physical Access Control Systems (PACS) as well.”98 Simon supports the NOPR proposal, but encourages the Commission to broaden the directive to include low impact BES Cyber Systems. Specifically, Simon states that “[o]mission of mandatory reporting for the disruption, or an attempt to disrupt, the operation of electronic access controls for BES assets with low impact BES Cyber Systems leaves a large blind spot in the Commission's effort to learn of efforts to harm the reliable operation of the bulk electric system.” 99 Isologic does not support limiting Cyber Security Incident reporting to situations involving an entity's ESP or associated EACMS. Isologic states that “there are few CIP standards for `secure perimeters' and for the mass of BES Low Impact Facilities, (substations), security is at the fence line, not in ESPs.” 100

52. The record in this proceeding supports establishing the compromise or attempted compromise of an ESP as the appropriate threshold for a Reportable Cyber Security incident. In addition, with exceptions, the comments support including EACMS associated with an ESP as part of the reporting threshold. As NERC notes, an “ESP protects some of the most important Cyber Assets and the EACMS control or monitor access to those Cyber Assets.” 101 While we believe that ESPs and EACMS should be within the scope of a broadened reporting requirement, the comments, correctly in our view, point to the need to establish an appropriate scope for reporting. As NERC states, “there is still a need to refine the scope of the proposed directive to ensure that it would provide meaningful data without overburdening entities.” 102 This concern is reflected in a number of comments, pointing to the need to identify the appropriate assets to monitor (for example, only EACMS associated with an ESP) and to clearly define an “attempt to compromise.” 103

53. The comments generally support the view that NERC should have the flexibility to establish an appropriate reporting threshold. We recognize the need for a certain level of flexibility and believe that it is appropriate for NERC to address the specific reporting threshold through the standards development process. However, as discussed further below, we provide guidance on certain aspects of how NERC should identify EACMS for reporting purposes and what types of attempted compromise must be reported.

54. With regard to identifying EACMS for reporting purposes, NERC's reporting threshold should encompass the functions that various electronic access control and monitoring technologies provide. Those functions must include, at a minimum: (1) Authentication; (2) monitoring and logging; (3) access control; (4) interactive remote access; and (5) alerting.104 Reporting a malicious act or suspicious event that has compromised, or attempted to compromise, a responsible entity's EACMS that perform any of these five functions would meet the intended scope of the directive by improving awareness of existing and future cyber security threats and potential vulnerabilities. Since responsible entities are already required to monitor and log system activity under Reliability Standard CIP-007-6, the incremental burden of reporting of the compromise or attempted compromise of an EACMS that performs the identified functions should be limited, especially when compared to the benefit of the enhanced situational awareness that such reporting will provide.

55. With regard to the definition of “attempted compromise” for reporting purposes, we consider attempted compromise to include an unauthorized access attempt or other confirmed suspicious activity. ITC raises a concern that including unsuccessful attempts to compromise an EACMS associated with an ESP would require reporting a significant number of events. We note, however, that limiting the reporting threshold to only EACMS that are associated with an ESP should limit the reporting burden since these assets should be located apart from the responsible entity's broader business IT networks. Moreover, as discussed in the next section, we also believe that a flexible reporting timeline that reflects the severity of a Cyber Security Incident could also help address the potential burden of reporting attempted compromises.

56. With regard to BPA's suggestion that a revised definition of Reportable Cyber Security Incident is necessary, as discussed above, revisions to the current definition of Reportable Cyber Security Incident could address certain aspects of the NOPR proposal, although a modified definition alone would not address the need to specify the required information in cyber security incident reports to improve the quality of reporting and allow for ease of comparison, or establish deadlines for submitting a report to facilitate timely information sharing. Therefore, although we believe that a modified definition of Reportable Cyber Security Incident could address part of the Commission's concerns, additional modifications to the Reliability Standards would be necessary to meet the security objective of the directives discussed herein.

57. A number of commenters request that we expand the directive to include a broader scope of assets, including low impact BES Cyber Systems. However, we decline to expand the scope of Cyber Security Incident reporting beyond the ESP and associated EACMS at this time. The focus on ESPs and associated EACMS is intended to provide threat information on BES Cyber Systems that have the greatest impact on BES reliability while imposing a reasonable reporting burden on responsible entities. Nevertheless, the Commission could revisit this issue if there is demonstrated need for expanded Cyber Security Incident reporting.

58. Therefore, we adopt the NOPR proposal and conclude that the compromise, or attempt to compromise, a responsible entity's ESP or associated EACMS is a reasonable threshold for augmented Cyber Security Incident reporting.

59. The NOPR proposed to direct NERC to modify the CIP Reliability Standards to augment the mandatory reporting of Cyber Security Incidents, while also seeking comment on whether a request for data or information pursuant to Section 1600 of the NERC Rules of Procedure would effectively address the reporting gap.

60. While NERC supports broadened mandatory Cyber Security Incident reporting, NERC does not support the NOPR proposal to direct a modification to the Reliability Standards. Instead, NERC requests flexibility to determine the appropriate reporting procedure. Specifically, NERC proposes to “use the [Rules of Procedure] Section 1600 process for gathering data used for system performance.” 105 NERC maintains that it has “successfully shifted to using Section 1600 for other data collection efforts, such as the collection of reports on Protection System Misoperation.” 106 NERC explains further that the Section 1600 process would be used to “supplement the existing voluntary reporting of cyber security threats to E-ISAC.” 107

61. NERC states that the Section 1600 process “provides many of the same benefits as Reliability Standards,” such as stakeholder and Commission staff input.108 NERC also states that, similar to Reliability Standards, compliance with Section 1600 is mandatory. NERC explains that if a responsible entity does not respond to a Section 1600 data request, “NERC has the authority under the [Rules of Procedure] to take such action as NERC deems appropriate to address a situation where a Rule of Procedure cannot practically be complied with or has been violated.” 109 NERC explains that the Section 1600 data request process provides the flexibility to revise or update the data request, if necessary, as well as “the flexibility to determine the appropriate timeline for submitting the data.” 110 NERC states that while it may continue to use the Reliability Standards for data collection for evidence of compliance or to facilitate sharing of information between entities for BES operations, it “has found the [Rules of Procedure] Section 1600 process to be effective for data collection to assess system performance.” 111 NERC cites a standing Section 1600 data request for entities to submit quarterly data on Protection System Misoperations as an example.

62. LPPC supports the use of the Section 1600 process to facilitate enhanced Cyber Security Incident reporting. LPPC states that it “supports a more flexible approach to collection of actionable information through the data request process outlined in NERC ROP Section 1600.” 112 LPPC asserts that the data request approach offers flexibility that the standards development process does not. Specifically, LPPC states that “compliance with a NERC data request is mandatory for applicable entities, while the data request procedures specified under [Rules of Procedure] Section 1600 also provide a more efficient process to update or revise a data request as needed to respond to rapidly-changing security threats.” 113 Finally, LPPC opines that “it seems appropriate to remove the data collection process from the enforcement process associated with mandatory Reliability Standards.” 114

63. APS, BPA, Resilient Societies, IRC, and NRG oppose the use of the Section 1600 process to facilitate enhanced Cyber Security Incident reporting. APS asserts that a request for data pursuant to Section 1600 would not effectively address the reporting gap and current lack of awareness of cyber-related incidents. Specifically, APS argues that a data request would create an independent, redundant reporting obligation to NERC or a regional entity and would subject the provisions of reported information to the confidentiality and data sharing processes set forth in Rules of Procedure Section 1500, unnecessarily delaying sharing and distribution of information.115 APS states further that the Section 1600 process “adds significant additional administrative burden for all involved entities, which is inefficient and unnecessary and presents a potential obstacle to the very sharing and distribution that is a critical part of the Commission's objectives set forth in the NOPR.” 116

64. BPA comments that a data request is not an effective means of obtaining information about cyber security incidents. BPA explains that Section 1600 data requests “are one time requests for existing data, and [. . .] not the appropriate vehicle for ensuring ongoing reporting necessary to make data about Cyber Security Incidents effective.” 117 Resilient Societies states that “[e]xamination of NERC Rules of Procedure Section 1600 shows the intent of [the] rule is to facilitate one-time requests for data.” 118 Therefore, Resilient Societies asserts that the Section 1600 reporting procedures “would be a poor fit for a standing order for data on cybersecurity incidents that occur continually.” 119 NRG opposes the use of the Section 1600 data request process asserting that a request for data or information would neither address the current lack of awareness of cyber-related incidents, nor satisfy the goals of the proposed directive.

65. APS, as discussed above, suggests adopting the DOE Electric Disturbance Events, Form OE-417 as the primary reporting tool for Cyber Security Events. EnergySec, for its part, suggests that the Commission could direct NERC to require entities to develop and implement an information sharing plan.120 According to EnergySec, such an approach should provide broad discretion to entities and ensure that compliance oversight efforts cannot result in second-guessing of decisions regarding which information to share, when, or with whom. IRC suggests, alternatively, that the Commission allow entities to comply with the reporting requirements by participating in the Cyber Risk Information Sharing program. IRC explains that the program allows entities to automatically report information to E-ISAC for analysis against classified information. IRC states that responsible entities that “automatically report indicators of compromise through these systems will share information at machine speed, and this should be considered superior to manual reporting, which requires much slower decision-making.” 121

66. As discussed above, we adopt the NOPR proposal and direct NERC to develop modifications to the NERC Reliability Standards to improve mandatory reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES. We have considered the arguments raised in the comments for using Reliability Standards, Section 1600 information and data requests, and other vehicles to implement augmented Cyber Security Incident reporting. On balance, we conclude that broadened mandatory reporting pursuant to Reliability Standard requirements is more aligned with the seriousness and magnitude of the current threat environment and the more effective approach to improve awareness of existing and future cyber security threats and potential vulnerabilities.

67. First, the development of a Reliability Standard provides the Commission with an opportunity to review and ultimately approve a new or modified Reliability Standard, ensuring that the desired goals of the directive are met. Moreover, the Reliability Standards development process allows for the collaboration of industry experts in developing a draft standard and also gives interested entities broader opportunity to participate and comment on any proposal that is developed. In contrast, NERC's process for developing a Section 1600 data request provides for less stakeholder input and only informal review of a draft data request by Commission staff. Thus, in this circumstance, the standards development process is preferable for the development of augmented cyber incident reporting requirements that satisfy the scope of the Commission's directive.

68. Second, the development of a Reliability Standard provides better assurance of accurate, complete, and verifiable reporting of cyber security incidents. The Commission has well-defined authority and processes under section 215(e) of the FPA to audit and enforce compliance with a Reliability Standard. While NERC notes that a responsible entity must respond to a NERC Section 1600 data request, NERC cannot impose sanctions on registered entities who fail to respond to such data requests. Rather, a failure to comply would be a violation of the Commission's regulations,122 requiring a referral to the Commission for action. Such a process would be a departure from the clearly defined processes used to enforce compliance with the Reliability Standards. Moreover, it is unclear how NERC would even learn of such a failure since, unlike mandatory Reliability Standards, compliance with Section 1600 data requests are not subject to regular audit. Accordingly, given the importance of accurate, complete, and verifiable cyber security incident reporting, we find that the more robust and well-established compliance and enforcement processes associated with mandatory Reliability Standards are desirable in this instance.

69. Third, we are not persuaded by NERC's assertion that a Section 1600 data request is preferable in this instance because it allows for flexibility and faster modification should a need arise for future revisions to the collection of cyber incident reporting data. We do not anticipate that there would be a need to change the parameters of the event report, given that the anticipated reporting requirements should not be technology-specific, but rather, broad enough to capture basic data even as the nature of cyber security incidents evolve. Specifically, the NOPR proposed that the minimum set of attributes to be reported should include: (1) The functional impact, where possible to determine, that the Cyber Security Incident achieved or attempted to achieve; (2) the attack vector that was used to achieve or attempted to achieve the Cyber Security Incident; and (3) the level of intrusion that was achieved or attempted as a result of the Cyber Security Incident. Since these attributes are general in nature and not technology specific, they would not need to be refined as the underlying cyber threats evolve, nor would they need to be refined quickly.

70. In a similar vein, the assets (i.e., EACMS) subject to the enhanced reporting requirements should be identified based on function, as opposed to a specific technology that could require a modification in the reporting requirements should the underlying technology change. As discussed above, those functions must include, at a minimum: (1) Authentication; (2) monitoring and logging; (3) access control; (4) interactive remote access; and (5) alerting. Finally, since the level of attempted compromise that warrants reporting should reflect unauthorized access attempts and other confirmed suspicious activity, we do not anticipate that a modification would be required in the future. Nevertheless, should the situation demand a more timely change in data collection or should NERC desire to collect additional information that is outside the scope of the proposed Reliability Standard, NERC could use the Section 1600 data request process to supplement information reported under a mandatory Reliability Standard.

71. Finally, requiring a data collection in a Reliability Standard is consistent with existing practices since responsible entities are currently required to maintain the types of information that would lead to a reportable Cyber Security Incident pursuant to Reliability Standard CIP-007-6, Requirement R4.1.

72. While we recognize that NERC could likely develop a Section 1600 data request more quickly than a mandatory Reliability Standard, given the potential complexity of considering reporting requirements for the various EACMS, we believe that the technical depth of a standard development process is more appropriate for this case. Although NERC states that it has successfully used ROP Section 1600 to collect data on system performance, in this circumstance the information being reported relates to threats and potential compromises that may require immediate or near-term action as opposed to retrospective reporting on Misoperations, as Section 1600 has been used.

73. We also do not support adopting the DOE Form OE-417 as the primary reporting tool for reporting Cyber Security Incidents, as suggested by some commenters. The reporting criteria in our directive are distinguishable and more aligned with a risk management approach than the information requested in the DOE Form OE-417. Specifically, the DOE Form OE-417 has twelve generic criteria for filing a report to the DOE, of which only two reflect the criteria outlined in the NOPR proposal, which are discussed in the following section. The DOE Form OE-417 does not address factors such as attack vector, functional impact and level of intrusion. In addition, the definition of a “Cyber Event” in the DOE Form OE-417 filing instructions does not align with the definition of Cyber Security Incident in the NERC Glossary of Terms, let alone a Reportable Cyber Security Incident.123 Nor does the DOE Form OE-417 require reporting to E-ISAC or ICS-CERT as our directive requires.

74. In sum, we conclude that modifications to the NERC Reliability Standards to improve mandatory reporting of Cyber Security Incidents, including incidents that might facilitate subsequent efforts to harm the reliable operation of the BES, is the appropriate approach to improve Cyber Security Incident reporting.

75. The NOPR proposed to direct that NERC modify the CIP Reliability Standards to specify the required content in a Cyber Security Incident report. Specifically, the NOPR proposed that the minimum set of attributes to be reported should include: (1) The functional impact, where possible, that the Cyber Security Incident achieved or attempted to achieve; (2) the attack vector that was used to achieve or attempt to achieve the Cyber Security Incident; and (3) the level of intrusion that was achieved or attempted as a result of the Cyber Security Incident. The NOPR noted that the proposed attributes are the same as attributes already used by DHS for its multi-sector reporting and summarized by DHS in an annual report. The NOPR stated that specifying the required content should improve the quality of reporting by ensuring that basic information is provided; and allowing for ease of comparison across reports by ensuring that each report includes specified fields of information. The NOPR sought comment on the proposed attributes and, more generally, the appropriate content for Cyber Security Incident reporting to improve awareness of existing and future cyber security threats and potential vulnerabilities.

76. In addition, the NOPR proposed to direct NERC to establish requirements outlining deadlines for filing a report once a compromise or disruption to reliable BES operation, or an attempted compromise or disruption, is identified by a responsible entity. The NOPR stated that the reporting timeline should reflect the actual or potential threat to reliability, with more serious incidents reported in a more timely fashion. The NOPR explained that a reporting timeline that takes into consideration the severity of a Cyber Security Incident should minimize potential burdens on responsible entities.

77. The NOPR also proposed that the reports submitted under the enhanced mandatory reporting requirements would be provided to E-ISAC, similar to the current reporting scheme under Reliability Standard CIP-008-5, as well as ICS-CERT or any successor organization. While the NOPR stated that the detailed incident report would not be submitted to the Commission, the NOPR proposed to direct NERC to file publicly an annual report reflecting the Cyber Security Incidents reported to NERC during the previous year. Specifically, the NOPR proposed to direct NERC to file annually an anonymized report providing an aggregated summary of the reported information, similar to the ICS-CERT annual report.124

78. NERC supports the minimum set of reporting attributes proposed in the NOPR, stating that “this level of detail regarding each reported Cyber Security Incident will not only help NERC understand the specific threat but also help NERC understand trends in threats over time.” 125 NERC also does not oppose either filing an annual, anonymized summary of the reports with the Commission, or submitting the reports of U.S.-based entities to the ICS-CERT in addition to E-ISAC. Finally, while NERC supports the concept of imposing a deadline for entities to submit full reports of Cyber Security Incidents, NERC requests flexibility to determine the appropriate timeframe. Specifically, NERC states that it “will determine an appropriate deadline for reports so that NERC can use the data for awareness and early indicators of potential compromise but also consider whether reporting for historical analysis can provide insight to the trends and effectiveness of industry's security controls.” 126

79. ITC, IRC, and NRG support the minimum set of reporting attributes proposed in the NOPR. ITC states that the NOPR proposal reflects “a reasonable set of baseline requirements for reporting.” 127 While ITC raises a concern that the collective information in a report could potentially lead to the identification of the reporting entity, ITC states that it “will work within the NERC stakeholder and standards development process to ensure that the Standards submitted in response to the Commission's final rule are structured to preserve anonymity to the maximum extent practicable.” 128 IRC asserts that “it will be beneficial for responsible entities to report indicators of compromise that are detected in potential cyberattacks against their systems in standard form.” 129 NRG recommends that mandatory reporting include: “content Date, Time, Duration of Incident, Origination of the attack, threat vector, targeted system (or OS), vulnerability exploited, [and] method used to stop/prevent the attack.” 130

80. Appelbaum, APS, EnergySec, Resilient Societies, and Idaho Power raise concerns with the minimum set of reporting attributes proposed in the NOPR. According to Appelbaum, a count by category of asset, attack vector, and impact is sufficient for the mandatory reporting. APS contends that “because each entity's network topology, architecture, applications, and other characteristics are different, any requirement to provide the functional impact and level of intrusion as part of reporting is of very low value and should not be included as mandatory attributes of reporting.” 131

81. APS, however, “agrees that information regarding attack vectors could be more relevant, actionable information to be shared.” 132 EnergySec expresses concern that including the proposed set of reporting attributes as a requirement could be construed to require significant forensic and analysis efforts. Resilient Societies suggests that the Commission leverage prior work done by the federal government as opposed to establishing new report content. Specifically, Resilient Societies suggests that the Commission adopt the US-CERT “Federal Incident Notification Guidelines.” Idaho Power states that a “description of the event and the system(s) affected along with a fact pattern describing the situation and known information at the time the report is submitted should be sufficient.” 133

82. With regard to the timing of reports, ITC questions whether an initial report of a Cyber Security Incident would have to be submitted to ICS-CERT as well as E-ISAC. ITC opines that “the existing one-hour reporting requirement poses a significant compliance challenge, and that requiring that the initial report also be provided to ICS-CERT would be unworkable under that timeframe.” 134 IRC states that “[t]he timeframe for completing a full report depends on the scale and scope of the investigation [and] FERC should consider requiring that reports be updated at a certain frequency until the full report is complete.” 135 IRC recommends a 90-day update requirement until a report is finalized. NRG recommends that Cyber Security Incident reports should be submitted after existing industry processes have been followed relating to Incident Reporting and Response Plans. In addition, NRG recommends that the Commission consider directing NERC to file a quarterly report in addition to the annual report.

83. APS recommends aligning the timing of any mandatory reporting obligations with the timing dictated in Form OE-417. APS contends that reporting events that “could, but didn't, cause harm to the BES and/or facilitate subsequent efforts to harm . . . should be far enough removed from the incident to not divert resources from incident response and to ensure that enough details are known about the incident to provide an accurate, thorough report.136

84. EnergySec agrees that clear timelines should be included in any new mandatory Cyber Security Incident requirements. EnergySec further comments that the timelines should factor in the severity of the incident and the level of effort required to complete an investigation. Resilient Societies offers that “[i]n an ideal world, reporting of cybersecurity incidents would take place at machine speed” and suggests that the Commission “allow and preferably require automated reporting, at least for an initial report.” 137 Idaho Power states that, should the Commission require timelines for reporting, it should ensure that an entity has adequate time to analyze each event before the reporting deadline.

85. Lasky supports entities being required to report Cyber Security Incidents to both E-ISAC and ICS-CERT, and states that “it would be prudent to report all incidents to the United States Cyber Emergency Response Team (US-CERT)” as well.138

86. As discussed below, we adopt the NOPR proposal on minimum reporting attributes and timing, in response to the commenters' concerns, but we also leave discretion to NERC to develop the reporting timelines in the standards development process by considering several factors so that the timelines provide for notice based upon the severity of the event and the risk to BES reliability, with updates to follow initial reports.

87. The comments generally support the proposed minimum set of reporting attributes. For example, NERC supports the proposed content for a Cyber Security Incident report, while requesting flexibility to determine the appropriate reporting timeframe. As noted by ITC, the NOPR proposal reflects “a reasonable set of baseline requirements for reporting.” 139 Certain comments do raise concerns with the proposed reporting attributes, especially in the case of attempts versus actual compromises.

88. In our view, a new or revised Cyber Security Incident report should include, at a minimum, the information outlined in the NOPR proposal, where available. Specifically, the minimum set of attributes to be reported should include: (1) The functional impact, where possible, that the Cyber Security Incident achieved or attempted to achieve; (2) the attack vector that was used to achieve or attempted to achieve the Cyber Security Incident; and (3) the level of intrusion that was achieved or attempted or as a result of the Cyber Security Incident. In addition, we agree that any reporting requirement should not take away from efforts to mitigate a potential compromise.

89. With regard to timing, we conclude that NERC should establish reporting timelines for when the responsible entity must submit Cyber Security Incident reports to the E-ISAC and ICS-CERT based on a risk impact assessment and incident prioritization approach to incident reporting.140 This approach would establish reporting timelines that are commensurate with the adverse impact to the BES that loss, compromise, or misuse of those BES Cyber Systems could have on the reliable operation of the BES. Higher risk incidents, such as detecting malware within the ESP and associated EACMS or an incident that disrupted one or more reliability tasks, could trigger the report to be submitted to the E-ISAC and ICS-CERT within a more urgent timeframe, such as within one hour, similar to the current reporting deadline in Reliability Standard CIP-008-5.141 For lower risk incidents, such as the detection of attempts at unauthorized access to the responsible entity's ESP or associated EACMS, an initial reporting timeframe between eight and twenty-four hours would provide an early indication of potential cyber attacks.142 For situations where a responsible entity identifies other suspicious activity associated with an ESP or associated EACMS, a monthly report could, as NERC states, assist in the analysis of trends in activity over time.143

90. With regard to the appropriate recipients for Cyber Security Incident reports, we determine that the reports should be provided to E-ISAC, similar to the current reporting scheme under Reliability Standard CIP-008-5, as well as ICS-CERT or its successor. 144 Reporting directly to E-ISAC and ICS-CERT will result in cyber threat information being provided to the organizations best suited to analyze and, to the extent necessary, timely inform responsible entities of cyber threats. In addition, reporting directly to E-ISAC and ICS-CERT addresses the concerns discussed above regarding the confidentiality of reported Cyber Security Incident information. We also find that it is reasonable for NERC to file annually an anonymized report providing an aggregated summary of the reported information, similar to the ICS-CERT annual report. The annual report will provide the Commission, NERC, and the public a better understanding of any Cyber Security Incidents that occurred during the prior year without releasing information on specific responsible entities or Cyber Security Events.

91. Therefore, we conclude that the minimum set of attributes to be reported should include: (1) The functional impact, where possible, that the Cyber Security Incident achieved or attempted to achieve; (2) the attack vector that was used to achieve or attempted to achieve the Cyber Security Incident; and (3) the level of intrusion that was achieved or attempted or as a result of the Cyber Security Incident. NERC may augment the list should it determine that additional information would benefit situational awareness of cyber threats. As discussed above, we also conclude that NERC should establish a reporting timeline that provides for notice based upon the severity of the event and the risk to BES reliability, with updates to follow initial reports. We also support the adoption of an online reporting tool to streamline reporting and reduce burdens on responsible entities to the extent the option is available.145

92. NYPSC supports the NOPR proposal, but notes that if the Commission adopts the NOPR proposal, “the only additional information that state entities would gain is an annual compilation of incidents reported to federal entities.” 146 NYPSC claims that an annual report would not provide states with sufficient information on a timely basis so that they can ensure that corrective actions can be taken. Therefore, NYPSC argues that appropriate state entities should also be provided with the cyber reporting information when it is filed with the “federal authorities.”

93. Microsoft raises a concern that the NOPR proposal is not clear as to whether the modified CIP Reliability Standards would apply to responsible entities that use a commercial cloud service to operate cloud-based BES Cyber Systems. Specifically, Microsoft requests that the Commission “confirm that cloud service providers that provide services to Registered Entities are not required to register with NERC based on their provision of [cloud-based] services, and . . . are not responsible for compliance with the CIP Reliability Standards.” 147 Microsoft asserts that clarifying the status of cloud service providers is important to foster technical innovation.

94. While we appreciate NYPSC's interest in receiving Cyber Security Incident reports when reported to E-ISAC and ICS-CERT, state entities will have access to the same information that is reported to the Commission (i.e., the annual, anonymized summary). Should a state entity determine that it requires additional information from a responsible entity under its jurisdiction, the state entity can work within its own jurisdiction to procure additional information. Our directive is intended to enhance the quality of information received by E-ISAC and ICS-CERT, and directing additional sharing with state entities is outside the scope of this proceeding.

95. We decline to grant Microsoft's requested clarification regarding the potential registration status of cloud service providers because it is outside the scope of this proceeding. Specifically, Microsoft's requested clarification addresses a question regarding registration of cloud service providers under the NERC functional model, as opposed to the specifics of enhanced Cyber Security Incident reporting. The purpose of this proceeding is not to make a determination regarding the registration status of cloud service providers and we have not received input from other interested entities.

96. The FERC-725 information collection requirements contained in this Final Rule are subject to review by the Office of Management and Budget (OMB) under section 3507(d) of the Paperwork Reduction Act of 1995.148 OMB's regulations require approval of certain information collection requirements imposed by agency rules.149 Upon approval of a collection of information, OMB will assign an OMB control number and expiration date. Respondents subject to the filing requirements of this rule will not be penalized for failing to respond to these collections of information unless the collections of information display a valid OMB control number. The Commission solicits comments on the Commission's need for this information, whether the information will have practical utility, the accuracy of the burden estimates, ways to enhance the quality, utility, and clarity of the information to be collected or retained, and any suggested methods for minimizing respondents' burden, including the use of automated information techniques.

97. The Commission will submit these proposed reporting requirements to OMB for its review and approval under section 3507(d) of the PRA because the Final Rule results in nonsubstantive/non-material changes in paperwork burden. The Final Rule directs NERC to make Cyber Security reporting changes across all applicable Reliability Standards. These proposed changes will be covered by the FERC-725 information collection (Certification of Electric Reliability Organization; Procedures for Electric Reliability Standards) [OMB Control No. 1902-0225]). FERC-725 includes the ERO's overall responsibility for developing Reliability Standards to include any Reliability Standards that relate to Cyber Security Incident reporting. There will be no change to the Public Reporting Burden as it affects the FERC-725 information collection.

98. Comments are solicited on the Commission's need for the information proposed to be reported, whether the information will have practical utility, ways to enhance the quality, utility, and clarity of the information to be collected, and any suggested methods for minimizing the respondent's burden, including the use of automated information techniques.

99. Internal review: The Commission has reviewed the approved changes and has determined that the changes are necessary to ensure the reliability and integrity of the Nation's Bulk-Power System.

100. Interested persons may obtain information on the reporting requirements by contacting the following: Federal Energy Regulatory Commission, 888 First Street NE, Washington, DC 20426 [Attention: Ellen Brown, Office of the Executive Director, email: [email protected], phone: (202) 502-8663, fax: (202) 273-0873].

101. For submitting comments concerning the collection(s) of information and the associated burden estimate(s), please send your comments to the Commission, and to the Office of Management and Budget, Office of Information and Regulatory Affairs, 725 17th Street NW, Washington, DC 20503 [Attention: Desk Officer for the Federal Energy Regulatory Commission, phone: (202) 395-8528, fax: (202) 395-7285]. For security reasons, comments to OMB should be submitted by email to: [email protected]. Comments submitted to OMB should include Docket Number RM18-2-000 and OMB Control Number 1902-0225.

102. The Regulatory Flexibility Act of 1980 (RFA) 150 generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities.

103. By only proposing to direct NERC, the Commission-certified ERO, to develop modified Reliability Standards for Cyber Security Incident reporting, this Final Rule will not have a significant or substantial impact on entities other than NERC. Therefore, the Commission certifies that this Final Rule will not have a significant economic impact on a substantial number of small entities.

104. Any Reliability Standards proposed by NERC in compliance with this rulemaking will be considered by the Commission in future proceedings. As part of any future proceedings, the Commission will make determinations pertaining to the Regulatory Flexibility Act based on the content of the Reliability Standards proposed by NERC.

105. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.151 The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural or that do not substantially change the effect of the regulations being amended.152 The actions proposed herein to augment current reporting requirements fall within this categorical exclusion in the Commission's regulations.

106. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the internet through the Commission's Home Page (http://www.ferc.gov) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE, Room 2A, Washington, DC 20426.

107. From the Commission's Home Page on the internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number of this document, excluding the last three digits, in the docket number field. User assistance is available for eLibrary and the Commission's website during normal business hours from the Commission's Online Support at (202) 502-6652 (toll free at 1-866-208-3676) or email at [email protected], or the Public Reference Room at (202) 502-8371, TTY (202) 502-8659. Email the Public Reference Room at [email protected].

108. The Final Rule is effective October 1, 2018. The Commission has determined that this Final Rule imposes no substantial effect upon either NERC or NERC registered entities 153 and, with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule is not a “major rule” as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996. This Final Rule is being submitted to the Senate, House, and Government Accountability Office.

Applicability Dates: April 2, 2018, First-Class Package Service Contract 92 (MC2018-133 and CP2018-189); April 3, 2018, Priority Mail Contract 426 (MC2018-134 and CP2018-190); April 17, 2018, Priority Mail & First-Class Package Service Contract 77 (MC2018-136 and CP2018-197); April 17, 2018, Priority Mail Contract 427 (MC2018-139 and CP2018-200); April 17, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 33 (MC2018-137 and CP2018-198); April 17, 2018, Priority Mail Express & Priority Mail Contract 64 (MC2018-138 and CP2018-199); April 18, 2018, Priority Mail Contract 429 (MC2018-141 and CP2018-202); April 18, 2018, Priority Mail Express & First-Class Package Service Contract 3 (MC2018-135 and CP2018-196); April 18, 2018, Priority Mail Contract 428 (MC2018-140 and CP2018-201); April 18, 2018, Priority Mail Contract 430 (MC2018-142 and CP2018-203); April 24, 2018, Priority Mail Contract 431 (MC2018-143 and CP2018-205); April 30, 2018, Priority Mail Contract 432 (MC2018-144 and CP2018-207); May 3, 2018, Priority Mail & First-Class Package Service Contract 78 (MC2018-145 and CP2018-208); May 3, 2018, Priority Mail & First-Class Package Service Contract 79 (MC2018-146 and CP2018-209); May 8, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 34 (MC2018-147 and CP2018-211); May 18, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 35 (MC2018-148 and CP2018-214); May 23, 2018, Priority Mail Express & Priority Mail Contract 65 (MC2018-151 and CP2018-217); May 23, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 36 (MC2018-153 and CP2018-219); May 23, 2018, Priority Mail & First-Class Package Service Contract 80 (MC2018-152 and CP2018-218); May 29, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 37 (MC2018-154 and CP2018-223); May 30, 2018, Priority Mail Contract 433 (MC2018-149 and CP2018-215); May 30, 2018, First-Class Package Service Contract 93 (MC2018-155 and CP2018-224); June 7, 2018, Priority Mail Contract 435 (MC2018-157 and CP2018-226); June 7, 2018, Priority Mail Contract 434 (MC2018-156 and CP2018-225); June 13, 2018, Priority Mail Express Contract 62 (MC2018-158 and CP2018-228); June 13, 2018, Priority Mail Contract 438 (MC2018-161 and CP2018-231); June 13, 2018, Priority Mail Contract 436 (MC2018-159 and CP2018-229); June 13, 2018, Priority Mail Contract 437 (MC2018-160 and CP2018-230); June 19, 2018, Priority Mail Contract 440 (MC2018-163 and CP2018-234); June 19, 2018, Priority Mail Contract 441 (MC2018-164 and CP2018-235); June 19, 2018, Priority Mail Contract 439 (MC2018-162 and CP2018-233); June 20, 2018, Priority Mail Express & Priority Mail Contract 66 (MC2018-165 and CP2018-236); June 20, 2018, Priority Mail Contract 442 (MC2018-166 and CP2018-238); June 21, 2018, Priority Mail Express & Priority Mail Contract 67 (MC2018-167 and CP2018-239); June 21, 2018, Priority Mail Contract 443 (MC2018-168 and CP2018-240); June 21, 2018, Priority Mail Express & Priority Mail Contract 68 (MC2018-169 and CP2018-241); June 21, 2018, Priority Mail Contract 444 (MC2018-170 and CP2018-242); June 21, 2018, Priority Mail Contract 445 (MC2018-171 and CP2018-243); June 22, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 38 (MC2018-172 and CP2018-244); June 22, 2018, First-Class Package Service Contract 94 (MC2018-173 and CP2018-245); June 25, 2018, Priority Mail & First-Class Package Service Contract 81 (MC2018-174 and CP2018-246); June 25, 2018, Priority Mail & First-Class Package Service Contract 82 (MC2018-175 and CP2018-247); June 25, 2018, Priority Mail Contract 447 (MC2018-177 and CP2018-249); June 25, 2018, Priority Mail Contract 446 (MC2018-176 and CP2018-248); June 26, 2018, Parcel Select Contract 31 (MC2018-179 and CP2018-251); June 26, 2018, Priority Mail Contract 448 (MC2018-178 and CP2018-250); June 26, 2018, Priority Mail Express, Priority Mail & First-Class Package Service Contract 39 (MC2018-180 and CP2018-252); June 28, 2018, Priority Mail Express Contract 63 (MC2018-181 and CP2018-255); June 28, 2018, Priority Mail Contract 449 (MC2018-182 and CP2018-256); June 28, 2018, Priority Mail Contract 450 (MC2018-183 and CP2018-257).

This document identifies updates to the market dominant and the competitive product lists, which appear as 39 CFR Appendix A to Subpart A of Part 3020—Market Dominant Product List and 39 CFR Appendix B to Subpart A of Part 3020—Competitive Product List, respectively. Publication of the updated product lists in the Federal Register is addressed in the Postal Accountability and Enhancement Act (PAEA) of 2006.

Authorization. The Commission process for periodic publication of updates was established in Docket Nos. MC2010-21 and CP2010-36, Order No. 445, April 22, 2010, at 8.

Changes. The product lists are being updated by publishing replacements in their entirety of 39 CFR Appendix A to Subpart A of Part 3020—Market Dominant Product List and 39 CFR Appendix B to Subpart A of Part 3020—Competitive Product List. The following products are being added, removed, or moved within the product lists:

1. First-Class Package Service Contract 92 (MC2018-133 and CP2018-189) (Order No. 4561), added April 2, 2018.

2. Priority Mail Contract 426 (MC2018-134 and CP2018-190) (Order No. 4564), added April 3, 2018.

3. Priority Mail & First-Class Package Service Contract 77 (MC2018-136 and CP2018-197) (Order No. 4579), added April 17, 2018.

4. Priority Mail Contract 427 (MC2018-139 and CP2018-200) (Order No. 4580), added April 17, 2018.

5. Priority Mail Express, Priority Mail & First-Class Package Service Contract 33 (MC2018-137 and CP2018-198) (Order No. 4581), added April 17, 2018.

6. Priority Mail Express & Priority Mail Contract 64 (MC2018-138 and CP2018-199) (Order No. 4582), added April 17, 2018.

7. Priority Mail Contract 429 (MC2018-141 and CP2018-202) (Order No. 4584), added April 18, 2018.

8. Priority Mail Express & First-Class Package Service Contract 3 (MC2018-135 and CP2018-196) (Order No. 4585), added April 18, 2018.

9. Priority Mail Contract 428 (MC2018-140 and CP2018-201) (Order No. 4586), added April 18, 2018.

10. Priority Mail Contract 430 (MC2018-142 and CP2018-203) (Order No. 4587), added April 18, 2018.

11. Priority Mail Contract 431 (MC2018-143 and CP2018-205) (Order No. 4590), added April 24, 2018.

12. Priority Mail Contract 432 (MC2018-144 and CP2018-207) (Order No. 4597), added April 30, 2018.

13. Priority Mail & First-Class Package Service Contract 78 (MC2018-145 and CP2018-208) (Order No. 4600), added May 3, 2018.

14. Priority Mail & First-Class Package Service Contract 79 (MC2018-146 and CP2018-209) (Order No. 4601), added May 3, 2018.

15. Priority Mail Express, Priority Mail & First-Class Package Service Contract 34 (MC2018-147 and CP2018-211) (Order No. 4603), added May 8, 2018.

16. Priority Mail Express, Priority Mail & First-Class Package Service Contract 35 (MC2018-148 and CP2018-214) (Order No. 4609), added May 18, 2018.

17. Priority Mail Express & Priority Mail Contract 65 (MC2018-151 and CP2018-217) (Order No. 4615), added May 23, 2018.

18. Priority Mail Express, Priority Mail & First-Class Package Service Contract 36 (MC2018-153 and CP2018-219) (Order No. 4616), added May 23, 2018.

19. Priority Mail & First-Class Package Service Contract 80 (MC2018-152 and CP2018-218) (Order No. 4617), added May 23, 2018.

20. Priority Mail Express, Priority Mail & First-Class Package Service Contract 37 (MC2018-154 and CP2018-223) (Order No. 4625), added May 29, 2018.

21. Priority Mail Contract 433 (MC2018-149 and CP2018-215) (Order No. 4626), added May 30, 2018.

22. First-Class Package Service Contract 93 (MC2018-155 and CP2018-224) (Order No. 4627), added May 30, 2018.

23. Priority Mail Contract 435 (MC2018-157 and CP2018-226) (Order No. 4637), added June 7, 2018.

24. Priority Mail Contract 434 (MC2018-156 and CP2018-225) (Order No. 4638), added June 7, 2018.

25. Priority Mail Express Contract 62 (MC2018-158 and CP2018-228) (Order No. 4642), added June 13, 2018.

26. Priority Mail Contract 438 (MC2018-161 and CP2018-231) (Order No. 4643), added June 13, 2018.

27. Priority Mail Contract 436 (MC2018-159 and CP2018-229) (Order No. 4644), added June 13, 2018.

28. Priority Mail Contract 437 (MC2018-160 and CP2018-230) (Order No. 4645), added June 13, 2018.

29. Priority Mail Contract 440 (MC2018-163 and CP2018-234) (Order No. 4650), added June 19, 2018.

30. Priority Mail Contract 441 (MC2018-164 and CP2018-235) (Order No. 4651), added June 19, 2018.

31. Priority Mail Contract 439 (MC2018-162 and CP2018-233) (Order No. 4653), added June 19, 2018.

32. Priority Mail Express & Priority Mail Contract 66 (MC2018-165 and CP2018-236) (Order No. 4656), added June 20, 2018.

33. Priority Mail Contract 442 (MC2018-166 and CP2018-238) (Order No. 4657), added June 20, 2018.

34. Priority Mail Express & Priority Mail Contract 67 (MC2018-167 and CP2018-239) (Order No. 4662), added June 21, 2018.

35. Priority Mail Contract 443 (MC2018-168 and CP2018-240) (Order No. 4663), added June 21, 2018.

36. Priority Mail Express & Priority Mail Contract 68 (MC2018-169 and CP2018-241) (Order No. 4664), added June 21, 2018.

37. Priority Mail Contract 444 (MC2018-170 and CP2018-242) (Order No. 4665), added June 21, 2018.

38. Priority Mail Contract 445 (MC2018-171 and CP2018-243) (Order No. 4666), added June 21, 2018.

39. Priority Mail Express, Priority Mail & First-Class Package Service Contract 38 (MC2018-172 and CP2018-244) (Order No. 4667), added June 22, 2018.

40. First-Class Package Service Contract 94 (MC2018-173 and CP2018-245) (Order No. 4668), added June 22, 2018.

41. Priority Mail & First-Class Package Service Contract 81 (MC2018-174 and CP2018-246) (Order No. 4671), added June 25, 2018.

42. Priority Mail & First-Class Package Service Contract 82 (MC2018-175 and CP2018-247) (Order No. 4672), added June 25, 2018.

43. Priority Mail Contract 447 (MC2018-177 and CP2018-249) (Order No. 4673), added June 25, 2018.

44. Priority Mail Contract 446 (MC2018-176 and CP2018-248) (Order No. 4674), added June 25, 2018.

45. Parcel Select Contract 31 (MC2018-179 and CP2018-251) (Order No. 4676), added June 26, 2018.

46. Priority Mail Contract 448 (MC2018-178 and CP2018-250) (Order No. 4677), added June 26, 2018.

47. Priority Mail Express, Priority Mail & First-Class Package Service Contract 39 (MC2018-180 and CP2018-252) (Order No. 4678), added June 26, 2018.

48. Priority Mail Express Contract 63 (MC2018-181 and CP2018-255) (Order No. 4686), added June 28, 2018.

49. Priority Mail Contract 449 (MC2018-182 and CP2018-256) (Order No. 4687), added June 28, 2018.

50. Priority Mail Contract 450 (MC2018-183 and CP2018-257) (Order No. 4688), added June 28, 2018.

The following negotiated service agreements have expired, or have been terminated early, and are being deleted from the Competitive Product List:

1. Priority Mail Express Contract 16 (MC2014-12 and CP2014-16) (Order No. 1941).

2. Priority Mail Express Contract 23 (MC2015-16 and CP2015-20) (Order No. 2296).

3. Priority Mail Contract 94 (MC2014-48 and CP2014-84) (Order No. 2209).

4. Priority Mail Contract 110 (MC2015-29 and CP2015-38) (Order No. 2354).

5. Priority Mail Contract 119 (MC2015-39 and CP2015-50) (Order No. 2393).

6. Priority Mail Contract 121 (MC2015-43 and CP2015-54) (Order No. 2428).

7. Priority Mail Contract 291 (MC2017-85 and CP2017-114) (Order No. 3784).

8. Parcel Select Contract 18 (MC2017-65 and CP2017-93) (Order No. 3724).

9. Priority Mail & First-Class Package Service Contract 2 (MC2015-24 and CP2015-32) (Order No. 2347).

10. Priority Mail & First-Class Package Service Contract 41 (MC2017-48 and CP2017-74) (Order No. 3698).

The following negotiated service agreements have expired, or have been terminated early, and are being deleted from the Market Dominant Product List:

1. PHI Acquisitions, Inc. Negotiated Service Agreement (MC2014-21 and R2014-6) (Notice of Termination of Agreement).

Updated product lists. The referenced changes to the product lists are incorporated into 39 CFR Appendix A to Subpart A of Part 3020—Market Dominant Product List and 39 CFR Appendix B to Subpart A of Part 3020—Competitive Product List.

Administrative practice and procedure, Postal Service.

For the reasons discussed in the preamble, the Postal Regulatory Commission amends chapter III of title 39 of the Code of Federal Regulations as follows:

Throughout this document whenever “we,” “us,” or “our” is used, we mean EPA. This supplementary information section is arranged as follows:

This rulemaking approves a SIP submission from MPCA dated October 4, 2016, which addresses infrastructure requirements relating to PSD for the 1997 ozone, 1997 PM2.5, 2006 PM2.5, 2008 Pb, 2008 ozone, 2010 NO2, 2010 SO2, and 2012 PM2.5 NAAQS.

The requirement for states to make infrastructure SIP submissions arises out of CAA section 110(a)(1). Pursuant to CAA section 110(a)(1), states must make SIP submissions “within 3 years (or such shorter period as the Administrator may prescribe) after the promulgation of a national primary ambient air quality standard (or any revision thereof),” and these SIP submissions are to provide for the “implementation, maintenance, and enforcement” of such NAAQS. The statute directly imposes on states the duty to make these SIP submissions, and the requirement to make the submissions is not conditioned upon EPA's taking any action other than promulgating a new or revised NAAQS. CAA section 110(a)(2) includes a list of specific elements that “[e]ach such plan” submission must address.

EPA has historically referred to these SIP submissions made for the purpose of satisfying the requirements of CAA section 110(a)(1) and (2) as “infrastructure SIP” submissions. Although the term “infrastructure SIP” does not appear in the CAA, EPA uses the term to distinguish this particular type of SIP submission from submissions that are intended to satisfy other SIP requirements under the CAA. This specific rulemaking is only taking action on the infrastructure SIP elements relating to PSD, provided at CAA sections 110(a)(2)(C), 110(a)(2)(D)(i)(II), 110(a)(2)(D)(ii), and 110(a)(2)(J).

In previous rulemakings, EPA addressed Minnesota's infrastructure obligations under the various NAAQS. On July 13, 2011 (76 FR 41075), EPA approved most elements of Minnesota's infrastructure SIP submittal for the 1997 ozone and 1997 PM2.5 NAAQS. On October 29, 2012 (77 FR 65478), EPA approved most elements of Minnesota's infrastructure SIP submittal for the 2006 PM2.5 NAAQS. On July 16, 2014 (79 FR 41439), EPA approved most elements of Minnesota's infrastructure SIP submittal for the 2008 Pb NAAQS. Finally, on October 20, 2015 (80 FR 63436), EPA approved most elements of Minnesota's infrastructure SIP submittal for the 2008 ozone, 2010 NO2, 2010 SO2, and 2012 PM2.5 NAAQS. However, because Minnesota did not have an approved PSD program at the time of these rulemakings, EPA generally disapproved infrastructure SIP elements relating to PSD in the rulemakings.1

MPCA's submission dated October 4, 2016, requested that EPA approve into its SIP Minnesota Rule 7007.3000, which incorporates by reference the Federal PSD rules at 40 CFR 52.21. On July 10, 2017 (82 FR 31741), EPA proposed to approve this request, and on September 26, 2017 (82 FR 44734), EPA finalized approval; the change became effective on October 26, 2017. Therefore, Minnesota is now implementing its own SIP-approved PSD program.

In this rulemaking, as requested by Minnesota, EPA is finding that Minnesota has satisfied all infrastructure SIP elements relating to PSD, at CAA sections 110(a)(2)(C), 110(a)(2)(D)(i)(II), 110(a)(2)(D)(ii), and 110(a)(2)(J), for the 1997 ozone, 1997 PM2.5, 2006 PM2.5, 2008 Pb, 2008 ozone, 2010 NO2, 2010 SO2, and 2012 PM2.5 NAAQS.

EPA's guidance relating to infrastructure SIP submissions can be found in a guidance document entitled “Guidance on SIP Elements Required Under Sections 110(a)(1) and (2) for the 1997 8-hour Ozone and PM2.5  2 National Ambient Air Quality Standards” (2007 Guidance).3 Further guidance is provided in a September 13, 2013, document entitled “Guidance on Infrastructure State Implementation Plan (SIP) Elements under CAA Sections 110(a)(1) and (2)” (2013 Guidance).4

Pursuant to CAA section 110(a), states must provide reasonable notice and opportunity for public hearing for all infrastructure SIP submissions. MPCA commenced a public comment period on June 20, 2016, and closed the public comment period on July 20, 2016. Minnesota received three comments, and provided a response to comments in its submittal.

Minnesota provided a synopsis of how its SIP meets each of the applicable requirements in CAA sections 110(a)(2)(C), 110(a)(2)(D)(i)(II), 110(a)(2)(D)(ii), and 110(a)(2)(J) for the 1997 ozone, 1997 PM2.5, 2006 PM2.5, 2008 Pb, 2008 ozone, 2010 NO2, 2010 SO2, and 2012 PM2.5 NAAQS, as applicable.

On May 17, 2018 (83 FR 22913), EPA published a proposed rule that would approve this submission into Minnesota's SIP. This proposed rule contained a detailed evaluation of how Minnesota's submission satisfies certain requirements under CAA section 110. Two comments were received; neither is relevant to this rulemaking. Therefore, EPA is finalizing this rule as proposed.

EPA is approving the submission from Minnesota certifying that its current SIP is sufficient to meet the infrastructure SIP requirements relating to PSD, at CAA sections 110(a)(2)(C), 110(a)(2)(D)(i)(II), 110(a)(2)(D)(ii), and 110(a)(2)(J), for the 1997 ozone, 1997 PM2.5, 2006 PM2.5, 2008 Pb, 2008 ozone, 2010 NO2, 2010 SO2, and 2012 PM2.5 NAAQS. EPA is also making some consistency and clarification edits to Minnesota's infrastructure SIP table in 40 CFR 52.1220.

Under the CAA, the Administrator is required to approve a SIP submission that complies with the provisions of the CAA and applicable Federal regulations. 42 U.S.C. 7410(k); 40 CFR 52.02(a). Thus, in reviewing SIP submissions, EPA's role is to approve state choices, provided that they meet the criteria of the CAA. Accordingly, this action merely approves state law as meeting Federal requirements and does not impose additional requirements beyond those imposed by state law. For that reason, this action:

• Is not a significant regulatory action subject to review by the Office of Management and Budget under Executive Orders 12866 (58 FR 51735, October 4, 1993) and 13563 (76 FR 3821, January 21, 2011);

• Is not an Executive Order 13771 (82 FR 9339, February 2, 2017) regulatory action because SIP approvals are exempted under Executive Order 12866;

• Does not impose an information collection burden under the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq.);

• Is certified as not having a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601 et seq.);

• Does not contain any unfunded mandate or significantly or uniquely affect small governments, as described in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4);

• Does not have federalism implications as specified in Executive Order 13132 (64 FR 43255, August 10, 1999);

• Is not an economically significant regulatory action based on health or safety risks subject to Executive Order 13045 (62 FR 19885, April 23, 1997);

• Is not a significant regulatory action subject to Executive Order 13211 (66 FR 28355, May 22, 2001);

• Is not subject to requirements of Section 12(d) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note) because application of those requirements would be inconsistent with the CAA; and

• Does not provide EPA with the discretionary authority to address, as appropriate, disproportionate human health or environmental effects, using practicable and legally permissible methods, under Executive Order 12898 (59 FR 7629, February 16, 1994).

In addition, the SIP is not approved to apply on any Indian reservation land or in any other area where EPA or an Indian tribe has demonstrated that a tribe has jurisdiction. In those areas of Indian country, the rule does not have tribal implications and will not impose substantial direct costs on tribal governments or preempt tribal law as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).

The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the Small Business Regulatory Enforcement Fairness Act of 1996, generally provides that before a rule may take effect, the agency promulgating the rule must submit a rule report, which includes a copy of the rule, to each House of the Congress and to the Comptroller General of the United States. EPA will submit a report containing this action and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States prior to publication of the rule in the Federal Register. A major rule cannot take effect until 60 days after it is published in the Federal Register. This action is not a “major rule” as defined by 5 U.S.C. 804(2).

Under section 307(b)(1) of the CAA, petitions for judicial review of this action must be filed in the United States Court of Appeals for the appropriate circuit by October 1, 2018. Filing a petition for reconsideration by the Administrator of this final rule does not affect the finality of this action for the purposes of judicial review nor does it extend the time within which a petition for judicial review may be filed, and shall not postpone the effectiveness of such rule or action. This action may not be challenged later in proceedings to enforce its requirements. (See section 307(b)(2).)

40 CFR part 52 is amended as follows:

Throughout this document whenever “we,” “us,” or “our” is used, we mean EPA. This supplementary information section is arranged as follows:

On October 26, 2015 (80 FR 65291), EPA revised the primary and secondary ozone NAAQS from 0.075 to 0.070 parts per million (ppm), daily maximum 8-hour concentration, codified at 40 CFR 50.19. EPA also revised the monitoring test methods for ozone, which are codified at 40 CFR part 50, appendices D and U, and at 40 CFR part 53.

On April 11, 2017, IDEM revised its ambient air quality primary and secondary standards for ozone to be consistent with EPA's 2015 revision, and codified that revision at 326 Indiana Administrative Code (IAC) 1-3-4, Ambient Air Quality Standards. IDEM revised 326 IAC 1-3-4(4)(B) to update its references to the Federal monitoring test methods. Indiana also made administrative revisions throughout 326 IAC 1-3-4 for ambient air quality standards other than ozone. This includes changing “shall represent” to “represents” and “shall” to “must.”

On September 7, 2017, IDEM submitted the revisions of 326 IAC 1-3-4 to EPA and requested their approval into the Indiana SIP. EPA proposed approving 326 IAC 1-3-4, as revised, on May 2, 2018 (83 FR 19194).

A public comment period was provided in the May 2, 2018 (83 FR 19194) proposed rule. The comment period closed on June 1, 2018. Two comments were submitted during the comment period. Both comments raised issues outside the scope of this rulemaking.

EPA is approving revisions related to Indiana's ambient air quality standards in 326 IAC 1-3-4 into the Indiana SIP. The revisions to 326 IAC 1-3-4 include making IDEM's ozone standard consistent with the 2015 8-hour ozone NAAQS, as codified at 40 CFR part 50, and making IDEM's monitoring test methods for ozone consistent with the methods codified at 40 CFR part 50 and 40 CFR part 53. Further, administrative revisions were made to IDEM's other ambient air quality standards in 326 IAC 1-3-4. IDEM submitted the SIP revision request on September 7, 2017.

In this rule, EPA is finalizing regulatory text that includes incorporation by reference. In accordance with requirements of 1 CFR 51.5, EPA is finalizing the incorporation by reference of the Indiana Regulations described in the amendments to 40 CFR part 52 set forth below. EPA has made, and will continue to make, these documents generally available through www.regulations.gov, and at the EPA Region 5 Office (please contact the person identified in the For Further Information Contact section of this preamble for more information). Therefore, these materials have been approved by EPA for inclusion in the State implementation plan, have been incorporated by reference by EPA into that plan, are fully federally enforceable under sections 110 and 113 of the CAA as of the effective date of the final rulemaking of EPA's approval, and will be incorporated by reference in the next update to the SIP compilation.1

Under the Clean Air Act, the Administrator is required to approve a SIP submission that complies with the provisions of the Clean Air Act and applicable Federal regulations. 42 U.S.C. 7410(k); 40 CFR 52.02(a). Thus, in reviewing SIP submissions, EPA's role is to approve state choices, provided that they meet the criteria of the Clean Air Act. Accordingly, this action merely approves state law as meeting Federal requirements and does not impose additional requirements beyond those imposed by state law. For that reason, this action:

• Is not a significant regulatory action subject to review by the Office of Management and Budget under Executive Orders 12866 (58 FR 51735, October 4, 1993) and 13563 (76 FR 3821, January 21, 2011);

• Is not an Executive Order 13771 (82 FR 9339, February 2, 2017) regulatory action because SIP approvals are exempted under Executive Order 12866;

• Does not impose an information collection burden under the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq.);

• Is certified as not having a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601 et seq.);

• Does not contain any unfunded mandate or significantly or uniquely affect small governments, as described in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4);

• Does not have Federalism implications as specified in Executive Order 13132 (64 FR 43255, August 10, 1999);

• Is not an economically significant regulatory action based on health or safety risks subject to Executive Order 13045 (62 FR 19885, April 23, 1997);

• Is not a significant regulatory action subject to Executive Order 13211 (66 FR 28355, May 22, 2001);

• Is not subject to requirements of Section 12(d) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note) because application of those requirements would be inconsistent with the Clean Air Act; and

• Does not provide EPA with the discretionary authority to address, as appropriate, disproportionate human health or environmental effects, using practicable and legally permissible methods, under Executive Order 12898 (59 FR 7629, February 16, 1994).

In addition, the SIP is not approved to apply on any Indian reservation land or in any other area where EPA or an Indian tribe has demonstrated that a tribe has jurisdiction. In those areas of Indian country, the rule does not have tribal implications and will not impose substantial direct costs on tribal governments or preempt tribal law as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).

The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the Small Business Regulatory Enforcement Fairness Act of 1996, generally provides that before a rule may take effect, the agency promulgating the rule must submit a rule report, which includes a copy of the rule, to each House of the Congress and to the Comptroller General of the United States. EPA will submit a report containing this action and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States prior to publication of the rule in the Federal Register. A major rule cannot take effect until 60 days after it is published in the Federal Register. This action is not a “major rule” as defined by 5 U.S.C. 804(2).

Under section 307(b)(1) of the Clean Air Act, petitions for judicial review of this action must be filed in the United States Court of Appeals for the appropriate circuit by October 1, 2018. Filing a petition for reconsideration by the Administrator of this final rule does not affect the finality of this action for the purposes of judicial review nor does it extend the time within which a petition for judicial review may be filed, and shall not postpone the effectiveness of such rule or action. This action may not be challenged later in proceedings to enforce its requirements. (See section 307(b)(2).)

40 CFR part 52 is amended as follows:

Throughout this document wherever “we,” “us,” or “our” is used, it is intended to refer to the EPA.

On May 31, 2018, the EPA proposed to approve Washington's Regional Haze Progress Report (83 FR 24954). An explanation of the Clean Air Act requirements, a detailed analysis of the submittal, and the EPA's reasons for proposing approval were provided in the notice of proposed rulemaking, and will not be restated here. The public comment period for the proposal ended July 2, 2018.

We received six comments on the rulemaking. After reviewing the comments, we have determined that four of the comments are outside the scope of our proposed action and fail to identify any material issue necessitating a response. The fifth and sixth comments, submitted by TransAlta Centralia Generation LLC (TransAlta) and an anonymous commenter, are described below.

Comment 0012: In its comment, TransAlta stated: “We write to comment on the future operations of TransAlta's Centralia Power Plant in the Regional Haze 5-Year Progress Report. The Progress Report and its supporting documents describe the `retirement' or `closure' of TransAlta's Centralia Power Plant in reference to reducing emissions and impacts. However, TransAlta and a number of other parties have always anticipated that when the Centralia Power Plant ceases coal-fired operations, it would likely convert one or both boilers to use gas instead of coal. Rather than shuttering the plant, TransAlta envisions retrofitting the facility to accommodate fuel-switching to natural gas as a means to supply power for Washington State until renewable energy is reliably sufficient. TransAlta estimates a reduction in emissions as a result of this fuel-switching, but does not anticipate ceasing operations or closing the Centralia Power Plant.” TransAlta then requested that the EPA make specific wording changes to the narrative text of the state's progress report, and supporting documents, to reflect this position.

Comment 0013: Purportedly in response to TransAlta's Comment 0012, an anonymous commenter stated: “The agreement to close a plant means that it is CLOSED. The last minute attempt to re-engineer the plant to burn a different type of fossil fuel is a contradiction of the plan.”

Response: Under the Clean Air Act the EPA has the authority to approve or disapprove SIP revisions submitted by the states. We do not have the authority to modify the narrative text of state submissions, or supporting documents, other than disapproval or partial disapproval. To the extent TransAlta believes that Washington's narrative description of the existing best available retrofit technology (BART) Order 6426 (order) is ambiguous or incorrect regarding facility operation after 2020 and 2025, this comment could have been submitted during the state public comment period. In reviewing Appendix G. Ecology's Responses to Comments Received during the Public Comment Period, we see no evidence of TransAlta requesting changes or commenting on this issue during the state public comment period.1

As discussed in the proposal for this action, the primary purpose of the progress report is to evaluate whether the existing regional haze plan is adequate for meeting the reasonable progress goals (RPGs) established for the first regional haze planning period, ending in 2018. The TransAlta BART order, as approved into the SIP states, “Coal units BW21 and BW22 will permanently cease burning coal and be decommissioned as follows: (4.1) One coal fired unit must permanently cease burning coal no later than December 31, 2020. (4.2) The second coal fired unit must permanently cease burning coal no later than December 31, 2025.” To the extent that TransAlta and Washington may or may not agree about the interpretation of these conditions as they relate to potential future revisions to the BART order, potential future changes under the new source review program, or potential use of the facility beyond 2020 and 2025, we note these issues are outside the scope of this action evaluating progress during the first planning period. We encourage TransAlta to resolve these issues directly with Washington as the state develops the regional haze update for the next planning period (2018-2028). In the interim, we do not believe this comment constitutes a sufficient basis for disapproving or partially disapproving Washington's progress report. As stated in our proposed approval of Washington's Regional Haze Progress Report, the progress report contained the information required by 40 CFR 51.308 and demonstrated that Washington is meeting or exceeding all reasonable progress goals for all Class I areas within Washington's borders, and implementation of the regional haze SIP has enabled other nearby states to meet RPGs for Class I areas where Washington sources are reasonably anticipated to contribute to visibility impairment. In addition, Washington's progress report contained an assessment of the status of all measures included in the SIP that were implemented during the first planning period, such as compliance with the BART emission limit for nitrogen oxides at TransAlta's Centralia Power Plant. Therefore, our position remains that the appropriate action is to approve Washington's Regional Haze Progress Report.

The EPA is approving the Washington Regional Haze Progress Report, submitted on November 6, 2017, as meeting the applicable requirements of the Clean Air Act and the federal Regional Haze Rule, as set forth in 40 CFR 51.308(g). The EPA is also approving Washington's determination that the existing regional haze SIP is adequate to meet the state's visibility goals established for the first planning period and requires no substantive revision at this time, as set forth in 40 CFR 51.308(h). We have also determined that Washington fulfilled the requirements in 40 CFR 51.308(i) regarding state coordination with Federal Land Managers.

Under the Clean Air Act, the Administrator is required to approve a SIP submission that complies with the provisions of the Clean Air Act and applicable federal regulations. 42 U.S.C. 7410(k); 40 CFR 52.02(a). Thus, in reviewing SIP submissions, the EPA's role is to approve state choices, provided that they meet the criteria of the Clean Air Act. Accordingly, this action merely approves state law as meeting federal requirements and does not impose additional requirements beyond those imposed by state law. For that reason, this action:

• Is not a “significant regulatory action” subject to review by the Office of Management and Budget under Executive Orders 12866 (58 FR 51735, October 4, 1993) and 13563 (76 FR 3821, January 21, 2011);

• is not an Executive Order 13771 (82 FR 9339, February 2, 2017) regulatory action because actions such as SIP approvals are exempted under Executive Order 12866;

• does not impose an information collection burden under the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq.);

• is certified as not having a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601 et seq.);

• does not contain any unfunded mandate or significantly or uniquely affect small governments, as described in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4);

• does not have Federalism implications as specified in Executive Order 13132 (64 FR 43255, August 10, 1999);

• is not an economically significant regulatory action based on health or safety risks subject to Executive Order 13045 (62 FR 19885, April 23, 1997);

• is not a significant regulatory action subject to Executive Order 13211 (66 FR 28355, May 22, 2001);

• is not subject to requirements of Section 12(d) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note) because this action does not involve technical standards; and

• does not provide the EPA with the discretionary authority to address, as appropriate, disproportionate human health or environmental effects, using practicable and legally permissible methods, under Executive Order 12898 (59 FR 7629, February 16, 1994).

The SIP is not approved to apply on any Indian reservation land and is also not approved to apply in any other area where the EPA or an Indian tribe has demonstrated that a tribe has jurisdiction. In those areas of Indian country, the rule does not have tribal implications as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).

The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the Small Business Regulatory Enforcement Fairness Act of 1996, generally provides that before a rule may take effect, the agency promulgating the rule must submit a rule report, which includes a copy of the rule, to each House of the Congress and to the Comptroller General of the United States. The EPA will submit a report containing this action and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States prior to publication of the rule in the Federal Register. A major rule cannot take effect until 60 days after it is published in the Federal Register. This action is not a “major rule” as defined by 5 U.S.C. 804(2).

Under section 307(b)(1) of the Clean Air Act, petitions for judicial review of this action must be filed in the United States Court of Appeals for the appropriate circuit by October 1, 2018. Filing a petition for reconsideration by the Administrator of this final rule does not affect the finality of this action for the purposes of judicial review nor does it extend the time within which a petition for judicial review may be filed, and shall not postpone the effectiveness of such rule or action. This action may not be challenged later in proceedings to enforce its requirements (See section 307(b)(2)).

For the reasons set forth in the preamble, 40 CFR part 52 is amended as follows:

Why we need to publish a rule. Under the Endangered Species Act of 1973, as amended (Act; 16 U.S.C. 1531 et seq.), a species may be protected through listing as an endangered species or threatened species if it meets the definition of an “endangered species” or “threatened species” under the Act. Listing a species as an endangered or threatened species can only be completed by issuing a rule.

What this document does. This rule will add the following five tarantula species to the List of Endangered and Threatened Wildlife in title 50 of the Code of Federal Regulations (50 CFR 17.11(h)) as endangered species: Poecilotheria fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata.

The basis for our action. Under the Act, we use the best available scientific and commercial data to determine whether a species meets the definition of a “threatened species” or an “endangered species” because of any one or more of the following five factors or the cumulative effects thereof: (A) The present or threatened destruction, modification, or curtailment of its habitat or range; (B) Overutilization for commercial, recreational, scientific, or educational purposes; (C) Disease or predation; (D) The inadequacy of existing regulatory mechanisms; or (E) Other natural or manmade factors affecting its continued existence. We have determined on the basis of the best available scientific and commercial data that P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata are in danger of extinction because of ongoing habitat loss and degradation and the cumulative effects of this and other threat factors. One species, P. smithi, is also in danger of extinction because of the effects of stochastic (random) processes.

Peer review and public comment. We sought comments from independent peer reviewers to ensure that our designation is based on scientifically sound data and analyses. We invited these peer reviewers to comment on our listing proposal. We also considered all comments and information received from the public during the comment period.

We received a petition, dated October 29, 2010, from WildEarth Guardians requesting that the following 11 tarantula species in the genus Poecilotheria be listed under the Act as endangered or threatened: Poecilotheria fasciata, P. formosa, P. hanumavilasumica, P. metallica, P. miranda, P. ornata, P. pederseni, P. rufilata, P. smithi, P. striata, and P. subfusca. The petition identified itself as such and included the information as required by 50 CFR 424.14(a). We published a 90-day finding on December 3, 2013 (78 FR 72622), indicating that the petition presents substantial scientific and commercial information indicating that listing these 11 species may be warranted. At that time we also (1) notified the public that we were initiating a review of the status of these species to determine if listing them is warranted, (2) requested from the public scientific and commercial data and other information regarding the species, and (3) notified the public that at the conclusion of our review of the status of these species, we would issue a 12-month finding on the petition, as provided in section 4(b)(3)(B) of the Act. We published a 12-month finding and proposed rule for listing the five Poecilotheria species that are endemic to Sri Lanka (Poecilotheria fasciata, P. ornata, P. pederseni, P. smithi, and P. subfusca) on December 14, 2016 (81 FR 90297). In our 12-month finding and proposed rule we determined that these five species were in danger of extinction throughout their ranges and proposed listing them as endangered under the Act. We requested input from the public, range country, other interested parties, and peer reviewers during a 60-day public comment period that ended February 13, 2017.

In preparing this final rule, we reviewed and fully considered comments from the public and peer reviewers on the proposed rule. This final rule incorporates minor changes to our proposed listing based on the comments we received (See: Summary of Comments and Recommendations).

Poecilotheria is a genus of arboreal spiders endemic to Sri Lanka and India. The genus belongs to the family Theraphosidae, often referred to as tarantulas, within the infraorder Mygalomorphae. As with most theraphosid genera, Poecilotheria is a poorly understood genus. The taxonomy has never been studied using modern DNA technology; therefore, species descriptions are based solely on morphological characteristics. Consequently, there have been several revisions, additions, and subtractions to the list of Poecilotheria species over the last 20 years (Nanayakkara 2014a, pp. 71-72; Gabriel et al. 2013, entire).

The World Spider Catalog (2017, unpaginated; 2016, unpaginated) currently recognizes 14 species of Poecilotheria. The Integrated Taxonomic Information System currently identifies 16 species in the genus, based on the 2011 version of the same catalog. Because the World Spider Catalog is the widely accepted authority on spider taxonomy, we consider the Poecilotheria species recognized by the most recent (2017) version of this catalog to be valid. Based on the World Spider Catalog, all five of the species addressed in this rule are considered valid taxon, although P. pederseni is now considered a junior synonym to the currently accepted name P. vittata. Therefore, in the remainder of this document we refer to this species as P. vittata. Further, all five of these species have multiple common names (see WildEarth Guardians 2010, p. 4); thus, we refer to them by their scientific names throughout this document.

Poecilotheria species are among the largest spiders in the world, with body lengths of 4 to 9 centimeters (1.5 to 3.5 inches) and maximum adult leg spans varying from 15 to 25 centimeters (6 to 10 inches) (Nanayakkara 2014a, pp. 94-129; Molur et al. 2006, p. 23). They are known for their fast movements and potent venom that, in humans, typically causes extended muscle cramps and severe pain (Fuchs 2014, p. 75; Nanayakkara and Adikaram 2013, p. 53). They are hairy spiders and have striking coloration, with dorsal color patterns of gray, black, brown, and in one case, a metallic blue. Ventral coloration of either sex is typically more of the same with the exception of the first pair of legs, which in some species bear bright yellow to orange aposematic (warning) markings that are visible when the spider presents a defensive display. Mature spiders exhibit some sexual dimorphism with mature males having a more drab coloration and being significantly smaller than the adult females (Siliwal 2017, unpaginated; Nanayakkara 2014a, entire; Pocock 1899, pp. 84-86).

The primary characteristics used to distinguish Poecilotheria species are ventral leg markings (Gabriel 2010 p. 13, citing several authors). Some authors indicate that identification via leg markings is straightforward for most Poecilotheria species (Nanayakkara 2014a, pp. 74-75; Gabriel 2011a, p. 25). However, the apparent consistent leg patterns observed in adults of a species could also be a function of specimens being collected from a limited number of locations (Morra 2013, p. 129). During surveys, researchers found more variation than suggested by published species descriptions and indicated that identifying Poecilotheria species is not as straightforward as suggested by current descriptions (Molur et al. 2003, unpaginated). Immature spiders (juveniles) lack the variation in coloring found in adults. As a result, they are difficult to differentiate visually; genetic analysis may be the only way to reliably identify juveniles to species (Longhorn 2014a, unpaginated).

Most captive individuals of Poecilotheria species are in the pet trade; few specimens of the species addressed in this rule are held in zoos (Species360 2017, unpaginated). Poecilotheria species are commonly bred in captivity by amateur hobbyists as well as vendors, and are available as captive-bred young in the pet trade in the United States, Europe, and elsewhere (see Trade). However, while rearing and keeping of captive individuals by hobbyists and vendors has provided information on life history of these species, we are not aware of any existing conservation programs for these species, including any in which specimens held or sold as pets contribute to the viability of these species within their native ranges in the wild.

Individuals of these species that are held or sold as pets hold limited conservation value to the species in the wild because they are not genetically managed for conservation purposes. Individuals in the pet trade descend from wild individuals from unknown locations, have undocumented lineages, come from limited stock (e.g., see Gabriel 2012, p. 18), and are bred without knowledge or consideration of their genetics. They also likely include an unknown number of hybrid individuals resulting from intentional crosses, or unintentional crosses resulting from confusion and difficulty in species taxonomy and identification (Gabriel 2011a, pp. 25-26; Gabriel et al. 2005, p. 4; Gabriel 2003, pp. 89-90). Further, many are likely several generations removed from wild ancestors and thus may be adversely affected by inbreeding or maladapted to conditions in the wild. In short, captive individuals held or sold as pets do not adhere to the IUCN guidelines for reintroductions and other conservation translocations (IUCN 2013, entire). Further, we are not aware of any captive-breeding programs for Poecilotheria that adhere to IUCN guidelines.

Because (1) the purpose of our status assessments is to determine the status of the species in the wild, (2) we are not aware of any information indicating that captive individuals are contributing to the conservation of these species in the wild, and (3) captive individuals held or sold as pets have limited value for conservation programs or for reintroduction purposes, we place little weight on the status of captive individuals in our assessment of the status of the five Poecilotheria species addressed in this rule.

Tarantulas possess life-history traits markedly different from most spiders and other arthropods (Bond et al. 2006, p. 145). They are long-lived, have delayed sexual maturity, and most are habitat specialists that are extremely sedentary. They also have poor dispersal ability because their mode of travel is limited to walking, and they typically do not move far from the area in which they are born. As a result, the distribution of individuals tends to be highly clumped in suitable microhabitats (a smaller habitat within a larger habitat), populations are extremely genetically structured (genetically subdivided; gene frequencies differ across the population), and the group shows a high level of endemism (species restricted to a particular geographical location) (Ferreti et al. 2014, p. 2; Hedin et al. 2013, p. 509, citing several sources; Bond et al. 2006, pp. 145-146, citing several sources).

Tarantulas are primarily nocturnal and typically lead a hidden life, spending much of their time concealed inside burrows or crevices (retreats) that provide protection from predators and the elements (Foelix 2011, p. 14; Molur et al. 2003, unpaginated; Gallon 2000, unpaginated). They are very sensitive to vibrations and climatic conditions, and usually do not come out of their retreats in conditions like rains, wind, or excessive light, or when they detect movement outside their retreat (Molur et al. 2003, unpaginated). Tarantulas are generalist predators that sit and wait for passing prey near the entrance of their retreats (Gallon 2000, unpaginated). With the exception of reproductive males that wander in search of females during the breeding season, they leave their retreat only briefly for capturing prey, and quickly return to it at the slightest vibration or disturbance (Foelix 2011, p. 14; Stotley and Shillington 2009, pp. 1210-1211; Molur et al. 2003, unpaginated). Tarantulas generally inhabit a suitable retreat for extended periods and may use the same retreat for years (Stotley and Shilling 2009, pp. 1210-1211; Stradling 1994, p. 87). Most tarantulas are solitary, with one spider occupying a retreat (Gallon 2000, unpaginated).

The lifestyle of adult male tarantulas differs from that of adult females and juveniles. Females and juveniles are sedentary, spending most of their time in or near their retreat. Adult females are long-lived and continue to grow, molt, and reproduce for several years after reaching maturity (Ferreti et al. 2014, p. 2, citing several sources; Costa and Perez-Miles 2002, p. 585, citing several sources; Gallon 2000, unpaginated). They are capable of producing one brood per year, although they do not always do so (Ferreti et al. 2014, p. 2; Stradling 1994, pp. 92-96). Males have shorter lifespans than females and, after reaching maturity, no longer molt and usually only live one or two breeding seasons (Costa and Perez-Miles 2002, p. 585, Gallon 2000, unpaginated). Further, on reaching maturity, males leave their retreats to wander in search of receptive females with which to mate (Stotley and Shillington 2009, pp. 1210-1211). Males appear to search the landscape for females randomly and, at short range, may be able to detect females through contact sex-pheromones on silk deposited by the female at the entrance of her retreat (Ferreti et al. 2013, pp. 88, 90; Janowski-Bell and Horner 1999, pp. 506, 509; Yanez et al. 1999, pp. 165-167; Stradling 1994, p. 96). Males may cover relatively large areas when searching for females. Males of a ground-dwelling temperate species (Aphonopelma anax) are reported covering search areas up to 29 ha (72 acres), though the mean size of areas searched is much smaller (1.1 ± 0.5 ha one year and 8.8 ± 2.5 ha another year) (Stotley and Shillington 2009, p. 1216).

When a male locates a receptive female, the two will mate in or near the entrance to the female's retreat. After mating, the female returns to her retreat where she eventually lays eggs within an egg-sac and tends the eggs until they hatch. Spiderlings reach maturity in one or more years (Gallon 2000, unpaginated).

Limited information is available on Poecilotheria species in the wild. While they appear to be typical tarantulas in many respects, they differ from most tarantulas in that they are somewhat social (discussed below) and reside in trees rather than ground burrows (see Microhabitat).

Poecilotheria species are patchily distributed (Siliwal et al. 2008, p. 8) and prey on a variety of insects, including winged termites, beetles, grasshoppers, and moths, and occasionally small vertebrates (Das et al. 2012, entire; Molur et al. 2006, p. 31; Smith et al. 2001, p. 57).

We are not aware of any information regarding the reproductive success of wild Poecilotheria species. However, reproduction may be greatly reduced during droughts (Smith et al. 2001, pp. 46, 49). Additionally, given the apparently random searching for females by male tarantulas, successful mating of females likely depends on the density of males in the vicinity. In a study conducted on an arboreal tropical tarantula (Avicularia avicularia in Trinidad), less than half of adult females produced eggs in the same year despite the fact that they were in close proximity to each other and exhibited the same weight gain, possibly due to a failure to mate (Stradling 1994, p. 96).

Time to maturity in Poecilotheria species varies and is influenced by the temperature at which the young are raised and amount of food provided (Gabriel 2006, entire). Based on observations of captive Poecilotheria, males mature from spiderlings to adults in 11 to16 months (Gabriel 2011b, p. 101; Gabriel 2005, entire). Females mature in 14 to 48 months and generally live an additional 60 to 85 months after maturing (Cowper 2017, unpaginated; Weaver 2017, unpaginated; Gabriel 2012, p. 19; Government of Sri Lanka and Government of the United States 2000, p. 3), although they have been reported living up to 14 years (Gallon 2012, p. 69). Females lay about 50 to 100 eggs, 5 to 6 months after mating (Nanayakarra 2014a, p. 79; Gabriel 2011b, entire; Gabriel 2005, p. 101). In captivity, generation time appears to be roughly 2-3 years (see Gabriel 2011b, entire; Gabriel 2006, p. 96; Gabriel 2005, entire). While captive individuals provide some indication of potential growth, longevity, and reproductive capacity of wild individuals, these variables are likely to vary with conditions in the wild. Poecilotheria are ectotherms and, as such, their physiological and developmental processes including growth and reproduction are strongly influenced by body temperature and it is likely that captive-rearing of these species is primarily done under ideal environmental conditions for reproduction and growth.

Unlike most tarantulas, which are solitary, most Poecilotheria species display a degree of sociality. Adult females often share their retreat with their spiderlings. Eventually as the young mature, they disperse to find denning areas of their own. Occasionally young remain on their natal tree to breed, or three to four adult females will share the same retreat (Nanayakkara 2014a, pp. 74, 80). These semi-social behaviors are believed to be a response to a lack of availability of suitable habitat (trees) in which individuals can reside (Nanayakkara 2014a, pp. 74, 80; Gallon 2000, unpaginated).

Poecilotheria occupy preexisting holes or crevices in trees or behind loose tree bark (Molur et al. 2006, p. 31; Samarawckrama et al. 2005; Molur et al. 2003 unpaginated; Kirk 1996, pp. 22-23). Individuals of some species are also occasionally found in grooves or crevices in or on other substrates such as rocks or buildings that are close to wooded areas (Samarawckrama et al. 2005, pp. 76, 83; Molur et al. 2003, unpaginated). In a survey in Sri Lanka, 89 percent (31) of Poecilotheria spiders were found in or on trees, while 11 percent (4) were found in or on buildings (Samarawckrama et al. 2005, p. 76). Poecilotheria species are said to have a preference for residing in old, established trees with naturally occurring burrows (Nanayakkara 2014a, p. 86). Some species also appear to prefer particular tree species (Nanayakkara 2014a, p. 84; Samarawckrama et al. 2005, p. 76).

Most Poecilotheria species occur in forested areas, although some occasionally occur in other treed habitats such as plantations (Nanayakkara 2014a, p. 86; Molur et al. 2006, p. 10; Molur et al 2003, entire; Smith et al. 2001, entire). Poecilotheria are less abundant in degraded forest (Molur et al. 2004, p. 1665). Less complex, degraded forests may contain fewer trees that provide adequate retreats for these species and less cover for protection from predators and the elements. Trees with broad, dense canopy cover likely provide Poecilotheria in hotter, dryer habitats protection from heat and desiccation (Siliwal 2008, pp. 12, 15). We provide additional, species-specific information on habitat below.

Sri Lanka is an island nation about 65,610 square kilometers (km 2) (25,332 square miles (mi 2)) in area (Weerakoon 2012, p. xvii), or about the size of West Virginia (Fig. 1). The variation in topography, soils, and rainfall on the island has resulted in a diversity of ecosystems with high levels of species endemism (Government of Sri Lanka (GOSL) 2014, pp. xiv-xv). Sri Lanka, together with the Western Ghats of India, is identified as a global biodiversity hotspot, and is among the eight “hottest hotspots,” (Myers et al. 2000, entire).

Sri Lanka consists of a mountainous region (central highlands), reaching 2,500 meters (8,202 feet) in elevation, in the south-central part of the island surrounded by broad lowland plains (GOSL 2012, p. 2a-3-141) (Fig. 2). The country has a tropical climate characterized by two major monsoon periods: the southwest monsoon from May to September and the northeast monsoon from December to February (GOSL 2012, pp. 7-8).

Sri Lanka's central highlands create a rain shadow effect that gives rise to two pronounced climate zones—the wet zone and dry zone—and a less extensive intermediate zone between the two (Ministry of Environment-Sri Lanka (MOE) 2010, pp. 21-22) (Fig. 2). Small arid zones also occur on the northwestern and southeastern ends of the country (Nanayakkara 2014a, p. 22). Annual rainfall ranges from less than 1,000 millimeters (mm) (39.4 inches (in)) in the arid zone to over 5,000 mm (197 in) in the wet zone of the central highlands (Jayatillake et al. 2005, pp. 66-67). Mean annual temperature ranges from 27 degrees Celsius (°C) (80.6 degrees Fahrenheit (°F)) in the lowlands to 15 °C (59 ;°F) in the highlands (Eriyagama et al. 2010, p. 2).

The wet zone is located in the southwestern quarter of the island, where high annual rainfall is maintained throughout the year by rain received during both monsoons and during inter-monsoonal periods (MOE 2010, pp. 21-22) (Fig. 2). The wet zone is divided into low, mid, and montane regions based on altitude. The dry zone, in which most of the land area of Sri Lanka occurs, is spread over much of the lowland plains and is subjected to several months of drought (MOE 2010, pp. 21-22) (Fig. 2). Most of the rain in this zone comes from the northeast monsoon and inter-monsoonal rains (MOE 2010, pp. 21-22; Malgrem 2003, p. 1236). Characteristic forest types occur within each of the different climate zones.

Each of the five species addressed in this finding is endemic to Sri Lanka and has a range restricted to a particular region and one or two of Sri Lanka's climate zones (Nanayakkara 2014a, pp. 84-85) (Fig. 1, Fig. 2). Due to their secretive and nocturnal habits, sensitivity to vibrations, and their occurrence in structurally complex habitat (forest), Poecilotheria species are difficult to detect (Molur et al. 2003, unpaginated). Therefore, reported ranges are possibly smaller than the actual ranges of these species. However, surveys for these species were conducted at many locations throughout the country during 2009-2012 by Nanayakkara et al. (2012, entire), and we consider the locations reported in Nanayakkara (2014a, entire) to reflect the best available information concerning the ranges of these species.

Historical ranges for the five species addressed in this rule are unknown. Further, information on species abundance or population dynamics is not available on any of the five species; therefore, population trends are unknown. However, based upon the multitude of threats acting on these species, especially extensive and ongoing habitat loss and degradation, experts believe populations are declining, and that these species are very likely to go extinct within the next two or three decades (Nanayakkara and Adikaram 2013, p. 54). We are not aware of any existing conservation programs for these species. All five species are categorized on the National Red List of Sri Lanka as Endangered or Critically Endangered based on their area of occupancy (Critically Endangered: less than 10 km 2; Endangered: less than 500 km 2) and distribution (Critically Endangered: severely fragmented or known to exist at only a single location; Endangered: severely fragmented or known to exist at no more than five locations), and the status (continuing decline, observed, inferred or projected, in the area, extent, or quality, or any combination of the three) of their habitat (MOE 2012, p. 55; IUCN 2001, entire).

For locations discussed in species-specific information below, see Fig. 1. For locations of the ranges of the different species, see Fig. 2.

Poecilotheria fasciata occurs in forests below 200-m elevation in Sri Lanka's dry and intermediate zones north of Colombo and is also sometimes found in coconut plantations in this region (Nanayakkara 2014a, p. 96; Nanayakkara 2014b, unpublished data; Smith et al. 2001, entire). The species has a broad but patchy distribution and is estimated to occupy less than 500 km2 (193 mi2) of its range (MOE 2012, p. 55; Smith et al. 2001, p. 48). The area, extent, or quality (or a combination thereof) of P. fasciata's habitat is in continuing decline, and the species is categorized on the National Red List of Sri Lanka as Endangered (MOE 2012, p. 55).

The only detailed record of the species' occurrence is provided by Smith et al. (2001, entire), where Poecilotheria fasciata colonized a coconut plantation following a prolonged drought. While P. fasciata in dry and intermediate zone forests, including those surrounding the coconut plantation, were found to be emaciated and without spiderlings, those in the irrigated plantation were found to have spiderlings in their retreats and wider abdomens. Smith et al. argue that P. fasciata was able to colonize the plantation due to the occurrence of P. fasciata in the adjacent remnant forest, the presence of coconut trees that were infested with weevils and subsequently fed on by woodpeckers that created holes suitable for P. fasciata retreats, and plantation irrigation that resulted in an abundant prey base for the species. The P. fasciata population in the plantation was apparently established in the 1980s and persisted until at least 2000 (Smith et al. 2001, pp. 49, 52).

During recent surveys, P. fasciata were detected at nine locations—two in coconut plantations and seven in forest locations. Greater than 20 adults and 100 juveniles were found in coconut plantations, and greater than 30 adults and no juveniles were found in forest locations (Nanayakkara 2014b, unpublished data). Although no juveniles were detected in forest habitats during these surveys, recent observations of P. fasciata juveniles in forest habitat have been reported (Nanayakkara 2014a, p. 96; Kumarasinghe et al. 2013, p. 10). Therefore, based on the observations of Smith et al. described above, it is possible that the lack of juveniles detected in forests during recent surveys was due to drought conditions during the survey period. As indicated above, island-wide surveys for Poecilotheria were conducted during 2009-2012, and droughts occurred in 2010 and 2012 in the region in which P. fasciata occurs (Integrated Regional Information Network 2012, unpaginated; Disaster Management Center, Sri Lanka 2010, p. 12). However, while juveniles were detected only in coconut plantations during these surveys, numbers found in coconut and forest habitat cannot be directly compared because surveys were designed for determining distribution rather than species abundance or density. For instance, juveniles may be more difficult to detect in forest habitat than in coconut plantations, or a greater area of coconut plantations may have been searched compared to forest habitat.

Poecilotheria ornata is found in the plains and hills of the lowland wet zone in southwestern Sri Lanka (Nanayakkara 2014a, pp. 112-113; Smith et al. 2002, p. 90). It is one of the few solitary species in the genus (Nanayakkara 2014a, p. 112). In recent surveys, 23 adults and no juveniles were detected at 4 locations (Nanayakkara 2014b, unpublished data). Poecilotheria ornata is estimated to occupy less than 500 km2 (193 mi2) of its range (MOE 2012, p. 55), and the area, extent, or quality (or a combination thereof) of the species' habitat is in continuing decline. Poecilotheria ornata is categorized on the National Red List of Sri Lanka as Endangered (MOE 2012, p. 55).

Poecilotherai smithi is found in the central highlands, in Kandy and Matale districts (Nanayakkara et al. 2013, pp. 73-74). It was originally found in the wet zone at mid elevations (Kirk 1996, p. 23), although it is described as a montane species (Jacobi 2005, entire; Smith et al. 2002, p. 92). Poecilotheria smithi appears to be very rare (Nanayakkara et al. 2013, p. 73; Gabriel et al. 2005, p. 4) and is considered “highly threatened” (Nanayakkara et al. 2013, p. 73). The species was described in 1996, and, despite several efforts to locate the species during the past 20 years, few individuals have been found (Nanayakkara et al. 2013, pp. 73-74; Gabriel et al. 2005, pp. 6-7). In 2005, three adult females and four spiderlings were reported in the Haragama, Kandy district, an area described as severely impacted by several anthropogenic factors (Nanayakkara et al. 2013, p. 74; Gabriel et al. 2005, pp. 6-7). During surveys conducted in several areas of the country during 2003-2005, no P. smithi were found (Samarawckrama et al. 2005, entire). Finally, during recent surveys, the species was found at two locations with seven adults and nine juveniles detected (Nanayakkara 2014b, unpublished data). Prior to these recent surveys, the species was known only from the Haragama, Kandy district. However, the species was recently found about 31 km (19.3 mi) away from Haragama, in three trees within a 5-km2 (1.9-mi2) area of highly disturbed habitat (Nanayakkara et al. 2013, p. 74).

Poecilotheria smithi was estimated to occupy less than 10 km2 (3.9 mi2) of its range (MOE 2012, p. 55) but a recently reported location in Matale district increases the known area of occupancy by 5 km2 (1.9 mi2). The area, extent, or quality (or a combination thereof) of the species' habitat is considered to be in continuing decline, and the species is categorized on the National Red List of Sri Lanka as Critically Endangered (MOE 2012, p. 55).

Poecilotheria subfusca occurs in the wet zone of the central highlands of Sri Lanka, in two disjunct regions: the montane region above 1,500-m elevation in Nuwara Eliya and Badulla districts; and at 500 to 600 m (1,640 to 1,968 ft) elevation in Kegalla, Kandy, and Matale districts (Nanayakkara 2014a, pp. 101-102, 116; Smith et al. 2002, entire).

During recent surveys, P. subfusca was found at 10 locations, and a total of 25 adult and 56 juvenile P. subfusca were detected (Nanayakkara 2014b, unpublished data). The area of the range occupied by P. subfusca is less than 500 km2 (193 mi2) (MOE 2012, p. 55). Further, the area, extent, or quality (or a combination thereof) of P. subfusca's habitat is in continuing decline throughout its range, and the species is categorized on the National Red List of Sri Lanka as Endangered (MOE 2012, p. 55).

Poecilotheria vittata occurs in the arid, dry, and intermediate zones of Hambantota and Monaragala districts in southeastern Sri Lanka (Kekulandala and Goonatilake 2015, unpaginated; Nanayakkara 2014a, pp. 106-107). The species' preferred habitat is Manilkara hexandra (Palu) trees (Nanayakkara 2014a, p. 106), a dominant canopy tree species in Sri Lanka's dry forest (Gunarathne and Perera 2014, p. 15). In recent surveys, the species was found at 4 locations, and 15 adults and 7 juveniles of P. vittata were detected (Nanayakkara 2014b, unpublished data). Poecilotheria vittata is estimated to occupy less than 500 km2 (193 mi2) of its range (MOE 2012, p. 55), and the area, extent, or quality (or a combination thereof) of the species' habitat is considered to be in continuing decline. Poecilotheria vittata is categorized on the National Red List of Sri Lanka as Endangered (MOE 2012, p. 55).

The Act directs us to determine whether any species is an endangered species or a threatened species because of any one or more of five factors or the cumulative effects thereof: (A) The present or threatened destruction, modification, or curtailment of its habitat or range; (B) Overutilization for commercial, recreational, scientific, or educational purposes; (C) Disease or predation; (D) The inadequacy of existing regulatory mechanisms; or (E) Other natural or manmade factors affecting its continued existence. In this section, we summarize the biological condition of the species and its resources, and the influences on these to assess the species' overall viability and the risks to that viability.

Habitat loss and degradation are considered primary factors negatively affecting Poecilotheria species (Nanayakkara and Adikaram 2013, pp. 53-54; MOE 2012, p. 55; Molur et al. 2008, pp. 1-2). Forest loss and degradation are likely to negatively impact the five species addressed in this rule in several ways. First, forest loss and degradation directly eliminate or reduce the availability of trees required by Poecilotheria species for reproduction, foraging, and protection (Samarawckrama et al. 2005, p. 76; Smith et al. 2002, entire). Second, due to the limited ability of Poecilotheria species to travel, as well as their sedentary habits, forest loss and degradation are also likely to result in direct mortality of individuals or populations, via physical trauma caused by the activities that result in forest loss and degradation, or the intentional killing of these spiders when they are encountered by humans during these activities (see Intentional Killing). Such mortality affects these species' abundances and distributions, and also their genetic diversity. Tarantulas have highly structured populations (See Tarantula General Biology) and, consequently, the loss of a local population of a species—due to habitat loss or any other factor—equates to a loss of unique genetic diversity (Bond et al. 2006, p. 154, citing several sources). Finally, the loss of forest also often results in fragmented habitat. Due to the limited dispersal ability of these species, forest fragmentation is likely to isolate Poecilotheria populations, which increases their vulnerability to stochastic processes (see Stochastic Processes), and may also expose wandering males and dispersing juveniles to increased mortality from intentional killing or predation when they attempt to cross between forest fragments (Bond et al. 2006, p. 155) (see Intentional Killing).

Forests covered almost the entire island of Sri Lanka a few centuries ago (Mattsson et al. 2012, p. 31). However, extensive deforestation occurred during the British colonial period (1815-1948) as a result of forest-clearing for establishment of plantation crops such as tea and coffee, and also exploitation for timber, slash-and-burn agriculture (a method of agriculture in which natural vegetation is cut down and burned to clear the land for planting), and land settlement. In 1884, about midway through the British colonial period, closed-canopy (dense) forest covered 84 percent of the country and was reduced to 44 percent by 1956 (GOSL 2012, p. 2a-3-145; Nanayakkara 1996, in Mattson et al. 2012, p. 31). Deforestation continued after independence as the result of timber extraction, slash-and-burn agriculture, human settlements, national development projects, and encroachment (GOSL 2012, pp. 2a-3-144-145; Perera et al. 2012, p. 165). As a result, dense forest cover (canopy density greater than 70 percent) declined by half in about 50 years, to 22 percent in 2010 (GOSL 2012, pp. 51, 2a-3-145; Nanayakkara 1996, in Mattson et al. 2012, p. 31). Open-canopy forest (canopy density less than 70 percent) covered an additional 6.8 percent of the country in 2010 for an overall forest cover of 28.6 percent (GOSL 2012, p. 51).

The extent of deforestation differed in the three climate zones of the country. The impacts of anthropogenic factors on forests in the wetter regions of the island have been more extensive due to the higher density of the human population in these regions. The human population density in the wet zone is 650 people per km2 (1,684 per mi2) compared to 170 people per km2 (440 per km2) in the dry zone and 329 per km2 (852 per mi2) nationally (GOSL 2012, p. 8). Currently about 13 percent of the wet zone, 15 percent of the intermediate zone, and 29 percent of the dry zone are densely forested (Table 1).

Recent information on forest cover in the different climate zones is provided in three reports (GOSL 2015, GOSL 2012, and FAO 2015a), all of which provide information from the Forest Department of Sri Lanka. One report (GOSL 2015) provides a map of the change in forest cover between 1992 and 2010 and a qualitative assessment of these changes. The others (GOSL 2012 and FAO 2015a) provide quantitative information on the area of forest cover by forest type for 1992, 1999, and 2010. These latter two reports differ slightly in their presentation of information but contain identical data on natural forest cover. However, the Forest Department of Sri Lanka used different rainfall criteria to separate dry and intermediate zone forests, and different altitude criteria to separate montane and submontane forests, in different years (see climate zone and forest definitions in FAO 2015a, p. 6; GOSL 2012, p. 51; FAO 2005, p. 7; FAO 2001, pp. 16, 53). Therefore, we combined the information on intermediate and dry zone forests, and the information on montane and submontane forests (see 81 FR 90307, Table 4). We discuss the information on forest cover from the various sources by climate zone below.

Wet zone forests in Sri Lanka are categorized as montane, submontane, or lowland forest, based on elevation. Very little wet zone forest remains in Sri Lanka. Currently, montane and submontane forests combined covers only about 733 km2 (283 mi2) and is severely fragmented (GOSL 2012, pp. 51, 2a-3-142). The area remained relatively stable from 1992 to 2010 (81 FR 90307; GOSL 2012, p. 51). More recent evidence indicates these forests are currently declining: firewood collection, cutting of trees for other domestic purposes, and gem mining are ongoing in these forests, and large areas were recently illegally cleared for vegetable cultivation (Wijesundara 2012, p. 182). While these forests are protected in Sri Lanka, administering agencies do not have sufficient resources to prevent these activities (Wijesundara 2012, p. 182).

The area of lowland wet zone forests (lowland rainforest) declined from 1992 to 2010. Remaining lowland rainforests are severely fragmented, exist primarily as small, isolated patches, and declined by 13% (183 km2)(71 mi2)) during the 18-year period, though the rate of loss slowed considerably during the latter half of this period (81 FR 90307, Table 4; GOSL 2012, p. 2a-3-142; Lindstrom et al. 2012, p. 681). Changes in forest cover show low levels of deforestation throughout the lowland rainforest region from 1992 to 2010, and a deforestation “hotspot” on the border of Kalutara and Ratnapura districts, which is within the range of P. ornata (Fig. 1, Fig. 2) (GOSL 2015, unpaginated).

Dry and intermediate zone forests, which include most open-canopy forest (Mattsson et al. 2012, p. 30), declined by 8% (1,372 km2 (530 mi2)) between 1992 and 2010 (81 FR 90307, Table 4). The rate of deforestation nationwide during this period was highest in Anuradhapura and Moneragala districts, in which large portions of the ranges of P. fasciata and P. vittata occur (see Fig. 1, Fig. 2) (GOSL 2015, unpaginated). Further, deforestation hotspots have been found in other districts where these species occur, including Puttalam and Hambantota (GOSL 2015, unpaginated). Natural regeneration of dry forest species is poor, and dry zone forests are heavily degraded as a result of activities such as frequent shifting cultivation and timber logging (Perera 2012, p. 165, citing several sources).

Sri Lanka has taken steps in recent decades to conserve its forests, and these efforts have contributed to the slowing of deforestation in the country (GOSL 2012, pp. 54-55). In 1990, the country imposed a moratorium on logging in all natural forests, marked most reserve boundaries to stem encroachments, and implemented management plans for forest and wildlife reserves, which became legal requirements under the Forest Ordinance Amendment Act No. 65 of 2009 and the Fauna and Flora Ordinance Amendment Act No. 22 of 2009 (GOSL 2014, p. 26). The government also encourages community participation in forest and protected area management, has implemented programs to engage residents in community forestry to reduce encroachment of cash crops and tea in the wet zone and slash-and-burn agriculture in the dry zone, and encourages use of non-forest lands and private woodlots for meeting the demands for wood and wood products (GOSL 2014, p. 26). In addition to these efforts, between 12 percent (GOSL 2015, unpaginated) and 28 percent (GOSL 2014, pp. xvi, 23) of the country's land area is reported to be under protected area status.

Although considerable efforts have been undertaken in Sri Lanka in recent years to stop deforestation and forest degradation, these processes are ongoing (see Current and Future Forest Trends). The assessment of the status of natural forests during the Species Red List assessments in 2012 indicate that, despite advances in forest conservation in the country, many existing threats continue to impact forest habitats (GOSL 2014, p. 26). While laws and regulations are in place to address deforestation, several factors inhibit their implementation (GOSL 2012, pp. 55, 2a-3-148-150). For instance, lack of financial assistance for protected area management, increasing demand for land, and unplanned, after-the-fact legalization of land encroachments, result in further loss of the forest habitat of the five species addressed in this finding (GOSL 2014, p. 22; GOSL 2011, unpaginated). Also, government agencies have poor coordination with respect to forest conservation—conservation agencies are not always adequately consulted on initiatives to develop forested land (GOSL 2014, p. 22; MOE 2010, p. 31). Finally, many protected areas within the wet zone are small, degraded, and isolated (GOSL 2014, p. 31).

The current drivers of deforestation and forest degradation in Sri Lanka include a variety of factors such as small-scale encroachments, illicit timber harvesting, forest fires, destructive mining practices, and clearing of forest for developments, settlements, and agriculture (GOSL 2012, p. 12). These stressors are exacerbated by a large, dense human population that is projected to increase from 20.7 million in 2015 to 21.5 million in 2030 (United Nations 2015, p. 22). While the majority of remaining forested areas are protected, further population growth is likely to result in reduction of forested areas because (1) Sri Lanka already has a very high human density (329 people per km2 (852 per mi2)), (2) increases in the population will elevate an already high demand for land, and (3) little non-forested land is available for expansion of housing, development, cash crops, or subsistence agriculture (GOSL 2012, pp. 8, 14, 58). Most (72%) of the population of Sri Lanka is rural, dependence on agriculture for subsistence is widespread, and the rate of population growth is higher in rural areas. This results in an increasing demand in the country for land for subsistence (Lindstrom et al. 2012, p. 680; GOSL 2011, unpaginated).

The current drivers of deforestation and forest degradation are exacerbated by high economic returns from illicit land conversions, lack of alternative livelihood opportunities for those practicing slash-and-burn agriculture and, in the dry zone, poverty and the weak implementation of land-use policy (GOSL 2012, pp. 14-15). Further, in the 30 years prior to 2009, Sri Lanka was engaged in a civil war, which was fought primarily in the dry zone of the northern and eastern regions of the country, many areas of which were inaccessible. The war, along with a reduced rate of development in the country as a whole during this period, may have helped limit deforestation rates (GOSL 2012, pp. 48, 56-57).

Overall, deforestation and forest degradation in Sri Lanka are ongoing, although recent rates of deforestation are much lower than during the mid- to late-20th century—the rate of deforestation during 1992-2010 was 71 km2 (27.4 mi2) per year, compared to 400 km2 (154 mi2) per year during 1956-1992 (GOSL 2015, unpaginated). However, since the end of Sri Lanka's civil war in 2009, the government has been implementing an extensive 10-year development plan with the goal of transforming the country into a global economic and industrial hub (Buthpitiya 2013, p. ii; Central Bank of Sri Lanka 2012, p. 67; Ministry of Finance and Planning-Sri Lanka (MOFP) 2010, entire). The plan includes large infrastructure projects throughout the country (MOFP 2010, entire). Projects include, among other things, development of seaports, airports, expressways, railways, industrial parks, power plants, and water management systems that will allow for planned expansion of agriculture, and many of these projects have already started (Buthpitiya 2013, pp. 5-6; Central Bank of Sri Lanka 2012, p. 67; MOFP 2010, entire). They also include projects located within the ranges of all five species addressed in this finding, although the plan does not provide the amount of area that will be impacted by these projects (Fig. 2 and MOFP 2010, pp. 63, 93, 101, 202-298). For example, a new dam project within the range of P. smithi will submerge one of the two sites at which the species is found (Nanayakkara 2017, unpaginated). The rate of loss of natural forest (primary forest and other naturally regenerated forest) increased from 60 km2 (23 mi2) per year during 2000-2010 to 86 km2 (33 mi2) per year during 2010-2015 (FAO 2015b, pp. 44, 50). As post-war reconstruction and development continues in Sri Lanka, deforestation and forest degradation can be expected to rise (GOSL 2012, p. 2a-3-146).

Coconut is grown throughout Sri Lanka. Most (57 percent) of the area under coconut cultivation is in the intermediate and wet zones north of Colombo (MOE 2011, p. 14), which overlaps with the southern portion of the range of P. fasciata. As indicated above, P. fasciata are sometimes found in coconut plantations in Sri Lanka, although the extent to which coconut plantations contribute to sustaining viable populations of these species is unknown. The ability of coconut plantations to contribute to conservation of P. fasciata is limited because: (1) Tarantulas are poor dispersers (see Tarantula General Biology); (2) colonization of coconut plantations by the species appears to depend on the occurrence of occupied natural forest in relatively close proximity to coconut plantations (Smith et al. 2001, entire); and (3) very little natural forest remains in the coconut-growing region in which P. fasciata occurs (Fig. 2 and GOSL 2015, unpaginated; MOE 2014, p. 94).

The aerial extent of coconut cultivation in Sri Lanka has varied between about 3,630 and 4,200 km2 (1,402 and 1,622 mi2) since 2005 (Central Bank of Sri Lanka 2014, Statistical Appendix, Table 13), with no clear directional trend. However, due to the rising human population and resulting escalating demand for land in Sri Lanka, plantations have become increasingly fragmented due to conversion of these lands to housing (GOSL 2014, pp. 26-27). As indicated above, due to their limited dispersal ability, forest fragmentation is likely to isolate Poecilotheria populations, which increases their vulnerability to stochastic processes (see Stochastic Processes), and may also expose wandering males and dispersing juveniles to increased mortality from intentional killing or predation when they attempt to cross between forest fragments (Bond et al. 2006, p. 155) (see Intentional Killing). Thus, even though P. fasciata uses coconut plantations to some extent, fragmentation of this habitat is likely to isolate populations and increase their vulnerability to stochastic processes, intentional killing, and predation.

Sri Lanka has lost most of its forest cover due to a variety of factors over the past several decades. Very little (1,966 km2 (759 mi2)) wet zone forest—in which the ranges of P. ornata, P. smithi, and P. subfusca occur—remains in the country. The remainder is highly fragmented and continues to be deforested. Only about 35 percent (16,872 km2 (6,514 mi2)) of dense and open canopy dry and intermediate zone forests—in which the ranges of P. fasciata and P. vittata occur—remain, deforestation in these forests is ongoing, and recent rates of deforestation in the country have been highest in regions constituting large portions of the ranges of these two species. Forest cover continues to decline at a rate of 86 km2 (33 mi2) per year, and the rate of loss is higher in the dry zone than the wet zone. While the current rate of forest loss is much lower than in the previous century, the rate of loss of natural forest is increasing and is anticipated to increase in the future with the country's emphasis on development and the projected population increase of 800,000 people. While coconut plantations provide additional habitat for one species (P. fasciata) in some areas, these plantations are becoming increasingly fragmented due to demand for housing.

Tarantulas have sedentary habits, limited dispersal ability, and highly structured populations. Therefore, loss of habitat has likely resulted in direct loss of individuals or populations and, consequently, a reduction in the distribution and genetic diversity of these species. The distribution of these species is already limited—each currently occupies less than 500 km2 (193 mi2) or, for P. smithi, less than 10 to 15 km2 (3.9 to 5.8 mi2) of its range—and deforestation continues within the ranges of all five species discussed in this finding. Further, the limited distribution of these species is likely continuing to decline with ongoing loss of habitat. We conclude that habitat loss is likely currently having significant negative impacts on the viability of these species because: (1) These species have very small distributions; (2) little forest remains in Sri Lanka; (3) remaining habitat is fragmented; and (4) deforestation is ongoing within these species' ranges.

Pesticides are identified as a threat to Poecilotheria species in Sri Lanka (Nanayakkara 2014b, unpublished data; Gabriel 2014, unpaginated). The five species addressed in this finding could potentially be exposed to pesticides via pesticide drift into forests that are adjacent to crop-growing areas; by traveling over pesticide-treated land when dispersing between forest patches; or by consuming prey that have been exposed to pesticides. Populations of these species could potentially be directly affected by pesticides through increased mortality or through sublethal effects such as reduced fecundity, fertility, and offspring viability, and changes in sex ratio, behavior, and dispersal (Nash et al. 2010, p. 1694, citing several sources). Poecilotheria species may also be indirectly affected by pesticides if pesticides reduce or deplete available prey species.

Over 100 pesticide (herbicide, fungicide, and insecticide) active ingredients are registered for use in Sri Lanka. Among the most commonly used insecticides are carbofuran, diazinon, and chloropyrifos (Padmajani et al. 2014, pp. 11-12). These are broad-spectrum, neurotoxic insecticides, which tend to have very negative effects on nontarget organisms (Pekar 2013, p. 415). Further, sit-and-wait predators appear to be more sensitive to insecticide applications than web-making spiders (Pekar 1999, p. 1077).

The use of pesticides in Sri Lanka has been increasing steadily since the 1950s (Selvarajah and Thiruchelvam 2007, p. 381). Pesticide imports into Sri Lanka increased by 50 percent in 2011 compared to 2006 (Padmajani et al. 2014, p. 11). The level of misuse and overuse of pesticides in Sri Lanka is high. Depending on region and crop species, 33 to 60 percent of Sri Lankan farmers use greater amounts, higher concentrations, or more frequent applications of pesticides (or a combination of these) than is recommended (Padmajani et al. 2014, pp. 13, 31, citing several sources).

The susceptibility of spiders to the direct effects of different pesticides varies with pesticide type and formulation, spider species, development stage, sex, and abiotic and biotic conditions at the time of pesticide application (Pekar 2013, pp. 416-417). Further, different classes of pesticides can cause different sublethal effects. For instance, activities such as movement, prey capture, reproduction, development, and defense are particularly disrupted by neurotoxic formulations because they are governed by complex neural interactions. However, spiders can potentially recover from sublethal effects over several days (Pekar 2013, p. 417), although the effects are complicated by the potential for cumulative effects of multiple applications across a season (Nash et al. 2010, p. 1694).

We are not aware of any information on the population-level effects of pesticides on Poecilotheria species. However, given the large proportion of Sri Lanka's human population that is reliant on farming, the high level of misuse and overuse of pesticides in the country, and the broad-spectrum and high level of toxicity of the insecticides commonly used in the country, it is likely that the species addressed in this finding are directly or indirectly negatively affected by pesticides to some extent. Therefore, while the population-level effects of pesticides on the five species addressed in this finding are uncertain, the effects of pesticides likely exacerbate the effects of other threats acting on these species.

The Intergovernmental Panel on Climate Change (IPCC) concluded that warming of the climate system is unequivocal (IPCC 2013, p. 4). Numerous long-term climate changes have been observed including changes in land surface temperatures, precipitation patterns, ocean temperature and salinity, sea ice extent, and sea level (IPCC 2013, pp. 4-12). Various types of changes in climate can have direct or indirect effects on species. These effects may be positive, neutral, or negative and they may change over time, depending on the species and other relevant considerations, such as the effects of interactions of climate with other variables (e.g., habitat fragmentation) (IPCC 2007, pp. 8-14, 18-19). However, a large fraction of terrestrial and freshwater species face increased extinction risk under projected climate change during and beyond the current century, especially as climate change interacts with habitat modification and other factors such as overexploitation, pollution, and invasive species (Settele et al. 2014, p. 275).

Maintenance of body temperature and water retention by spiders is critical to their survival. All spiders, including Poecilotheria, are ectotherms; therefore, their body temperature varies with that of their environment. While spiders keep body temperature within tolerable limits through behaviors such as moving into shade when temperatures rise (Pulz 1987, pp. 27, 34-35), they are susceptible to rapid fluctuations in body temperature and severe depletion of body water stores due to their relatively low body mass and high surface-to-volume ratio (Pulz 1987, p. 27).

Tropical ectotherms evolved in an environment of relatively low inter- and intra-annual climate variability, and already live near their upper thermal limits (Settele et al. 2014, p. 301; Deutsch et al. 2008, p. 6669). Their capacity to acclimate is generally low. They have small thermal safety margins, and small amounts of warming may decrease their ability to perform basic physiological functions such as development, growth, and reproduction (Deutsch et al. 2008, pp. 6668-6669, 6671). Evidence also indicates they may have low potential to increase their resistance to desiccation (drying out) (Schilthuizen and Kellerman 2014, p. 61, citing several sources).

The general trend in temperature in Sri Lanka over the past several decades is that of increasing temperature, although with considerable variation between locations in rates and magnitudes of change (De Costa 2008, p. 87; De Silva et al. 2007, p. 21, citing several sources). Over the six to ten decades prior to 2007, temperatures have increased within all climate zones of the country, although rates of increase vary from 0.065 °C (0.117 °F) per decade in Ratnapura (an increase of 0.65 °C (1.17 °F) during the 97-year period analyzed) in the lowland wet zone, to 0.195 °C (0.351 °F) per decade in Anuradhapura (an increase of 1.50 °C (2.70 °F) during the 77-year period analyzed) in the dry zone. In the montane region, temperatures increased at a rate of 0.141 °C (0.254 °F) per decade at Nuwara Eliya to 0.191 °C (0.344 °F) per decade at Badulla (increases of 1.09 and 1.47 °C (1.96 and 2.65 °F) during the 77-year period analyzed, respectively) (De Costa 2008, p. 68). The rate of warming has increased in more recent years—overall temperature in the country increased at a rate of 0.003 °C (0.005 °F) per year during 1896-1996, 0.016 °C (0.029 °F) per year during 1961-1990, and 0.025 °C (0.045 °F) per year during 1987-1996 (Eriyagama et al. 2010, p. 2, citing several sources). Depending on future climate scenarios, temperatures are projected to increase by 2.93 to 5.44 °C (5.27 to 9.49 °F) by the end of the current century in South Asia (Cruz et al. 2007, in Eriyagama et al. 2010, p. 6). Downscaled projections for Sri Lanka using regional climate models report increases of 2.0 to 4.0 °C (3.6 to 7.2 °F) by 2100, while statistical downscaling of global climate models report increases of 0.9 to 3 °C (1.62 to 5.4 °F) by 2100 and 1.2 to 1.3 °C (2.16 to 2.34 °F) by 2050 (Eriyagama et al. 2010, p. 6, citing several sources).

Trends in rainfall have been decreasing in Sri Lanka over the past several decades (see De Costa 2008, p. 87; De Silva et al. 2007, p. 21, citing several sources) although, according to the Climate Change Secretariat of Sri Lanka (2015, p. 19), there is no consensus on this fact. However, authors appear to agree that the intensity and frequency of extreme events such as droughts and floods have increased (Imbulana et al. 2016 and Ratnayake and Herath 2005, in Climate Change Secretariat of Sri Lanka 2015, p. 19).

Rainfall in Sri Lanka is highly variable from year to year, across seasons and across locations within any given year (Jayatillake et al. 2005, p. 70). Statistically significant declines in rainfall have been observed for the period 1869-2007 at Anuradhapura in the northern dry zone (12.92 mm (0.51 in) per decade), and Badulla, Kandy, and Nuwara Eliya (19.16, 30.50, and 51.60 mm (0.75, 1.20, and 2.03 in) per decade, respectively) in the central highlands (De Costa 2008, p. 77). Significant declines have also been observed in more recent decades at Kurunegala in western Sri Lanka's intermediate zone (120.57 mm (4.75 in) per decade during 1970-2007) and Ratnapura (41.02 mm (1.61 in) per decade during 1920-2007) (De Costa 2008, p. 77). Further, a significant trend of decreasing rainfall with increasing temperature exists at Anuradhapura, Kurunegala, and Nuwara Eliya (De Costa 2008, pp. 79-81). Patterns of future rainfall in the country are highly uncertain—studies provide variable and conflicting projections (Eriyagama et al. p. 6, citing several sources). However, an increased frequency of dry periods and droughts are expected (MOE 2010, p. 35).

While observed and projected changes in temperature and precipitation could potentially be within the tolerance limits of the Poecilotheria species addressed in this finding, it is possible that climate change could directly negatively affect these species through rising land surface temperatures, changes in the amount and pattern of precipitation, and increases in the frequency and intensity of extreme climate events such as heat waves or droughts. It is also possible that climate change could indirectly negatively affect these species by adversely impacting populations of their insect prey, which are also tropical ectotherms. The only detailed observations of a Sri Lankan Poecilotheria species indicated that P. fasciata found in natural forest were emaciated and without spiderlings during an extended drought, while those found in an irrigated plantation had wider girths and spiderlings (see Species-Specific Information) (Smith et al. 2001, entire). The lack of reproduction in natural forest during drought may have been due to desiccation stress or lack of available prey, or both, as a result of low moisture levels.

While at least one of the species addressed in this finding (P. fasciata) appears to be vulnerable to drought, the responses of the five Poecilotheria species to observed and projected climate change in Sri Lanka are largely unknown. However, the climate in Sri Lanka has already changed considerably in all climate zones of the country, and continues to change at an increasing rate. These species evolved in specific, relatively stable climates and, because they are tropical ectotherms, may be sensitive to changing environmental conditions, particularly temperature and moisture (Deutsch et al. 2008, pp. 6668-6669; Schilthuizen and Kellerman 2014, pp. 59-61, citing several sources). Moreover, because they have poor dispersal ability, Peocilotheria are unlikely to be able to escape changing climate conditions via range shifts. Therefore, while population-level responses of the five species addressed in this finding to observed and projected changes in climate are not certain, the stress imposed on these species by increasing temperatures and changing patterns of precipitation is likely exacerbating the effects of other factors acting on these species such as stochastic events and habitat loss and degradation. This is especially the case for P. fasciata because (1) the frequency and intensity of droughts have increased and are expected to continue increasing, (2) the species fails to reproduce in natural forest during extended droughts, and (3) although P. fasciata is also known to inhabit irrigated coconut plantations, most populations have been found in natural forest.

Poecilotheria species are popular in trade due to their striking coloration and large size (Nanayakkara 2014a, p. 86; Molur et al. 2006, p. 23). In 2000, concerned about increasing trade in these species, Sri Lanka and the United States co-sponsored a proposal to include the genus in Appendix II of the Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES) (Government of Sri Lanka and Government of the United States 2000, entire). However, at the 11th Conference of the Parties, the proposal was criticized as containing too little information on international trade and on the limits of the distribution of the genus. It was further noted that the genus was primarily threatened by habitat destruction, and was not protected by domestic legislation in India. Also, the delegation of Sri Lanka promised to list the genus in Appendix III if the proposal failed. No consensus was reached on the proposal and a vote failed to achieve the required two-thirds majority—there were 49 votes in favor, 30 against, and 27 abstentions—and the proposal was therefore rejected (Convention on International Trade in Endangered Species of Wild Fauna and Flora 2000, p. 50). None of the five species addressed in this rule are currently listed in the CITES Appendices (Convention on International Trade in Endangered Species of Wild Fauna and Flora 2017, p. 48).

Collection of Poecilotheria specimens from the wild could have significant negative impacts on Poecilotheria populations. Due to the patchy distributions and poor dispersal abilities of tarantulas, collection of several individuals from a single location could potentially reduce the abundance or distribution of a species, especially those with restricted distributions (Molur et al. 2006, p. 14; West et al. 2001, unpaginated). Further, because tarantula populations are highly structured, loss of individuals from a single location could result in significant loss of that species' genetic diversity (Bond 2006, p. 154). Collection of a relatively large number of individuals from a single population could also alter population demographics such that the survival of a species or population is more vulnerable to the effects of other factors, such as habitat loss.

Collection of species from the wild for trade often begins when a new species is described or when a rare species has been rediscovered. Alerted to a new or novel species, collectors arrive at the reported location and set out collecting the species from the wild (Molur et al. 2006, p. 15; Stuart et al. 2006, entire). For tarantulas, adult females may be especially vulnerable to collection pressures as collectors often attempt to capture females, which produce young that can be sold (Capannini 2003, p. 107). Collectors then sell the collected specimens or their offspring to hobbyists who captive-rear the species and provide the pet trade with captive-bred specimens (Gabriel 2014, unpaginated; Molur et al. 2006, p. 16). Thus, more individuals are likely to be captured from the wild during the period in which captive-breeding stocks are being established, in other words, prior to the species becoming broadly available in trade (Gabriel 2014, unpaginated).

All five of the endemic Sri Lankan species addressed in this rule are bred by hobbyists and vendors and are available in the pet trade as captive-bred individuals in the United States, Europe, and elsewhere (see Herndon 2014, pers. comm.; Elowsky 2014, unpaginated; Gabriel 2014, unpaginated; Longhorn 2014a, unpaginated; Longhorn 2014b, unpaginated; Mugleston 2014, unpaginated; Service 2012, in litt.). We are not aware of any information on numbers of these species in domestic trade within the United States or numbers solely in foreign trade outside the United States. The Service's Law Enforcement Management Information System contains information on U.S. international trade in three of these species—P. fasciata, P. ornata, and P. vittata (it does not currently collect information on P. smithi or P. subfusca). Four hundred individuals of these species were legally imported into, or exported or re-exported from, the United States during 2007-2012; 298 were imported into, and 106 were exported or re-exported from, the United States.

Captive-bred individuals appear to supply the majority of the current legal trade in these species in the United States. Of the 400 individuals legally imported into, or exported or re-exported from, the United States during 2007-2012, 392 (98 percent) were declared as captive-bred (Service 2012, in litt.). However, wild individuals of at least some of these species are still being collected (Nanayakkara 2014a, p. 86; Nanayakkara 2014b, unpublished data; Service 2012, in litt.). Two sources indicate that there is evidence of illegal smuggling from Sri Lanka, although they do not provide details (see Nanayakkara 2014, p. 85; Samarawckrama et al. 2005, p. 76). Further, of the 400 individuals of Sri Lankan Poecilotheria imported into, or exported or re-exported from, the United States during 2007-2012, 8 P. vittata were declared as wild-caught. It is possible that additional wild-caught individuals of the five species addressed in this rule were (or are) not included in this total because they are imported into the United States illegally, or imported into other countries. For example, some wild-caught specimens are imported into Europe (Merzlak 2017, unpaginated; Corcoran, 2016, unpaginated), although specific information on this activity is not available.

Sri Lanka prohibits the commercial collection and exportation of all Poecilotheria species, under the Sri Lanka Flora and Fauna Protection (Amendment) Act, No. 22 of 2009, which is part of the Fauna and Flora Protection Ordinance No. 2 (1937) (DLA Piper 2015, p. 392; Government of Sri Lanka and Government of the United States 2000, p. 5). However, enforcement is weak and influenced by corruption (DLA Piper 2015, p. 392; GOSL 2012, p. 2a-3-149).

In sum, individuals of at least some of these species are currently being collected from the wild. However, the extent to which this activity is occurring is unknown, as is the extent to which these species have been, or are being, affected by collection. Based on the available information on U.S. imports, exports, and re-exports, a small amount of trade occurs in wild specimens of these species. However, it is likely that more wild specimens enter Europe or Asia than the United States due to the closer proximity of Sri Lanka to Europe and Asia and consequent increased ease of travel and transport of specimens. Further, even small amounts of collection of species with small populations can have a negative impact on these species. Given that collection of at least some of these species from the wild continues to occur, it is likely that collection for trade is exacerbating population effects of other factors negatively impacting these species, such as stochastic events, habitat loss, and habitat degradation.

Poecilotheria spiders are feared by humans in Sri Lanka and, as a result, are usually killed when encountered (Kekulandala and Goonatilake 2015, unpaginated; Nanayakkara 2014a, p. 86; Gabriel 2014, unpaginated; Smith et al. 2001, p. 49). Intentional killing of Poecilotheria spiders may negatively impact these five species by raising mortality rates in these species' populations to such an extent that populations decline or are more vulnerable to the effects of other factors, such as habitat loss. Adult male Poecilotheria are probably more vulnerable to being intentionally killed because they wander in search of females during the breeding season (see Tarantula General Biology) and thus are more likely to be encountered by people. Consequently, intentional killing could potentially reduce the density of males in an area. Because the mating of a female depends on a male finding her, and males search for females randomly, a reduction in the density of males could result in a reduction in the percent of females laying eggs in any given year (Stradling 1994, p. 96) and, consequently, a lower population growth rate.

We do not have any information on the number of individuals of these five species that are intentionally killed by people. However, in areas where these species occur, higher human densities are likely to result in higher human contact with these species and, consequently, higher numbers of spiders killed. The human population density in Sri Lanka is much higher in the wet zone (see Habitat Loss and Degradation). Therefore, it is likely that P. ornata, P. smithi, and P. subfusca are affected by intentional killing more than P. fasciata and P. vittata. Although we do not have any information indicating the numbers of individuals of these species that are intentionally killed each year, it is likely that such killing is exacerbating the negative effects of other factors on these species' populations, such as habitat loss and degradation.

Species endemic to small regions, or known from few, widely dispersed locations, are inherently more vulnerable to extinction than widespread species because of the higher risks from localized stochastic (random) events and processes, such as floods, fire, landslides, and drought (Brooks et al. 2008, pp. 455-456; Mangel and Tier 1994, entire; Pimm et al. 1988, p. 757). These problems can be further magnified when populations are very small, due to genetic bottlenecks (reduced genetic diversity resulting from fewer individuals contributing to the species' overall gene pool) and random demographic fluctuations (Lande 1988, pp. 1455-1458; Pimm et al. 1988, p. 757). Species with few populations, limited geographic area, and a small number of individuals face an increased likelihood of stochastic extinction due to changes in demography, the environment, genetics, or other factors, in a process described as an extinction vortex (a mutual reinforcement that occurs among biotic and abiotic processes that drives population size downward to extinction) (Gilpin and Soule´ 1986, pp. 24-25). The negative impacts associated with small population size and vulnerability to random demographic fluctuations or natural catastrophes can be further magnified by synergistic interactions with other threats.

P. smithi is known from very few widely dispersed locations and is likely very rare (see Species-Specific Information). Therefore, it is highly likely that P. smithi is extremely vulnerable to stochastic processes and that the species is highly likely negatively impacted by these processes. The remaining four species have narrow ranges within specific climate zones of Sri Lanka. It is unclear whether the range sizes of these four are so small that stochastic processes on their own are likely to have significant negative impacts on these species. However, stochastic processes may have negative impacts on these species in combination with other factors such as habitat loss, because habitat loss can further fragment and isolate populations.

Section 4 of the Act (16 U.S.C. 1533), and its implementing regulations at 50 CFR part 424, set forth the procedures for adding species to the Federal Lists of Endangered and Threatened Wildlife and Plants. Under section 4(a)(1) of the Act, we determine whether a species meets the definition of a “threatened species” or an “endangered species” because of any one or more of the following five threat factors or the cumulative effects thereof: (A) The present or threatened destruction, modification, or curtailment of its habitat or range; (B) Overutilization for commercial, recreational, scientific, or educational purposes; (C) Disease or predation; (D) The inadequacy of existing regulatory mechanisms; or (E) Other natural or manmade factors affecting its continued existence.

We have carefully assessed the best scientific and commercial information available on P. fasciata, P. ornata, P. subfusca, P. smithi, and P. vittata. While information on species abundance or population dynamics is not available on these species, the best available information indicates these species' populations have experienced extensive declines in the past and their populations continue to decline. Tarantulas have limited dispersal ability and sedentary habits; therefore, the loss of habitat (Factor A) likely results in direct loss of individuals or populations and, consequently, a reduction in the distribution of the species. As a result, the extensive loss of forest (71 percent in the dry zone, 85 percent in the intermediate zone, and 87 percent in the wet zone) has reduced the amount of habitat where the species may remain, and their populations will likely continue to decline with ongoing deforestation. Further, because these species likely have highly structured populations, reductions in these species' populations have likely resulted in coincident loss of these species' unique genetic diversities, eroding the adaptive and evolutionary potential of these species (Bond 2006, p. 154).

All five Sri Lankan Poecilotheria species have restricted ranges within specific regions and climates of Sri Lanka and are currently estimated to occupy areas of less than 500 km2 (193 mi2), and less than 10-15 km2 (4-6 mi2) for P. smithi. Due to the life-history traits of tarantulas—restricted range, sedentary habits, poor dispersal ability, and structured populations—these species are vulnerable to habitat loss. Extensive habitat loss (Factor A) has already occurred in all the climate zones in which these species occur, and deforestation is ongoing in the country. Further, the cumulative effects of changing climate, intentional killing, pesticides, capture for the pet trade, and stochastic processes are likely significantly exacerbating the effects of habitat loss.

Therefore, for the following reasons we conclude populations of P. fasciata, P. ornata, P. subfusca, P. smithi, and P. vittata have been and continue to be significantly reduced to the extent that the viability of each of these five species is significantly compromised:

(1) These species are closely tied to their habitats, little of their forest habitat remains, deforestation is ongoing in these habitats, and these species are vulnerable to habitat loss;

(2) these species' have poor dispersal ability, are unlikely to be able to escape changing climate conditions via range shifts, and Sri Lanka's climate is changing at increasing rates;

(3) the cumulative effects of climate change, intentional killing, pesticides, capture for the pet trade, and stochastic processes are likely significantly exacerbating the effects of habitat loss; and

(4) P. smithi is known from few locations, is likely rare, and very likely vulnerable to stochastic processes.

The Act defines an endangered species in section 3(6) of the Act as any species that is “in danger of extinction throughout all or a significant portion of its range” and a threatened species in section 3(20) of the Act as any species that is “likely to become an endangered species within the foreseeable future throughout all or a significant portion of its range.”

Based on the factors described above and their impacts on P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata, we find the following factors to be threats to these species (i.e., factors contributing to the risk of extinction of these species): Loss of habitat (Factor A; all five species), stochastic processes (Factor E; P. smithi), and the cumulative effects (Factor E; all five species) of these and other threats including climate change, intentional killing, pesticide use, and capture for the pet trade. Furthermore, despite laws in place to protect these five species and the forest and other habitat they depend on, these threats continue (Factor D), in part due to lack of resources and challenges to enforcement. We consider the risk of extinction of these five species to be high because these species are vulnerable to habitat loss, this process is ongoing, and these species have limited potential to recolonize reforested areas or move to more favorable climate. We find that P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata are presently in danger of extinction throughout their ranges based on the likely severity and immediacy of threats currently impacting these species, and we are listing these five tarantula species as endangered in accordance with sections 3(6) and 4(a)(1) of the Act. We find that a threatened species status is not appropriate for these species because of their restricted ranges, limited distributions, and vulnerability to extinction and because the threats are ongoing throughout their ranges at a level that places these species in danger of extinction now, even without the worsening of the threats, that, as discussed above, is likely.

Under the Act and our implementing regulations, a species may warrant listing if it is endangered or threatened throughout all or a significant portion of its range. Because we have determined that P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata are endangered throughout all of their ranges, we do not need to conduct an analysis of whether there is any significant portion of their ranges where these species are in danger of extinction or likely to become so in the foreseeable future. This is consistent with the Act because when we find that a species is currently in danger of extinction throughout all of its range (i.e., meets the definition of an endangered species), the species is experiencing high-magnitude threats across its range or threats are so high in particular areas that they severely affect the species across its range. Therefore, the species is in danger of extinction throughout every portion of its range and an analysis of whether there is any significant portion of the range that may be in danger of extinction or likely to become so would not result in a different outcome.

Conservation measures provided to species listed as endangered or threatened under the Act include recognition of conservation status, requirements for Federal protection, and prohibitions against certain practices. Recognition through listing encourages and results in public awareness and conservation actions by Federal and State governments in the United States, foreign governments, private agencies and groups, and individuals.

Section 7(a) of the Act, as amended, and as implemented by regulations at 50 CFR part 402, requires Federal agencies to evaluate their actions that are to be conducted within the United States or upon the high seas, with respect to any species that is listed as an endangered or threatened species. Because P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata are not native to the United States, no critical habitat is being designated with this rule. Regulations implementing the interagency cooperation provision of the Act are codified at 50 CFR part 402. Section 7(a)(2) of the Act requires Federal agencies to ensure that activities they authorize, fund, or carry out are not likely to jeopardize the continued existence of a listed species or to destroy or adversely modify its critical habitat. If a proposed Federal action may adversely affect a listed species, the responsible Federal agency must enter into formal consultation with the Service. Currently, with respect to P. fasciata, P. ornata, P. smithi, P. subfusca, and P. vittata, no Federal activities are known that would require consultation.

Section 8(a) of the Act authorizes the provision of limited financial assistance for the development and management of programs that the Secretary of the Interior determines to be necessary or useful for the conservation of endangered or threatened species in foreign countries. Sections 8(b) and 8(c) of the Act authorize the Secretary to encourage conservation programs for foreign listed species, and to provide assistance for such programs, in the form of personnel and the training of personnel.

Section 9 of the Act and our implementing regulations at 50 CFR 17.21 set forth a series of general prohibitions that apply to all endangered wildlife. These prohibitions, in part, make it illegal for any person subject to the jurisdiction of the United States to “take” (which includes harass, harm, pursue, hunt, shoot, wound, kill, trap, capture, or collect; or to attempt any of these) endangered wildlife within the United States or upon the high seas. It is also illegal to possess, sell, deliver, carry, transport, or ship any such wildlife that has been taken illegally. In addition, it is illegal for any person subject to the jurisdiction of the United States to import; export; deliver, receive, carry, transport, or ship in interstate or foreign commerce, by any means whatsoever and in the course of commercial activity; or sell or offer for sale in interstate or foreign commerce any listed species. Certain exceptions apply to employees of the Service, the National Marine Fisheries Service, other Federal land management agencies, and State conservation agencies.

We may issue permits to carry out otherwise prohibited activities involving endangered wildlife under certain circumstances. No permit is required for activities that do not constitute prohibited acts. Regulations governing permits for endangered species are codified at 50 CFR 17.22. With regard to endangered wildlife, a permit may be issued for the following purposes: For scientific purposes, to enhance the propagation or survival of the species, and for incidental take in connection with otherwise lawful activities. The Service may also register persons subject to the jurisdiction of the United States through its captive-bred-wildlife (CBW) program if certain established requirements are met under the CBW regulations. 50 CFR 17.21(g). Through a CBW registration, the Service may allow a registrant to conduct certain otherwise prohibited activities under certain circumstances to enhance the propagation or survival of the affected species: Take; export or re-import; deliver, receive, carry, transport or ship in interstate or foreign commerce, in the course of a commercial activity; or sell or offer for sale in interstate or foreign commerce. A CBW registration may authorize interstate purchase and sale only between entities that both hold a registration for the taxon concerned. The CBW program is available for species having a natural geographic distribution not including any part of the United States and other species that the Director has determined to be eligible by regulation. The individual specimens must have been born in captivity in the United States. There are also certain statutory exemptions from the prohibitions, which are found in sections 9 and 10 of the Act.

In the proposed rule published on December 14, 2016 (81 FR 90297), we requested that all interested parties submit written comments on the proposal by February 13, 2017. We also contacted appropriate scientific experts and organizations, and other interested parties and invited them to comment on the proposal. We did not receive any requests for a public hearing. All substantive information provided during comment periods has either been incorporated directly into this final determination or is addressed below.

In accordance with our peer review policy published on July 1, 1994 (59 FR 34270), we solicited expert opinion from four knowledgeable individuals with scientific expertise that included familiarity with Poecilotheria species or other tarantulas, their habitats and biological needs, and stressors acting on their populations. We received responses from two of the peer reviewers from whom we requested comments. One did not review the rule but provided additional information regarding a threat to the habitat of P. smithi, and we have incorporated this information into this final rule. The second peer reviewer supported our determinations based on our assessment of some threats, but disagreed with our assessment of others. This peer reviewer also provided a technical correction pertaining to our physical description of Poecilotheria species, and we have incorporated this information into this final rule.

We reviewed all comments received from the peer reviewers for substantive and new information regarding the listing of the five species addressed in this rule. Peer reviewer comments are addressed in the following summary and incorporated into the final rule as appropriate.

(1) Comment: Citing the taxonomic revision done by Gabriel et al. (2013, entire), and the World Spider Catalog, the peer reviewer states that P. vittata is not endemic to Sri Lanka, but rather that P. vittata was synonymized with the Indian species P. striata and recently removed from this synonymy.

Our response: Gabriel et al. (2013, entire) not only remove P. vittata from synonymy with the Indian species P. striata, but also show P. vittata to be the senior synonym of P. pederseni. Further, the World Spider Catalog (2017, unpaginated) recognizes this synonymy, identifying P. pederseni as a synonym of P. vittata. Therefore, in this final rule we retain the taxonomy provided in our proposed rule.

(2) Comment: The peer reviewer indicated that our conclusions regarding the effects of climate change and pesticides on these species are speculative because no studies have been conducted on the effects of these factors on Poecilotheria species. The peer reviewer also indicates that Poecilotheria are unlikely to come in direct contact with pesticides because they live in forests, which are not generally sprayed, and are nocturnal so are not active when spraying occurs. The peer reviewer indicates that studies on spiders in agroecosystems show spiders that do not have direct contact with pesticides survive. However, the peer reviewer did not provide any new information or evidence supporting her assertions.

Our response: While no studies have been carried out specifically assessing the effects of stress factors on any Poecilotheria species, the Act requires that we make our determination of species status based on the best scientific and commercial data available at the time of our rulemaking. In conducting our assessment of the statuses of these species, we reviewed all relevant information available to us, including information submitted to us following the initiation of the 12-month status reviews for these species. We subsequently based our conclusions regarding the factors affecting these five species on the best available information. We acknowledged in our proposed rule that the population-level effects of climate change and pesticides on these species are uncertain. However, as indicated in our proposed rule, the best available information indicates that these stressors are likely negatively affecting these species, either directly or indirectly, to some extent. Consequently, it is reasonable to conclude, as we did in our proposed rule, that pesticides and climate change likely exacerbate the effects of other stressors acting on these species. Therefore, because we based our conclusions on the best available information, and the peer reviewer provided no evidence or new information for our review, we did not revise our conclusions regarding the effects of climate change or pesticides on these five species.

We cannot assess the studies to which the reviewer refers regarding the effects of pesticides on spiders because the reviewer did not provide copies of these studies or the citations for them. Further, while we agree that some members of these species' populations are unlikely to have direct contact with pesticides, we do not agree that is the case for all members, particularly those inhabiting fragmented forests or remnant forest patches. As indicated in our proposed rule, these species could be exposed to pesticides via pesticide drift into forests that are adjacent to crop-growing areas, by traveling over pesticide treated land when dispersing between forest patches, or by consuming prey that have been exposed to pesticides (see Pesticides). Also, the most commonly used insecticides in Sri Lanka—carbofuran, chlorpyrifos, and diazinon—can remain active in the environment for days after application (Kamrin 1997, in Christensen et al. 2009, unpaginated; Karmin 1997, in Harper et al. 2009, unpaginated; U.S. National Library of Medicine 1995, in EXTOXNET 1996, unpaginated). Therefore, these five species could be directly and negatively affected by these pesticides after spraying occurs. They could also be indirectly affected by pesticides through consumption of contaminated prey, or reduction or depletion of prey populations. Taken together, and considering the extent of pesticide use and misuse in the country, it is likely that the five species addressed in this rule are directly or indirectly negatively affected by pesticides to some extent and that these effects likely exacerbate the effects of other threats acting on these species.

We received 115 public comments on the proposed listing of these species, most from people involved in the tarantula hobby as owners, breeders, or sellers. We reviewed all comments received from the public for substantive issues and new information regarding the listing of the five species addressed in this rule. Public comments are addressed in the following summary and incorporated into the final rule as appropriate. A few commenters provided new information on Poecilotheria biology or trade, and we have incorporated this information into the corresponding sections of this rule.

(1) Comment: Several commenters questioned certain information in our proposed rule. Several claimed that we inaccurately characterized the degree or effects (or both) of inbreeding or maladaptation in captive specimens of these species. Another questioned our assessment of the ability of these species to adapt to changing climate in Sri Lanka. Many of these commenters cited their own anecdotal observations of captive specimens to support their claims while the remaining commenters provided no new information. A few other commenters claimed, more generally, that we used outdated references or erroneous information, or misrepresented the findings of cited authors. However, these commenters also provided no new references or information supporting their claims.

Our Response: The Act requires that we use the best available scientific and commercial data to determine if a species meets the definition of a “threatened species” or an “endangered species” because of any one or a combination of the five factors found in section 4(a)(1) of the Act. This analysis includes an analysis of the extent to which captive-held members of a species create or contribute to threats to the species (for example, by fueling trade) or the extent to which captive-held members of a species remove or reduce threats to the species by contributing to the conservation of the species (for example, by providing specimens for population augmentation or reintroduction). In conducting our analysis, we reviewed all relevant information available to us on these species, including information submitted to us following the initiation of the 12-month status reviews for these species. We based our proposed rule, including the discussion and conclusions regarding captive Poecilotheria, on the best scientific and commercial data available to us at the time of our proposed rule. In addition, we reviewed all comments and information submitted by the public and peer reviewers during the public comment period for our proposed rule and base this final rule on the best available information.

Although some commenters provided anecdotal observations of captive specimens to support their assertions regarding the effects of inbreeding and maladaptation in captive specimens, or the ability of captive specimens to adapt to climate conditions, observations of health or survivability in captive conditions are not informative to predicting health or survivability in wild conditions because selection pressures in the wild differ greatly from those in captivity. Therefore, in this final rule we did not change any of our conclusions on these topics. However, we revised the section on Captive Poecilotheria to clarify the bases of our conclusions.

(2) Comment: A few commenters suggested that we did not consider the knowledge or efforts of hobbyists in our proposal.

Our Response: As required by the Act, we based our determinations on the best scientific and commercial information available. In doing so, we reviewed all information available to us on these species, including information submitted to us by the public following initiation of our 12-month status reviews for these species. This included information and dozens of articles from hobbyist publications. Further, we cited several of these sources in our proposal and retained these citations in this final rule.

(3) Comment: Some commenters believe that we inaccurately suggested in our proposed rule that all captive-bred specimens of these species have limited value to the conservation of these species—that all are inbred, maladapted to conditions in the wild, or hybridized—and that we did not acknowledge the knowledge and good practices of reputable breeders. A few suggest that genetic tests could determine which captives could potentially be useful for a conservation breeding program.

Our Response: We appreciate the level of knowledge and care taken by reputable hobbyists when breeding these species. However, we acknowledged the uncertainties pertaining to the levels of inbreeding and hybridization in pet trade specimens in our proposed rule by indicating that captive individuals of these species “may be inbred or maladapted to conditions in the wild” and “likely include an unknown number of hybrids” (see Captive Poecilotheria). Further, as indicated above, we have revised the section on captive Poecilotheria to clarify the bases of our conclusions. With respect to determining the genetic appropriateness of captive specimens for conservation via genetic testing, the Act requires us to make our decision based on the best available information at the time we make our decision, and we are not aware of any genetic studies on any individuals of these species, captive or wild. Even if such information existed, we have no information indicating that pet trade specimens are contributing to the conservation of these species in the wild, for instance, as part of a reintroduction program. Therefore, we have not changed our conclusions regarding captive specimens of these species.

(4) Comment: A few commenters assert that the extent of hybridization of these species in the pet trade is likely low because tarantula hobbyists are strongly opposed to hybridization of species, and because breeders can distinguish between species of adult specimens and take care not to cross-breed them.

Our Response: Again, we appreciate the level of knowledge and care taken by reputable hobbyists when breeding these species. However, because (1) genetic studies have not been conducted on any of these species, (2) evidence indicates that hybrids do occur in the hobby, (3) hybridization may not be visually apparent in captive individuals, and (4) the lineages of pet trade specimens of these species are not documented, the extent of hybridization in any particular captive specimen—be it high, low, or nonexistent—is unknown.

(5) Comment: Several commenters believe that captive-bred specimens in the pet trade are beneficial or necessary to the conservation of these species. They believe captive-bred specimens provide a safety net for these species to prevent extinction, increase public awareness, provide for education and research, supply zoos, and take the collection pressure off wild populations by fulling the demand for these species as pets. Two commenters assert that these species are not in danger of extinction because many exist in captivity.

Our Response: The goal of the Act is survival and recovery of endangered and threatened species and the ecosystems on which they depend. Therefore, when analyzing threats to a species, we focus our analysis on threats acting upon its survival in the wild, generally within the native range of the species. In our assessment of the status of a species, the extent to which captive-held members of a species create or contribute to threats to the species (for example, by fueling trade) or the extent to which captive-held members of a species remove or reduce threats to the species by contributing to the conservation of the species in the wild (for example, by providing specimens for population augmentation or reintroduction) is part of the analysis we conduct under section 4(a)(1) of the Act to determine if the species meets the definition of an endangered species or a threatened species. Further, the Act requires that we make our decision based on the best scientific and commercial data available at the time our decision is made. As indicated in our proposed rule, we are not aware of any existing conservation programs for these species or information indicating that pet trade specimens contribute to the viability of these species within their native ranges in the wild, and have clarified this in revisions to the Captive Poecilotheria section of this rule. We also determined that pet trade specimens likely hold limited value to the conservation of these species in the wild. However, we acknowledge that some pet trade specimens could potentially contribute to the conservation of these species in the wild if, for example, they became part of a genetically managed conservation breeding program. Persons seeking to engage in otherwise prohibited activities with endangered wildlife for scientific purposes or to enhance the propagation or survival of these species may seek authorization from the Service (see Available Conservation Measures).

We also have no information indicating that current or future education or research efforts are being conducted or planned with captive-bred pet trade specimens of these species for conservation purposes, or any evidence that populations in the wild are benefiting from current education or research efforts using captive-bred pet trade specimens. The best scientific and commercial data available indicate that as of September 2017 there were only 19 specimens in captivity in zoos worldwide (11 P. fasciata, 1 P. ornata, 2 P. vitatta, 5 P. subfusca) (Species360 2017, unpaginated).

With respect to trade, certain prohibitions, certain exceptions, and other conservation measures established through the Act are available for endangered species upon listing (see Available Conservation Measures). Therefore, they are provided by law to fulfill the purposes and policy of the Act. The effects of legal trade of a species on wild populations and market demand for that species is a complex phenomenon influenced by a variety of factors (Bulte and Damania 2005, entire; Fischer 2004, entire), and we are not aware of any evidence indicating that the pet trade of captive-bred specimens of these species are benefitting wild populations.

(6) Comment: One commenter expressed concern that listing these species as endangered would likely result in their extinction due to forcing breeders to stop breeding unless they apply for a permit. The commenter also indicated that specimens possessed by hobbyists that are unable to be used in repopulation efforts would not fall under the protections of the Act because they are “unpure specimens”.

Our Response: As explained in response to comments below, captive breeding and many activities related to captive breeding are not prohibited under the Act. Persons seeking to engage in activities that are not prohibited under the Act do not need a permit under the Act. While we are not certain how this commenter defines “unpure”, the protections of the Act apply to all members of these five species as explained in response to comments below. We recommend that breeding records be maintained to show parentage.

(7) Comment: Several commenters requested we exempt captive-bred specimens and their offspring from possession and interstate sales regulations, allowing ownership and interstate trade of these species to occur without obtaining a permit under the Act.

Our Response: Because we determined that all five of these species meet the definition of an “endangered species” under the Act, section 9(a)(1) of the Act and our implementing regulations at 50 CFR 17.21 set forth a series of general prohibitions that apply to all members of each of these species, whether captive or wild. The prohibitions cannot be revised through a regulation under section 4(d) of the Act, because such regulations apply to threatened species. The Act also does not allow for captive-bred specimens of these listed species to be assigned separate legal status from their wild counterparts. However, no permit is required for activities that do not constitute prohibited acts. As noted in response to comments below, the Act does not prohibit captive breeding of listed species and also does not prohibit a number of activities related to captive breeding, such as ownership. Furthermore, we may authorize otherwise prohibited activities for scientific purposes or to enhance the propagation or survival of these species, in accordance with the Act and our regulations (see Available Conservation Measures).

(8) Comment: Several commenters suggested that, rather than list these species as endangered species under the Act, we instead take another action such as: List them in a CITES Appendix, list them as threatened species with a section 4(d) rule that allows interstate trade, do not list them at all, or focus on ameliorating threats within these species' native ranges rather than on regulating domestic trade.

Our Response: When we receive a petition to list a species under the Act, we are required to make a determination as to whether that species meets the Act's definition of a threatened species or an endangered species. We are required to do this based solely on the best scientific and commercial data available, as it relates to the five listing factors in section 4(a)(1) of the Act. When we determine that a species meets the Act's definition of a threatened species or endangered species, we must list that species accordingly under the Act. We determined that these species meet the definition of endangered species, and as such we must list them as endangered species. The Act and our regulations provide prohibitions and other conservation measures that apply to all endangered species as described above (see Available Conservation Measures). Because we found that listing these species as endangered is warranted, not listing them is not an option. We also cannot list them as threatened species with a section 4(d) rule because we found that they are endangered, not threatened species. Furthermore, because we found them warranted for listing, not listing them is not feasible. Finally, CITES has a different process and set of criteria for listing species in the CITES Appendices that is independent of listing under the Act. The portion of the comment suggesting a CITES listing is outside the scope of this agency action to consider whether these species should be listed as endangered species under the Act.

(9) Comment: One commenter asked how to acquire a permit for exemption from the prohibitions of the Act and how often permits need to be renewed.

Our Response: Information regarding permits for activities related to these five species can be obtained at our International Affairs program website at https://www.fws.gov/international/.

(10) Comment: Several commenters believe that trade in these species has little or no effect on wild populations and provided various reasons, including: They had never seen, or heard of others seeing, a wild-caught specimen; the captive stock is self-sustaining; wild-caught specimens are frowned upon in the hobby; and there is no financial incentive for the trade of wild-caught specimens. Others contend that listing and/or regulating trade in the United States is not necessary or useful because U.S. trade does not affect wild populations and because the primary threats to these species occur outside U.S. jurisdiction, in Sri Lanka.

Our Response: Evidence shows that wild-caught specimens of some of these species occur in trade (see Trade). Although the amount of trade in wild-caught specimens in the United States appears to be small, this does not mean trade, or U.S. trade, has no, or even little, effect on wild populations. As indicated in our proposed rule, collection of small numbers of individuals of these species could potentially have significant negative effects on wild populations of these species. With respect to U.S. jurisdiction and the regulation of trade, the Act requires the Service to determine if species qualify as endangered or threatened species regardless of whether a species is native to the United States. The protections of the Act include prohibitions on certain activities including import, export, take, and certain commercial activity in interstate or foreign commerce (see Available Conservation Measures). By regulating these activities, the Act helps to ensure that people under the jurisdiction of the United States do not contribute to the further decline of listed species.

(11) Comment: Several commenters raise concerns that listing would provide a disincentive to captive-breeding these species.

Our Response: It is not our intention to cause difficulties for breeders of these species or a decline in the pool of captive-held specimens. The Act does not prohibit or “ban” captive breeding of listed species. The Act also does not prohibit a number of activities related to captive breeding. For example, ownership, possession, or keeping of a listed species that was legally acquired and not taken in violation of the Act is not prohibited by the Act—nor is interstate transport of animals that are not for sale, not offered for sale, or not transported in the course of a commercial activity. Further, while the Act prohibits harassment of listed species (via the definition of “take”), our regulations specify that, when captive animals are involved, harassment does not include generally accepted animal husbandry practices that meet or exceed AWA standards, breeding procedures, or provisions of veterinary care for confining, tranquilizing, or anesthetizing, when such practices, procedures, or provisions are not likely to result in injury (see the definition of harass at 50 CFR 17.3). In addition, activities that do not adversely affect these species, such as observations in behavioral research, are not considered take. Activities that are not prohibited by the Act do not require a permit under the Act.

The protections of the Act for endangered species include prohibitions on certain activities with any member of the listed species including import, export, take, and certain commercial activity in interstate or foreign commerce (see Available Conservation Measures). Permits may be issued to carry out otherwise prohibited activities, for scientific purposes or to enhance the propagation or survival of the species. For example, a permit could potentially be issued for import or export of captive-bred specimens if the activity were determined to enhance the propagation or survival of the species. Section 10(g) of the Act provides that any person claiming the benefit of any exemption or permit under the Act shall have the burden of proving that the exemption or permit is applicable, has been granted, and was valid and in force at the time of an alleged violation. While the Service may have information available to it that may assist in making required determinations prior to authorizing otherwise prohibited activities with listed species, the burden is on the applicant to provide necessary information for the Service to issue a permit.

We have determined that environmental assessments and environmental impact statements, as defined under the authority of the National Environmental Policy Act (NEPA; 42 U.S.C. 4321 et seq.), need not be prepared in connection with listing a species as an endangered or threatened species under the Endangered Species Act. We published a notice outlining our reasons for this determination in the Federal Register on October 25, 1983 (48 FR 49244).

A complete list of references cited in this rulemaking is available on the internet at http://www.regulations.gov in Docket No. FWS-HQ-ES-2016-0076 and upon request from the Branch of Foreign Species, Ecological Services (see FOR FURTHER INFORMATION CONTACT).

The primary authors of this final rule are the staff members of the Branch of Foreign Species, Ecological Services, Falls Church, VA.

Accordingly, we amend part 17, subchapter B of chapter I, title 50 of the Code of Federal Regulations, as set forth below:

This final rule establishes a framework under the authority of the MMPA (16 U.S.C. 1361 et seq.) to allow for the authorization of take of marine mammals incidental to the Navy's construction activities related to marine structure maintenance and pile replacement at a facility in Groton, Connecticut.

We received an application from the Navy requesting five-year regulations and authorization to take multiple species of marine mammals. Take would occur by Level A and Level B harassment incidental to impact and vibratory pile driving. Please see “Background” below for definitions of harassment.

Section 101(a)(5)(A) of the MMPA (16 U.S.C. 1371(a)(5)(A)) directs the Secretary of Commerce to allow, upon request, the incidental, but not intentional taking of small numbers of marine mammals by U.S. citizens who engage in a specified activity (other than commercial fishing) within a specified geographical region for up to five years if, after notice and public comment, the agency makes certain findings and issues regulations that set forth permissible methods of taking pursuant to that activity and other means of effecting the “least practicable adverse impact” on the affected species or stocks and their habitat (see the discussion below in the “Proposed Mitigation” section), as well as monitoring and reporting requirements. Section 101(a)(5)(A) of the MMPA and the implementing regulations at 50 CFR part 216, subpart I, provide the legal basis for issuing this proposed rule containing five-year regulations, and for any subsequent letters of authorization (LOAs). As directed by this legal authority, this final rule contains mitigation, monitoring, and reporting requirements.

Following is a summary of the major provisions of this final rule regarding Navy construction activities. These measures include:

• Required monitoring of the construction areas to detect the presence of marine mammals before beginning construction activities.

• Shutdown of construction activities under certain circumstances to avoid injury of marine mammals.

• Soft start for impact pile driving to allow marine mammals the opportunity to leave the area prior to beginning impact pile driving at full power.

Sections 101(a)(5)(A) and (D) of the Marine Mammal Protection Act of 1972, as amended (MMPA; 16 U.S.C. 1361 et seq.) direct the Secretary of Commerce (Secretary) to allow, upon request, the incidental, but not intentional taking of marine mammals by U.S. citizens who engage in a specified activity (other than commercial fishing) if certain findings are made and regulations are issued or, if the taking is limited to harassment, notice of a proposed authorization is provided to the public for review.

Authorization for incidental takings shall be granted if NMFS finds that the taking will have a negligible impact on the species or stock(s), will not have an unmitigable adverse impact on the availability of the species or stock(s) for subsistence uses (where relevant), and if the permissible methods of taking and requirements pertaining to the mitigation, monitoring and reporting of such taking are set forth.

NMFS has defined “negligible impact” in 50 CFR 216.103 as an impact resulting from the specified activity that cannot be reasonably expected to, and is not reasonably likely to, adversely affect the species or stock through effects on annual rates of recruitment or survival.

The MMPA states that the term “take” means to harass, hunt, capture, kill or attempt to harass, hunt, capture, or kill any marine mammal. Except with respect to certain activities not pertinent here, the MMPA defines “harassment” as any act of pursuit, torment, or annoyance which (i) has the potential to injure a marine mammal or marine mammal stock in the wild (Level A harassment); or (ii) has the potential to disturb a marine mammal or marine mammal stock in the wild by causing disruption of behavioral patterns, including, but not limited to, migration, breathing, nursing, breeding, feeding, or sheltering (Level B harassment).

On March 22, 2017, NMFS received an application from the Navy requesting authorization to incidentally take harbor and gray seals, by Level A and Level B harassment, incidental to noise exposure resulting from conducting pier construction activities at the Navy Submarine Base New London in Groton, Connecticut, from October 2018 to March 2022. These regulations would be valid for a period of five years. On August 31, 2017, NMFS deemed the application adequate and complete. On May 23, 2018, the Navy requested that the rule be valid between March 1, 2020, and February 28, 2025, due to construction schedule changes.

The use of sound sources such as those described in the application (e.g., piledriving) may result in the take of marine mammals through disruption of behavioral patterns or may cause auditory injury of marine mammals. Therefore, incidental take authorization under the MMPA is warranted.

The Navy is planning to demolish Pier 32 and Pier 10 and construct a new Pier 32 at Naval Submarine Base New London (SUBASE), Groton, Connecticut.

Recent Global Shore Infrastructure Plans and Regional Shore Infrastructure Plans identified a requirement for 11 adequate submarine berths at SUBASE. There are currently six adequate berths available via Piers 6, 17, and 31, leaving a shortfall of five adequate berths. The remaining submarine berthing piers (8, 10, 12, 32, and 33) are classified as inadequate because of their narrow width and short length compared to current SSN (hull classification) berthing design standards (Unified Facilities Criteria 4-152-01, Design Standards for Piers and Wharves).

The Proposed Action is to demolish Pier 32 and Pier 10, and replace them with a new Pier 32 that meets all current Navy SSN pier standards to accommodate Virginia Class submarines. The Proposed Action includes:

• Construction of a new, larger Pier 32 to be located approximately 150 feet (ft) north of the current location.

• Upgrade of the quaywall, north of Pier 32, may be required to accommodate a crane weight test area.

• Demolition of existing Pier 32 and Pier 10.

• Dredging of the sediment mounds beneath the existing Pier 32 (approximately 9,400 cubic yards [cy]) and the existing Pier 10 (approximately 10,000 cy) to a depth of 36 ft below mean lower low water (−36 ft MLLW) plus 2 ft of over dredge (additional dredge depth that allows for varying degrees of accuracy of different types of dredging equipment). Any remaining timber piles beneath the existing piers would be pulled with a strap.

• Dredging of the berthing areas alongside the proposed new Pier 32 (approximately 74,000 sq ft) to a depth of −38 feet MLLW plus 2 feet of over dredge.

• Dredging of two additional areas (approximately 10,200 cy and 31,100 cy) in the Thames River navigation channel to a depth of −36 ft MLLW plus 2 ft of over dredge.

Two species of marine mammals are expected to potentially be present in the Thames River near SUBASE: Harbor seal (Phoca vitulina) and gray seal (Halichoeris grypus). Harbor seals and gray seals are more likely to occur at SUBASE from September to May.

Pile installation for the new Pier 32 and pile removal associated with the demolition of the existing Piers 32 and 10 is expected to take a total of approximately 3.5 years. Construction and demolition activities are expected to begin no earlier than March 2020 and proceed to completion in February 2025.

In-water activities expected to result in incidental takes of marine mammals would occur during approximately 35 non-consecutive months of the project beginning in March 2020. The estimated duration of pile installation and removal, including duration of the vibratory and impact hammer activities, is provided in Table 1 below for each year of construction and demolition. Also included in the Table are the durations for wood piles and steel fender piles to be pulled by a crane using a sling or strap attached to the pile. The durations of proposed pile driving/removal activities are primarily derived from information provided by Naval Facilities Engineering Command (NAVFAC) Mid-Atlantic Public Works Department, Facilities Engineering and Acquisition Department (FEAD) Design Manager and the record of pile driving activities documented during the construction of SUBASE Pier 31 (American Bridge 2010-2011). The proposed new Pier 32 would be comparable to Pier 31 in design and location and would have similar sub-surface geological conditions along this reach of the Thames River.

SUBASE is located in the towns of Groton and Ledyard in New London County, Connecticut. SUBASE occupies approximately 687 acres along the east bank of the Thames River, 6 mi north of the river's mouth at Long Island Sound (Figure 1-1 in LOA application). The Thames River is the easternmost of Connecticut's three major rivers and is formed by the confluence of the Shetucket and Yantic rivers in Norwich, from which it flows south for 12 mi to New London Harbor. The Thames River discharges freshwater and sediment from the interior of eastern Connecticut into Long Island Sound. It is the main drainage of the Thames River Major Drainage Basin, which encompasses approximately 3,900 square mi of eastern Connecticut and central Massachusetts (USACE 2015). The lower Thames River and New London Harbor sustains a variety of military, commercial, and recreational vessel usage. New London Harbor provides protection to a number of these.

Pile driving would most likely be conducted using a barge and crane. However, the contractor may choose to use a temporary pile-supported work trestle that would be constructed by driving approximately 60 steel 14-inch diameter H-piles.

Structural support piles for Pier 32 would consist of approximately 120 concrete-filled steel pipe piles measuring 36 inches in diameter. The piles would be driven between 40 ft below the mudline near the shore and 150 ft below the mudline at the end of the pier. Fender piles would also be installed and would consist of approximately 194 fiberglass-reinforced plastic piles measuring 16 inches in diameter.

Special construction features would include drilling rock sockets into bedrock in an estimated 60 places to hold the piles. A rotary drill using a rock core barrel and rock muck bucket would be used inside of the steel pipe piles to drill a minimum of 2 ft down into bedrock to create the rock socket that would be filled with concrete. Sediment would be lifted out and re-deposited within 10 ft of the pipe pile during rock socket drilling. Underwater noise from the rock drill as it is operated inside a steel pipe would be much less than that produced by vibratory and impact pile driving of the steel pipes (Martin et al. 2012).

Impact and vibratory hammers would be used for installing piles where rock sockets are not required. Based on previous construction projects at SUBASE, it is estimated that an average of one 36-inch pile per week (with driving on multiple days) and two plastic piles per day would be installed. The per-pile drive time for each pile type and method will vary based on environmental conditions (including substrate) where each pile is driven. Impact or vibratory pile driving may result in harassment of marine mammals.

Construction of Pier 32 may also require upgrade of the quaywall north of Pier 32 to provide the reinforcement needed to support a crane weight test area. Because there is potential that a work trestle would be used and the requirement for the upgrade will not be determined until final design, the pile driving is included in the analyzed activities. The quaywall upgrade would include up to approximately eighteen 30-inch diameter concrete-filled steel pipe piles that would be installed into rock sockets driven into bedrock adjacent and parallel to the existing steel sheet pile wall. Pile caps and a concrete deck would be installed above the piles. A fender system composed of approximately nine 16-inch diameter plastic piles would also be installed into rock sockets approximately 2 ft in front of the new deck.

When the new Pier 32 is operational, the existing Pier 32 would be demolished using a floating crane and a series of barges. Pier 10 would be demolished after the demolition of existing Pier 32. The concrete decks of the piers would be cut into pieces and placed on the barges. Demolition debris would be sorted and removed by barge and recycled to the maximum extent practicable. Any residual waste would be disposed of offsite in accordance with applicable federal, state, and local regulations. Once the decks are removed, the steel H piles and pipe piles that support the existing pier would be pulled using a vibratory extraction method (hammer). The vibratory hammer would be attached to the pile head with a clamp. Once attached, vibration would be applied to the pile that would liquefy the adjacent sediment allowing the pile to be removed.

Demolition of existing Pier 32 would include the removal by vibratory driver-extractor (hammer) of approximately 60 steel piles from the temporary work trestle, 120 concrete-encased steel H-piles, and 70 steel H-piles. Fifty-six wood piles would be pulled with a sling. Demolition of Pier 10 would include the removal by vibratory hammer of 24 concrete-encased, steel H-piles and 166 cast-in-place, reinforced concrete piles. Eighty-four steel fender piles and 41 wood piles would be pulled with a sling. A total of 440 piles would be removed by vibratory hammer for both piers and the work trestle.

The Proposed Action would also include dredging of approximately 60,000 cy of sediment in two areas of the Thames River navigation channel near Pier 32, the berthing areas alongside the new Pier 32, and underneath existing Pier 32 and Pier 10 after demolition. All dredging for the Proposed Action would support safe maneuvering for entry and departure of submarines at the proposed new Pier 32 and existing Piers 8, 12, 17, and 31. The proposed design dredge depth in all areas to be dredged is −36 ft relative to MLLW plus 2 ft of over dredge.

Dredging would be conducted in two phases. Dredging of the new Pier 32 area and the northern portion of the channel dredge areas would be conducted in the first construction year. The footprints of the demolished Pier 32 and Pier 10 and the southern portions of the channel dredge areas would be dredged after demolition of the existing piers in the fourth year of construction. Dredging would occur only during the period between October 1 and January 31 to avoid potential impacts on shellfish and fisheries resources in the area. Each dredging and disposal phase would take approximately 2 weeks to complete.

After the demolition of Pier 32, any remnant timber piles present underneath existing Pier 32 would be pulled with a strap. The sediment mound that has formed beneath the pier would be dredged (approximately 9,400 cy) to the design depth. Dredging would also be required immediately west of Piers 31 and 32 (approximately 10,200 cy) and along the eastern edge (approximately 31,100 cy) of the navigation channel to achieve the required minimum depths to maneuver the submarines. Once the existing Pier 10 and any remnant timber piles are removed, the sediment mound beneath the old pier would be dredged (approximately 10,000 cy).

Since dredging and disposal activities would be slow moving and conspicuous to marine mammals, they pose negligible risks of physical injury. An environmental bucket would be used for dredging to minimize turbidity compared with the turbidity generated by hydraulic dredging. Noise emitted by dredging equipment is broadband, with most energy below 1 kilohertz (kHz), and would be similar to that generated by vessels and maritime industrial activities that regularly operate within the action area (Clarke et al. 2002; Todd et al. 2015). Due to the low noise output and slow and steady transiting nature of the dredging activity, NMFS does not consider it would result to the level of harassment under the MMPA. Therefore, dredging is not considered further in this document.

Prescribed mitigation, monitoring, and reporting measures are described in detail later in this document (please see “Mitigation” and “Monitoring and Reporting”).

NMFS published a proposed rule in the Federal Register on April 13, 2018 (83 FR 16027). During the 30-day public comment period on the proposed rule, NMFS received comments from the Marine Mammal Commission (Commission). We did not receive other comments.

Comment 1: The Commission recommends that NMFS require the Navy to conduct sound source verification (SSV) and the size of Level B harassment zone measurements for certain piles that data are lacking and where the zones are not based on modeling. These acoustic measurements include:

• Vibratory and impact installation of at least five 16-in fiberglass-reinforced plastic piles—measurements for source levels;

• Rock socket drilling of at least three 30-in and three 16-in piles—measurements for source levels and the extent of the Level B harassment zones;

• Vibratory installation of at least three 36-in steel piles—measurements for the extent of the Level B harassment zone; and

• Vibratory removal of at least three 24-in concrete and three 33-in concrete piles—measurements for source levels and the extent of the Level B harassment zones.

Response: NMFS discussed these recommendation with the Navy and the Navy agreed to conduct SSVs on the piles for which source level data are not already available. SSV measurements to be conducted are:

• Vibratory and impact installation of at least 5 16-in fiberglass reinforced plastic piles, and

• Rock socket drilling of at least 3 30-in and 3 16-in piles.

However, the Navy did not agree to conduct acoustic measurements to the extent of the Level B harassment zones. The Navy indicated that conducting hydroacoustic monitoring to the extent of the Level B harassment zones is not a common requirement based on the five most recent active IHAs, including U.S. Army Corps of Engineers' (USACE) Tampa Harbor Big Bend Channel expansion project, the City of Astoria's waterfront bridge replacement project, the Navy's Bravo wharf recapitalization project, and U.S. Coast Guard's (USCG) Monterey waterfront repair project. Instead, the Navy offered to conduct hydroacoustic measurements at several points between 10 and 500 m from the source and extrapolate the distance of the Level B harassment zone.

While being able to determine the extent of Level B harassment zones is critical to accurately assess the potential impacts to marine mammals, these zones can be determined by means other than direct measurements recommended by the Commission. Therefore, NMFS considers the Navy's proposal of extrapolating the Level B harassment zone using near- and far-field measurement data a valid approach.

Therefore, in the final rule, NMFS requires the Navy to conduct SSVs on the piles listed above and to conduct measurements on several locations between 10 and 500 m from the source to determine the Level B harassment zones for those zones that were not based on modeling.

These requirements are included in the final rule.

Comment 2: The Commission recommends that NMFS require the Navy to include certain metrics in the hydroacoustic monitoring report for measurements being conducted. These metrics include:

• Root-mean-square sound pressure levels (SPLrms), 1-sec sound exposure levels (SELs), duration of recordings used to derive SELs, cumulative SEL (SELcum) based on the number of piles and driving duration for each scenario, and SEL source spectra for vibratory pile driving/removal source level measurements;

• Peak SPLs (SPLpeak), SPLrms, integration time/pulse duration for SPLrms, single-strike SPLs (SPLs-s), SELcum based on the number of piles and driving duration for each scenario, and SELs-s spectra for impact pile driving source level measurements;

• The measured (or extrapolated, if not reached) distances at which the SPLrms decays to 120 dB re 1 μPa or to ambient, whichever is higher, and integration time/pulse duration for SPLrms for verification of the extent to the Level B harassment zones;

• All sound levels via medians, means, minimums, and maximums and linear average (i.e., averaging the sound intensity/pressure before converting to dB); and

• Sediment type, water depth, hydrophone depth, etc.

Response: NMFS discussed this with the Navy and the Navy agreed to report these metrics in the acoustic monitoring report. These requirements are included in the final rule.

Comment 3: The Commission recommends that NMFS revise its draft rounding criteria and share it with the Commission.

Response: NMFS appreciates the Commission's ongoing concern in this matter. Calculating predicted takes is not an exact science and there are arguments for taking different mathematical approaches in different situations, and for making qualitative adjustments in other situations. We believe, however, that the methodology used for take calculation in this LOA remains appropriate and is not at odds with the 24-hour reset policy the Commission references. We look forward to continued discussion with the Commission on this matter and will share the rounding guidance as soon as is appropriate.

Sections 3 and 4 of the application summarize available information regarding status and trends, distribution and habitat preferences, and behavior and life history, of the potentially affected species. Additional information regarding population trends and threats may be found in NMFS's Stock Assessment Reports (SAR; www.nmfs.noaa.gov/pr/sars/) and more general information about these species (e.g., physical and behavioral descriptions) may be found on NMFS's website (https://www.fisheries.noaa.gov/seals-sea-lions).

Table 2 lists all species with expected potential for occurrence in location and summarizes information related to the population or stock, including regulatory status under the MMPA and ESA and potential biological removal (PBR), where known. For taxonomy, we follow Committee on Taxonomy (2017). PBR is defined by the MMPA as the maximum number of animals, not including natural mortalities, that may be removed from a marine mammal stock while allowing that stock to reach or maintain its optimum sustainable population (as described in NMFS's SARs). While no mortality is anticipated or authorized here, PBR and annual serious injury and mortality from anthropogenic sources are included here as gross indicators of the status of the species and other threats.

Marine mammal abundance estimates presented in this document represent the total number of individuals that make up a given stock or the total number estimated within a particular study or survey area. NMFS's stock abundance estimates for most species represent the total estimate of individuals within the geographic area, if known, that comprises that stock. For some species, this geographic area may extend beyond U.S. waters. All managed stocks in this region are assessed in NMFS's U.S. Atlantic SARs (Waring et al., 2017). All values presented in Table 2 are the most recent available at the time of publication and are available in the draft 2017 SARs (Hayes et al., 2017).