# Regulations Implementing FAST Act Section 61003-Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2016-28322

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** December 21, 2016
- **Citation:** 81 FR 93732

## Text

DEPARTMENT OF ENERGY
Federal Energy Regulatory Commission
18 CFR Parts 375 and 388
[Docket Nos. RM16-15-000 and RM15-25-001; Order No. 833]
Regulations Implementing FAST Act Section 61003—Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission

AGENCY:

Federal Energy Regulatory Commission, Department of Energy.

ACTION:

Final rule.

SUMMARY:

The Federal Energy Regulatory Commission (Commission) amends its regulations to implement provisions of the Fixing America's Surface Transportation Act that pertain to the designation, protection and sharing of Critical Electric Infrastructure Information. Additionally, the Commission amends its regulations addressing Critical Energy Infrastructure Information.

DATES:

This rule will become effective February 21, 2017.

FOR FURTHER INFORMATION CONTACT:

Nneka Frye, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029,
Nneka.frye@ferc.gov.

Christopher MacFarlane, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6761,
Christopher.macfarlane@ferc.gov.

Mark Hershfield, Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, (202) 502-8597,
Mark.hershfield@ferc.gov.

SUPPLEMENTARY INFORMATION:

1. The Commission amends 18 CFR 375.309, 375.313, 388.112 and 388.113 of its regulations to implement the requirements of the Fixing America's Surface Transportation (FAST) Act as set forth in section 215A(d)(2) of the Federal Power Act (FPA).
1

The Commission also amends its existing Critical Energy Infrastructure Information procedures. These changes are intended to comply with the FAST Act as well as improve the overall efficiency of the Commission's procedures for certain infrastructure information that is submitted to, or generated by, the Commission. The amended procedures will be referred to as the Critical Energy/Electric Infrastructure Information (CEII) procedures.

1
Fixing America's Surface Transportation Act, Public Law 114-94, 61,003, 129 Stat. 1312, 1773-1779 (2015) (to be codified at 16 U.S.C. 824
et seq.
) (FAST Act).

I. Background

A. Critical Energy Infrastructure Information Regulations

2. Shortly after September 11, 2001, the Commission took steps to protect information that it considered Critical Energy Infrastructure Information.
2

As a preliminary step, the Commission removed documents from its public files and eLibrary database that were likely to contain detailed specifications about critical infrastructure. The Commission directed the public to use the Freedom of Information Act (FOIA) request process to obtain such information.
3

Given that such information would typically be exempt from mandatory disclosure pursuant to FOIA, the Commission determined that it was important to have a process for individuals with a valid or legitimate need to access certain sensitive energy infrastructure information. Thus, in 2003, the Commission issued a final rule establishing Critical Energy Infrastructure Information regulations.
4

2

See Statement of Policy on Treatment of Previously Public Documents,
97 FERC ¶ 61,030 (2001).

3
5 U.S.C. 552
as amended by
the FOIA Improvement Act of 2016, Public Law 114-185, 130 Stat. 538 (2016); 18 CFR 388.108 (Requests for Commission records not available through the Public Reference Room (FOIA Requests)).

4

Critical Energy Infrastructure Information,
Order No. 630, FERC Stats. & Regs. ¶ 31,140,
order on reh'g,
Order No. 630-A, FERC Stats. & Regs. ¶ 31,147 (2003).

3. Each year, over 7,000 documents are submitted to the Commission's eLibrary system as Critical Energy Infrastructure Information. The Commission also receives approximately 200 requests for Critical Energy Infrastructure Information each year. Requests for Critical Energy Infrastructure Information are submitted by, among others, public utilities, gas pipelines, Liquefied Natural Gas (LNG) facilities, hydroelectric developers, academics, landowners, public interest groups, researchers, renewable energy organizations, consultants, and federal agencies.

4. The Commission's current Critical Energy Infrastructure Information process is designed to limit the distribution of sensitive infrastructure information to those individuals with a need to know in order to avoid having sensitive information fall into the hands of those who may use it to attack the Nation's infrastructure.

B. FAST Act

5. On December 4, 2015, the President signed the FAST Act into law. The FAST Act,
inter alia,
added section 215A to the Federal Power Act to improve the security and resilience of energy infrastructure in the face of emergencies. The FAST Act directs the Commission to issue regulations aimed at securing and sharing sensitive infrastructure information. Specifically, FPA section 215A(d)(2) (Designation and Sharing of Critical Electric Infrastructure Information) requires the Commission to promulgate regulations on the following. First, the statute requires the Commission to establish criteria and procedures to designate information as critical electric infrastructure information. Second, the statute requires the Commission to prohibit the unauthorized disclosure of critical electric infrastructure information. Third, the statute requires the Commission to ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy [DOE] who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized by the statute. Fourth, FPA section 215A(d)(2)(D) requires the Commission, taking into account standards of the Electric Reliability Organization, to facilitate voluntary sharing of critical electric infrastructure information. The statute, specifically, directs the Commission to facilitate voluntary sharing with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission.
5

5
FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

C. Notice of Proposed Rulemaking

6. On June 16, 2016, the Commission issued a Notice of Proposed Rulemaking (NOPR) to amend its regulations to implement the provisions of the FAST Act pertaining to the designation, protection and sharing of CEII.
6

The

proposed amendments included, among other things, the creation of criteria and procedures for designating information as CEII; a specific prohibition on unauthorized disclosure of that information; sanctions for knowing and willful wrongful disclosure of CEII by certain federal personnel; a process for voluntary sharing of CEII; and changes to the existing process for requesting CEII. In response to the NOPR, nineteen entities filed comments and two entities filed reply comments. The Appendix to this Final Rule lists the entities that submitted comments in response to the NOPR.

6

Regulations Implementing FAST Act Section 61003—Critical Infrastructure Security and

Amending Critical Energy Information,

81 FR 43,557 (July 5, 2016), 155 FERC ¶ 61,278 (2016) (NOPR).

II. Discussion

7. The Commission adopts the majority of amendments proposed in the NOPR. The Commission determines that the amendments comply with the requirements of the FAST Act and better ensure the secure treatment of CEII. In addition, as discussed below, the Commission modifies or otherwise clarifies certain proposals made in the NOPR based on our review of the comments. In the discussion below, we address the following issues regarding the CEII amendments: (A) Scope, purpose, and definitions; (B) criteria and procedures for determining what constitutes CEII; (C) duty to protect CEII; (D) sanctions for unauthorized disclosure of CEII; (E) voluntary sharing of CEII; and (F) requests for access to CEII.

A. Scope, Purpose, and Definitions

NOPR

8. In the NOPR, the Commission proposed to amend section 388.113 to include procedures for submitting, designating, handling, sharing and disseminating Critical Electric Infrastructure Information submitted to or generated by the Commission.
7

The Commission proposed to define the term “Critical Electric Infrastructure Information”
8

to include “Critical Energy Infrastructure Information” as defined under the Commission's current regulations and to refer to both types of information, collectively, as CEII.
9

The Commission also proposed to delete references to CEII in section 388.112 so that section 388.112 would only address privileged material and all procedures regarding CEII would be in section 388.113.

7
NOPR, 155 FERC ¶ 61,278 at P 10.

8

Id.
P 11 (noting that Section 215A(a)(3) of the FAST Act defines Critical Electric Infrastructure Information to include information that qualifies as critical energy infrastructure information under the Commission's regulations).

9
NOPR, 155 FERC ¶ 61,278 at P 13.

Comments

9. APPA and MISO maintain that CEII should not include all Critical Energy Infrastructure Information.
10

APPA contends that Congress intended for the Commission to develop a separate process for Critical Electric Infrastructure Information regarding the bulk-power system and that the amended regulations fall “short” of Congress's intent under the FAST Act because the amended regulations include the voluntary disclosure provisions found in the Commission's current regulations.
11

APPA also asserts that the proposed definition of “critical electric infrastructure” “does not comport well” with section 215A(d)(10) of the FPA, which provides DOE and the Commission with the authority to remove the CEII designation from information regarding the bulk-power system or distribution facilities.
12

MISO contends that the Commission misinterpreted the definition of Critical Electric Infrastructure Information and that not all “Critical Energy Infrastructure Information under the Commission's regulations is included” in the definition of Critical Electric Infrastructure Information.
13

10

See
APPA Comments at 5-11; MISO Comments at 5.

11
APPA Comments at 5, 9, 13.

12
Section 215A(d)(10) of the FPA provides that when “the Commission or the [DOE] Secretary, as appropriate, determines that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities” the designation shall be removed.

13
MISO Comments at 4-6.

10. TAPS and APPA maintain that the Commission should revise the CEII definition to include additional language from the FAST Act. Specifically, TAPS and APPA recommend that the proposed definition of CEII incorporate section 215A(d)(1)(B), which provides that CEII “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.”
14

APPA requests that, if the Commission includes Critical Energy Infrastructure Information in CEII, then the Commission should interpret section 215A(d)(1)(B) to apply to all forms of CEII, including Critical Energy Infrastructure Information.
15

TAPS and APPA also request that the Commission define the term “political subdivision,” as used in section 215A(d)(1)(B), to have the same meaning as the term “political subdivision” in section 201(f) of the FPA, such that the term in section 215A(d)(1)(B) would include any agency, authority or instrumentality of any political subdivision or owned by a political subdivision.
16

TAPS and APPA contend that, absent the clarification, these additional entities may not be considered a “political subdivision” under State laws.
17

14
TAPS Comments at 8; APPA Comments at 21-22.

15
APPA Comments at 23.

16
TAPS Comments at 8; APPA Comments at 22 (citing Section 201(f), which indicates that provisions of that subchapter are not applicable to, among others, the United States, a State or any political subdivision of a State, certain electric cooperatives or any agency, authority, or instrumentality of any one or more of those entities or any corporation wholly owned, directly or indirectly, by any one or more of those entities).

16 U.S.C. 824(f)

17
TAPS Comments at 8-9; APPA Comments at 22-23.

11. TAPS recommends that the Commission delete from the definition of Critical Energy Infrastructure Information the requirement that such information be exempt from FOIA.
18

TAPS contends that the existing exemption clause is unnecessary because any materials will be exempt from FOIA pursuant to section 215A(d)(1)(A).
19

18
TAPS Comments at 4-5.

19

Id.
at 4.

12. Other commenters seek clarification on the scope of the CEII definition. Specifically, the Trade Associations request that the Commission clarify whether the name or location of an electric system, asset, owner or operator could be protected under the proposed CEII definition.
20

NRECA, similarly, urges the Commission to clarify that material considered Critical Energy Infrastructure Information, such as electric generation, and non-bulk electric system transmission and distribution facilities, would still qualify as CEII under the revised definition in the amended regulations.
21

20
Trade Associations Comments at 16.

21
NRECA Comments at 7.

13. Powerex requests that the Commission specify whether the new definition of CEII expands the scope of information currently defined as Critical Energy Infrastructure Information.
22

Powerex contends that the scope of this proceeding should remain limited to CEII regulations and procedures discussed in the NOPR and, thus, the scope of this proceeding should not extend to other forms of sensitive data.
23

Powerex, further, explains that there

may be a tendency to over-designate information as CEII and, therefore, the Commission should recognize that transparency is needed to balance CEII protection against the due process rights of parties participating in Commission proceedings.
24

22
Powerex Comments at 11.

23

Id.
at 15.

24

Id.
at 12.

14. TAPS, APPA and the Trade Associations recommend revisions to the CEII Non-Disclosure Agreements (NDA).
25

Specifically, TAPS, APPA, and the Trade Associations state that the Commission should expressly incorporate the language from section 215A(d)(1)(B), exempting CEII from public disclosure, into the NDA.
26

TAPS requests that the Commission eliminate the State Agency NDA. TAPS contends that “[p]rior to the FAST Act's express preemption of Sunshine Laws requiring disclosure,” the State Agency NDA was an attempt to impose a contractual nondisclosure requirement for critical energy infrastructure information provided to a State agency. TAPS maintains that, once section 215A(d)(1)(B) is included in the general NDA, the State Agency NDA should be eliminated because it is now unnecessary.
27

25
APPA Comments at 23; TAPS Comments at 9-10; Trade Associations Comments at 32.

26

See id.

27
TAPS Comments at 10;
see also
Critical Energy Infrastructure Information State Agency Employee Non-Disclosure Agreement,
http://www.ferc.gov/legal/ceii-foia/ceii/state-agen-nda.pdf.

15. With respect to the proposed edits to sections 388.112 and 388.113 to separate the Commission's treatment of privileged material from the Commission's treatment of CEII, MISO suggests that the title for section 388.112 be changed to “Submission and treatment of privileged information” and section 388.113 be changed to “Submission and treatment of Critical Electric Infrastructure Information (CEII).”
28

28
MISO Comments at 3.

16. The Trade Associations request that the Commission expressly state in the amended regulations that the CEII process is not intended to, and should not be interpreted to, supersede or otherwise affect existing laws, regulations, and agency rules that separately safeguard such data.
29

29

See
Trade Associations Comments at 26.

Commission Determination

17. As discussed below, the Commission, with limited modifications, adopts the amendments proposed in the NOPR addressing the scope, purpose and definitions in the CEII regulations. The Commission determines that the amendments are consistent with the requirements of the FAST Act and will result in more secure treatment of CEII.

18. The Commission disagrees with APPA and MISO that the CEII definition should not include Critical Energy Infrastructure Information and that there should be separate processes for electric and non-electric CEII. Our determination is based on the plain language of the FAST Act. Section 215A(a)(3) defines Critical Electric Infrastructure Information to “include information that qualifies as critical energy infrastructure information under the Commission's regulations.”
30

In subsuming the Commission's existing Critical Energy Infrastructure Information within section 215A's CEII definition, Congress expressly stated that the definition of CEII includes Critical Energy Infrastructure Information. There is no indication in the language of the FAST Act that Congress intended to limit the types of Critical Energy Infrastructure Information to only electric infrastructure information.
31

30
FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

31
For the same reason, we reject MISO's recommendation that the title for section 388.112 should be changed to “Submission and treatment of privileged information” and that the title for section 388.113 should be changed to “Submission and treatment of Critical Energy Infrastructure Information (CEII).” MISO Comments at 3.

19. Including Critical Energy Infrastructure Information within the definition of CEII is not inconsistent with the provisions of section 215A(d)(10), as APPA maintains. First, section 215A(d)(10) states that removal of a CEII designation may be appropriate when the disclosure of such information “could no longer be used to impair the security or reliability of the bulk-power system
or distribution facilities.
” (Emphasis supplied.) Thus, it is clear that Congress did not intend for the new Critical Electric Infrastructure Information designation to apply only to the bulk-power system. Second, Critical Energy Infrastructure Information includes information that “relates details about the production, generation, transportation, transmission, or distribution of energy.”
32

Such information, even if it concerns non-electric infrastructure, could be used to impair the security or reliability of the bulk-power system, for example by severing gas pipeline connections to electric generation facilities.

32
18 CFR 388.113(c)(1)(i)).

20. Moreover, the Commission determines that a single CEII process for Critical Energy/Electric Infrastructure Information is the most efficient way to fulfill the statutory mandate of the FAST Act and to avoid any confusion that could result from different processes for different types of critical infrastructure information.
33

Absent contrary language in the FAST Act, the Commission has discretion in how it administers statutory mandates by regulation.
34

33
NOPR, 155 FERC ¶ 61,278 at P 14.

34

See Anna Jacques Hosp.
v.
Burwell,
797 F.3d 1155, 1165 (D.C. Cir. 2015) (holding that “interstitial question[s] of implementation” are left to the discretion of the implementing agency).

21. APPA's assertion that the Commission is “falling short” of meeting Congress's intent is without merit. In the proposed regulations, the Commission complies with each provision in section 215A(d)(2) with regard to designating and handling Critical Electric Infrastructure Information. The fact that those rules also apply to Critical Energy Infrastructure Information does not diminish the Commission's compliance under the FAST Act. Rather, in this regard, the Commission's determination meets Congress's intent. Moreover, APPA's argument that “information related to cyber threats and defensive measures should not be `protected' under a designation regime that also provides for potentially involuntary access by any federal employee . . ., landowners [or]any person who is a participant in a Commission proceeding . . .” and others has no basis in the text of the FAST Act. APPA notably cites to nothing in the FAST Act to support that argument.
35

On the contrary, Congress explicitly directed the Commission to include voluntary sharing in the regulations that the Commission is required to promulgate under the FAST Act.
36

Further, the implication of APPA's argument—that cyber information is different from other types of infrastructure information and therefore warrants different rules—fails to take into consideration that the Commission will evaluate each request for CEII, and each decision to voluntarily share CEII, on a case-by-case basis. For example, a person seeking cyber threat information would have to show a different need for the information than a person seeking information for a pipeline facility for a certificate proceeding.

35

See
APPA Comments at 15.

36
Section 215A(d)(2)(D) states that the Commission “shall promulgate such regulations as necessary to . . . facilitate voluntary sharing of critical electric infrastructure information . . .” FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

22. The Commission agrees with TAPS and APPA that the Commission's regulations should incorporate the

provision in section 215A(d)(1)(B) that CEII “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.”
37

As to TAPS's and APPA's request that the Commission define the term “political subdivision,” in section 215A(d)(1)(B) of the FAST Act to be consistent with the definition of that term in FPA section 201(f), Congress did not adopt the definition of “political subdivision” in section 201(f) for the purposes of the FAST Act. However, the Commission believes that the broad language of section 215A(d)(1)(B), as it applies to “any Federal, State, political subdivision or tribal authority,” should encompass the instrumentalities and components of States. Section 215A(d)(1)(B) was included to protect CEII from mandatory disclosure. It would be illogical to provide such protection to States, but not their instrumentalities and components.

37
APPA states that there may be instances where an entity could provide CEII to NERC who, in turn, may submit that entity's information to the Commission or DOE as CEII without notifying the entity. Thus, APPA is concerned the entity may not be aware that the information has been submitted to the Commission and designated as CEII. As a result, APPA suggests that the Commission establish notification procedures so that entities are aware that their information was designated as CEII. APPA Comments at 21-22. We see no need to adopt such a notification process. Section 1505 of NERC's Rules of Procedure already requires NERC, unless otherwise directed by the Commission or its staff, to notify submitting entities of requests made by the Commission to NERC for the submitting entities' information.

23. The Commission disagrees with TAPS that the Commission should delete from the definition of Critical Energy Infrastructure Information the provision that states that Critical Energy Infrastructure Information “[i]s exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552.”
38

As we have discussed above, Congress incorporated Critical Energy Infrastructure Information within section 215A's definition of Critical Electric Infrastructure Information without revision.
39

Accordingly, the Commission will retain its current definition of Critical Energy Infrastructure Information.

38
18 CFR 388.113(c)(2)(iii).

39

See Stone
v.
INS,
514 U.S. 386, 397 (1995) (holding that “[w]hen Congress acts to amend a statute, we presume it intends its amendment to have real and substantial effect”).

24. In response to the Trade Associations' comments seeking clarification if a name or location of a facility should be protected as CEII, the Commission's current practice is that information that “simply give[s] the general location of the critical infrastructure” or simply provides the name of the facility is not CEII.
40

However, under certain circumstances, information regarding the location of infrastructure or its name that is not already publicly known could be CEII.
41

Therefore, we clarify that, while as a general matter the location or name of infrastructure is not CEII, a submitter of information to the Commission may ask that non-public information about the location, or the name, of critical infrastructure be treated as CEII. The submitter would have to provide a justification for the request and explain why the information is not already publicly known.

40
18 CFR 388.113(c)(1)(iv).

41
For example, the location of an operating transformer is likely publicly known. However, the location of a spare transformer housed in a central location may not be publicly known and, therefore, may qualify as CEII.

25. In response to NRECA's request that the Commission clarify that material treated as Critical Energy Infrastructure Information under the Commission's current regulations would, in most circumstances, be treated as CEII under the amended regulations, we note that such information should continue to qualify as CEII. We also note, however, in response to Powerex's comment, that it is conceivable that Critical Electric Infrastructure Information may include information that would not fall within the existing definition of Critical Energy Infrastructure Information.
42

42
For example, while Critical Energy Infrastructure Information must satisfy the four-part definition in amended section 388.113(c)(1), Critical Electric Infrastructure Information must meet the definition in amended section 388.113(c)(2).

26. We agree with Powerex's comment that the Final Rule should only address CEII and not other types of information. In response to Powerex's concerns about a party's due process rights, under the amended CEII regulations the Commission will balance the need to protect critical information with the potential need of parties participating in Commission proceedings to access CEII. For example, the Commission's regulations include a process for parties to access information directly from other parties in a Commission proceeding.
43

43

See
18 CFR 388.112(b)(2) and 388.113(g)(4).

27. In response to comments from TAPS, APPA, and the Trade Associations, the Commission agrees that the CEII NDA should reference the provision in section 215A(d)(1) that CEII is exempt from disclosure under any Federal, State, political subdivision or tribal law requiring public disclosure. We disagree that the State Agency NDA should be eliminated because it reinforces the minimum protections applicable to CEII that the Commission may provide to states as well as provides for additional protections beyond the exemptions in State public disclosure laws.
44

44

See supra
note 27.

28. Finally, the Commission declines to adopt the revision suggested by the Trade Associations to expressly state that the CEII regulations are not intended to supersede other laws, regulations, and agency rules that separately safeguard such data.
45

This Final Rule and adopted CEII amendments do not purport to supersede any other legal authorities other than the regulations and associated materials specifically amended in this Final Rule.

45

See
Trade Associations Comments at 26.

B. Criteria and Procedures for Determining What Constitutes CEII

1. General Criteria and Procedures

NOPR

29. Section 215A(d)(2)(A) requires the Commission to “establish criteria and procedures to designate information as critical electric infrastructure information.” In the NOPR, the Commission proposed criteria and procedures for the handling of CEII consistent with section 215A(d)(2)(A).
46

46
NOPR, 155 FERC ¶ 61,278 at P 16.

Comments

30. Commenters request that the Commission provide more detail on what qualifies as CEII.
47

The Public Interest Organizations, for example, ask the Commission to publish guidelines and criteria for designating information as CEII.
48

The Public Interest Organizations further recommend that the Commission publish “data tables that provide suggested classifications for common data types.”
49

HRC asks that the Commission require entities filing CEII to include a public cover letter providing a description of the facility the information relates to and describing the nature of the submission. HRC also contends that information submitted as CEII should include a more detailed description in eLibrary.
50

HRC contends that this information will better allow the public to understand the basis for

the CEII classification.
51

HRC also requests that the Commission develop a procedure whereby the public can request that the Commission review information at the time of submission to ensure that it was properly submitted as CEII.
52

HRC contends that filing a CEII or FOIA request as a means of triggering the review of CEII classification is burdensome.
53

47
Peak Comments at 8-10; Powerex Comments at 12; APS Comments at 5; APPA Comments at 17; WIRAB Comments at 5.

48
Public Interest Organizations Comments at 4.

49

Id.
at 5.

50
HRC Comments at 2-3.

51

Id.
at 2.

52

Id.
at 3.

53

Id.

31. WIRAB and APS commented that additional designation guidance is needed in order to avoid submitters' over-designation of documents as CEII. Specifically, WIRAB and APS recommend that the Commission establish separate criteria for determining when information qualifies as CEII on the basis of national security, economic security or public health or safety.
54

54
WIRAB Comments at 5; APS Comments at 5.

32. The Trade Associations maintain that the Commission's regulations should explicitly designate as CEII information “related to compliance with the Reliability Standards as critical electric infrastructure information and exempt it from disclosure under 388.113(f).”
55

The Trade Associations assert that a blanket presumption that information regarding Reliability Standards compliance is CEII is necessary because it “may . . . be difficult for a submitter to present,
ex ante,
a clear justification for meeting the critical electric infrastructure information definition for a particular system or asset, especially if the potential for negative effect could also arise from the disclosure of a combination of sets of information that alone may not meet the CEII definition.”
56

55
Trade Associations Comments at 12.

56

Id.
at 11.

33. APPA and the Trade Associations raise concerns about how the designation criteria will apply to DOE.
57

Specifically, they assert that the Commission failed to provide criteria and procedures that would apply to DOE.
58

Additionally, Peak, Public Interest Organizations, and APPA request that the Commission hold a technical conference on the implementation of the new CEII rules as part of the “consultation with the Secretary” required by FPA section 215A(d)(2).
59

57
APPA Comments at 24-25; Trade Associations Comments at 23.

58

Id.

59
Peak Comments at 6-7; Public Interest Organizations Comments at 5; APPA Comments at 25. WIRAB also requests a technical conference to discuss implementation of the FAST Act. WIRAB Comments at 11.

34. Finally, NRC requests that the Commission establish a generic CEII designation that other federal agencies can use to designate information.
60

NRC also recommends that the Commission clarify in the Final Rule that other federal agencies “are to establish their own procedures for identifying CEII on an information-specific basis utilizing the FERC's generic CEII standard.”
61

60
NRC Comments at 1-2.

61

Id.
at 2.

Commission Determination

35. The Commission is not persuaded that more detailed guidance or additional designation criteria in the CEII regulations are necessary. FPA section 215A(a)(2) defines Critical Electric Infrastructure as “a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.” FPA section 215A(a)(3) includes Critical Energy Infrastructure Information within CEII. We believe that the regulations, as proposed, provide adequate guidance for a submitter or Commission staff to determine whether information is CEII and for the CEII Coordinator to make a determination. In addition, the criteria and designation procedures adopted herein are informed by the Commission's experience of implementing and administering the Critical Energy Infrastructure Information regulations over the past fifteen years.

36. The Commission does not agree that the scope of CEII should be modified, as suggested by the Trade Associations, to encompass information “related to compliance with the Reliability Standards.” The Trade Associations' proposal is unduly broad and inconsistent with the FAST Act because it could lead to all infrastructure information, whether critical or not, being treated as CEII. For the same reason, we do not agree that the blanket presumption that information relating to compliance with Reliability Standards is CEII, proposed by the Trade Associations, is appropriate. Like other forms of CEII, however, information on compliance with Reliability Standards may be treated as CEII if the submitter justifies its treatment as CEII under the Commission's regulations.

37. In response to HRC's comments that documents listed as CEII could be better described in eLibrary, the level of detail needed for a document description in eLibrary is better addressed in our submission guidelines rather than in our regulations.
62

62

See
CEII Filing Guide,
https://www.ferc.gov/resources/guides/filing-guide/file-ceii/ceii-guidelines.asp.
The Commission will update the CEII Filing Guide when the proposed regulations become effective.

38. In response to HRC's request for an additional process to obtain a ruling on CEII when it is filed, we believe that such a process is unnecessary, as entities seeking access to information filed as CEII may submit a FOIA or CEII request at any time, including promptly after that information is filed with the Commission. We further conclude that the proposed procedures are adequate for the Commission to process information submitted to the Commission, or generated by the Commission, as CEII.
63

As previously noted, the Commission receives over 7,000 CEII submissions a year; reviewing the information at the time of submission, in the absence of a specific request for that information, would be overly burdensome on the Commission's resources. In response to a CEII request, the CEII Coordinator will review the information to determine whether to designate it as CEII. Further, proposed section 388.113(d)(1)(iv) specifically states that the Commission retains the right to make determinations with regard to any claim of CEII status, at any time.

63

See
amended sections 388.113(c) and (d).

39. In response to the comments from APPA and the Trade Associations, the Commission declines to revise the regulations to identify specific designation criteria and CEII procedures for DOE. Section 215A(d)(3) of the FAST Act provides that information “may be designated” by the Commission and DOE pursuant to the criteria and procedures that the Commission establishes.
64

The FAST Act, however, does not compel DOE to make any changes to its regulations in this regard, and as noted in the NOPR, nothing within the Commission's regulations would limit DOE's ability to designate CEII in accordance with the FAST Act.
65

Furthermore, we do not believe a technical conference is necessary to satisfy the requirement for consultation with DOE in the FAST Act.

64
FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776.

65
NOPR, 155 FERC ¶ 61,278 at P 16 n.12.

40. Although the Commission recognizes that other agencies have an obligation to protect certain information in their custody, the FAST Act does not grant other federal agencies the authority to designate information as

CEII. Critical Electric Infrastructure Information is specifically defined as information “designated as critical electric infrastructure information by the Commission or the Secretary of the Department of Energy pursuant to subsection (d).”
66

Congress's intent to limit the designation authority to the Commission and DOE is reinforced by the fact that only the staff of the Commission and DOE are subject to sanctions for unauthorized release under section 215A(d)(2)(C).
67

However, because NRC has raised valid concerns about the protection of sensitive information of the electric grid in its custody, the Commission revises the amended scope of section 388.113 to state that nothing in this section limits any other Federal agency's ability to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. Further, the section is revised to state that, to the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information (see the last two sentences of paragraph (a) in the regulatory text of section 388.113 in this rule). Nothing in this section limits the ability of any other Federal agency to take all necessary steps to protect information within its custody or control that is necessary to ensure the safety and security of the electric grid. To the extent necessary, such agency may consult with the CEII Coordinator regarding the treatment or designation of such information.

66
FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776.

67

Id.

41. By this change, the Commission does not limit the discretion of other federal agencies to protect sensitive information in their custody but provides a mechanism for agencies to consult with the Commission's CEII Coordinator regarding the treatment or designation of such information as CEII.
68

We believe this change strikes a reasonable balance by recognizing other federal agencies' discretion to protect their information, while adhering to the statutory framework that limits CEII designation authority to the Commission and DOE.

68
For example, the Commission could establish the parameters of the Commission's role with regard to CEII with another federal agency through a Memorandum of Understanding with that agency.

2. Designation of Submissions to the Commission

NOPR

42. The Commission proposed to treat information submitted with a justification for CEII treatment as CEII, unless the submitter is otherwise notified by the Commission.
69

69
NOPR, 155 FERC ¶ 61,278 at P 19.

Comments

43. APS asks that the Commission “deem” information as CEII at the time an entity submits the information to the Commission.
70

HRC and Tacoma Power are concerned that “treating” a submission as CEII is not a designation and, as a result, submitting entities may not be able to assert the FOIA exemption when faced with a records request unless and until the Commission makes a CEII designation determination.
71

Tacoma Power further requests that the Commission develop a process for state entities to receive a CEII designation determination so that state entities may assert any FOIA exemption with certainty.
72

70
APS Comments at 6.

71
HRC Comments at 2; Tacoma Power Comments at 4.

72
Tacoma Power Comments at 4.

44. INGAA, NERC, and the Trade Associations request that the Commission change the comment period afforded to submitters of CEII to respond to a request for CEII from five calendar days to five business days, ten working days, or at least 30 calendar days, respectively.
73

APS and CEA comment that if the Commission determines that particular information is not CEII, the Commission should provide the submitter with an explanation of why the information does not meet the criteria for designation as CEII.
74

The Trade Associations also request that the Commission provide a more detailed explanation in instances when CEII is released over an objection from the submitter of the material.
75

73
INGAA Comments at 4; NERC Comments at 15; Trade Associations Comments at 19.

74
APS Comments at 6; CEA Comments at 6-7.

75
Trade Associations Comments at 19-20.

45. MISO, Trade Associations, CEA, and HRC submitted comments recommending changes to the Commission's processing and evaluation of justification statements that must accompany a submitter's request for CEII treatment. MISO is concerned that the Commission may automatically make information public if the submission fails to meet the Commission's regulations. Thus, MISO recommends that amended section 388.113(d)(1) be revised to make clear that failure to provide the justification or other required information will be considered in the determination of whether the information will be maintained as CEII by the Commission, but it will not result in automatic disclosure of the information.
76

76
MISO Comments at 7.

46. The Trade Associations maintain information submitted to the Commission for designation as CEII that ultimately is determined not to be CEII should not automatically be disclosed to the public because such information may be subject to other laws and regulations restricting disclosure of the information.
77

77
Trade Associations Comments at 25-26.

47. CEA recommends that the Commission provide the submitter with an opportunity to retract a submission and re-submit it with the appropriate justification.
78

78
CEA Comments at 6-7.

Commission Determination

48. As an initial matter, we correct the statement in the NOPR erroneously stating that under our current practice, “the Commission deems the designation on a submission accepted as submitted.”
79

Our current practice is to
treat
information as CEII, and maintain it in our non-public files, when it is submitted with a request for CEII treatment. That practice is reflected in the current and proposed regulations.
80

Under the regulations adopted in this Final Rule information that is submitted will not be
designated
CEII until the CEII Coordinator makes such a determination.

79
NOPR, 155 FERC ¶ 61,278 at P 19.

80

See
amended section 388.113(d)(1)(vi).

49. As to the comments submitted by Tacoma Power, the Commission is not persuaded that a special expedited process for designations in the event a State entity is facing a public records request is needed, because State and local entities may consult with the CEII Coordinator as to whether information that is subject to a State, local, or other type of records request is CEII under the Commission's regulations.
81

81
Section 215A(d)(1)(B) states that Critical Electric Infrastructure Information “shall not be made available by any Federal, State, political subdivision or tribal authority pursuant to any Federal, State, political subdivision or tribal law requiring public disclosure of information or records.” FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776.

50. In response to the comments from APS and CEA about the procedures for informing a submitter of a potential release or re-designation of CEII, the Commission's current practices are sufficient to comply with the FAST Act

and we maintain those practices under the adopted regulations. The current practice is to provide notice to the submitter if a proposed CEII designation will be rejected or if CEII will be released over an objection. The notification will include an explanation as to why the information does not meet the criteria and the submitter will have an opportunity to comment or seek appropriate relief under amended section 388.113(e)(4).

51. The Commission is not persuaded that it is necessary to make the changes proposed by MISO and CEA regarding treatment of information that is filed in a manner that does not meet our regulations. The amended regulations do not mandate automatic disclosure of the information. Furthermore, even if the Commission were to make information public, the Commission will provide notice to the submitter prior to any determination.
82

82

See
amended sections 388.113(d)(1)(iv) and 388.113(e)(3)-(4).

52. The Commission adopts INGAA's proposal to change the comment period from five calendar days to five business days, and will change all references in section 388.113 from “calendar” days to “business” days. Allowing more time is not warranted because the issue of whether to release CEII is relatively limited and, as a general matter, the Commission endeavors to respond to requests for CEII as soon as possible. In addition, the Commission notes that submitters can request an extension of that time-period to submit comments to the Commission.

3. Information Included in NERC Databases

NOPR

53. The Commission proposed that information downloaded by Commission staff from private databases that are accessed pursuant to Commission order or regulation will be maintained as non-public information consistent with the Commission's internal controls.
83

The Commission noted that in response to an information request, it will evaluate whether the information is CEII, proprietary information, or otherwise privileged or non-public and will provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.
84

83
NOPR, 155 FERC ¶ 61,278 at P 17 n.13(citing
Availability of Certain North American Electric Reliability Corporation Databases to the Commission,
Order No. 824, 155 FERC ¶ 61,275 (2016)).

84

Id.

Comments

54. Most commenters support treating data downloaded from the NERC databases as non-public. NERC agrees with the proposal to treat information downloaded from its databases as non-public, but it seeks clarification as to whether the Commission intends to designate the information as privileged and CEII.
85

TAPS requests that if the Commission determines to release database information, the manager of the database and the entity whose data would be released should receive notice and an opportunity to comment.
86

85
NERC Comments at 19.

86
TAPS Comments at 5-7.

55. The Trade Associations recommend that the Commission treat the NERC databases information that Commission staff does not download as inextricably intertwined with downloaded information and thereby treat all of the information on each database as CEII.
87

TAPS raises concerns that information that is contained in a database may not be adequately protected from disclosure, because the data “is not being submitted to the Commission, but rather accessed by the Commission.”
88

87
Trade Associations Comments at 15.

88
TAPS Comments at 6.

CEA requests that the Commission respect Canadian information that may be accessed through any private databases accessible to the Commission.
89

CEA further comments that the Commission's information gathering through other databases be restricted to U.S. facility information only.
90

89
CEA Comments at 4.

90

Id.

Commission Determination

56. The Commission adopts the NOPR proposal to treat information
downloaded
from NERC databases as non-public
91

and to evaluate whether it should be designated as CEII in response to a request for the information or if the Commission determines such information should be disclosed.
92

In addition, because the CEII designation only applies to information that is submitted to or generated by the Commission, information that Commission staff accesses and reviews, but never takes custody of, cannot be designated as CEII. Therefore, the Commission disagrees with the proposal to treat all of the information in an accessed database as inextricably intertwined CEII.
93

91
This is consistent with the statement in Order No. 824 that the Commission “will take appropriate steps, as provided for in our governing statutes and regulations, in handling such information.” Order No. 824, 152 FERC ¶ 61,208 at P 22.

92
The discussion above and our determination address the Trade Associations' request for clarification of Order No. 824 in Docket No. RM15-25-001.

93
By the same token, information that is not downloaded cannot be disclosed under a FOIA request as the Commission would not possess the information.

57. The Commission clarifies that information downloaded by the Commission or its staff from a non-public NERC database will be treated as non-public information and will be afforded the same treatment as CEII. Thus, in the event the Commission receives a request for the information or the Commission determines such information should be disclosed, the Commission will “provide the owner of the database or information (as appropriate) with an opportunity to comment on the request.”
94

In response to TAPS's comments, we clarify that, where practicable, we will notify the database owner and the information owner.
95

94
NOPR, 155 FERC ¶ 61,278 at P 17 n.13.

95
We note that section 1505 of NERC's Rules of Procedure requires NERC, unless otherwise directed by the Commission or its staff, to provide notice to submitting entities in response to requests for the submitting entities' information by the Commission.

58. Finally, as to CEA's comment regarding Canadian information on other databases, we believe that CEA's request goes beyond the scope of this rulemaking proceeding, which is limited to amending the Commission's regulations regarding CEII.
96

96
The Commission has addressed the scope of information covered by specific data collection requirements in individual proceedings. For example, in Order No. 824, concerning Commission access to certain NERC databases that include data about both U.S. and Canadian facilities, the Commission revised its regulations to indicate that “Commission access will be limited to data regarding U.S. facilities.” Order No. 824, 155 FERC ¶ 61,275 at P 38.

4. Designation of Commission-Generated Information

NOPR

59. For Commission-generated information, the NOPR explained that the CEII Coordinator, after consultation with the appropriate Commission Office Director, will determine whether the information meets the definition of CEII.
97

The CEII Coordinator will then determine how long the CEII designation should last and, as appropriate, whether to make any re-designation.
98

97
NOPR, 155 FERC ¶ 61,278 at P 21.

98

Id.

Comments

60. The Trade Associations request that the Commission establish a process in which appropriate stakeholders may

participate in the Commission's CEII designation determinations for Commission-generated information.
99

The Trade Associations assert that whether the information is submitted to the Commission or not, “owners and operators of that critical infrastructure who will be faced with defending such a potential attack deserve to have input into the determination of whether or not such information should be disclosed.”
100

99
Trade Associations Comments at 24.

100

Id.

Commission Determination

61. The Commission determines that there is no need for stakeholder participation in the designation of Commission-generated information. The Commission has the expertise and experience to make determinations about whether Commission-generated information is CEII. And as a practical matter, it would not be appropriate in some circumstances for stakeholders to be privy to Commission-generated information that qualifies as CEII. For example, Commission-generated CEII may contain information that is otherwise non-public or privileged. To the extent that an entity believes that a Commission-generated document contains CEII about its facility, the entity is not precluded from raising that concern with the CEII Coordinator.

5. Segregable Information

NOPR

62. The NOPR recognized that information submitted to the Commission may contain parts that are CEII and parts that may not be CEII. As a result, the NOPR proposed to require entities submitting CEII and Commission staff who generate CEII, to the extent feasible, to segregate the CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) from non-CEII at the time of submission or staff's generation, respectively.
101

101
NOPR, 155 FERC ¶ 61,278 at P 22.

Comments

63. HRC and Powerex support the requirement to segregate CEII from non-CEII and encourage efforts to prevent the over-classification of information.
102

TAPS asks the Commission to confirm that submitting a redacted public version of a filing satisfies the requirement to segregate CEII.
103

Powerex asks the Commission to clarify that derivative analyses performed by governmental entities or their contractors that use or rely on CEII, without more detail, should not be designated as CEII solely based on the fact the analysis relies on or uses CEII.
104

102
HRC Comments at 3; Powerex Comments at 16-17.

103
TAPS Comments at 14.

104
Powerex Comments at 16.

Commission Determination

64. The Commission clarifies that submitting a properly redacted public version of information submitted as CEII meets the requirement established in section 215A(d)(8). Moreover, derivative analyses that use or rely on CEII, without actually containing or disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII.

6. Duration of Designation

NOPR

65. Section 215A(d)(9) provides that information “may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.”
105

The NOPR stated that the five-year designation period will commence upon submission, and the expiration of the five-year period will not automatically trigger the public release of the information unless the Commission determines it is appropriate to do so.
106

The NOPR also stated that the Commission will make a re-designation determination when an entity requests the information; when staff determines a need to remove the designation; or when a submitter requests that the information no longer be treated as CEII.
107

Consistent with current practice, the NOPR proposed that a NDA will require protection of CEII past the expiration of the CEII designation marked on the information and that the recipient of CEII from the Commission must receive prior authorization from the Commission before making any disclosure.
108

105
FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 1776.

106
NOPR, 155 FERC ¶ 61,278 at P 18 n.14 and P 24.

107

Id.

108

Id.
P 26.

66. In the NOPR, the Commission proposed removing the CEII designation when the information no longer could impair the security or reliability of not only the bulk-power system or distribution facilities but also other forms of energy infrastructure.
109

The Commission stated that the Commission would provide notice to the submitter “in the instance where the Commission takes the affirmative step to rescind the designation.”
110

109

Id.
P 27.

110

Id.

Comments

67. Several commenters support the proposal to maintain information as non-public after CEII designations marked on the information expire.
111

However, Peak requests that the Commission determine at the time of the designation whether the data will lose its protection after the five-year term ends and recommends creating designation categories that include designation timeframes.
112

The Trade Associations and APPA ask the Commission to automatically re-designate information, absent objection.
113

Tallgrass requests that a designation remain for the life of a pipeline facility.
114

INGAA requests that the Commission never un-designate CEII related to pipeline facilities on its own initiative or unilaterally as long as the facility is in operation.
115

111

See, e.g.,
ITC Comments at 2-3; INGAA Comments at 3; NRECA Comments at 9.

112
Peak Comments at 10-11 (recommending categories such as “transmission and generation outage data, generator-specific forecast data, transmission facility and load status and measurements, specific facility modeling data, and device lists”).

113
Trade Associations Comments at 21-22; APPA Comments at 20.

114
Tallgrass Comments at 3.

115
INGAA Comments at 3.

68. APS requests clarification on whether the criteria for re-designating CEII are the same as the criteria used for the initial CEII designation.
116

116
APS Comments at 12.

69. NRECA and ITC assert that the NOPR is unclear with respect to the notice and comment provisions pertaining to a determination to remove CEII designations. In particular, they urge the Commission to clarify that submitters will receive notice, an opportunity to comment, and appeals rights prior to any determination to remove a CEII designation and prior to any disclosure of the information.
117

ITC also states that the NOPR proposal to “notify the person who submitted the document and give the person an opportunity (at least five calendar days) in which to comment in writing prior to the removal of the designation” is insufficient notice. ITC asks the Commission to provide notice and an opportunity to comment not only to the “person who submitted the document” but also to the organization on whose

behalf the person submitted the document.
118

117
NRECA Comments at 11; ITC Comments at 3-4.

118
ITC Comments at 3.

70. APPA requests that the Commission revise the language in amended section 388.113(e) to ensure that designations made by DOE cannot be removed by the Commission.
119

119
APPA Comments at 26.

Commission Determination

71. The Commission adopts the NOPR proposal to treat expired CEII as non-public until a re-designation determination is made. Such a process is supported by the majority of commenters and is reasonable given the large volume of CEII presently in the Commission's files and anticipated to be filed. Consistent with the NOPR's intent, the Commission will modify the regulatory language in amended section 388.113(e) to indicate that the Commission will treat information as non-public after the CEII designation has lapsed; that no information will be released as non-CEII unless the Commission decides to release the information; and that notice and opportunity for comment will be provided to the submitter prior to any determination that the CEII designation of a submitted document should be removed.

72. We do not adopt the recommendations to automatically re-designate information, designate by category, or designate for the lifetime of a facility. Blanket designations are inconsistent with FPA section 215A(d)(9), which requires the Commission to specifically re-designate information.
120

120
Section 215A(d)(9) states that information “may not be designated as critical electric infrastructure information for longer than 5 years, unless specifically re-designated by the Commission or the Secretary, as appropriate.” FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

73. In response to ITC's comments that providing notice to the person who submitted the document is insufficient, we clarify that the Commission will provide the person and/or the organization identified on the submission notice an opportunity to comment as well as appeal rights prior to any determination to rescind a CEII designation or release the information.
121

121
The Commission will use the relevant service list, where appropriate, to determine the appropriate recipient.

74. With respect to APPA's comments regarding the Commission's ability to remove a DOE designation, we clarify that the Commission does not intend to remove any designations that DOE may make. With respect to APS's request for clarification regarding re-designations, we clarify that the regulations adopted herein do not differentiate between the processes for designating or re-designating information as CEII.

7. Judicial Review of Designation

NOPR

75. The Commission proposed to require a person seeking to challenge a Commission designation determination to file an administrative appeal with the Commission's General Counsel prior to seeking judicial review in federal district court under section 215A(d)(11).
122

122
NOPR, 155 FERC ¶ 61,278 at P 28.

Comments

76. HRC contends that the Commission's administrative appeal requirement should not be mandatory.
123

NRECA asserts that the Commission does not have a legal basis for the administrative appeal requirement.
124

NRECA also recommends that the regulations specify the timeframes in which appeals can be pursued; a timeframe for when a decision on the appeal should be rendered; and that the designation will remain in place until legal challenges have been exhausted.
125

123
HRC Comments at 3.

124
NRECA Comments at 11; HRC Comments at 3-4.

125

Id.

77. NRECA contends that the Commission must revise the delegation authority provisions in section 375.313 to allow the General Counsel to hear and decide an administrative appeal.
126

126
NRECA Comments at 12.

Commission Determination

78. With respect to NRECA and HRC's comment, Congress directed the Commission to establish criteria and procedures to designate information as CEII, and the mandatory appeal to the Commission's General Counsel is a procedure that will assist in proper designation of such information. Requiring a party to exhaust administrative remedies prior to taking a matter to court is a standard and basic function of administrative law.
127

The administrative appeal process gives the Commission an opportunity to correct any error and to ensure that Commission policy has been properly complied with. This process creates efficiency in the administrative process and promotes judicial economy. In addition, the current FOIA and CEII process provides for administrative appeal.
128

127

See Hidalgo
v.
FBI,
344 F.3d 1256, 1258-59 (D.C. Cir. 2003) (holding that “exhaustion of administrative remedies is generally required before filing suit in federal court so that the agency has an opportunity to exercise its discretion and expertise on the matter and to make a factual record to support its decision”).

128
NOPR, 155 FERC ¶ 61,278 at P 28.

79. In response to NRECA's suggestion regarding appeal timeframes, the Commission will revise the amended regulations at section 388.113(j) to provide more specificity about the process for submitting an administrative appeal. After receiving a determination that information no longer qualifies as CEII, a submitter may appeal that determination. To make an appeal, the submitter must file a notice of appeal to the General Counsel, copying the CEII Coordinator, within 5 business days of the date of the determination.
129

A statement in support of the appeal (a statement providing applicable facts and legal authority) must be submitted to the General Counsel within 20 business days of the date of the determination. The appeal will be considered received upon receipt of the statement in support of the appeal. A determination denying a request for disclosure or denying a request to designate a document as public may also be appealed. A notice of appeal is not required for these determinations because information would not be disclosed under the challenged decision. However, the requester must submit an appeal within 20 business days of the date of the determination by submitting its statement in support of its appeal to the Commission's General Counsel.
130

The General Counsel or the General Counsel's designee will make a determination with respect to any appeal within 20 business days after the receipt of the appeal, unless extended pursuant to section 388.110(b)(1), which will equally apply to CEII for purposes of appeals.

129
Requiring the submitter to inform the Commission of its intent to appeal within 5 business days will allow the Commission to know sooner than later whether the submitter plans to challenge the decision and, if not, allow the Commission to disclose the information sooner.

130
The Trade Associations suggest that the Commission should issue an order on appeal of any denial of an information owner's objections to disclosure of CEII pursuant to a NDA. Trade Association Comments at 20. Under our current practice, the decision to disclose CEII pursuant to a NDA is appealable directly to a district court under 5 U.S.C. 552(a)(4)(B). There is no need to establish an additional procedure under the amended regulations that requires the Commission to issue an order on appeal.

80. To avoid any uncertainty, the Commission will amend section 375.309 to include a provision to make clear that the Commission has delegated to the General Counsel authority to make determinations on behalf of the

Commission on appeals of designations and determinations regarding CEII.

C. Duty to Protect CEII

NOPR

81. The Commission proposed revisions to strengthen the handling requirements for Commission employees and external recipients of CEII. With respect to Commission staff, the Commission proposed to add section 388.113(h) to require Commissioners, Commission staff, and Commission contractors to comply with the Commission's internal controls.
131

For external recipients of CEII, the Commission proposed requiring requesters to provide specific information to demonstrate a legitimate need for the information and to include a signed statement attesting to the accuracy of the information provided in any CEII request.
132

The Commission also proposed that all NDAs minimally require that CEII: (1) will only be used for the purpose it was requested; (2) may only be discussed with authorized recipients; (3) must be kept in a secure place in a manner that would prevent unauthorized access; and (4) must be destroyed or returned to the Commission upon request. The Commission also proposed that the NDA make clear that the Commission may audit compliance with the NDA.

131
NOPR, 155 FERC ¶ 61,278 at P 30.

132

Id.
PP 33-34. Specifically, the Commission proposed to require a requester to demonstrate: (1) the extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) whether the information is needed expeditiously.
Id.

Comments

82. The Trade Associations request that the Commission provide further details of the content and nature of the internal controls and include them in the Commission's regulations.
133

MISO agrees that the Commission should have internal controls and notes that the internal controls should be enforced.
134

133
Trade Associations Comments at P 36-37. The Trade Associations also state that the Commission should consider expounding on recommendations from the DOE IG.

134
MISO Comments at 8.

83. Several commenters request that the Commission expand the list of minimum requirements for a NDA. MISO and NRECA note that the NOPR recognizes the need for requesters to protect CEII after the designation has lapsed and recommend that the duty to protect expired CEII be included in the minimum NDA requirements.
135

MISO, the Trade Associations and APS recommend that the Commission require recipients to report all unauthorized disclosures.
136

NERC recommends adding to the NDA a requirement that a recipient must destroy or return CEII by specific deadlines.
137

NERC and the Trade Associations request that submitters be able to enforce the terms of a NDA that covers the submitter's CEII.
138

135
MISO Comments at 8; NRECA Comments at 10.

136
MISO Comments at 9; Trade Associations Comments at 26; APS Comments at 10.

137
NERC Comments at 14.

138
NERC Comments at 14; Trade Associations Comments at 26.

84. In addition to the NDA recommendations stated above, the Trade Associations request that the Commission add the following clauses to the NDA: (1) Recipients of CEII shall have information protection policies and procedures to protect the CEII; and (2) an officer of the recipient's organization, on behalf of the organization, as well as all individuals who will have access to the CEII, shall execute the NDA, which shall specify that the individuals and organization face sanctions for failure to honor the terms of the NDA.
139

139
Trade Associations Comments at 26.

85. APS encourages the Commission to review the current NDA for potential gaps, such as the lack of an obligation to treat CEII with the same degree of care as a requester would treat its own confidential or proprietary information.
140

NRECA asks the Commission to clarify that a NDA is required when an entity receives CEII after the designation expires.
141

140
APS Comments at 9-10.

141
NRECA Comments at 10.

86. Peak seeks clarification regarding the requirements for keeping CEII in a secure place and manner.
142

Peak explains that recipients of CEII may have different views of what constitutes a “secure place.”
143

142
Peak Comments at 14-15.

143

Id.

87. The Trade Associations recommend that the Commission adopt a monitoring and enforcement process to discourage unauthorized disclosures and ask for additional language clarifying that “any person or entity found to have used or disclosed CEII in a manner inconsistent with the NDA will lose its access to CEII for an extended period of time.”
144

The Trade Associations and NRECA suggest that the Commission determine that noncompliance with the NDA would subject an individual to penalties of up to $1 million per violation per day.
145

144
Trade Associations Comments at 34.

145
Trade Associations Comments at 35; NRECA Comments at 16-17.

88. NERC requests that the Commission ensure that requesters have not been convicted of criminal activity by performing background checks, reviewing watch lists, and verifying security clearances to prevent inadvertent disclosures of CEII to a person with a criminal record or who is under investigation or on a terrorist watch list.
146

146
NERC Comments at 13-14.

89. NERC also proposes that the Commission include evidentiary criteria to determine whether a requester of CEII is legitimate, and the Trade Associations ask the Commission to conduct risk assessments on all requesters.
147

147
NERC Comments at 12-14; Trade Associations Comments at 33.

90. APS urges the Commission to require all requests to include at least two business references and the submission of documentation of authority for organizational requesters.
148

Peak requests that if a CEII request is not for participation in a specific proceeding, the requester should be required to include in its statement of need a “reliability or societal benefit.”
149

148
APS Comments at 7-8.

149
Peak Comments at 14.

Commission Determination

91. We disagree with the Trade Associations' recommendation that we provide additional details regarding internal controls and that we include internal controls in the Commission's regulations. The NOPR stated that the internal controls will address “how sensitive information, including CEII, should be handled, marked, and kept.”
150

We find that this statement provides sufficient details regarding the nature of the internal controls. We also conclude that internal controls should not be specified in the Commission's regulations to allow Commission staff the flexibility to revise such controls as needed.
151

150
NOPR, 155 FERC ¶ 61,278 at P 30.

151
In developing this Final Rule and the internal controls, the Commission has been cognizant of the recommendations of the DOE Inspector General Report from January 30, 2015 as well as the Commission's earlier response thereto, which are a matter of public record.
See
Department of Energy, Office of Inspector General, Inspection Report, Review of Controls for Protecting Nonpublic Information at the Federal Energy Regulatory Commission, DOE/IG-0933 (January 2015),
http://energy.gov/ig/downloads/inspection-report-doeig-0933.

92. Amended section 388.113(h)(2) only includes “minimum” requirements

for a NDA and is not intended to be exhaustive or preclude other requirements. Under certain circumstances the Commission may add additional provisions to the NDA and submitters may request that additional provisions be added to the NDA.

93. In response to MISO's and NRECA's comments, the Commission will amend section 388.113(h)(2) to require a recipient of CEII under a NDA to protect the CEII after a designation lapses as part of the list of minimum requirements of a NDA. In response to the comments by MISO, the Trade Associations and APS, we will also amend section 388.113(h)(2) to add an obligation to require CEII recipients to promptly report all unauthorized disclosures of CEII to the Commission.

94. In response to NRECA's concern, the Commission clarifies that a requester seeking information past the expiration of the CEII designation marked on the information must still pursue the information through the CEII or FOIA processes. We read NRECA's comments to apply to situations where an entity requests information that has been submitted to the Commission more than five years prior to the request and the Commission has not made a determination to re-designate the information. In these situations, the CEII Coordinator will make a re-designation determination as part of the response to a request seeking access to information that has a designation determination older than five years. If the information is re-designated as CEII, then it will be processed pursuant to the Commission's requirements for CEII.

95. The Commission is not persuaded by Peak's comments that there is a need to clarify what constitutes maintaining CEII in a secure place. We believe that a “secure place,” as articulated in the NDA, has a well-understood meaning,
i.e.
safe or free from unauthorized access or a risk of loss.

96. The Commission believes that it has sufficient authority to enforce the terms of the NDA and, as a result, it is unnecessary to confer on NERC or others authority to enforce the terms of a NDA.

97. In response to the comments of the Trade Associations and NRECA, the Commission notes that the FAST Act does not require the Commission to develop sanctions for external recipients of CEII. In any event, the general CEII NDA already states that a violation of the NDA may result in civil sanctions for an external recipient of CEII, and it will continue to do so. It is not necessary to list all the various civil sanctions that may apply, as each matter would be reviewed on its own facts. For these reasons, we also decline to adopt the Trade Associations' recommendation that we add to the minimum requirements of a NDA a provision that CEII recipients may be sanctioned by losing access to CEII for an extended period of time.

98. The Commission agrees that it is important to ensure that requesters of CEII do not pose security risks. CEII requesters have historically fallen into different categories, including individuals known to the Commission with no known risk.
152

The Commission will continue the practice of requiring information needed to verify the legitimacy of a requester on an as-needed basis. As such, there is no need for a CEII requester to demonstrate that there is a “reliability or social benefit” to the request. We believe that our procedures have adequately assessed whether requestors should receive CEII. In addition, we propose additional requirements for a requester to obtain CEII information. Thus, given these procedures, it is not necessary to mandate specific background check criteria in the regulations. Moreover, while the current request form asks for a business reference, we are not persuaded that such a submission is necessary in all instances or that two references are necessary.
153

152
Requests are typically received from public utilities, gas pipelines, hydro developers, academics, landowners, public interest groups, researchers, renewable energy organizations, and consultants.

153
Electronic CEII Request Form,
http://www.ferc.gov/resources/guides/filing-guide/ceii-request.asp.

D. Sanctions

NOPR

99. Section 215A(d)(2)(C) of the FPA requires the Commission to “ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or DOE who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized under this section.”
154

The Commission proposed sanctioning unauthorized disclosures of CEII by Commission personnel and further noted that DOE will have responsibility for sanctions for unauthorized disclosures by its officers and employees.
155

The Commission also proposed to refer any misconduct by the Chairman or Commissioners to the DOE Inspector General (DOE IG).
156

154
FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

155
NOPR, 155 FERC ¶ 61,278 at P 36.

156

Id.

Comments

100. Several commenters, including APPA and the Trade Associations, point to the absence of stated sanctions for Commissioners in the NOPR and request that the Commission consider whether to impose civil sanctions under section 316A of the FPA and criminal penalties under section 316(b) of the FPA.
157

APPA also recommends that the Commission consider referring unauthorized CEII disclosures by Commissioners to the Department of Justice (DOJ) and that the Commission coordinate with DOE to outline a new or cite an existing procedure that DOE can utilize to sanction its employees.
158

MISO suggests that the Commission's General Counsel be tasked with referring any willful, unauthorized disclosures to the DOE IG.
159

NRECA asks that a mechanism be put in place for the public to make a referral to the DOE IG if they are aware of any misconduct.
160

MISO and NRECA recommend that the Commission revise its proposed rule to make clear that the Commission “shall” refer any misconduct to the DOE IG and to allow the public to refer matters to the DOE IG.
161

157

See
Trade Associations Comments at 40 (noting that CEII protections adopted in the FAST Act were adopted in the context of what many considered to be an inappropriate disclosure of CEII by a former FERC Commissioner);
see also
APPA Comments at 28. APPA states that the Commission has authority to impose civil penalties against “any person” who violates any provision of any Commission rule and may use criminal penalties under FPA section 316(b) for knowing and willful violations, by “any person” of Commission rules or regulations under the FPA.

158
APPA Comments at 27, 29. APPA also asserts that a DOE employee sanctioned for unauthorized disclosure may be able to challenge their sanction “on grounds that it was not promulgated by the Commission, as directed by Congress.”

159
MISO Comments at 10.

160
NRECA Comments at 16.

161
MISO Comments at 10; NRECA Comments at 16.

Commission Determination

101. As discussed below, we conclude that the sanctions adopted in this Final Rule, as well as other reforms adopted prior to the passage of the FAST Act, provide sufficient deterrents to the unauthorized disclosure of CEII.

102. First, we note that, in addition to the changes adopted in this Final Rule, the Commission has recently made a number of changes to its internal procedures to ensure the protection and security of CEII.

103. The Commission has revised its security classification and ethics training to ensure that Commission employees are aware of their responsibility to protect sensitive

nonpublic information. The Commission also has strengthened its protection of CEII and other sensitive, non-public information. For example, the Commission conducted a comprehensive review of its internal information governance procedures, which informed the development of the internal controls referenced in this Final Rule. We believe that these reforms should help protect against unauthorized disclosure of CEII.

104. The Commission has also taken steps to ensure that there are appropriate sanctions in place for certain persons who knowingly and willfully disclose CEII without authorization. With respect to former employees and Commissioners, the Commission has strengthened certain requirements applicable to departing employees and Commissioners by requiring them to certify that they are not unlawfully removing records from the agency. This certification form also identifies and requires a departing employee or Commissioner to acknowledge the potential criminal penalties associated with the unlawful removal or destruction of federal records. While these changes pre-date the passage of the FAST Act, they are an important component of the Commission's ongoing efforts to protect against improper disclosure of CEII.

105. As to existing Commission officers, employees, and agents, we conclude that the sanctions adopted in this Final Rule are appropriate, as they provide for possible dismissal from federal service and criminal prosecution for improper disclosure of CEII. These sanctions should serve as a deterrent to, and punishment for, improper activity.

106. With respect to Commissioners, we believe it is appropriate that violations be referred to the DOE IG, as that office is equipped to investigate a Commissioner's actions and impose sanctions on a Commissioner through an independent process outside of the Commission's enforcement process.
162

For example, it is within the DOE IG's discretion after concluding its investigation to refer a matter to the DOJ for criminal prosecution. Upon becoming aware of a potentially improper disclosure of CEII, the Designated Agency Ethics Official (DAEO) will oversee an examination of those circumstances. If there is reason to believe that an improper disclosure has occurred, the DAEO will refer the matter to the DOE IG.

162
We note that no commenter has indicated that the DOE IG has insufficient tools to investigate and, as appropriate, pursue sanctions for a Commissioner.

107. Finally we conclude that there is no need to add a mechanism to our regulations for the public to make a referral to the DOE IG, as the DOE IG has an existing hotline in place for the public.
163

The Commission will also continue to defer to DOE as to what sanctions would be appropriate for DOE officers and employees.

163

See
DOE IG Hotline,
http://www.energy.gov/ig/services.

E. Voluntary Sharing of CEII

NOPR

108. Section 215A(d)(2)(D) of the FPA requires the Commission, taking into account standards of the Electric Reliability Organization, to facilitate voluntary sharing of critical electric infrastructure information. The statute, specifically, directs the Commission to facilitate voluntary sharing with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers established pursuant to Presidential Decision Directive 63; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission.
164

164
FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776.

109. The Commission proposed that it would voluntarily share Commission-generated CEII and CEII submitted to the Commission with individuals or organizations when there is a need to ensure that energy infrastructure is protected.
165

Under this proposal, the Commission may voluntarily share CEII without receiving a request for the CEII.
166

However, the NOPR proposed that all voluntarily shared CEII would be shared subject to an appropriate NDA or Acknowledgement and Agreement.
167

Additionally, the NOPR proposed to require an Office Director or his designee to consult with the CEII Coordinator before voluntarily sharing CEII.
168

165
NOPR, 155 FERC ¶ 61,278 at PP 37-38, 40.

166

Id.
P 38.

167

Id.
P 40.

168

Id.
P 39.

110. In the NOPR, the Commission also noted that it retains the discretion to release information as necessary for other federal agencies to carry out their jurisdictional responsibilities.
169

169

Id.

111. The NOPR also proposed that the Commission may impose additional restrictions on how voluntarily shared CEII may be used and maintained.
170

Where practicable, the Commission proposed providing notice of its voluntary sharing of CEII to the submitter of the CEII.
171

170

Id.
P 41.

171

Id.
P 42. The Commission noted that it may not be practicable to provide notice to the submitter in instances where voluntary sharing is necessary to maintain infrastructure security, to address a potential threat, or in other exigent circumstances.

Comments

112. Several commenters observe that the NOPR only addressed the Commission's voluntary sharing of CEII and did not establish guidelines for the voluntary sharing of CEII “with, between, and by” other entities.
172

Powerex requests that the Commission facilitate the sharing of CEII between and by owners, operators, and users of the critical electric infrastructure, while still adequately safeguarding CEII.
173

The Public Interest Organizations and WIRAB recommend that the Commission adopt a “white list” of CEII requesters that the Commission determines do not pose a risk of unauthorized disclosure.
174

They also contend that the Commission should adopt a universal NDA to encourage more sharing between and by non-Commission entities.
175

WIRAB also seeks standardization of NDAs used by NERC, regional entities, and the owners and operators of Critical Electric Infrastructure in the United States.
176

172

See, e.g.,
Peak Comments at 5-6; Powerex Comments at 13-14; APPA Comments at 31; NRECA Comments at 13.

173
Powerex Comments at 13-15.

174
Public Interest Organizations Comments at 8-9; WIRAB Comments at 9.

175

Id.

176
WIRAB Comments at 10.

113. The Joint RTOs (ISO New England, Inc. and Southwest Power Pool, Inc.) suggest that the Commission facilitate the sharing of CEII by permitting regional transmission organizations (RTOs), independent system operators (ISOs), and other entities with FERC-approved tariffs or similar agreements to share CEII “between the entities relying on their tariff information-handling commitments.”
177

In response, PJM states that the Commission should reject the Joint RTOs' proposal, arguing that it is incomplete and overbroad and fails to acknowledge results achieved through the current sharing of CEII.
178

The Joint RTOs, in reply comments, state that their proposal would simply allow ISOs, RTOs, and other entities with

Commission-approved tariffs that have planning and operations responsibilities to use those tariffs to facilitate information-sharing.
179

177
Joint RTOs Comments at 4. MISO also suggests the Commission encourage sharing between planning authorities and transmission planners.
See
MISO Comments at 10.

178
PJM Reply Comments at 2.

179
Joint RTOs Reply Comments at 2.

114. NERC generally supports the Commission's proposal to facilitate voluntary information sharing with NERC, regional entities and information sharing and analysis centers. NERC, nonetheless, requests that the Commission, under appropriate circumstances, share CEII with the Electricity Information Sharing & Analysis Center (E-ISAC) when voluntarily sharing CEII with a governmental entity.
180

NERC asks that the voluntary sharing process include coordination between the CEII Coordinator and certain Commission office staff prior to any disclosure.
181

180
NERC Comments at 9.

181

Id.

115. APS, the Trade Associations and CEA ask for additional criteria as to how and when the Commission will voluntarily share information.
182

182
APS Comments at 13; Trade Associations Comments at 27; CEA Comments at 5.

116. APPA asserts that FPA 215A(d)(2)(D) directs the Commission only to facilitate voluntary sharing of CEII among electricity subsector stakeholders—not to preemptively share CEII with interested parties.
183

APPA asserts that when the Commission voluntarily shares submitted information, it effectively forces the entity that submitted the information as CEII to share its information with others, which may reduce the incentive for the entity to voluntarily share CEII with the Commission.
184

APPA recommends that the Commission designate E-ISAC and any other appropriate Information Sharing and Analysis Organizations (ISAOs) as forums through which CEII can be shared under FPA 215A, and to apply the liability protections of FPA section 215A(f)(3) to those entities.
185

APPA also recommends that the Commission provide protections like those that are utilized by other federal agencies to facilitate information sharing activity.
186

183
APPA Comments at 30.

184

Id.

185
APPA Comments at 31-32.

186

Id.
at 31-32. For example, APPA proposes that the Commission allow for “source anonymizing” shared CEII or to adopt DHS's Traffic Light Protocol to ensure information is shared with the correct audience.

117. The Trade Associations request that the regulations explicitly state that the voluntary sharing of CEII is limited to instances where the Commission has determined that there is a need to “ensure that energy infrastructure is protected.”
187

187
Trade Associations Comments at 27-28.

118. CEA requests that the Commission include language clarifying that the Commission will make every reasonable effort to provide advance notice before sharing CEII and will provide after-the-fact notice if prior notice is not practical.
188

MISO recommends that the Commission adopt regulatory language indicating that “when prior notice is not given, submitters of CEII shall receive notice of a limited release of CEII as soon as practicable.”
189

NRECA requests that the Commission clarify that any disclosure by the Commission on the basis of “voluntary sharing” must be subject to the same notice, comment, and appeal rights provisions that are afforded to submitters in response to CEII requests.
190

188
CEA Comments at 6. NRECA also references the need to provide notice as soon as possible, even if such notice is after the disclosure.
See
NRECA Comments at 12.

189
MISO Comments at 11.

190
NRECA Comments at 12-13.

119. The Trade Associations state that the proposed regulations could be strengthened by: (1) Limiting and defining the circumstances where notice would “not be practicable”; and (2) allowing the submitters an opportunity to provide comments protesting the release of information the Commission proposes to voluntarily share.
191

191
Trade Associations Comments at 30.

120. Finally, TAPS requests that the Commission revise its delegations to reflect the NOPR's proposal that Office Directors will engage in voluntary sharing.
192

192
TAPS Comments at 12-13.

Commission Determination

121. Many of the commenters misapprehend how CEII may be voluntarily shared under the FAST Act or otherwise seek to expand the Commission's CEII sharing program in ways that neither the FAST Act nor the NOPR contemplated. Under FPA section 215A(a)(3), CEII is limited to information that is submitted to, or generated by, the Commission and designated as such by the Commission (or information submitted to, or generated by DOE, and designated as such by DOE).
193

In voluntarily releasing CEII to a person, the Commission imposes obligations on that person through a NDA. However, the Commission's CEII rules do not, and are not intended to, address information that an entity has unilaterally determined to be CEII and never submitted to the Commission.
194

In addition, the Commission's regulations do not cover an entity that has submitted CEII to the Commission but intends to share the same information with others outside of the Commission's processes. To be clear, an entity that receives CEII from the Commission is subject to the restrictions in the applicable NDA, including restrictions on use and disclosure. However, an entity that submitted the information to the Commission is not subject to a NDA and, as a result, the Commission's rules do not apply to how that entity may want to share its information.
195

Moreover, an entity may have information that could qualify as CEII, but such information is not CEII under the Commission's regulations unless it has been submitted to the Commission pursuant to the Commission's CEII regulations and the Commission has determined it to be CEII.

193
FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1773 (“critical electric infrastructure information means information . . . generated by or provided to the Commission or other Federal agency . . . that is designated as critical electric infrastructure information by the Commission or the Secretary pursuant to subsection (d)”).

194
As CEII information has to be designated by the CEII Coordinator or DOE Secretary, information that an entity creates and maintains without providing to the Commission has not been formally designated as CEII.

195
However, other concerns may influence how the entity shares its own information with others.

122. The Final Rule facilitates voluntary sharing by allowing the public to request CEII and by adding to the Commission's regulations a process whereby staff may share CEII in a proactive manner with a variety of entities. The Commission agrees with PJM's comments that existing non-public voluntary sharing mechanisms within the energy industry are sufficient to encourage sharing information among the different groups and therefore there is no need for the Commission to establish requirements for sharing within the industry through tariff revisions or otherwise.
196

It is also unnecessary to adopt Public Interest Organizations' and WIRAB's recommendation that the Commission establish “whitelists” for third parties to use or to require entities sharing information outside of the Commission's CEII process to adopt a particular NDA.

196
Section 215A(d) requires the Commission “to promulgate [-] regulations as necessary” to,
inter alia,
“facilitate voluntary sharing of critical electric infrastructure information.” FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. The FAST Act, therefore, affords the Commission with discretion in this regard and, at least implicitly, recognizes that the Commission may, identify, encourage and support existing processes to facilitate the voluntary sharing of CEII.

123. The Commission agrees with NERC and APPA that the plain language of the statute expressly provides for the voluntary sharing of information with entities like E-ISAC and other ISAOs. Section 215A(d)(2)(iv) concerns the voluntary sharing of CEII with, between, and by “information sharing and analysis centers established pursuant to Presidential Decision Directive 63.” Pursuant to that provision, the Commission anticipates voluntary sharing of information with, between and by E-ISAC and other ISAOs under the appropriate circumstances. Under our current NDAs, CEII recipients may share CEII with other individuals covered by a NDA for the same information.
197

When information is provided in accordance with section 215A(d) the provisions for release from liability in section 215A(f)(3) would apply.

197

See, e.g.,
Critical Energy Infrastructure Information General Non-Disclosure Agreement,
https://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf
(“A Recipient may only discuss CEII with another Recipient of the identical CEII. A Recipient may check with the CEII Coordinator to determine whether another individual is a Recipient of the identical CEII.”).

124. The Commission disagrees with APPA that E-ISAC or another ISAO should be designated as a forum to share CEII. The FAST Act does not specify that the Commission should designate E-ISAC, another ISAO, or any other entity as a forum through which CEII can be shared under section 215A. In fact, a plain reading of the statute indicates that Congress designated the Commission as the entity to facilitate this sharing. As such, the Commission declines to take the recommendation of APPA.

125. We disagree with APPA's assertions that the voluntary sharing provision in the Commission's regulations effectively requires entities to share CEII with another entity or the Commission.
198

Section 215A(d)(6) explicitly states that an entity is not required to share CEII with the Commission or another entity or person.
199

The voluntary sharing provision does not impose a sharing requirement on entities; instead, it allows the Commission discretion to share, in certain circumstances, CEII that has already been submitted to, or generated by, the Commission.

198
FAST Act, Public Law 114-94, 61,003, 129 Stat. 1312, 1777.

199

Id.

126. Even if the Commission's voluntary sharing of information were viewed as the same as a third-party sharing it, the Commission must balance its obligation to disclose information as necessary to carry out its jurisdictional responsibilities against an entity's possible preference not to have such information disclosed.
200

The regulations adopted here achieve that balance. Furthermore, the FAST Act does not place limits on the Commission's ability to share information in its possession when authorized and necessary to carry out the requirements of the FAST Act or the Commission's other jurisdictional responsibilities.

200
The FAST Act does not prohibit the Commission from disclosing any information, nor does it require an entity to produce any information. FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 1777.

127. As noted in the NOPR, in some circumstances, providing notice to a submitter of CEII that its information will be shared under section 215A could hamper the ability of the Commission to act in a timely way.
201

The Commission, therefore, disagrees with the comments by APPA and NRECA that prior notice must be provided in each instance where the Commissions uses the voluntary sharing provisions of section 215A. However, in response to the comments, the Commission clarifies in amended section 388.113(f) that the Commission will not provide advanced notice only in situations where there is an urgent need to disseminate the information. The Commission will also adopt MISO's and CEA's proposal that when prior notice is not given, the Commission will provide submitters of CEII whose information was shared with notice as soon as practicable.

201
NOPR, 155 FERC ¶ 61,278 at P 38.

128. The NOPR proposed to require that a consultation between the CEII Coordinator and the appropriate Office Director take place prior to any voluntary sharing of CEII. We disagree with NERC's proposal to add a requirement that staff from the Commission's Office of Electric Reliability (OER) and Office of Energy Infrastructure Security (OEIS) be involved in all voluntary sharing consultations because the information in question may not involve OEIS or OER subject matter. However, we note that the CEII Coordinator will consult with Commission staff as appropriate, which could include OER and OEIS staff. The Commission is also not persuaded that it is necessary to provide additional details regarding the factors the Commission will use to determine when voluntary sharing is appropriate. The NOPR specifically proposed that the Commission will voluntarily share “CEII with individuals and organizations that the Commission has determined need the information to ensure that energy infrastructure is protected.”
202

Thus, the NOPR provided sufficient details on the circumstances in which the Commission will voluntarily share CEII. Providing more details may unnecessarily restrict the Commission's ability to voluntarily share needed information.

202
NOPR, 155 FERC ¶ 61,278 at P 37.

129. The Commission disagrees with APPA's suggestion that the regulations should include more developed protections to facilitate information sharing.
203

The Commission believes that procedures outlined in the NOPR are sufficient to protect CEII that the Commission shares. When the Commission voluntarily shares information, CEII will be shared subject to an appropriate NDA or Acknowledgement and Agreement.
204

Moreover, under section 388.113(f), the Commission may impose additional conditions on how the information may be used and maintained that the Commission voluntarily shares.

203

Id.
PP 31-32

204
As noted below, to obtain CEII federal agencies execute an Acknowledgement and Agreement, as opposed to a NDA.
See
Federal Agency Acknowledgement and Agreement,
http://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf.

130. In response to TAPS's comment, the Commission finds that the CEII Coordinator delegation in section 375.313 is sufficient and does not require separate delegations for Office Directors to voluntarily share CEII. Moreover, existing section 388.113(d)(1) has allowed Commission staff to share Critical Energy Infrastructure Information with facility owners and operators. No such delegated authority has been used for such sharing.

F. Request for Access to CEII

NOPR

131. The Commission proposed to maintain special access procedures for owner-operators of facilities, federal agencies, and intervening parties.
205

For intervenors, the Commission proposed to move the existing procedures in section 388.112 to section 388.113 and to eliminate the exemption for certain LNG materials.
206

For general requesters, the Commission added a one-year time limit for organizational requests and added back a time requirement for the Commission to process CEII requests.
207

The Commission also proposed adding a provision to clarify that the Commission's CEII regulations should

not be construed to require the release of certain non-CEII.
208

205
NOPR, 155 FERC ¶ 61,278 at PP 43-49.

206

Id.
P 49.

207

Id.
PP 50-51.

208

Id.
P 52.

Comments

132. APPA recommends that the Commission adopt a tiered system with varying levels of access restrictions.
209

APPA and the Trade Associations suggest that the Commission create a distinct “need to know” standard to access information related to the bulk-power system.
210

Under this suggested standard, CEII would only be disclosed when the person or entity seeking the information has a direct “need to know” in order to maintain reliability, safety, or security.
211

209
APPA Comments at 19.

210
APPA Comments at 18; Trade Associations Comments at 27.

211
APPA Comments at 9; Trade Associations Comments at 27.

133. The Trade Associations recommend that if an academic institution or other members of the public request CEII, the Commission should deny the request and refer the request to the information owner.
212

Peak, on the other hand, supports data sharing with researchers and asks the Commission to permit researchers to access CEII data.
213

Peak also suggests that the Commission consider whether “research institutions with defined cyber security and employee background checks” should have a specific process for obtaining CEII.
214

WIRAB supports the Commission's balancing approach for determining who should receive CEII, but WIRAB recommends that the Commission delete the portion of proposed section 388.113(g)(iv) that states that the Commission can deny a request for “other reasons.”
215

212
Trade Associations Comments at 32.

213
Peak Comments at 7-8.

214

Id.
at 14.

215
WIRAB Comments at 8.

134. Peak recommends that the Commission's sharing of CEII with owners and operators should not be limited to information related to “its own facility.”
216

216
Peak Comments at 13.

135. Public Interest Organizations support the NOPR's proposed revisions allowing certain LNG materials to be accessible in proceedings in which there is a right to intervention.
217

Public Interest Organizations suggest that “the Commission streamline the release of CEII data for intervenors by allowing one request to trigger release of all of an entity's CEII data.”
218

217
Public Interest Organizations Comments at 9.

218

Id.
at 9-10.

136. MISO notes that for purposes of consistency, the Commission should add language already in section 388.112(b)(iv) to amended section 388.113(g)(4) to ensure that, if an objection to a request for disclosure is filed, whether the information is privileged or CEII, “the filer shall not provide the non-public document to the person or class of persons identified in the objection until ordered by the Commission or a decisional authority.”
219

219
MISO Comments at 4.

137. Peak asks the Commission to clarify whether the protections proposed in section 388.113(g)(2) regarding the obligation of federal agency recipients to protect CEII in the same manner as the Commission extends to data generated by a federal agency through an analysis of CEII.
220

220
Peak Comments at 13.

138. APS requests that the Commission revise amended section 388.113(g)(5)(vi) to require organizational requesters to promptly update/remove individuals from their list of approved individuals.
221

221
APS Comments at 11; s
ee also
Trade Associations Comments at 35.

139. The Trade Associations and APS state that they are concerned that amended section 388.113(g)(5)(v), which allows an individual under an organizational request to have access to CEII for the remainder of a calendar year, may result in a less robust verification system.
222

WIRAB supports allowing requesters to maintain their validity for the duration of the calendar year.
223

222
Trade Associations Comments at 35; APS Comments at 10-11.

223
WIRAB Comments at 9.

140. INGAA asks for acknowledgment that the Commission approves of entities providing requested information directly to CEII requesters.
224

INGAA also requests that proposed section 388.113(g)(5)(ix) be modified to add “information on rare species of plants and animals” to the list of items not required to be released through the CEII process.
225

224
INGAA Comments at 4.

225

Id.

141. Public Interest Organizations ask the Commission to establish a reasonable timeline for the review of and response to CEII requests.
226

APS requests that the Commission add a default twenty-day time period to respond to CEII requests unless the information is needed in fewer than twenty days.
227

NERC suggests that the Commission add a provision indicating that the Commission may toll the response time when there is a need to gather further information from the requester.
228

226
Public Interest Organizations Comments at 10 (noting that it often takes 4-6 months to get access to Form No. 715 information through the existing Critical Energy Infrastructure Information process).

227
APS Comments at 8.

228
NERC Comments at 16 (citing 5 U.S.C. 552(a)(6)(B)(ii)).

142. NERC requests that the appeal rights available to requesters be made available to submitting entities to avoid disclosures that might place CEII at risk.
229

TAPS asks for clarification that when conditions are imposed on a receipt of CEII, appeal rights will be granted.
230

229

Id.
at 18.

230
TAPS Comments at 14.

Commission Determination

143. APPA and the Trade Associations have not demonstrated a need for the Commission to change its practices and use a tiered system of categories of CEII or a heightened “need to know” standard for bulk-power system information. The Commission will continue to “balance the requestor's need for the information against the sensitivity of the information.”
231

The Commission has utilized this balancing approach effectively in response to Critical Energy Infrastructure Information requests for almost fifteen years. The balancing approach has provided to individuals with a demonstrated need access to information subject to a NDA. However, in some instances, the Commission has balanced a requester's asserted need for the information against its sensitivity and has determined not to produce certain types of CEII to the requester. The Commission will continue this balancing approach under the Final Rule.

231
Section 388.113(g)(5)(iii).

144. As noted above, the FAST Act does not require changes to the Commission's existing process for accessing information. The CEII Coordinator will continue to evaluate each request individually. In response to Peak's comments, the Commission notes that the current procedures allow academics to obtain CEII, and that the Commission does, as appropriate in individual rulemakings, consider whether certain categories of information should generally be made available for research.
232

The Commission is not persuaded that any

changes should be made to restrict or expand access to CEII by academics.

232

See, e.g., Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events,
156 FERC ¶ 61,215, at PP 93-95 (2016) (determining that geomagnetically induced current monitoring and magnetometer data will help facilitate geomagnetic disturbance research and concluding that such data typically should not be treated as confidential).

145. The Commission also disagrees with deleting the term “other reasons” from proposed section 388.113(g)(5)(iv) as there may be other legitimate reasons why the Commission would not permit access to certain CEII in particular situations.

146. The Commission is not persuaded that it needs to adopt Peak's proposed changes to the owner-operator provision. An owner-operator has a need to obtain CEII about its own facility. To the extent the owner-operator needs other CEII, it can pursue additional information through the regular CEII request process.

147. As to the comment by Public Interest Organizations, the Final Rule maintains the mechanism for interveners to request CEII outside of the CEII process.
233

233

See
section 388.113(g)(4).

148. The Commission agrees with MISO's change to proposed section 388.113(g)(4), and amends that provision to include all of the language that currently exists in section 388.112(b)(2)(iv) to ensure that if an objection to the disclosure of CEII is filed, the information will not be disclosed until directed by the Commission or a decisional authority.

149. In response to Peak's comments, the Commission clarifies that a federal agency in receipt of CEII from the Commission must protect that information in the same manner as the Commission. That agency will be required to execute an appropriate Agency Acknowledgment and Agreement. We clarify that derivative analyses that use or rely on CEII, without actually disclosing CEII, do not automatically qualify as CEII unless the information provided could reasonably be expected to lead to the disclosure of CEII.
234

234

See supra
P 64.

150. Recognizing that the employment status and circumstances surrounding an individual or organization can change, in response to APS's comment, the Commission will modify the NDAs to indicate that a recipient of CEII must promptly notify the Commission if any changed conditions, such as a change in employment, occur.

151. Amended section 388.113(g)(5)(v) recognizes that in some instances a requester may request CEII multiple times during a calendar year. In response to comments by APS and Trade Associations regarding the robustness of the requester verifications, the Commission clarifies that each request will be reviewed by balancing the needs of the requester against the sensitivity of the requested information.

152. In response to INGAA's request, the Commission notes that under the current CEII rules, entities may share information that they submitted to the Commission with a request for CEII treatment (as opposed to CEII that they received from the Commission) directly with other entities, and the Commission will continue to encourage and support such a practice. The Commission adopts INGAA's recommendation that “information about rare species of plants and animals” be added to the section 388.113(g)(5)(ix) list of items that are not required to be released when the information is inextricably intertwined with CEII.

153. In response to comments by Public Interest Organizations, the Commission is not persuaded that additional clarifications regarding timing are necessary. Section 388.113(g)(5)(vii) of the amended regulations indicates that the time period for responding to CEII requests should mirror the period for responding to FOIA requests. In response to APS's suggestion of a default time period for the Commission to respond to a request for CEII unless the information is needed sooner, expedited treatment is not needed, as a requester may include a timeframe in which it needs the information, and the Commission will endeavor to respond in that period. The Commission believes that NERC's recommendation to place language concerning tolling in the CEII regulation is not necessary, as the time requirement for responses to requesters is not binding and the Commission's practice is to always toll the response period when further information is needed.

154. In response to NERC's comment regarding appeal rights, the Commission notes that the existing CEII appeals process, which provides appeal rights to the requester, has been effective and there is no compelling need to extend a right to appeal to anyone other than the individual requester. If a submitter believes that its objection to disclosure of its CEII under a NDA has not been fully addressed, the submitter may raise that issue in district court.
235

235
Because the challenge does not relate to the designation of the information, the action would not be under FPA section 215A(d)(11).
See supra
note 130;
see also Cortez III Serv. Corp
v.
NASA,
921 F.Supp. 8, 11 (D.D.C. 1996) (holding, in a “reverse FOIA” action, that courts have jurisdiction over claims from parties that a release of their information would adversely affect them.”)

155. In response to TAPS's comment, the Commission clarifies that appeal rights apply when it imposes any conditions on receipt of CEII.

III. Information Collection Statement

156. The Paperwork Reduction Act and Office of Management and Budget's (OMB) implementing regulations require OMB to review and approve certain information collection requirements imposed by agency rule.
236

This Final Rule does not impose any additional information collection requirements.
237

Therefore, the information collection regulations do not apply to this Final Rule.

236
5 CFR part 1320.

237
The current information collection requirements related to requesting access to CEII material are approved by OMB under FERC-603 (OMB Control No. 1902-0197).

IV. Environmental Analysis

157. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.
238

238

Regulations Implementing National Environmental Policy Act of 1969,
Order No. 486, FERC Stats. & Regs. ¶ 30,783 (1987).

158. The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural, or that do not substantially change the effect of the regulations being amended.
239

The actions here fall within this categorical exclusion in the Commission's regulations.

239
18 CFR 380.4(a)(2)(ii).

V. Regulatory Flexibility Act Certification

159. The Regulatory Flexibility Act of 1980 (RFA) requires rulemakings to contain either a description and analysis of the effect that the rule will have on small entities or a certification that the rule will not have a significant economic impact on a substantial number of small entities.
240

Rules that are exempt from the notice and comment requirements of section 553(b) of the Administrative Procedure Act are exempt from the RFA requirements. The Final Rule concerns rules of agency procedure and, therefore, an analysis under the RFA is not required.
241

240
5 U.S.C. 603 (2012).

241
5 U.S.C. 553(b).

VI. Document Availability

160. In addition to publishing the full text of this document in the
Federal Register
, the Commission provides all interested persons an opportunity to

view and/or print the contents of this document via the Internet through the Commission's Home Page (
http://www.ferc.gov
) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, Washington, DC 20426.

161. From the Commission's Home Page on the Internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number of this document, excluding the last three digits, in the docket number field.

162. User assistance is available for eLibrary and the Commission Web site during normal business hours from FERC Online Support at 202-502-6652 (toll free at 1-866-208-3676) or email at
ferconlinesupport@ferc.gov,
or the Public Reference Room at (202) 502-8371, TTY (202) 502-8659. Email the Public Reference Room at
public.referenceroom@ferc.gov.

VII. Effective Date and Congressional Notification

163. These regulations are effective February 21, 2017. The Commission has determined, with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule is not a “major rule” as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996. The Commission will submit the Final Rule to both houses of Congress and to the General Accountability Office.

List of Subjects

18 CFR Part 375
Authority delegations (Government agencies), Seals and insignia, Sunshine Act.

18 CFR Part 388
Confidential business information, Freedom of information.

By the Commission.

Issued: November 17, 2016.
Nathaniel J. Davis, Sr.,
Deputy Secretary.

In consideration of the foregoing, the Commission amends Parts 375 and 388, Chapter I, Title 18, Code of Federal Regulations, as follows:

PART 375— THE COMMISSION

1. The authority citation for part 375 continues to read as follows:

Authority:

5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 U.S.C. 791-825r, 2601-2645; 42 U.S.C. 7101-7352.

2. In § 375.309, paragraph (h) is added as follows:

§ 375.309
Delegations to the General Counsel

(h) Deny or grant, in whole or in part, an appeal of a determination by the CEII Coordinator.

3. In § 375.313:
a. Revise the section heading and paragraphs (a) and (b);
b. Redesignate paragraphs (c) through (e) as paragraphs (d) through (f) and revising newly redesignated paragraphs (d) through (f); and
c. Add a new paragraph (c).
The revisions and addition read as follows:

§ 375.313
Delegations to the Critical Energy/Electric Infrastructure Information (CEII) Coordinator

(a) Receive and review all requests for CEII as defined in § 388.113(c) of this chapter.

(b) Make determinations as to whether particular information fits within the definition of CEI

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2016-28322. Public record. Not legal advice.