Regulations Implementing FAST Act Section 61003-Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission, 93732-93753 [2016-28322]

Agencies

• DEPARTMENT OF ENERGY
• Federal Energy Regulatory Commission

[Federal Register Volume 81, Number 245 (Wednesday, December 21, 2016)]
[Rules and Regulations]
[Pages 93732-93753]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2016-28322]



[[Page 93731]]

Vol. 81

Wednesday,

No. 245

December 21, 2016

Part II





Department of Energy





-----------------------------------------------------------------------





Federal Energy Regulatory Commission





-----------------------------------------------------------------------





18 CFR Parts 375 and 388





Regulations Implementing FAST Act Section 61003--Critical Electric 
Infrastructure Security and Amending Critical Energy Infrastructure 
Information; Availability of Certain North American Electric 
Reliability Corporation Databases to the Commission; Final Rule

Federal Register / Vol. 81 , No. 245 / Wednesday, December 21, 2016 / 
Rules and Regulations

[[Page 93732]]


-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

18 CFR Parts 375 and 388

[Docket Nos. RM16-15-000 and RM15-25-001; Order No. 833]


Regulations Implementing FAST Act Section 61003--Critical 
Electric Infrastructure Security and Amending Critical Energy 
Infrastructure Information; Availability of Certain North American 
Electric Reliability Corporation Databases to the Commission

AGENCY: Federal Energy Regulatory Commission, Department of Energy.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Energy Regulatory Commission (Commission) amends 
its regulations to implement provisions of the Fixing America's Surface 
Transportation Act that pertain to the designation, protection and 
sharing of Critical Electric Infrastructure Information. Additionally, 
the Commission amends its regulations addressing Critical Energy 
Infrastructure Information.

DATES: This rule will become effective February 21, 2017.

FOR FURTHER INFORMATION CONTACT: 
Nneka Frye, Office of the General Counsel, Federal Energy Regulatory 
Commission, 888 First Street NE., Washington, DC 20426, (202) 502-6029, 
Nneka.frye@ferc.gov.

Christopher MacFarlane, Office of the General Counsel, Federal Energy 
Regulatory Commission, 888 First Street NE., Washington, DC 20426, 
(202) 502-6761, Christopher.macfarlane@ferc.gov.

Mark Hershfield, Office of the General Counsel, Federal Energy 
Regulatory Commission, 888 First Street NE., Washington, DC 20426, 
(202) 502-8597, Mark.hershfield@ferc.gov.

SUPPLEMENTARY INFORMATION: 
    1. The Commission amends 18 CFR 375.309, 375.313, 388.112 and 
388.113 of its regulations to implement the requirements of the Fixing 
America's Surface Transportation (FAST) Act as set forth in section 
215A(d)(2) of the Federal Power Act (FPA).\1\ The Commission also 
amends its existing Critical Energy Infrastructure Information 
procedures. These changes are intended to comply with the FAST Act as 
well as improve the overall efficiency of the Commission's procedures 
for certain infrastructure information that is submitted to, or 
generated by, the Commission. The amended procedures will be referred 
to as the Critical Energy/Electric Infrastructure Information (CEII) 
procedures.
---------------------------------------------------------------------------

    \1\ Fixing America's Surface Transportation Act, Public Law 114-
94, 61,003, 129 Stat. 1312, 1773-1779 (2015) (to be codified at 16 
U.S.C. 824 et seq.) (FAST Act).
---------------------------------------------------------------------------

I. Background

A. Critical Energy Infrastructure Information Regulations

    2. Shortly after September 11, 2001, the Commission took steps to 
protect information that it considered Critical Energy Infrastructure 
Information.\2\ As a preliminary step, the Commission removed documents 
from its public files and eLibrary database that were likely to contain 
detailed specifications about critical infrastructure. The Commission 
directed the public to use the Freedom of Information Act (FOIA) 
request process to obtain such information.\3\ Given that such 
information would typically be exempt from mandatory disclosure 
pursuant to FOIA, the Commission determined that it was important to 
have a process for individuals with a valid or legitimate need to 
access certain sensitive energy infrastructure information. Thus, in 
2003, the Commission issued a final rule establishing Critical Energy 
Infrastructure Information regulations.\4\
---------------------------------------------------------------------------

    \2\ See Statement of Policy on Treatment of Previously Public 
Documents, 97 FERC ] 61,030 (2001).
    \3\ 5 U.S.C. 552 as amended by the FOIA Improvement Act of 2016, 
Public Law 114-185, 130 Stat. 538 (2016); 18 CFR 388.108 (Requests 
for Commission records not available through the Public Reference 
Room (FOIA Requests)).
    \4\ Critical Energy Infrastructure Information, Order No. 630, 
FERC Stats. & Regs. ] 31,140, order on reh'g, Order No. 630-A, FERC 
Stats. & Regs. ] 31,147 (2003).
---------------------------------------------------------------------------

    3. Each year, over 7,000 documents are submitted to the 
Commission's eLibrary system as Critical Energy Infrastructure 
Information. The Commission also receives approximately 200 requests 
for Critical Energy Infrastructure Information each year. Requests for 
Critical Energy Infrastructure Information are submitted by, among 
others, public utilities, gas pipelines, Liquefied Natural Gas (LNG) 
facilities, hydroelectric developers, academics, landowners, public 
interest groups, researchers, renewable energy organizations, 
consultants, and federal agencies.
    4. The Commission's current Critical Energy Infrastructure 
Information process is designed to limit the distribution of sensitive 
infrastructure information to those individuals with a need to know in 
order to avoid having sensitive information fall into the hands of 
those who may use it to attack the Nation's infrastructure.

B. FAST Act

    5. On December 4, 2015, the President signed the FAST Act into law. 
The FAST Act, inter alia, added section 215A to the Federal Power Act 
to improve the security and resilience of energy infrastructure in the 
face of emergencies. The FAST Act directs the Commission to issue 
regulations aimed at securing and sharing sensitive infrastructure 
information. Specifically, FPA section 215A(d)(2) (Designation and 
Sharing of Critical Electric Infrastructure Information) requires the 
Commission to promulgate regulations on the following. First, the 
statute requires the Commission to establish criteria and procedures to 
designate information as critical electric infrastructure information. 
Second, the statute requires the Commission to prohibit the 
unauthorized disclosure of critical electric infrastructure 
information. Third, the statute requires the Commission to ensure there 
are appropriate sanctions in place for Commissioners, officers, 
employees, or agents of the Commission or the Department of Energy 
[DOE] who knowingly and willfully disclose critical electric 
infrastructure information in a manner that is not authorized by the 
statute. Fourth, FPA section 215A(d)(2)(D) requires the Commission, 
taking into account standards of the Electric Reliability Organization, 
to facilitate voluntary sharing of critical electric infrastructure 
information. The statute, specifically, directs the Commission to 
facilitate voluntary sharing with, between, and by Federal, State, 
political subdivision, and tribal authorities; the Electric Reliability 
Organization; regional entities; information sharing and analysis 
centers established pursuant to Presidential Decision Directive 63; 
owners, operators, and users of critical electric infrastructure in the 
United States; and other entities determined appropriate by the 
Commission.\5\
---------------------------------------------------------------------------

    \5\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 
1776.
---------------------------------------------------------------------------

C. Notice of Proposed Rulemaking

    6. On June 16, 2016, the Commission issued a Notice of Proposed 
Rulemaking (NOPR) to amend its regulations to implement the provisions 
of the FAST Act pertaining to the designation, protection and sharing 
of CEII.\6\ The

[[Page 93733]]

proposed amendments included, among other things, the creation of 
criteria and procedures for designating information as CEII; a specific 
prohibition on unauthorized disclosure of that information; sanctions 
for knowing and willful wrongful disclosure of CEII by certain federal 
personnel; a process for voluntary sharing of CEII; and changes to the 
existing process for requesting CEII. In response to the NOPR, nineteen 
entities filed comments and two entities filed reply comments. The 
Appendix to this Final Rule lists the entities that submitted comments 
in response to the NOPR.
---------------------------------------------------------------------------

    \6\ Regulations Implementing FAST Act Section 61003--Critical 
Infrastructure Security and Amending Critical Energy Information, 81 
FR 43,557 (July 5, 2016), 155 FERC ] 61,278 (2016) (NOPR).
---------------------------------------------------------------------------

II. Discussion

    7. The Commission adopts the majority of amendments proposed in the 
NOPR. The Commission determines that the amendments comply with the 
requirements of the FAST Act and better ensure the secure treatment of 
CEII. In addition, as discussed below, the Commission modifies or 
otherwise clarifies certain proposals made in the NOPR based on our 
review of the comments. In the discussion below, we address the 
following issues regarding the CEII amendments: (A) Scope, purpose, and 
definitions; (B) criteria and procedures for determining what 
constitutes CEII; (C) duty to protect CEII; (D) sanctions for 
unauthorized disclosure of CEII; (E) voluntary sharing of CEII; and (F) 
requests for access to CEII.

A. Scope, Purpose, and Definitions

NOPR
    8. In the NOPR, the Commission proposed to amend section 388.113 to 
include procedures for submitting, designating, handling, sharing and 
disseminating Critical Electric Infrastructure Information submitted to 
or generated by the Commission.\7\ The Commission proposed to define 
the term ``Critical Electric Infrastructure Information'' \8\ to 
include ``Critical Energy Infrastructure Information'' as defined under 
the Commission's current regulations and to refer to both types of 
information, collectively, as CEII.\9\ The Commission also proposed to 
delete references to CEII in section 388.112 so that section 388.112 
would only address privileged material and all procedures regarding 
CEII would be in section 388.113.
---------------------------------------------------------------------------

    \7\ NOPR, 155 FERC ] 61,278 at P 10.
    \8\ Id. P 11 (noting that Section 215A(a)(3) of the FAST Act 
defines Critical Electric Infrastructure Information to include 
information that qualifies as critical energy infrastructure 
information under the Commission's regulations).
    \9\ NOPR, 155 FERC ] 61,278 at P 13.
---------------------------------------------------------------------------

Comments
    9. APPA and MISO maintain that CEII should not include all Critical 
Energy Infrastructure Information.\10\ APPA contends that Congress 
intended for the Commission to develop a separate process for Critical 
Electric Infrastructure Information regarding the bulk-power system and 
that the amended regulations fall ``short'' of Congress's intent under 
the FAST Act because the amended regulations include the voluntary 
disclosure provisions found in the Commission's current 
regulations.\11\ APPA also asserts that the proposed definition of 
``critical electric infrastructure'' ``does not comport well'' with 
section 215A(d)(10) of the FPA, which provides DOE and the Commission 
with the authority to remove the CEII designation from information 
regarding the bulk-power system or distribution facilities.\12\ MISO 
contends that the Commission misinterpreted the definition of Critical 
Electric Infrastructure Information and that not all ``Critical Energy 
Infrastructure Information under the Commission's regulations is 
included'' in the definition of Critical Electric Infrastructure 
Information.\13\
---------------------------------------------------------------------------

    \10\ See APPA Comments at 5-11; MISO Comments at 5.
    \11\ APPA Comments at 5, 9, 13.
    \12\ Section 215A(d)(10) of the FPA provides that when ``the 
Commission or the [DOE] Secretary, as appropriate, determines that 
the unauthorized disclosure of such information could no longer be 
used to impair the security or reliability of the bulk-power system 
or distribution facilities'' the designation shall be removed.
    \13\ MISO Comments at 4-6.
---------------------------------------------------------------------------

    10. TAPS and APPA maintain that the Commission should revise the 
CEII definition to include additional language from the FAST Act. 
Specifically, TAPS and APPA recommend that the proposed definition of 
CEII incorporate section 215A(d)(1)(B), which provides that CEII 
``shall not be made available by any Federal, State, political 
subdivision or tribal authority pursuant to any Federal, State, 
political subdivision or tribal law requiring public disclosure of 
information or records.'' \14\ APPA requests that, if the Commission 
includes Critical Energy Infrastructure Information in CEII, then the 
Commission should interpret section 215A(d)(1)(B) to apply to all forms 
of CEII, including Critical Energy Infrastructure Information.\15\ TAPS 
and APPA also request that the Commission define the term ``political 
subdivision,'' as used in section 215A(d)(1)(B), to have the same 
meaning as the term ``political subdivision'' in section 201(f) of the 
FPA, such that the term in section 215A(d)(1)(B) would include any 
agency, authority or instrumentality of any political subdivision or 
owned by a political subdivision.\16\ TAPS and APPA contend that, 
absent the clarification, these additional entities may not be 
considered a ``political subdivision'' under State laws.\17\
---------------------------------------------------------------------------

    \14\ TAPS Comments at 8; APPA Comments at 21-22.
    \15\ APPA Comments at 23.
    \16\ TAPS Comments at 8; APPA Comments at 22 (citing Section 
201(f), which indicates that provisions of that subchapter are not 
applicable to, among others, the United States, a State or any 
political subdivision of a State, certain electric cooperatives or 
any agency, authority, or instrumentality of any one or more of 
those entities or any corporation wholly owned, directly or 
indirectly, by any one or more of those entities).
    16 U.S.C. 824(f)
    \17\ TAPS Comments at 8-9; APPA Comments at 22-23.
---------------------------------------------------------------------------

    11. TAPS recommends that the Commission delete from the definition 
of Critical Energy Infrastructure Information the requirement that such 
information be exempt from FOIA.\18\ TAPS contends that the existing 
exemption clause is unnecessary because any materials will be exempt 
from FOIA pursuant to section 215A(d)(1)(A).\19\
---------------------------------------------------------------------------

    \18\ TAPS Comments at 4-5.
    \19\ Id. at 4.
---------------------------------------------------------------------------

    12. Other commenters seek clarification on the scope of the CEII 
definition. Specifically, the Trade Associations request that the 
Commission clarify whether the name or location of an electric system, 
asset, owner or operator could be protected under the proposed CEII 
definition.\20\ NRECA, similarly, urges the Commission to clarify that 
material considered Critical Energy Infrastructure Information, such as 
electric generation, and non-bulk electric system transmission and 
distribution facilities, would still qualify as CEII under the revised 
definition in the amended regulations.\21\
---------------------------------------------------------------------------

    \20\ Trade Associations Comments at 16.
    \21\ NRECA Comments at 7.
---------------------------------------------------------------------------

    13. Powerex requests that the Commission specify whether the new 
definition of CEII expands the scope of information currently defined 
as Critical Energy Infrastructure Information.\22\ Powerex contends 
that the scope of this proceeding should remain limited to CEII 
regulations and procedures discussed in the NOPR and, thus, the scope 
of this proceeding should not extend to other forms of sensitive 
data.\23\ Powerex, further, explains that there

[[Page 93734]]

may be a tendency to over-designate information as CEII and, therefore, 
the Commission should recognize that transparency is needed to balance 
CEII protection against the due process rights of parties participating 
in Commission proceedings.\24\
---------------------------------------------------------------------------

    \22\ Powerex Comments at 11.
    \23\ Id. at 15.
    \24\ Id. at 12.
---------------------------------------------------------------------------

    14. TAPS, APPA and the Trade Associations recommend revisions to 
the CEII Non-Disclosure Agreements (NDA).\25\ Specifically, TAPS, APPA, 
and the Trade Associations state that the Commission should expressly 
incorporate the language from section 215A(d)(1)(B), exempting CEII 
from public disclosure, into the NDA.\26\ TAPS requests that the 
Commission eliminate the State Agency NDA. TAPS contends that ``[p]rior 
to the FAST Act's express preemption of Sunshine Laws requiring 
disclosure,'' the State Agency NDA was an attempt to impose a 
contractual nondisclosure requirement for critical energy 
infrastructure information provided to a State agency. TAPS maintains 
that, once section 215A(d)(1)(B) is included in the general NDA, the 
State Agency NDA should be eliminated because it is now 
unnecessary.\27\
---------------------------------------------------------------------------

    \25\ APPA Comments at 23; TAPS Comments at 9-10; Trade 
Associations Comments at 32.
    \26\ See id.
    \27\ TAPS Comments at 10; see also Critical Energy 
Infrastructure Information State Agency Employee Non-Disclosure 
Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/state-agen-nda.pdf.
---------------------------------------------------------------------------

    15. With respect to the proposed edits to sections 388.112 and 
388.113 to separate the Commission's treatment of privileged material 
from the Commission's treatment of CEII, MISO suggests that the title 
for section 388.112 be changed to ``Submission and treatment of 
privileged information'' and section 388.113 be changed to ``Submission 
and treatment of Critical Electric Infrastructure Information (CEII).'' 
\28\
---------------------------------------------------------------------------

    \28\ MISO Comments at 3.
---------------------------------------------------------------------------

    16. The Trade Associations request that the Commission expressly 
state in the amended regulations that the CEII process is not intended 
to, and should not be interpreted to, supersede or otherwise affect 
existing laws, regulations, and agency rules that separately safeguard 
such data.\29\
---------------------------------------------------------------------------

    \29\ See Trade Associations Comments at 26.
---------------------------------------------------------------------------

Commission Determination
    17. As discussed below, the Commission, with limited modifications, 
adopts the amendments proposed in the NOPR addressing the scope, 
purpose and definitions in the CEII regulations. The Commission 
determines that the amendments are consistent with the requirements of 
the FAST Act and will result in more secure treatment of CEII.
    18. The Commission disagrees with APPA and MISO that the CEII 
definition should not include Critical Energy Infrastructure 
Information and that there should be separate processes for electric 
and non-electric CEII. Our determination is based on the plain language 
of the FAST Act. Section 215A(a)(3) defines Critical Electric 
Infrastructure Information to ``include information that qualifies as 
critical energy infrastructure information under the Commission's 
regulations.'' \30\ In subsuming the Commission's existing Critical 
Energy Infrastructure Information within section 215A's CEII 
definition, Congress expressly stated that the definition of CEII 
includes Critical Energy Infrastructure Information. There is no 
indication in the language of the FAST Act that Congress intended to 
limit the types of Critical Energy Infrastructure Information to only 
electric infrastructure information.\31\
---------------------------------------------------------------------------

    \30\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 
1312, 1776.
    \31\ For the same reason, we reject MISO's recommendation that 
the title for section 388.112 should be changed to ``Submission and 
treatment of privileged information'' and that the title for section 
388.113 should be changed to ``Submission and treatment of Critical 
Energy Infrastructure Information (CEII).'' MISO Comments at 3.
---------------------------------------------------------------------------

    19. Including Critical Energy Infrastructure Information within the 
definition of CEII is not inconsistent with the provisions of section 
215A(d)(10), as APPA maintains. First, section 215A(d)(10) states that 
removal of a CEII designation may be appropriate when the disclosure of 
such information ``could no longer be used to impair the security or 
reliability of the bulk-power system or distribution facilities.'' 
(Emphasis supplied.) Thus, it is clear that Congress did not intend for 
the new Critical Electric Infrastructure Information designation to 
apply only to the bulk-power system. Second, Critical Energy 
Infrastructure Information includes information that ``relates details 
about the production, generation, transportation, transmission, or 
distribution of energy.'' \32\ Such information, even if it concerns 
non-electric infrastructure, could be used to impair the security or 
reliability of the bulk-power system, for example by severing gas 
pipeline connections to electric generation facilities.
---------------------------------------------------------------------------

    \32\ 18 CFR 388.113(c)(1)(i)).
---------------------------------------------------------------------------

    20. Moreover, the Commission determines that a single CEII process 
for Critical Energy/Electric Infrastructure Information is the most 
efficient way to fulfill the statutory mandate of the FAST Act and to 
avoid any confusion that could result from different processes for 
different types of critical infrastructure information.\33\ Absent 
contrary language in the FAST Act, the Commission has discretion in how 
it administers statutory mandates by regulation.\34\
---------------------------------------------------------------------------

    \33\ NOPR, 155 FERC ] 61,278 at P 14.
    \34\ See Anna Jacques Hosp. v. Burwell, 797 F.3d 1155, 1165 
(D.C. Cir. 2015) (holding that ``interstitial question[s] of 
implementation'' are left to the discretion of the implementing 
agency).
---------------------------------------------------------------------------

    21. APPA's assertion that the Commission is ``falling short'' of 
meeting Congress's intent is without merit. In the proposed 
regulations, the Commission complies with each provision in section 
215A(d)(2) with regard to designating and handling Critical Electric 
Infrastructure Information. The fact that those rules also apply to 
Critical Energy Infrastructure Information does not diminish the 
Commission's compliance under the FAST Act. Rather, in this regard, the 
Commission's determination meets Congress's intent. Moreover, APPA's 
argument that ``information related to cyber threats and defensive 
measures should not be `protected' under a designation regime that also 
provides for potentially involuntary access by any federal employee . . 
., landowners [or]any person who is a participant in a Commission 
proceeding . . .'' and others has no basis in the text of the FAST Act. 
APPA notably cites to nothing in the FAST Act to support that 
argument.\35\ On the contrary, Congress explicitly directed the 
Commission to include voluntary sharing in the regulations that the 
Commission is required to promulgate under the FAST Act.\36\ Further, 
the implication of APPA's argument--that cyber information is different 
from other types of infrastructure information and therefore warrants 
different rules--fails to take into consideration that the Commission 
will evaluate each request for CEII, and each decision to voluntarily 
share CEII, on a case-by-case basis. For example, a person seeking 
cyber threat information would have to show a different need for the 
information than a person seeking information for a pipeline facility 
for a certificate proceeding.
---------------------------------------------------------------------------

    \35\ See APPA Comments at 15.
    \36\ Section 215A(d)(2)(D) states that the Commission ``shall 
promulgate such regulations as necessary to . . . facilitate 
voluntary sharing of critical electric infrastructure information . 
. .'' FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312, 
1776.
---------------------------------------------------------------------------

    22. The Commission agrees with TAPS and APPA that the Commission's 
regulations should incorporate the

[[Page 93735]]

provision in section 215A(d)(1)(B) that CEII ``shall not be made 
available by any Federal, State, political subdivision or tribal 
authority pursuant to any Federal, State, political subdivision or 
tribal law requiring public disclosure of information or records.'' 
\37\ As to TAPS's and APPA's request that the Commission define the 
term ``political subdivision,'' in section 215A(d)(1)(B) of the FAST 
Act to be consistent with the definition of that term in FPA section 
201(f), Congress did not adopt the definition of ``political 
subdivision'' in section 201(f) for the purposes of the FAST Act. 
However, the Commission believes that the broad language of section 
215A(d)(1)(B), as it applies to ``any Federal, State, political 
subdivision or tribal authority,'' should encompass the 
instrumentalities and components of States. Section 215A(d)(1)(B) was 
included to protect CEII from mandatory disclosure. It would be 
illogical to provide such protection to States, but not their 
instrumentalities and components.
---------------------------------------------------------------------------

    \37\ APPA states that there may be instances where an entity 
could provide CEII to NERC who, in turn, may submit that entity's 
information to the Commission or DOE as CEII without notifying the 
entity. Thus, APPA is concerned the entity may not be aware that the 
information has been submitted to the Commission and designated as 
CEII. As a result, APPA suggests that the Commission establish 
notification procedures so that entities are aware that their 
information was designated as CEII. APPA Comments at 21-22. We see 
no need to adopt such a notification process. Section 1505 of NERC's 
Rules of Procedure already requires NERC, unless otherwise directed 
by the Commission or its staff, to notify submitting entities of 
requests made by the Commission to NERC for the submitting entities' 
information.
---------------------------------------------------------------------------

    23. The Commission disagrees with TAPS that the Commission should 
delete from the definition of Critical Energy Infrastructure 
Information the provision that states that Critical Energy 
Infrastructure Information ``[i]s exempt from mandatory disclosure 
under the Freedom of Information Act, 5 U.S.C. 552.'' \38\ As we have 
discussed above, Congress incorporated Critical Energy Infrastructure 
Information within section 215A's definition of Critical Electric 
Infrastructure Information without revision.\39\ Accordingly, the 
Commission will retain its current definition of Critical Energy 
Infrastructure Information.
---------------------------------------------------------------------------

    \38\ 18 CFR 388.113(c)(2)(iii).
    \39\ See Stone v. INS, 514 U.S. 386, 397 (1995) (holding that 
``[w]hen Congress acts to amend a statute, we presume it intends its 
amendment to have real and substantial effect'').
---------------------------------------------------------------------------

    24. In response to the Trade Associations' comments seeking 
clarification if a name or location of a facility should be protected 
as CEII, the Commission's current practice is that information that 
``simply give[s] the general location of the critical infrastructure'' 
or simply provides the name of the facility is not CEII.\40\ However, 
under certain circumstances, information regarding the location of 
infrastructure or its name that is not already publicly known could be 
CEII.\41\ Therefore, we clarify that, while as a general matter the 
location or name of infrastructure is not CEII, a submitter of 
information to the Commission may ask that non-public information about 
the location, or the name, of critical infrastructure be treated as 
CEII. The submitter would have to provide a justification for the 
request and explain why the information is not already publicly known.
---------------------------------------------------------------------------

    \40\ 18 CFR 388.113(c)(1)(iv).
    \41\ For example, the location of an operating transformer is 
likely publicly known. However, the location of a spare transformer 
housed in a central location may not be publicly known and, 
therefore, may qualify as CEII.
---------------------------------------------------------------------------

    25. In response to NRECA's request that the Commission clarify that 
material treated as Critical Energy Infrastructure Information under 
the Commission's current regulations would, in most circumstances, be 
treated as CEII under the amended regulations, we note that such 
information should continue to qualify as CEII. We also note, however, 
in response to Powerex's comment, that it is conceivable that Critical 
Electric Infrastructure Information may include information that would 
not fall within the existing definition of Critical Energy 
Infrastructure Information.\42\
---------------------------------------------------------------------------

    \42\ For example, while Critical Energy Infrastructure 
Information must satisfy the four-part definition in amended section 
388.113(c)(1), Critical Electric Infrastructure Information must 
meet the definition in amended section 388.113(c)(2).
---------------------------------------------------------------------------

    26. We agree with Powerex's comment that the Final Rule should only 
address CEII and not other types of information. In response to 
Powerex's concerns about a party's due process rights, under the 
amended CEII regulations the Commission will balance the need to 
protect critical information with the potential need of parties 
participating in Commission proceedings to access CEII. For example, 
the Commission's regulations include a process for parties to access 
information directly from other parties in a Commission proceeding.\43\
---------------------------------------------------------------------------

    \43\ See 18 CFR 388.112(b)(2) and 388.113(g)(4).
---------------------------------------------------------------------------

    27. In response to comments from TAPS, APPA, and the Trade 
Associations, the Commission agrees that the CEII NDA should reference 
the provision in section 215A(d)(1) that CEII is exempt from disclosure 
under any Federal, State, political subdivision or tribal law requiring 
public disclosure. We disagree that the State Agency NDA should be 
eliminated because it reinforces the minimum protections applicable to 
CEII that the Commission may provide to states as well as provides for 
additional protections beyond the exemptions in State public disclosure 
laws.\44\
---------------------------------------------------------------------------

    \44\ See supra note 27.
---------------------------------------------------------------------------

    28. Finally, the Commission declines to adopt the revision 
suggested by the Trade Associations to expressly state that the CEII 
regulations are not intended to supersede other laws, regulations, and 
agency rules that separately safeguard such data.\45\ This Final Rule 
and adopted CEII amendments do not purport to supersede any other legal 
authorities other than the regulations and associated materials 
specifically amended in this Final Rule.
---------------------------------------------------------------------------

    \45\ See Trade Associations Comments at 26.
---------------------------------------------------------------------------

B. Criteria and Procedures for Determining What Constitutes CEII

1. General Criteria and Procedures
NOPR
    29. Section 215A(d)(2)(A) requires the Commission to ``establish 
criteria and procedures to designate information as critical electric 
infrastructure information.'' In the NOPR, the Commission proposed 
criteria and procedures for the handling of CEII consistent with 
section 215A(d)(2)(A).\46\
---------------------------------------------------------------------------

    \46\ NOPR, 155 FERC ] 61,278 at P 16.
---------------------------------------------------------------------------

Comments
    30. Commenters request that the Commission provide more detail on 
what qualifies as CEII.\47\ The Public Interest Organizations, for 
example, ask the Commission to publish guidelines and criteria for 
designating information as CEII.\48\ The Public Interest Organizations 
further recommend that the Commission publish ``data tables that 
provide suggested classifications for common data types.'' \49\ HRC 
asks that the Commission require entities filing CEII to include a 
public cover letter providing a description of the facility the 
information relates to and describing the nature of the submission. HRC 
also contends that information submitted as CEII should include a more 
detailed description in eLibrary.\50\ HRC contends that this 
information will better allow the public to understand the basis for

[[Page 93736]]

the CEII classification.\51\ HRC also requests that the Commission 
develop a procedure whereby the public can request that the Commission 
review information at the time of submission to ensure that it was 
properly submitted as CEII.\52\ HRC contends that filing a CEII or FOIA 
request as a means of triggering the review of CEII classification is 
burdensome.\53\
---------------------------------------------------------------------------

    \47\ Peak Comments at 8-10; Powerex Comments at 12; APS Comments 
at 5; APPA Comments at 17; WIRAB Comments at 5.
    \48\ Public Interest Organizations Comments at 4.
    \49\ Id. at 5.
    \50\ HRC Comments at 2-3.
    \51\ Id. at 2.
    \52\ Id. at 3.
    \53\ Id.
---------------------------------------------------------------------------

    31. WIRAB and APS commented that additional designation guidance is 
needed in order to avoid submitters' over-designation of documents as 
CEII. Specifically, WIRAB and APS recommend that the Commission 
establish separate criteria for determining when information qualifies 
as CEII on the basis of national security, economic security or public 
health or safety.\54\
---------------------------------------------------------------------------

    \54\ WIRAB Comments at 5; APS Comments at 5.
---------------------------------------------------------------------------

    32. The Trade Associations maintain that the Commission's 
regulations should explicitly designate as CEII information ``related 
to compliance with the Reliability Standards as critical electric 
infrastructure information and exempt it from disclosure under 
388.113(f).'' \55\ The Trade Associations assert that a blanket 
presumption that information regarding Reliability Standards compliance 
is CEII is necessary because it ``may . . . be difficult for a 
submitter to present, ex ante, a clear justification for meeting the 
critical electric infrastructure information definition for a 
particular system or asset, especially if the potential for negative 
effect could also arise from the disclosure of a combination of sets of 
information that alone may not meet the CEII definition.''\56\
---------------------------------------------------------------------------

    \55\ Trade Associations Comments at 12.
    \56\ Id. at 11.
---------------------------------------------------------------------------

    33. APPA and the Trade Associations raise concerns about how the 
designation criteria will apply to DOE.\57\ Specifically, they assert 
that the Commission failed to provide criteria and procedures that 
would apply to DOE.\58\ Additionally, Peak, Public Interest 
Organizations, and APPA request that the Commission hold a technical 
conference on the implementation of the new CEII rules as part of the 
``consultation with the Secretary'' required by FPA section 
215A(d)(2).\59\
---------------------------------------------------------------------------

    \57\ APPA Comments at 24-25; Trade Associations Comments at 23.
    \58\ Id.
    \59\ Peak Comments at 6-7; Public Interest Organizations 
Comments at 5; APPA Comments at 25. WIRAB also requests a technical 
conference to discuss implementation of the FAST Act. WIRAB Comments 
at 11.
---------------------------------------------------------------------------

    34. Finally, NRC requests that the Commission establish a generic 
CEII designation that other federal agencies can use to designate 
information.\60\ NRC also recommends that the Commission clarify in the 
Final Rule that other federal agencies ``are to establish their own 
procedures for identifying CEII on an information-specific basis 
utilizing the FERC's generic CEII standard.'' \61\
---------------------------------------------------------------------------

    \60\ NRC Comments at 1-2.
    \61\ Id. at 2.
---------------------------------------------------------------------------

Commission Determination
    35. The Commission is not persuaded that more detailed guidance or 
additional designation criteria in the CEII regulations are necessary. 
FPA section 215A(a)(2) defines Critical Electric Infrastructure as ``a 
system or asset of the bulk-power system, whether physical or virtual, 
the incapacity or destruction of which would negatively affect national 
security, economic security, public health or safety, or any 
combination of such matters.'' FPA section 215A(a)(3) includes Critical 
Energy Infrastructure Information within CEII. We believe that the 
regulations, as proposed, provide adequate guidance for a submitter or 
Commission staff to determine whether information is CEII and for the 
CEII Coordinator to make a determination. In addition, the criteria and 
designation procedures adopted herein are informed by the Commission's 
experience of implementing and administering the Critical Energy 
Infrastructure Information regulations over the past fifteen years.
    36. The Commission does not agree that the scope of CEII should be 
modified, as suggested by the Trade Associations, to encompass 
information ``related to compliance with the Reliability Standards.'' 
The Trade Associations' proposal is unduly broad and inconsistent with 
the FAST Act because it could lead to all infrastructure information, 
whether critical or not, being treated as CEII. For the same reason, we 
do not agree that the blanket presumption that information relating to 
compliance with Reliability Standards is CEII, proposed by the Trade 
Associations, is appropriate. Like other forms of CEII, however, 
information on compliance with Reliability Standards may be treated as 
CEII if the submitter justifies its treatment as CEII under the 
Commission's regulations.
    37. In response to HRC's comments that documents listed as CEII 
could be better described in eLibrary, the level of detail needed for a 
document description in eLibrary is better addressed in our submission 
guidelines rather than in our regulations.\62\
---------------------------------------------------------------------------

    \62\ See CEII Filing Guide, https://www.ferc.gov/resources/guides/filing-guide/file-ceii/ceii-guidelines.asp. The Commission 
will update the CEII Filing Guide when the proposed regulations 
become effective.
---------------------------------------------------------------------------

    38. In response to HRC's request for an additional process to 
obtain a ruling on CEII when it is filed, we believe that such a 
process is unnecessary, as entities seeking access to information filed 
as CEII may submit a FOIA or CEII request at any time, including 
promptly after that information is filed with the Commission. We 
further conclude that the proposed procedures are adequate for the 
Commission to process information submitted to the Commission, or 
generated by the Commission, as CEII.\63\ As previously noted, the 
Commission receives over 7,000 CEII submissions a year; reviewing the 
information at the time of submission, in the absence of a specific 
request for that information, would be overly burdensome on the 
Commission's resources. In response to a CEII request, the CEII 
Coordinator will review the information to determine whether to 
designate it as CEII. Further, proposed section 388.113(d)(1)(iv) 
specifically states that the Commission retains the right to make 
determinations with regard to any claim of CEII status, at any time.
---------------------------------------------------------------------------

    \63\ See amended sections 388.113(c) and (d).
---------------------------------------------------------------------------

    39. In response to the comments from APPA and the Trade 
Associations, the Commission declines to revise the regulations to 
identify specific designation criteria and CEII procedures for DOE. 
Section 215A(d)(3) of the FAST Act provides that information ``may be 
designated'' by the Commission and DOE pursuant to the criteria and 
procedures that the Commission establishes.\64\ The FAST Act, however, 
does not compel DOE to make any changes to its regulations in this 
regard, and as noted in the NOPR, nothing within the Commission's 
regulations would limit DOE's ability to designate CEII in accordance 
with the FAST Act.\65\ Furthermore, we do not believe a technical 
conference is necessary to satisfy the requirement for consultation 
with DOE in the FAST Act.
---------------------------------------------------------------------------

    \64\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 
1776.
    \65\ NOPR, 155 FERC ] 61,278 at P 16 n.12.
---------------------------------------------------------------------------

    40. Although the Commission recognizes that other agencies have an 
obligation to protect certain information in their custody, the FAST 
Act does not grant other federal agencies the authority to designate 
information as

[[Page 93737]]

CEII. Critical Electric Infrastructure Information is specifically 
defined as information ``designated as critical electric infrastructure 
information by the Commission or the Secretary of the Department of 
Energy pursuant to subsection (d).'' \66\ Congress's intent to limit 
the designation authority to the Commission and DOE is reinforced by 
the fact that only the staff of the Commission and DOE are subject to 
sanctions for unauthorized release under section 215A(d)(2)(C).\67\ 
However, because NRC has raised valid concerns about the protection of 
sensitive information of the electric grid in its custody, the 
Commission revises the amended scope of section 388.113 to state that 
nothing in this section limits any other Federal agency's ability to 
take all necessary steps to protect information within its custody or 
control that is necessary to ensure the safety and security of the 
electric grid. Further, the section is revised to state that, to the 
extent necessary, such agency may consult with the CEII Coordinator 
regarding the treatment or designation of such information (see the 
last two sentences of paragraph (a) in the regulatory text of section 
388.113 in this rule). Nothing in this section limits the ability of 
any other Federal agency to take all necessary steps to protect 
information within its custody or control that is necessary to ensure 
the safety and security of the electric grid. To the extent necessary, 
such agency may consult with the CEII Coordinator regarding the 
treatment or designation of such information.
---------------------------------------------------------------------------

    \66\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 
1776.
    \67\ Id.
---------------------------------------------------------------------------

    41. By this change, the Commission does not limit the discretion of 
other federal agencies to protect sensitive information in their 
custody but provides a mechanism for agencies to consult with the 
Commission's CEII Coordinator regarding the treatment or designation of 
such information as CEII.\68\ We believe this change strikes a 
reasonable balance by recognizing other federal agencies' discretion to 
protect their information, while adhering to the statutory framework 
that limits CEII designation authority to the Commission and DOE.
---------------------------------------------------------------------------

    \68\ For example, the Commission could establish the parameters 
of the Commission's role with regard to CEII with another federal 
agency through a Memorandum of Understanding with that agency.
---------------------------------------------------------------------------

2. Designation of Submissions to the Commission
NOPR
    42. The Commission proposed to treat information submitted with a 
justification for CEII treatment as CEII, unless the submitter is 
otherwise notified by the Commission.\69\
---------------------------------------------------------------------------

    \69\ NOPR, 155 FERC ] 61,278 at P 19.
---------------------------------------------------------------------------

Comments
    43. APS asks that the Commission ``deem'' information as CEII at 
the time an entity submits the information to the Commission.\70\ HRC 
and Tacoma Power are concerned that ``treating'' a submission as CEII 
is not a designation and, as a result, submitting entities may not be 
able to assert the FOIA exemption when faced with a records request 
unless and until the Commission makes a CEII designation 
determination.\71\ Tacoma Power further requests that the Commission 
develop a process for state entities to receive a CEII designation 
determination so that state entities may assert any FOIA exemption with 
certainty.\72\
---------------------------------------------------------------------------

    \70\ APS Comments at 6.
    \71\ HRC Comments at 2; Tacoma Power Comments at 4.
    \72\ Tacoma Power Comments at 4.
---------------------------------------------------------------------------

    44. INGAA, NERC, and the Trade Associations request that the 
Commission change the comment period afforded to submitters of CEII to 
respond to a request for CEII from five calendar days to five business 
days, ten working days, or at least 30 calendar days, respectively.\73\ 
APS and CEA comment that if the Commission determines that particular 
information is not CEII, the Commission should provide the submitter 
with an explanation of why the information does not meet the criteria 
for designation as CEII.\74\ The Trade Associations also request that 
the Commission provide a more detailed explanation in instances when 
CEII is released over an objection from the submitter of the 
material.\75\
---------------------------------------------------------------------------

    \73\ INGAA Comments at 4; NERC Comments at 15; Trade 
Associations Comments at 19.
    \74\ APS Comments at 6; CEA Comments at 6-7.
    \75\ Trade Associations Comments at 19-20.
---------------------------------------------------------------------------

    45. MISO, Trade Associations, CEA, and HRC submitted comments 
recommending changes to the Commission's processing and evaluation of 
justification statements that must accompany a submitter's request for 
CEII treatment. MISO is concerned that the Commission may automatically 
make information public if the submission fails to meet the 
Commission's regulations. Thus, MISO recommends that amended section 
388.113(d)(1) be revised to make clear that failure to provide the 
justification or other required information will be considered in the 
determination of whether the information will be maintained as CEII by 
the Commission, but it will not result in automatic disclosure of the 
information.\76\
---------------------------------------------------------------------------

    \76\ MISO Comments at 7.
---------------------------------------------------------------------------

    46. The Trade Associations maintain information submitted to the 
Commission for designation as CEII that ultimately is determined not to 
be CEII should not automatically be disclosed to the public because 
such information may be subject to other laws and regulations 
restricting disclosure of the information.\77\
---------------------------------------------------------------------------

    \77\ Trade Associations Comments at 25-26.
---------------------------------------------------------------------------

    47. CEA recommends that the Commission provide the submitter with 
an opportunity to retract a submission and re-submit it with the 
appropriate justification.\78\
---------------------------------------------------------------------------

    \78\ CEA Comments at 6-7.
---------------------------------------------------------------------------

Commission Determination
    48. As an initial matter, we correct the statement in the NOPR 
erroneously stating that under our current practice, ``the Commission 
deems the designation on a submission accepted as submitted.'' \79\ Our 
current practice is to treat information as CEII, and maintain it in 
our non-public files, when it is submitted with a request for CEII 
treatment. That practice is reflected in the current and proposed 
regulations.\80\ Under the regulations adopted in this Final Rule 
information that is submitted will not be designated CEII until the 
CEII Coordinator makes such a determination.
---------------------------------------------------------------------------

    \79\ NOPR, 155 FERC ] 61,278 at P 19.
    \80\ See amended section 388.113(d)(1)(vi).
---------------------------------------------------------------------------

    49. As to the comments submitted by Tacoma Power, the Commission is 
not persuaded that a special expedited process for designations in the 
event a State entity is facing a public records request is needed, 
because State and local entities may consult with the CEII Coordinator 
as to whether information that is subject to a State, local, or other 
type of records request is CEII under the Commission's regulations.\81\
---------------------------------------------------------------------------

    \81\ Section 215A(d)(1)(B) states that Critical Electric 
Infrastructure Information ``shall not be made available by any 
Federal, State, political subdivision or tribal authority pursuant 
to any Federal, State, political subdivision or tribal law requiring 
public disclosure of information or records.'' FAST Act, Pub. L. 
114-94, section 61,003, 129 Stat. 1312, 1776.
---------------------------------------------------------------------------

    50. In response to the comments from APS and CEA about the 
procedures for informing a submitter of a potential release or re-
designation of CEII, the Commission's current practices are sufficient 
to comply with the FAST Act

[[Page 93738]]

and we maintain those practices under the adopted regulations. The 
current practice is to provide notice to the submitter if a proposed 
CEII designation will be rejected or if CEII will be released over an 
objection. The notification will include an explanation as to why the 
information does not meet the criteria and the submitter will have an 
opportunity to comment or seek appropriate relief under amended section 
388.113(e)(4).
    51. The Commission is not persuaded that it is necessary to make 
the changes proposed by MISO and CEA regarding treatment of information 
that is filed in a manner that does not meet our regulations. The 
amended regulations do not mandate automatic disclosure of the 
information. Furthermore, even if the Commission were to make 
information public, the Commission will provide notice to the submitter 
prior to any determination.\82\
---------------------------------------------------------------------------

    \82\ See amended sections 388.113(d)(1)(iv) and 388.113(e)(3)-
(4).
---------------------------------------------------------------------------

    52. The Commission adopts INGAA's proposal to change the comment 
period from five calendar days to five business days, and will change 
all references in section 388.113 from ``calendar'' days to 
``business'' days. Allowing more time is not warranted because the 
issue of whether to release CEII is relatively limited and, as a 
general matter, the Commission endeavors to respond to requests for 
CEII as soon as possible. In addition, the Commission notes that 
submitters can request an extension of that time-period to submit 
comments to the Commission.
3. Information Included in NERC Databases
NOPR
    53. The Commission proposed that information downloaded by 
Commission staff from private databases that are accessed pursuant to 
Commission order or regulation will be maintained as non-public 
information consistent with the Commission's internal controls.\83\ The 
Commission noted that in response to an information request, it will 
evaluate whether the information is CEII, proprietary information, or 
otherwise privileged or non-public and will provide the owner of the 
database or information (as appropriate) with an opportunity to comment 
on the request.\84\
---------------------------------------------------------------------------

    \83\ NOPR, 155 FERC ] 61,278 at P 17 n.13(citing Availability of 
Certain North American Electric Reliability Corporation Databases to 
the Commission, Order No. 824, 155 FERC ] 61,275 (2016)).
    \84\ Id.
---------------------------------------------------------------------------

Comments
    54. Most commenters support treating data downloaded from the NERC 
databases as non-public. NERC agrees with the proposal to treat 
information downloaded from its databases as non-public, but it seeks 
clarification as to whether the Commission intends to designate the 
information as privileged and CEII.\85\ TAPS requests that if the 
Commission determines to release database information, the manager of 
the database and the entity whose data would be released should receive 
notice and an opportunity to comment.\86\
---------------------------------------------------------------------------

    \85\ NERC Comments at 19.
    \86\ TAPS Comments at 5-7.
---------------------------------------------------------------------------

    55. The Trade Associations recommend that the Commission treat the 
NERC databases information that Commission staff does not download as 
inextricably intertwined with downloaded information and thereby treat 
all of the information on each database as CEII.\87\ TAPS raises 
concerns that information that is contained in a database may not be 
adequately protected from disclosure, because the data ``is not being 
submitted to the Commission, but rather accessed by the Commission.'' 
\88\
---------------------------------------------------------------------------

    \87\ Trade Associations Comments at 15.
    \88\ TAPS Comments at 6.
---------------------------------------------------------------------------

    CEA requests that the Commission respect Canadian information that 
may be accessed through any private databases accessible to the 
Commission.\89\ CEA further comments that the Commission's information 
gathering through other databases be restricted to U.S. facility 
information only.\90\
---------------------------------------------------------------------------

    \89\ CEA Comments at 4.
    \90\ Id.
---------------------------------------------------------------------------

Commission Determination
    56. The Commission adopts the NOPR proposal to treat information 
downloaded from NERC databases as non-public \91\ and to evaluate 
whether it should be designated as CEII in response to a request for 
the information or if the Commission determines such information should 
be disclosed.\92\ In addition, because the CEII designation only 
applies to information that is submitted to or generated by the 
Commission, information that Commission staff accesses and reviews, but 
never takes custody of, cannot be designated as CEII. Therefore, the 
Commission disagrees with the proposal to treat all of the information 
in an accessed database as inextricably intertwined CEII.\93\
---------------------------------------------------------------------------

    \91\ This is consistent with the statement in Order No. 824 that 
the Commission ``will take appropriate steps, as provided for in our 
governing statutes and regulations, in handling such information.'' 
Order No. 824, 152 FERC ] 61,208 at P 22.
    \92\ The discussion above and our determination address the 
Trade Associations' request for clarification of Order No. 824 in 
Docket No. RM15-25-001.
    \93\ By the same token, information that is not downloaded 
cannot be disclosed under a FOIA request as the Commission would not 
possess the information.
---------------------------------------------------------------------------

    57. The Commission clarifies that information downloaded by the 
Commission or its staff from a non-public NERC database will be treated 
as non-public information and will be afforded the same treatment as 
CEII. Thus, in the event the Commission receives a request for the 
information or the Commission determines such information should be 
disclosed, the Commission will ``provide the owner of the database or 
information (as appropriate) with an opportunity to comment on the 
request.'' \94\ In response to TAPS's comments, we clarify that, where 
practicable, we will notify the database owner and the information 
owner.\95\
---------------------------------------------------------------------------

    \94\ NOPR, 155 FERC ] 61,278 at P 17 n.13.
    \95\ We note that section 1505 of NERC's Rules of Procedure 
requires NERC, unless otherwise directed by the Commission or its 
staff, to provide notice to submitting entities in response to 
requests for the submitting entities' information by the Commission.
---------------------------------------------------------------------------

    58. Finally, as to CEA's comment regarding Canadian information on 
other databases, we believe that CEA's request goes beyond the scope of 
this rulemaking proceeding, which is limited to amending the 
Commission's regulations regarding CEII.\96\
---------------------------------------------------------------------------

    \96\ The Commission has addressed the scope of information 
covered by specific data collection requirements in individual 
proceedings. For example, in Order No. 824, concerning Commission 
access to certain NERC databases that include data about both U.S. 
and Canadian facilities, the Commission revised its regulations to 
indicate that ``Commission access will be limited to data regarding 
U.S. facilities.'' Order No. 824, 155 FERC ] 61,275 at P 38.
---------------------------------------------------------------------------

4. Designation of Commission-Generated Information
NOPR
    59. For Commission-generated information, the NOPR explained that 
the CEII Coordinator, after consultation with the appropriate 
Commission Office Director, will determine whether the information 
meets the definition of CEII.\97\ The CEII Coordinator will then 
determine how long the CEII designation should last and, as 
appropriate, whether to make any re-designation.\98\
---------------------------------------------------------------------------

    \97\ NOPR, 155 FERC ] 61,278 at P 21.
    \98\ Id.
---------------------------------------------------------------------------

Comments
    60. The Trade Associations request that the Commission establish a 
process in which appropriate stakeholders may

[[Page 93739]]

participate in the Commission's CEII designation determinations for 
Commission-generated information.\99\ The Trade Associations assert 
that whether the information is submitted to the Commission or not, 
``owners and operators of that critical infrastructure who will be 
faced with defending such a potential attack deserve to have input into 
the determination of whether or not such information should be 
disclosed.'' \100\
---------------------------------------------------------------------------

    \99\ Trade Associations Comments at 24.
    \100\ Id.
---------------------------------------------------------------------------

Commission Determination
    61. The Commission determines that there is no need for stakeholder 
participation in the designation of Commission-generated information. 
The Commission has the expertise and experience to make determinations 
about whether Commission-generated information is CEII. And as a 
practical matter, it would not be appropriate in some circumstances for 
stakeholders to be privy to Commission-generated information that 
qualifies as CEII. For example, Commission-generated CEII may contain 
information that is otherwise non-public or privileged. To the extent 
that an entity believes that a Commission-generated document contains 
CEII about its facility, the entity is not precluded from raising that 
concern with the CEII Coordinator.
5. Segregable Information
NOPR
    62. The NOPR recognized that information submitted to the 
Commission may contain parts that are CEII and parts that may not be 
CEII. As a result, the NOPR proposed to require entities submitting 
CEII and Commission staff who generate CEII, to the extent feasible, to 
segregate the CEII (or information that reasonably could be expected to 
lead to the disclosure of the CEII) from non-CEII at the time of 
submission or staff's generation, respectively.\101\
---------------------------------------------------------------------------

    \101\ NOPR, 155 FERC ] 61,278 at P 22.
---------------------------------------------------------------------------

Comments
    63. HRC and Powerex support the requirement to segregate CEII from 
non-CEII and encourage efforts to prevent the over-classification of 
information.\102\ TAPS asks the Commission to confirm that submitting a 
redacted public version of a filing satisfies the requirement to 
segregate CEII.\103\ Powerex asks the Commission to clarify that 
derivative analyses performed by governmental entities or their 
contractors that use or rely on CEII, without more detail, should not 
be designated as CEII solely based on the fact the analysis relies on 
or uses CEII.\104\
---------------------------------------------------------------------------

    \102\ HRC Comments at 3; Powerex Comments at 16-17.
    \103\ TAPS Comments at 14.
    \104\ Powerex Comments at 16.
---------------------------------------------------------------------------

Commission Determination
    64. The Commission clarifies that submitting a properly redacted 
public version of information submitted as CEII meets the requirement 
established in section 215A(d)(8). Moreover, derivative analyses that 
use or rely on CEII, without actually containing or disclosing CEII, do 
not automatically qualify as CEII unless the information provided could 
reasonably be expected to lead to the disclosure of CEII.
6. Duration of Designation
NOPR
    65. Section 215A(d)(9) provides that information ``may not be 
designated as critical electric infrastructure information for longer 
than 5 years, unless specifically re-designated by the Commission or 
the Secretary, as appropriate.''\105\ The NOPR stated that the five-
year designation period will commence upon submission, and the 
expiration of the five-year period will not automatically trigger the 
public release of the information unless the Commission determines it 
is appropriate to do so.\106\ The NOPR also stated that the Commission 
will make a re-designation determination when an entity requests the 
information; when staff determines a need to remove the designation; or 
when a submitter requests that the information no longer be treated as 
CEII.\107\ Consistent with current practice, the NOPR proposed that a 
NDA will require protection of CEII past the expiration of the CEII 
designation marked on the information and that the recipient of CEII 
from the Commission must receive prior authorization from the 
Commission before making any disclosure.\108\
---------------------------------------------------------------------------

    \105\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312, 
1776.
    \106\ NOPR, 155 FERC ] 61,278 at P 18 n.14 and P 24.
    \107\ Id.
    \108\ Id. P 26.
---------------------------------------------------------------------------

    66. In the NOPR, the Commission proposed removing the CEII 
designation when the information no longer could impair the security or 
reliability of not only the bulk-power system or distribution 
facilities but also other forms of energy infrastructure.\109\ The 
Commission stated that the Commission would provide notice to the 
submitter ``in the instance where the Commission takes the affirmative 
step to rescind the designation.'' \110\
---------------------------------------------------------------------------

    \109\ Id. P 27.
    \110\ Id.
---------------------------------------------------------------------------

Comments
    67. Several commenters support the proposal to maintain information 
as non-public after CEII designations marked on the information 
expire.\111\ However, Peak requests that the Commission determine at 
the time of the designation whether the data will lose its protection 
after the five-year term ends and recommends creating designation 
categories that include designation timeframes.\112\ The Trade 
Associations and APPA ask the Commission to automatically re-designate 
information, absent objection.\113\ Tallgrass requests that a 
designation remain for the life of a pipeline facility.\114\ INGAA 
requests that the Commission never un-designate CEII related to 
pipeline facilities on its own initiative or unilaterally as long as 
the facility is in operation.\115\
---------------------------------------------------------------------------

    \111\ See, e.g., ITC Comments at 2-3; INGAA Comments at 3; NRECA 
Comments at 9.
    \112\ Peak Comments at 10-11 (recommending categories such as 
``transmission and generation outage data, generator-specific 
forecast data, transmission facility and load status and 
measurements, specific facility modeling data, and device lists'').
    \113\ Trade Associations Comments at 21-22; APPA Comments at 20.
    \114\ Tallgrass Comments at 3.
    \115\ INGAA Comments at 3.
---------------------------------------------------------------------------

    68. APS requests clarification on whether the criteria for re-
designating CEII are the same as the criteria used for the initial CEII 
designation.\116\
---------------------------------------------------------------------------

    \116\ APS Comments at 12.
---------------------------------------------------------------------------

    69. NRECA and ITC assert that the NOPR is unclear with respect to 
the notice and comment provisions pertaining to a determination to 
remove CEII designations. In particular, they urge the Commission to 
clarify that submitters will receive notice, an opportunity to comment, 
and appeals rights prior to any determination to remove a CEII 
designation and prior to any disclosure of the information.\117\ ITC 
also states that the NOPR proposal to ``notify the person who submitted 
the document and give the person an opportunity (at least five calendar 
days) in which to comment in writing prior to the removal of the 
designation'' is insufficient notice. ITC asks the Commission to 
provide notice and an opportunity to comment not only to the ``person 
who submitted the document'' but also to the organization on whose

[[Page 93740]]

behalf the person submitted the document.\118\
---------------------------------------------------------------------------

    \117\ NRECA Comments at 11; ITC Comments at 3-4.
    \118\ ITC Comments at 3.
---------------------------------------------------------------------------

    70. APPA requests that the Commission revise the language in 
amended section 388.113(e) to ensure that designations made by DOE 
cannot be removed by the Commission.\119\
---------------------------------------------------------------------------

    \119\ APPA Comments at 26.
---------------------------------------------------------------------------

Commission Determination
    71. The Commission adopts the NOPR proposal to treat expired CEII 
as non-public until a re-designation determination is made. Such a 
process is supported by the majority of commenters and is reasonable 
given the large volume of CEII presently in the Commission's files and 
anticipated to be filed. Consistent with the NOPR's intent, the 
Commission will modify the regulatory language in amended section 
388.113(e) to indicate that the Commission will treat information as 
non-public after the CEII designation has lapsed; that no information 
will be released as non-CEII unless the Commission decides to release 
the information; and that notice and opportunity for comment will be 
provided to the submitter prior to any determination that the CEII 
designation of a submitted document should be removed.
    72. We do not adopt the recommendations to automatically re-
designate information, designate by category, or designate for the 
lifetime of a facility. Blanket designations are inconsistent with FPA 
section 215A(d)(9), which requires the Commission to specifically re-
designate information.\120\
---------------------------------------------------------------------------

    \120\ Section 215A(d)(9) states that information ``may not be 
designated as critical electric infrastructure information for 
longer than 5 years, unless specifically re-designated by the 
Commission or the Secretary, as appropriate.'' FAST Act, Public Law 
114-94, section 61,003, 129 Stat. 1312, 1776.
---------------------------------------------------------------------------

    73. In response to ITC's comments that providing notice to the 
person who submitted the document is insufficient, we clarify that the 
Commission will provide the person and/or the organization identified 
on the submission notice an opportunity to comment as well as appeal 
rights prior to any determination to rescind a CEII designation or 
release the information.\121\
---------------------------------------------------------------------------

    \121\ The Commission will use the relevant service list, where 
appropriate, to determine the appropriate recipient.
---------------------------------------------------------------------------

    74. With respect to APPA's comments regarding the Commission's 
ability to remove a DOE designation, we clarify that the Commission 
does not intend to remove any designations that DOE may make. With 
respect to APS's request for clarification regarding re-designations, 
we clarify that the regulations adopted herein do not differentiate 
between the processes for designating or re-designating information as 
CEII.
7. Judicial Review of Designation
NOPR
    75. The Commission proposed to require a person seeking to 
challenge a Commission designation determination to file an 
administrative appeal with the Commission's General Counsel prior to 
seeking judicial review in federal district court under section 
215A(d)(11).\122\
---------------------------------------------------------------------------

    \122\ NOPR, 155 FERC ] 61,278 at P 28.
---------------------------------------------------------------------------

Comments
    76. HRC contends that the Commission's administrative appeal 
requirement should not be mandatory.\123\ NRECA asserts that the 
Commission does not have a legal basis for the administrative appeal 
requirement.\124\ NRECA also recommends that the regulations specify 
the timeframes in which appeals can be pursued; a timeframe for when a 
decision on the appeal should be rendered; and that the designation 
will remain in place until legal challenges have been exhausted.\125\
---------------------------------------------------------------------------

    \123\ HRC Comments at 3.
    \124\ NRECA Comments at 11; HRC Comments at 3-4.
    \125\ Id.
---------------------------------------------------------------------------

    77. NRECA contends that the Commission must revise the delegation 
authority provisions in section 375.313 to allow the General Counsel to 
hear and decide an administrative appeal.\126\
---------------------------------------------------------------------------

    \126\ NRECA Comments at 12.
---------------------------------------------------------------------------

Commission Determination
    78. With respect to NRECA and HRC's comment, Congress directed the 
Commission to establish criteria and procedures to designate 
information as CEII, and the mandatory appeal to the Commission's 
General Counsel is a procedure that will assist in proper designation 
of such information. Requiring a party to exhaust administrative 
remedies prior to taking a matter to court is a standard and basic 
function of administrative law.\127\ The administrative appeal process 
gives the Commission an opportunity to correct any error and to ensure 
that Commission policy has been properly complied with. This process 
creates efficiency in the administrative process and promotes judicial 
economy. In addition, the current FOIA and CEII process provides for 
administrative appeal.\128\
---------------------------------------------------------------------------

    \127\ See Hidalgo v. FBI, 344 F.3d 1256, 1258-59 (D.C. Cir. 
2003) (holding that ``exhaustion of administrative remedies is 
generally required before filing suit in federal court so that the 
agency has an opportunity to exercise its discretion and expertise 
on the matter and to make a factual record to support its 
decision'').
    \128\ NOPR, 155 FERC ] 61,278 at P 28.
---------------------------------------------------------------------------

    79. In response to NRECA's suggestion regarding appeal timeframes, 
the Commission will revise the amended regulations at section 
388.113(j) to provide more specificity about the process for submitting 
an administrative appeal. After receiving a determination that 
information no longer qualifies as CEII, a submitter may appeal that 
determination. To make an appeal, the submitter must file a notice of 
appeal to the General Counsel, copying the CEII Coordinator, within 5 
business days of the date of the determination.\129\ A statement in 
support of the appeal (a statement providing applicable facts and legal 
authority) must be submitted to the General Counsel within 20 business 
days of the date of the determination. The appeal will be considered 
received upon receipt of the statement in support of the appeal. A 
determination denying a request for disclosure or denying a request to 
designate a document as public may also be appealed. A notice of appeal 
is not required for these determinations because information would not 
be disclosed under the challenged decision. However, the requester must 
submit an appeal within 20 business days of the date of the 
determination by submitting its statement in support of its appeal to 
the Commission's General Counsel.\130\ The General Counsel or the 
General Counsel's designee will make a determination with respect to 
any appeal within 20 business days after the receipt of the appeal, 
unless extended pursuant to section 388.110(b)(1), which will equally 
apply to CEII for purposes of appeals.
---------------------------------------------------------------------------

    \129\ Requiring the submitter to inform the Commission of its 
intent to appeal within 5 business days will allow the Commission to 
know sooner than later whether the submitter plans to challenge the 
decision and, if not, allow the Commission to disclose the 
information sooner.
    \130\ The Trade Associations suggest that the Commission should 
issue an order on appeal of any denial of an information owner's 
objections to disclosure of CEII pursuant to a NDA. Trade 
Association Comments at 20. Under our current practice, the decision 
to disclose CEII pursuant to a NDA is appealable directly to a 
district court under 5 U.S.C. 552(a)(4)(B). There is no need to 
establish an additional procedure under the amended regulations that 
requires the Commission to issue an order on appeal.
---------------------------------------------------------------------------

    80. To avoid any uncertainty, the Commission will amend section 
375.309 to include a provision to make clear that the Commission has 
delegated to the General Counsel authority to make determinations on 
behalf of the

[[Page 93741]]

Commission on appeals of designations and determinations regarding 
CEII.

C. Duty to Protect CEII

NOPR
    81. The Commission proposed revisions to strengthen the handling 
requirements for Commission employees and external recipients of CEII. 
With respect to Commission staff, the Commission proposed to add 
section 388.113(h) to require Commissioners, Commission staff, and 
Commission contractors to comply with the Commission's internal 
controls.\131\ For external recipients of CEII, the Commission proposed 
requiring requesters to provide specific information to demonstrate a 
legitimate need for the information and to include a signed statement 
attesting to the accuracy of the information provided in any CEII 
request.\132\ The Commission also proposed that all NDAs minimally 
require that CEII: (1) will only be used for the purpose it was 
requested; (2) may only be discussed with authorized recipients; (3) 
must be kept in a secure place in a manner that would prevent 
unauthorized access; and (4) must be destroyed or returned to the 
Commission upon request. The Commission also proposed that the NDA make 
clear that the Commission may audit compliance with the NDA.
---------------------------------------------------------------------------

    \131\ NOPR, 155 FERC ] 61,278 at P 30.
    \132\ Id. PP 33-34. Specifically, the Commission proposed to 
require a requester to demonstrate: (1) the extent to which a 
particular function is dependent upon access to the information; (2) 
why the function cannot be achieved or performed without access to 
the information; (3) whether other information is available to the 
requester that could facilitate the same objective; (4) how long the 
information will be needed; (5) whether or not the information is 
needed to participate in a specific proceeding (with that proceeding 
identified); and (6) whether the information is needed 
expeditiously. Id.
---------------------------------------------------------------------------

Comments
    82. The Trade Associations request that the Commission provide 
further details of the content and nature of the internal controls and 
include them in the Commission's regulations.\133\ MISO agrees that the 
Commission should have internal controls and notes that the internal 
controls should be enforced.\134\
---------------------------------------------------------------------------

    \133\ Trade Associations Comments at P 36-37. The Trade 
Associations also state that the Commission should consider 
expounding on recommendations from the DOE IG.
    \134\ MISO Comments at 8.
---------------------------------------------------------------------------

    83. Several commenters request that the Commission expand the list 
of minimum requirements for a NDA. MISO and NRECA note that the NOPR 
recognizes the need for requesters to protect CEII after the 
designation has lapsed and recommend that the duty to protect expired 
CEII be included in the minimum NDA requirements.\135\ MISO, the Trade 
Associations and APS recommend that the Commission require recipients 
to report all unauthorized disclosures.\136\ NERC recommends adding to 
the NDA a requirement that a recipient must destroy or return CEII by 
specific deadlines.\137\ NERC and the Trade Associations request that 
submitters be able to enforce the terms of a NDA that covers the 
submitter's CEII.\138\
---------------------------------------------------------------------------

    \135\ MISO Comments at 8; NRECA Comments at 10.
    \136\ MISO Comments at 9; Trade Associations Comments at 26; APS 
Comments at 10.
    \137\ NERC Comments at 14.
    \138\ NERC Comments at 14; Trade Associations Comments at 26.
---------------------------------------------------------------------------

    84. In addition to the NDA recommendations stated above, the Trade 
Associations request that the Commission add the following clauses to 
the NDA: (1) Recipients of CEII shall have information protection 
policies and procedures to protect the CEII; and (2) an officer of the 
recipient's organization, on behalf of the organization, as well as all 
individuals who will have access to the CEII, shall execute the NDA, 
which shall specify that the individuals and organization face 
sanctions for failure to honor the terms of the NDA.\139\
---------------------------------------------------------------------------

    \139\ Trade Associations Comments at 26.
---------------------------------------------------------------------------

    85. APS encourages the Commission to review the current NDA for 
potential gaps, such as the lack of an obligation to treat CEII with 
the same degree of care as a requester would treat its own confidential 
or proprietary information.\140\ NRECA asks the Commission to clarify 
that a NDA is required when an entity receives CEII after the 
designation expires.\141\
---------------------------------------------------------------------------

    \140\ APS Comments at 9-10.
    \141\ NRECA Comments at 10.
---------------------------------------------------------------------------

    86. Peak seeks clarification regarding the requirements for keeping 
CEII in a secure place and manner.\142\ Peak explains that recipients 
of CEII may have different views of what constitutes a ``secure 
place.''\143\
---------------------------------------------------------------------------

    \142\ Peak Comments at 14-15.
    \143\ Id.
---------------------------------------------------------------------------

    87. The Trade Associations recommend that the Commission adopt a 
monitoring and enforcement process to discourage unauthorized 
disclosures and ask for additional language clarifying that ``any 
person or entity found to have used or disclosed CEII in a manner 
inconsistent with the NDA will lose its access to CEII for an extended 
period of time.'' \144\ The Trade Associations and NRECA suggest that 
the Commission determine that noncompliance with the NDA would subject 
an individual to penalties of up to $1 million per violation per 
day.\145\
---------------------------------------------------------------------------

    \144\ Trade Associations Comments at 34.
    \145\ Trade Associations Comments at 35; NRECA Comments at 16-
17.
---------------------------------------------------------------------------

    88. NERC requests that the Commission ensure that requesters have 
not been convicted of criminal activity by performing background 
checks, reviewing watch lists, and verifying security clearances to 
prevent inadvertent disclosures of CEII to a person with a criminal 
record or who is under investigation or on a terrorist watch list.\146\
---------------------------------------------------------------------------

    \146\ NERC Comments at 13-14.
---------------------------------------------------------------------------

    89. NERC also proposes that the Commission include evidentiary 
criteria to determine whether a requester of CEII is legitimate, and 
the Trade Associations ask the Commission to conduct risk assessments 
on all requesters.\147\
---------------------------------------------------------------------------

    \147\ NERC Comments at 12-14; Trade Associations Comments at 33.
---------------------------------------------------------------------------

    90. APS urges the Commission to require all requests to include at 
least two business references and the submission of documentation of 
authority for organizational requesters.\148\ Peak requests that if a 
CEII request is not for participation in a specific proceeding, the 
requester should be required to include in its statement of need a 
``reliability or societal benefit.'' \149\
---------------------------------------------------------------------------

    \148\ APS Comments at 7-8.
    \149\ Peak Comments at 14.
---------------------------------------------------------------------------

Commission Determination
    91. We disagree with the Trade Associations' recommendation that we 
provide additional details regarding internal controls and that we 
include internal controls in the Commission's regulations. The NOPR 
stated that the internal controls will address ``how sensitive 
information, including CEII, should be handled, marked, and 
kept.''\150\ We find that this statement provides sufficient details 
regarding the nature of the internal controls. We also conclude that 
internal controls should not be specified in the Commission's 
regulations to allow Commission staff the flexibility to revise such 
controls as needed.\151\
---------------------------------------------------------------------------

    \150\ NOPR, 155 FERC ] 61,278 at P 30.
    \151\ In developing this Final Rule and the internal controls, 
the Commission has been cognizant of the recommendations of the DOE 
Inspector General Report from January 30, 2015 as well as the 
Commission's earlier response thereto, which are a matter of public 
record. See Department of Energy, Office of Inspector General, 
Inspection Report, Review of Controls for Protecting Nonpublic 
Information at the Federal Energy Regulatory Commission, DOE/IG-0933 
(January 2015), https://energy.gov/ig/downloads/inspection-report-doeig-0933.
---------------------------------------------------------------------------

    92. Amended section 388.113(h)(2) only includes ``minimum'' 
requirements

[[Page 93742]]

for a NDA and is not intended to be exhaustive or preclude other 
requirements. Under certain circumstances the Commission may add 
additional provisions to the NDA and submitters may request that 
additional provisions be added to the NDA.
    93. In response to MISO's and NRECA's comments, the Commission will 
amend section 388.113(h)(2) to require a recipient of CEII under a NDA 
to protect the CEII after a designation lapses as part of the list of 
minimum requirements of a NDA. In response to the comments by MISO, the 
Trade Associations and APS, we will also amend section 388.113(h)(2) to 
add an obligation to require CEII recipients to promptly report all 
unauthorized disclosures of CEII to the Commission.
    94. In response to NRECA's concern, the Commission clarifies that a 
requester seeking information past the expiration of the CEII 
designation marked on the information must still pursue the information 
through the CEII or FOIA processes. We read NRECA's comments to apply 
to situations where an entity requests information that has been 
submitted to the Commission more than five years prior to the request 
and the Commission has not made a determination to re-designate the 
information. In these situations, the CEII Coordinator will make a re-
designation determination as part of the response to a request seeking 
access to information that has a designation determination older than 
five years. If the information is re-designated as CEII, then it will 
be processed pursuant to the Commission's requirements for CEII.
    95. The Commission is not persuaded by Peak's comments that there 
is a need to clarify what constitutes maintaining CEII in a secure 
place. We believe that a ``secure place,'' as articulated in the NDA, 
has a well-understood meaning, i.e. safe or free from unauthorized 
access or a risk of loss.
    96. The Commission believes that it has sufficient authority to 
enforce the terms of the NDA and, as a result, it is unnecessary to 
confer on NERC or others authority to enforce the terms of a NDA.
    97. In response to the comments of the Trade Associations and 
NRECA, the Commission notes that the FAST Act does not require the 
Commission to develop sanctions for external recipients of CEII. In any 
event, the general CEII NDA already states that a violation of the NDA 
may result in civil sanctions for an external recipient of CEII, and it 
will continue to do so. It is not necessary to list all the various 
civil sanctions that may apply, as each matter would be reviewed on its 
own facts. For these reasons, we also decline to adopt the Trade 
Associations' recommendation that we add to the minimum requirements of 
a NDA a provision that CEII recipients may be sanctioned by losing 
access to CEII for an extended period of time.
    98. The Commission agrees that it is important to ensure that 
requesters of CEII do not pose security risks. CEII requesters have 
historically fallen into different categories, including individuals 
known to the Commission with no known risk.\152\ The Commission will 
continue the practice of requiring information needed to verify the 
legitimacy of a requester on an as-needed basis. As such, there is no 
need for a CEII requester to demonstrate that there is a ``reliability 
or social benefit'' to the request. We believe that our procedures have 
adequately assessed whether requestors should receive CEII. In 
addition, we propose additional requirements for a requester to obtain 
CEII information. Thus, given these procedures, it is not necessary to 
mandate specific background check criteria in the regulations. 
Moreover, while the current request form asks for a business reference, 
we are not persuaded that such a submission is necessary in all 
instances or that two references are necessary.\153\
---------------------------------------------------------------------------

    \152\ Requests are typically received from public utilities, gas 
pipelines, hydro developers, academics, landowners, public interest 
groups, researchers, renewable energy organizations, and 
consultants.
    \153\ Electronic CEII Request Form, https://www.ferc.gov/resources/guides/filing-guide/ceii-request.asp.
---------------------------------------------------------------------------

D. Sanctions

NOPR
    99. Section 215A(d)(2)(C) of the FPA requires the Commission to 
``ensure there are appropriate sanctions in place for Commissioners, 
officers, employees, or agents of the Commission or DOE who knowingly 
and willfully disclose critical electric infrastructure information in 
a manner that is not authorized under this section.'' \154\ The 
Commission proposed sanctioning unauthorized disclosures of CEII by 
Commission personnel and further noted that DOE will have 
responsibility for sanctions for unauthorized disclosures by its 
officers and employees.\155\ The Commission also proposed to refer any 
misconduct by the Chairman or Commissioners to the DOE Inspector 
General (DOE IG).\156\
---------------------------------------------------------------------------

    \154\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 
1312, 1776.
    \155\ NOPR, 155 FERC ] 61,278 at P 36.
    \156\ Id.
---------------------------------------------------------------------------

Comments
    100. Several commenters, including APPA and the Trade Associations, 
point to the absence of stated sanctions for Commissioners in the NOPR 
and request that the Commission consider whether to impose civil 
sanctions under section 316A of the FPA and criminal penalties under 
section 316(b) of the FPA.\157\ APPA also recommends that the 
Commission consider referring unauthorized CEII disclosures by 
Commissioners to the Department of Justice (DOJ) and that the 
Commission coordinate with DOE to outline a new or cite an existing 
procedure that DOE can utilize to sanction its employees.\158\ MISO 
suggests that the Commission's General Counsel be tasked with referring 
any willful, unauthorized disclosures to the DOE IG.\159\ NRECA asks 
that a mechanism be put in place for the public to make a referral to 
the DOE IG if they are aware of any misconduct.\160\ MISO and NRECA 
recommend that the Commission revise its proposed rule to make clear 
that the Commission ``shall'' refer any misconduct to the DOE IG and to 
allow the public to refer matters to the DOE IG.\161\
---------------------------------------------------------------------------

    \157\ See Trade Associations Comments at 40 (noting that CEII 
protections adopted in the FAST Act were adopted in the context of 
what many considered to be an inappropriate disclosure of CEII by a 
former FERC Commissioner); see also APPA Comments at 28. APPA states 
that the Commission has authority to impose civil penalties against 
``any person'' who violates any provision of any Commission rule and 
may use criminal penalties under FPA section 316(b) for knowing and 
willful violations, by ``any person'' of Commission rules or 
regulations under the FPA.
    \158\ APPA Comments at 27, 29. APPA also asserts that a DOE 
employee sanctioned for unauthorized disclosure may be able to 
challenge their sanction ``on grounds that it was not promulgated by 
the Commission, as directed by Congress.''
    \159\ MISO Comments at 10.
    \160\ NRECA Comments at 16.
    \161\ MISO Comments at 10; NRECA Comments at 16.
---------------------------------------------------------------------------

Commission Determination
    101. As discussed below, we conclude that the sanctions adopted in 
this Final Rule, as well as other reforms adopted prior to the passage 
of the FAST Act, provide sufficient deterrents to the unauthorized 
disclosure of CEII.
    102. First, we note that, in addition to the changes adopted in 
this Final Rule, the Commission has recently made a number of changes 
to its internal procedures to ensure the protection and security of 
CEII.
    103. The Commission has revised its security classification and 
ethics training to ensure that Commission employees are aware of their 
responsibility to protect sensitive

[[Page 93743]]

nonpublic information. The Commission also has strengthened its 
protection of CEII and other sensitive, non-public information. For 
example, the Commission conducted a comprehensive review of its 
internal information governance procedures, which informed the 
development of the internal controls referenced in this Final Rule. We 
believe that these reforms should help protect against unauthorized 
disclosure of CEII.
    104. The Commission has also taken steps to ensure that there are 
appropriate sanctions in place for certain persons who knowingly and 
willfully disclose CEII without authorization. With respect to former 
employees and Commissioners, the Commission has strengthened certain 
requirements applicable to departing employees and Commissioners by 
requiring them to certify that they are not unlawfully removing records 
from the agency. This certification form also identifies and requires a 
departing employee or Commissioner to acknowledge the potential 
criminal penalties associated with the unlawful removal or destruction 
of federal records. While these changes pre-date the passage of the 
FAST Act, they are an important component of the Commission's ongoing 
efforts to protect against improper disclosure of CEII.
    105. As to existing Commission officers, employees, and agents, we 
conclude that the sanctions adopted in this Final Rule are appropriate, 
as they provide for possible dismissal from federal service and 
criminal prosecution for improper disclosure of CEII. These sanctions 
should serve as a deterrent to, and punishment for, improper activity.
    106. With respect to Commissioners, we believe it is appropriate 
that violations be referred to the DOE IG, as that office is equipped 
to investigate a Commissioner's actions and impose sanctions on a 
Commissioner through an independent process outside of the Commission's 
enforcement process.\162\ For example, it is within the DOE IG's 
discretion after concluding its investigation to refer a matter to the 
DOJ for criminal prosecution. Upon becoming aware of a potentially 
improper disclosure of CEII, the Designated Agency Ethics Official 
(DAEO) will oversee an examination of those circumstances. If there is 
reason to believe that an improper disclosure has occurred, the DAEO 
will refer the matter to the DOE IG.
---------------------------------------------------------------------------

    \162\ We note that no commenter has indicated that the DOE IG 
has insufficient tools to investigate and, as appropriate, pursue 
sanctions for a Commissioner.
---------------------------------------------------------------------------

    107. Finally we conclude that there is no need to add a mechanism 
to our regulations for the public to make a referral to the DOE IG, as 
the DOE IG has an existing hotline in place for the public.\163\ The 
Commission will also continue to defer to DOE as to what sanctions 
would be appropriate for DOE officers and employees.
---------------------------------------------------------------------------

    \163\ See DOE IG Hotline, https://www.energy.gov/ig/services.
---------------------------------------------------------------------------

E. Voluntary Sharing of CEII

NOPR
    108. Section 215A(d)(2)(D) of the FPA requires the Commission, 
taking into account standards of the Electric Reliability Organization, 
to facilitate voluntary sharing of critical electric infrastructure 
information. The statute, specifically, directs the Commission to 
facilitate voluntary sharing with, between, and by Federal, State, 
political subdivision, and tribal authorities; the Electric Reliability 
Organization; regional entities; information sharing and analysis 
centers established pursuant to Presidential Decision Directive 63; 
owners, operators, and users of critical electric infrastructure in the 
United States; and other entities determined appropriate by the 
Commission.\164\
---------------------------------------------------------------------------

    \164\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 
1312, 1776.
---------------------------------------------------------------------------

    109. The Commission proposed that it would voluntarily share 
Commission-generated CEII and CEII submitted to the Commission with 
individuals or organizations when there is a need to ensure that energy 
infrastructure is protected.\165\ Under this proposal, the Commission 
may voluntarily share CEII without receiving a request for the 
CEII.\166\ However, the NOPR proposed that all voluntarily shared CEII 
would be shared subject to an appropriate NDA or Acknowledgement and 
Agreement.\167\ Additionally, the NOPR proposed to require an Office 
Director or his designee to consult with the CEII Coordinator before 
voluntarily sharing CEII.\168\
---------------------------------------------------------------------------

    \165\ NOPR, 155 FERC ] 61,278 at PP 37-38, 40.
    \166\ Id. P 38.
    \167\ Id. P 40.
    \168\ Id. P 39.
---------------------------------------------------------------------------

    110. In the NOPR, the Commission also noted that it retains the 
discretion to release information as necessary for other federal 
agencies to carry out their jurisdictional responsibilities.\169\
---------------------------------------------------------------------------

    \169\ Id.
---------------------------------------------------------------------------

    111. The NOPR also proposed that the Commission may impose 
additional restrictions on how voluntarily shared CEII may be used and 
maintained.\170\ Where practicable, the Commission proposed providing 
notice of its voluntary sharing of CEII to the submitter of the 
CEII.\171\
---------------------------------------------------------------------------

    \170\ Id. P 41.
    \171\ Id. P 42. The Commission noted that it may not be 
practicable to provide notice to the submitter in instances where 
voluntary sharing is necessary to maintain infrastructure security, 
to address a potential threat, or in other exigent circumstances.
---------------------------------------------------------------------------

Comments
    112. Several commenters observe that the NOPR only addressed the 
Commission's voluntary sharing of CEII and did not establish guidelines 
for the voluntary sharing of CEII ``with, between, and by'' other 
entities.\172\ Powerex requests that the Commission facilitate the 
sharing of CEII between and by owners, operators, and users of the 
critical electric infrastructure, while still adequately safeguarding 
CEII.\173\ The Public Interest Organizations and WIRAB recommend that 
the Commission adopt a ``white list'' of CEII requesters that the 
Commission determines do not pose a risk of unauthorized 
disclosure.\174\ They also contend that the Commission should adopt a 
universal NDA to encourage more sharing between and by non-Commission 
entities.\175\ WIRAB also seeks standardization of NDAs used by NERC, 
regional entities, and the owners and operators of Critical Electric 
Infrastructure in the United States.\176\
---------------------------------------------------------------------------

    \172\ See, e.g., Peak Comments at 5-6; Powerex Comments at 13-
14; APPA Comments at 31; NRECA Comments at 13.
    \173\ Powerex Comments at 13-15.
    \174\ Public Interest Organizations Comments at 8-9; WIRAB 
Comments at 9.
    \175\ Id.
    \176\ WIRAB Comments at 10.
---------------------------------------------------------------------------

    113. The Joint RTOs (ISO New England, Inc. and Southwest Power 
Pool, Inc.) suggest that the Commission facilitate the sharing of CEII 
by permitting regional transmission organizations (RTOs), independent 
system operators (ISOs), and other entities with FERC-approved tariffs 
or similar agreements to share CEII ``between the entities relying on 
their tariff information-handling commitments.'' \177\ In response, PJM 
states that the Commission should reject the Joint RTOs' proposal, 
arguing that it is incomplete and overbroad and fails to acknowledge 
results achieved through the current sharing of CEII.\178\ The Joint 
RTOs, in reply comments, state that their proposal would simply allow 
ISOs, RTOs, and other entities with

[[Page 93744]]

Commission-approved tariffs that have planning and operations 
responsibilities to use those tariffs to facilitate information-
sharing.\179\
---------------------------------------------------------------------------

    \177\ Joint RTOs Comments at 4. MISO also suggests the 
Commission encourage sharing between planning authorities and 
transmission planners. See MISO Comments at 10.
    \178\ PJM Reply Comments at 2.
    \179\ Joint RTOs Reply Comments at 2.
---------------------------------------------------------------------------

    114. NERC generally supports the Commission's proposal to 
facilitate voluntary information sharing with NERC, regional entities 
and information sharing and analysis centers. NERC, nonetheless, 
requests that the Commission, under appropriate circumstances, share 
CEII with the Electricity Information Sharing & Analysis Center (E-
ISAC) when voluntarily sharing CEII with a governmental entity.\180\ 
NERC asks that the voluntary sharing process include coordination 
between the CEII Coordinator and certain Commission office staff prior 
to any disclosure.\181\
---------------------------------------------------------------------------

    \180\ NERC Comments at 9.
    \181\ Id.
---------------------------------------------------------------------------

    115. APS, the Trade Associations and CEA ask for additional 
criteria as to how and when the Commission will voluntarily share 
information.\182\
---------------------------------------------------------------------------

    \182\ APS Comments at 13; Trade Associations Comments at 27; CEA 
Comments at 5.
---------------------------------------------------------------------------

    116. APPA asserts that FPA 215A(d)(2)(D) directs the Commission 
only to facilitate voluntary sharing of CEII among electricity 
subsector stakeholders--not to preemptively share CEII with interested 
parties.\183\ APPA asserts that when the Commission voluntarily shares 
submitted information, it effectively forces the entity that submitted 
the information as CEII to share its information with others, which may 
reduce the incentive for the entity to voluntarily share CEII with the 
Commission.\184\ APPA recommends that the Commission designate E-ISAC 
and any other appropriate Information Sharing and Analysis 
Organizations (ISAOs) as forums through which CEII can be shared under 
FPA 215A, and to apply the liability protections of FPA section 
215A(f)(3) to those entities.\185\ APPA also recommends that the 
Commission provide protections like those that are utilized by other 
federal agencies to facilitate information sharing activity.\186\
---------------------------------------------------------------------------

    \183\ APPA Comments at 30.
    \184\ Id.
    \185\ APPA Comments at 31-32.
    \186\ Id. at 31-32. For example, APPA proposes that the 
Commission allow for ``source anonymizing'' shared CEII or to adopt 
DHS's Traffic Light Protocol to ensure information is shared with 
the correct audience.
---------------------------------------------------------------------------

    117. The Trade Associations request that the regulations explicitly 
state that the voluntary sharing of CEII is limited to instances where 
the Commission has determined that there is a need to ``ensure that 
energy infrastructure is protected.'' \187\
---------------------------------------------------------------------------

    \187\ Trade Associations Comments at 27-28.
---------------------------------------------------------------------------

    118. CEA requests that the Commission include language clarifying 
that the Commission will make every reasonable effort to provide 
advance notice before sharing CEII and will provide after-the-fact 
notice if prior notice is not practical.\188\ MISO recommends that the 
Commission adopt regulatory language indicating that ``when prior 
notice is not given, submitters of CEII shall receive notice of a 
limited release of CEII as soon as practicable.'' \189\ NRECA requests 
that the Commission clarify that any disclosure by the Commission on 
the basis of ``voluntary sharing'' must be subject to the same notice, 
comment, and appeal rights provisions that are afforded to submitters 
in response to CEII requests.\190\
---------------------------------------------------------------------------

    \188\ CEA Comments at 6. NRECA also references the need to 
provide notice as soon as possible, even if such notice is after the 
disclosure. See NRECA Comments at 12.
    \189\ MISO Comments at 11.
    \190\ NRECA Comments at 12-13.
---------------------------------------------------------------------------

    119. The Trade Associations state that the proposed regulations 
could be strengthened by: (1) Limiting and defining the circumstances 
where notice would ``not be practicable''; and (2) allowing the 
submitters an opportunity to provide comments protesting the release of 
information the Commission proposes to voluntarily share.\191\
---------------------------------------------------------------------------

    \191\ Trade Associations Comments at 30.
---------------------------------------------------------------------------

    120. Finally, TAPS requests that the Commission revise its 
delegations to reflect the NOPR's proposal that Office Directors will 
engage in voluntary sharing.\192\
---------------------------------------------------------------------------

    \192\ TAPS Comments at 12-13.
---------------------------------------------------------------------------

Commission Determination
    121. Many of the commenters misapprehend how CEII may be 
voluntarily shared under the FAST Act or otherwise seek to expand the 
Commission's CEII sharing program in ways that neither the FAST Act nor 
the NOPR contemplated. Under FPA section 215A(a)(3), CEII is limited to 
information that is submitted to, or generated by, the Commission and 
designated as such by the Commission (or information submitted to, or 
generated by DOE, and designated as such by DOE).\193\ In voluntarily 
releasing CEII to a person, the Commission imposes obligations on that 
person through a NDA. However, the Commission's CEII rules do not, and 
are not intended to, address information that an entity has 
unilaterally determined to be CEII and never submitted to the 
Commission.\194\ In addition, the Commission's regulations do not cover 
an entity that has submitted CEII to the Commission but intends to 
share the same information with others outside of the Commission's 
processes. To be clear, an entity that receives CEII from the 
Commission is subject to the restrictions in the applicable NDA, 
including restrictions on use and disclosure. However, an entity that 
submitted the information to the Commission is not subject to a NDA 
and, as a result, the Commission's rules do not apply to how that 
entity may want to share its information.\195\ Moreover, an entity may 
have information that could qualify as CEII, but such information is 
not CEII under the Commission's regulations unless it has been 
submitted to the Commission pursuant to the Commission's CEII 
regulations and the Commission has determined it to be CEII.
---------------------------------------------------------------------------

    \193\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 
1312, 1773 (``critical electric infrastructure information means 
information . . . generated by or provided to the Commission or 
other Federal agency . . . that is designated as critical electric 
infrastructure information by the Commission or the Secretary 
pursuant to subsection (d)'').
    \194\ As CEII information has to be designated by the CEII 
Coordinator or DOE Secretary, information that an entity creates and 
maintains without providing to the Commission has not been formally 
designated as CEII.
    \195\ However, other concerns may influence how the entity 
shares its own information with others.
---------------------------------------------------------------------------

    122. The Final Rule facilitates voluntary sharing by allowing the 
public to request CEII and by adding to the Commission's regulations a 
process whereby staff may share CEII in a proactive manner with a 
variety of entities. The Commission agrees with PJM's comments that 
existing non-public voluntary sharing mechanisms within the energy 
industry are sufficient to encourage sharing information among the 
different groups and therefore there is no need for the Commission to 
establish requirements for sharing within the industry through tariff 
revisions or otherwise.\196\ It is also unnecessary to adopt Public 
Interest Organizations' and WIRAB's recommendation that the Commission 
establish ``whitelists'' for third parties to use or to require 
entities sharing information outside of the Commission's CEII process 
to adopt a particular NDA.
---------------------------------------------------------------------------

    \196\ Section 215A(d) requires the Commission ``to promulgate [-
] regulations as necessary'' to, inter alia, ``facilitate voluntary 
sharing of critical electric infrastructure information.'' FAST Act, 
Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. The FAST 
Act, therefore, affords the Commission with discretion in this 
regard and, at least implicitly, recognizes that the Commission may, 
identify, encourage and support existing processes to facilitate the 
voluntary sharing of CEII.

---------------------------------------------------------------------------

[[Page 93745]]

    123. The Commission agrees with NERC and APPA that the plain 
language of the statute expressly provides for the voluntary sharing of 
information with entities like E-ISAC and other ISAOs. Section 
215A(d)(2)(iv) concerns the voluntary sharing of CEII with, between, 
and by ``information sharing and analysis centers established pursuant 
to Presidential Decision Directive 63.'' Pursuant to that provision, 
the Commission anticipates voluntary sharing of information with, 
between and by E-ISAC and other ISAOs under the appropriate 
circumstances. Under our current NDAs, CEII recipients may share CEII 
with other individuals covered by a NDA for the same information.\197\ 
When information is provided in accordance with section 215A(d) the 
provisions for release from liability in section 215A(f)(3) would 
apply.
---------------------------------------------------------------------------

    \197\ See, e.g., Critical Energy Infrastructure Information 
General Non-Disclosure Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf (``A Recipient may only discuss CEII with 
another Recipient of the identical CEII. A Recipient may check with 
the CEII Coordinator to determine whether another individual is a 
Recipient of the identical CEII.'').
---------------------------------------------------------------------------

    124. The Commission disagrees with APPA that E-ISAC or another ISAO 
should be designated as a forum to share CEII. The FAST Act does not 
specify that the Commission should designate E-ISAC, another ISAO, or 
any other entity as a forum through which CEII can be shared under 
section 215A. In fact, a plain reading of the statute indicates that 
Congress designated the Commission as the entity to facilitate this 
sharing. As such, the Commission declines to take the recommendation of 
APPA.
    125. We disagree with APPA's assertions that the voluntary sharing 
provision in the Commission's regulations effectively requires entities 
to share CEII with another entity or the Commission.\198\ Section 
215A(d)(6) explicitly states that an entity is not required to share 
CEII with the Commission or another entity or person.\199\ The 
voluntary sharing provision does not impose a sharing requirement on 
entities; instead, it allows the Commission discretion to share, in 
certain circumstances, CEII that has already been submitted to, or 
generated by, the Commission.
---------------------------------------------------------------------------

    \198\ FAST Act, Public Law 114-94, 61,003, 129 Stat. 1312, 1777.
    \199\ Id.
---------------------------------------------------------------------------

    126. Even if the Commission's voluntary sharing of information were 
viewed as the same as a third-party sharing it, the Commission must 
balance its obligation to disclose information as necessary to carry 
out its jurisdictional responsibilities against an entity's possible 
preference not to have such information disclosed.\200\ The regulations 
adopted here achieve that balance. Furthermore, the FAST Act does not 
place limits on the Commission's ability to share information in its 
possession when authorized and necessary to carry out the requirements 
of the FAST Act or the Commission's other jurisdictional 
responsibilities.
---------------------------------------------------------------------------

    \200\ The FAST Act does not prohibit the Commission from 
disclosing any information, nor does it require an entity to produce 
any information. FAST Act, Public Law 114-94, section 61,003, 129 
Stat. 1312, 1777.
---------------------------------------------------------------------------

    127. As noted in the NOPR, in some circumstances, providing notice 
to a submitter of CEII that its information will be shared under 
section 215A could hamper the ability of the Commission to act in a 
timely way.\201\ The Commission, therefore, disagrees with the comments 
by APPA and NRECA that prior notice must be provided in each instance 
where the Commissions uses the voluntary sharing provisions of section 
215A. However, in response to the comments, the Commission clarifies in 
amended section 388.113(f) that the Commission will not provide 
advanced notice only in situations where there is an urgent need to 
disseminate the information. The Commission will also adopt MISO's and 
CEA's proposal that when prior notice is not given, the Commission will 
provide submitters of CEII whose information was shared with notice as 
soon as practicable.
---------------------------------------------------------------------------

    \201\ NOPR, 155 FERC ] 61,278 at P 38.
---------------------------------------------------------------------------

    128. The NOPR proposed to require that a consultation between the 
CEII Coordinator and the appropriate Office Director take place prior 
to any voluntary sharing of CEII. We disagree with NERC's proposal to 
add a requirement that staff from the Commission's Office of Electric 
Reliability (OER) and Office of Energy Infrastructure Security (OEIS) 
be involved in all voluntary sharing consultations because the 
information in question may not involve OEIS or OER subject matter. 
However, we note that the CEII Coordinator will consult with Commission 
staff as appropriate, which could include OER and OEIS staff. The 
Commission is also not persuaded that it is necessary to provide 
additional details regarding the factors the Commission will use to 
determine when voluntary sharing is appropriate. The NOPR specifically 
proposed that the Commission will voluntarily share ``CEII with 
individuals and organizations that the Commission has determined need 
the information to ensure that energy infrastructure is protected.'' 
\202\ Thus, the NOPR provided sufficient details on the circumstances 
in which the Commission will voluntarily share CEII. Providing more 
details may unnecessarily restrict the Commission's ability to 
voluntarily share needed information.
---------------------------------------------------------------------------

    \202\ NOPR, 155 FERC ] 61,278 at P 37.
---------------------------------------------------------------------------

    129. The Commission disagrees with APPA's suggestion that the 
regulations should include more developed protections to facilitate 
information sharing.\203\ The Commission believes that procedures 
outlined in the NOPR are sufficient to protect CEII that the Commission 
shares. When the Commission voluntarily shares information, CEII will 
be shared subject to an appropriate NDA or Acknowledgement and 
Agreement.\204\ Moreover, under section 388.113(f), the Commission may 
impose additional conditions on how the information may be used and 
maintained that the Commission voluntarily shares.
---------------------------------------------------------------------------

    \203\ Id. PP 31-32
    \204\ As noted below, to obtain CEII federal agencies execute an 
Acknowledgement and Agreement, as opposed to a NDA. See Federal 
Agency Acknowledgement and Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf.
---------------------------------------------------------------------------

    130. In response to TAPS's comment, the Commission finds that the 
CEII Coordinator delegation in section 375.313 is sufficient and does 
not require separate delegations for Office Directors to voluntarily 
share CEII. Moreover, existing section 388.113(d)(1) has allowed 
Commission staff to share Critical Energy Infrastructure Information 
with facility owners and operators. No such delegated authority has 
been used for such sharing.

F. Request for Access to CEII

NOPR
    131. The Commission proposed to maintain special access procedures 
for owner-operators of facilities, federal agencies, and intervening 
parties.\205\ For intervenors, the Commission proposed to move the 
existing procedures in section 388.112 to section 388.113 and to 
eliminate the exemption for certain LNG materials.\206\ For general 
requesters, the Commission added a one-year time limit for 
organizational requests and added back a time requirement for the 
Commission to process CEII requests.\207\ The Commission also proposed 
adding a provision to clarify that the Commission's CEII regulations 
should

[[Page 93746]]

not be construed to require the release of certain non-CEII.\208\
---------------------------------------------------------------------------

    \205\ NOPR, 155 FERC ] 61,278 at PP 43-49.
    \206\ Id. P 49.
    \207\ Id. PP 50-51.
    \208\ Id. P 52.
---------------------------------------------------------------------------

Comments
    132. APPA recommends that the Commission adopt a tiered system with 
varying levels of access restrictions.\209\ APPA and the Trade 
Associations suggest that the Commission create a distinct ``need to 
know'' standard to access information related to the bulk-power 
system.\210\ Under this suggested standard, CEII would only be 
disclosed when the person or entity seeking the information has a 
direct ``need to know'' in order to maintain reliability, safety, or 
security.\211\
---------------------------------------------------------------------------

    \209\ APPA Comments at 19.
    \210\ APPA Comments at 18; Trade Associations Comments at 27.
    \211\ APPA Comments at 9; Trade Associations Comments at 27.
---------------------------------------------------------------------------

    133. The Trade Associations recommend that if an academic 
institution or other members of the public request CEII, the Commission 
should deny the request and refer the request to the information 
owner.\212\ Peak, on the other hand, supports data sharing with 
researchers and asks the Commission to permit researchers to access 
CEII data.\213\ Peak also suggests that the Commission consider whether 
``research institutions with defined cyber security and employee 
background checks'' should have a specific process for obtaining 
CEII.\214\ WIRAB supports the Commission's balancing approach for 
determining who should receive CEII, but WIRAB recommends that the 
Commission delete the portion of proposed section 388.113(g)(iv) that 
states that the Commission can deny a request for ``other reasons.'' 
\215\
---------------------------------------------------------------------------

    \212\ Trade Associations Comments at 32.
    \213\ Peak Comments at 7-8.
    \214\ Id. at 14.
    \215\ WIRAB Comments at 8.
---------------------------------------------------------------------------

    134. Peak recommends that the Commission's sharing of CEII with 
owners and operators should not be limited to information related to 
``its own facility.'' \216\
---------------------------------------------------------------------------

    \216\ Peak Comments at 13.
---------------------------------------------------------------------------

    135. Public Interest Organizations support the NOPR's proposed 
revisions allowing certain LNG materials to be accessible in 
proceedings in which there is a right to intervention.\217\ Public 
Interest Organizations suggest that ``the Commission streamline the 
release of CEII data for intervenors by allowing one request to trigger 
release of all of an entity's CEII data.'' \218\
---------------------------------------------------------------------------

    \217\ Public Interest Organizations Comments at 9.
    \218\ Id. at 9-10.
---------------------------------------------------------------------------

    136. MISO notes that for purposes of consistency, the Commission 
should add language already in section 388.112(b)(iv) to amended 
section 388.113(g)(4) to ensure that, if an objection to a request for 
disclosure is filed, whether the information is privileged or CEII, 
``the filer shall not provide the non-public document to the person or 
class of persons identified in the objection until ordered by the 
Commission or a decisional authority.'' \219\
---------------------------------------------------------------------------

    \219\ MISO Comments at 4.
---------------------------------------------------------------------------

    137. Peak asks the Commission to clarify whether the protections 
proposed in section 388.113(g)(2) regarding the obligation of federal 
agency recipients to protect CEII in the same manner as the Commission 
extends to data generated by a federal agency through an analysis of 
CEII.\220\
---------------------------------------------------------------------------

    \220\ Peak Comments at 13.
---------------------------------------------------------------------------

    138. APS requests that the Commission revise amended section 
388.113(g)(5)(vi) to require organizational requesters to promptly 
update/remove individuals from their list of approved individuals.\221\
---------------------------------------------------------------------------

    \221\ APS Comments at 11; see also Trade Associations Comments 
at 35.
---------------------------------------------------------------------------

    139. The Trade Associations and APS state that they are concerned 
that amended section 388.113(g)(5)(v), which allows an individual under 
an organizational request to have access to CEII for the remainder of a 
calendar year, may result in a less robust verification system.\222\ 
WIRAB supports allowing requesters to maintain their validity for the 
duration of the calendar year.\223\
---------------------------------------------------------------------------

    \222\ Trade Associations Comments at 35; APS Comments at 10-11.
    \223\ WIRAB Comments at 9.
---------------------------------------------------------------------------

    140. INGAA asks for acknowledgment that the Commission approves of 
entities providing requested information directly to CEII 
requesters.\224\ INGAA also requests that proposed section 
388.113(g)(5)(ix) be modified to add ``information on rare species of 
plants and animals'' to the list of items not required to be released 
through the CEII process.\225\
---------------------------------------------------------------------------

    \224\ INGAA Comments at 4.
    \225\ Id.
---------------------------------------------------------------------------

    141. Public Interest Organizations ask the Commission to establish 
a reasonable timeline for the review of and response to CEII 
requests.\226\ APS requests that the Commission add a default twenty-
day time period to respond to CEII requests unless the information is 
needed in fewer than twenty days.\227\ NERC suggests that the 
Commission add a provision indicating that the Commission may toll the 
response time when there is a need to gather further information from 
the requester.\228\
---------------------------------------------------------------------------

    \226\ Public Interest Organizations Comments at 10 (noting that 
it often takes 4-6 months to get access to Form No. 715 information 
through the existing Critical Energy Infrastructure Information 
process).
    \227\ APS Comments at 8.
    \228\ NERC Comments at 16 (citing 5 U.S.C. 552(a)(6)(B)(ii)).
---------------------------------------------------------------------------

    142. NERC requests that the appeal rights available to requesters 
be made available to submitting entities to avoid disclosures that 
might place CEII at risk.\229\ TAPS asks for clarification that when 
conditions are imposed on a receipt of CEII, appeal rights will be 
granted.\230\
---------------------------------------------------------------------------

    \229\ Id. at 18.
    \230\ TAPS Comments at 14.
---------------------------------------------------------------------------

Commission Determination
    143. APPA and the Trade Associations have not demonstrated a need 
for the Commission to change its practices and use a tiered system of 
categories of CEII or a heightened ``need to know'' standard for bulk-
power system information. The Commission will continue to ``balance the 
requestor's need for the information against the sensitivity of the 
information.'' \231\ The Commission has utilized this balancing 
approach effectively in response to Critical Energy Infrastructure 
Information requests for almost fifteen years. The balancing approach 
has provided to individuals with a demonstrated need access to 
information subject to a NDA. However, in some instances, the 
Commission has balanced a requester's asserted need for the information 
against its sensitivity and has determined not to produce certain types 
of CEII to the requester. The Commission will continue this balancing 
approach under the Final Rule.
---------------------------------------------------------------------------

    \231\ Section 388.113(g)(5)(iii).
---------------------------------------------------------------------------

    144. As noted above, the FAST Act does not require changes to the 
Commission's existing process for accessing information. The CEII 
Coordinator will continue to evaluate each request individually. In 
response to Peak's comments, the Commission notes that the current 
procedures allow academics to obtain CEII, and that the Commission 
does, as appropriate in individual rulemakings, consider whether 
certain categories of information should generally be made available 
for research.\232\ The Commission is not persuaded that any

[[Page 93747]]

changes should be made to restrict or expand access to CEII by 
academics.
---------------------------------------------------------------------------

    \232\ See, e.g., Reliability Standard for Transmission System 
Planned Performance for Geomagnetic Disturbance Events, 156 FERC ] 
61,215, at PP 93-95 (2016) (determining that geomagnetically induced 
current monitoring and magnetometer data will help facilitate 
geomagnetic disturbance research and concluding that such data 
typically should not be treated as confidential).
---------------------------------------------------------------------------

    145. The Commission also disagrees with deleting the term ``other 
reasons'' from proposed section 388.113(g)(5)(iv) as there may be other 
legitimate reasons why the Commission would not permit access to 
certain CEII in particular situations.
    146. The Commission is not persuaded that it needs to adopt Peak's 
proposed changes to the owner-operator provision. An owner-operator has 
a need to obtain CEII about its own facility. To the extent the owner-
operator needs other CEII, it can pursue additional information through 
the regular CEII request process.
    147. As to the comment by Public Interest Organizations, the Final 
Rule maintains the mechanism for interveners to request CEII outside of 
the CEII process.\233\
---------------------------------------------------------------------------

    \233\ See section 388.113(g)(4).
---------------------------------------------------------------------------

    148. The Commission agrees with MISO's change to proposed section 
388.113(g)(4), and amends that provision to include all of the language 
that currently exists in section 388.112(b)(2)(iv) to ensure that if an 
objection to the disclosure of CEII is filed, the information will not 
be disclosed until directed by the Commission or a decisional 
authority.
    149. In response to Peak's comments, the Commission clarifies that 
a federal agency in receipt of CEII from the Commission must protect 
that information in the same manner as the Commission. That agency will 
be required to execute an appropriate Agency Acknowledgment and 
Agreement. We clarify that derivative analyses that use or rely on 
CEII, without actually disclosing CEII, do not automatically qualify as 
CEII unless the information provided could reasonably be expected to 
lead to the disclosure of CEII.\234\
---------------------------------------------------------------------------

    \234\ See supra P 64.
---------------------------------------------------------------------------

    150. Recognizing that the employment status and circumstances 
surrounding an individual or organization can change, in response to 
APS's comment, the Commission will modify the NDAs to indicate that a 
recipient of CEII must promptly notify the Commission if any changed 
conditions, such as a change in employment, occur.
    151. Amended section 388.113(g)(5)(v) recognizes that in some 
instances a requester may request CEII multiple times during a calendar 
year. In response to comments by APS and Trade Associations regarding 
the robustness of the requester verifications, the Commission clarifies 
that each request will be reviewed by balancing the needs of the 
requester against the sensitivity of the requested information.
    152. In response to INGAA's request, the Commission notes that 
under the current CEII rules, entities may share information that they 
submitted to the Commission with a request for CEII treatment (as 
opposed to CEII that they received from the Commission) directly with 
other entities, and the Commission will continue to encourage and 
support such a practice. The Commission adopts INGAA's recommendation 
that ``information about rare species of plants and animals'' be added 
to the section 388.113(g)(5)(ix) list of items that are not required to 
be released when the information is inextricably intertwined with CEII.
    153. In response to comments by Public Interest Organizations, the 
Commission is not persuaded that additional clarifications regarding 
timing are necessary. Section 388.113(g)(5)(vii) of the amended 
regulations indicates that the time period for responding to CEII 
requests should mirror the period for responding to FOIA requests. In 
response to APS's suggestion of a default time period for the 
Commission to respond to a request for CEII unless the information is 
needed sooner, expedited treatment is not needed, as a requester may 
include a timeframe in which it needs the information, and the 
Commission will endeavor to respond in that period. The Commission 
believes that NERC's recommendation to place language concerning 
tolling in the CEII regulation is not necessary, as the time 
requirement for responses to requesters is not binding and the 
Commission's practice is to always toll the response period when 
further information is needed.
    154. In response to NERC's comment regarding appeal rights, the 
Commission notes that the existing CEII appeals process, which provides 
appeal rights to the requester, has been effective and there is no 
compelling need to extend a right to appeal to anyone other than the 
individual requester. If a submitter believes that its objection to 
disclosure of its CEII under a NDA has not been fully addressed, the 
submitter may raise that issue in district court.\235\
---------------------------------------------------------------------------

    \235\ Because the challenge does not relate to the designation 
of the information, the action would not be under FPA section 
215A(d)(11). See supra note 130; see also Cortez III Serv. Corp v. 
NASA, 921 F.Supp. 8, 11 (D.D.C. 1996) (holding, in a ``reverse 
FOIA'' action, that courts have jurisdiction over claims from 
parties that a release of their information would adversely affect 
them.'')
---------------------------------------------------------------------------

    155. In response to TAPS's comment, the Commission clarifies that 
appeal rights apply when it imposes any conditions on receipt of CEII.

III. Information Collection Statement

    156. The Paperwork Reduction Act and Office of Management and 
Budget's (OMB) implementing regulations require OMB to review and 
approve certain information collection requirements imposed by agency 
rule.\236\ This Final Rule does not impose any additional information 
collection requirements.\237\ Therefore, the information collection 
regulations do not apply to this Final Rule.
---------------------------------------------------------------------------

    \236\ 5 CFR part 1320.
    \237\ The current information collection requirements related to 
requesting access to CEII material are approved by OMB under FERC-
603 (OMB Control No. 1902-0197).
---------------------------------------------------------------------------

IV. Environmental Analysis

    157. The Commission is required to prepare an Environmental 
Assessment or an Environmental Impact Statement for any action that may 
have a significant adverse effect on the human environment.\238\
---------------------------------------------------------------------------

    \238\ Regulations Implementing National Environmental Policy Act 
of 1969, Order No. 486, FERC Stats. & Regs. ] 30,783 (1987).
---------------------------------------------------------------------------

    158. The Commission has categorically excluded certain actions from 
this requirement as not having a significant effect on the human 
environment. Included in the exclusion are rules that are clarifying, 
corrective, or procedural, or that do not substantially change the 
effect of the regulations being amended.\239\ The actions here fall 
within this categorical exclusion in the Commission's regulations.
---------------------------------------------------------------------------

    \239\ 18 CFR 380.4(a)(2)(ii).
---------------------------------------------------------------------------

V. Regulatory Flexibility Act Certification

    159. The Regulatory Flexibility Act of 1980 (RFA) requires 
rulemakings to contain either a description and analysis of the effect 
that the rule will have on small entities or a certification that the 
rule will not have a significant economic impact on a substantial 
number of small entities.\240\ Rules that are exempt from the notice 
and comment requirements of section 553(b) of the Administrative 
Procedure Act are exempt from the RFA requirements. The Final Rule 
concerns rules of agency procedure and, therefore, an analysis under 
the RFA is not required.\241\
---------------------------------------------------------------------------

    \240\ 5 U.S.C. 603 (2012).
    \241\ 5 U.S.C. 553(b).
---------------------------------------------------------------------------

VI. Document Availability

    160. In addition to publishing the full text of this document in 
the Federal Register, the Commission provides all interested persons an 
opportunity to

[[Page 93748]]

view and/or print the contents of this document via the Internet 
through the Commission's Home Page (https://www.ferc.gov) and in the 
Commission's Public Reference Room during normal business hours (8:30 
a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, 
Washington, DC 20426.
    161. From the Commission's Home Page on the Internet, this 
information is available on eLibrary. The full text of this document is 
available on eLibrary in PDF and Microsoft Word format for viewing, 
printing, and/or downloading. To access this document in eLibrary, type 
the docket number of this document, excluding the last three digits, in 
the docket number field.
    162. User assistance is available for eLibrary and the Commission 
Web site during normal business hours from FERC Online Support at 202-
502-6652 (toll free at 1-866-208-3676) or email at 
ferconlinesupport@ferc.gov, or the Public Reference Room at (202) 502-
8371, TTY (202) 502-8659. Email the Public Reference Room at 
public.referenceroom@ferc.gov.

VII. Effective Date and Congressional Notification

    163. These regulations are effective February 21, 2017. The 
Commission has determined, with the concurrence of the Administrator of 
the Office of Information and Regulatory Affairs of OMB, that this rule 
is not a ``major rule'' as defined in section 351 of the Small Business 
Regulatory Enforcement Fairness Act of 1996. The Commission will submit 
the Final Rule to both houses of Congress and to the General 
Accountability Office.

List of Subjects

18 CFR Part 375

    Authority delegations (Government agencies), Seals and insignia, 
Sunshine Act.

18 CFR Part 388

    Confidential business information, Freedom of information.

    By the Commission.

    Issued: November 17, 2016.
Nathaniel J. Davis, Sr.,
Deputy Secretary.

    In consideration of the foregoing, the Commission amends Parts 375 
and 388, Chapter I, Title 18, Code of Federal Regulations, as follows:

PART 375-- THE COMMISSION

0
1. The authority citation for part 375 continues to read as follows:

    Authority:  5 U.S.C. 551-557; 15 U.S.C. 717-717w, 3301-3432; 16 
U.S.C. 791-825r, 2601-2645; 42 U.S.C. 7101-7352.


0
2. In Sec.  375.309, paragraph (h) is added as follows:


Sec.  375.309   Delegations to the General Counsel

* * * * *
    (h) Deny or grant, in whole or in part, an appeal of a 
determination by the CEII Coordinator.

0
3. In Sec.  375.313:
0
a. Revise the section heading and paragraphs (a) and (b);
0
b. Redesignate paragraphs (c) through (e) as paragraphs (d) through (f) 
and revising newly redesignated paragraphs (d) through (f); and
0
c. Add a new paragraph (c).
    The revisions and addition read as follows:


Sec.  375.313   Delegations to the Critical Energy/Electric 
Infrastructure Information (CEII) Coordinator

* * * * *
    (a) Receive and review all requests for CEII as defined in Sec.  
388.113(c) of this chapter.
    (b) Make determinations as to whether particular information fits 
within the definition of CEII found at Sec.  388.113(c) of this 
chapter, including designating information, as appropriate.
    (c) Make determinations that information designated as CEII should 
no longer be so designated when the unauthorized disclosure of the 
information could no longer be used to impair the security or 
reliability of the bulk-power system or distribution facilities or any 
other form of energy infrastructure.
    (d) Make determinations as to whether a particular requester's need 
for and ability and willingness to protect CEII warrants limited 
disclosure of the information to the requester.
    (e) Establish reasonable conditions on the release of CEII.
    (f) Release CEII to requesters who satisfy the requirements in 
paragraph (d) of this section and agree in writing to abide by any 
conditions set forth by the Coordinator pursuant to paragraph (e) of 
this section.

PART 388--INFORMATION AND REQUESTS

0
4. The authority citation for part 388 is revised to read as follows:

    Authority:  5 U.S.C. 301-305, 551, 552 (as amended), 553-557; 42 
U.S.C. 7101-7352; 16 U.S.C. 824(o-l).


0
5. In Sec.  388.112, the section heading, paragraph (a), the heading of 
paragraph (b), and paragraphs (b)(1), (b)(2)(i), (b)(2)(vi), (c)(1), 
(d), and (e) are revised to read as follows:


Sec.  388.112   Requests for privileged treatment for documents 
submitted to the Commission

    (a) Scope. By following the procedures specified in this section, 
any person submitting a document to the Commission may request 
privileged treatment for some or all of the information contained in a 
particular document that it claims is exempt from the mandatory public 
disclosure requirements of the Freedom of Information Act, 5 U.S.C. 552 
(FOIA), and should be withheld from public disclosure. For the purposes 
of the Commission's filing requirements, non-CEII subject to an 
outstanding claim of exemption from disclosure under FOIA will be 
referred to as privileged material. The rules governing CEII are 
contained in Sec.  388.113.
    (b) Procedures for filing and obtaining privileged material. (1) 
General Procedures. A person requesting that material be treated as 
privileged information must include in its filing a justification for 
such treatment in accordance with the filing procedures posted on the 
Commission's Web site at https://www.ferc.gov. A person requesting that 
a document filed with the Commission be treated as privileged in whole 
or in part must designate the document as privileged in making an 
electronic filing or clearly indicate a request for such treatment on a 
paper filing. The cover page and pages or portions of the document 
containing material for which privileged treatment is claimed should be 
clearly labeled in bold, capital lettering, indicating that it contains 
privileged or confidential information, as appropriate, and marked ``DO 
NOT RELEASE.'' The filer also must submit to the Commission a public 
version with the information that is claimed to be privileged material 
redacted, to the extent practicable.
    (2) * * *
    (i) If a person files material as privileged material in a 
complaint proceeding or other proceeding to which a right to 
intervention exists, that person must include a proposed form of 
protective agreement with the filing, or identify a protective 
agreement that has already been filed in the proceeding that applies to 
the filed material. This requirement does not apply to material 
submitted in hearing or settlement proceedings, or if the only material 
for which privileged treatment is claimed consists of landowner lists 
or privileged information filed under Sec. Sec.  380.12(f) and 
380.16(f) of this chapter.
* * * * *

[[Page 93749]]

    (vi) For landowner lists, information filed as privileged under 
Sec. Sec.  380.12(f) and 380.16(f) of this chapter, forms filed with 
the Commission, and other documents not covered above, access to this 
material can be sought pursuant to a FOIA request under Sec.  388.108. 
Applicants are not required under paragraph (b)(2)(iv) of this section 
to provide intervenors with landowner lists and the other materials 
identified in the previous sentence.
    (c) * * * (1) For documents filed with the Commission:
    (i) The documents for which privileged treatment is claimed will be 
maintained in the Commission's document repositories as non-public 
until such time as the Commission may determine that the document is 
not entitled to the treatment sought and is subject to disclosure 
consistent with Sec.  388.108. By treating the documents as nonpublic, 
the Commission is not making a determination on any claim of privilege 
status. The Commission retains the right to make determinations with 
regard to any claim of privilege status, and the discretion to release 
information as necessary to carry out its jurisdictional 
responsibilities.
    (ii) The request for privileged treatment and the public version of 
the document will be made available while the request is pending.
* * * * *
    (d) Notification of request and opportunity to comment. When a FOIA 
requester seeks a document for which privilege status has been claimed, 
or when the Commission itself is considering release of such 
information, the Commission official who will decide whether to release 
the information or any other appropriate Commission official will 
notify the person who submitted the document and give the person an 
opportunity (at least five calendar days) in which to comment in 
writing on the request. A copy of this notice will be sent to the 
requester.
    (e) Notification before release. Notice of a decision by the 
Commission, the Chairman of the Commission, the Director, Office of 
External Affairs, the General Counsel or General Counsel's designee, a 
presiding officer in a proceeding under part 385 of this chapter, or 
any other appropriate official to deny a claim of privilege, in whole 
or in part, will be given to any person claiming that the information 
is privileged no less than 5 calendar days before disclosure. The 
notice will briefly explain why the person's objections to disclosure 
are not sustained by the Commission. A copy of this notice will be sent 
to the FOIA requester.
* * * * *

0
6. Revise Sec.  388.113 to read as follows:


Sec.  388.113   Critical Energy/Electric Infrastructure Information 
(CEII)

    (a) Scope. This section governs the procedures for submitting, 
designating, handling, sharing, and disseminating Critical Energy/
Electric Infrastructure Information (CEII) submitted to or generated by 
the Commission. The Commission reserves the right to restrict access to 
previously filed information as well as Commission-generated 
information containing CEII. Nothing in this section limits the ability 
of any other Federal agency to take all necessary steps to protect 
information within its custody or control that is necessary to ensure 
the safety and security of the electric grid. To the extent necessary, 
such agency may consult with the CEII Coordinator regarding the 
treatment or designation of such information.
    (b) Purpose. The procedures in this section implement section 215A 
of the Federal Power Act, and provide a comprehensive overview of the 
manner in which the Commission will implement the CEII program.
    (c) Definitions. For purposes of this section:
    (1) Critical electric infrastructure information means information 
related to critical electric infrastructure, or proposed critical 
electrical infrastructure, generated by or provided to the Commission 
or other Federal agency other than classified national security 
information, that is designated as critical electric infrastructure 
information by the Commission or the Secretary of the Department of 
Energy pursuant to section 215A(d) of the Federal Power Act. Such term 
includes information that qualifies as critical energy infrastructure 
information under the Commission's regulations. Critical Electric 
Infrastructure Information is exempt from mandatory disclosure under 
the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be 
made available by any Federal, State, political subdivision or tribal 
authority pursuant to any Federal, State, political subdivision or 
tribal law requiring public disclosure of information or records 
pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act.
    (2) Critical energy infrastructure information means specific 
engineering, vulnerability, or detailed design information about 
proposed or existing critical infrastructure that:
    (i) Relates details about the production, generation, 
transportation, transmission, or distribution of energy;
    (ii) Could be useful to a person in planning an attack on critical 
infrastructure;
    (iii) Is exempt from mandatory disclosure under the Freedom of 
Information Act, 5 U.S.C. 552; and
    (iv) Does not simply give the general location of the critical 
infrastructure.
    (3) Critical electric infrastructure means a system or asset of the 
bulk-power system, whether physical or virtual, the incapacity or 
destruction of which would negatively affect national security, 
economic security, public health or safety, or any combination of such 
matters.
    (4) Critical infrastructure means existing and proposed systems and 
assets, whether physical or virtual, the incapacity or destruction of 
which would negatively affect security, economic security, public 
health or safety, or any combination of those matters.
    (d) Criteria and procedures for determining what constitutes CEII. 
The following criteria and procedures apply to information labeled as 
CEII:
    (1) For information submitted to the Commission:
    (i) A person requesting that information submitted to the 
Commission be treated as CEII must include with its submission a 
justification for such treatment in accordance with the filing 
procedures posted on the Commission's Web site at https://www.ferc.gov. 
The justification must provide how the information, or any portion of 
the information, qualifies as CEII, as the terms are defined in 
paragraphs (c)(1) and (2) of this section. The submission must also 
include a clear statement of the date the information was submitted to 
the Commission, how long the CEII designation should apply to the 
information and support for the period proposed. Failure to provide the 
justification or other required information could result in denial of 
the designation and release of the information to the public.
    (ii) In addition to the justification required by paragraph 
(d)(1)(i) of this section, a person requesting that information 
submitted to the Commission be treated as CEII must clearly label the 
cover page and pages or portions of the information for which CEII 
treatment is claimed in bold, capital lettering, indicating that it 
contains CEII, as appropriate, and marked ``DO NOT RELEASE.'' The 
submitter must also segregate those portions of the information that 
contain

[[Page 93750]]

CEII (or information that reasonably could be expected to lead to the 
disclosure of the CEII) wherever feasible. The submitter must also 
submit to the Commission a public version with the information where 
CEII is redacted, to the extent practicable.
    (iii) If a person files material as CEII in a complaint proceeding 
or other proceeding to which a right to intervention exists, that 
person must include a proposed form of protective agreement with the 
filing, or identify a protective agreement that has already been filed 
in the proceeding that applies to the filed material.
    (iv) The information for which CEII treatment is claimed will be 
maintained in the Commission's files as non-public until such time as 
the Commission may determine that the information is not entitled to 
the treatment sought. By treating the information as CEII, the 
Commission is not making a determination on any claim of CEII status. 
The Commission retains the right to make determinations with regard to 
any claim of CEII status at any time, and the discretion to release 
information as necessary to carry out its jurisdictional 
responsibilities. Although unmarked information may be eligible for 
CEII treatment, the Commission will treat unmarked information as CEII 
only if it is properly designated as CEII pursuant to Commission 
regulations.
    (v) The CEII Coordinator will evaluate whether the submitted 
information or portions of the information are covered by the 
definitions in paragraphs (c)(1) and (2) of this section prior to 
making a designation as CEII.
    (vi) Subject to the exceptions set forth in paragraph (f)(5) of 
this section, when a CEII requester seeks information for which CEII 
status has been claimed, or when the Commission itself is considering 
release of such information, the CEII Coordinator or any other 
appropriate Commission official will notify the person who submitted 
the information and give the person an opportunity (at least five 
business days) in which to comment in writing on the request. A copy of 
this notice will be sent to the requester. Notice of a decision by the 
Commission, or the CEII Coordinator to make a release of CEII, will be 
given to any person claiming that the information is CEII no less than 
five business days before disclosure. The notice will respond to any 
objections to disclosure from the submitter that are not sustained. 
Where applicable, a copy of this notice will be sent to the CEII 
requester.
    (2) For Commission-generated information:
    (i) After consultation with the Office Director for the office that 
created the information, or the Office Director's designee, the CEII 
Coordinator will designate Commission-generated information as CEII 
after determining that the information or portions of the information 
are covered by the definitions in paragraphs (c)(1) and (2) of this 
section. Commission-generated CEII shall include clear markings to 
indicate the information is CEII and the date of the designation.
    (ii) The Commission will segregate non-CEII from Commission-
generated CEII or information that reasonably could be expected to lead 
to the disclosure of CEII wherever feasible.
    (e) Duration of the CEII designation. All CEII designations will be 
subject to the following conditions:
    (1) A designation may last for up to a five-year period, unless re-
designated. In making a determination as to whether the designation 
should be extended, the CEII Coordinator will take into account 
information provided in response to paragraph (d)(1)(i) of this 
section, and any other information, as appropriate.
    (2) A designation may be removed at any time, in whole or in part, 
if the Commission determines that the unauthorized disclosure of CEII 
could no longer be used to impair the security or reliability of the 
bulk-power system or distribution facilities or any other form of 
energy infrastructure.
    (3) The Commission will treat CEII or documents marked as CEII as 
non-public after the designation has lapsed until the CEII Coordinator 
determines to un-designate the information.
    (4) If a CEII designation is removed, the submitter will receive 
notice and an opportunity to comment. The CEII Coordinator will notify 
the submitter of the information and give the submitter an opportunity 
(at least five business days) in which to comment in writing prior to 
the removal of the designation. Notice of a removal decision will be 
given to any submitter claiming that the information is CEII no less 
than five business days before disclosure. The notice will briefly 
explain why the submitter's objections to the removal of the 
designation are not sustained by the Commission
    (f) Voluntary sharing of CEII. The Commission, taking into account 
standards of the Electric Reliability Organization, will facilitate 
voluntary sharing of CEII with, between, and by Federal, state, 
political subdivision, and tribal authorities; the Electric Reliability 
Organization; regional entities; information sharing and analysis 
centers established pursuant to Presidential Decision Directive 63; 
owners, operators, and users of critical electric infrastructure in the 
United States; and other entities determined appropriate by the 
Commission. The process will be as follows:
    (1) The Director of any Office of the Commission or his designee 
that wishes to voluntarily share CEII shall consult with the CEII 
Coordinator prior to the Office Director or his designee making a 
determination on whether to voluntarily share the CEII.
    (2) Consistent with paragraph (d) of this section, the Commission 
retains the discretion to release information as necessary to carry out 
its jurisdictional responsibilities in facilitating voluntary sharing 
or, in the case of information provided to other federal agencies, the 
Commission retains the discretion to release information as necessary 
for those agencies to carry out their jurisdictional responsibilities.
    (3) All entities receiving CEII must execute either a non-
disclosure agreement or an acknowledgement and agreement. A copy of 
each agreement will be maintained by the Office Director with a copy to 
the CEII Coordinator.
    (4) When the Commission voluntarily shares CEII pursuant to this 
subsection, the Commission may impose additional restrictions on how 
the information may be used and maintained.
    (5) Submitters of CEII shall receive notification of a limited 
release of CEII no less than five business days before disclosure, 
except in instances where voluntary sharing is necessary for law 
enforcement purposes, to maintain infrastructure security, to address 
potential threats, when notice would not be practicable, and where 
there is an urgent need to quickly disseminate the information. When 
prior notice is not given, the Commission will provide submitters of 
CEII notice of a limited release of the CEII as soon as practicable.
    (g) Accessing CEII. (1) An owner/operator of a facility, including 
employees and officers of the owner/operator, may obtain CEII relating 
to its own facility, excluding Commission-generated information except 
inspection reports/operation reports and any information directed to 
the owner-operators, directly from Commission staff without going 
through the procedures outlined in paragraph (g)(5) of this section. 
Non-employee agents of an owner/operator of such facility may obtain 
CEII relating to the owner/operator's facility in the same manner as 
owner/operators as long as they present written authorization from the 
owner/operator to obtain such information. Notice of such requests must 
be given to

[[Page 93751]]

the CEII Coordinator, who shall track this information.
    (2) An employee of a federal agency acting within the scope of his 
or her federal employment may obtain CEII directly from Commission 
staff without following the procedures outlined in paragraph (g)(5) of 
this section. Any Commission employee at or above the level of division 
director or its equivalent may rule on requests for access to CEII by a 
representative of a federal agency. To obtain access to CEII, an agency 
employee must sign an acknowledgement and agreement, which states that 
the agency will protect the CEII in the same manner as the Commission 
and will refer any requests for the information to the Commission. 
Notice of each such request also must be given to the CEII Coordinator, 
who shall track this information.
    (3) A landowner whose property is crossed by or in the vicinity of 
a project may receive detailed alignment sheets containing CEII 
directly from Commission staff without submitting a non-disclosure 
agreement as outlined in paragraph (g)(5) of this section. A landowner 
must provide Commission staff with proof of his or her property 
interest in the vicinity of a project.
    (4) Any person who is a participant in a proceeding or has filed a 
motion to intervene or notice of intervention in a proceeding may make 
a written request to the filer for a copy of the complete CEII version 
of the document without following the procedures outlined in paragraph 
(g)(5) of this section. The request must include an executed copy of 
the applicable protective agreement and a statement of the person's 
right to party or participant status or a copy of the person's motion 
to intervene or notice of intervention. Any person may file an 
objection to the proposed form of protective agreement. A filer, or any 
other person, may file an objection to disclosure, generally or to a 
particular person or persons who have sought intervention. If no 
objection to disclosure is filed, the filer must provide a copy of the 
complete, non-public document to the requesting person within five 
business days after receipt of the written request that is accompanied 
by an executed copy of the protective agreement. If an objection to 
disclosure is filed, the filer shall not provide the non-public 
document to the person or class of persons identified in the objection 
until ordered by the Commission or a decisional authority.
    (5) If any requester not described above in paragraphs (g)(1) 
through (4) of this section has a particular need for information 
designated as CEII, the requester may request the information using the 
following procedures:
    (i) File a signed, written request with the Commission's CEII 
Coordinator. The request must contain the following:
    (A) Requester's name (including any other name(s) which the 
requester has used and the dates the requester used such name(s)), 
title, address, and telephone number; and the name, address, and 
telephone number of the person or entity on whose behalf the 
information is requested;
    (B) A detailed Statement of Need, which must state: The extent to 
which a particular function is dependent upon access to the 
information; why the function cannot be achieved or performed without 
access to the information; an explanation of whether other information 
is available to the requester that could facilitate the same objective; 
how long the information will be needed; whether or not the information 
is needed to participate in a specific proceeding (with that proceeding 
identified); and an explanation of whether the information is needed 
expeditiously.
    (C) An executed non-disclosure agreement as described in paragraph 
(h)(2) of this section;
    (D) A signed statement attesting to the accuracy of the information 
provided in the request; and
    (E) A requester shall provide his or her date and place of birth 
upon request, if it is determined by the CEII Coordinator that this 
information is necessary to process the request.
    (ii) A requester who seeks the information on behalf of all 
employees of an organization should clearly state that the information 
is sought for the organization, that the requester is authorized to 
seek the information on behalf of the organization, and that all 
individuals in the organization that have access to the CEII will agree 
to be bound by a non-disclosure agreement that must be executed.
    (iii) After the request is received, the CEII Coordinator will 
determine if the information is CEII, and, if it is, whether to release 
the CEII to the requester. The CEII Coordinator will balance the 
requester's need for the information against the sensitivity of the 
information. If the requester is determined to be eligible to receive 
the information requested, the CEII Coordinator will determine what 
conditions, if any, to place on release of the information.
    (iv) If the CEII Coordinator determines that the CEII requester has 
not demonstrated a valid or legitimate need for the CEII or that access 
to the CEII should be denied for other reasons, this determination may 
be appealed to the General Counsel pursuant to Sec.  388.110. The 
General Counsel will decide whether the information is properly 
classified as CEII, which by definition is exempt from release under 
FOIA, and whether the Commission should in its discretion make such 
CEII available to the CEII requester in view of the requester's 
asserted legitimacy and need.
    (v) Once a CEII requester has been verified by Commission staff as 
a legitimate requester who does not pose a security risk, his or her 
verification will be valid for the remainder of that calendar year. 
Such a requester is not required to provide detailed information about 
himself or herself with subsequent requests during the calendar year. 
He or she is also not required to file a non-disclosure agreement with 
subsequent requests during the calendar year because the original non-
disclosure agreement will apply to all subsequent releases of CEII.
    (vi) An organization that is granted access to CEII pursuant to 
paragraph (g)(5)(ii) of this section may seek to add additional 
individuals to the non-disclosure agreement within one (1) year of the 
date of the initial CEII request. Such an organization must provide the 
names of the added individuals to the CEII Coordinator and certify that 
notice of each added individual has been given to the submitter. Any 
newly added individuals must execute a supplement to the original non-
disclosure agreement indicating their acceptance of its terms. If there 
is no written opposition within five business days of notifying the 
CEII Coordinator and the submitter concerning the addition of any newly 
added individuals, the CEII Coordinator will issue a standard notice 
accepting the addition of these names to the non-disclosure agreement. 
If the submitter files a timely opposition with the CEII Coordinator, 
the CEII Coordinator will issue a formal determination addressing the 
merits of such opposition. If an organization that is granted access to 
CEII pursuant to paragraph (g)(5)(ii) of this section wants to add new 
individuals to its non-disclosure agreement more than one year after 
the date of its initial CEII request, the organization must submit a 
new CEII request pursuant to paragraph (g)(5)(ii) of this section and a 
new non-disclosure agreement for each new individual added.
    (vii) The CEII Coordinator will attempt to respond to the requester 
under this section according to the timing required for responses under 
the FOIA in Sec.  388.108(c).

[[Page 93752]]

    (viii) Fees for processing CEII requests will be determined in 
accordance with Sec.  388.109.
    (ix) Nothing in this section should be construed as requiring the 
release of proprietary information, personally identifiable 
information, cultural resource information, information on rare species 
of plants and animals, and other comparable data protected by statute 
or any privileged information, including information protected by the 
deliberative process privilege.
    (h) Duty to protect CEII. Unauthorized disclosure of CEII is 
prohibited.
    (1) To ensure that the Commissioners, Commission employees, and 
Commission contractors protect CEII from unauthorized disclosure, 
internal controls will describe the handling, marking, and security 
controls for CEII.
    (2) Any individual who requests information pursuant to paragraph 
(g)(5) of this section must sign and execute a non-disclosure 
agreement, which indicates the individual's willingness to adhere to 
limitations on the use and disclosure of the information requested. The 
non-disclosure agreement will, at a minimum, require the following: 
CEII will only be used for the purpose for which it was requested; CEII 
may only be discussed with authorized recipients; CEII must be kept in 
a secure place in a manner that would prevent unauthorized access; CEII 
must be destroyed or returned to the Commission upon request; the 
Commission may audit the recipient's compliance with the non-disclosure 
agreement; CEII provided pursuant to the agreement is not subject to 
release under either FOIA or Sunshine Laws; a recipient is obligated to 
protect the CEII even after a designation has lapsed until the CEII 
Coordinator determines the information should no longer be designated 
as CEII under paragraph (e)(2) of this section; and a recipient is 
required to promptly report all unauthorized disclosures of CEII to the 
Commission.
    (i) Sanctions. Any officers, employees, or agents of the Commission 
who knowingly and willfully disclose CEII in a manner that is not 
authorized under this section will be subject to appropriate sanctions, 
such as removal from the federal service, or possible referral for 
criminal prosecution. Commissioners who knowingly and willfully 
disclose CEII without authorization may be referred to the Department 
of Energy Inspector General. The Commission will take responsibility 
for investigating and, as necessary, imposing sanctions on its 
employees and agents.
    (j) Administrative appeals of CEII determinations. (1) Submitters 
who receive a determination that the Commission intends to remove a 
CEII designation may appeal that determination. The submitter must file 
notice of its intent to appeal that determination within five business 
days of the determination. The notice of intent to file an appeal must 
be sent to the General Counsel, with a copy to the CEII Coordinator. A 
statement in support of the notice of appeal must be submitted to the 
General Counsel within 20 business days of the date of the 
determination. The appeal will be considered received upon receipt of 
the statement in support of the notice of appeal.
    (2) Individuals who receive a determination denying a request for 
the release of CEII, in whole or in part, or a determination denying a 
request to change the designation of CEII may appeal such 
determinations. Such appeals must be submitted to the General Counsel 
within 20 business days of the date of the determination.
    (3) The Commission's General Counsel or the General Counsel's 
designee will make a determination with respect to any appeal within 20 
business days after the receipt of the appeal. If, on appeal, the 
General Counsel or the General Counsel's designee upholds the 
determination in whole or in part, then the General Counsel or the 
General Counsel's designee will notify the person submitting the appeal 
of the availability of judicial review.
    (4) The time limits prescribed for the General Counsel or his 
designee to act on an appeal may be extended pursuant to Sec.  
388.110(b)(1).
    (5) Prior to seeking judicial review in federal district court 
pursuant to section 215A(d)(11) of the Federal Power Act, a person who 
received a determination from the Commission concerning a CEII 
designation must first appeal the determination to the Commission's 
General Counsel.

    Note: The following appendix will not appear in the Code of 
Federal Regulations.


                                Appendix
------------------------------------------------------------------------
           Abbreviation                           Commenter
------------------------------------------------------------------------
Initial Comments:
    APPA..........................  American Public Power Association.
    CEA...........................  Canadian Electricity Association.
    HRC...........................  Hydropower Reform Coalition.
    INGAA.........................  Interstate Natural Gas Association
                                     of America.
    ITC...........................  International Transmission Company d/
                                     b/a ITCTransmission, Michigan
                                     Electric Company, LLC, ITC Midwest
                                     LLC, and ITC Great Plains LLC.
    Joint RTOs....................  ISO New England, Inc. and Southwest
                                     Power Pool, Inc.
    MISO..........................  Midcontinent Independent System
                                     Operator, Inc.
    NRECA.........................  National Rural Electric Cooperative
                                     Association.
    NERC..........................  North American Electric Reliability
                                     Corporation.
    NRC...........................  Nuclear Regulatory Commission.
    Peak..........................  Peak Reliability.
    Powerex.......................  Powerex Corp.
    Public Interest Organizations.  Alliance for Affordable Energy,
                                     Citizens Action Coalition of
                                     Indiana, Inc., Citizens Utility
                                     Board, Fresh Energy, Great Plains
                                     Institute, Natural Resources
                                     Defense Council, Sierra Club
                                     Environmental Law Program, Southern
                                     Environmental Law Center,
                                     Sustainable FERC Project, Union of
                                     Concerned Scientists, Utah Clean
                                     Energy, VoeSolar, Western Grid
                                     Group, Western Resource Advocates,
                                     and Wind on the Wires.
    Tacoma Power..................  City of Tacoma, Department of Public
                                     Utilities, Light Division d.b.a.
                                     Tacoma Power (Tacoma Power).
    Tallgrass Pipelines...........  Rockies Express Pipeline LLC,
                                     Tallgrass Interstate Gas,
                                     Transmission, LLC, and Trailblazer
                                     Pipeline Company LLC.
    TAPS..........................  Transmission Access Policy Study
                                     Group.
    Trade Associations............  Edison Electric Institute, Electric
                                     Power Supply Association, and
                                     Electricity Consumers Resource
                                     Council.
    WIRAB.........................  Western Interconnection Regional
                                     Advisory Board.

[[Page 93753]]

 
Reply Comments:
    PJM...........................  PJM Interconnection, LLC.
    Joint RTOs....................  ISO New England, Inc. and Southwest
                                     Power Pool, Inc.
------------------------------------------------------------------------

[FR Doc. 2016-28322 Filed 12-20-16; 8:45 am]
BILLING CODE 6717-01-P