Critical Electric Infrastructure Information; New Administrative Procedures, 14756-14772 [2020-04640]

Agencies

• DEPARTMENT OF ENERGY

[Federal Register Volume 85, Number 51 (Monday, March 16, 2020)]
[Rules and Regulations]
[Pages 14756-14772]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-04640]


-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

10 CFR Part 1004

RIN 1901-AB44


Critical Electric Infrastructure Information; New Administrative 
Procedures

AGENCY: Office of Electricity, U.S. Department of Energy.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The U.S. Department of Energy (DOE or Department) publishes 
this final rule to implement DOE's critical electric infrastructure 
information (CEII) designation authority under the Federal Power Act 
(FPA). In this final rule, DOE establishes administrative procedures 
intended to ensure that stakeholders and the public understand how the 
Department would designate, protect, and share CEII.

DATES: The effective date of this rule is May 15, 2020.

ADDRESSES: The docket for this rulemaking, which includes Federal 
Register notices, comments, and other supporting documents/materials, 
is available for review at https://www.regulations.gov. All documents 
in the docket are listed in the https://www.regulations.gov index. 
However, not all documents listed in the index, such as those 
containing information that is exempt from public disclosure by law, 
may be publicly available. A link to the docket web page can be found 
at https://www.regulations.gov/docket?D=DOE-HQ-2019-0003. The docket 
web page explains how to access all documents, including public 
comments, in the docket.

FOR FURTHER INFORMATION CONTACT: Michael Coe, U.S. Department of 
Energy, Office of Electricity, Mailstop OE-20, Room 8H-033, 1000

[[Page 14757]]

Independence Avenue SW, Washington, DC 20585; (202) 287-5166; or 
[email protected].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction
II. Discussion of Final Rule
    A. Background
    B. Filing Procedures and Guidance
    C. Purpose and Scope
    D. Definitions
    E. Authority to Designate Information as CEII
    F. Coordination Among DOE Office Designators
    G. CEII FOIA Exemption
    H. Criteria and Procedures for Designating CEII
    I. Duration of Designation
    J. Review or Requests for Reconsideration of Designation
    K. Sharing of CEII
    L. Procedures for Requesting CEII
    M. Unauthorized Disclosure
III. Regulatory Review
    A. Executive Orders 12866 and 13563
    B. Executive Orders 13771, 13777, and 13783
    C. National Environmental Policy Act
    D. Regulatory Flexibility Act
    E. Paperwork Reduction Act
    F. Unfunded Mandates Reform Act of 1995
    G. Treasury and General Government Appropriations Act, 1999
    H. Executive Order 13132
    I. Executive Order 12988
    J. Treasury and General Government Appropriations Act, 2001
    K. Executive Order 13211
    L. Congressional Notification
IV. Approval of the Office of the Secretary

I. Introduction

    In this final rule, the Department of Energy (DOE) establishes 
procedures for the designation of critical electric infrastructure 
information (CEII) under section 215A(d) of the Federal Power Act 
(FPA). Section 61003 of the Fixing America's Surface Transportation Act 
(FAST Act), Public Law 114-94, added section 215A to the FPA. The new 
section authorizes both the Secretary of Energy (the Secretary) and the 
Federal Energy Regulatory Commission (FERC) independently to designate 
CEII. Under section 215A(d)(1) of the FPA, a CEII designation exempts 
the data or information so designated from disclosure under the Freedom 
of Information Act (FOIA) and other laws requiring government 
disclosure of certain information or records. 16 U.S.C. 824o-1(d)(1); 5 
U.S.C. 552(b)(3). Section 215A(d)(2) required FERC, after consultation 
with the Secretary and within a year of the FAST Act's enactment, to 
``promulgate such regulations as necessary to . . . establish criteria 
and procedures to designate information as [CEII].'' 16 U.S.C. 824o-
1(d)(2). FERC did so, following a notice-and-comment rulemaking similar 
to the instant rulemaking. Order No. 833, Regulations Implementing FAST 
Act Section 61003--Critical Electric Infrastructure Security and 
Amending Critical Energy Infrastructure Information; Availability of 
Certain North American Electric Reliability Corporation Databases to 
the Commission, FERC Docket Nos. RM16-15-000 and RM15-25-001, 157 FERC 
] 61,123 (2016), order on reh'g & clarification, Order No. 833-A, FERC 
Docket No. RM16-15-001, 163 FERC ] 61,125 (2018). While this rulemaking 
established criteria for designating CEII applicable to both FERC and 
the Department, the designation procedures in the rulemaking were 
limited to FERC. Thus, on October 29, 2018, the Department published a 
Notice of Proposed Rulemaking (NOPR) to establish its own designation 
procedures. (83 FR 54274) This final rule establishes DOE's designation 
procedures, which are consistent with the procedures established by 
FERC to the maximum extent possible.
    The Department is committed to improving the resilience, 
reliability, and security of the Nation's electricity delivery system. 
Consistent with its statutory authorities and ongoing work with energy 
sector entities in furtherance of that mission, the Department 
anticipates that the majority of CEII the Department will receive will 
be voluntary submissions, scoped in collaboration with the submitting 
entity, and for which DOE may often make a CEII designation based on 
the scoping prior to submission. DOE's role with respect to CEII is not 
expected to be related to its regulatory functions, and DOE expects 
that nearly all potential CEII sent to DOE will be voluntary 
submissions tied to specific programs. The Department anticipates 
receiving a smaller volume of CEII material than FERC does given the 
regulatory requirements for mandatory FERC filings by the electricity 
industry, giving DOE the flexibility to engage in more proactive 
designations. Even if the submission relates to a DOE regulatory 
function, DOE will still evaluate it based on the procedures set forth 
in this rule on whether to designate the information as CEII. If 
organizations and individuals submit material to DOE, the Department 
recommends adding all appropriate FOIA exemption markings, as the 
material may be both Confidential Business Information (CBI) and CEII. 
Based on the recent opinion of the Supreme Court of the United States 
in Food Marketing Institute v. Argus Leader Media (No. 18-481), which 
effectively broadens the scope of data and information that are 
eligible for the fourth exemption from disclosure under FOIA, DOE notes 
that all entities submitting information for CEII designation under 
this rule should also specify whether the material is Confidential 
Business Information under the new legal standard.
    DOE received a total of fourteen (14) written comments in response 
to the NOPR, all of which are available at https://www.regulations.gov. 
Generally, the comments addressed the following issues: Scope, purpose, 
and definitions; authority to designate information as CEII; 
coordination among DOE Office designators; criteria and procedures for 
determining what constitutes CEII; duration of designation of CEII; 
sharing of CEII; and sanctions for unauthorized disclosure of CEII. DOE 
responds to the comments received in the discussion of the final rule 
in Section II below.

II. Discussion of Final Rule

A. Background

    After FERC published its CEII designation criteria and procedures, 
DOE began its rulemaking to establish administrative procedures 
regarding how the Department would designate, protect, and share CEII. 
The Department follows the designation criteria FERC has already 
formulated, but establishes its own procedures for such designation in 
this final rule. These procedures differ from those established by FERC 
in that DOE's procedures provide additional time to coordinate with 
parties that submit CEII to DOE. However, the agencies' overall 
procedures are similar in providing specific information when 
requesting that submitted information be designated as CEII, as well as 
procedures for appealing a CEII designation determination. The 
Department's rule is consistent with FERC's rule to the maximum extent 
possible, so that the fundamental objectives of the CEII statutory 
program will be met regardless of whether the information is submitted 
to the Department or to FERC.
    The Canadian Electricity Association (CEA) expressed support for 
DOE's effort to harmonize its CEII procedures with FERC's CEII 
procedures. (CEA, No. 12, p. 4). However, CEA asked for clarification 
between DOE and FERC's CEII procedures. In particular, CEA sought 
understanding on processes to ensure consistency between CEII 
designation, as well as removal of CEII designation, if the same 
material is shared with both DOE and FERC. Id.

[[Page 14758]]

    The Department recognizes the importance of coordination among 
Federal agencies with similar programs, as each agency has different 
procedures related to voluntary information sharing and protection of 
the information. As mentioned above, the Department has sought to 
harmonize its procedures with the FERC procedures as much as possible, 
and DOE will use FERC's designation criteria. The Department's 
designation, however, does not mean that the information will be 
automatically shared with FERC, the Department of Homeland Security 
(DHS), or any other Federal agency. The Department will follow the 
procedures outlined in this rule to review and designate information 
and data as CEII. In addition, the Department will continue to 
coordinate with the DHS regarding its Protected Critical Infrastructure 
Information program, including as provided for under 1004.13(e)(4). If 
DOE finds it necessary to provide CEII material to another Federal 
agency, DOE will provide dissemination instructions prohibiting further 
distribution. DOE will continue to coordinate with FERC, DHS, and other 
Federal agencies on all cross-cutting initiatives related to CEII to 
ensure maximum harmonization.

B. Filing Procedures and Guidance

    Proposed Sec.  1004.13(a) tells interested stakeholders where to 
find information about CEII filing procedures and guidance. No comments 
were received; therefore, DOE finalizes this section as proposed.

C. Purpose and Scope

    As described in proposed Sec.  1004.13(b), procedures for the 
designation, protection, and sharing of CEII developed under section 
215A of the FPA would apply to anyone who provides CEII to DOE or who 
receives CEII from DOE, including DOE employees, DOE contractors, 
agents of DOE, and individuals or organizations who have been permitted 
access to CEII, as well as non-DOE entities submitting CEII to DOE or 
receiving CEII from DOE. These proposed procedures would also apply to 
other Federal agencies seeking CEII designation and protection of 
information that agencies may submit to DOE.
    The joint comments of EarthJustice, Union of Concerned Scientists, 
and Public Citizen (EarthJustice et al.) disputed the validity of the 
Department's notice and comment process in this rulemaking. Their 
comments alleged that the Department violated the Administrative 
Procedure Act because it held a meeting in February 2018 (discussed in 
footnote 1 of this rule) at which ``industry stakeholders'' laid out 
concerns in advance of this rulemaking. EarthJustice et al. stated that 
``[t]he public cannot meaningfully comment on an agency's action if key 
facts or rationale in support of the decision are not made available 
for consideration and comment.'' (Earth Justice et al., No. 3, p. 13).
    The Department disagrees with EarthJustice et al.'s claims of 
inadequate notice and comment. As explained in the October 2018 NOPR, 
the Department held a meeting with interested stakeholders in 
compliance with all applicable laws and procedures.\1\ As a preliminary 
matter, DOE's ex parte guidelines, promulgated in October 2009 and 
available at https://www.energy.gov/gc/downloads/guidance-ex-parte-communications, provide that the applicability of the guidelines begins 
upon release of a NOPR or other preliminary rulemaking document. As 
noted in the Department's October 2018 NOPR, however, DOE nonetheless 
made a summary of that meeting available to the public, as specified in 
the ex parte guidelines. The NOPR subsequently provided regulatory text 
and a preamble explaining the proposed rule. Commenters were given 60 
days to respond to the proposed rule, which is to be binding on the 
Department in designating CEII. No commenters asked for additional time 
to comment on the rule. This final rule includes the Department's 
consideration of, and response to, the comments it received. Based on 
the above, DOE concludes that commenters had the opportunity to 
meaningfully comment on the Department's proposed rule.
---------------------------------------------------------------------------

    \1\ On February 14 and 15, 2018, DOE's Office of Electricity 
(OE) (known at the time as DOE's Office of Electricity Delivery and 
Energy Reliability) and Office of Policy convened an ex-parte 
meeting with representatives from energy industry, local, state, and 
Federal government agencies to discuss issues, challenges, and 
opportunities in CEII-sharing frameworks and optional information 
sharing protections and protocols leading up to the development of 
this proposed rule. A memorandum summarizing this meeting is 
available at https://www.regulations.gov/docket?D=DOE-HQ-2019-0003 
and https://www.energy.gov/gc/legal-resources/ex-parte-communications.
---------------------------------------------------------------------------

D. Definitions

    Section 1004.13(c) of the proposed rule defines terms applicable to 
the proposed procedures in this notice for the designation of CEII. 
Where the terms are defined by statute or by FERC's CEII regulations, 
the definitions track those corresponding definitions, either verbatim 
or with maximum consistency. Other terms are proposed for the first 
time in this context. The Department received no comments on the 
proposed definitions. Therefore, unless discussed below, the proposed 
definitions are adopted without change in this final rule.
    The Department adds the definition of ``Confidential Business 
Information'' to Sec.  1004.13(c) to mean ``commercial or financial 
information that is both customarily and actually treated as private by 
its owner and that is provided to the government as part of a claimed 
CEII submission.'' This addition is based on the June 24, 2019, opinion 
of the Supreme Court of the United States in Food Marketing Institute 
v. Argus Leader Media (No. 18-481). The decision effectively broadens 
the scope of data and information that are eligible for exemption from 
disclosure under 5 U.S.C. 552(b)(4). In the case, the Supreme Court 
rejected the lower courts' holding that ``information can never be 
deemed confidential [the FOIA statutory term] unless disclosing it is 
likely to result in `substantial competitive harm' to the business that 
provided it.'' Food Mktg. Inst. v. Argus Leader Media, No. 18-481, slip 
op. at 1 (U.S. June 24, 2019). The Court found that the ``substantial 
competitive harm'' test which stemmed from the D.C. Circuit's 1974 
opinion in National Parks & Conservation Association v. Morton, 498 
F.2d 765 (DC Cir. 1974), went beyond the language of the statute 
itself, and did not reflect the typical meaning of the words used when 
Congress enacted FOIA Exemption 4. See Argus Leader, slip op. at 7-10. 
The Court held that ``[a]t least where commercial or financial 
information is both customarily and actually treated as private by its 
owner and provided to the government under an assurance of privacy, the 
information is `confidential' within the meaning of Exemption 4.'' Id. 
at 12.
    The Department clarifies that the CEII Coordinator may delegate the 
daily implementation of the CEII Coordinator function as described in 
this rule, in whole or in part, to an Assistant Secretary or 
Administrator in DOE. The NOPR stated that the final CEII designation 
authority would reside with the DOE Office exercising its delegated 
CEII designation authority. The appropriate Assistant Secretary or 
Administrator would exercise the authority delegated to a DOE Office. 
Therefore, the Department adopts a definition of CEII Coordinator in 
Sec.  1004.13(c) to specify delegation to the appropriate Assistant 
Secretary in DOE.

[[Page 14759]]

E. Authority To Designate Information as CEII

    Proposed Sec.  1004.13(d) allows the Secretary, or DOE Offices with 
delegated authority, to receive and designate CEII. Practically 
speaking, the flexibility to delegate allows the Department to handle 
CEII in a manner ensuring access to the critical information it needs 
to execute its responsibilities as the lead Sector-Specific Agency for 
cybersecurity for the energy sector, under section 61003(c) of the FAST 
Act, and the Sector-Specific Agency for Energy (Critical 
Infrastructure), under Presidential Policy Directive 21.
    EarthJustice et al. claimed that ``[t]he Department has no legal 
authority to establish criteria and procedures for CEII designation.'' 
The comments contended that ``while both [FERC] and the Department have 
authority to designate CEII, the power to establish criteria and 
procedures for doing so is [FERC]'s alone.'' (EarthJustice et al., No. 
3, p. 2).
    EarthJustice et al. are correct that both the Department and FERC 
may designate CEII. However, while the Department is obligated to apply 
the criteria FERC crafted, FERC acknowledged in its final procedural 
rule that DOE is not bound by the procedures FERC uses, noting that 
``[t]he FAST Act . . . does not compel DOE to make any changes to its 
regulations in this regard'' and that ``nothing within the Commission's 
regulations would limit DOE's ability to designate CEII in accordance 
with the FAST Act,'' and specifically ``declin[ing] to revise [its] 
regulations to identify specific designation criteria and CEII 
procedures for DOE.'' FERC Order No. 833, 157 FERC ] 61,123 at P 39 
(2016), reh'g denied, FERC Order No. 833-A, 163 FERC ] 61,125 at PP 31-
33 (2018). See also Department of Energy Organization Act, as amended, 
section 644, 42 U.S.C. 7254 (``The Secretary is authorized to prescribe 
such procedural . . . rules and regulations as he may deem necessary or 
appropriate to administer and manage the functions now or hereafter 
vested in him.''). The Department has therefore designed its own CEII 
designation procedures, which are consistent with the FERC regulations 
to the maximum extent possible.
    Other commenters requested more detail on how the Department will 
evaluate information submitted as CEII. For example, Midcontinent 
Independent System Operator, Inc. (MISO) noted that the proposed rules 
allowed the delegation of CEII designation authority. (MISO, No. 11, p. 
3). Therefore, MISO recommended that ``[t]he designation criteria must 
be specified to enable consistent designation of CEII by each DOE 
Office, and for CEII submitters to understand the kind of information 
the DOE will designate as CEII.'' Id. Edison Electric Institute (EEI) 
recommended that, in clarifying the CEII designation criteria, ``the 
Department consider information on other systems or assets that may 
negatively affect national security, economic security, and/or public 
health; information that may enable the misuse of an asset or system 
that may negatively affect national security, economic security, and/or 
public health; and information on systems or assets that has previously 
been made public.'' (EEI, No. 9, p. 5).
    DOE has determined that the existing CEII designation criteria 
address these concerns. FPA section 215A(a)(2) defines Critical 
Electric Infrastructure as ``a system or asset of the bulk-power 
system, whether physical or virtual, the incapacity or destruction of 
which would negatively affect national security, economic security, 
public health or safety, or any combination of such matters.'' FPA 
section 215A(a)(3) includes ``information related to critical electric 
infrastructure'' in its definition of CEII. Under the criteria that 
FERC established and that DOE follows, FERC and DOE may consider a 
range of elements in determining what qualifies as CEII. The 
regulation, as proposed, provides adequate guidance for a submitter and 
DOE staff to determine whether information is CEII, and for the CEII 
Coordinator or Coordinator's designee to make a determination.
    EEI stated that it supported coordination among DOE Office 
designees to ensure that the FAST Act authorities are consistently 
implemented within DOE and recommends a robust internal process to 
ensure that CEII is appropriately and consistently designated, 
protected, and shared throughout the Department. (EEI, No. 9, p. 11).
    DOE agrees that the internal process for coordination among DOE 
Office designees is important and will ensure robust internal controls 
to appropriately and consistently designate, protect, and share CEII 
throughout the Department. More information on the internal process is 
provided in Section F.

F. Coordination Among DOE Office Designators

    Proposed Sec.  1004.13(e) sets out the functions of the CEII 
Coordinator and the Coordinator's designee. The CEII Coordinator may 
make an initial determination as to whether the information fits within 
the definition of CEII, but final CEII designation authority resides 
with the CEII Coordinator or DOE Office exercising its delegated CEII 
designation authority. The proposed subsection also provides that DOE 
entities with authority to designate CEII would meet to calibrate their 
approaches to CEII designation, and would meet with representatives of 
other Federal agencies, as needed and at the discretion of the 
Coordinator or designee, to ensure consistent understanding of CEII 
designation processes.
    The Department clarifies that the CEII Coordinator or Coordinator's 
designee is delegated the authority already granted to the Secretary, 
in accordance with FPA section 215A, to designate information sought by 
DOE as CEII. Therefore, the Department amends Sec.  1004.13(e)(1) to 
include specific mention that the CEII Coordinator or Coordinator's 
designee can designate certain information sought by DOE as CEII, in 
accordance with FPA section 215A(a)(3), and using the designation 
criteria codified at 18 CFR 388.113(c).
    The Department clarifies that Sec.  1004.13(e)(2) was not meant to 
limit coordination of implementation of DOE's CEII authority with only 
DOE Offices, PMAs, and the Energy Information Administration (EIA). It 
was meant to include all CEII Coordinator designees. Therefore, the 
Department amends Sec.  1004.13(e)(2) to remove specific mention of the 
four PMAs and EIA.
    The Department clarifies that a submitter requesting information be 
designated as CEII must clearly label the cover page and pages or 
portions of the information for which CEII treatment is requested in 
bold, capital lettering, indicating that it contains CEII, as 
appropriate, and marked ``CEII-CRITICAL ELECTRIC INFRASTRUCTURE 
INFORMATION--DO NOT RELEASE.'' The additional marking of spelling out 
CEII is meant to eliminate any confusion related to the use of the new 
FOIA exemption in DOE. Therefore, the Department amends Sec.  
1004.13(e)(2)(i) to include the updated marking of CEII as ``CEII-
CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION--DO NOT RELEASE''
    The Department clarifies that, based on the addition of the 
definition of ``confidential business information,'' when any person or 
entity requests CEII designation of submitted material, the submitter 
must also clearly label the cover page and pages or portions of 
information that it considers Confidential Business Information in 
bold, capital lettering, indicating that it contains Confidential 
Business

[[Page 14760]]

Information, as appropriate, and marked ``CONFIDENTIAL BUSINESS 
INFORMATION--DO NOT RELEASE.'' In addition, if CEII and CBI are both 
included in the submission, the information should be marked ``CEII-
CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS 
INFORMATION--DO NOT RELEASE.'' The Department therefore revises Sec.  
1004.13(e)(2) to add a new paragraph (ii) to include this additional 
requirement.
    EEI supports the procedures that require the CEII Coordinator or 
the Coordinator's designee to notify CEII submitters of a non-federal 
entity request for CEII and to convene a conference call with the 
affected DOE Office(s) and the CEII submitter(s) to discuss any 
concerns with sharing the CEII. (EEI, No. 9, pp.11-12). However, EEI 
``recommends that the Department provide additional guidance to CEII 
submitters on what to expect from the CEII Coordinator or his/her 
designees when convening a conference call to discuss a non-federal 
entity request for CEII release.'' Id. at 12. In particular, EEI 
requests clarity on whether a ``conference call will be scheduled 
within five days of the request or within five days of when the 
submitter is notified of the request, and if the submitter will receive 
the Sec.  1004.13(k) request before the conference call is convened.'' 
Id. In addition, EEI supports the Department's proposed coordination 
with other Federal agencies but recommends that, ``in addition to 
coordination with FERC, coordination with [DHS] under its Protected 
Critical Infrastructure Information (`PCII') and other information 
protection authorities and the Nuclear Regulatory Commission (`NRC') 
are critical'' because each agency has different procedures related to 
CEII, and discussions identifying best practices related to voluntary 
information sharing and protection of the information ``will be key to 
protecting the nation's critical electric infrastructure.'' (EEI, No. 
9, pp.12-13).
    DOE clarifies and amends proposed Sec.  1004.13(e)(1)(vii) to state 
that a conference call will be scheduled within five days of when the 
CEII submitter is notified of the request, and the submitter will 
receive a copy of the request before the conference call is convened.
    The Department agrees with EEI's recommendation that close 
coordination between all relevant Federal agencies is critical to 
ensuring protection of the nation's critical electric infrastructure. 
Therefore, the Department has amended Sec.  1004.13(e)(4) to 
specifically include DHS and the Nuclear Regulatory Commission.

G. CEII FOIA Exemption

    The language from Sec.  1004.13(f)(6)(ii) of the proposed rule 
(renumbered as Sec.  1004.13(g)(7)(ii)) is moved to new Sec.  
1004.13(f) and a reference is made to new Sec.  1004.13(f) in the 
renumbered Sec.  1004.13(g)(7)(ii). This only moves to a new subsection 
the content of FPA section 215A(d)(1)(B), stating that all information 
designated CEII is exempt from disclosure under the FOIA exemption 
codified at 5 U.S.C. 552(b)(3) and other laws requiring the disclosure 
of certain information or records, whether at the Federal, State, 
political subdivision, or tribal level of government.
    EEI noted that the proposed regulations do not contain a paragraph 
(g) and the Department should review and edit the number of all 
paragraphs and references as appropriate before finalizing the rule. 
(EEI, No. 9, p. 18).
    DOE appreciates EEI raising the clerical error. The Department has 
added paragraph (f) to fix the clerical error and codify the 
requirements of FPA section 215A(d)(1)(B) in this new section.

H. Procedures for Designating CEII

    Proposed Sec.  1004.13(g) sets forth the procedures the Department 
would follow to designate CEII. The subsection covers requesting 
designation for information submitted to or generated by DOE, how DOE 
would treat submitted information and apply FERC's CEII designation 
criteria, how DOE would treat information once it has decided whether 
to designate the information as CEII, and how DOE would protect 
designated CEII. In particular, proposed Sec.  1004.13(g)(3)(ii) stated 
that ``[i]nformation for which CEII treatment is requested will be 
maintained by the CEII Coordinator or Coordinator's designee in DOE's 
files as non-public unless and until DOE completes its determination 
that the information is not entitled to CEII treatment.'' To ensure 
that submitters of CEII are kept informed of the decision to be made, 
the Department has added the requirement to Sec.  1004.13(g)(6)(i) that 
the designation decision be communicated ``promptly.''
    CEA shared its concern about the consequences of a submitter's 
inability to produce a public version of a document containing CEII. To 
alleviate that concern, CEA asked the Department to ``clarify 
accommodations or outcomes if a submitter is unable to produce a public 
version of CEII.'' (CEA, No. 12, p. 4).
    In response to CEA's comment, the Department clarifies that if a 
submitter cannot produce a public version of a document with CEII, then 
the Department will provide a public version in response to a valid 
FOIA request with the CEII or other FOIA-exempt material redacted. The 
Department prefers, however, that a submitter provide public and non-
public versions of documents containing CEII. Before the FAST Act 
amendments to the FPA, filers at FERC would routinely submit two 
versions of documents in this way. DOE encourages, but does not 
require, the same approach. The Department also suggests that CEII 
material be consolidated, to the extent possible, within a document 
rather than scattered throughout a document.
    The comments of the American Public Power Association (APPA), the 
Large Public Power Council (LPPC), and the (National Rural Electric 
Cooperative Association (NRECA) (collectively, Joint Trade 
Associations) recommend that ``the Department specify . . . that 
material maintained `in DOE's files as non-public' during the pendency 
of a request for CEII designation will be treated and handled in all 
respects as if it were CEII, as appears to be the Department's intent. 
[I]n particular, that treatment of electronic information as non-public 
will include `stor[age] in a secure electronic environment' with 
appropriate labeling, as the NOPR proposes for CEII.'' (Joint Trade 
Associations, No. 15, pp. 9-10).
    DOE believes that such a clarification is not necessary. The 
proposed regulation already states that ``[w]hen a requester seeks 
information for which CEII status has been requested but not designated 
. . . DOE will render a decision on designation before responding to 
the requester or releasing such information. Subsequently, the release 
of information will be treated in accordance with the procedures 
established for CEII-designated material, or the return of information 
not designated as CEII.'' Therefore, it is sufficiently clear that the 
Department will treat non-designated, CEII-marked information as if it 
were already designated CEII, until a designation has been conferred on 
the information. However, to prevent confusion, the Department amends 
Sec.  1004.13(g)(7)(iii) to state that ``secure place'' refers to 
locked room or file cabinet.
    EEI recommends that that the Department address how to mark 
information that cannot be physically labeled such as machine-to-
machine information that may be shared with the Department because 
several DOE Power

[[Page 14761]]

Marketing Administrations regularly receive machine-to-machine, 
electronic information from electric companies. (EEI, No. 9, p. 10).
    In response to EEI's recommendation, DOE amends Sec.  1004.13(g)(7) 
to require the marking of electronic information with the words ``CEII-
CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION--DO NOT RELEASE'' in the 
electronic file name or transmitted under a Non-Disclosure Agreement 
(NDA) or other agreements or arrangements, such as those identified in 
Sec.  1004.13(j)(3), to an electronic system where such information is 
stored in a secure electronic environment that identifies the stored 
information as CEII. The Department agrees that the PMAs receive a 
significant amount of CEII, including real-time, streaming information. 
The Department understands that it may not be practical or possible to 
physically mark each electronic file or each bit of real-time, 
streaming data submitted to the PMAs. The Department will consider the 
information marked as long as it is shared with the PMAs under 
appropriate protections, transmitted through secure protocols, and 
stored in secure electronic environments that identify information as 
CEII. For instance, an entity sharing real-time operating information 
under the North American Electric Reliability Corporation's Operating 
Reliability Data Confidential Agreement with PMAs does not need to mark 
the data, provided that the entity supplying the data communicates to 
the PMAs that such real-time data is being provided under the agreement 
and the entity providing the data requests CEII designation. The PMAs 
will store such data in secure electronic environments identifying 
information as CEII. The Department notes that the DOE CEII Coordinator 
or Coordinator's designee still needs to review and evaluate such 
information and make a CEII determination. The marking of information 
as CEII does not guarantee that such information will be designated as 
CEII.
    EEI encourages the Department to clarify the marking requirements 
for submitting pre-designated and machine-to-machine information as 
CEII. In particular, EEI supports the pre-designation of information 
``about [Defense Critical Electric Infrastructure (DCEI)] on incidents 
and emergencies reported through the Department's Form OE-417, and 
Federal spectrum information managed by the National Telecommunications 
and Information Administration (``NTIA'') . . . however, it is unclear 
whether the proposed procedures require submitters of this pre-
designated information to follow the submission process outlined in 
Sec.  1004.13(f)(1)(i) through (iv).'' (EEI, No. 9, p. 9).
    The Joint Trade Associations urge DOE to ``pre-designate'' all 
information as CEII for which a CEII designation is requested. (Joint 
Trade Associations, No. 15, p. 6). Joint Trade Associations argues that 
``Defense Critical Infrastructure Information, Form OE-417 submissions, 
and Federal spectrum information is likely to reflect CEII, and it is 
appropriate to immediately extend a blanket of protection over these 
submissions.'' Id. This approach would not preclude the case where 
``individualized designation determination would still be made on all 
information for which CEII treatment is requested, which would protect 
against over-designation of material that does not qualify as CEII.'' 
Id. at 8. Further, the Joint Trade Associations argue ``if the 
Department does not adopt pre-designation for all materials . . . DOE 
should specify that a public power utility that receives a state public 
records request for information that has been submitted to DOE with 
request for CEII designation will have the opportunity to consult with 
the DOE CEII Coordinator and receive an expedited determination as to 
whether the submitted information is CEII under DOE's regulations.'' 
Id. at 11.
    EarthJustice et al. also raised concerns with the Department's 
suggested blanket CEII designation of information related to DCEI. The 
comment doubted that all information related to DCEI would meet the 
CEII criteria. See id. The comment characterized the automatic DCEI 
designation as a ``sweeping restriction on public access to information 
that would not lead to disclosure of CEII,'' in violation of the FAST 
Act, ``and the Department's failure to provide reasonable justification 
for this element of the proposal also violates the [Administrative 
Procedure Act].'' Id. at 9.
    S&P Global Market Intelligence and E&E News oppose what they 
describe as the Department's intent to automatically designate the 
content of submitted Form OE-417 (or successor), including Schedule 2 
(the narrative description), as CEII. (S&P Global Market Intelligence, 
No. 6, p. 1; E&E News, No. 8, at p.1). S&P Global Market Intelligence 
raised the following three points opposing the Department's proposal. 
First, the Department did not explain why it must distinguish between 
OE-417 Schedule 1 (information that is ``not confidential'') and 
Schedule 2 (information that ``DOE proposes `will be protected' upon 
CEII designation request''). (S&P Global Market Intelligence, No. 6, p. 
1). Second, an automatic exemption would be at odds with FERC's 
requirement of adequate justification for a CEII designation. Finally, 
the Department in 2014 proposed to revoke public access to Form OE-417 
Schedule 2 under the Confidential Information Protection and 
Statistical Efficiency Act of 2002, but never did, based on feedback. 
Id. at 2.
    E&E News also opposed the Department's proposal. First, 
automatically exempting any portion of the Form OE-417 from applicable 
FOIA laws without proper justification would be in conflict with FERC, 
which requires adequate justification. (E&E News, No. 8, at p.1). 
Second, E&E News argues that ``[i]n years of processing OE-417 
information and releasing accompanying data, in whole or in part, under 
FOIA, DOE has not demonstrated that the public release of properly-
redacted Schedule 1 or 2 information ever threatened to impair the 
security of critical infrastructure . . . Section 2 is where the 
clarifying details are often provided in the form, without which the 
public could get a distorted picture of the exact scope of the concern, 
issue or threat.'' Id. at 2. Finally, E&E News argues that in 2014 DOE 
proposed to revoke public access to Schedule 2 under the Confidential 
Information Protection and Statistical Efficiency Act of 2002. But 
based on feedback received, DOE did not proceed with the proposal. Id.
    Electric Reliability Council of Texas, Inc. (ERCOT) pointed out 
that the language in the proposed rule is in conflict with respect to 
schedule 2 of Form OE-417. In Sec.  1004.13(g)(3) ``DOE intends to 
`automatically' classify information submitted on schedule 2 of Form 
OE-417 as CEII upon submission of a request for CEII treatment of that 
information . . . However, the proposed definition of CEII [in Sec.  
1004.13(c)(3)] indicates that information submitted on Form OE-417 will 
be confidential only if it meets the definition of CEII.'' (ERCOT, No. 
14, p. 2). ERCOT recommends ``DOE revise the rule to treat all 
information submitted on schedule 2 of Form OE-417 as CEII without 
requiring a further showing of CEII status or even requiring a request 
for CEII treatment. Otherwise, ERCOT would suggest that the DOE remove 
the mention of OE-417 from the definition of CEII to avoid confusion.'' 
Id. at 2-3.
    In response to the comments above, the Department clarifies that 
the intent of the Department is not to designate categories of 
information as CEII through this rulemaking. The

[[Page 14762]]

Department will therefore remove all references to ``pre-designation'' 
in the Final Rule. All information submitted will be reviewed and 
evaluated and then, if appropriate, designated as CEII by the CEII 
Coordinator or his/her designee. The Department will modify the 
definition of CEII to remove the categories Defense Critical Electric 
Infrastructure; information on electric incidents and emergencies 
reported to DOE through the Electric Emergency Incident and Disturbance 
Report (Form OE-417); and/or Federal spectrum information managed by 
the National Telecommunications and Information Administration (NTIA). 
DOE notes that whether the information meets one or more of these 
categories will still be considered in the Department's determination 
of whether information is CEII. DOE will also render a decision as to 
whether information is CEII before sharing the information with other 
Federal or non-federal entities or releasing that information in 
response to a FOIA request. As a result, there is no practical change 
in the protection of information for which a CEII designation is 
requested between the NOPR and this final rule. The Department intends 
that this practice will facilitate the energy sector's sharing of CEII 
with DOE and, in requesting information to support its policy 
initiatives and priorities, it may request CEII-designated information. 
If information requested by the Department is determined to meet the 
CEII designation criteria, the Department will designate such 
information as CEII upon receipt by the Department.
    EarthJustice et al. commented on the Department's ``pre-
designation'' of material as CEII, as well as its ``interim'' treatment 
of CEII. The comment stated that the proposed rule would allow such 
information ``to be withheld indefinitely without opportunity for 
judicial review.'' (EarthJustice et al., No. 3, p. 3). Further, the 
comment stressed that the Department ``fails to explain its need to 
provide indefinite, interim treatment of information as CEII based 
solely on the assertion of the information provider.'' Id. at 10.
    As discussed above, the Department will not be pre-designating 
categories of information as CEII through this rulemaking, and CEII 
designation will hinge on a rigorous review and application of the 
criteria defining such information. Notwithstanding that approach, 
information submitted with a CEII designation request will not be 
shared with the public except in response to a valid FOIA request, and 
only then if the information is determined not to be CEII, not to fall 
under any other FOIA exemption, and applicable administrative and 
judicial remedies have been exhausted pursuant to paragraph 1004.13(i) 
of the regulations. To clarify, if the information is sought via FOIA, 
the Department will review and consider whether the information is 
eligible for official CEII designation. In any event, a submitter will 
still need to follow all of the submission process outlined in Sec.  
1004.13(g)(1)(i) through (iv), and the information will not be 
designated as CEII until the CEII Coordinator or his/her designee makes 
a determination.
    EarthJustice et al., discussing a related concern, cautioned that 
pre-designation and interim treatment would hamstring judicial review 
of CEII determinations. The comments stressed that the amendments to 
the FPA demonstrate ``clear legislative intent to afford protections 
against arbitrary CEII designations and ensure public access where 
appropriate.'' Id. at 4. More specifically, EarthJustice et al. were 
concerned that ``[b]ecause neither pre-designation nor interim CEII 
status appears to trigger an opportunity for a person to request 
reconsideration of that treatment, which would be a prerequisite to 
judicial review, DOE's proposed rules effectively and inappropriately 
nullify this section of law.'' Id.
    As discussed above, DOE will not be pre-designating categories of 
information as CEII in this rulemaking. If a FOIA request is received 
for material claimed to be CEII but not yet designated as such, the 
request will result in a decision by DOE whether the information is 
CEII. If the submitter pursues DOE's decision through the 
reconsideration stage described at Sec.  1004.13(i), that decision 
would then be subject to judicial review.
    Finally, EarthJustice et al. pointed out that the Department's 
promise to return or destroy material not designated CEII would violate 
the Federal Records Act. Specifically, they said that ``[t]he proposal 
suggests that records could be requested under FOIA, triggering a 
determination that a CEII designation is unwarranted, and then the 
records could be returned or destroyed prior to the resolution of the 
FOIA request[, which] would be patently unlawful.'' (EarthJustice et 
al., No. 3, p. 6). The comment warned that information ``could be 
labeled CEII, however unjustifiably, for the purpose of ensuring that 
such information is returned or destroyed when a CEII designation is 
denied, regardless of the information's content or how the Department 
utilized it.'' Id. at 8.
    The Department agrees that destruction of submitted material 
examined for CEII designation may be contrary to the Federal Records 
Act. The Department therefore revises Sec.  1004.13(g)(6)(iii) to 
emphasize that it will in all instances comply with the Federal Records 
Act.

I. Duration of Designation

    Section 1004.13(h) outlines procedures governing the duration of 
CEII designation, to include re-applications for CEII designation, 
expiration of designation, removal of designation, and treatment and 
return of information no longer designated as CEII.
    EEI, joined by Southern California Edison (SoCal Edison), expressed 
concern that the proposed rule would not ease the regulatory burden on 
submitters of information claimed as CEII. Their comments warned, for 
instance, that ``[d]uplicative tracking [of CEII expiration dates] 
could quickly become onerous and overwhelming for submitters who may 
also have to track information they have shared with other Federal 
entities.'' (EEI, No. 9, pp. 15-16). They suggested ``that the 
Department notify the CEII submitter and automatically initiate the re-
designation process before the CEII designation period expires.'' Id. 
at 16. They also recommended a ``default action'' of returning or 
destroying non-CEII and ``allowing at least ten days for submitters to 
comment in writing prior to the removal of CEII designations.'' Id.
    The Joint Trade Associations described similar concerns. 
Specifically, their comments expressed unease ``that the need for CEII 
submitters to track designation durations and dates of expiration for 
potentially numerous CEII submissions over multiple years could be a 
record-keeping challenge and a potential trap for the unwary that could 
put CEII designations at risk of inadvertent expiration.'' (Joint Trade 
Associations, No. 15, pp. 11-12). They recommended ``revis[ing] the 
proposed regulations to specify that, like FERC, DOE will continue to 
treat CEII as non-public even after a designation has lapsed due to the 
passage of time,'' and that ``submitters of CEII for which a 
designation has lapsed would receive notice of any requests for such 
information (by either a Federal or non-federal entity) and an 
opportunity to assert that DOE should re-designate the information as 
CEII.'' Id. at 12.
    The Department agrees with the comments that the Department could 
automatically initiate the re-designation process before the CEII 
designation period expires. Therefore, the

[[Page 14763]]

Department clarifies there are two methods for initiation of the re-
designation process. The Department may automatically initiate the re-
designation process or the CEII submitter may request re-designation. 
Thus, the Department revises Sec.  1004.13(h)(1) to add a subparagraph 
(iii) to make clear that the Department can also automatically initiate 
the re-designation process at any time during the duration of the 
designation.
    Furthermore, the Department clarifies that information whose CEII 
designation has lapsed will not be immediately disclosed to the public. 
The information would only be disclosed following a review and 
determination as to whether CEII or other FOIA exemptions are 
applicable. Should the Department receive a FOIA request for the 
information, and determine that the information would be responsive to 
the FOIA request, the submitter or the Department will have an 
opportunity to contend that the information should be re-designated 
CEII prior to release. Regardless of the Department's re-designation 
decision, the aggrieved party could seek reconsideration, after which 
judicial review would be available if desired.
    Finally, the Department cannot return or destroy non-CEII in 
violation of the Federal Records Act or other applicable laws. The 
Department therefore declines to institute the default action as the 
commenters recommended. Instead, the Department will return or destroy 
non-CEII consistent with applicable law and will make that evaluation 
on a case-by-case basis.

J. Review or Requests for Reconsideration of Designation

    Proposed Sec.  1004.13(i) describes how a submitter may request 
reconsideration of a decision not to designate CEII, not to release 
CEII in response to a request for release, or not to maintain an 
existing CEII designation, and discusses eligibility for judicial 
review. The subsection also notes that, with several exceptions, a 
reconsideration request triggers a stay of the underlying decision. The 
Department would like to clarify that all submitters of information 
proposed for CEII designation may request reconsideration of a DOE 
decision not to designate that information as CEII. A request for 
reconsideration can be made through a secure electronic submission or 
by mail according to the instructions at 10 CFR 205.12. The Department 
therefore revises Sec.  1004.13(i) to allow for secure electronic 
submission or by mail according to the instructions at 10 CFR 205.12.
    EarthJustice et al. stated that the Department does not provide due 
process to challengers of its decisions. The comment accuses the 
Department's proposed rule of being ``little more than an attempt to 
hide the Department's decision-making process from public scrutiny and 
obfuscate judicial challenges to the Department's authority.'' 
(EarthJustice et al., No. 3, p. 14). Further, the comment points out 
that, in contrast to FERC, ``[t]he proposed rules notably do not 
provide any means for parties to Department proceedings to obtain 
timely access to information that is designated as CEII or 
preliminarily treated as CEII, and which therefore cannot be accessed 
by the public.'' Id. at 13. The comment stresses that ``[d]enying 
access to information that forms the basis of Department decision-
making to parties affected by those decisions is inconsistent with due 
process.'' Id.
    In response, the Department emphasizes that the CEII designation 
procedure is an exercise in balancing a requester's need for 
information against the Nation's interest in national security. When 
information does not meet the CEII standard, the Department may 
disclose it if the Department receives a request under FOIA and the 
information is not otherwise protected from disclosure. When the 
Department finds that information qualifies as CEII, the Department 
will withhold it if the Department receives a FOIA request. Those 
aggrieved by such decisions have a number of avenues to seek relief, as 
specified in the rule and in DOE's FOIA regulations.

K. Sharing of CEII

    As indicated in proposed Sec.  1004.13(j), DOE may share CEII as 
necessary to carry out its specific jurisdictional duties pursuant to 
section 215A of the FPA and as the lead Sector-Specific Agency for 
cybersecurity for the energy sector under section 61003(c)(2)(A) of the 
FAST Act, and the Sector-Specific Agency for Energy (Critical 
Infrastructure) under Presidential Policy Directive 21, ``Critical 
Infrastructure Security and Resilience'' (Feb. 12, 2013). Those 
submitting CEII would have DOE's assurance that the information will be 
protected from unauthorized disclosure. The Department would follow 
standardized procedures when sharing CEII with Federal and non-federal 
entities to ensure the protection of CEII. Non-federal entities would 
be required to enter into a NDA with the Department, meeting the 
standards outlined in the proposed rule, prior to receiving CEII from 
DOE. When a non-federal entity requests such information, the DOE CEII 
coordinator would notify the submitter of the CEII and the appropriate 
DOE Office(s), to facilitate coordination and allow the submitter to 
raise concerns related to a requesting entity. The DOE CEII coordinator 
would, in consultation with the appropriate DOE Office(s), make a final 
determination on whether to release any CEII-designated material in 
response to such a request.
    As mentioned above, DOE recognizes the importance of coordination 
among Federal entities with similar programs, therefore DOE revises 
Sec.  1004.13(j)(1) to allow for CEII to be shared with other Federal 
entities without such entities being subject to the procedures set 
forth in Sec.  1004.13(k). Instead, DOE will evaluate requests by 
Federal entities for CEII on a case-by-case, fact-specific basis, and 
may request information from the Federal entity explaining the specific 
jurisdictional responsibility, and the entity program charged with 
implementing that responsibility, to be fulfilled by obtaining the 
CEII. This approach allows DOE to continue its goal of appropriate 
sharing of CEII within the Federal Government. It also ensures that 
Federal entities will have access to CEII to carry out jurisdictional 
responsibilities.
    ERCOT urges DOE to reconsider its approach to share CEII with non-
federal Entities and instead ``[f]or CEII that DOE obtains from 
external sources, those who can demonstrate a legitimate need for that 
information should be able to obtain the information directly from the 
source of that CEII . . .'' (ERCOT, No. 14, p. 1). PJM Interconnection 
LLC (PJM) notes that it ``has its own procedures under which requestors 
may submit requests and obtain CEII directly from PJM . . . PJM is 
concerned that as written, the proposed DOE rule potentially allows for 
requesters to circumvent the more rigorous CEII processes of the RTOs 
by simply going directly to the DOE for the requested information.'' 
(PJM, No. 13, p. 5). PJM recommends DOE revise its proposed regulations 
``to require a requestor to first seek the information from the 
submitter of the CEII . . . Ultimately, if a requester is denied access 
to CEII from the submitter of the information, the requester could 
still seek the CEII from the Department'' (Id. at pp. 5-6). The Joint 
Trade Associations recommend that ``DOE reconsider its proposal to 
allow sharing of CEII that was not generated by DOE over the objection 
of the submitting entity in cases where information was voluntarily 
provided to DOE by the submitter.'' (Joint Trade Associations, No. 15, 
p. 15).

[[Page 14764]]

    DOE declines to revise its procedures as requested in the comments 
above. Once the CEII is in the Department's possession, it is the 
Department's obligation to determine whether to share the information. 
However, the Department clarifies that it will balance the need for and 
intended use of the information in the interest of national security 
against any concerns the CEII submitter has regarding the release of 
the information. The Department therefore revises Sec.  1004.13(j)(2) 
to emphasize that a request shall not be entertained unless the 
requesting non-federal entity can demonstrate that the release of 
information is in the national security interest. In addition, based on 
other comments set forth below in Section L, DOE is adopting the 
criteria set forth in the FERC regulations in Sec.  1004.13(k) for the 
detailed statement that is required by a requestor of CEII. These 
criteria provide more specificity with regard to the proposed Sec.  
1104.13(k)(2) as to what DOE will expect in the explanation of need 
provided with a request for CEII.
    EEI encourages the Department to clarify and align its procedures 
for sharing with Federal and non-federal entities. In particular, EEI 
recommends ``that in Sec.  1004.13(j)(1) the Department explicitly 
require Federal Entities with which the Department shares CEII to 
protect the CEII from access or disclosure by individuals or 
organizations that have not been authorized by the Department and limit 
their use of the CEII.'' (EEI, No. 9, p. 19). EEI argues that only 
requiring minimum protections for CEII shared with non-federal entities 
creates a disclosure risk for submitters if DOE shares the information 
with Federal entities. Id. EEI does acknowledge that the Department's 
procedures allow the Department to impose restrictions on the use and 
security of the information but without explicitly requiring minimum 
protections there is a risk that the information could be disclosed 
inadvertently, knowingly, or willfully to unauthorized individuals or 
organizations by other Federal entities. Id. EEI encourages the 
Department to also consider clarifying that the CEII it shares with 
Federal entities be maintained in accordance with the Department's CEII 
procedures. Id.
    The Department clarifies that a Federal agency in receipt of CEII 
from the Department must protect that information in the same manner as 
the Department. That agency will be required to execute an appropriate 
Agency Acknowledgment and Agreement. The Department has revised Sec.  
1004.13(j)(1) to require an authorized agency employee to sign an 
acknowledgement and agreement that states the agency will protect the 
CEII in the same manner as the Department and will refer any requests 
for the information to the Department. Notice of each such request must 
also be given to the CEII Coordinator, who shall track this 
information.
    PJM points out that ``[i]t is unclear from the proposed rule 
whether the Department intends for the contemplated CEII NDA to apply 
to each individual request . . . or whether the Department intends for 
the requester to enter into the CEII NDA once, with such CEII NDA 
applying to all requests made by the requester for a certain period of 
time.'' (PJM, No. 13, p. 6). PJM recommends ``DOE's CEII NDAs to be 
specific to the requested information, be specific to the named 
individuals, and subset on their own terms, absent specific requests 
for renewal after twelve (12) months. Incorporating these parameters 
into the Department's procedures would avoid the perpetuation of stale 
NDAs not tied to specific data or signed by individuals no longer 
employed by the particular entity under which the request was made to 
the DOE.'' Id at 6-7.
    The Department revises Sec.  1004.13(j)(2) to clarify that a 
requester that has entered into a CEII NDA with the Department is not 
required to file another NDA with subsequent requests during the 
calendar year because the original NDA must state that the agreement 
applies to all subsequent releases of CEII during that calendar year. 
However, the Department does not believe it is necessary to have an NDA 
be specific to the individual CEII information requested because all 
CEII will be maintained and protected in the same manner regardless of 
source or type of information.
    The Joint Trade Associations and the Transmission Access Policy 
Study Group (TAPS) recommend revising the CEII NDA to include specific 
reference to the public disclosure law exemption. Both parties contend 
that including the text of the exemption in the NDA would ensure 
awareness of the limitation among stakeholders. (Joint Trade 
Associations, No. 15, p. 10; TAPS, No. 7, p. 3). Further, the Joint 
Trade Associations pointed out that FERC agreed with this 
recommendation and referenced the provision in section 215A(d)(1) in 
its CEII NDA. Id.
    DOE agrees that the CEII NDA should reference the provision in 
section 215A(d)(1) that CEII is exempt from disclosure under Federal, 
State, political subdivision, or tribal law requiring public 
disclosure. Accordingly Sec.  1004.13(j)(2) has been revised to include 
this additional requirement.
    EEI encourages ``the Department to share the minimum-level NDA with 
stakeholders for notice and comment to enable input from potential 
submitters and requesters on what can and should be agreed upon in the 
minimum-level NDAs.'' (EEI, No. 9, p. 21). EEI goes on to state that 
although it does not oppose the development of protocols for sharing 
CEII with Canadian and Mexican authorities it recommends that the 
Department allow for notice and comment by stakeholders. Id. at 21-22.
    Section 1004.13(j)(2) already includes minimum requirements for an 
NDA and is not intended to be exhaustive or preclude other 
requirements. Under certain circumstances, DOE may add additional 
provisions to the NDA and submitters may request that additional 
provisions be added to the NDA.
    DOE appreciates EEI's concerns about protocols for sharing CEII 
with Canadian and Mexican authorities. DOE believes stakeholder notice 
and comment for the development of the protocols is not necessary. DOE 
clarifies here that a series of bilateral agreements govern and inform 
its work with Canadian and Mexican Authorities. As the U.S. power grid 
is integrated with jurisdictions in both Canada and Mexico, DOE fully 
intends to work closely with Canadian and Mexican authorities. Our 
three nations have a shared interest in the optimal functionality of 
our integrated power grid, and DOE will therefore develop sharing 
protocols that will ensure consistent treatment of information and 
data.
    Section 1004.13(j)(3) was based on section 215A(d)(2)(D) of the 
FPA. Since the promulgation of Sec.  215A, the Presidential Decision 
Directive 63, ``Critical Infrastructure Protection'' (May 22, 1998) 
referenced in section 215A(d)(2)(D) was superseded by Homeland Security 
Presidential Directive/HSPD-7, ``Critical Infrastructure, 
Identification, Prioritization, and Protection'' (Dec. 17, 2003), which 
has since been revoked by Presidential Policy Directive 21, ``Critical 
Infrastructure Security and Resilience'' (Feb. 12, 2013) (PPD-21). 
Therefore, DOE includes reference to information sharing and analysis 
organization (ISAO) defined at 6 U.S.C. 671(5), which defines ISAO as 
``any formal or informal entity or collaboration created or employed by 
public or private sector organizations for purposes of gathering and 
analyzing . . . communicating or disclosing . . . and voluntarily 
disseminating critical infrastructure information, including

[[Page 14765]]

cybersecurity risks and incidents.'' ISAO includes information sharing 
and analysis centers. See, e.g., 6 U.S.C. 659(d)(1)(B)(ii).

L. Procedures for Requesting CEII

    Proposed Sec.  1004.13(k) delineates procedures for requesting CEII 
designation and sharing CEII-designated materials. A request must 
include contact information, an explanation of the need for and 
intended use of the CEII, and a signed Non-Disclosure Acknowledgment or 
Agreement, as applicable.
    DOE received several comments requesting additional details 
concerning the criteria and procedures that DOE will apply in 
responding to requests for release of CEII. For example, EEI recommends 
that DOE ``consider clarifying that it will review the legitimacy of 
received requests and their associated requestors in making its sharing 
determination.'' (EEI, No. 9, p. 15). MISO stated that ``DOE should 
specify criteria for the review of requestors and requests, and 
consistently abide by those criteria throughout the DOE Offices when 
making decisions about sharing CEII.'' (MISO, No. 11, p. 4). PJM noted 
that ``the Department should deny a non-federal entity request that 
merely provides a broad need statement, such as general explanations of 
the business or profession of the requester or generalized statements 
that the requester intends to use the CEII in the normal course of the 
requestor's business or profession.'' (PJM, No. 13, p. 3). PJM 
recommended ``the requestor should be required to detail with 
specificity its need to know the requested information and why a 
request to DOE for release of CEII is the sole means for it to 
accomplish the purpose outlined in its request.'' Id. at 4. The Joint 
Trade Associations recommended that ``DOE should specify that any 
entity requesting CEII will be required to make a particularized 
showing of how its receipt of CEII will accomplish the stated need for 
the information.'' (Joint Trade Associations, No. 15, p. 16). The 
Sustainable FERC Project and Natural Resources Defense Council 
recommend that ``DOE adopt FERC's language so that there is consistency 
across agencies.'' (The Sustainable FERC Project and Natural Resources 
Defense Council, No. 10, p. 3).
    In response to these comments, DOE is adopting the criteria set 
forth in the FERC regulations for the detailed statement that is 
required by a requestor of CEII. In Sec.  1004.13(k), DOE shall 
consider requests for CEII on a case-by-case basis. In addition, the 
requestor must provide a detailed statement which includes: (1) The 
extent to which a particular function is dependent upon access to the 
information; (2) why the function cannot be achieved or performed 
without access to the information; (3) an explanation of whether other 
information is available to the requester that could facilitate the 
same objective; (4) how long the information will be needed; (5) 
whether or not the information is needed to participate in a specific 
proceeding (with that proceeding identified); and (6) an explanation of 
whether the information is needed expeditiously. As noted in section K, 
these criteria provide more specificity with regard to the proposed 
Sec.  1104.13(k)(2) as to what DOE will expect in the explanation of 
need provided with a request for CEII.

M. Unauthorized Disclosure

    In the NOPR, DOE proposed Sec.  1004.13(l), which sets out 
penalties and sanctions for unauthorized disclosure of CEII, 
emphasizing that statutory whistleblower protections still apply.
    PJM encourages the Department to consider ``specifying disciplinary 
action for non-Department employees or contractors who knowingly or 
willfully disclose CEII in an unauthorized manner'' such as prohibition 
of making future requests by the requester.'' (PJM, No. 13, p. 7). 
Additionally, PJM recommended the Department ``should consider 
providing remedies to submitters for incidents of knowing or willful 
disclosure of CEII in an unauthorized manner.'' Id.
    The Department notes that the FAST Act does not require the 
Department to develop sanctions for external recipients of CEII. 
However, in order to ensure non-federal entities understand the serious 
nature of a knowing or willful disclosure of CEII, DOE will amend its 
proposed regulations at Sec.  1004.13(l)(2) to state that any action by 
a Federal or non-federal Entity who knowingly or willfully falsifies, 
conceals, or covers up by any trick, scheme, or device a material fact; 
makes any materially false, fictitious, or fraudulent statement or 
representation; or makes or uses any false writing or document knowing 
the same to contain any materially false, fictitious, or fraudulent 
statement or entry to obtain CEII may constitute a violation of other 
applicable laws and is potentially punishable by fine and imprisonment. 
DOE will actively pursue all available remedies, including through 
referrals to appropriate law enforcement entities.
    The Department declines to adopt PJM's recommendation that it 
provide remedies to submitters for incidents of knowing or willful 
disclosure of CEII in an unauthorized manner. The Department is 
revising the regulations to specify that knowingly or willfully 
falsifying information to obtain CEII may constitute a violation of 
applicable laws and is potentially punishable by fine or imprisonment.
    EEI (joined by SoCal Edison) and the Joint Trade Associations 
expressed concern that inadvertent disclosure of CEII could eliminate 
that material's status as CEII and lift its FOIA exemption. EEI stated 
that ``it is unclear if an inadvertent disclosure will trigger the 
Department to remove the CEII designation,'' and asked the Department 
to clarify ``the notification procedures for unauthorized CEII 
disclosures and CEII designation changes.'' (EEI, No. 9, p. 13). The 
Joint Trade Associations asked the Department to ``clarify that 
inadvertent disclosure of CEII by a submitting entity generally would 
not be a basis for reconsidering/removing a CEII designation.'' (Joint 
Trade Associations, No. 15, p. 4).
    The Department clarifies that inadvertent disclosure does not 
affect the disclosed material's CEII status. Such status is to be 
determined strictly according to the criteria FERC developed and 
promulgated in December 2016, as mandated by the FAST Act amendments to 
the FPA that created the CEII designation authority. Once a CEII 
designation is applied, the designation continues until it expires or 
is affirmatively removed.
    Nonetheless, it is important to distinguish between inadvertent and 
deliberate disclosure. As stated in proposed Sec.  1004.13(l)(1), the 
Department may remove a CEII designation ``[i]f the submitter of 
information [designated CEII] discloses'' that information. In response 
to the comment, the Department revises Sec.  1004.13(l)(1) to emphasize 
that a CEII designation may be removed following deliberate disclosure, 
meaning disclosure that is not inadvertent and is sanctioned by the 
person with ultimate authority to determine whether and how the 
information is to be shared with the public.

III. Regulatory Review

A. Executive Order 12866 and 13563

    This regulatory action has been determined to be a ``significant 
regulatory action'' under Executive Order 12866, ``Regulatory Planning 
and Review.'' 58 FR 51735 (Oct. 4, 1993). Accordingly, this action was 
subject to

[[Page 14766]]

review under that Executive Order by the Office of Information and 
Regulatory Affairs of the Office of Management and Budget. DOE has also 
reviewed this regulation pursuant to Executive Order 13563, issued on 
January 18, 2011. 76 FR 3281 (Jan. 21, 2011). Executive Order 13563 is 
supplemental to and explicitly reaffirms the principles, structures, 
and definitions governing regulatory review established in Executive 
Order 12866. To the extent permitted by law, agencies are required by 
Executive Order 13563 to: (1) Propose or adopt a regulation only upon a 
reasoned determination that its benefits justify its costs (recognizing 
that some benefits and costs are difficult to quantify); (2) tailor 
regulations to impose the least burden on society, consistent with 
obtaining regulatory objectives, taking into account, among other 
things, and to the extent practicable, the costs of cumulative 
regulations; (3) select, in choosing among alternative regulatory 
approaches, those approaches that maximize net benefits (including 
potential economic, environmental, public health and safety, and other 
advantages; distributive impacts; and equity); (4) to the extent 
feasible, specify performance objectives, rather than specifying the 
behavior or manner of compliance that regulated entities must adopt; 
and (5) identify and assess available alternatives to direct 
regulation, including providing economic incentives to encourage the 
desired behavior, such as user fees or marketable permits, or providing 
information upon which choices can be made by the public.

B. Executive Orders 13771

    On January 30, 2017, the President issued Executive Order 13771, 
``Reducing Regulation and Controlling Regulatory Costs.'' 82 FR 9339 
(Feb. 3, 2017). That Order stated the policy of the executive branch is 
to be prudent and financially responsible in the expenditure of funds, 
from both public and private sources. The Order stated it is essential 
to manage the costs associated with the governmental imposition of 
private expenditures required to comply with Federal regulations.
    The development and implementation of the procedures, as laid out 
in section 215A(d) of the FPA, are designed to protect the security and 
reliability of the nation's bulk-power system, distribution facilities, 
and other forms of energy infrastructure. The procedures relate solely 
to marking information that would facilitate voluntary sharing of CEII 
among DOE and other appropriate Federal, state, or local entities to 
address emergencies, accidents, or intentional destructive acts 
affecting the production, transmission, and delivery of energy 
resources. There is no new reporting requirement and no new program 
created as a result of the proposed procedures. This information will 
be stored on currently existing DOE systems.
    This final rule is not subject to the requirements of E.O. 13771 
(82 FR 9339, February 3, 2017) because this final rule is related to 
agency organization, management or personnel. Specifically, the rule 
provides for marking of information submitted to DOE as CEII so that 
DOE can protect CEII as necessary and appropriate.

C. National Environmental Policy Act

    DOE has concluded that promulgation of this rule is covered under 
the Categorical Exclusion found in DOE's National Environmental Policy 
Act regulations at paragraph A6 of appendix A to subpart D, 10 CFR part 
1021, which applies to rulemakings that are strictly procedural, such 
as rulemaking (under 48 CFR part 9) establishing procedures for 
technical and pricing proposals and establishing contract clauses and 
contracting practices for the purchase of goods and services, and 
rulemaking (under 10 CFR part 600) establishing application and review 
procedures for, and administration, audit, and closeout of, grants and 
cooperative agreements. Accordingly, neither an environmental 
assessment nor an environmental impact statement is required.

D. Regulatory Flexibility Act

    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires 
preparation of an initial regulatory flexibility analysis for any rule 
that by law must be proposed for public comment, unless the agency 
certifies that the rule, if promulgated, will not have a significant 
economic impact on a substantial number of small entities. As required 
by Executive Order 13272, ``Proper Consideration of Small Entities in 
Agency Rulemaking,'' 67 FR 53461 (Aug. 16, 2002), DOE published 
procedures and policies on February 19, 2003, to ensure that the 
potential impacts of its rules on small entities are properly 
considered during the rulemaking process. 68 FR 7990 (Feb. 19, 2003). 
DOE's procedures and policies are available on the Office of General 
Counsel's website: https://energy.gov/gc/office-general-counsel.
    DOE has reviewed this final rule under the provisions of the 
Regulatory Flexibility Act and the procedures and policies published on 
February 19, 2003. This final rule sets forth agency procedures for the 
designation, sharing, and protection of CEII, and applies to DOE 
employees, DOE contractors, agents of DOE, and individuals or 
organizations submitting a request for CEII designation or who have 
requested or been permitted access to CEII. The proposed procedures for 
marking incoming requests and/or submissions, which are expected to 
facilitate voluntary sharing of CEII among DOE and other appropriate 
Federal, state, or local entities to address emergencies, accidents, or 
intentional destructive acts to the production, transmission, and 
delivery of energy resources, are not expected to result in a 
significant impact to stakeholders. FERC's regulations already require 
entities requesting CEII designation to mark the subject information. 
DOE's procedures would provide consistency and would also help avoid 
unauthorized disclosure or release. DOE therefore expects that these 
procedures would not affect DOE's decision to designate submitted 
information as CEII, nor any decision to withhold or release 
information to requesters of energy infrastructure information under 
FOIA. On the basis of the foregoing, DOE certifies that this regulation 
will not have a significant economic impact on a substantial number of 
small entities. Accordingly, DOE has not prepared a regulatory 
flexibility analysis for this rulemaking. DOE's certification and 
supporting statement of factual basis was provided to the Chief Counsel 
for Advocacy of the Small Business Administration pursuant to 5 U.S.C. 
605(b) and the Department did not receive any comments on the 
certification or the economic impacts of the rule.

E. Paperwork Reduction Act

    Pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et 
seq.) (PRA) and the procedures implementing that Act at 5 CFR part 1320 
require the Office of Management and Budget to review and approve 
certain information collection requirements imposed by agency rule. 
This Final Rule does not impose any additional information collection 
requirements. Therefore, the information collection regulations do not 
apply to this Final Rule.

F. Unfunded Mandates Reform Act of 1995

    The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) generally 
requires Federal agencies to examine closely the impacts of regulatory 
actions on State, local, and tribal governments. Section 101(5) of 
title I of that law defines a Federal intergovernmental mandate to 
include any regulation that

[[Page 14767]]

would impose upon State, local, or tribal governments an enforceable 
duty, except a condition of Federal assistance or a duty arising from 
participating in a voluntary Federal program. Title II of that law 
requires each Federal agency to assess the effects of Federal 
regulatory actions on State, local, and tribal governments, in the 
aggregate, or to the private sector, other than to the extent such 
actions merely incorporate requirements specifically set forth in a 
statute. Section 202 of that title requires a Federal agency to perform 
a detailed assessment of the anticipated costs and benefits of any rule 
that includes a Federal mandate that may result in costs to State, 
local, or tribal governments, or to the private sector, of $100 million 
or more in any one year (adjusted annually for inflation). 2 U.S.C. 
1532(a) and (b). Section 204 of that title requires each agency that 
proposes a rule containing a significant Federal intergovernmental 
mandate to develop an effective process for obtaining meaningful and 
timely input from elected officers of State, local, and tribal 
governments. 2 U.S.C. 1534.
    This rule will not result in the expenditure by State, local, and 
tribal governments in the aggregate, or by the private sector, of $100 
million or more in any one year. Accordingly, no assessment or analysis 
is required under the Unfunded Mandates Reform Act of 1995.

G. Treasury and General Government Appropriations Act, 1999

    Section 654 of the Treasury and General Government Appropriations 
Act, 1999 (Pub. L. 105-277) requires Federal agencies to issue a Family 
Policymaking Assessment for any rule that may affect family well-being. 
This rule will not have any impact on the autonomy or integrity of the 
family as an institution. Accordingly, DOE has concluded that it is not 
necessary to prepare a Family Policymaking Assessment.

H. Executive Order 13132

    Executive Order 13132, ``Federalism,'' 64 FR 43255 (Aug. 4, 1999), 
imposes certain requirements on agencies formulating and implementing 
policies or regulations that preempt State law or that have Federalism 
implications. Agencies are required to examine the constitutional and 
statutory authority supporting any action that would limit the 
policymaking discretion of the States and carefully assess the 
necessity for such actions. DOE has examined the rule and has 
determined that it will not preempt State law and will not have a 
substantial direct effect on the States, on the relationship between 
the national government and the States, or on the distribution of power 
and responsibilities among the various levels of government. No further 
action is required by Executive Order 13132.

I. Executive Order 12988

    With respect to the review of existing regulations and the 
promulgation of new regulations, section 3(a) of Executive Order 12988, 
``Civil Justice Reform,'' 61 FR 4729 (Feb. 7, 1996), imposes on 
Executive agencies the general duty to adhere to the following 
requirements: (1) Eliminate drafting errors and ambiguity; (2) write 
regulations to minimize litigation; and (3) provide a clear legal 
standard for affected conduct rather than a general standard and 
promote simplification and burden reduction. Section 3(b)(2) of 
Executive Order 12988 specifically requires that Executive agencies 
make every reasonable effort to ensure that the regulation: (1) Clearly 
specifies the preemptive effect, if any, to be given to the regulation; 
(2) clearly specifies any effect on existing Federal law or regulation; 
(3) provides a clear legal standard for affected conduct while 
promoting simplification and burden reduction; (4) specifies the 
retroactive effect, if any, to be given to the regulation; (5) defines 
key terms; and (6) addresses other important issues affecting clarity 
and general draftsmanship under any guidelines issued by the Attorney 
General. Section 3(c) of Executive Order 12988 requires Executive 
agencies to review regulations in light of applicable standards in 
section 3(a) and section 3(b) to determine whether they are met or it 
is unreasonable to meet one or more of the standards. DOE has completed 
the required review and determined that, to the extent permitted by 
law, the rule meets the relevant standards of Executive Order 12988.

J. Treasury and General Government Appropriations Act, 2001

    The Treasury and General Government Appropriations Act, 2001 (44 
U.S.C. 3516 note) provides for agencies to review most disseminations 
of information to the public under guidelines established by each 
agency pursuant to general guidelines issued by OMB.
    OMB's guidelines were published at 67 FR 8452 (Feb. 22, 2002), and 
DOE's guidelines were published at 67 FR 62446 (Oct. 7, 2002). DOE has 
reviewed this rule under the OMB and DOE guidelines and has concluded 
that it is consistent with applicable policies in those guidelines.

K. Executive Order 13211

    Executive Order 13211, ``Actions Concerning Regulations That 
Significantly Affect Energy Supply, Distribution, or Use,'' 66 FR 28355 
(May 22, 2001), requires Federal agencies to prepare and submit to the 
OMB a Statement of Energy Effects for any proposed significant energy 
action. A ``significant energy action'' is defined as any action by an 
agency that promulgated or is expected to lead to promulgation of a 
final rule, and that (1) is a significant regulatory action under 
Executive Order 12866, or any successor order and is likely to have a 
significant adverse effect on the supply, distribution, or use of 
energy; or (2) is designated by the Administrator of the OIRA as a 
significant energy action. For any proposed significant energy action, 
the agency must give a detailed statement of any adverse effects on 
energy supply, distribution, or use should the proposal be implemented, 
and of reasonable alternatives to the action and their expected 
benefits on energy supply, distribution, and use. This regulatory 
action will not have a significant adverse effect on the supply, 
distribution, or use of energy because it is concerned primarily with 
the procedures for designating, protecting, and sharing information. As 
the FAST Act highlighted, protection of CEII will have a positive 
effect on the energy supply, and is therefore not a significant energy 
action. Accordingly, DOE has not prepared a Statement of Energy 
Effects.

L. Congressional Notification

    As required by 5 U.S.C. 801, DOE will submit to Congress a report 
regarding the issuance of this final rule prior to the effective date 
set forth at the outset of this rulemaking. The report will state that 
it has been determined that the rule is not a ``major rule'' as defined 
by 5 U.S.C. 801(2).

IV. Approval of the Office of the Secretary

    The Secretary of Energy has approved publication of this final 
rulemaking.

List of Subjects in 10 CFR Part 1004

    Freedom of Information.

    Signed in Washington, DC, on February 28, 2020.
Dan Brouillette,
Secretary of Energy.

    For the reasons set out in the preamble, the DOE amends part 1004 
of title 10, Code of Federal Regulations as set forth below:

[[Page 14768]]

PART 1004--FREEDOM OF INFORMATION ACT (FOIA)

0
1. The authority citation for part 1004 is revised to read as follows:

    Authority: 5 U.S.C. 552; 16 U.S.C. 824o-1.


0
2. Add Sec.  1004.13 to read as follows:


Sec.  1004.13  Critical electric infrastructure information.

    (a) Filing Procedures and guidance. Information regarding critical 
electric infrastructure information (CEII) filing procedures and 
further guidance for submitters and requesters is available on the 
website of the United States Department of Energy's Office of 
Electricity at https://www.energy.gov/oe/office-electricity.
    (b) Purpose and scope. This part sets forth the regulations of the 
Department of Energy (DOE) that implement section 215A(d) of the 
Federal Power Act (FPA), codified at 16 U.S.C. 824o-1(d). The 
regulations in this part set forth the DOE procedures for the 
designation, sharing, and protection of CEII. This section applies to 
anyone who provides CEII to DOE or who receives CEII from DOE, 
including DOE employees, DOE contractors, and agents of DOE or of other 
Federal agencies, as well as individuals or organizations providing 
CEII or submitting a request for CEII designation to DOE or who have 
requested or have been permitted access to CEII by DOE.
    (c) Definitions--(1) Bulk-Power System means the facilities and 
control systems necessary for operating an interconnected electric 
energy transmission network (and any portion thereof), and electric 
energy from generation facilities needed to maintain transmission 
system reliability. The term does not include facilities used in the 
local distribution of electric energy.
    (2) Confidential Business Information means commercial or financial 
information that is both customarily and actually treated as private by 
its owner and that is provided to the government as part of a claimed 
CEII submission.
    (3) Critical Electric Infrastructure means a system or asset of the 
bulk-power system, whether physical or virtual, the incapacity or 
destruction of which would negatively affect national security, 
economic security, public health or safety, or any combination of such 
matters.
    (4) Critical Electric Infrastructure Information (CEII) is defined 
at FPA section 215(a)(3), with designation criteria codified at 18 CFR 
388.113(c). CEII means information related to critical electric 
infrastructure, or proposed critical electrical infrastructure, 
generated by or provided to FERC or another Federal agency, other than 
classified national security information, that is designated as CEII by 
FERC or the Secretary pursuant to section 215A(d) of the FPA. Such term 
includes information that qualifies as critical energy infrastructure 
information under FERC's regulations.
    (5) CEII Coordinator means the Assistant Secretary or Principal 
Deputy Assistant Secretary of the DOE Office of Electricity, who shall 
coordinate and oversee the implementation of DOE's program for CEII-
designation authority under section 215A of the FPA, assist all DOE 
Offices with respect to requests for CEII designation in determining 
whether particular information fits within the definition of CEII, and 
manage DOE's protection, storage, and sharing of CEII materials and 
oversight of the development of CEII international sharing protocols. 
The CEII Coordinator may delegate the daily implementation of the CEII 
Coordinator function as described in this rule, in whole or in part, to 
an appropriate DOE Office of Electricity official, to an Assistant 
Secretary in DOE, and to the Administrator of the Bonneville Power 
Administration, the Energy Information Administration, the Southeastern 
Power Administration, the Southwestern Power Administration, or the 
Western Area Power Administration (``Coordinator's designee'').
    (6) Department means the United States Department of Energy.
    (7) Department of Energy (DOE) means all organizational entities 
that are part of the Executive Department created by Title II of the 
DOE Organization Act (Pub. L. 95-91, 91 Stat. 565, 42 U.S.C. 7101 et 
seq.). For purposes of this Part, the definition of DOE specifically 
excludes the Federal Energy Regulatory Commission, which has 
promulgated its own CEII procedures at 18 CFR 388.113.
    (8) DOE Office means any administrative or operating unit of DOE 
with authority at or above the level of Assistant Secretary, Principal 
Deputy Assistant Secretary, or Administrator.
    (9) Secretary means the Secretary of Energy.
    (d) Authority to designate information as CEII. The Secretary has 
the authority to designate information as CEII, in accordance with FPA 
section 215A. The Secretary may delegate the authority to designate 
information as CEII to any DOE Office.
    (e) Coordination among DOE Office designators. The DOE CEII 
Coordinator shall be the primary point of contact for the submission of 
all requests for designation of information as CEII by DOE, as well as 
for requests made to DOE by organizations or individuals for 
information that may be protected, in whole or in part, as CEII.
    (1) The CEII Coordinator or Coordinator's designee shall:
    (i) Receive and review all incoming requests for CEII as defined in 
paragraph (c) of this section and in accordance with paragraph (g) of 
this section;
    (ii) Make initial determinations as to whether particular 
information fits within the definition of CEII found in paragraph (c) 
of this section;
    (iii) Assist any DOE Offices with delegated CEII designation 
authority to make determinations as to whether a particular requester's 
need for and ability and willingness to protect CEII warrants limited 
disclosure of the information to the requester;
    (iv) Establish reasonable conditions for considering requests for 
release of CEII-designated material in accordance with paragraphs 
(g)(5) and (6) of this section;
    (v) Make the Department's final determination regarding a request 
by any non-federal entity (organization or individual) for CEII-
designated materials, in consultation with the appropriate DOE 
Office(s);
    (vi) Notify a CEII submitter of a request for such information by a 
non-federal entity;
    (vii) Convene a conference call between an affected DOE Office and 
a CEII submitter to discuss concerns related to a non-federal entity 
requesting release of CEII within no more than five (5) business days 
after the CEII submitter is notified of the request, providing the CEII 
submitter with a copy of the request prior to the conference call; and
    (viii) Perform oversight of the DOE CEII program and establish 
guidance for the treatment, handling, and storage of all CEII materials 
in the Department in accordance with paragraph (g)(6) of this section, 
including those related to CEII international sharing protocols.
    (2) DOE Offices with delegated authority to designate CEII in 
accordance with paragraph (d) of this section, as well as any CEII 
Coordinator designee(s), will meet regularly, at the discretion of the 
CEII Coordinator, but not less than once per year, to ensure 
coordinated implementation of DOE's CEII designation authority.
    (3) DOE, at the discretion of the CEII Coordinator, shall meet with 
representatives from the Federal Energy Regulatory Commission semi-
annually (or more often, as necessary) to ensure that both agencies are 
applying CEII designation criteria consistently and to share best 
practices.

[[Page 14769]]

    (4) DOE, at the discretion of the CEII Coordinator, shall meet at 
least once per year with representatives from the Department of 
Commerce including the National Telecommunications and Information 
Administration, the Department of Homeland Security, the Nuclear 
Regulatory Commission, and other Federal agencies, as needed, to ensure 
shared understanding and consistent communication among Federal 
agencies that collect, maintain, and potentially release information 
that DOE may consider designating as CEII as defined in paragraph (c) 
of this section.
    (f) CEII FOIA Exemption. All information designated by DOE as CEII 
is exempt from disclosure under the Freedom of Information Act, 5 
U.S.C. 552(b)(3) and shall not be made available by any Federal, state, 
political subdivision, or tribal authority pursuant to any Federal, 
State, political subdivision, or tribal law requiring public disclosure 
of information or records pursuant to section 215A(d)(1)(A) and (B) of 
the Federal Power Act.
    (g) Criteria and procedures for designating CEII--(1) Criteria. The 
CEII Coordinator or Coordinator's designee shall apply the definition 
of CEII as provided in paragraph (c) of this section, consistent with 
FPA section 215A(a)(3), and with designation criteria codified at 18 
CFR 388.113(c), to information sought by DOE and to information 
submitted to DOE with a request for designation.
    (2) Requesting CEII designation of information submitted to DOE. 
Any person or entity requesting that information submitted to DOE be 
designated as CEII must submit such request to the DOE CEII Coordinator 
or Coordinator's designee according to the following procedures:
    (i) The submitter must clearly label the cover page and pages or 
portions of the information for which CEII treatment is requested in 
bold, capital lettering, indicating that it contains CEII, as 
appropriate, and marked ``CEII--CRITICAL ELECTRIC INFRASTRUCTURE 
INFORMATION--DO NOT RELEASE.''
    (ii) The submitter must clearly label the cover page and pages or 
portions of information that it considers Confidential Business 
Information in bold, capital lettering, indicating that it contains 
Confidential Business Information, as appropriate, and marked 
``CONFIDENTIAL BUSINESS INFORMATION--DO NOT RELEASE.'' If combined with 
a CEII label, the information should be marked ``CEII--CRITICAL 
ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS 
INFORMATION--DO NOT RELEASE.''
    (iii) The submitter must also clearly indicate the DOE Office(s) 
from which the CEII designation is being requested in bold, capital 
lettering on the cover page.
    (iv) The submitter must also segregate those portions of the 
information that contain CEII (or information that reasonably could be 
expected to lead to the disclosure of the CEII) wherever feasible.
    (v) The submitter must also label and segregate information that it 
classifies as Confidential Business Information under the definition at 
paragraph (c)(2) of this section with the mark ``CONFIDENTIAL BUSINESS 
INFORMATION--DO NOT RELEASE.'' Under separate cover, the submitter may, 
but is not required to, submit a written justification of why the 
labeled information meets the definition at paragraph (c)(2) of this 
section.
    (vi) The submitter must submit a public version of the information 
where information designated CEII and information for which CEII 
designation is requested is redacted or otherwise protected through 
extraction from the non-CEII to the DOE CEII Coordinator and the 
Coordinator's designee in an appropriate DOE Office, where feasible. If 
the entirety of submitted information is CEII, the submitter must 
indicate that, but no separate public version is required.
    (3) Requesting CEII designation for information generated by DOE. 
Any DOE employees, DOE contractors, or agents of DOE requesting that 
information generated by the Department be designated as CEII must 
submit such request to the DOE CEII Coordinator or the Coordinator's 
designee in an appropriate DOE Office according to the following 
procedures:
    (i) The submitter must clearly label the cover page and pages or 
portions of the information for which CEII treatment is requested in 
bold, capital lettering, indicating that it contains CEII, as 
appropriate, and marked ``CEII--CRITICAL ELECTRIC INFRASTRUCTURE 
INFORMATION--DO NOT RELEASE.''
    (ii) The submitter must also segregate those portions of the 
information that contain CEII (or information that reasonably could be 
expected to lead to the disclosure of the CEII) wherever feasible.
    (iii) The submitter must submit a public version of the information 
where information designated CEII and information for which CEII 
designation is requested is redacted or otherwise protected through 
extraction from non-CEII.
    (iv) CEII designation for information generated by DOE, to include 
all organizational entities that are a part of the Executive Department 
created by Title II of the DOE Organization Act, may be executed at any 
time, regardless of when such information was generated, where 
feasible.
    (4) Treatment of Submitted Information. (i) Upon receiving a 
request for CEII designation of information submitted to DOE, the DOE 
CEII Coordinator or Coordinator's designee shall review the submission 
made in accordance with paragraph (g)(2) of this section.
    (ii) Information for which CEII treatment is requested will be 
maintained by the CEII Coordinator or Coordinator's designee in DOE's 
files as non-public unless and until DOE completes its determination 
that the information is not entitled to CEII treatment. This approach 
does not mean that DOE has made a determination regarding CEII 
designation, and should under no circumstances be construed as such. 
DOE will endeavor to make a determination as soon as practicable. The 
Department retains the right to make determinations about any request 
for CEII designation at any time, including the removal of a previously 
granted CEII designation. At such time that a determination is made 
that information does not meet the CEII criteria, DOE will follow the 
procedures for return of information not designated as CEII outlined in 
paragraph (g)(6)(iii) of this section.
    (iii) When a requester seeks information for which CEII status has 
been requested but not designated, or when DOE itself is considering 
release of such information, DOE will render a decision on designation 
before responding to the requester or releasing such information. 
Subsequently, the release of information will be treated in accordance 
with the procedures established for CEII-designated material, or the 
return of information not designated as CEII.
    (5) Evaluation of CEII designation criteria to inform CEII 
designation determination. (i) The DOE CEII Coordinator, or a 
Coordinator's designee, will execute the Department's evaluation as to 
whether the submitted information or portions of the information meets 
the definition of CEII, as described at paragraph (c)(2) of this 
section, with the appropriate DOE Office with delegated CEII 
designation authority. The DOE Office will designate submitted 
information as soon as practicable and will inform

[[Page 14770]]

submitters of the designation date if requested at the time of 
submission.
    (ii) [Reserved]
    (6) CEII Determination. (i) DOE CEII Coordinator makes CEII 
designation determination. The Secretary or delegated DOE Office will 
make a determination regarding CEII designation after considering the 
information against the criteria for CEII designation. The DOE CEII 
Coordinator or Coordinator's designee shall promptly communicate the 
decision of the Secretary or delegated DOE Office to the submitter.
    (ii) Review of determination. DOE reserves the right to review at 
any time information designated by DOE as CEII to determine whether the 
information is properly designated. The designation of information as 
CEII, or the removal of such designation, must be reviewed when:
    (A) A FOIA request is submitted for the information under Sec.  
1004.10; or
    (B) A request is made for reconsideration of the designation or 
removal of the designation under paragraph (i)(1) of this section.
    (iii) Return of Information not designated as CEII. Because the 
submitter voluntarily provided the information to DOE, at the request 
of the submitter, DOE will return or destroy information for which CEII 
designation was requested but not granted, and will attempt to remove 
all copies of such information from DOE files, both physical and 
electronic. DOE shall return or destroy non-CEII consistent with the 
Federal Records Act, and DOE handling of agency records in accordance 
with DOE Order O.243.1A, Records Management Program, and related 
requirements and responsibilities for implementing and maintaining an 
efficient and economic records management program in accordance with 
law and regulatory requirements. DOE shall not remove electronic files 
in the ordinary course of business. If a submitter is required to 
provide information and DOE denies CEII designation, the submitter may 
file a request for review under the procedures.
    (7) Protection of CEII--(i) Marking of CEII. All information 
designated by DOE as CEII, whether submitted to or generated by DOE, 
shall be clearly labeled as such, and shall include the date on which 
the information was designated as CEII. For information that meets the 
definition of CEII but cannot be physically labeled, such as electronic 
information, the information shall be--
    (A) Electronically marked with the words ``CEII--CRITICAL ELECTRIC 
INFRASTRUCTURE INFORMATION--DO NOT RELEASE'' in the electronic file 
name; or
    (B) Transmitted under a Non-Disclosure Agreement or other 
agreements or arrangements, such as those identified in paragraph 
(j)(3) of this section, to an electronic system where such information 
is stored in a secure electronic environment that identifies the stored 
information as CEII.
    (ii) Protection and Exemption from Disclosure. All information 
designated by DOE as CEII is exempt from FOIA and shall not be made 
available as provided in paragraph (f) of this section.
    (iii) Secure Storage. DOE will store information for which CEII 
treatment is requested in a secure place in a manner that would prevent 
unauthorized access (e.g. locked room or file cabinet). Information 
submitted to DOE in electronic format shall be stored in a secure 
electronic environment that identifies the stored information as CEII.
    (8) Protection of Confidential Business Information--Exemption 
Determination. DOE will evaluate information claimed as Confidential 
Business Information if, and at such time as, a valid FOIA request is 
submitted and the information is otherwise responsive to the request. 
DOE will conduct the evaluation pursuant to procedures set forth in 
this part. In its evaluation, DOE will consult any supplementary 
justification provided by the submitter as described at paragraph 
(f)(1)(iv) of this section.
    (h) Duration of designation. Designation of information as CEII 
shall be a five-year period, unless removed or re-designated.
    (1) Expiration of designation. (i) The Secretary or delegated DOE 
Office will determine the duration of designation at the time of 
designation.
    (ii) A submitter may re-apply for CEII designation no earlier than 
one year prior to the date of expiration of the initial designation or 
re-designation in accordance with the application procedures in 
paragraph (g)(1) of this section.
    (iii) The Secretary, the DOE CEII Coordinator, or a Coordinator's 
designee may initiate CEII designation at any time prior to the date of 
expiration of the initial designation or re-designation.
    (2) Removal of designation. The designation of information as CEII 
may be removed at any time, by the Secretary or the DOE CEII 
Coordinator in consultation with the DOE Office to which the Secretary 
has delegated the authority, in whole or in part, upon determination 
that the unauthorized disclosure of such information could no longer be 
used to impair the security or reliability of the bulk-power system or 
distribution facilities or any other form of energy infrastructure. If 
the CEII designation is to be removed, the submitter and the DOE Office 
that produced or maintains the CEII will receive electronic notice 
stating that the CEII designation will be removed at least nine (9) 
business days before disclosure. In such notice, the DOE CEII 
Coordinator or Coordinator's designee will provide the submitter and 
the DOE Office that produced or maintains the CEII an opportunity (at 
least nine (9) business days) in which to comment in writing prior to 
the removal of the designation. The final determination will briefly 
explain DOE's determination.
    (3) Treatment of information no longer designated as CEII. If a 
FOIA request is received for information for which CEII designation has 
expired or has been removed, DOE will work with the submitter to review 
whether the information is subject to other FOIA exemptions. DOE will 
destroy non-CEII consistent with the Federal Records Act, and DOE 
handling of agency records in accordance with DOE Order O.243.1A, 
Records Management Program, and related requirements and 
responsibilities for implementing and maintaining an efficient and 
economic records management program in accordance with law and 
regulatory requirements.
    (i) Review or requests for reconsideration of designation--(1) 
Request for Reconsideration. (i) Any person who has submitted 
information and requested such information to be designated as CEII may 
request reconsideration of a DOE decision not to designate that 
information as CEII, or to remove an existing CEII designation, on 
grounds that the information does not meet the required CEII criteria. 
Within ten (10) business days of notification by DOE of its CEII 
decision, the person must file a request for reconsideration. The 
request must be sent to the DOE CEII Coordinator and Coordinator's 
designee through a secure electronic submission or by mail according to 
the instructions at 10 CFR 205.12. The request must also be sent to the 
DOE Office that made the decision at issue and to DOE's Office of 
General Counsel in Washington, DC, according to the instructions at 10 
CFR 205.12. A statement in support of the request for reconsideration 
must be submitted within twenty (20) business days of the date of the 
determination. The request and the supporting statement will be 
considered submitted upon receipt by the Office of the General Counsel.
    (ii) Any person who has received a decision denying a request for 
the

[[Page 14771]]

release of CEII, in whole or in part, or a decision denying a request 
to change the designation of CEII, may request reconsideration of that 
decision. A statement in support of the request for reconsideration 
must be submitted to the DOE Office of the General Counsel within 
twenty (20) business days of the date of the determination.
    (iii) The Secretary or the DOE Office that made the decision at 
issue will make a determination, in coordination with the DOE CEII 
Coordinator or Coordinator's designee, with respect to any request for 
reconsideration within twenty (20) business days after the receipt of 
the request and will notify the person submitting the request of the 
determination and the availability of judicial review.
    (iv) Before seeking judicial review in Federal District Court under 
section 215A(d)(11) of the FPA, a person who received a determination 
from DOE concerning a CEII designation must first request 
reconsideration of that determination.
    (v) A request for reconsideration triggers a stay of the underlying 
decision, except in instances where voluntary sharing of the disputed 
information is necessary for law enforcement purposes, to ensure 
reliable operation or maintenance of electric or energy infrastructure, 
to maintain infrastructure security, to address potential threats, or 
to address an urgent need to disseminate the information quickly due to 
an emergency or other unforeseen circumstance.
    (j) Sharing of CEII--(1) Federal Entities. An employee of a Federal 
entity acting within the scope of his or her Federal employment may 
obtain CEII directly from DOE without following the procedures outlined 
in paragraph (k) of this section. DOE will evaluate requests by Federal 
entities for CEII on a programmatic, fact-specific basis. DOE may share 
CEII with affected agencies for those agencies to carry out their 
specific jurisdictional responsibilities, but it may impose additional 
restrictions on how the information may be used and maintained. To 
obtain access to CEII, an authorized agency employee must sign an 
acknowledgement and agreement that states the agency will protect the 
CEII in the same manner as the Department and will refer any requests 
for the information to the Department. Notice of each such request also 
must be given to the CEII Coordinator.
    (2) Non-federal Entities. The Secretary or the CEII Coordinator 
shall make a final determination whether to share CEII materials 
requested by non-federal entities that are within the categories 
specified in section 215A(d)(2)(D) of the FPA. A request by such a non-
federal entity shall not be entertained unless the requesting non-
federal entity demonstrates that the release of information is in the 
national security interest and it has entered into a Non-Disclosure 
Agreement with DOE that ensures, at a minimum:
    (i) Use of the information only for authorized purposes and by 
authorized recipients and under the conditions prescribed by the 
Secretary or CEII Coordinator;
    (ii) Protection of the information in a secure manner to prevent 
unauthorized access;
    (iii) Destruction or return of the information after the intended 
purposes of receiving the information have been fulfilled;
    (iv) Prevention of viewing or access by individuals or 
organizations that have been prohibited or restricted by the United 
States or the Department from viewing or accessing CEII;
    (v) Compliance with the provisions of the Non-Disclosure Agreement, 
subject to DOE audit;
    (vi) No further sharing of the information without DOE's 
permission; and
    (vii) CEII provided pursuant to the agreement is not subject to 
release under the Freedom of Information Act, 5 U.S.C. 552(b)(3), and 
shall not be made available by any Federal, state, political 
subdivision, or tribal authority pursuant to any Federal, State, 
political subdivision, or tribal law requiring public disclosure of 
information or records pursuant to sections 215A(d)(1)(A) and (B) of 
the Federal Power Act.
    (viii) The Non-Disclosure Agreement must state that the agreement 
applies to all subsequent releases of CEII during the calendar year in 
which the DOE and the non-federal entity enter into the agreement. As a 
result, the non-federal entity will not be required to file a Non-
Disclosure Agreement with subsequent requests during the calendar year.
    (3) Security and Reliability Coordination. In accordance with 
section 215A(d)(2)(D) of the FPA, DOE may, taking into account 
standards of the Electric Reliability Organization, facilitate 
voluntary sharing of CEII with, between, and by Federal, State, 
political subdivision, and tribal authorities; the Electric Reliability 
Organization; regional entities; information sharing and analysis 
centers or information sharing and analysis organizations; reliability 
coordinators; balancing authorities; owners, operators, and users of 
critical electric infrastructure in the United States; and other 
entities determined appropriate. All entities receiving CEII must 
execute either a Non-Disclosure Agreement or an Acknowledgement and 
Agreement or participate in an Electric Reliability Organization or 
Regional Entity information sharing program that ensures the protection 
of CEII. A copy of each agreement or program will be maintained by the 
DOE Office with a copy to the CEII Coordinator or the Coordinator's 
designee. If DOE facilitates voluntary sharing of CEII under this 
subsection, DOE may impose additional restrictions on how the 
information may be used and maintained.
    (4) International Sharing Protocols. The Secretary may delegate 
authority to DOE Offices to develop, after consultation with Canadian 
and Mexican authorities, protocols for the voluntary sharing of CEII 
with Canadian and Mexican authorities and owners, operators, and users 
of the bulk-power system outside the United States. The DOE CEII 
Coordinator or Coordinator's designee would provide assistance and 
advice to DOE Offices in the development of the international sharing 
protocols.
    (5) Notice for Sharing of CEII not Generated by DOE. The DOE CEII 
Coordinator or Coordinator's designee will provide electronic notice to 
the CEII submitter no less than ten (10) business days before DOE 
releases CEII submitted to and not generated by DOE, except in 
instances where voluntary sharing is necessary for law enforcement 
purposes, to ensure reliable operation or maintenance of electric or 
energy infrastructure, to maintain infrastructure security, or to 
address potential threats; where there is an urgent need to quickly 
disseminate the information; or where prior notice is not practicable 
due to an emergency or other unforeseen circumstance. If prior notice 
is not given, DOE will provide notice as soon as practicable. The DOE 
CEII Coordinator or Coordinator's designee will convene a phone call 
within five (5) business days of electronic notice with the CEII 
submitter to discuss concerns about the proposed release of CEII-
designated materials to the requester. DOE will make the final 
determination as to whether to share CEII not generated by DOE.
    (k) Procedures for requesting CEII. DOE shall consider requests for 
CEII on a case-by-case basis. Any person requesting CEII must include 
the following material with the request:
    (1) Contact Information. Provide your name, title and employer, 
work address, work phone number, and work email. If you are requesting 
the information on

[[Page 14772]]

behalf of a person or entity other than yourself, you must also list 
that person's or entity's work contact information, including name, 
title, address, phone number, and email.
    (2) Explanation of Need. Provide a detailed statement explaining 
the particular need for and intended use of the information. This 
statement must include:
    (i) The extent to which a particular function is dependent upon 
access to the information;
    (ii) Why the function cannot be achieved or performed without 
access to the information;
    (iii) An explanation of whether other information is available to 
the requester that could facilitate the same objective;
    (iv) How long the information will be needed;
    (v) Whether or not the information is needed to participate in a 
specific proceeding (with that proceeding identified); and
    (vi) An explanation of whether the information is needed 
expeditiously.
    (3) Signed Non-Disclosure Acknowledgement/Agreement. Provide an 
executed Non-Disclosure Acknowledgement (if the requester is a Federal 
entity) or an executed Non-Disclosure Agreement (if the requester is 
not a Federal entity) requiring adherence to limitations on the use and 
disclosure of the information requested.
    (4) DOE evaluation. Upon receiving a request for CEII, the CEII 
Coordinator shall contact the DOE Office or Federal agency that created 
or maintains the CEII. In consultation with the DOE Office, the CEII 
Coordinator shall carefully consider the statement of need provided by 
the requester and determine if the need for CEII and the protection 
afforded to the CEII should result in sharing CEII for the limited 
purpose identified in the request. If the CEII Coordinator or 
Coordinator's designee denies the request, the requestor may seek 
reconsideration, as provided in paragraph (i) of this section.
    (l) Disclosure--(1) Disclosure by submitter of information. If the 
submitter of information deliberately discloses to the public 
information that has received a CEII designation, then the Department 
reserves the right to remove its CEII designation.
    (2) Disciplinary Action for Unauthorized Disclosure. DOE employees 
or contractors who knowingly or willfully disclose CEII in an 
unauthorized manner will be subject to appropriate sanctions, including 
disciplinary action under DOE or DOE Office personnel rules or referral 
to the DOE Inspector General. Any action by a Federal or non-federal 
Entity who knowingly or willfully falsifies, conceals, or covers up by 
any trick, scheme, or device a material fact; makes any materially 
false, fictitious, or fraudulent statement or representation; or makes 
or uses any false writing or document knowing the same to contain any 
materially false, fictitious, or fraudulent statement or entry to 
obtain CEII may also constitute a violation of other applicable laws 
and is potentially punishable by fine and imprisonment.
    (3) Whistleblower protection. In accordance with the Whistleblower 
Protection Enhancement Act of 2012 (Pub. L. 112-199, 126 Stat. 1465), 
the provisions of this rule are consistent with and do not supersede, 
conflict with, or otherwise alter the employee obligations, rights, or 
liabilities created by existing statute relating to:
    (i) Classified information;
    (ii) Communications to Congress;
    (iii) The reporting to an Inspector General of a violation of any 
law, rule, or regulation, or mismanagement, a gross waste of funds, an 
abuse of authority, or a substantial and specific danger to public 
health or safety; or
    (iv) Any other whistleblower protection. The definitions, 
requirements, obligations, rights, sanctions, and liabilities created 
by controlling statutory provisions are not affected by this rule.

[FR Doc. 2020-04640 Filed 3-13-20; 8:45 am]
 BILLING CODE 6450-01-P