[Federal Register Volume 81, Number 245 (Wednesday, December 21, 2016)]
[Rules and Regulations]
[Pages 93732-93753]
[FR Doc No: 2016-28322]

Vol. 81

Wednesday,

No. 245

December 21, 2016

Part II

Department of Energy

-----------------------------------------------------------------------

Federal Energy Regulatory Commission

-----------------------------------------------------------------------

18 CFR Parts 375 and 388

Regulations Implementing FAST Act Section 61003--Critical Electric
Infrastructure Security and Amending Critical Energy Infrastructure
Information; Availability of Certain North American Electric
Reliability Corporation Databases to the Commission; Final Rule

Federal Register / Vol. 81 , No. 245 / Wednesday, December 21, 2016 /
Rules and Regulations

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

18 CFR Parts 375 and 388

[Docket Nos. RM16-15-000 and RM15-25-001; Order No. 833]

Regulations Implementing FAST Act Section 61003--Critical
Electric Infrastructure Security and Amending Critical Energy
Infrastructure Information; Availability of Certain North American
Electric Reliability Corporation Databases to the Commission

AGENCY: Federal Energy Regulatory Commission, Department of Energy.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Energy Regulatory Commission (Commission) amends
its regulations to implement provisions of the Fixing America's Surface
Transportation Act that pertain to the designation, protection and
sharing of Critical Electric Infrastructure Information. Additionally,
the Commission amends its regulations addressing Critical Energy
Infrastructure Information.

DATES: This rule will become effective February 21, 2017.

FOR FURTHER INFORMATION CONTACT:
Nneka Frye, Office of the General Counsel, Federal Energy Regulatory
Commission, 888 First Street NE., Washington, DC 20426,<PHONE_NUMBER>,
<EMAIL_ADDRESS>
Christopher MacFarlane, Office of the General Counsel, Federal Energy
Regulatory Commission, 888 First Street NE., Washington, DC 20426,
(202) 502-6761<EMAIL_ADDRESS>
Mark Hershfield, Office of the General Counsel, Federal Energy
Regulatory Commission, 888 First Street NE., Washington, DC 20426,
(202) 502-8597<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:
    1. The Commission amends 18 CFR 375.309, 375.313, 388.112 and
388.113 of its regulations to implement the requirements of the Fixing
America's Surface Transportation (FAST) Act as set forth in section
215A(d)(2) of the Federal Power Act (FPA).\1\ The Commission also
amends its existing Critical Energy Infrastructure Information
procedures. These changes are intended to comply with the FAST Act as
well as improve the overall efficiency of the Commission's procedures
for certain infrastructure information that is submitted to, or
generated by, the Commission. The amended procedures will be referred
to as the Critical Energy/Electric Infrastructure Information (CEII)
procedures.
---------------------------------------------------------------------------

    \1\ Fixing America's Surface Transportation Act, Public Law 114-
94, 61,003, 129 Stat. 1312, 1773-1779 (2015) (to be codified at 16
U.S.C. 824 et seq.) (FAST Act).
---------------------------------------------------------------------------

I. Background

A. Critical Energy Infrastructure Information Regulations

    2. Shortly after September 11, 2001, the Commission took steps to
protect information that it considered Critical Energy Infrastructure
Information.\2\ As a preliminary step, the Commission removed documents
from its public files and eLibrary database that were likely to contain
detailed specifications about critical infrastructure. The Commission
directed the public to use the Freedom of Information Act (FOIA)
request process to obtain such information.\3\ Given that such
information would typically be exempt from mandatory disclosure
pursuant to FOIA, the Commission determined that it was important to
have a process for individuals with a valid or legitimate need to
access certain sensitive energy infrastructure information. Thus, in
2003, the Commission issued a final rule establishing Critical Energy
Infrastructure Information regulations.\4\
---------------------------------------------------------------------------

    \2\ See Statement of Policy on Treatment of Previously Public
Documents, 97 FERC ] 61,030 (2001).
    \3\ 5 U.S.C. 552 as amended by the FOIA Improvement Act of 2016,
Public Law 114-185, 130 Stat. 538 (2016); 18 CFR 388.108 (Requests
for Commission records not available through the Public Reference
Room (FOIA Requests)).
    \4\ Critical Energy Infrastructure Information, Order No. 630,
FERC Stats. & Regs. ] 31,140, order on reh'g, Order No. 630-A, FERC
Stats. & Regs. ] 31,147 (2003).
---------------------------------------------------------------------------

    3. Each year, over 7,000 documents are submitted to the
Commission's eLibrary system as Critical Energy Infrastructure
Information. The Commission also receives approximately 200 requests
for Critical Energy Infrastructure Information each year. Requests for
Critical Energy Infrastructure Information are submitted by, among
others, public utilities, gas pipelines, Liquefied Natural Gas (LNG)
facilities, hydroelectric developers, academics, landowners, public
interest groups, researchers, renewable energy organizations,
consultants, and federal agencies.
    4. The Commission's current Critical Energy Infrastructure
Information process is designed to limit the distribution of sensitive
infrastructure information to those individuals with a need to know in
order to avoid having sensitive information fall into the hands of
those who may use it to attack the Nation's infrastructure.

B. FAST Act

    5. On December 4, 2015, the President signed the FAST Act into law.
The FAST Act, inter alia, added section 215A to the Federal Power Act
to improve the security and resilience of energy infrastructure in the
face of emergencies. The FAST Act directs the Commission to issue
regulations aimed at securing and sharing sensitive infrastructure
information. Specifically, FPA section 215A(d)(2) (Designation and
Sharing of Critical Electric Infrastructure Information) requires the
Commission to promulgate regulations on the following. First, the
statute requires the Commission to establish criteria and procedures to
designate information as critical electric infrastructure information.
Second, the statute requires the Commission to prohibit the
unauthorized disclosure of critical electric infrastructure
information. Third, the statute requires the Commission to ensure there
are appropriate sanctions in place for Commissioners, officers,
employees, or agents of the Commission or the Department of Energy
[DOE] who knowingly and willfully disclose critical electric
infrastructure information in a manner that is not authorized by the
statute. Fourth, FPA section 215A(d)(2)(D) requires the Commission,
taking into account standards of the Electric Reliability Organization,
to facilitate voluntary sharing of critical electric infrastructure
information. The statute, specifically, directs the Commission to
facilitate voluntary sharing with, between, and by Federal, State,
political subdivision, and tribal authorities; the Electric Reliability
Organization; regional entities; information sharing and analysis
centers established pursuant to Presidential Decision Directive 63;
owners, operators, and users of critical electric infrastructure in the
United States; and other entities determined appropriate by the
Commission.\5\
---------------------------------------------------------------------------

    \5\ FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312,
1776.
---------------------------------------------------------------------------

C. Notice of Proposed Rulemaking

    6. On June 16, 2016, the Commission issued a Notice of Proposed
Rulemaking (NOPR) to amend its regulations to implement the provisions
of the FAST Act pertaining to the designation, protection and sharing
of CEII.\6\ The

proposed amendments included, among other things, the creation of
criteria and procedures for designating information as CEII; a specific
prohibition on unauthorized disclosure of that information; sanctions
for knowing and willful wrongful disclosure of CEII by certain federal
personnel; a process for voluntary sharing of CEII; and changes to the
existing process for requesting CEII. In response to the NOPR, nineteen
entities filed comments and two entities filed reply comments. The
Appendix to this Final Rule lists the entities that submitted comments
in response to the NOPR.
---------------------------------------------------------------------------

    \6\ Regulations Implementing FAST Act Section 61003--Critical
Infrastructure Security and Amending Critical Energy Information, 81
FR 43,557 (July 5, 2016), 155 FERC ] 61,278 (2016) (NOPR).
---------------------------------------------------------------------------

II. Discussion

    7. The Commission adopts the majority of amendments proposed in the
NOPR. The Commission determines that the amendments comply with the
requirements of the FAST Act and better ensure the secure treatment of
CEII. In addition, as discussed below, the Commission modifies or
otherwise clarifies certain proposals made in the NOPR based on our
review of the comments. In the discussion below, we address the
following issues regarding the CEII amendments: (A) Scope, purpose, and
definitions; (B) criteria and procedures for determining what
constitutes CEII; (C) duty to protect CEII; (D) sanctions for
unauthorized disclosure of CEII; (E) voluntary sharing of CEII; and (F)
requests for access to CEII.

A. Scope, Purpose, and Definitions

NOPR
    8. In the NOPR, the Commission proposed to amend section 388.113 to
include procedures for submitting, designating, handling, sharing and
disseminating Critical Electric Infrastructure Information submitted to
or generated by the Commission.\7\ The Commission proposed to define
the term ``Critical Electric Infrastructure Information'' \8\ to
include ``Critical Energy Infrastructure Information'' as defined under
the Commission's current regulations and to refer to both types of
information, collectively, as CEII.\9\ The Commission also proposed to
delete references to CEII in section 388.112 so that section 388.112
would only address privileged material and all procedures regarding
CEII would be in section 388.113.
---------------------------------------------------------------------------

    \7\ NOPR, 155 FERC ] 61,278 at P 10.
    \8\ Id. P 11 (noting that Section 215A(a)(3) of the FAST Act
defines Critical Electric Infrastructure Information to include
information that qualifies as critical energy infrastructure
information under the Commission's regulations).
    \9\ NOPR, 155 FERC ] 61,278 at P 13.
---------------------------------------------------------------------------

Comments
    9. APPA and MISO maintain that CEII should not include all Critical
Energy Infrastructure Information.\10\ APPA contends that Congress
intended for the Commission to develop a separate process for Critical
Electric Infrastructure Information regarding the bulk-power system and
that the amended regulations fall ``short'' of Congress's intent under
the FAST Act because the amended regulations include the voluntary
disclosure provisions found in the Commission's current
regulations.\11\ APPA also asserts that the proposed definition of
``critical electric infrastructure'' ``does not comport well'' with
section 215A(d)(10) of the FPA, which provides DOE and the Commission
with the authority to remove the CEII designation from information
regarding the bulk-power system or distribution facilities.\12\ MISO
contends that the Commission misinterpreted the definition of Critical
Electric Infrastructure Information and that not all ``Critical Energy
Infrastructure Information under the Commission's regulations is
included'' in the definition of Critical Electric Infrastructure
Information.\13\
---------------------------------------------------------------------------

    \10\ See APPA Comments at 5-11; MISO Comments at 5.
    \11\ APPA Comments at 5, 9, 13.
    \12\ Section 215A(d)(10) of the FPA provides that when ``the
Commission or the [DOE] Secretary, as appropriate, determines that
the unauthorized disclosure of such information could no longer be
used to impair the security or reliability of the bulk-power system
or distribution facilities'' the designation shall be removed.
    \13\ MISO Comments at 4-6.
---------------------------------------------------------------------------

    10. TAPS and APPA maintain that the Commission should revise the
CEII definition to include additional language from the FAST Act.
Specifically, TAPS and APPA recommend that the proposed definition of
CEII incorporate section 215A(d)(1)(B), which provides that CEII
``shall not be made available by any Federal, State, political
subdivision or tribal authority pursuant to any Federal, State,
political subdivision or tribal law requiring public disclosure of
information or records.'' \14\ APPA requests that, if the Commission
includes Critical Energy Infrastructure Information in CEII, then the
Commission should interpret section 215A(d)(1)(B) to apply to all forms
of CEII, including Critical Energy Infrastructure Information.\15\ TAPS
and APPA also request that the Commission define the term ``political
subdivision,'' as used in section 215A(d)(1)(B), to have the same
meaning as the term ``political subdivision'' in section 201(f) of the
FPA, such that the term in section 215A(d)(1)(B) would include any
agency, authority or instrumentality of any political subdivision or
owned by a political subdivision.\16\ TAPS and APPA contend that,
absent the clarification, these additional entities may not be
considered a ``political subdivision'' under State laws.\17\
---------------------------------------------------------------------------

    \14\ TAPS Comments at 8; APPA Comments at 21-22.
    \15\ APPA Comments at 23.
    \16\ TAPS Comments at 8; APPA Comments at 22 (citing Section
201(f), which indicates that provisions of that subchapter are not
applicable to, among others, the United States, a State or any
political subdivision of a State, certain electric cooperatives or
any agency, authority, or instrumentality of any one or more of
those entities or any corporation wholly owned, directly or
indirectly, by any one or more of those entities).
    16 U.S.C. 824(f)
    \17\ TAPS Comments at 8-9; APPA Comments at 22-23.
---------------------------------------------------------------------------

    11. TAPS recommends that the Commission delete from the definition
of Critical Energy Infrastructure Information the requirement that such
information be exempt from FOIA.\18\ TAPS contends that the existing
exemption clause is unnecessary because any materials will be exempt
from FOIA pursuant to section 215A(d)(1)(A).\19\
---------------------------------------------------------------------------

    \18\ TAPS Comments at 4-5.
    \19\ Id. at 4.
---------------------------------------------------------------------------

    12. Other commenters seek clarification on the scope of the CEII
definition. Specifically, the Trade Associations request that the
Commission clarify whether the name or location of an electric system,
asset, owner or operator could be protected under the proposed CEII
definition.\20\ NRECA, similarly, urges the Commission to clarify that
material considered Critical Energy Infrastructure Information, such as
electric generation, and non-bulk electric system transmission and
distribution facilities, would still qualify as CEII under the revised
definition in the amended regulations.\21\
---------------------------------------------------------------------------

    \20\ Trade Associations Comments at 16.
    \21\ NRECA Comments at 7.
---------------------------------------------------------------------------

    13. Powerex requests that the Commission specify whether the new
definition of CEII expands the scope of information currently defined
as Critical Energy Infrastructure Information.\22\ Powerex contends
that the scope of this proceeding should remain limited to CEII
regulations and procedures discussed in the NOPR and, thus, the scope
of this proceeding should not extend to other forms of sensitive
data.\23\ Powerex, further, explains that there

may be a tendency to over-designate information as CEII and, therefore,
the Commission should recognize that transparency is needed to balance
CEII protection against the due process rights of parties participating
in Commission proceedings.\24\
---------------------------------------------------------------------------

    \22\ Powerex Comments at 11.
    \23\ Id. at 15.
    \24\ Id. at 12.
---------------------------------------------------------------------------

    14. TAPS, APPA and the Trade Associations recommend revisions to
the CEII Non-Disclosure Agreements (NDA).\25\ Specifically, TAPS, APPA,
and the Trade Associations state that the Commission should expressly
incorporate the language from section 215A(d)(1)(B), exempting CEII
from public disclosure, into the NDA.\26\ TAPS requests that the
Commission eliminate the State Agency NDA. TAPS contends that ``[p]rior
to the FAST Act's express preemption of Sunshine Laws requiring
disclosure,'' the State Agency NDA was an attempt to impose a
contractual nondisclosure requirement for critical energy
infrastructure information provided to a State agency. TAPS maintains
that, once section 215A(d)(1)(B) is included in the general NDA, the
State Agency NDA should be eliminated because it is now
unnecessary.\27\
---------------------------------------------------------------------------

    \25\ APPA Comments at 23; TAPS Comments at 9-10; Trade
Associations Comments at 32.
    \26\ See id.
    \27\ TAPS Comments at 10; see also Critical Energy
Infrastructure Information State Agency Employee Non-Disclosure
Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/state-agen-nda.pdf.
---------------------------------------------------------------------------

    15. With respect to the proposed edits to sections 388.112 and
388.113 to separate the Commission's treatment of privileged material
from the Commission's treatment of CEII, MISO suggests that the title
for section 388.112 be changed to ``Submission and treatment of
privileged information'' and section 388.113 be changed to ``Submission
and treatment of Critical Electric Infrastructure Information (CEII).''
\28\
---------------------------------------------------------------------------

    \28\ MISO Comments at 3.
---------------------------------------------------------------------------

    16. The Trade Associations request that the Commission expressly
state in the amended regulations that the CEII process is not intended
to, and should not be interpreted to, supersede or otherwise affect
existing laws, regulations, and agency rules that separately safeguard
such data.\29\
---------------------------------------------------------------------------

    \29\ See Trade Associations Comments at 26.
---------------------------------------------------------------------------

Commission Determination
    17. As discussed below, the Commission, with limited modifications,
adopts the amendments proposed in the NOPR addressing the scope,
purpose and definitions in the CEII regulations. The Commission
determines that the amendments are consistent with the requirements of
the FAST Act and will result in more secure treatment of CEII.
    18. The Commission disagrees with APPA and MISO that the CEII
definition should not include Critical Energy Infrastructure
Information and that there should be separate processes for electric
and non-electric CEII. Our determination is based on the plain language
of the FAST Act. Section 215A(a)(3) defines Critical Electric
Infrastructure Information to ``include information that qualifies as
critical energy infrastructure information under the Commission's
regulations.'' \30\ In subsuming the Commission's existing Critical
Energy Infrastructure Information within section 215A's CEII
definition, Congress expressly stated that the definition of CEII
includes Critical Energy Infrastructure Information. There is no
indication in the language of the FAST Act that Congress intended to
limit the types of Critical Energy Infrastructure Information to only
electric infrastructure information.\31\
---------------------------------------------------------------------------

    \30\ FAST Act, Public Law 114-94, section 61,003, 129 Stat.
1312, 1776.
    \31\ For the same reason, we reject MISO's recommendation that
the title for section 388.112 should be changed to ``Submission and
treatment of privileged information'' and that the title for section
388.113 should be changed to ``Submission and treatment of Critical
Energy Infrastructure Information (CEII).'' MISO Comments at 3.
---------------------------------------------------------------------------

    19. Including Critical Energy Infrastructure Information within the
definition of CEII is not inconsistent with the provisions of section
215A(d)(10), as APPA maintains. First, section 215A(d)(10) states that
removal of a CEII designation may be appropriate when the disclosure of
such information ``could no longer be used to impair the security or
reliability of the bulk-power system or distribution facilities.''
(Emphasis supplied.) Thus, it is clear that Congress did not intend for
the new Critical Electric Infrastructure Information designation to
apply only to the bulk-power system. Second, Critical Energy
Infrastructure Information includes information that ``relates details
about the production, generation, transportation, transmission, or
distribution of energy.'' \32\ Such information, even if it concerns
non-electric infrastructure, could be used to impair the security or
reliability of the bulk-power system, for example by severing gas
pipeline connections to electric generation facilities.
---------------------------------------------------------------------------

    \32\ 18 CFR 388.113(c)(1)(i)).
---------------------------------------------------------------------------

    20. Moreover, the Commission determines that a single CEII process
for Critical Energy/Electric Infrastructure Information is the most
efficient way to fulfill the statutory mandate of the FAST Act and to
avoid any confusion that could result from different processes for
different types of critical infrastructure information.\33\ Absent
contrary language in the FAST Act, the Commission has discretion in how
it administers statutory mandates by regulation.\34\
---------------------------------------------------------------------------

    \33\ NOPR, 155 FERC ] 61,278 at P 14.
    \34\ See Anna Jacques Hosp. v. Burwell, 797 F.3d 1155, 1165
(D.C. Cir. 2015) (holding that ``interstitial question[s] of
implementation'' are left to the discretion of the implementing
agency).
---------------------------------------------------------------------------

    21. APPA's assertion that the Commission is ``falling short'' of
meeting Congress's intent is without merit. In the proposed
regulations, the Commission complies with each provision in section
215A(d)(2) with regard to designating and handling Critical Electric
Infrastructure Information. The fact that those rules also apply to
Critical Energy Infrastructure Information does not diminish the
Commission's compliance under the FAST Act. Rather, in this regard, the
Commission's determination meets Congress's intent. Moreover, APPA's
argument that ``information related to cyber threats and defensive
measures should not be `protected' under a designation regime that also
provides for potentially involuntary access by any federal employee . .
., landowners [or]any person who is a participant in a Commission
proceeding . . .'' and others has no basis in the text of the FAST Act.
APPA notably cites to nothing in the FAST Act to support that
argument.\35\ On the contrary, Congress explicitly directed the
Commission to include voluntary sharing in the regulations that the
Commission is required to promulgate under the FAST Act.\36\ Further,
the implication of APPA's argument--that cyber information is different
from other types of infrastructure information and therefore warrants
different rules--fails to take into consideration that the Commission
will evaluate each request for CEII, and each decision to voluntarily
share CEII, on a case-by-case basis. For example, a person seeking
cyber threat information would have to show a different need for the
information than a person seeking information for a pipeline facility
for a certificate proceeding.
---------------------------------------------------------------------------

    \35\ See APPA Comments at 15.
    \36\ Section 215A(d)(2)(D) states that the Commission ``shall
promulgate such regulations as necessary to . . . facilitate
voluntary sharing of critical electric infrastructure information .
. .'' FAST Act, Public Law 114-94, section 61,003, 129 Stat. 1312,
1776.
---------------------------------------------------------------------------

    22. The Commission agrees with TAPS and APPA that the Commission's
regulations should incorporate the

provision in section 215A(d)(1)(B) that CEII ``shall not be made
available by any Federal, State, political subdivision or tribal
authority pursuant to any Federal, State, political subdivision or
tribal law requiring public disclosure of information or records.''
\37\ As to TAPS's and APPA's request that the Commission define the
term ``political subdivision,'' in section 215A(d)(1)(B) of the FAST
Act to be consistent with the definition of that term in FPA section
201(f), Congress did not adopt the definition of ``political
subdivision'' in section 201(f) for the purposes of the FAST Act.
However, the Commission believes that the broad language of section
215A(d)(1)(B), as it applies to ``any Federal, State, political
subdivision or tribal authority,'' should encompass the
instrumentalities and components of States. Section 215A(d)(1)(B) was
included to protect CEII from mandatory disclosure. It would be
illogical to provide such protection to States, but not their
instrumentalities and components.
---------------------------------------------------------------------------

    \37\ APPA states that there may be instances where an entity
could provide CEII to NERC who, in turn, may submit that entity's
information to the Commission or DOE as CEII without notifying the
entity. Thus, APPA is concerned the entity may not be aware that the
information has been submitted to the Commission and designated as
CEII. As a result, APPA suggests that the Commission establish
notification procedures so that entities are aware that their
information was designated as CEII. APPA Comments at 21-22. We see
no need to adopt such a notification process. Section 1505 of NERC's
Rules of Procedure already requires NERC, unless otherwise directed
by the Commission or its staff, to notify submitting entities of
requests made by the Commission to NERC for the submitting entities'
information.
---------------------------------------------------------------------------

    23. The Commission disagrees with TAPS that the Commission should
delete from the definition of Critical Energy Infrastructure
Information the provision that states that Critical Energy
Infrastructure Information ``[i]s exempt from mandatory disclosure
under the Freedom of Information Act, 5 U.S.C. 552.'' \38\ As we have
discussed above, Congress incorporated Critical Energy Infrastructure
Information within section 215A's definition of Critical Electric
Infrastructure Information without revision.\39\ Accordingly, the
Commission will retain its current definition of Critical Energy
Infrastructure Information.
---------------------------------------------------------------------------

    \38\ 18 CFR 388.113(c)(2)(iii).
    \39\ See Stone v. INS, 514 U.S. 386, 397 (1995) (holding that
``[w]hen Congress acts to amend a statute, we presume it intends its
amendment to have real and substantial effect'').
---------------------------------------------------------------------------

    24. In response to the Trade Associations' comments seeking
clarification if a name or location of a facility should be protected
as CEII, the Commission's current practice is that information that
``simply give[s] the general location of the critical infrastructure''
or simply provides the name of the facility is not CEII.\40\ However,
under certain circumstances, information regarding the location of
infrastructure or its name that is not already publicly known could be
CEII.\41\ Therefore, we clarify that, while as a general matter the
location or name of infrastructure is not CEII, a submitter of
information to the Commission may ask that non-public information about
the location, or the name, of critical infrastructure be treated as
CEII. The submitter would have to provide a justification for the
request and explain why the information is not already publicly known.
---------------------------------------------------------------------------

    \40\ 18 CFR 388.113(c)(1)(iv).
    \41\ For example, the location of an operating transformer is
likely publicly known. However, the location of a spare transformer
housed in a central location may not be publicly known and,
therefore, may qualify as CEII.
---------------------------------------------------------------------------

    25. In response to NRECA's request that the Commission clarify that
material treated as Critical Energy Infrastructure Information under
the Commission's current regulations would, in most circumstances, be
treated as CEII under the amended regulations, we note that such
information should continue to qualify as CEII. We also note, however,
in response to Powerex's comment, that it is conceivable that Critical
Electric Infrastructure Information may include information that would
not fall within the existing definition of Critical Energy
Infrastructure Information.\42\
---------------------------------------------------------------------------

    \42\ For example, while Critical Energy Infrastructure
Information must satisfy the four-part definition in amended section
388.113(c)(1), Critical Electric Infrastructure Information must
meet the definition in amended section 388.113(c)(2).
---------------------------------------------------------------------------

    26. We agree with Powerex's comment that the Final Rule should only
address CEII and not other types of information. In response to
Powerex's concerns about a party's due process rights, under the
amended CEII regulations the Commission will balance the need to
protect critical information with the potential need of parties
participating in Commission proceedings to access CEII. For example,
the Commission's regulations include a process for parties to access
information directly from other parties in a Commission proceeding.\43\
---------------------------------------------------------------------------

    \43\ See 18 CFR 388.112(b)(2) and 388.113(g)(4).
---------------------------------------------------------------------------

    27. In response to comments from TAPS, APPA, and the Trade
Associations, the Commission agrees that the CEII NDA should reference
the provision in section 215A(d)(1) that CEII is exempt from disclosure
under any Federal, State, political subdivision or tribal law requiring
public disclosure. We disagree that the State Agency NDA should be
eliminated because it reinforces the minimum protections applicable to
CEII that the Commission may provide to states as well as provides for
additional protections beyond the exemptions in State public disclosure
laws.\44\
---------------------------------------------------------------------------

    \44\ See supra note 27.
---------------------------------------------------------------------------

    28. Finally, the Commission declines to adopt the revision
suggested by the Trade Associations to expressly state that the CEII
regulations are not intended to supersede other laws, regulations, and
agency rules that separately safeguard such data.\45\ This Final Rule
and adopted CEII amendments do not purport to supersede any other legal
authorities other than the regulations and associated materials
specifically amended in this Final Rule.
---------------------------------------------------------------------------

    \45\ See Trade Associations Comments at 26.
---------------------------------------------------------------------------

B. Criteria and Procedures for Determining What Constitutes CEII

1. General Criteria and Procedures
NOPR
    29. Section 215A(d)(2)(A) requires the Commission to ``establish
criteria and procedures to designate information as critical electric
infrastructure information.'' In the NOPR, the Commission proposed
criteria and procedures for the handling of CEII consistent with
section 215A(d)(2)(A).\46\
---------------------------------------------------------------------------

    \46\ NOPR, 155 FERC ] 61,278 at P 16.
---------------------------------------------------------------------------

Comments
    30. Commenters request that the Commission provide more detail on
what qualifies as CEII.\47\ The Public Interest Organizations, for
example, ask the Commission to publish guidelines and criteria for
designating information as CEII.\48\ The Public Interest Organizations
further recommend that the Commission publish ``data tables that
provide suggested classifications for common data types.'' \49\ HRC
asks that the Commission require entities filing CEII to include a
public cover letter providing a description of the facility the
information relates to and describing the nature of the submission. HRC
also contends that information submitted as CEII should include a more
detailed description in eLibrary.\50\ HRC contends that this
information will better allow the public to understand the basis for

the CEII classification.\51\ HRC also requests that the Commission
develop a procedure whereby the public can request that the Commission
review information at the time of submission to ensure that it was
properly submitted as CEII.\52\ HRC contends that filing a CEII or FOIA
request as a means of triggering the review of CEII classification is
burdensome.\53\
---------------------------------------------------------------------------

    \47\ Peak Comments at 8-10; Powerex Comments at 12; APS Comments
at 5; APPA Comments at 17; WIRAB Comments at 5.
    \48\ Public Interest Organizations Comments at 4.
    \49\ Id. at 5.
    \50\ HRC Comments at 2-3.
    \51\ Id. at 2.
    \52\ Id. at 3.
    \53\ Id.
---------------------------------------------------------------------------

    31. WIRAB and APS commented that additional designation guidance is
needed in order to avoid submitters' over-designation of documents as
CEII. Specifically, WIRAB and APS recommend that the Commission
establish separate criteria for determining when information qualifies
as CEII on the basis of national security, economic security or public
health or safety.\54\
---------------------------------------------------------------------------

    \54\ WIRAB Comments at 5; APS Comments at 5.
---------------------------------------------------------------------------

    32. The Trade Associations maintain that the Commission's
regulations should explicitly designate as CEII information ``related
to compliance with the Reliability Standards as critical electric
infrastructure information and exempt it from disclosure under
388.113(f).'' \55\ The Trade Associations assert that a blanket
presumption that information regarding Reliability Standards compliance
is CEII is necessary because it ``may . . . be difficult for a
submitter to present, ex ante, a clear justification for meeting the
critical electric infrastructure information definition for a
particular system or asset, especially if the potential for negative
effect could also arise from the disclosure of a combination of sets of
information that alone may not meet the CEII definition.''\56\
---------------------------------------------------------------------------

    \55\ Trade Associations Comments at 12.
    \56\ Id. at 11.
---------------------------------------------------------------------------

    33. APPA and the Trade Associations raise concerns about how the
designation criteria will apply to DOE.\57\ Specifically, they assert
that the Commission failed to provide criteria and procedures that
would apply to DOE.\58\ Additionally, Peak, Public Interest
Organizations, and APPA request that the Commission hold a technical
conference on the implementation of the new CEII rules as part of the
``consultation with the Secretary'' required by FPA section
215A(d)(2).\59\
---------------------------------------------------------------------------

    \57\ APPA Comments at 24-25; Trade Associations Comments at 23.
    \58\ Id.
    \59\ Peak Comments at 6-7; Public Interest Organizations
Comments at 5; APPA Comments at 25. WIRAB also requests a technical
conference to discuss implementation of the FAST Act. WIRAB Comments
at 11.
---------------------------------------------------------------------------

    34. Finally, NRC requests that the Commission establish a generic
CEII designation that other federal agencies can use to designate
information.\60\ NRC also recommends that the Commission clarify in the
Final Rule that other federal agencies ``are to establish their own
procedures for identifying CEII on an information-specific basis
utilizing the FERC's generic CEII standard.'' \61\
---------------------------------------------------------------------------

    \60\ NRC Comments at 1-2.
    \61\ Id. at 2.
---------------------------------------------------------------------------

Commission Determination
    35. The Commission is not persuaded that more detailed guidance or
additional designation criteria in the CEII regulations are necessary.
FPA section 215A(a)(2) defines Critical Electric Infrastructure as ``a
system or asset of the bulk-power system, whether physical or virtual,
the incapacity or destruction of which would negatively affect national
security, economic security, public health or safety, or any
combination of such matters.'' FPA section 215A(a)(3) includes Critical
Energy Infrastructure Information within CEII. We believe that the
regulations, as proposed, provide adequate guidance for a submitter or
Commission staff to determine whether information is CEII and for the
CEII Coordinator to make a determination. In addition, the criteria and
designation procedures adopted herein are informed by the Commission's
experience of implementing and administering the Critical Energy
Infrastructure Information regulations over the past fifteen years.
    36. The Commission does not agree that the scope of CEII should be
modified, as suggested by the Trade Associations, to encompass
information ``related to compliance with the Reliability Standards.''
The Trade Associations' proposal is unduly broad and inconsistent with
the FAST Act because it could lead to all infrastructure information,
whether critical or not, being treated as CEII. For the same reason, we
do not agree that the blanket presumption that information relating to
compliance with Reliability Standards is CEII, proposed by the Trade
Associations, is appropriate. Like other forms of CEII, however,
information on compliance with Reliability Standards may be treated as
CEII if the submitter justifies its treatment as CEII under the
Commission's regulations.
    37. In response to HRC's comments that documents listed as CEII
could be better described in eLibrary, the level of detail needed for a
document description in eLibrary is better addressed in our submission
guidelines rather than in our regulations.\62\
---------------------------------------------------------------------------

    \62\ See CEII Filing Guide, https://www.ferc.gov/resources/guides/filing-guide/file-ceii/ceii-guidelines.asp. The Commission
will update the CEII Filing Guide when the proposed regulations
become effective.
---------------------------------------------------------------------------

    38. In response to HRC's request for an additional process to
obtain a ruling on CEII when it is filed, we believe that such a
process is unnecessary, as entities seeking access to information filed
as CEII may submit a FOIA or CEII request at any time, including
promptly after that information is filed with the Commission. We
further conclude that the proposed procedures are adequate for the
Commission to process information submitted to the Commission, or
generated by the Commission, as CEII.\63\ As previously noted, the
Commission receives over 7,000 CEII submissions a year; reviewing the
information at the time of submission, in the absence of a specific
request for that information, would be overly burdensome on the
Commission's resources. In response to a CEII request, the CEII
Coordinator will review the information to determine whether to
designate it as CEII. Further, proposed section 388.113(d)(1)(iv)
specifically states that the Commission retains the right to make
determinations with regard to any claim of CEII status, at any time.
---------------------------------------------------------------------------

    \63\ See amended sections 388.113(c) and (d).
---------------------------------------------------------------------------

    39. In response to the comments from APPA and the Trade
Associations, the Commission declines to revise the regulations to
identify specific designation criteria and CEII procedures for DOE.
Section 215A(d)(3) of the FAST Act provides that information ``may be
designated'' by the Commission and DOE pursuant to the criteria and
procedures that the Commission establishes.\64\ The FAST Act, however,
does not compel DOE to make any changes to its regulations in this
regard, and as noted in the NOPR, nothing within the Commission's
regulations would limit DOE's ability to designate CEII in accordance
with the FAST Act.\65\ Furthermore, we do not believe a technical
conference is necessary to satisfy the requirement for consultation
with DOE in the FAST Act.
---------------------------------------------------------------------------

    \64\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312,
1776.
    \65\ NOPR, 155 FERC ] 61,278 at P 16 n.12.
---------------------------------------------------------------------------

    40. Although the Commission recognizes that other agencies have an
obligation to protect certain information in their custody, the FAST
Act does not grant other federal agencies the authority to designate
information as

CEII. Critical Electric Infrastructure Information is specifically
defined as information ``designated as critical electric infrastructure
information by the Commission or the Secretary of the Department of
Energy pursuant to subsection (d).'' \66\ Congress's intent to limit
the designation authority to the Commission and DOE is reinforced by
the fact that only the staff of the Commission and DOE are subject to
sanctions for unauthorized release under section 215A(d)(2)(C).\67\
However, because NRC has raised valid concerns about the protection of
sensitive information of the electric grid in its custody, the
Commission revises the amended scope of section 388.113 to state that
nothing in this section limits any other Federal agency's ability to
take all necessary steps to protect information within its custody or
control that is necessary to ensure the safety and security of the
electric grid. Further, the section is revised to state that, to the
extent necessary, such agency may consult with the CEII Coordinator
regarding the treatment or designation of such information (see the
last two sentences of paragraph (a) in the regulatory text of section
388.113 in this rule). Nothing in this section limits the ability of
any other Federal agency to take all necessary steps to protect
information within its custody or control that is necessary to ensure
the safety and security of the electric grid. To the extent necessary,
such agency may consult with the CEII Coordinator regarding the
treatment or designation of such information.
---------------------------------------------------------------------------

    \66\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312,
1776.
    \67\ Id.
---------------------------------------------------------------------------

    41. By this change, the Commission does not limit the discretion of
other federal agencies to protect sensitive information in their
custody but provides a mechanism for agencies to consult with the
Commission's CEII Coordinator regarding the treatment or designation of
such information as CEII.\68\ We believe this change strikes a
reasonable balance by recognizing other federal agencies' discretion to
protect their information, while adhering to the statutory framework
that limits CEII designation authority to the Commission and DOE.
---------------------------------------------------------------------------

    \68\ For example, the Commission could establish the parameters
of the Commission's role with regard to CEII with another federal
agency through a Memorandum of Understanding with that agency.
---------------------------------------------------------------------------

2. Designation of Submissions to the Commission
NOPR
    42. The Commission proposed to treat information submitted with a
justification for CEII treatment as CEII, unless the submitter is
otherwise notified by the Commission.\69\
---------------------------------------------------------------------------

    \69\ NOPR, 155 FERC ] 61,278 at P 19.
---------------------------------------------------------------------------

Comments
    43. APS asks that the Commission ``deem'' information as CEII at
the time an entity submits the information to the Commission.\70\ HRC
and Tacoma Power are concerned that ``treating'' a submission as CEII
is not a designation and, as a result, submitting entities may not be
able to assert the FOIA exemption when faced with a records request
unless and until the Commission makes a CEII designation
determination.\71\ Tacoma Power further requests that the Commission
develop a process for state entities to receive a CEII designation
determination so that state entities may assert any FOIA exemption with
certainty.\72\
---------------------------------------------------------------------------

    \70\ APS Comments at 6.
    \71\ HRC Comments at 2; Tacoma Power Comments at 4.
    \72\ Tacoma Power Comments at 4.
---------------------------------------------------------------------------

    44. INGAA, NERC, and the Trade Associations request that the
Commission change the comment period afforded to submitters of CEII to
respond to a request for CEII from five calendar days to five business
days, ten working days, or at least 30 calendar days, respectively.\73\
APS and CEA comment that if the Commission determines that particular
information is not CEII, the Commission should provide the submitter
with an explanation of why the information does not meet the criteria
for designation as CEII.\74\ The Trade Associations also request that
the Commission provide a more detailed explanation in instances when
CEII is released over an objection from the submitter of the
material.\75\
---------------------------------------------------------------------------

    \73\ INGAA Comments at 4; NERC Comments at 15; Trade
Associations Comments at 19.
    \74\ APS Comments at 6; CEA Comments at 6-7.
    \75\ Trade Associations Comments at 19-20.
---------------------------------------------------------------------------

    45. MISO, Trade Associations, CEA, and HRC submitted comments
recommending changes to the Commission's processing and evaluation of
justification statements that must accompany a submitter's request for
CEII treatment. MISO is concerned that the Commission may automatically
make information public if the submission fails to meet the
Commission's regulations. Thus, MISO recommends that amended section
388.113(d)(1) be revised to make clear that failure to provide the
justification or other required information will be considered in the
determination of whether the information will be maintained as CEII by
the Commission, but it will not result in automatic disclosure of the
information.\76\
---------------------------------------------------------------------------

    \76\ MISO Comments at 7.
---------------------------------------------------------------------------

    46. The Trade Associations maintain information submitted to the
Commission for designation as CEII that ultimately is determined not to
be CEII should not automatically be disclosed to the public because
such information may be subject to other laws and regulations
restricting disclosure of the information.\77\
---------------------------------------------------------------------------

    \77\ Trade Associations Comments at 25-26.
---------------------------------------------------------------------------

    47. CEA recommends that the Commission provide the submitter with
an opportunity to retract a submission and re-submit it with the
appropriate justification.\78\
---------------------------------------------------------------------------

    \78\ CEA Comments at 6-7.
---------------------------------------------------------------------------

Commission Determination
    48. As an initial matter, we correct the statement in the NOPR
erroneously stating that under our current practice, ``the Commission
deems the designation on a submission accepted as submitted.'' \79\ Our
current practice is to treat information as CEII, and maintain it in
our non-public files, when it is submitted with a request for CEII
treatment. That practice is reflected in the current and proposed
regulations.\80\ Under the regulations adopted in this Final Rule
information that is submitted will not be designated CEII until the
CEII Coordinator makes such a determination.
---------------------------------------------------------------------------

    \79\ NOPR, 155 FERC ] 61,278 at P 19.
    \80\ See amended section 388.113(d)(1)(vi).
---------------------------------------------------------------------------

    49. As to the comments submitted by Tacoma Power, the Commission is
not persuaded that a special expedited process for designations in the
event a State entity is facing a public records request is needed,
because State and local entities may consult with the CEII Coordinator
as to whether information that is subject to a State, local, or other
type of records request is CEII under the Commission's regulations.\81\
---------------------------------------------------------------------------

    \81\ Section 215A(d)(1)(B) states that Critical Electric
Infrastructure Information ``shall not be made available by any
Federal, State, political subdivision or tribal authority pursuant
to any Federal, State, political subdivision or tribal law requiring
public disclosure of information or records.'' FAST Act, Pub. L.
114-94, section 61,003, 129 Stat. 1312, 1776.
---------------------------------------------------------------------------

    50. In response to the comments from APS and CEA about the
procedures for informing a submitter of a potential release or re-
designation of CEII, the Commission's current practices are sufficient
to comply with the FAST Act

and we maintain those practices under the adopted regulations. The
current practice is to provide notice to the submitter if a proposed
CEII designation will be rejected or if CEII will be released over an
objection. The notification will include an explanation as to why the
information does not meet the criteria and the submitter will have an
opportunity to comment or seek appropriate relief under amended section
388.113(e)(4).
    51. The Commission is not persuaded that it is necessary to make
the changes proposed by MISO and CEA regarding treatment of information
that is filed in a manner that does not meet our regulations. The
amended regulations do not mandate automatic disclosure of the
information. Furthermore, even if the Commission were to make
information public, the Commission will provide notice to the submitter
prior to any determination.\82\
---------------------------------------------------------------------------

    \82\ See amended sections 388.113(d)(1)(iv) and 388.113(e)(3)-
(4).
---------------------------------------------------------------------------

    52. The Commission adopts INGAA's proposal to change the comment
period from five calendar days to five business days, and will change
all references in section 388.113 from ``calendar'' days to
``business'' days. Allowing more time is not warranted because the
issue of whether to release CEII is relatively limited and, as a
general matter, the Commission endeavors to respond to requests for
CEII as soon as possible. In addition, the Commission notes that
submitters can request an extension of that time-period to submit
comments to the Commission.
3. Information Included in NERC Databases
NOPR
    53. The Commission proposed that information downloaded by
Commission staff from private databases that are accessed pursuant to
Commission order or regulation will be maintained as non-public
information consistent with the Commission's internal controls.\83\ The
Commission noted that in response to an information request, it will
evaluate whether the information is CEII, proprietary information, or
otherwise privileged or non-public and will provide the owner of the
database or information (as appropriate) with an opportunity to comment
on the request.\84\
---------------------------------------------------------------------------

    \83\ NOPR, 155 FERC ] 61,278 at P 17 n.13(citing Availability of
Certain North American Electric Reliability Corporation Databases to
the Commission, Order No. 824, 155 FERC ] 61,275 (2016)).
    \84\ Id.
---------------------------------------------------------------------------

Comments
    54. Most commenters support treating data downloaded from the NERC
databases as non-public. NERC agrees with the proposal to treat
information downloaded from its databases as non-public, but it seeks
clarification as to whether the Commission intends to designate the
information as privileged and CEII.\85\ TAPS requests that if the
Commission determines to release database information, the manager of
the database and the entity whose data would be released should receive
notice and an opportunity to comment.\86\
---------------------------------------------------------------------------

    \85\ NERC Comments at 19.
    \86\ TAPS Comments at 5-7.
---------------------------------------------------------------------------

    55. The Trade Associations recommend that the Commission treat the
NERC databases information that Commission staff does not download as
inextricably intertwined with downloaded information and thereby treat
all of the information on each database as CEII.\87\ TAPS raises
concerns that information that is contained in a database may not be
adequately protected from disclosure, because the data ``is not being
submitted to the Commission, but rather accessed by the Commission.''
\88\
---------------------------------------------------------------------------

    \87\ Trade Associations Comments at 15.
    \88\ TAPS Comments at 6.
---------------------------------------------------------------------------

    CEA requests that the Commission respect Canadian information that
may be accessed through any private databases accessible to the
Commission.\89\ CEA further comments that the Commission's information
gathering through other databases be restricted to U.S. facility
information only.\90\
---------------------------------------------------------------------------

    \89\ CEA Comments at 4.
    \90\ Id.
---------------------------------------------------------------------------

Commission Determination
    56. The Commission adopts the NOPR proposal to treat information
downloaded from NERC databases as non-public \91\ and to evaluate
whether it should be designated as CEII in response to a request for
the information or if the Commission determines such information should
be disclosed.\92\ In addition, because the CEII designation only
applies to information that is submitted to or generated by the
Commission, information that Commission staff accesses and reviews, but
never takes custody of, cannot be designated as CEII. Therefore, the
Commission disagrees with the proposal to treat all of the information
in an accessed database as inextricably intertwined CEII.\93\
---------------------------------------------------------------------------

    \91\ This is consistent with the statement in Order No. 824 that
the Commission ``will take appropriate steps, as provided for in our
governing statutes and regulations, in handling such information.''
Order No. 824, 152 FERC ] 61,208 at P 22.
    \92\ The discussion above and our determination address the
Trade Associations' request for clarification of Order No. 824 in
Docket No. RM15-25-001.
    \93\ By the same token, information that is not downloaded
cannot be disclosed under a FOIA request as the Commission would not
possess the information.
---------------------------------------------------------------------------

    57. The Commission clarifies that information downloaded by the
Commission or its staff from a non-public NERC database will be treated
as non-public information and will be afforded the same treatment as
CEII. Thus, in the event the Commission receives a request for the
information or the Commission determines such information should be
disclosed, the Commission will ``provide the owner of the database or
information (as appropriate) with an opportunity to comment on the
request.'' \94\ In response to TAPS's comments, we clarify that, where
practicable, we will notify the database owner and the information
owner.\95\
---------------------------------------------------------------------------

    \94\ NOPR, 155 FERC ] 61,278 at P 17 n.13.
    \95\ We note that section 1505 of NERC's Rules of Procedure
requires NERC, unless otherwise directed by the Commission or its
staff, to provide notice to submitting entities in response to
requests for the submitting entities' information by the Commission.
---------------------------------------------------------------------------

    58. Finally, as to CEA's comment regarding Canadian information on
other databases, we believe that CEA's request goes beyond the scope of
this rulemaking proceeding, which is limited to amending the
Commission's regulations regarding CEII.\96\
---------------------------------------------------------------------------

    \96\ The Commission has addressed the scope of information
covered by specific data collection requirements in individual
proceedings. For example, in Order No. 824, concerning Commission
access to certain NERC databases that include data about both U.S.
and Canadian facilities, the Commission revised its regulations to
indicate that ``Commission access will be limited to data regarding
U.S. facilities.'' Order No. 824, 155 FERC ] 61,275 at P 38.
---------------------------------------------------------------------------

4. Designation of Commission-Generated Information
NOPR
    59. For Commission-generated information, the NOPR explained that
the CEII Coordinator, after consultation with the appropriate
Commission Office Director, will determine whether the information
meets the definition of CEII.\97\ The CEII Coordinator will then
determine how long the CEII designation should last and, as
appropriate, whether to make any re-designation.\98\
---------------------------------------------------------------------------

    \97\ NOPR, 155 FERC ] 61,278 at P 21.
    \98\ Id.
---------------------------------------------------------------------------

Comments
    60. The Trade Associations request that the Commission establish a
process in which appropriate stakeholders may

participate in the Commission's CEII designation determinations for
Commission-generated information.\99\ The Trade Associations assert
that whether the information is submitted to the Commission or not,
``owners and operators of that critical infrastructure who will be
faced with defending such a potential attack deserve to have input into
the determination of whether or not such information should be
disclosed.'' \100\
---------------------------------------------------------------------------

    \99\ Trade Associations Comments at 24.
    \100\ Id.
---------------------------------------------------------------------------

Commission Determination
    61. The Commission determines that there is no need for stakeholder
participation in the designation of Commission-generated information.
The Commission has the expertise and experience to make determinations
about whether Commission-generated information is CEII. And as a
practical matter, it would not be appropriate in some circumstances for
stakeholders to be privy to Commission-generated information that
qualifies as CEII. For example, Commission-generated CEII may contain
information that is otherwise non-public or privileged. To the extent
that an entity believes that a Commission-generated document contains
CEII about its facility, the entity is not precluded from raising that
concern with the CEII Coordinator.
5. Segregable Information
NOPR
    62. The NOPR recognized that information submitted to the
Commission may contain parts that are CEII and parts that may not be
CEII. As a result, the NOPR proposed to require entities submitting
CEII and Commission staff who generate CEII, to the extent feasible, to
segregate the CEII (or information that reasonably could be expected to
lead to the disclosure of the CEII) from non-CEII at the time of
submission or staff's generation, respectively.\101\
---------------------------------------------------------------------------

    \101\ NOPR, 155 FERC ] 61,278 at P 22.
---------------------------------------------------------------------------

Comments
    63. HRC and Powerex support the requirement to segregate CEII from
non-CEII and encourage efforts to prevent the over-classification of
information.\102\ TAPS asks the Commission to confirm that submitting a
redacted public version of a filing satisfies the requirement to
segregate CEII.\103\ Powerex asks the Commission to clarify that
derivative analyses performed by governmental entities or their
contractors that use or rely on CEII, without more detail, should not
be designated as CEII solely based on the fact the analysis relies on
or uses CEII.\104\
---------------------------------------------------------------------------

    \102\ HRC Comments at 3; Powerex Comments at 16-17.
    \103\ TAPS Comments at 14.
    \104\ Powerex Comments at 16.
---------------------------------------------------------------------------

Commission Determination
    64. The Commission clarifies that submitting a properly redacted
public version of information submitted as CEII meets the requirement
established in section 215A(d)(8). Moreover, derivative analyses that
use or rely on CEII, without actually containing or disclosing CEII, do
not automatically qualify as CEII unless the information provided could
reasonably be expected to lead to the disclosure of CEII.
6. Duration of Designation
NOPR
    65. Section 215A(d)(9) provides that information ``may not be
designated as critical electric infrastructure information for longer
than 5 years, unless specifically re-designated by the Commission or
the Secretary, as appropriate.''\105\ The NOPR stated that the five-
year designation period will commence upon submission, and the
expiration of the five-year period will not automatically trigger the
public release of the information unless the Commission determines it
is appropriate to do so.\106\ The NOPR also stated that the Commission
will make a re-designation determination when an entity requests the
information; when staff determines a need to remove the designation; or
when a submitter requests that the information no longer be treated as
CEII.\107\ Consistent with current practice, the NOPR proposed that a
NDA will require protection of CEII past the expiration of the CEII
designation marked on the information and that the recipient of CEII
from the Commission must receive prior authorization from the
Commission before making any disclosure.\108\
---------------------------------------------------------------------------

    \105\ FAST Act, Pub. L. 114-94, section 61,003, 129 Stat. 1312,
1776.
    \106\ NOPR, 155 FERC ] 61,278 at P 18 n.14 and P 24.
    \107\ Id.
    \108\ Id. P 26.
---------------------------------------------------------------------------

    66. In the NOPR, the Commission proposed removing the CEII
designation when the information no longer could impair the security or
reliability of not only the bulk-power system or distribution
facilities but also other forms of energy infrastructure.\109\ The
Commission stated that the Commission would provide notice to the
submitter ``in the instance where the Commission takes the affirmative
step to rescind the designation.'' \110\
---------------------------------------------------------------------------

    \109\ Id. P 27.
    \110\ Id.
---------------------------------------------------------------------------

Comments
    67. Several commenters support the proposal to maintain information
as non-public after CEII designations marked on the information
expire.\111\ However, Peak requests that the Commission determine at
the time of the designation whether the data will lose its protection
after the five-year term ends and recommends creating designation
categories that include designation timeframes.\112\ The Trade
Associations and APPA ask the Commission to automatically re-designate
information, absent objection.\113\ Tallgrass requests that a
designation remain for the life of a pipeline facility.\114\ INGAA
requests that the Commission never un-designate CEII related to
pipeline facilities on its own initiative or unilaterally as long as
the facility is in operation.\115\
---------------------------------------------------------------------------

    \111\ See, e.g., ITC Comments at 2-3; INGAA Comments at 3; NRECA
Comments at 9.
    \112\ Peak Comments at 10-11 (recommending categories such as
``transmission and generation outage data, generator-specific
forecast data, transmission facility and load status and
measurements, specific facility modeling data, and device lists'').
    \113\ Trade Associations Comments at 21-22; APPA Comments at 20.
    \114\ Tallgrass Comments at 3.
    \115\ INGAA Comments at 3.
---------------------------------------------------------------------------

    68. APS requests clarification on whether the criteria for re-
designating CEII are the same as the criteria used for the initial CEII
designation.\116\
---------------------------------------------------------------------------

    \116\ APS Comments at 12.
---------------------------------------------------------------------------

    69. NRECA and ITC assert that the NOPR is unclear with respect to
the notice and comment provisions pertaining to a determination to
remove CEII designations. In particular, they urge the Commission to
clarify that submitters will receive notice, an opportunity to comment,
and appeals rights prior to any determination to remove a CEII
designation and prior to any disclosure of the information.\117\ ITC
also states that the NOPR proposal to ``notify the person who submitted
the document and give the person an opportunity (at least five calendar
days) in which to comment in writing prior to the removal of the
designation'' is insufficient notice. ITC asks the Commission to
provide notice and an opportunity to comment not only to the ``person
who submitted the document'' but also to the organization on whose

behalf the person submitted the document.\118\
---------------------------------------------------------------------------

    \117\ NRECA Comments at 11; ITC Comments at 3-4.
    \118\ ITC Comments at 3.
---------------------------------------------------------------------------

    70. APPA requests that the Commission revise the language in
amended section 388.113(e) to ensure that designations made by DOE
cannot be removed by the Commission.\119\
---------------------------------------------------------------------------

    \119\ APPA Comments at 26.
---------------------------------------------------------------------------

Commission Determination
    71. The Commission adopts the NOPR proposal to treat expired CEII
as non-public until a re-designation determination is made. Such a
process is supported by the majority of commenters and is reasonable
given the large volume of CEII presently in the Commission's files and
anticipated to be filed. Consistent with the NOPR's intent, the
Commission will modify the regulatory language in amended section
388.113(e) to indicate that the Commission will treat information as
non-public after the CEII designation has lapsed; that no information
will be released as non-CEII unless the Commission decides to release
the information; and that notice and opportunity for comment will be
provided to the submitter prior to any determination that the CEII
designation of a submitted document should be removed.
    72. We do not adopt the recommendations to automatically re-
designate information, designate by category, or designate for the
lifetime of a facility. Blanket designations are inconsistent with FPA
section 215A(d)(9), which requires the Commission to specifically re-
designate information.\120\
---------------------------------------------------------------------------

    \120\ Section 215A(d)(9) states that information ``may not be
designated as critical electric infrastructure information for
longer than 5 years, unless specifically re-designated by the
Commission or the Secretary, as appropriate.'' FAST Act, Public Law
114-94, section 61,003, 129 Stat. 1312, 1776.
---------------------------------------------------------------------------

    73. In response to ITC's comments that providing notice to the
person who submitted the document is insufficient, we clarify that the
Commission will provide the person and/or the organization identified
on the submission notice an opportunity to comment as well as appeal
rights prior to any determination to rescind a CEII designation or
release the information.\121\
---------------------------------------------------------------------------

    \121\ The Commission will use the relevant service list, where
appropriate, to determine the appropriate recipient.
---------------------------------------------------------------------------

    74. With respect to APPA's comments regarding the Commission's
ability to remove a DOE designation, we clarify that the Commission
does not intend to remove any designations that DOE may make. With
respect to APS's request for clarification regarding re-designations,
we clarify that the regulations adopted herein do not differentiate
between the processes for designating or re-designating information as
CEII.
7. Judicial Review of Designation
NOPR
    75. The Commission proposed to require a person seeking to
challenge a Commission designation determination to file an
administrative appeal with the Commission's General Counsel prior to
seeking judicial review in federal district court under section
215A(d)(11).\122\
---------------------------------------------------------------------------

    \122\ NOPR, 155 FERC ] 61,278 at P 28.
---------------------------------------------------------------------------

Comments
    76. HRC contends that the Commission's administrative appeal
requirement should not be mandatory.\123\ NRECA asserts that the
Commission does not have a legal basis for the administrative appeal
requirement.\124\ NRECA also recommends that the regulations specify
the timeframes in which appeals can be pursued; a timeframe for when a
decision on the appeal should be rendered; and that the designation
will remain in place until legal challenges have been exhausted.\125\
---------------------------------------------------------------------------

    \123\ HRC Comments at 3.
    \124\ NRECA Comments at 11; HRC Comments at 3-4.
    \125\ Id.
---------------------------------------------------------------------------

    77. NRECA contends that the Commission must revise the delegation
authority provisions in section 375.313 to allow the General Counsel to
hear and decide an administrative appeal.\126\
---------------------------------------------------------------------------

    \126\ NRECA Comments at 12.
---------------------------------------------------------------------------

Commission Determination
    78. With respect to NRECA and HRC's comment, Congress directed the
Commission to establish criteria and procedures to designate
information as CEII, and the mandatory appeal to the Commission's
General Counsel is a procedure that will assist in proper designation
of such information. Requiring a party to exhaust administrative
remedies prior to taking a matter to court is a standard and basic
function of administrative law.\127\ The administrative appeal process
gives the Commission an opportunity to correct any error and to ensure
that Commission policy has been properly complied with. This process
creates efficiency in the administrative process and promotes judicial
economy. In addition, the current FOIA and CEII process provides for
administrative appeal.\128\
---------------------------------------------------------------------------

    \127\ See Hidalgo v. FBI, 344 F.3d 1256, 1258-59 (D.C. Cir.
2003) (holding that ``exhaustion of administrative remedies is
generally required before filing suit in federal court so that the
agency has an opportunity to exercise its discretion and expertise
on the matter and to make a factual record to support its
decision'').
    \128\ NOPR, 155 FERC ] 61,278 at P 28.
---------------------------------------------------------------------------

    79. In response to NRECA's suggestion regarding appeal timeframes,
the Commission will revise the amended regulations at section
388.113(j) to provide more specificity about the process for submitting
an administrative appeal. After receiving a determination that
information no longer qualifies as CEII, a submitter may appeal that
determination. To make an appeal, the submitter must file a notice of
appeal to the General Counsel, copying the CEII Coordinator, within 5
business days of the date of the determination.\129\ A statement in
support of the appeal (a statement providing applicable facts and legal
authority) must be submitted to the General Counsel within 20 business
days of the date of the determination. The appeal will be considered
received upon receipt of the statement in support of the appeal. A
determination denying a request for disclosure or denying a request to
designate a document as public may also be appealed. A notice of appeal
is not required for these determinations because information would not
be disclosed under the challenged decision. However, the requester must
submit an appeal within 20 business days of the date of the
determination by submitting its statement in support of its appeal to
the Commission's General Counsel.\130\ The General Counsel or the
General Counsel's designee will make a determination with respect to
any appeal within 20 business days after the receipt of the appeal,
unless extended pursuant to section 388.110(b)(1), which will equally
apply to CEII for purposes of appeals.
---------------------------------------------------------------------------

    \129\ Requiring the submitter to inform the Commission of its
intent to appeal within 5 business days will allow the Commission to
know sooner than later whether the submitter plans to challenge the
decision and, if not, allow the Commission to disclose the
information sooner.
    \130\ The Trade Associations suggest that the Commission should
issue an order on appeal of any denial of an information owner's
objections to disclosure of CEII pursuant to a NDA. Trade
Association Comments at 20. Under our current practice, the decision
to disclose CEII pursuant to a NDA is appealable directly to a
district court under 5 U.S.C. 552(a)(4)(B). There is no need to
establish an additional procedure under the amended regulations that
requires the Commission to issue an order on appeal.
---------------------------------------------------------------------------

    80. To avoid any uncertainty, the Commission will amend section
375.309 to include a provision to make clear that the Commission has
delegated to the General Counsel authority to make determinations on
behalf of the

Commission on appeals of designations and determinations regarding
CEII.

C. Duty to Protect CEII

NOPR
    81. The Commission proposed revisions to strengthen the handling
requirements for Commission employees and external recipients of CEII.
With respect to Commission staff, the Commission proposed to add
section 388.113(h) to require Commissioners, Commission staff, and
Commission contractors to comply with the Commission's internal
controls.\131\ For external recipients of CEII, the Commission proposed
requiring requesters to provide specific information to demonstrate a
legitimate need for the information and to include a signed statement
attesting to the accuracy of the information provided in any CEII
request.\132\ The Commission also proposed that all NDAs minimally
require that CEII: (1) will only be used for the purpose it was
requested; (2) may only be discussed with authorized recipients; (3)
must be kept in a secure place in a manner that would prevent
unauthorized access; and (4) must be destroyed or returned to the
Commission upon request. The Commission also proposed that the NDA make
clear that the Commission may audit compliance with the NDA.
---------------------------------------------------------------------------

    \131\ NOPR, 155 FERC ] 61,278 at P 30.
    \132\ Id. PP 33-34. Specifically, the Commission proposed to
require a requester to demonstrate: (1) the extent to which a
particular function is dependent upon access to the information; (2)
why the function cannot be achieved or performed without access to
the information; (3) whether other information is available to the
requester that could facilitate the same objective; (4) how long the
information will be needed; (5) whether or not the information is
needed to participate in a specific proceeding (with that proceeding
identified); and (6) whether the information is needed
expeditiously. Id.
---------------------------------------------------------------------------

Comments
    82. The Trade Associations request that the Commission provide
further details of the content and nature of the internal controls and
include them in the Commission's regulations.\133\ MISO agrees that the
Commission should have internal controls and notes that the internal
controls should be enforced.\134\
---------------------------------------------------------------------------

    \133\ Trade Associations Comments at P 36-37. The Trade
Associations also state that the Commission should consider
expounding on recommendations from the DOE IG.
    \134\ MISO Comments at 8.
---------------------------------------------------------------------------

    83. Several commenters request that the Commission expand the list
of minimum requirements for a NDA. MISO and NRECA note that the NOPR
recognizes the need for requesters to protect CEII after the
designation has lapsed and recommend that the duty to protect expired
CEII be included in the minimum NDA requirements.\135\ MISO, the Trade
Associations and APS recommend that the Commission require recipients
to report all unauthorized disclosures.\136\ NERC recommends adding to
the NDA a requirement that a recipient must destroy or return CEII by
specific deadlines.\137\ NERC and the Trade Associations request that
submitters be able to enforce the terms of a NDA that covers the
submitter's CEII.\138\
---------------------------------------------------------------------------

    \135\ MISO Comments at 8; NRECA Comments at 10.
    \136\ MISO Comments at 9; Trade Associations Comments at 26; APS
Comments at 10.
    \137\ NERC Comments at 14.
    \138\ NERC Comments at 14; Trade Associations Comments at 26.
---------------------------------------------------------------------------

    84. In addition to the NDA recommendations stated above, the Trade
Associations request that the Commission add the following clauses to
the NDA: (1) Recipients of CEII shall have information protection
policies and procedures to protect the CEII; and (2) an officer of the
recipient's organization, on behalf of the organization, as well as all
individuals who will have access to the CEII, shall execute the NDA,
which shall specify that the individuals and organization face
sanctions for failure to honor the terms of the NDA.\139\
---------------------------------------------------------------------------

    \139\ Trade Associations Comments at 26.
---------------------------------------------------------------------------

    85. APS encourages the Commission to review the current NDA for
potential gaps, such as the lack of an obligation to treat CEII with
the same degree of care as a requester would treat its own confidential
or proprietary information.\140\ NRECA asks the Commission to clarify
that a NDA is required when an entity receives CEII after the
designation expires.\141\
---------------------------------------------------------------------------

    \140\ APS Comments at 9-10.
    \141\ NRECA Comments at 10.
---------------------------------------------------------------------------

    86. Peak seeks clarification regarding the requirements for keeping
CEII in a secure place and manner.\142\ Peak explains that recipients
of CEII may have different views of what constitutes a ``secure
place.''\143\
---------------------------------------------------------------------------

    \142\ Peak Comments at 14-15.
    \143\ Id.
---------------------------------------------------------------------------

    87. The Trade Associations recommend that the Commission adopt a
monitoring and enforcement process to discourage unauthorized
disclosures and ask for additional language clarifying that ``any
person or entity found to have used or disclosed CEII in a manner
inconsistent with the NDA will lose its access to CEII for an extended
period of time.'' \144\ The Trade Associations and NRECA suggest that
the Commission determine that noncompliance with the NDA would subject
an individual to penalties of up to $1 million per violation per
day.\145\
---------------------------------------------------------------------------

    \144\ Trade Associations Comments at 34.
    \145\ Trade Associations Comments at 35; NRECA Comments at 16-
17.
---------------------------------------------------------------------------

    88. NERC requests that the Commission ensure that requesters have
not been convicted of criminal activity by performing background
checks, reviewing watch lists, and verifying security clearances to
prevent inadvertent disclosures of CEII to a person with a criminal
record or who is under investigation or on a terrorist watch list.\146\
---------------------------------------------------------------------------

    \146\ NERC Comments at 13-14.
---------------------------------------------------------------------------

    89. NERC also proposes that the Commission include evidentiary
criteria to determine whether a requester of CEII is legitimate, and
the Trade Associations ask the Commission to conduct risk assessments
on all requesters.\147\
---------------------------------------------------------------------------

    \147\ NERC Comments at 12-14; Trade Associations Comments at 33.
---------------------------------------------------------------------------

    90. APS urges the Commission to require all requests to include at
least two business references and the submission of documentation of
authority for organizational requesters.\148\ Peak requests that if a
CEII request is not for participation in a specific proceeding, the
requester should be required to include in its statement of need a
``reliability or societal benefit.'' \149\
---------------------------------------------------------------------------

    \148\ APS Comments at 7-8.
    \149\ Peak Comments at 14.
---------------------------------------------------------------------------

Commission Determination
    91. We disagree with the Trade Associations' recommendation that we
provide additional details regarding internal controls and that we
include internal controls in the Commission's regulations. The NOPR
stated that the internal controls will address ``how sensitive
information, including CEII, should be handled, marked, and
kept.''\150\ We find that this statement provides sufficient details
regarding the nature of the internal controls. We also conclude that
internal controls should not be specified in the Commission's
regulations to allow Commission staff the flexibility to revise such
controls as needed.\151\
---------------------------------------------------------------------------

    \150\ NOPR, 155 FERC ] 61,278 at P 30.
    \151\ In developing this Final Rule and the internal controls,
the Commission has been cognizant of the recommendations of the DOE
Inspector General Report from January 30, 2015 as well as the
Commission's earlier response thereto, which are a matter of public
record. See Department of Energy, Office of Inspector General,
Inspection Report, Review of Controls for Protecting Nonpublic
Information at the Federal Energy Regulatory Commission, DOE/IG-0933
(January 2015), http://energy.gov/ig/downloads/inspection-report-doeig-0933.
---------------------------------------------------------------------------

    92. Amended section 388.113(h)(2) only includes ``minimum''
requirements

for a NDA and is not intended to be exhaustive or preclude other
requirements. Under certain circumstances the Commission may add
additional provisions to the NDA and submitters may request that
additional provisions be added to the NDA.
    93. In response to MISO's and NRECA's comments, the Commission will
amend section 388.113(h)(2) to require a recipient of CEII under a NDA
to protect the CEII after a designation lapses as part of the list of
minimum requirements of a NDA. In response to the comments by MISO, the
Trade Associations and APS, we will also amend section 388.113(h)(2) to
add an obligation to require CEII recipients to promptly report all
unauthorized disclosures of CEII to the Commission.
    94. In response to NRECA's concern, the Commission clarifies that a
requester seeking information past the expiration of the CEII
designation marked on the information must still pursue the information
through the CEII or FOIA processes. We read NRECA's comments to apply
to situations where an entity requests information that has been
submitted to the Commission more than five years prior to the request
and the Commission has not made a determination to re-designate the
information. In these situations, the CEII Coordinator will make a re-
designation determination as part of the response to a request seeking
access to information that has a designation determination older than
five years. If the information is re-designated as CEII, then it will
be processed pursuant to the Commission's requirements for CEII.
    95. The Commission is not persuaded by Peak's comments that there
is a need to clarify what constitutes maintaining CEII in a secure
place. We believe that a ``secure place,'' as articulated in the NDA,
has a well-understood meaning, i.e. safe or free from unauthorized
access or a risk of loss.
    96. The Commission believes that it has sufficient authority to
enforce the terms of the NDA and, as a result, it is unnecessary to
confer on NERC or others authority to enforce the terms of a NDA.
    97. In response to the comments of the Trade Associations and
NRECA, the Commission notes that the FAST Act does not require the
Commission to develop sanctions for external recipients of CEII. In any
event, the general CEII NDA already states that a violation of the NDA
may result in civil sanctions for an external recipient of CEII, and it
will continue to do so. It is not necessary to list all the various
civil sanctions that may apply, as each matter would be reviewed on its
own facts. For these reasons, we also decline to adopt the Trade
Associations' recommendation that we add to the minimum requirements of
a NDA a provision that CEII recipients may be sanctioned by losing
access to CEII for an extended period of time.
    98. The Commission agrees that it is important to ensure that
requesters of CEII do not pose security risks. CEII requesters have
historically fallen into different categories, including individuals
known to the Commission with no known risk.\152\ The Commission will
continue the practice of requiring information needed to verify the
legitimacy of a requester on an as-needed basis. As such, there is no
need for a CEII requester to demonstrate that there is a ``reliability
or social benefit'' to the request. We believe that our procedures have
adequately assessed whether requestors should receive CEII. In
addition, we propose additional requirements for a requester to obtain
CEII information. Thus, given these procedures, it is not necessary to
mandate specific background check criteria in the regulations.
Moreover, while the current request form asks for a business reference,
we are not persuaded that such a submission is necessary in all
instances or that two references are necessary.\153\
---------------------------------------------------------------------------

    \152\ Requests are typically received from public utilities, gas
pipelines, hydro developers, academics, landowners, public interest
groups, researchers, renewable energy organizations, and
consultants.
    \153\ Electronic CEII Request Form, http://www.ferc.gov/resources/guides/filing-guide/ceii-request.asp.
---------------------------------------------------------------------------

D. Sanctions

NOPR
    99. Section 215A(d)(2)(C) of the FPA requires the Commission to
``ensure there are appropriate sanctions in place for Commissioners,
officers, employees, or agents of the Commission or DOE who knowingly
and willfully disclose critical electric infrastructure information in
a manner that is not authorized under this section.'' \154\ The
Commission proposed sanctioning unauthorized disclosures of CEII by
Commission personnel and further noted that DOE will have
responsibility for sanctions for unauthorized disclosures by its
officers and employees.\155\ The Commission also proposed to refer any
misconduct by the Chairman or Commissioners to the DOE Inspector
General (DOE IG).\156\
---------------------------------------------------------------------------

    \154\ FAST Act, Public Law 114-94, section 61,003, 129 Stat.
1312, 1776.
    \155\ NOPR, 155 FERC ] 61,278 at P 36.
    \156\ Id.
---------------------------------------------------------------------------

Comments
    100. Several commenters, including APPA and the Trade Associations,
point to the absence of stated sanctions for Commissioners in the NOPR
and request that the Commission consider whether to impose civil
sanctions under section 316A of the FPA and criminal penalties under
section 316(b) of the FPA.\157\ APPA also recommends that the
Commission consider referring unauthorized CEII disclosures by
Commissioners to the Department of Justice (DOJ) and that the
Commission coordinate with DOE to outline a new or cite an existing
procedure that DOE can utilize to sanction its employees.\158\ MISO
suggests that the Commission's General Counsel be tasked with referring
any willful, unauthorized disclosures to the DOE IG.\159\ NRECA asks
that a mechanism be put in place for the public to make a referral to
the DOE IG if they are aware of any misconduct.\160\ MISO and NRECA
recommend that the Commission revise its proposed rule to make clear
that the Commission ``shall'' refer any misconduct to the DOE IG and to
allow the public to refer matters to the DOE IG.\161\
---------------------------------------------------------------------------

    \157\ See Trade Associations Comments at 40 (noting that CEII
protections adopted in the FAST Act were adopted in the context of
what many considered to be an inappropriate disclosure of CEII by a
former FERC Commissioner); see also APPA Comments at 28. APPA states
that the Commission has authority to impose civil penalties against
``any person'' who violates any provision of any Commission rule and
may use criminal penalties under FPA section 316(b) for knowing and
willful violations, by ``any person'' of Commission rules or
regulations under the FPA.
    \158\ APPA Comments at 27, 29. APPA also asserts that a DOE
employee sanctioned for unauthorized disclosure may be able to
challenge their sanction ``on grounds that it was not promulgated by
the Commission, as directed by Congress.''
    \159\ MISO Comments at 10.
    \160\ NRECA Comments at 16.
    \161\ MISO Comments at 10; NRECA Comments at 16.
---------------------------------------------------------------------------

Commission Determination
    101. As discussed below, we conclude that the sanctions adopted in
this Final Rule, as well as other reforms adopted prior to the passage
of the FAST Act, provide sufficient deterrents to the unauthorized
disclosure of CEII.
    102. First, we note that, in addition to the changes adopted in
this Final Rule, the Commission has recently made a number of changes
to its internal procedures to ensure the protection and security of
CEII.
    103. The Commission has revised its security classification and
ethics training to ensure that Commission employees are aware of their
responsibility to protect sensitive

nonpublic information. The Commission also has strengthened its
protection of CEII and other sensitive, non-public information. For
example, the Commission conducted a comprehensive review of its
internal information governance procedures, which informed the
development of the internal controls referenced in this Final Rule. We
believe that these reforms should help protect against unauthorized
disclosure of CEII.
    104. The Commission has also taken steps to ensure that there are
appropriate sanctions in place for certain persons who knowingly and
willfully disclose CEII without authorization. With respect to former
employees and Commissioners, the Commission has strengthened certain
requirements applicable to departing employees and Commissioners by
requiring them to certify that they are not unlawfully removing records
from the agency. This certification form also identifies and requires a
departing employee or Commissioner to acknowledge the potential
criminal penalties associated with the unlawful removal or destruction
of federal records. While these changes pre-date the passage of the
FAST Act, they are an important component of the Commission's ongoing
efforts to protect against improper disclosure of CEII.
    105. As to existing Commission officers, employees, and agents, we
conclude that the sanctions adopted in this Final Rule are appropriate,
as they provide for possible dismissal from federal service and
criminal prosecution for improper disclosure of CEII. These sanctions
should serve as a deterrent to, and punishment for, improper activity.
    106. With respect to Commissioners, we believe it is appropriate
that violations be referred to the DOE IG, as that office is equipped
to investigate a Commissioner's actions and impose sanctions on a
Commissioner through an independent process outside of the Commission's
enforcement process.\162\ For example, it is within the DOE IG's
discretion after concluding its investigation to refer a matter to the
DOJ for criminal prosecution. Upon becoming aware of a potentially
improper disclosure of CEII, the Designated Agency Ethics Official
(DAEO) will oversee an examination of those circumstances. If there is
reason to believe that an improper disclosure has occurred, the DAEO
will refer the matter to the DOE IG.
---------------------------------------------------------------------------

    \162\ We note that no commenter has indicated that the DOE IG
has insufficient tools to investigate and, as appropriate, pursue
sanctions for a Commissioner.
---------------------------------------------------------------------------

    107. Finally we conclude that there is no need to add a mechanism
to our regulations for the public to make a referral to the DOE IG, as
the DOE IG has an existing hotline in place for the public.\163\ The
Commission will also continue to defer to DOE as to what sanctions
would be appropriate for DOE officers and employees.
---------------------------------------------------------------------------

    \163\ See DOE IG Hotline, http://www.energy.gov/ig/services.
---------------------------------------------------------------------------

E. Voluntary Sharing of CEII

NOPR
    108. Section 215A(d)(2)(D) of the FPA requires the Commission,
taking into account standards of the Electric Reliability Organization,
to facilitate voluntary sharing of critical electric infrastructure
information. The statute, specifically, directs the Commission to
facilitate voluntary sharing with, between, and by Federal, State,
political subdivision, and tribal authorities; the Electric Reliability
Organization; regional entities; information sharing and analysis
centers established pursuant to Presidential Decision Directive 63;
owners, operators, and users of critical electric infrastructure in the
United States; and other entities determined appropriate by the
Commission.\164\
---------------------------------------------------------------------------

    \164\ FAST Act, Public Law 114-94, section 61,003, 129 Stat.
1312, 1776.
---------------------------------------------------------------------------

    109. The Commission proposed that it would voluntarily share
Commission-generated CEII and CEII submitted to the Commission with
individuals or organizations when there is a need to ensure that energy
infrastructure is protected.\165\ Under this proposal, the Commission
may voluntarily share CEII without receiving a request for the
CEII.\166\ However, the NOPR proposed that all voluntarily shared CEII
would be shared subject to an appropriate NDA or Acknowledgement and
Agreement.\167\ Additionally, the NOPR proposed to require an Office
Director or his designee to consult with the CEII Coordinator before
voluntarily sharing CEII.\168\
---------------------------------------------------------------------------

    \165\ NOPR, 155 FERC ] 61,278 at PP 37-38, 40.
    \166\ Id. P 38.
    \167\ Id. P 40.
    \168\ Id. P 39.
---------------------------------------------------------------------------

    110. In the NOPR, the Commission also noted that it retains the
discretion to release information as necessary for other federal
agencies to carry out their jurisdictional responsibilities.\169\
---------------------------------------------------------------------------

    \169\ Id.
---------------------------------------------------------------------------

    111. The NOPR also proposed that the Commission may impose
additional restrictions on how voluntarily shared CEII may be used and
maintained.\170\ Where practicable, the Commission proposed providing
notice of its voluntary sharing of CEII to the submitter of the
CEII.\171\
---------------------------------------------------------------------------

    \170\ Id. P 41.
    \171\ Id. P 42. The Commission noted that it may not be
practicable to provide notice to the submitter in instances where
voluntary sharing is necessary to maintain infrastructure security,
to address a potential threat, or in other exigent circumstances.
---------------------------------------------------------------------------

Comments
    112. Several commenters observe that the NOPR only addressed the
Commission's voluntary sharing of CEII and did not establish guidelines
for the voluntary sharing of CEII ``with, between, and by'' other
entities.\172\ Powerex requests that the Commission facilitate the
sharing of CEII between and by owners, operators, and users of the
critical electric infrastructure, while still adequately safeguarding
CEII.\173\ The Public Interest Organizations and WIRAB recommend that
the Commission adopt a ``white list'' of CEII requesters that the
Commission determines do not pose a risk of unauthorized
disclosure.\174\ They also contend that the Commission should adopt a
universal NDA to encourage more sharing between and by non-Commission
entities.\175\ WIRAB also seeks standardization of NDAs used by NERC,
regional entities, and the owners and operators of Critical Electric
Infrastructure in the United States.\176\
---------------------------------------------------------------------------

    \172\ See, e.g., Peak Comments at 5-6; Powerex Comments at 13-
14; APPA Comments at 31; NRECA Comments at 13.
    \173\ Powerex Comments at 13-15.
    \174\ Public Interest Organizations Comments at 8-9; WIRAB
Comments at 9.
    \175\ Id.
    \176\ WIRAB Comments at 10.
---------------------------------------------------------------------------

    113. The Joint RTOs (ISO New England, Inc. and Southwest Power
Pool, Inc.) suggest that the Commission facilitate the sharing of CEII
by permitting regional transmission organizations (RTOs), independent
system operators (ISOs), and other entities with FERC-approved tariffs
or similar agreements to share CEII ``between the entities relying on
their tariff information-handling commitments.'' \177\ In response, PJM
states that the Commission should reject the Joint RTOs' proposal,
arguing that it is incomplete and overbroad and fails to acknowledge
results achieved through the current sharing of CEII.\178\ The Joint
RTOs, in reply comments, state that their proposal would simply allow
ISOs, RTOs, and other entities with

Commission-approved tariffs that have planning and operations
responsibilities to use those tariffs to facilitate information-
sharing.\179\
---------------------------------------------------------------------------

    \177\ Joint RTOs Comments at 4. MISO also suggests the
Commission encourage sharing between planning authorities and
transmission planners. See MISO Comments at 10.
    \178\ PJM Reply Comments at 2.
    \179\ Joint RTOs Reply Comments at 2.
---------------------------------------------------------------------------

    114. NERC generally supports the Commission's proposal to
facilitate voluntary information sharing with NERC, regional entities
and information sharing and analysis centers. NERC, nonetheless,
requests that the Commission, under appropriate circumstances, share
CEII with the Electricity Information Sharing & Analysis Center (E-
ISAC) when voluntarily sharing CEII with a governmental entity.\180\
NERC asks that the voluntary sharing process include coordination
between the CEII Coordinator and certain Commission office staff prior
to any disclosure.\181\
---------------------------------------------------------------------------

    \180\ NERC Comments at 9.
    \181\ Id.
---------------------------------------------------------------------------

    115. APS, the Trade Associations and CEA ask for additional
criteria as to how and when the Commission will voluntarily share
information.\182\
---------------------------------------------------------------------------

    \182\ APS Comments at 13; Trade Associations Comments at 27; CEA
Comments at 5.
---------------------------------------------------------------------------

    116. APPA asserts that FPA 215A(d)(2)(D) directs the Commission
only to facilitate voluntary sharing of CEII among electricity
subsector stakeholders--not to preemptively share CEII with interested
parties.\183\ APPA asserts that when the Commission voluntarily shares
submitted information, it effectively forces the entity that submitted
the information as CEII to share its information with others, which may
reduce the incentive for the entity to voluntarily share CEII with the
Commission.\184\ APPA recommends that the Commission designate E-ISAC
and any other appropriate Information Sharing and Analysis
Organizations (ISAOs) as forums through which CEII can be shared under
FPA 215A, and to apply the liability protections of FPA section
215A(f)(3) to those entities.\185\ APPA also recommends that the
Commission provide protections like those that are utilized by other
federal agencies to facilitate information sharing activity.\186\
---------------------------------------------------------------------------

    \183\ APPA Comments at 30.
    \184\ Id.
    \185\ APPA Comments at 31-32.
    \186\ Id. at 31-32. For example, APPA proposes that the
Commission allow for ``source anonymizing'' shared CEII or to adopt
DHS's Traffic Light Protocol to ensure information is shared with
the correct audience.
---------------------------------------------------------------------------

    117. The Trade Associations request that the regulations explicitly
state that the voluntary sharing of CEII is limited to instances where
the Commission has determined that there is a need to ``ensure that
energy infrastructure is protected.'' \187\
---------------------------------------------------------------------------

    \187\ Trade Associations Comments at 27-28.
---------------------------------------------------------------------------

    118. CEA requests that the Commission include language clarifying
that the Commission will make every reasonable effort to provide
advance notice before sharing CEII and will provide after-the-fact
notice if prior notice is not practical.\188\ MISO recommends that the
Commission adopt regulatory language indicating that ``when prior
notice is not given, submitters of CEII shall receive notice of a
limited release of CEII as soon as practicable.'' \189\ NRECA requests
that the Commission clarify that any disclosure by the Commission on
the basis of ``voluntary sharing'' must be subject to the same notice,
comment, and appeal rights provisions that are afforded to submitters
in response to CEII requests.\190\
---------------------------------------------------------------------------

    \188\ CEA Comments at 6. NRECA also references the need to
provide notice as soon as possible, even if such notice is after the
disclosure. See NRECA Comments at 12.
    \189\ MISO Comments at 11.
    \190\ NRECA Comments at 12-13.
---------------------------------------------------------------------------

    119. The Trade Associations state that the proposed regulations
could be strengthened by: (1) Limiting and defining the circumstances
where notice would ``not be practicable''; and (2) allowing the
submitters an opportunity to provide comments protesting the release of
information the Commission proposes to voluntarily share.\191\
---------------------------------------------------------------------------

    \191\ Trade Associations Comments at 30.
---------------------------------------------------------------------------

    120. Finally, TAPS requests that the Commission revise its
delegations to reflect the NOPR's proposal that Office Directors will
engage in voluntary sharing.\192\
---------------------------------------------------------------------------

    \192\ TAPS Comments at 12-13.
---------------------------------------------------------------------------

Commission Determination
    121. Many of the commenters misapprehend how CEII may be
voluntarily shared under the FAST Act or otherwise seek to expand the
Commission's CEII sharing program in ways that neither the FAST Act nor
the NOPR contemplated. Under FPA section 215A(a)(3), CEII is limited to
information that is submitted to, or generated by, the Commission and
designated as such by the Commission (or information submitted to, or
generated by DOE, and designated as such by DOE).\193\ In voluntarily
releasing CEII to a person, the Commission imposes obligations on that
person through a NDA. However, the Commission's CEII rules do not, and
are not intended to, address information that an entity has
unilaterally determined to be CEII and never submitted to the
Commission.\194\ In addition, the Commission's regulations do not cover
an entity that has submitted CEII to the Commission but intends to
share the same information with others outside of the Commission's
processes. To be clear, an entity that receives CEII from the
Commission is subject to the restrictions in the applicable NDA,
including restrictions on use and disclosure. However, an entity that
submitted the information to the Commission is not subject to a NDA
and, as a result, the Commission's rules do not apply to how that
entity may want to share its information.\195\ Moreover, an entity may
have information that could qualify as CEII, but such information is
not CEII under the Commission's regulations unless it has been
submitted to the Commission pursuant to the Commission's CEII
regulations and the Commission has determined it to be CEII.
---------------------------------------------------------------------------

    \193\ FAST Act, Public Law 114-94, section 61,003, 129 Stat.
1312, 1773 (``critical electric infrastructure information means
information . . . generated by or provided to the Commission or
other Federal agency . . . that is designated as critical electric
infrastructure information by the Commission or the Secretary
pursuant to subsection (d)'').
    \194\ As CEII information has to be designated by the CEII
Coordinator or DOE Secretary, information that an entity creates and
maintains without providing to the Commission has not been formally
designated as CEII.
    \195\ However, other concerns may influence how the entity
shares its own information with others.
---------------------------------------------------------------------------

    122. The Final Rule facilitates voluntary sharing by allowing the
public to request CEII and by adding to the Commission's regulations a
process whereby staff may share CEII in a proactive manner with a
variety of entities. The Commission agrees with PJM's comments that
existing non-public voluntary sharing mechanisms within the energy
industry are sufficient to encourage sharing information among the
different groups and therefore there is no need for the Commission to
establish requirements for sharing within the industry through tariff
revisions or otherwise.\196\ It is also unnecessary to adopt Public
Interest Organizations' and WIRAB's recommendation that the Commission
establish ``whitelists'' for third parties to use or to require
entities sharing information outside of the Commission's CEII process
to adopt a particular NDA.
---------------------------------------------------------------------------

    \196\ Section 215A(d) requires the Commission ``to promulgate [-
] regulations as necessary'' to, inter alia, ``facilitate voluntary
sharing of critical electric infrastructure information.'' FAST Act,
Public Law 114-94, section 61,003, 129 Stat. 1312, 1776. The FAST
Act, therefore, affords the Commission with discretion in this
regard and, at least implicitly, recognizes that the Commission may,
identify, encourage and support existing processes to facilitate the
voluntary sharing of CEII.

---------------------------------------------------------------------------

    123. The Commission agrees with NERC and APPA that the plain
language of the statute expressly provides for the voluntary sharing of
information with entities like E-ISAC and other ISAOs. Section
215A(d)(2)(iv) concerns the voluntary sharing of CEII with, between,
and by ``information sharing and analysis centers established pursuant
to Presidential Decision Directive 63.'' Pursuant to that provision,
the Commission anticipates voluntary sharing of information with,
between and by E-ISAC and other ISAOs under the appropriate
circumstances. Under our current NDAs, CEII recipients may share CEII
with other individuals covered by a NDA for the same information.\197\
When information is provided in accordance with section 215A(d) the
provisions for release from liability in section 215A(f)(3) would
apply.
---------------------------------------------------------------------------

    \197\ See, e.g., Critical Energy Infrastructure Information
General Non-Disclosure Agreement, https://www.ferc.gov/legal/ceii-foia/ceii/gen-nda.pdf (``A Recipient may only discuss CEII with
another Recipient of the identical CEII. A Recipient may check with
the CEII Coordinator to determine whether another individual is a
Recipient of the identical CEII.'').
---------------------------------------------------------------------------

    124. The Commission disagrees with APPA that E-ISAC or another ISAO
should be designated as a forum to share CEII. The FAST Act does not
specify that the Commission should designate E-ISAC, another ISAO, or
any other entity as a forum through which CEII can be shared under
section 215A. In fact, a plain reading of the statute indicates that
Congress designated the Commission as the entity to facilitate this
sharing. As such, the Commission declines to take the recommendation of
APPA.
    125. We disagree with APPA's assertions that the voluntary sharing
provision in the Commission's regulations effectively requires entities
to share CEII with another entity or the Commission.\198\ Section
215A(d)(6) explicitly states that an entity is not required to share
CEII with the Commission or another entity or person.\199\ The
voluntary sharing provision does not impose a sharing requirement on
entities; instead, it allows the Commission discretion to share, in
certain circumstances, CEII that has already been submitted to, or
generated by, the Commission.
---------------------------------------------------------------------------

    \198\ FAST Act, Public Law 114-94, 61,003, 129 Stat. 1312, 1777.
    \199\ Id.
---------------------------------------------------------------------------

    126. Even if the Commission's voluntary sharing of information were
viewed as the same as a third-party sharing it, the Commission must
balance its obligation to disclose information as necessary to carry
out its jurisdictional responsibilities against an entity's possible
preference not to have such information disclosed.\200\ The regulations
adopted here achieve that balance. Furthermore, the FAST Act does not
place limits on the Commission's ability to share information in its
possession when authorized and necessary to carry out the requirements
of the FAST Act or the Commission's other jurisdictional
responsibilities.
---------------------------------------------------------------------------

    \200\ The FAST Act does not prohibit the Commission from
disclosing any information, nor does it require an entity to produce
any information. FAST Act, Public Law 114-94, section 61,003, 129
Stat. 1312, 1777.
---------------------------------------------------------------------------

    127. As noted in the NOPR, in some circumstances, providing notice
to a submitter of CEII that its information will be shared under
section 215A could hamper the ability of the Commission to act in a
timely way.\201\ The Commission, therefore, disagrees with the comments
by APPA and NRECA that prior notice must be provided in each instance
where the Commissions uses the voluntary sharing provisions of section
215A. However, in response to the comments, the Commission clarifies in
amended section 388.113(f) that the Commission will not provide
advanced notice only in situations where there is an urgent need to
disseminate the information. The Commission will also adopt MISO's and
CEA's proposal that when prior notice is not given, the Commission will
provide submitters of CEII whose information was shared with notice as
soon as practicable.
---------------------------------------------------------------------------

    \201\ NOPR, 155 FERC ] 61,278 at P 38.
---------------------------------------------------------------------------

    128. The NOPR proposed to require that a consultation between the
CEII Coordinator and the appropriate Office Director take place prior
to any voluntary sharing of CEII. We disagree with NERC's proposal to
add a requirement that staff from the Commission's Office of Electric
Reliability (OER) and Office of Energy Infrastructure Security (OEIS)
be involved in all voluntary sharing consultations because the
information in question may not involve OEIS or OER subject matter.
However, we note that the CEII Coordinator will consult with Commission
staff as appropriate, which could include OER and OEIS staff. The
Commission is also not persuaded that it is necessary to provide
additional details regarding the factors the Commission will use to
determine when voluntary sharing is appropriate. The NOPR specifically
proposed that the Commission will voluntarily share ``CEII with
individuals and organizations that the Commission has determined need
the information to ensure that energy infrastructure is protected.''
\202\ Thus, the NOPR provided sufficient details on the circumstances
in which the Commission will voluntarily share CEII. Providing more
details may unnecessarily restrict the Commission's ability to
voluntarily share needed information.
---------------------------------------------------------------------------

    \202\ NOPR, 155 FERC ] 61,278 at P 37.
---------------------------------------------------------------------------

    129. The Commission disagrees with APPA's suggestion that the
regulations should include more developed protections to facilitate
information sharing.\203\ The Commission believes that procedures
outlined in the NOPR are sufficient to protect CEII that the Commission
shares. When the Commission voluntarily shares information, CEII will
be shared subject to an appropriate NDA or Acknowledgement and
Agreement.\204\ Moreover, under section 388.113(f), the Commission may
impose additional conditions on how the information may be used and
maintained that the Commission voluntarily shares.
---------------------------------------------------------------------------

    \203\ Id. PP 31-32
    \204\ As noted below, to obtain CEII federal agencies execute an
Acknowledgement and Agreement, as opposed to a NDA. See Federal
Agency Acknowledgement and Agreement, http://www.ferc.gov/legal/ceii-foia/ceii/fed-agen-acknow-agree.pdf.
---------------------------------------------------------------------------

    130. In response to TAPS's comment, the Commission finds that the
CEII Coordinator delegation in section 375.313 is sufficient and does
not require separate delegations for Office Directors to voluntarily
share CEII. Moreover, existing section 388.113(d)(1) has allowed
Commission staff to share Critical Energy Infrastructure Information
with facility owners and operators. No such delegated authority has
been used for such sharing.

F. Request for Access to CEII

NOPR
    131. The Commission proposed to maintain special access procedures
for owner-operators of facilities, federal agencies, and intervening
parties.\205\ For intervenors, the Commission proposed to move the
existing procedures in section 388.112 to section 388.113 and to
eliminate the exemption for certain LNG materials.\206\ For general
requesters, the Commission added a one-year time limit for
organizational requests and added back a time requirement for the
Commission to process CEII requests.\207\ The Commission also proposed
adding a provision to clarify that the Commission's CEII regulations
should

not be construed to require the release of certain non-CEII.\208\
---------------------------------------------------------------------------

    \205\ NOPR, 155 FERC ] 61,278 at PP 43-49.
    \206\ Id. P 49.
    \207\ Id. PP 50-51.
    \208\ Id. P 52.
---------------------------------------------------------------------------

Comments
    132. APPA recommends that the Commission adopt a tiered system with
varying levels of access restrictions.\209\ APPA and the Trade
Associations suggest that the Commission create a distinct ``need to
know'' standard to access information related to the bulk-power
system.\210\ Under this suggested standard, CEII would only be
disclosed when the person or entity seeking the information has a
direct ``need to know'' in order to maintain reliability, safety, or
security.\211\
---------------------------------------------------------------------------

    \209\ APPA Comments at 19.
    \210\ APPA Comments at 18; Trade Associations Comments at 27.
    \211\ APPA Comments at 9; Trade Associations Comments at 27.
---------------------------------------------------------------------------

    133. The Trade Associations recommend that if an academic
institution or other members of the public request CEII, the Commission
should deny the request and refer the request to the information
owner.\212\ Peak, on the other hand, supports data sharing with
researchers and asks the Commission to permit researchers to access
CEII data.\213\ Peak also suggests that the Commission consider whether
``research institutions with defined cyber security and employee
background checks'' should have a specific process for obtaining
CEII.\214\ WIRAB supports the Commission's balancing approach for
determining who should receive CEII, but WIRAB recommends that the
Commission delete the portion of proposed section 388.113(g)(iv) that
states that the Commission can deny a request for ``other reasons.''
\215\
---------------------------------------------------------------------------

    \212\ Trade Associations Comments at 32.
    \213\ Peak Comments at 7-8.
    \214\ Id. at 14.
    \215\ WIRAB Comments at 8.
---------------------------------------------------------------------------

    134. Peak recommends that the Commission's sharing of CEII with
owners and operators should not be limited to information related to
``its own facility.'' \216\
---------------------------------------------------------------------------

    \216\ Peak Comments at 13.
---------------------------------------------------------------------------

    135. Public Interest Organizations support the NOPR's proposed
revisions allowing certain LNG materials to be accessible in
proceedings in which there is a right to intervention.\217\ Public
Interest Organizations suggest that ``the Commission streamline the
release of CEII data for intervenors by allowing one request to trigger
release of all of an entity's CEII data.'' \218\
---------------------------------------------------------------------------

    \217\ Public Interest Organizations Comments at 9.
    \218\ Id. at 9-10.
---------------------------------------------------------------------------

    136. MISO notes that for purposes of consistency, the Commission
should add language already in section 388.112(b)(iv) to amended
section 388.113(g)(4) to ensure that, if an objection to a request for
disclosure is filed, whether the information is privileged or CEII,
``the filer shall not provide the non-public document to the person or
class of persons identified in the objection until ordered by the
Commission or a decisional authority.'' \219\
---------------------------------------------------------------------------

    \219\ MISO Comments at 4.
---------------------------------------------------------------------------

    137. Peak asks the Commission to clarify whether the protections
proposed in section 388.113(g)(2) regarding the obligation of federal
agency recipients to protect CEII in the same manner as the Commission
extends to data generated by a federal agency through an analysis of
CEII.\220\
---------------------------------------------------------------------------

    \220\ Peak Comments at 13.
---------------------------------------------------------------------------

    138. APS requests that the Commission revise amended section
388.113(g)(5)(vi) to require organizational requesters to promptly
update/remove individuals from their list of approved individuals.\221\
---------------------------------------------------------------------------

    \221\ APS Comments at 11; see also Trade Associations Comments
at 35.
---------------------------------------------------------------------------

    139. The Trade Associations and APS state that they are concerned
that amended section 388.113(g)(5)(v), which allows an individual under
an organizational request to have access to CEII for the remainder of a
calendar year, may result in a less robust verification system.\222\
WIRAB supports allowing requesters to maintain their validity for the
duration of the calendar year.\223\
---------------------------------------------------------------------------