FERC, in a Nov. 17 final rule, said that it amends its regulations to implement provisions of the Fixing America’s Surface Transportation (FAST) Act that pertain to the designation, protection and sharing of critical electric infrastructure information, and that it amends its regulations addressing critical energy infrastructure information.
FERC noted in a statement that President Obama in December 2015 signed into law the FAST Act, which adds section 215A to the Federal Power Act (FPA) to improve security and resilience of energy infrastructure in the face of emergencies. The FAST Act required FERC to issue regulations aimed at securing and sharing CEII.
FERC added that it issued in June a notice of proposed rulemaking (NOPR), and that its final rule – which takes effect 60 days after publication in the Federal Register – largely adopts the NOPR by:
- Establishing criteria and procedures to designate information as CEII
- Prohibiting unauthorized disclosure of CEII
- Establishing sanctions for FERC employees and certain other individuals who knowingly and willfully make unauthorized disclosures
- Facilitating voluntary sharing of CEII among federal, state, political subdivisions and tribal authorities; the Electric Reliability Organization; regional entities; owners, operators and users of critical electric infrastructure; and other entities deemed appropriate by FERC
According to the final rule, shortly after Sept. 11, 2001, FERC took steps to protect information that it considered critical energy infrastructure information. As a preliminary step, FERC removed documents from its public files and eLibrary database that were likely to contain detailed specifications about critical infrastructure. FERC directed the public to use the Freedom of Information Act (FOIA) request process to obtain such information. FERC also said that it determined that it was important to have a process for individuals with a valid or legitimate need to access certain sensitive energy infrastructure information, and so in 2003, it issued a final rule establishing critical energy infrastructure information regulations.
In the NOPR, FERC proposed to amend section 388.113 to include procedures for submitting, designating, handling, sharing and disseminating critical electric infrastructure information submitted to or generated by FERC. FERC proposed to define the term “critical electric infrastructure information” to include “critical energy infrastructure information” as defined under FERC’s current regulations and to refer to both types of information, collectively as CEII. FERC also proposed to delete references to CEII in section 388.112 so that that section would only address privileged material and all procedures regarding CEII would be in section 388.113.
Discussing comments filed, FERC said that the Midcontinent ISO (MISO), for instance, maintained that CEII should not include all critical energy infrastructure information. MISO contended that FERC misinterpreted the definition of critical electric infrastructure information and that not all “critical energy infrastructure information under the commission’s regulations is included” in the definition of critical electric infrastructure information.
FERC said that it disagrees that the CEII definition should not include critical energy infrastructure information and that there should be separate processes for electric and non-electric CEII.
Noting that its determination is based on the plain language of the FAST Act, FERC said that section 215A(a)(3) defines critical electric infrastructure information to “include information that qualifies as critical energy infrastructure information under the commission’s regulations.”
In subsuming FERC’s existing critical energy infrastructure information within section 215A’s CEII definition, Congress expressly stated that the definition of CEII includes critical energy infrastructure information, FERC said.
The commission also said that an assertion by a commenter that FERC is “falling short” of meeting Congress’ intent is without merit. In the proposed regulations, FERC complies with each provision in section 215A(d)(2) with regard to designating and handling critical electric infrastructure information, the commission said, adding, “The fact that those rules also apply to critical energy infrastructure information does not diminish the commission’s compliance under the FAST Act.”
FERC also noted that commenters requested that the commission provide more detail on what qualifies as CEII, with the Public Interest Organizations, for instance, asking FERC to publish guidelines and criteria for designating information as CEII. FERC said that it is not persuaded that more detailed guidance or additional designation criteria in the CEII regulations are necessary.
FPA section 215A(a)(2) defines critical electric infrastructure as “a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.”
FPA section 215A(a)(3) includes critical energy infrastructure information within CEII, FERC added, noting that it believes that the regulations, as proposed, provide adequate guidance for a submitter or FERC staff to determine whether information is CEII and for the CEII coordinator to make a determination.
FERC also noted that it proposed in the NOPR to treat information submitted with a justification for CEII treatment as CEII, unless the submitter is otherwise notified by FERC. As an initial matter, FERC corrected the statement in the NOPR erroneously stating that under the commission’s current practice, it “deems the designation on a submission accepted as submitted.”
FERC said that its current practice is to treat information as CEII, and maintain it in its non-public files, when it is submitted with a request for CEII treatment. Under the regulations adopted in the final rule, information that is submitted will not be designated CEII until the CEII coordinator makes such a determination, FERC said.
FERC also noted that it adopts the NOPR proposal to treat information downloaded from NERC databases as non-public and to evaluate whether it should be designated as CEII in response to a request for the information or if FERC determines such information should be disclosed.
Among other things, FERC also said that there is no need for stakeholder participation in the designation of FERC-generated information.