10 CFR Document 2020-04640
Critical Electric Infrastructure Information; New Administrative Procedures
June 9, 2020
CFR

AGENCY:

Office of Electricity, U.S. Department of Energy.

ACTION:

Final rule.

SUMMARY:

The U.S. Department of Energy (DOE or Department) publishes this final rule to implement DOE's critical electric infrastructure information (CEII) designation authority under the Federal Power Act (FPA). In this final rule, DOE establishes administrative procedures intended to ensure that stakeholders and the public understand how the Department would designate, protect, and share CEII.

DATES:

The effective date of this rule is May 15, 2020.

ADDRESSES:

The docket for this rulemaking, which includes Federal Register notices, comments, and other supporting documents/materials, is available for review at https://www.regulations.gov. All documents in the docket are listed in the https://www.regulations.gov index. However, not all documents listed in the index, such as those containing information that is exempt from public disclosure by law, may be publicly available. A link to the docket web page can be found at https://www.regulations.gov/​docket?​D=​DOE-HQ-2019-0003. The docket web page explains how to access all documents, including public comments, in the docket.

FOR FURTHER INFORMATION CONTACT:

Michael Coe, U.S. Department of Energy, Office of Electricity, Mailstop OE-20, Room 8H-033, 1000 Independence Avenue SW, Washington, DC 20585; (202) 287-5166; or oeregs@hq.doe.gov.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction

II. Discussion of Final Rule

A. Background

B. Filing Procedures and Guidance

C. Purpose and Scope

D. Definitions

E. Authority to Designate Information as CEII

F. Coordination Among DOE Office Designators

G. CEII FOIA Exemption

H. Criteria and Procedures for Designating CEII

I. Duration of Designation

J. Review or Requests for Reconsideration of Designation

K. Sharing of CEII

L. Procedures for Requesting CEII

M. Unauthorized Disclosure

III. Regulatory Review

A. Executive Orders 12866 and 13563

B. Executive Orders 13771, 13777, and 13783

C. National Environmental Policy Act

D. Regulatory Flexibility Act

E. Paperwork Reduction Act

F. Unfunded Mandates Reform Act of 1995

G. Treasury and General Government Appropriations Act, 1999

H. Executive Order 13132

I. Executive Order 12988

J. Treasury and General Government Appropriations Act, 2001

K. Executive Order 13211

L. Congressional Notification

IV. Approval of the Office of the Secretary

I. Introduction

In this final rule, the Department of Energy (DOE) establishes procedures for the designation of critical electric infrastructure information (CEII) under section 215A(d) of the Federal Power Act (FPA). Section 61003 of the Fixing America's Surface Transportation Act (FAST Act), Public Law 114-94, added section 215A to the FPA. The new section authorizes both the Secretary of Energy (the Secretary) and the Federal Energy Regulatory Commission (FERC) independently to designate CEII. Under section 215A(d)(1) of the FPA, a CEII designation exempts the data or information so designated from disclosure under the Freedom of Information Act (FOIA) and other laws requiring government disclosure of certain information or records. 16 U.S.C. 824o-1(d)(1); 5 U.S.C. 552(b)(3). Section 215A(d)(2) required FERC, after consultation with the Secretary and within a year of the FAST Act's enactment, to “promulgate such regulations as necessary to . . . establish criteria and procedures to designate information as [CEII].” 16 U.S.C. 824o-1(d)(2). FERC did so, following a notice-and-comment rulemaking similar to the instant rulemaking. Order No. 833, Regulations Implementing FAST Act Section 61003—Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission, FERC Docket Nos. RM16-15-000 and RM15-25-001, 157 FERC ¶ 61,123 (2016), order on reh'g & clarification, Order No. 833-A, FERC Docket No. RM16-15-001, 163 FERC ¶ 61,125 (2018). While this rulemaking established criteria for designating CEII applicable to both FERC and the Department, the designation procedures in the rulemaking were limited to FERC. Thus, on October 29, 2018, the Department published a Notice of Proposed Rulemaking (NOPR) to establish its own designation procedures. (83 FR 54274) This final rule establishes DOE's designation procedures, which are consistent with the procedures established by FERC to the maximum extent possible.

The Department is committed to improving the resilience, reliability, and security of the Nation's electricity delivery system. Consistent with its statutory authorities and ongoing work with energy sector entities in furtherance of that mission, the Department anticipates that the majority of CEII the Department will receive will be voluntary submissions, scoped in collaboration with the submitting entity, and for which DOE may often make a CEII designation based on the scoping prior to submission. DOE's role with respect to CEII is not expected to be related to its regulatory functions, and DOE expects that nearly all potential CEII sent to DOE will be voluntary submissions tied to specific programs. The Department anticipates receiving a smaller volume of CEII material than FERC does given the regulatory requirements for mandatory FERC filings by the electricity industry, giving DOE the flexibility to engage in more proactive designations. Even if the submission relates to a DOE regulatory function, DOE will still evaluate it based on the procedures set forth in this rule on whether to designate the information as CEII. If organizations and individuals submit material to DOE, the Department recommends adding all appropriate FOIA exemption markings, as the material may be both Confidential Business Information (CBI) and CEII. Based on the recent opinion of the Supreme Court of the United States in Food Marketing Institute v. Argus Leader Media (No. 18-481), which effectively broadens the scope of data and information that are eligible for the fourth exemption from disclosure under FOIA, DOE notes that all entities submitting information for CEII designation under this rule should also specify whether the material is Confidential Business Information under the new legal standard.

DOE received a total of fourteen (14) written comments in response to the NOPR, all of which are available at https://www.regulations.gov. Generally, the comments addressed the following issues: Scope, purpose, and definitions; authority to designate information as CEII; coordination among DOE Office designators; criteria and procedures for determining what constitutes CEII; duration of designation of CEII; sharing of CEII; and sanctions for unauthorized disclosure of CEII. DOE responds to the comments received in the discussion of the final rule in Section II below.

II. Discussion of Final Rule

A. Background

After FERC published its CEII designation criteria and procedures, DOE began its rulemaking to establish administrative procedures regarding how the Department would designate, protect, and share CEII. The Department follows the designation criteria FERC has already formulated, but establishes its own procedures for such designation in this final rule. These procedures differ from those established by FERC in that DOE's procedures provide additional time to coordinate with parties that submit CEII to DOE. However, the agencies' overall procedures are similar in providing specific information when requesting that submitted information be designated as CEII, as well as procedures for appealing a CEII designation determination. The Department's rule is consistent with FERC's rule to the maximum extent possible, so that the fundamental objectives of the CEII statutory program will be met regardless of whether the information is submitted to the Department or to FERC.

The Canadian Electricity Association (CEA) expressed support for DOE's effort to harmonize its CEII procedures with FERC's CEII procedures. (CEA, No. 12, p. 4). However, CEA asked for clarification between DOE and FERC's CEII procedures. In particular, CEA sought understanding on processes to ensure consistency between CEII designation, as well as removal of CEII designation, if the same material is shared with both DOE and FERC. Id.

The Department recognizes the importance of coordination among Federal agencies with similar programs, as each agency has different procedures related to voluntary information sharing and protection of the information. As mentioned above, the Department has sought to harmonize its procedures with the FERC procedures as much as possible, and DOE will use FERC's designation criteria. The Department's designation, however, does not mean that the information will be automatically shared with FERC, the Department of Homeland Security (DHS), or any other Federal agency. The Department will follow the procedures outlined in this rule to review and designate information and data as CEII. In addition, the Department will continue to coordinate with the DHS regarding its Protected Critical Infrastructure Information program, including as provided for under 1004.13(e)(4). If DOE finds it necessary to provide CEII material to another Federal agency, DOE will provide dissemination instructions prohibiting further distribution. DOE will continue to coordinate with FERC, DHS, and other Federal agencies on all cross-cutting initiatives related to CEII to ensure maximum harmonization.

B. Filing Procedures and Guidance

Proposed § 1004.13(a) tells interested stakeholders where to find information about CEII filing procedures and guidance. No comments were received; therefore, DOE finalizes this section as proposed.

C. Purpose and Scope

As described in proposed § 1004.13(b), procedures for the designation, protection, and sharing of CEII developed under section 215A of the FPA would apply to anyone who provides CEII to DOE or who receives CEII from DOE, including DOE employees, DOE contractors, agents of DOE, and individuals or organizations who have been permitted access to CEII, as well as non-DOE entities submitting CEII to DOE or receiving CEII from DOE. These proposed procedures would also apply to other Federal agencies seeking CEII designation and protection of information that agencies may submit to DOE.

The joint comments of EarthJustice, Union of Concerned Scientists, and Public Citizen (EarthJustice et al.) disputed the validity of the Department's notice and comment process in this rulemaking. Their comments alleged that the Department violated the Administrative Procedure Act because it held a meeting in February 2018 (discussed in footnote 1 of this rule) at which “industry stakeholders” laid out concerns in advance of this rulemaking. EarthJustice et al. stated that “[t]he public cannot meaningfully comment on an agency's action if key facts or rationale in support of the decision are not made available for consideration and comment.” (Earth Justice et al., No. 3, p. 13).

The Department disagrees with EarthJustice et al.' s claims of inadequate notice and comment. As explained in the October 2018 NOPR, the Department held a meeting with interested stakeholders in compliance with all applicable laws and procedures.[1] As a preliminary matter, DOE's ex parte guidelines, promulgated in October 2009 and available at https://www.energy.gov/​gc/​downloads/​guidance-ex-parte-communications, provide that the applicability of the guidelines begins upon release of a NOPR or other preliminary rulemaking document. As noted in the Department's October 2018 NOPR, however, DOE nonetheless made a summary of that meeting available to the public, as specified in the ex parte guidelines. The NOPR subsequently provided regulatory text and a preamble explaining the proposed rule. Commenters were given 60 days to respond to the proposed rule, which is to be binding on the Department in designating CEII. No commenters asked for additional time to comment on the rule. This final rule includes the Department's consideration of, and response to, the comments it received. Based on the above, DOE concludes that commenters had the opportunity to meaningfully comment on the Department's proposed rule.

D. Definitions

Section 1004.13(c) of the proposed rule defines terms applicable to the proposed procedures in this notice for the designation of CEII. Where the terms are defined by statute or by FERC's CEII regulations, the definitions track those corresponding definitions, either verbatim or with maximum consistency. Other terms are proposed for the first time in this context. The Department received no comments on the proposed definitions. Therefore, unless discussed below, the proposed definitions are adopted without change in this final rule.

The Department adds the definition of “Confidential Business Information” to § 1004.13(c) to mean “commercial or financial information that is both customarily and actually treated as private by its owner and that is provided to the government as part of a claimed CEII submission.” This addition is based on the June 24, 2019, opinion of the Supreme Court of the United States in Food Marketing Institute v. Argus Leader Media (No. 18-481). The decision effectively broadens the scope of data and information that are eligible for exemption from disclosure under 5 U.S.C. 552(b)(4). In the case, the Supreme Court rejected the lower courts' holding that “information can never be deemed confidential [the FOIA statutory term] unless disclosing it is likely to result in `substantial competitive harm' to the business that provided it.” Food Mktg. Inst. v. Argus Leader Media, No. 18-481, slip op. at 1 (U.S. June 24, 2019). The Court found that the “substantial competitive harm” test which stemmed from the D.C. Circuit's 1974 opinion in National Parks & Conservation Association v. Morton, 498 F.2d 765 (DC Cir. 1974), went beyond the language of the statute itself, and did not reflect the typical meaning of the words used when Congress enacted FOIA Exemption 4. See Argus Leader, slip op. at 7-10. The Court held that “[a]t least where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is `confidential' within the meaning of Exemption 4.” Id. at 12.

The Department clarifies that the CEII Coordinator may delegate the daily implementation of the CEII Coordinator function as described in this rule, in whole or in part, to an Assistant Secretary or Administrator in DOE. The NOPR stated that the final CEII designation authority would reside with the DOE Office exercising its delegated CEII designation authority. The appropriate Assistant Secretary or Administrator would exercise the authority delegated to a DOE Office. Therefore, the Department adopts a definition of CEII Coordinator in § 1004.13(c) to specify delegation to the appropriate Assistant Secretary in DOE.

E. Authority To Designate Information as CEII

Proposed § 1004.13(d) allows the Secretary, or DOE Offices with delegated authority, to receive and designate CEII. Practically speaking, the flexibility to delegate allows the Department to handle CEII in a manner ensuring access to the critical information it needs to execute its responsibilities as the lead Sector-Specific Agency for cybersecurity for the energy sector, under section 61003(c) of the FAST Act, and the Sector-Specific Agency for Energy (Critical Infrastructure), under Presidential Policy Directive 21.

EarthJustice et al. claimed that “[t]he Department has no legal authority to establish criteria and procedures for CEII designation.” The comments contended that “while both [FERC] and the Department have authority to designate CEII, the power to establish criteria and procedures for doing so is [FERC]'s alone.” (EarthJustice et al., No. 3, p. 2).

EarthJustice et al. are correct that both the Department and FERC may designate CEII. However, while the Department is obligated to apply the criteria FERC crafted, FERC acknowledged in its final procedural rule that DOE is not bound by the procedures FERC uses, noting that “[t]he FAST Act . . . does not compel DOE to make any changes to its regulations in this regard” and that “nothing within the Commission's regulations would limit DOE's ability to designate CEII in accordance with the FAST Act,” and specifically “declin[ing] to revise [its] regulations to identify specific designation criteria and CEII procedures for DOE.” FERC Order No. 833, 157 FERC ¶ 61,123 at P 39 (2016), reh'g denied, FERC Order No. 833-A, 163 FERC ¶ 61,125 at PP 31-33 (2018). See also Department of Energy Organization Act, as amended, section 644, 42 U.S.C. 7254 (“The Secretary is authorized to prescribe such procedural . . . rules and regulations as he may deem necessary or appropriate to administer and manage the functions now or hereafter vested in him.”). The Department has therefore designed its own CEII designation procedures, which are consistent with the FERC regulations to the maximum extent possible.

Other commenters requested more detail on how the Department will evaluate information submitted as CEII. For example, Midcontinent Independent System Operator, Inc. (MISO) noted that the proposed rules allowed the delegation of CEII designation authority. (MISO, No. 11, p. 3). Therefore, MISO recommended that “[t]he designation criteria must be specified to enable consistent designation of CEII by each DOE Office, and for CEII submitters to understand the kind of information the DOE will designate as CEII.” Id. Edison Electric Institute (EEI) recommended that, in clarifying the CEII designation criteria, “the Department consider information on other systems or assets that may negatively affect national security, economic security, and/or public health; information that may enable the misuse of an asset or system that may negatively affect national security, economic security, and/or public health; and information on systems or assets that has previously been made public.” (EEI, No. 9, p. 5).

DOE has determined that the existing CEII designation criteria address these concerns. FPA section 215A(a)(2) defines Critical Electric Infrastructure as “a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.” FPA section 215A(a)(3) includes “information related to critical electric infrastructure” in its definition of CEII. Under the criteria that FERC established and that DOE follows, FERC and DOE may consider a range of elements in determining what qualifies as CEII. The regulation, as proposed, provides adequate guidance for a submitter and DOE staff to determine whether information is CEII, and for the CEII Coordinator or Coordinator's designee to make a determination.

EEI stated that it supported coordination among DOE Office designees to ensure that the FAST Act authorities are consistently implemented within DOE and recommends a robust internal process to ensure that CEII is appropriately and consistently designated, protected, and shared throughout the Department. (EEI, No. 9, p. 11).

DOE agrees that the internal process for coordination among DOE Office designees is important and will ensure robust internal controls to appropriately and consistently designate, protect, and share CEII throughout the Department. More information on the internal process is provided in Section F.

F. Coordination Among DOE Office Designators

Proposed § 1004.13(e) sets out the functions of the CEII Coordinator and the Coordinator's designee. The CEII Coordinator may make an initial determination as to whether the information fits within the definition of CEII, but final CEII designation authority resides with the CEII Coordinator or DOE Office exercising its delegated CEII designation authority. The proposed subsection also provides that DOE entities with authority to designate CEII would meet to calibrate their approaches to CEII designation, and would meet with representatives of other Federal agencies, as needed and at the discretion of the Coordinator or designee, to ensure consistent understanding of CEII designation processes.

The Department clarifies that the CEII Coordinator or Coordinator's designee is delegated the authority already granted to the Secretary, in accordance with FPA section 215A, to designate information sought by DOE as CEII. Therefore, the Department amends § 1004.13(e)(1) to include specific mention that the CEII Coordinator or Coordinator's designee can designate certain information sought by DOE as CEII, in accordance with FPA section 215A(a)(3), and using the designation criteria codified at 18 CFR 388.113(c).

The Department clarifies that § 1004.13(e)(2) was not meant to limit coordination of implementation of DOE's CEII authority with only DOE Offices, PMAs, and the Energy Information Administration (EIA). It was meant to include all CEII Coordinator designees. Therefore, the Department amends § 1004.13(e)(2) to remove specific mention of the four PMAs and EIA.

The Department clarifies that a submitter requesting information be designated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.” The additional marking of spelling out CEII is meant to eliminate any confusion related to the use of the new FOIA exemption in DOE. Therefore, the Department amends § 1004.13(e)(2)(i) to include the updated marking of CEII as “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE”

The Department clarifies that, based on the addition of the definition of “confidential business information,” when any person or entity requests CEII designation of submitted material, the submitter must also clearly label the cover page and pages or portions of information that it considers Confidential Business Information in bold, capital lettering, indicating that it contains Confidential Business Information, as appropriate, and marked “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” In addition, if CEII and CBI are both included in the submission, the information should be marked “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” The Department therefore revises § 1004.13(e)(2) to add a new paragraph (ii) to include this additional requirement.

EEI supports the procedures that require the CEII Coordinator or the Coordinator's designee to notify CEII submitters of a non-federal entity request for CEII and to convene a conference call with the affected DOE Office(s) and the CEII submitter(s) to discuss any concerns with sharing the CEII. (EEI, No. 9, pp.11-12). However, EEI “recommends that the Department provide additional guidance to CEII submitters on what to expect from the CEII Coordinator or his/her designees when convening a conference call to discuss a non-federal entity request for CEII release.” Id. at 12. In particular, EEI requests clarity on whether a “conference call will be scheduled within five days of the request or within five days of when the submitter is notified of the request, and if the submitter will receive the § 1004.13(k) request before the conference call is convened.” Id. In addition, EEI supports the Department's proposed coordination with other Federal agencies but recommends that, “in addition to coordination with FERC, coordination with [DHS] under its Protected Critical Infrastructure Information (`PCII') and other information protection authorities and the Nuclear Regulatory Commission (`NRC') are critical” because each agency has different procedures related to CEII, and discussions identifying best practices related to voluntary information sharing and protection of the information “will be key to protecting the nation's critical electric infrastructure.” (EEI, No. 9, pp.12-13).

DOE clarifies and amends proposed § 1004.13(e)(1)(vii) to state that a conference call will be scheduled within five days of when the CEII submitter is notified of the request, and the submitter will receive a copy of the request before the conference call is convened.

The Department agrees with EEI's recommendation that close coordination between all relevant Federal agencies is critical to ensuring protection of the nation's critical electric infrastructure. Therefore, the Department has amended § 1004.13(e)(4) to specifically include DHS and the Nuclear Regulatory Commission.

G. CEII FOIA Exemption

The language from § 1004.13(f)(6)(ii) of the proposed rule (renumbered as § 1004.13(g)(7)(ii)) is moved to new § 1004.13(f) and a reference is made to new § 1004.13(f) in the renumbered § 1004.13(g)(7)(ii). This only moves to a new subsection the content of FPA section 215A(d)(1)(B), stating that all information designated CEII is exempt from disclosure under the FOIA exemption codified at 5 U.S.C. 552(b)(3) and other laws requiring the disclosure of certain information or records, whether at the Federal, State, political subdivision, or tribal level of government.

EEI noted that the proposed regulations do not contain a paragraph (g) and the Department should review and edit the number of all paragraphs and references as appropriate before finalizing the rule. (EEI, No. 9, p. 18).

DOE appreciates EEI raising the clerical error. The Department has added paragraph (f) to fix the clerical error and codify the requirements of FPA section 215A(d)(1)(B) in this new section.

H. Procedures for Designating CEII

Proposed § 1004.13(g) sets forth the procedures the Department would follow to designate CEII. The subsection covers requesting designation for information submitted to or generated by DOE, how DOE would treat submitted information and apply FERC's CEII designation criteria, how DOE would treat information once it has decided whether to designate the information as CEII, and how DOE would protect designated CEII. In particular, proposed § 1004.13(g)(3)(ii) stated that “[i]nformation for which CEII treatment is requested will be maintained by the CEII Coordinator or Coordinator's designee in DOE's files as non-public unless and until DOE completes its determination that the information is not entitled to CEII treatment.” To ensure that submitters of CEII are kept informed of the decision to be made, the Department has added the requirement to § 1004.13(g)(6)(i) that the designation decision be communicated “promptly.”

CEA shared its concern about the consequences of a submitter's inability to produce a public version of a document containing CEII. To alleviate that concern, CEA asked the Department to “clarify accommodations or outcomes if a submitter is unable to produce a public version of CEII.” (CEA, No. 12, p. 4).

In response to CEA's comment, the Department clarifies that if a submitter cannot produce a public version of a document with CEII, then the Department will provide a public version in response to a valid FOIA request with the CEII or other FOIA-exempt material redacted. The Department prefers, however, that a submitter provide public and non-public versions of documents containing CEII. Before the FAST Act amendments to the FPA, filers at FERC would routinely submit two versions of documents in this way. DOE encourages, but does not require, the same approach. The Department also suggests that CEII material be consolidated, to the extent possible, within a document rather than scattered throughout a document.

The comments of the American Public Power Association (APPA), the Large Public Power Council (LPPC), and the (National Rural Electric Cooperative Association (NRECA) (collectively, Joint Trade Associations) recommend that “the Department specify . . . that material maintained `in DOE's files as non-public' during the pendency of a request for CEII designation will be treated and handled in all respects as if it were CEII, as appears to be the Department's intent. [I]n particular, that treatment of electronic information as non-public will include `stor[age] in a secure electronic environment' with appropriate labeling, as the NOPR proposes for CEII.” (Joint Trade Associations, No. 15, pp. 9-10).

DOE believes that such a clarification is not necessary. The proposed regulation already states that “[w]hen a requester seeks information for which CEII status has been requested but not designated . . . DOE will render a decision on designation before responding to the requester or releasing such information. Subsequently, the release of information will be treated in accordance with the procedures established for CEII-designated material, or the return of information not designated as CEII.” Therefore, it is sufficiently clear that the Department will treat non-designated, CEII-marked information as if it were already designated CEII, until a designation has been conferred on the information. However, to prevent confusion, the Department amends § 1004.13(g)(7)(iii) to state that “secure place” refers to locked room or file cabinet.

EEI recommends that that the Department address how to mark information that cannot be physically labeled such as machine-to-machine information that may be shared with the Department because several DOE Power Marketing Administrations regularly receive machine-to-machine, electronic information from electric companies. (EEI, No. 9, p. 10).

In response to EEI's recommendation, DOE amends § 1004.13(g)(7) to require the marking of electronic information with the words “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE” in the electronic file name or transmitted under a Non-Disclosure Agreement (NDA) or other agreements or arrangements, such as those identified in § 1004.13(j)(3), to an electronic system where such information is stored in a secure electronic environment that identifies the stored information as CEII. The Department agrees that the PMAs receive a significant amount of CEII, including real-time, streaming information. The Department understands that it may not be practical or possible to physically mark each electronic file or each bit of real-time, streaming data submitted to the PMAs. The Department will consider the information marked as long as it is shared with the PMAs under appropriate protections, transmitted through secure protocols, and stored in secure electronic environments that identify information as CEII. For instance, an entity sharing real-time operating information under the North American Electric Reliability Corporation's Operating Reliability Data Confidential Agreement with PMAs does not need to mark the data, provided that the entity supplying the data communicates to the PMAs that such real-time data is being provided under the agreement and the entity providing the data requests CEII designation. The PMAs will store such data in secure electronic environments identifying information as CEII. The Department notes that the DOE CEII Coordinator or Coordinator's designee still needs to review and evaluate such information and make a CEII determination. The marking of information as CEII does not guarantee that such information will be designated as CEII.

EEI encourages the Department to clarify the marking requirements for submitting pre-designated and machine-to-machine information as CEII. In particular, EEI supports the pre-designation of information “about [Defense Critical Electric Infrastructure (DCEI)] on incidents and emergencies reported through the Department's Form OE-417, and Federal spectrum information managed by the National Telecommunications and Information Administration (“NTIA”) . . . however, it is unclear whether the proposed procedures require submitters of this pre-designated information to follow the submission process outlined in § 1004.13(f)(1)(i) through (iv).” (EEI, No. 9, p. 9).

The Joint Trade Associations urge DOE to “pre-designate” all information as CEII for which a CEII designation is requested. (Joint Trade Associations, No. 15, p. 6). Joint Trade Associations argues that “Defense Critical Infrastructure Information, Form OE-417 submissions, and Federal spectrum information is likely to reflect CEII, and it is appropriate to immediately extend a blanket of protection over these submissions.” Id. This approach would not preclude the case where “individualized designation determination would still be made on all information for which CEII treatment is requested, which would protect against over-designation of material that does not qualify as CEII.” Id. at 8. Further, the Joint Trade Associations argue “if the Department does not adopt pre-designation for all materials . . . DOE should specify that a public power utility that receives a state public records request for information that has been submitted to DOE with request for CEII designation will have the opportunity to consult with the DOE CEII Coordinator and receive an expedited determination as to whether the submitted information is CEII under DOE's regulations.” Id. at 11.

EarthJustice et al. also raised concerns with the Department's suggested blanket CEII designation of information related to DCEI. The comment doubted that all information related to DCEI would meet the CEII criteria. See id. The comment characterized the automatic DCEI designation as a “sweeping restriction on public access to information that would not lead to disclosure of CEII,” in violation of the FAST Act, “and the Department's failure to provide reasonable justification for this element of the proposal also violates the [Administrative Procedure Act].” Id. at 9.

S&P Global Market Intelligence and E&E News oppose what they describe as the Department's intent to automatically designate the content of submitted Form OE-417 (or successor), including Schedule 2 (the narrative description), as CEII. (S&P Global Market Intelligence, No. 6, p. 1; E&E News, No. 8, at p.1). S&P Global Market Intelligence raised the following three points opposing the Department's proposal. First, the Department did not explain why it must distinguish between OE-417 Schedule 1 (information that is “not confidential”) and Schedule 2 (information that “DOE proposes `will be protected' upon CEII designation request”). (S&P Global Market Intelligence, No. 6, p. 1). Second, an automatic exemption would be at odds with FERC's requirement of adequate justification for a CEII designation. Finally, the Department in 2014 proposed to revoke public access to Form OE-417 Schedule 2 under the Confidential Information Protection and Statistical Efficiency Act of 2002, but never did, based on feedback. Id. at 2.

E&E News also opposed the Department's proposal. First, automatically exempting any portion of the Form OE-417 from applicable FOIA laws without proper justification would be in conflict with FERC, which requires adequate justification. (E&E News, No. 8, at p.1). Second, E&E News argues that “[i]n years of processing OE-417 information and releasing accompanying data, in whole or in part, under FOIA, DOE has not demonstrated that the public release of properly-redacted Schedule 1 or 2 information ever threatened to impair the security of critical infrastructure . . . Section 2 is where the clarifying details are often provided in the form, without which the public could get a distorted picture of the exact scope of the concern, issue or threat.” Id. at 2. Finally, E&E News argues that in 2014 DOE proposed to revoke public access to Schedule 2 under the Confidential Information Protection and Statistical Efficiency Act of 2002. But based on feedback received, DOE did not proceed with the proposal. Id.

Electric Reliability Council of Texas, Inc. (ERCOT) pointed out that the language in the proposed rule is in conflict with respect to schedule 2 of Form OE-417. In § 1004.13(g)(3) “DOE intends to `automatically' classify information submitted on schedule 2 of Form OE-417 as CEII upon submission of a request for CEII treatment of that information . . . However, the proposed definition of CEII [in § 1004.13(c)(3)] indicates that information submitted on Form OE-417 will be confidential only if it meets the definition of CEII.” (ERCOT, No. 14, p. 2). ERCOT recommends “DOE revise the rule to treat all information submitted on schedule 2 of Form OE-417 as CEII without requiring a further showing of CEII status or even requiring a request for CEII treatment. Otherwise, ERCOT would suggest that the DOE remove the mention of OE-417 from the definition of CEII to avoid confusion.” Id. at 2-3.

In response to the comments above, the Department clarifies that the intent of the Department is not to designate categories of information as CEII through this rulemaking. The Department will therefore remove all references to “pre-designation” in the Final Rule. All information submitted will be reviewed and evaluated and then, if appropriate, designated as CEII by the CEII Coordinator or his/her designee. The Department will modify the definition of CEII to remove the categories Defense Critical Electric Infrastructure; information on electric incidents and emergencies reported to DOE through the Electric Emergency Incident and Disturbance Report (Form OE-417); and/or Federal spectrum information managed by the National Telecommunications and Information Administration (NTIA). DOE notes that whether the information meets one or more of these categories will still be considered in the Department's determination of whether information is CEII. DOE will also render a decision as to whether information is CEII before sharing the information with other Federal or non-federal entities or releasing that information in response to a FOIA request. As a result, there is no practical change in the protection of information for which a CEII designation is requested between the NOPR and this final rule. The Department intends that this practice will facilitate the energy sector's sharing of CEII with DOE and, in requesting information to support its policy initiatives and priorities, it may request CEII-designated information. If information requested by the Department is determined to meet the CEII designation criteria, the Department will designate such information as CEII upon receipt by the Department.

EarthJustice et al. commented on the Department's “pre-designation” of material as CEII, as well as its “interim” treatment of CEII. The comment stated that the proposed rule would allow such information “to be withheld indefinitely without opportunity for judicial review.” (EarthJustice et al., No. 3, p. 3). Further, the comment stressed that the Department “fails to explain its need to provide indefinite, interim treatment of information as CEII based solely on the assertion of the information provider.” Id. at 10.

As discussed above, the Department will not be pre-designating categories of information as CEII through this rulemaking, and CEII designation will hinge on a rigorous review and application of the criteria defining such information. Notwithstanding that approach, information submitted with a CEII designation request will not be shared with the public except in response to a valid FOIA request, and only then if the information is determined not to be CEII, not to fall under any other FOIA exemption, and applicable administrative and judicial remedies have been exhausted pursuant to paragraph 1004.13(i) of the regulations. To clarify, if the information is sought via FOIA, the Department will review and consider whether the information is eligible for official CEII designation. In any event, a submitter will still need to follow all of the submission process outlined in § 1004.13(g)(1)(i) through (iv), and the information will not be designated as CEII until the CEII Coordinator or his/her designee makes a determination.

EarthJustice et al., discussing a related concern, cautioned that pre-designation and interim treatment would hamstring judicial review of CEII determinations. The comments stressed that the amendments to the FPA demonstrate “clear legislative intent to afford protections against arbitrary CEII designations and ensure public access where appropriate.” Id. at 4. More specifically, EarthJustice et al. were concerned that “[b]ecause neither pre-designation nor interim CEII status appears to trigger an opportunity for a person to request reconsideration of that treatment, which would be a prerequisite to judicial review, DOE's proposed rules effectively and inappropriately nullify this section of law.” Id.

As discussed above, DOE will not be pre-designating categories of information as CEII in this rulemaking. If a FOIA request is received for material claimed to be CEII but not yet designated as such, the request will result in a decision by DOE whether the information is CEII. If the submitter pursues DOE's decision through the reconsideration stage described at § 1004.13(i), that decision would then be subject to judicial review.

Finally, EarthJustice et al. pointed out that the Department's promise to return or destroy material not designated CEII would violate the Federal Records Act. Specifically, they said that “[t]he proposal suggests that records could be requested under FOIA, triggering a determination that a CEII designation is unwarranted, and then the records could be returned or destroyed prior to the resolution of the FOIA request[, which] would be patently unlawful.” (EarthJustice et al., No. 3, p. 6). The comment warned that information “could be labeled CEII, however unjustifiably, for the purpose of ensuring that such information is returned or destroyed when a CEII designation is denied, regardless of the information's content or how the Department utilized it.” Id. at 8.

The Department agrees that destruction of submitted material examined for CEII designation may be contrary to the Federal Records Act. The Department therefore revises § 1004.13(g)(6)(iii) to emphasize that it will in all instances comply with the Federal Records Act.

I. Duration of Designation

Section 1004.13(h) outlines procedures governing the duration of CEII designation, to include re-applications for CEII designation, expiration of designation, removal of designation, and treatment and return of information no longer designated as CEII.

EEI, joined by Southern California Edison (SoCal Edison), expressed concern that the proposed rule would not ease the regulatory burden on submitters of information claimed as CEII. Their comments warned, for instance, that “[d]uplicative tracking [of CEII expiration dates] could quickly become onerous and overwhelming for submitters who may also have to track information they have shared with other Federal entities.” (EEI, No. 9, pp. 15-16). They suggested “that the Department notify the CEII submitter and automatically initiate the re-designation process before the CEII designation period expires.” Id. at 16. They also recommended a “default action” of returning or destroying non-CEII and “allowing at least ten days for submitters to comment in writing prior to the removal of CEII designations.” Id.

The Joint Trade Associations described similar concerns. Specifically, their comments expressed unease “that the need for CEII submitters to track designation durations and dates of expiration for potentially numerous CEII submissions over multiple years could be a record-keeping challenge and a potential trap for the unwary that could put CEII designations at risk of inadvertent expiration.” (Joint Trade Associations, No. 15, pp. 11-12). They recommended “revis[ing] the proposed regulations to specify that, like FERC, DOE will continue to treat CEII as non-public even after a designation has lapsed due to the passage of time,” and that “submitters of CEII for which a designation has lapsed would receive notice of any requests for such information (by either a Federal or non-federal entity) and an opportunity to assert that DOE should re-designate the information as CEII.” Id. at 12.

The Department agrees with the comments that the Department could automatically initiate the re-designation process before the CEII designation period expires. Therefore, the Department clarifies there are two methods for initiation of the re-designation process. The Department may automatically initiate the re-designation process or the CEII submitter may request re-designation. Thus, the Department revises § 1004.13(h)(1) to add a subparagraph (iii) to make clear that the Department can also automatically initiate the re-designation process at any time during the duration of the designation.

Furthermore, the Department clarifies that information whose CEII designation has lapsed will not be immediately disclosed to the public. The information would only be disclosed following a review and determination as to whether CEII or other FOIA exemptions are applicable. Should the Department receive a FOIA request for the information, and determine that the information would be responsive to the FOIA request, the submitter or the Department will have an opportunity to contend that the information should be re-designated CEII prior to release. Regardless of the Department's re-designation decision, the aggrieved party could seek reconsideration, after which judicial review would be available if desired.

Finally, the Department cannot return or destroy non-CEII in violation of the Federal Records Act or other applicable laws. The Department therefore declines to institute the default action as the commenters recommended. Instead, the Department will return or destroy non-CEII consistent with applicable law and will make that evaluation on a case-by-case basis.

J. Review or Requests for Reconsideration of Designation

Proposed § 1004.13(i) describes how a submitter may request reconsideration of a decision not to designate CEII, not to release CEII in response to a request for release, or not to maintain an existing CEII designation, and discusses eligibility for judicial review. The subsection also notes that, with several exceptions, a reconsideration request triggers a stay of the underlying decision. The Department would like to clarify that all submitters of information proposed for CEII designation may request reconsideration of a DOE decision not to designate that information as CEII. A request for reconsideration can be made through a secure electronic submission or by mail according to the instructions at 10 CFR 205.12. The Department therefore revises § 1004.13(i) to allow for secure electronic submission or by mail according to the instructions at 10 CFR 205.12.

EarthJustice et al. stated that the Department does not provide due process to challengers of its decisions. The comment accuses the Department's proposed rule of being “little more than an attempt to hide the Department's decision-making process from public scrutiny and obfuscate judicial challenges to the Department's authority.” (EarthJustice et al., No. 3, p. 14). Further, the comment points out that, in contrast to FERC, “[t]he proposed rules notably do not provide any means for parties to Department proceedings to obtain timely access to information that is designated as CEII or preliminarily treated as CEII, and which therefore cannot be accessed by the public.” Id. at 13. The comment stresses that “[d]enying access to information that forms the basis of Department decision-making to parties affected by those decisions is inconsistent with due process.” Id.

In response, the Department emphasizes that the CEII designation procedure is an exercise in balancing a requester's need for information against the Nation's interest in national security. When information does not meet the CEII standard, the Department may disclose it if the Department receives a request under FOIA and the information is not otherwise protected from disclosure. When the Department finds that information qualifies as CEII, the Department will withhold it if the Department receives a FOIA request. Those aggrieved by such decisions have a number of avenues to seek relief, as specified in the rule and in DOE's FOIA regulations.

K. Sharing of CEII

As indicated in proposed § 1004.13(j), DOE may share CEII as necessary to carry out its specific jurisdictional duties pursuant to section 215A of the FPA and as the lead Sector-Specific Agency for cybersecurity for the energy sector under section 61003(c)(2)(A) of the FAST Act, and the Sector-Specific Agency for Energy (Critical Infrastructure) under Presidential Policy Directive 21, “Critical Infrastructure Security and Resilience” (Feb. 12, 2013). Those submitting CEII would have DOE's assurance that the information will be protected from unauthorized disclosure. The Department would follow standardized procedures when sharing CEII with Federal and non-federal entities to ensure the protection of CEII. Non-federal entities would be required to enter into a NDA with the Department, meeting the standards outlined in the proposed rule, prior to receiving CEII from DOE. When a non-federal entity requests such information, the DOE CEII coordinator would notify the submitter of the CEII and the appropriate DOE Office(s), to facilitate coordination and allow the submitter to raise concerns related to a requesting entity. The DOE CEII coordinator would, in consultation with the appropriate DOE Office(s), make a final determination on whether to release any CEII-designated material in response to such a request.

As mentioned above, DOE recognizes the importance of coordination among Federal entities with similar programs, therefore DOE revises § 1004.13(j)(1) to allow for CEII to be shared with other Federal entities without such entities being subject to the procedures set forth in § 1004.13(k). Instead, DOE will evaluate requests by Federal entities for CEII on a case-by-case, fact-specific basis, and may request information from the Federal entity explaining the specific jurisdictional responsibility, and the entity program charged with implementing that responsibility, to be fulfilled by obtaining the CEII. This approach allows DOE to continue its goal of appropriate sharing of CEII within the Federal Government. It also ensures that Federal entities will have access to CEII to carry out jurisdictional responsibilities.

ERCOT urges DOE to reconsider its approach to share CEII with non-federal Entities and instead “[f]or CEII that DOE obtains from external sources, those who can demonstrate a legitimate need for that information should be able to obtain the information directly from the source of that CEII . . .” (ERCOT, No. 14, p. 1). PJM Interconnection LLC (PJM) notes that it “has its own procedures under which requestors may submit requests and obtain CEII directly from PJM . . . PJM is concerned that as written, the proposed DOE rule potentially allows for requesters to circumvent the more rigorous CEII processes of the RTOs by simply going directly to the DOE for the requested information.” (PJM, No. 13, p. 5). PJM recommends DOE revise its proposed regulations “to require a requestor to first seek the information from the submitter of the CEII . . . Ultimately, if a requester is denied access to CEII from the submitter of the information, the requester could still seek the CEII from the Department” (Id. at pp. 5-6). The Joint Trade Associations recommend that “DOE reconsider its proposal to allow sharing of CEII that was not generated by DOE over the objection of the submitting entity in cases where information was voluntarily provided to DOE by the submitter.” (Joint Trade Associations, No. 15, p. 15).

DOE declines to revise its procedures as requested in the comments above. Once the CEII is in the Department's possession, it is the Department's obligation to determine whether to share the information. However, the Department clarifies that it will balance the need for and intended use of the information in the interest of national security against any concerns the CEII submitter has regarding the release of the information. The Department therefore revises § 1004.13(j)(2) to emphasize that a request shall not be entertained unless the requesting non-federal entity can demonstrate that the release of information is in the national security interest. In addition, based on other comments set forth below in Section L, DOE is adopting the criteria set forth in the FERC regulations in § 1004.13(k) for the detailed statement that is required by a requestor of CEII. These criteria provide more specificity with regard to the proposed § 1104.13(k)(2) as to what DOE will expect in the explanation of need provided with a request for CEII.

EEI encourages the Department to clarify and align its procedures for sharing with Federal and non-federal entities. In particular, EEI recommends “that in § 1004.13(j)(1) the Department explicitly require Federal Entities with which the Department shares CEII to protect the CEII from access or disclosure by individuals or organizations that have not been authorized by the Department and limit their use of the CEII.” (EEI, No. 9, p. 19). EEI argues that only requiring minimum protections for CEII shared with non-federal entities creates a disclosure risk for submitters if DOE shares the information with Federal entities. Id. EEI does acknowledge that the Department's procedures allow the Department to impose restrictions on the use and security of the information but without explicitly requiring minimum protections there is a risk that the information could be disclosed inadvertently, knowingly, or willfully to unauthorized individuals or organizations by other Federal entities. Id. EEI encourages the Department to also consider clarifying that the CEII it shares with Federal entities be maintained in accordance with the Department's CEII procedures. Id.

The Department clarifies that a Federal agency in receipt of CEII from the Department must protect that information in the same manner as the Department. That agency will be required to execute an appropriate Agency Acknowledgment and Agreement. The Department has revised § 1004.13(j)(1) to require an authorized agency employee to sign an acknowledgement and agreement that states the agency will protect the CEII in the same manner as the Department and will refer any requests for the information to the Department. Notice of each such request must also be given to the CEII Coordinator, who shall track this information.

PJM points out that “[i]t is unclear from the proposed rule whether the Department intends for the contemplated CEII NDA to apply to each individual request . . . or whether the Department intends for the requester to enter into the CEII NDA once, with such CEII NDA applying to all requests made by the requester for a certain period of time.” (PJM, No. 13, p. 6). PJM recommends “DOE's CEII NDAs to be specific to the requested information, be specific to the named individuals, and subset on their own terms, absent specific requests for renewal after twelve (12) months. Incorporating these parameters into the Department's procedures would avoid the perpetuation of stale NDAs not tied to specific data or signed by individuals no longer employed by the particular entity under which the request was made to the DOE.” Id at 6-7.

The Department revises § 1004.13(j)(2) to clarify that a requester that has entered into a CEII NDA with the Department is not required to file another NDA with subsequent requests during the calendar year because the original NDA must state that the agreement applies to all subsequent releases of CEII during that calendar year. However, the Department does not believe it is necessary to have an NDA be specific to the individual CEII information requested because all CEII will be maintained and protected in the same manner regardless of source or type of information.

The Joint Trade Associations and the Transmission Access Policy Study Group (TAPS) recommend revising the CEII NDA to include specific reference to the public disclosure law exemption. Both parties contend that including the text of the exemption in the NDA would ensure awareness of the limitation among stakeholders. (Joint Trade Associations, No. 15, p. 10; TAPS, No. 7, p. 3). Further, the Joint Trade Associations pointed out that FERC agreed with this recommendation and referenced the provision in section 215A(d)(1) in its CEII NDA. Id.

DOE agrees that the CEII NDA should reference the provision in section 215A(d)(1) that CEII is exempt from disclosure under Federal, State, political subdivision, or tribal law requiring public disclosure. Accordingly § 1004.13(j)(2) has been revised to include this additional requirement.

EEI encourages “the Department to share the minimum-level NDA with stakeholders for notice and comment to enable input from potential submitters and requesters on what can and should be agreed upon in the minimum-level NDAs.” (EEI, No. 9, p. 21). EEI goes on to state that although it does not oppose the development of protocols for sharing CEII with Canadian and Mexican authorities it recommends that the Department allow for notice and comment by stakeholders. Id. at 21-22.

Section 1004.13(j)(2) already includes minimum requirements for an NDA and is not intended to be exhaustive or preclude other requirements. Under certain circumstances, DOE may add additional provisions to the NDA and submitters may request that additional provisions be added to the NDA.

DOE appreciates EEI's concerns about protocols for sharing CEII with Canadian and Mexican authorities. DOE believes stakeholder notice and comment for the development of the protocols is not necessary. DOE clarifies here that a series of bilateral agreements govern and inform its work with Canadian and Mexican Authorities. As the U.S. power grid is integrated with jurisdictions in both Canada and Mexico, DOE fully intends to work closely with Canadian and Mexican authorities. Our three nations have a shared interest in the optimal functionality of our integrated power grid, and DOE will therefore develop sharing protocols that will ensure consistent treatment of information and data.

Section 1004.13(j)(3) was based on section 215A(d)(2)(D) of the FPA. Since the promulgation of § 215A, the Presidential Decision Directive 63, “Critical Infrastructure Protection” (May 22, 1998) referenced in section 215A(d)(2)(D) was superseded by Homeland Security Presidential Directive/HSPD-7, “Critical Infrastructure, Identification, Prioritization, and Protection” (Dec. 17, 2003), which has since been revoked by Presidential Policy Directive 21, “Critical Infrastructure Security and Resilience” (Feb. 12, 2013) (PPD-21). Therefore, DOE includes reference to information sharing and analysis organization (ISAO) defined at 6 U.S.C. 671(5), which defines ISAO as “any formal or informal entity or collaboration created or employed by public or private sector organizations for purposes of gathering and analyzing . . . communicating or disclosing . . . and voluntarily disseminating critical infrastructure information, including cybersecurity risks and incidents.” ISAO includes information sharing and analysis centers. See, e.g., 6 U.S.C. 659(d)(1)(B)(ii).

L. Procedures for Requesting CEII

Proposed § 1004.13(k) delineates procedures for requesting CEII designation and sharing CEII-designated materials. A request must include contact information, an explanation of the need for and intended use of the CEII, and a signed Non-Disclosure Acknowledgment or Agreement, as applicable.

DOE received several comments requesting additional details concerning the criteria and procedures that DOE will apply in responding to requests for release of CEII. For example, EEI recommends that DOE “consider clarifying that it will review the legitimacy of received requests and their associated requestors in making its sharing determination.” (EEI, No. 9, p. 15). MISO stated that “DOE should specify criteria for the review of requestors and requests, and consistently abide by those criteria throughout the DOE Offices when making decisions about sharing CEII.” (MISO, No. 11, p. 4). PJM noted that “the Department should deny a non-federal entity request that merely provides a broad need statement, such as general explanations of the business or profession of the requester or generalized statements that the requester intends to use the CEII in the normal course of the requestor's business or profession.” (PJM, No. 13, p. 3). PJM recommended “the requestor should be required to detail with specificity its need to know the requested information and why a request to DOE for release of CEII is the sole means for it to accomplish the purpose outlined in its request.” Id. at 4. The Joint Trade Associations recommended that “DOE should specify that any entity requesting CEII will be required to make a particularized showing of how its receipt of CEII will accomplish the stated need for the information.” (Joint Trade Associations, No. 15, p. 16). The Sustainable FERC Project and Natural Resources Defense Council recommend that “DOE adopt FERC's language so that there is consistency across agencies.” (The Sustainable FERC Project and Natural Resources Defense Council, No. 10, p. 3).

In response to these comments, DOE is adopting the criteria set forth in the FERC regulations for the detailed statement that is required by a requestor of CEII. In § 1004.13(k), DOE shall consider requests for CEII on a case-by-case basis. In addition, the requestor must provide a detailed statement which includes: (1) The extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) an explanation of whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) an explanation of whether the information is needed expeditiously. As noted in section K, these criteria provide more specificity with regard to the proposed § 1104.13(k)(2) as to what DOE will expect in the explanation of need provided with a request for CEII.

M. Unauthorized Disclosure

In the NOPR, DOE proposed § 1004.13(l), which sets out penalties and sanctions for unauthorized disclosure of CEII, emphasizing that statutory whistleblower protections still apply.

PJM encourages the Department to consider “specifying disciplinary action for non-Department employees or contractors who knowingly or willfully disclose CEII in an unauthorized manner” such as prohibition of making future requests by the requester.” (PJM, No. 13, p. 7). Additionally, PJM recommended the Department “should consider providing remedies to submitters for incidents of knowing or willful disclosure of CEII in an unauthorized manner.” Id.

The Department notes that the FAST Act does not require the Department to develop sanctions for external recipients of CEII. However, in order to ensure non-federal entities understand the serious nature of a knowing or willful disclosure of CEII, DOE will amend its proposed regulations at § 1004.13(l)(2) to state that any action by a Federal or non-federal Entity who knowingly or willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact; makes any materially false, fictitious, or fraudulent statement or representation; or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry to obtain CEII may constitute a violation of other applicable laws and is potentially punishable by fine and imprisonment. DOE will actively pursue all available remedies, including through referrals to appropriate law enforcement entities.

The Department declines to adopt PJM's recommendation that it provide remedies to submitters for incidents of knowing or willful disclosure of CEII in an unauthorized manner. The Department is revising the regulations to specify that knowingly or willfully falsifying information to obtain CEII may constitute a violation of applicable laws and is potentially punishable by fine or imprisonment.

EEI (joined by SoCal Edison) and the Joint Trade Associations expressed concern that inadvertent disclosure of CEII could eliminate that material's status as CEII and lift its FOIA exemption. EEI stated that “it is unclear if an inadvertent disclosure will trigger the Department to remove the CEII designation,” and asked the Department to clarify “the notification procedures for unauthorized CEII disclosures and CEII designation changes.” (EEI, No. 9, p. 13). The Joint Trade Associations asked the Department to “clarify that inadvertent disclosure of CEII by a submitting entity generally would not be a basis for reconsidering/removing a CEII designation.” (Joint Trade Associations, No. 15, p. 4).

The Department clarifies that inadvertent disclosure does not affect the disclosed material's CEII status. Such status is to be determined strictly according to the criteria FERC developed and promulgated in December 2016, as mandated by the FAST Act amendments to the FPA that created the CEII designation authority. Once a CEII designation is applied, the designation continues until it expires or is affirmatively removed.

Nonetheless, it is important to distinguish between inadvertent and deliberate disclosure. As stated in proposed § 1004.13(l)(1), the Department may remove a CEII designation “[i]f the submitter of information [designated CEII] discloses” that information. In response to the comment, the Department revises § 1004.13(l)(1) to emphasize that a CEII designation may be removed following deliberate disclosure, meaning disclosure that is not inadvertent and is sanctioned by the person with ultimate authority to determine whether and how the information is to be shared with the public.

III. Regulatory Review

A. Executive Order 12866 and 13563

This regulatory action has been determined to be a “significant regulatory action” under Executive Order 12866, “Regulatory Planning and Review.” 58 FR 51735 (Oct. 4, 1993). Accordingly, this action was subject to review under that Executive Order by the Office of Information and Regulatory Affairs of the Office of Management and Budget. DOE has also reviewed this regulation pursuant to Executive Order 13563, issued on January 18, 2011. 76 FR 3281 (Jan. 21, 2011). Executive Order 13563 is supplemental to and explicitly reaffirms the principles, structures, and definitions governing regulatory review established in Executive Order 12866. To the extent permitted by law, agencies are required by Executive Order 13563 to: (1) Propose or adopt a regulation only upon a reasoned determination that its benefits justify its costs (recognizing that some benefits and costs are difficult to quantify); (2) tailor regulations to impose the least burden on society, consistent with obtaining regulatory objectives, taking into account, among other things, and to the extent practicable, the costs of cumulative regulations; (3) select, in choosing among alternative regulatory approaches, those approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity); (4) to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt; and (5) identify and assess available alternatives to direct regulation, including providing economic incentives to encourage the desired behavior, such as user fees or marketable permits, or providing information upon which choices can be made by the public.

B. Executive Orders 13771

On January 30, 2017, the President issued Executive Order 13771, “Reducing Regulation and Controlling Regulatory Costs.” 82 FR 9339 (Feb. 3, 2017). That Order stated the policy of the executive branch is to be prudent and financially responsible in the expenditure of funds, from both public and private sources. The Order stated it is essential to manage the costs associated with the governmental imposition of private expenditures required to comply with Federal regulations.

The development and implementation of the procedures, as laid out in section 215A(d) of the FPA, are designed to protect the security and reliability of the nation's bulk-power system, distribution facilities, and other forms of energy infrastructure. The procedures relate solely to marking information that would facilitate voluntary sharing of CEII among DOE and other appropriate Federal, state, or local entities to address emergencies, accidents, or intentional destructive acts affecting the production, transmission, and delivery of energy resources. There is no new reporting requirement and no new program created as a result of the proposed procedures. This information will be stored on currently existing DOE systems.

This final rule is not subject to the requirements of E.O. 13771 (82 FR 9339, February 3, 2017) because this final rule is related to agency organization, management or personnel. Specifically, the rule provides for marking of information submitted to DOE as CEII so that DOE can protect CEII as necessary and appropriate.

C. National Environmental Policy Act

DOE has concluded that promulgation of this rule is covered under the Categorical Exclusion found in DOE's National Environmental Policy Act regulations at paragraph A6 of appendix A to subpart D, 10 CFR part 1021, which applies to rulemakings that are strictly procedural, such as rulemaking (under 48 CFR part 9) establishing procedures for technical and pricing proposals and establishing contract clauses and contracting practices for the purchase of goods and services, and rulemaking (under 10 CFR part 600) establishing application and review procedures for, and administration, audit, and closeout of, grants and cooperative agreements. Accordingly, neither an environmental assessment nor an environmental impact statement is required.

D. Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires preparation of an initial regulatory flexibility analysis for any rule that by law must be proposed for public comment, unless the agency certifies that the rule, if promulgated, will not have a significant economic impact on a substantial number of small entities. As required by Executive Order 13272, “Proper Consideration of Small Entities in Agency Rulemaking,” 67 FR 53461 (Aug. 16, 2002), DOE published procedures and policies on February 19, 2003, to ensure that the potential impacts of its rules on small entities are properly considered during the rulemaking process. 68 FR 7990 (Feb. 19, 2003). DOE's procedures and policies are available on the Office of General Counsel's website: https://energy.gov/​gc/​office-general-counsel.

DOE has reviewed this final rule under the provisions of the Regulatory Flexibility Act and the procedures and policies published on February 19, 2003. This final rule sets forth agency procedures for the designation, sharing, and protection of CEII, and applies to DOE employees, DOE contractors, agents of DOE, and individuals or organizations submitting a request for CEII designation or who have requested or been permitted access to CEII. The proposed procedures for marking incoming requests and/or submissions, which are expected to facilitate voluntary sharing of CEII among DOE and other appropriate Federal, state, or local entities to address emergencies, accidents, or intentional destructive acts to the production, transmission, and delivery of energy resources, are not expected to result in a significant impact to stakeholders. FERC's regulations already require entities requesting CEII designation to mark the subject information. DOE's procedures would provide consistency and would also help avoid unauthorized disclosure or release. DOE therefore expects that these procedures would not affect DOE's decision to designate submitted information as CEII, nor any decision to withhold or release information to requesters of energy infrastructure information under FOIA. On the basis of the foregoing, DOE certifies that this regulation will not have a significant economic impact on a substantial number of small entities. Accordingly, DOE has not prepared a regulatory flexibility analysis for this rulemaking. DOE's certification and supporting statement of factual basis was provided to the Chief Counsel for Advocacy of the Small Business Administration pursuant to 5 U.S.C. 605(b) and the Department did not receive any comments on the certification or the economic impacts of the rule.

E. Paperwork Reduction Act

Pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA) and the procedures implementing that Act at 5 CFR part 1320 require the Office of Management and Budget to review and approve certain information collection requirements imposed by agency rule. This Final Rule does not impose any additional information collection requirements. Therefore, the information collection regulations do not apply to this Final Rule.

F. Unfunded Mandates Reform Act of 1995

The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) generally requires Federal agencies to examine closely the impacts of regulatory actions on State, local, and tribal governments. Section 101(5) of title I of that law defines a Federal intergovernmental mandate to include any regulation that would impose upon State, local, or tribal governments an enforceable duty, except a condition of Federal assistance or a duty arising from participating in a voluntary Federal program. Title II of that law requires each Federal agency to assess the effects of Federal regulatory actions on State, local, and tribal governments, in the aggregate, or to the private sector, other than to the extent such actions merely incorporate requirements specifically set forth in a statute. Section 202 of that title requires a Federal agency to perform a detailed assessment of the anticipated costs and benefits of any rule that includes a Federal mandate that may result in costs to State, local, or tribal governments, or to the private sector, of $100 million or more in any one year (adjusted annually for inflation). 2 U.S.C. 1532(a) and (b). Section 204 of that title requires each agency that proposes a rule containing a significant Federal intergovernmental mandate to develop an effective process for obtaining meaningful and timely input from elected officers of State, local, and tribal governments. 2 U.S.C. 1534.

This rule will not result in the expenditure by State, local, and tribal governments in the aggregate, or by the private sector, of $100 million or more in any one year. Accordingly, no assessment or analysis is required under the Unfunded Mandates Reform Act of 1995.

G. Treasury and General Government Appropriations Act, 1999

Section 654 of the Treasury and General Government Appropriations Act, 1999 (Pub. L. 105-277) requires Federal agencies to issue a Family Policymaking Assessment for any rule that may affect family well-being. This rule will not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has concluded that it is not necessary to prepare a Family Policymaking Assessment.

H. Executive Order 13132

Executive Order 13132, “Federalism,” 64 FR 43255 (Aug. 4, 1999), imposes certain requirements on agencies formulating and implementing policies or regulations that preempt State law or that have Federalism implications. Agencies are required to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and carefully assess the necessity for such actions. DOE has examined the rule and has determined that it will not preempt State law and will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. No further action is required by Executive Order 13132.

I. Executive Order 12988

With respect to the review of existing regulations and the promulgation of new regulations, section 3(a) of Executive Order 12988, “Civil Justice Reform,” 61 FR 4729 (Feb. 7, 1996), imposes on Executive agencies the general duty to adhere to the following requirements: (1) Eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; and (3) provide a clear legal standard for affected conduct rather than a general standard and promote simplification and burden reduction. Section 3(b)(2) of Executive Order 12988 specifically requires that Executive agencies make every reasonable effort to ensure that the regulation: (1) Clearly specifies the preemptive effect, if any, to be given to the regulation; (2) clearly specifies any effect on existing Federal law or regulation; (3) provides a clear legal standard for affected conduct while promoting simplification and burden reduction; (4) specifies the retroactive effect, if any, to be given to the regulation; (5) defines key terms; and (6) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of Executive Order 12988 requires Executive agencies to review regulations in light of applicable standards in section 3(a) and section 3(b) to determine whether they are met or it is unreasonable to meet one or more of the standards. DOE has completed the required review and determined that, to the extent permitted by law, the rule meets the relevant standards of Executive Order 12988.

J. Treasury and General Government Appropriations Act, 2001

The Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516 note) provides for agencies to review most disseminations of information to the public under guidelines established by each agency pursuant to general guidelines issued by OMB.

OMB's guidelines were published at 67 FR 8452 (Feb. 22, 2002), and DOE's guidelines were published at 67 FR 62446 (Oct. 7, 2002). DOE has reviewed this rule under the OMB and DOE guidelines and has concluded that it is consistent with applicable policies in those guidelines.

K. Executive Order 13211

Executive Order 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 22, 2001), requires Federal agencies to prepare and submit to the OMB a Statement of Energy Effects for any proposed significant energy action. A “significant energy action” is defined as any action by an agency that promulgated or is expected to lead to promulgation of a final rule, and that (1) is a significant regulatory action under Executive Order 12866, or any successor order and is likely to have a significant adverse effect on the supply, distribution, or use of energy; or (2) is designated by the Administrator of the OIRA as a significant energy action. For any proposed significant energy action, the agency must give a detailed statement of any adverse effects on energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution, and use. This regulatory action will not have a significant adverse effect on the supply, distribution, or use of energy because it is concerned primarily with the procedures for designating, protecting, and sharing information. As the FAST Act highlighted, protection of CEII will have a positive effect on the energy supply, and is therefore not a significant energy action. Accordingly, DOE has not prepared a Statement of Energy Effects.

L. Congressional Notification

As required by 5 U.S.C. 801, DOE will submit to Congress a report regarding the issuance of this final rule prior to the effective date set forth at the outset of this rulemaking. The report will state that it has been determined that the rule is not a “major rule” as defined by 5 U.S.C. 801(2).

IV. Approval of the Office of the Secretary

The Secretary of Energy has approved publication of this final rulemaking.

List of Subjects in 10 CFR Part 1004

  • Freedom of Information

Signed in Washington, DC, on February 28, 2020.

Dan Brouillette,

Secretary of Energy.

For the reasons set out in the preamble, the DOE amends part 1004 of title 10, Code of Federal Regulations as set forth below:

PART 1004—FREEDOM OF INFORMATION ACT (FOIA)

1. The authority citation for part 1004 is revised to read as follows:

Authority: 5 U.S.C. 552; 16 U.S.C. 824o-1.

2. Add § 1004.13 to read as follows:

§ 1004.13
Critical electric infrastructure information.

(a) Filing Procedures and guidance. Information regarding critical electric infrastructure information (CEII) filing procedures and further guidance for submitters and requesters is available on the website of the United States Department of Energy's Office of Electricity at https://www.energy.gov/​oe/​office-electricity.

(b) Purpose and scope. This part sets forth the regulations of the Department of Energy (DOE) that implement section 215A(d) of the Federal Power Act (FPA), codified at 16 U.S.C. 824o-1(d). The regulations in this part set forth the DOE procedures for the designation, sharing, and protection of CEII. This section applies to anyone who provides CEII to DOE or who receives CEII from DOE, including DOE employees, DOE contractors, and agents of DOE or of other Federal agencies, as well as individuals or organizations providing CEII or submitting a request for CEII designation to DOE or who have requested or have been permitted access to CEII by DOE.

(c) Definitions—(1) Bulk-Power System means the facilities and control systems necessary for operating an interconnected electric energy transmission network (and any portion thereof), and electric energy from generation facilities needed to maintain transmission system reliability. The term does not include facilities used in the local distribution of electric energy.

(2) Confidential Business Information means commercial or financial information that is both customarily and actually treated as private by its owner and that is provided to the government as part of a claimed CEII submission.

(3) Critical Electric Infrastructure means a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.

(4) Critical Electric Infrastructure Information (CEII) is defined at FPA section 215(a)(3), with designation criteria codified at 18 CFR 388.113(c). CEII means information related to critical electric infrastructure, or proposed critical electrical infrastructure, generated by or provided to FERC or another Federal agency, other than classified national security information, that is designated as CEII by FERC or the Secretary pursuant to section 215A(d) of the FPA. Such term includes information that qualifies as critical energy infrastructure information under FERC's regulations.

(5) CEII Coordinator means the Assistant Secretary or Principal Deputy Assistant Secretary of the DOE Office of Electricity, who shall coordinate and oversee the implementation of DOE's program for CEII-designation authority under section 215A of the FPA, assist all DOE Offices with respect to requests for CEII designation in determining whether particular information fits within the definition of CEII, and manage DOE's protection, storage, and sharing of CEII materials and oversight of the development of CEII international sharing protocols. The CEII Coordinator may delegate the daily implementation of the CEII Coordinator function as described in this rule, in whole or in part, to an appropriate DOE Office of Electricity official, to an Assistant Secretary in DOE, and to the Administrator of the Bonneville Power Administration, the Energy Information Administration, the Southeastern Power Administration, the Southwestern Power Administration, or the Western Area Power Administration (“Coordinator's designee”).

(6) Department means the United States Department of Energy.

(7) Department of Energy (DOE) means all organizational entities that are part of the Executive Department created by Title II of the DOE Organization Act (Pub. L. 95-91, 91 Stat. 565, 42 U.S.C. 7101 et seq.). For purposes of this Part, the definition of DOE specifically excludes the Federal Energy Regulatory Commission, which has promulgated its own CEII procedures at 18 CFR 388.113.

(8) DOE Office means any administrative or operating unit of DOE with authority at or above the level of Assistant Secretary, Principal Deputy Assistant Secretary, or Administrator.

(9) Secretary means the Secretary of Energy.

(d) Authority to designate information as CEII. The Secretary has the authority to designate information as CEII, in accordance with FPA section 215A. The Secretary may delegate the authority to designate information as CEII to any DOE Office.

(e) Coordination among DOE Office designators. The DOE CEII Coordinator shall be the primary point of contact for the submission of all requests for designation of information as CEII by DOE, as well as for requests made to DOE by organizations or individuals for information that may be protected, in whole or in part, as CEII.

(1) The CEII Coordinator or Coordinator's designee shall:

(i) Receive and review all incoming requests for CEII as defined in paragraph (c) of this section and in accordance with paragraph (g) of this section;

(ii) Make initial determinations as to whether particular information fits within the definition of CEII found in paragraph (c) of this section;

(iii) Assist any DOE Offices with delegated CEII designation authority to make determinations as to whether a particular requester's need for and ability and willingness to protect CEII warrants limited disclosure of the information to the requester;

(iv) Establish reasonable conditions for considering requests for release of CEII-designated material in accordance with paragraphs (g)(5) and (6) of this section;

(v) Make the Department's final determination regarding a request by any non-federal entity (organization or individual) for CEII-designated materials, in consultation with the appropriate DOE Office(s);

(vi) Notify a CEII submitter of a request for such information by a non-federal entity;

(vii) Convene a conference call between an affected DOE Office and a CEII submitter to discuss concerns related to a non-federal entity requesting release of CEII within no more than five (5) business days after the CEII submitter is notified of the request, providing the CEII submitter with a copy of the request prior to the conference call; and

(viii) Perform oversight of the DOE CEII program and establish guidance for the treatment, handling, and storage of all CEII materials in the Department in accordance with paragraph (g)(6) of this section, including those related to CEII international sharing protocols.

(2) DOE Offices with delegated authority to designate CEII in accordance with paragraph (d) of this section, as well as any CEII Coordinator designee(s), will meet regularly, at the discretion of the CEII Coordinator, but not less than once per year, to ensure coordinated implementation of DOE's CEII designation authority.

(3) DOE, at the discretion of the CEII Coordinator, shall meet with representatives from the Federal Energy Regulatory Commission semi-annually (or more often, as necessary) to ensure that both agencies are applying CEII designation criteria consistently and to share best practices.

(4) DOE, at the discretion of the CEII Coordinator, shall meet at least once per year with representatives from the Department of Commerce including the National Telecommunications and Information Administration, the Department of Homeland Security, the Nuclear Regulatory Commission, and other Federal agencies, as needed, to ensure shared understanding and consistent communication among Federal agencies that collect, maintain, and potentially release information that DOE may consider designating as CEII as defined in paragraph (c) of this section.

(f) CEII FOIA Exemption. All information designated by DOE as CEII is exempt from disclosure under the Freedom of Information Act, 5 U.S.C. 552(b)(3) and shall not be made available by any Federal, state, political subdivision, or tribal authority pursuant to any Federal, State, political subdivision, or tribal law requiring public disclosure of information or records pursuant to section 215A(d)(1)(A) and (B) of the Federal Power Act.

(g) Criteria and procedures for designating CEII—(1) Criteria. The CEII Coordinator or Coordinator's designee shall apply the definition of CEII as provided in paragraph (c) of this section, consistent with FPA section 215A(a)(3), and with designation criteria codified at 18 CFR 388.113(c), to information sought by DOE and to information submitted to DOE with a request for designation.

(2) Requesting CEII designation of information submitted to DOE. Any person or entity requesting that information submitted to DOE be designated as CEII must submit such request to the DOE CEII Coordinator or Coordinator's designee according to the following procedures:

(i) The submitter must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.”

(ii) The submitter must clearly label the cover page and pages or portions of information that it considers Confidential Business Information in bold, capital lettering, indicating that it contains Confidential Business Information, as appropriate, and marked “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” If combined with a CEII label, the information should be marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.”

(iii) The submitter must also clearly indicate the DOE Office(s) from which the CEII designation is being requested in bold, capital lettering on the cover page.

(iv) The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible.

(v) The submitter must also label and segregate information that it classifies as Confidential Business Information under the definition at paragraph (c)(2) of this section with the mark “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” Under separate cover, the submitter may, but is not required to, submit a written justification of why the labeled information meets the definition at paragraph (c)(2) of this section.

(vi) The submitter must submit a public version of the information where information designated CEII and information for which CEII designation is requested is redacted or otherwise protected through extraction from the non-CEII to the DOE CEII Coordinator and the Coordinator's designee in an appropriate DOE Office, where feasible. If the entirety of submitted information is CEII, the submitter must indicate that, but no separate public version is required.

(3) Requesting CEII designation for information generated by DOE. Any DOE employees, DOE contractors, or agents of DOE requesting that information generated by the Department be designated as CEII must submit such request to the DOE CEII Coordinator or the Coordinator's designee in an appropriate DOE Office according to the following procedures:

(i) The submitter must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.”

(ii) The submitter must also segregate those portions of the information that contain CEII (or information that reasonably could be expected to lead to the disclosure of the CEII) wherever feasible.

(iii) The submitter must submit a public version of the information where information designated CEII and information for which CEII designation is requested is redacted or otherwise protected through extraction from non-CEII.

(iv) CEII designation for information generated by DOE, to include all organizational entities that are a part of the Executive Department created by Title II of the DOE Organization Act, may be executed at any time, regardless of when such information was generated, where feasible.

(4) Treatment of Submitted Information. (i) Upon receiving a request for CEII designation of information submitted to DOE, the DOE CEII Coordinator or Coordinator's designee shall review the submission made in accordance with paragraph (g)(2) of this section.

(ii) Information for which CEII treatment is requested will be maintained by the CEII Coordinator or Coordinator's designee in DOE's files as non-public unless and until DOE completes its determination that the information is not entitled to CEII treatment. This approach does not mean that DOE has made a determination regarding CEII designation, and should under no circumstances be construed as such. DOE will endeavor to make a determination as soon as practicable. The Department retains the right to make determinations about any request for CEII designation at any time, including the removal of a previously granted CEII designation. At such time that a determination is made that information does not meet the CEII criteria, DOE will follow the procedures for return of information not designated as CEII outlined in paragraph (g)(6)(iii) of this section.

(iii) When a requester seeks information for which CEII status has been requested but not designated, or when DOE itself is considering release of such information, DOE will render a decision on designation before responding to the requester or releasing such information. Subsequently, the release of information will be treated in accordance with the procedures established for CEII-designated material, or the return of information not designated as CEII.

(5) Evaluation of CEII designation criteria to inform CEII designation determination. (i) The DOE CEII Coordinator, or a Coordinator's designee, will execute the Department's evaluation as to whether the submitted information or portions of the information meets the definition of CEII, as described at paragraph (c)(2) of this section, with the appropriate DOE Office with delegated CEII designation authority. The DOE Office will designate submitted information as soon as practicable and will inform submitters of the designation date if requested at the time of submission.

(ii) [Reserved]

(6) CEII Determination. (i) DOE CEII Coordinator makes CEII designation determination. The Secretary or delegated DOE Office will make a determination regarding CEII designation after considering the information against the criteria for CEII designation. The DOE CEII Coordinator or Coordinator's designee shall promptly communicate the decision of the Secretary or delegated DOE Office to the submitter.

(ii) Review of determination. DOE reserves the right to review at any time information designated by DOE as CEII to determine whether the information is properly designated. The designation of information as CEII, or the removal of such designation, must be reviewed when:

(A) A FOIA request is submitted for the information under § 1004.10; or

(B) A request is made for reconsideration of the designation or removal of the designation under paragraph (i)(1) of this section.

(iii) Return of Information not designated as CEII. Because the submitter voluntarily provided the information to DOE, at the request of the submitter, DOE will return or destroy information for which CEII designation was requested but not granted, and will attempt to remove all copies of such information from DOE files, both physical and electronic. DOE shall return or destroy non-CEII consistent with the Federal Records Act, and DOE handling of agency records in accordance with DOE Order O.243.1A, Records Management Program, and related requirements and responsibilities for implementing and maintaining an efficient and economic records management program in accordance with law and regulatory requirements. DOE shall not remove electronic files in the ordinary course of business. If a submitter is required to provide information and DOE denies CEII designation, the submitter may file a request for review under the procedures.

(7) Protection of CEII—(i) Marking of CEII. All information designated by DOE as CEII, whether submitted to or generated by DOE, shall be clearly labeled as such, and shall include the date on which the information was designated as CEII. For information that meets the definition of CEII but cannot be physically labeled, such as electronic information, the information shall be—

(A) Electronically marked with the words “CEII—CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE” in the electronic file name; or

(B) Transmitted under a Non-Disclosure Agreement or other agreements or arrangements, such as those identified in paragraph (j)(3) of this section, to an electronic system where such information is stored in a secure electronic environment that identifies the stored information as CEII.

(ii) Protection and Exemption from Disclosure. All information designated by DOE as CEII is exempt from FOIA and shall not be made available as provided in paragraph (f) of this section.

(iii) Secure Storage. DOE will store information for which CEII treatment is requested in a secure place in a manner that would prevent unauthorized access (e.g. locked room or file cabinet). Information submitted to DOE in electronic format shall be stored in a secure electronic environment that identifies the stored information as CEII.

(8) Protection of Confidential Business InformationExemption Determination. DOE will evaluate information claimed as Confidential Business Information if, and at such time as, a valid FOIA request is submitted and the information is otherwise responsive to the request. DOE will conduct the evaluation pursuant to procedures set forth in this part. In its evaluation, DOE will consult any supplementary justification provided by the submitter as described at paragraph (f)(1)(iv) of this section.

(h) Duration of designation. Designation of information as CEII shall be a five-year period, unless removed or re-designated.

(1) Expiration of designation. (i) The Secretary or delegated DOE Office will determine the duration of designation at the time of designation.

(ii) A submitter may re-apply for CEII designation no earlier than one year prior to the date of expiration of the initial designation or re-designation in accordance with the application procedures in paragraph (g)(1) of this section.

(iii) The Secretary, the DOE CEII Coordinator, or a Coordinator's designee may initiate CEII designation at any time prior to the date of expiration of the initial designation or re-designation.

(2) Removal of designation. The designation of information as CEII may be removed at any time, by the Secretary or the DOE CEII Coordinator in consultation with the DOE Office to which the Secretary has delegated the authority, in whole or in part, upon determination that the unauthorized disclosure of such information could no longer be used to impair the security or reliability of the bulk-power system or distribution facilities or any other form of energy infrastructure. If the CEII designation is to be removed, the submitter and the DOE Office that produced or maintains the CEII will receive electronic notice stating that the CEII designation will be removed at least nine (9) business days before disclosure. In such notice, the DOE CEII Coordinator or Coordinator's designee will provide the submitter and the DOE Office that produced or maintains the CEII an opportunity (at least nine (9) business days) in which to comment in writing prior to the removal of the designation. The final determination will briefly explain DOE's determination.

(3) Treatment of information no longer designated as CEII. If a FOIA request is received for information for which CEII designation has expired or has been removed, DOE will work with the submitter to review whether the information is subject to other FOIA exemptions. DOE will destroy non-CEII consistent with the Federal Records Act, and DOE handling of agency records in accordance with DOE Order O.243.1A, Records Management Program, and related requirements and responsibilities for implementing and maintaining an efficient and economic records management program in accordance with law and regulatory requirements.

(i) Review or requests for reconsideration of designation—(1) Request for Reconsideration. (i) Any person who has submitted information and requested such information to be designated as CEII may request reconsideration of a DOE decision not to designate that information as CEII, or to remove an existing CEII designation, on grounds that the information does not meet the required CEII criteria. Within ten (10) business days of notification by DOE of its CEII decision, the person must file a request for reconsideration. The request must be sent to the DOE CEII Coordinator and Coordinator's designee through a secure electronic submission or by mail according to the instructions at 10 CFR 205.12. The request must also be sent to the DOE Office that made the decision at issue and to DOE's Office of General Counsel in Washington, DC, according to the instructions at 10 CFR 205.12. A statement in support of the request for reconsideration must be submitted within twenty (20) business days of the date of the determination. The request and the supporting statement will be considered submitted upon receipt by the Office of the General Counsel.

(ii) Any person who has received a decision denying a request for the release of CEII, in whole or in part, or a decision denying a request to change the designation of CEII, may request reconsideration of that decision. A statement in support of the request for reconsideration must be submitted to the DOE Office of the General Counsel within twenty (20) business days of the date of the determination.

(iii) The Secretary or the DOE Office that made the decision at issue will make a determination, in coordination with the DOE CEII Coordinator or Coordinator's designee, with respect to any request for reconsideration within twenty (20) business days after the receipt of the request and will notify the person submitting the request of the determination and the availability of judicial review.

(iv) Before seeking judicial review in Federal District Court under section 215A(d)(11) of the FPA, a person who received a determination from DOE concerning a CEII designation must first request reconsideration of that determination.

(v) A request for reconsideration triggers a stay of the underlying decision, except in instances where voluntary sharing of the disputed information is necessary for law enforcement purposes, to ensure reliable operation or maintenance of electric or energy infrastructure, to maintain infrastructure security, to address potential threats, or to address an urgent need to disseminate the information quickly due to an emergency or other unforeseen circumstance.

(j) Sharing of CEII—(1) Federal Entities. An employee of a Federal entity acting within the scope of his or her Federal employment may obtain CEII directly from DOE without following the procedures outlined in paragraph (k) of this section. DOE will evaluate requests by Federal entities for CEII on a programmatic, fact-specific basis. DOE may share CEII with affected agencies for those agencies to carry out their specific jurisdictional responsibilities, but it may impose additional restrictions on how the information may be used and maintained. To obtain access to CEII, an authorized agency employee must sign an acknowledgement and agreement that states the agency will protect the CEII in the same manner as the Department and will refer any requests for the information to the Department. Notice of each such request also must be given to the CEII Coordinator.

(2) Non-federal Entities. The Secretary or the CEII Coordinator shall make a final determination whether to share CEII materials requested by non-federal entities that are within the categories specified in section 215A(d)(2)(D) of the FPA. A request by such a non-federal entity shall not be entertained unless the requesting non-federal entity demonstrates that the release of information is in the national security interest and it has entered into a Non-Disclosure Agreement with DOE that ensures, at a minimum:

(i) Use of the information only for authorized purposes and by authorized recipients and under the conditions prescribed by the Secretary or CEII Coordinator;

(ii) Protection of the information in a secure manner to prevent unauthorized access;

(iii) Destruction or return of the information after the intended purposes of receiving the information have been fulfilled;

(iv) Prevention of viewing or access by individuals or organizations that have been prohibited or restricted by the United States or the Department from viewing or accessing CEII;

(v) Compliance with the provisions of the Non-Disclosure Agreement, subject to DOE audit;

(vi) No further sharing of the information without DOE's permission; and

(vii) CEII provided pursuant to the agreement is not subject to release under the Freedom of Information Act, 5 U.S.C. 552(b)(3), and shall not be made available by any Federal, state, political subdivision, or tribal authority pursuant to any Federal, State, political subdivision, or tribal law requiring public disclosure of information or records pursuant to sections 215A(d)(1)(A) and (B) of the Federal Power Act.

(viii) The Non-Disclosure Agreement must state that the agreement applies to all subsequent releases of CEII during the calendar year in which the DOE and the non-federal entity enter into the agreement. As a result, the non-federal entity will not be required to file a Non-Disclosure Agreement with subsequent requests during the calendar year.

(3) Security and Reliability Coordination. In accordance with section 215A(d)(2)(D) of the FPA, DOE may, taking into account standards of the Electric Reliability Organization, facilitate voluntary sharing of CEII with, between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers or information sharing and analysis organizations; reliability coordinators; balancing authorities; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate. All entities receiving CEII must execute either a Non-Disclosure Agreement or an Acknowledgement and Agreement or participate in an Electric Reliability Organization or Regional Entity information sharing program that ensures the protection of CEII. A copy of each agreement or program will be maintained by the DOE Office with a copy to the CEII Coordinator or the Coordinator's designee. If DOE facilitates voluntary sharing of CEII under this subsection, DOE may impose additional restrictions on how the information may be used and maintained.

(4) International Sharing Protocols. The Secretary may delegate authority to DOE Offices to develop, after consultation with Canadian and Mexican authorities, protocols for the voluntary sharing of CEII with Canadian and Mexican authorities and owners, operators, and users of the bulk-power system outside the United States. The DOE CEII Coordinator or Coordinator's designee would provide assistance and advice to DOE Offices in the development of the international sharing protocols.

(5) Notice for Sharing of CEII not Generated by DOE. The DOE CEII Coordinator or Coordinator's designee will provide electronic notice to the CEII submitter no less than ten (10) business days before DOE releases CEII submitted to and not generated by DOE, except in instances where voluntary sharing is necessary for law enforcement purposes, to ensure reliable operation or maintenance of electric or energy infrastructure, to maintain infrastructure security, or to address potential threats; where there is an urgent need to quickly disseminate the information; or where prior notice is not practicable due to an emergency or other unforeseen circumstance. If prior notice is not given, DOE will provide notice as soon as practicable. The DOE CEII Coordinator or Coordinator's designee will convene a phone call within five (5) business days of electronic notice with the CEII submitter to discuss concerns about the proposed release of CEII-designated materials to the requester. DOE will make the final determination as to whether to share CEII not generated by DOE.

(k) Procedures for requesting CEII. DOE shall consider requests for CEII on a case-by-case basis. Any person requesting CEII must include the following material with the request:

(1) Contact Information. Provide your name, title and employer, work address, work phone number, and work email. If you are requesting the information on behalf of a person or entity other than yourself, you must also list that person's or entity's work contact information, including name, title, address, phone number, and email.

(2) Explanation of Need. Provide a detailed statement explaining the particular need for and intended use of the information. This statement must include:

(i) The extent to which a particular function is dependent upon access to the information;

(ii) Why the function cannot be achieved or performed without access to the information;

(iii) An explanation of whether other information is available to the requester that could facilitate the same objective;

(iv) How long the information will be needed;

(v) Whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and

(vi) An explanation of whether the information is needed expeditiously.

(3) Signed Non-Disclosure Acknowledgement/Agreement. Provide an executed Non-Disclosure Acknowledgement (if the requester is a Federal entity) or an executed Non-Disclosure Agreement (if the requester is not a Federal entity) requiring adherence to limitations on the use and disclosure of the information requested.

(4) DOE evaluation. Upon receiving a request for CEII, the CEII Coordinator shall contact the DOE Office or Federal agency that created or maintains the CEII. In consultation with the DOE Office, the CEII Coordinator shall carefully consider the statement of need provided by the requester and determine if the need for CEII and the protection afforded to the CEII should result in sharing CEII for the limited purpose identified in the request. If the CEII Coordinator or Coordinator's designee denies the request, the requestor may seek reconsideration, as provided in paragraph (i) of this section.

(l) Disclosure— (1) Disclosure by submitter of information. If the submitter of information deliberately discloses to the public information that has received a CEII designation, then the Department reserves the right to remove its CEII designation.

(2) Disciplinary Action for Unauthorized Disclosure. DOE employees or contractors who knowingly or willfully disclose CEII in an unauthorized manner will be subject to appropriate sanctions, including disciplinary action under DOE or DOE Office personnel rules or referral to the DOE Inspector General. Any action by a Federal or non-federal Entity who knowingly or willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact; makes any materially false, fictitious, or fraudulent statement or representation; or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry to obtain CEII may also constitute a violation of other applicable laws and is potentially punishable by fine and imprisonment.

(3) Whistleblower protection. In accordance with the Whistleblower Protection Enhancement Act of 2012 (Pub. L. 112-199, 126 Stat. 1465), the provisions of this rule are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute relating to:

(i) Classified information;

(ii) Communications to Congress;

(iii) The reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety; or

(iv) Any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling statutory provisions are not affected by this rule.

Footnotes

1.  On February 14 and 15, 2018, DOE's Office of Electricity (OE) (known at the time as DOE's Office of Electricity Delivery and Energy Reliability) and Office of Policy convened an ex-parte meeting with representatives from energy industry, local, state, and Federal government agencies to discuss issues, challenges, and opportunities in CEII-sharing frameworks and optional information sharing protections and protocols leading up to the development of this proposed rule. A memorandum summarizing this meeting is available at https://www.regulations.gov/​docket?​D=​DOE-HQ-2019-0003 and https://www.energy.gov/​gc/​legal-resources/​ex-parte-communications.

Back to Citation

[FR Doc. 2020-04640 Filed 3-13-20; 8:45 am]

BILLING CODE 6450-01-P


Tried the LawStack mobile app?

Join thousands and try LawStack mobile for FREE today.

  • Carry the law offline, wherever you go.
  • Download CFR, USC, rules, and state law to your mobile device.