AGENCY:

Office of Electricity, U.S. Department of Energy.

ACTION:

Final rule.

SUMMARY:

The U.S. Department of Energy (DOE or Department) publishes this final rule to implement DOE's critical electric infrastructure information (CEII) designation authority under the Federal Power Act (FPA). In this final rule, DOE establishes administrative procedures intended to ensure that stakeholders and the public understand how the Department would designate, protect, and share CEII.

DATES:

The effective date of this rule is May 15, 2020.

ADDRESSES:

The docket for this rulemaking, which includes Federal Register notices, comments, and other supporting documents/materials, is available for review at https://www.regulations.gov. All documents in the docket are listed in the https://www.regulations.gov index. However, not all documents listed in the index, such as those containing information that is exempt from public disclosure by law, may be publicly available. A link to the docket web page can be found at https://www.regulations.gov/​docket?​D=​DOE-HQ-2019-0003. The docket web page explains how to access all documents, including public comments, in the docket.

FOR FURTHER INFORMATION CONTACT:

Michael Coe, U.S. Department of Energy, Office of Electricity, Mailstop OE-20, Room 8H-033, 1000 Independence Avenue SW, Washington, DC 20585; (202) 287-5166; or oeregs@hq.doe.gov.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction

II. Discussion of Final Rule

A. Background

B. Filing Procedures and Guidance

C. Purpose and Scope

D. Definitions

E. Authority to Designate Information as CEII

F. Coordination Among DOE Office Designators

G. CEII FOIA Exemption

H. Criteria and Procedures for Designating CEII

I. Duration of Designation

J. Review or Requests for Reconsideration of Designation

K. Sharing of CEII

L. Procedures for Requesting CEII

M. Unauthorized Disclosure

III. Regulatory Review

A. Executive Orders 12866 and 13563

B. Executive Orders 13771, 13777, and 13783

C. National Environmental Policy Act

D. Regulatory Flexibility Act

E. Paperwork Reduction Act

F. Unfunded Mandates Reform Act of 1995

G. Treasury and General Government Appropriations Act, 1999

H. Executive Order 13132

I. Executive Order 12988

J. Treasury and General Government Appropriations Act, 2001

K. Executive Order 13211

L. Congressional Notification

IV. Approval of the Office of the Secretary

I. Introduction

In this final rule, the Department of Energy (DOE) establishes procedures for the designation of critical electric infrastructure information (CEII) under section 215A(d) of the Federal Power Act (FPA). Section 61003 of the Fixing America's Surface Transportation Act (FAST Act), Public Law 114-94, added section 215A to the FPA. The new section authorizes both the Secretary of Energy (the Secretary) and the Federal Energy Regulatory Commission (FERC) independently to designate CEII. Under section 215A(d)(1) of the FPA, a CEII designation exempts the data or information so designated from disclosure under the Freedom of Information Act (FOIA) and other laws requiring government disclosure of certain information or records. 16 U.S.C. 824o-1(d)(1); 5 U.S.C. 552(b)(3). Section 215A(d)(2) required FERC, after consultation with the Secretary and within a year of the FAST Act's enactment, to “promulgate such regulations as necessary to . . . establish criteria and procedures to designate information as [CEII].” 16 U.S.C. 824o-1(d)(2). FERC did so, following a notice-and-comment rulemaking similar to the instant rulemaking. Order No. 833, Regulations Implementing FAST Act Section 61003—Critical Electric Infrastructure Security and Amending Critical Energy Infrastructure Information; Availability of Certain North American Electric Reliability Corporation Databases to the Commission, FERC Docket Nos. RM16-15-000 and RM15-25-001, 157 FERC ¶ 61,123 (2016), order on reh'g & clarification, Order No. 833-A, FERC Docket No. RM16-15-001, 163 FERC ¶ 61,125 (2018). While this rulemaking established criteria for designating CEII applicable to both FERC and the Department, the designation procedures in the rulemaking were limited to FERC. Thus, on October 29, 2018, the Department published a Notice of Proposed Rulemaking (NOPR) to establish its own designation procedures. (83 FR 54274) This final rule establishes DOE's designation procedures, which are consistent with the procedures established by FERC to the maximum extent possible.

The Department is committed to improving the resilience, reliability, and security of the Nation's electricity delivery system. Consistent with its statutory authorities and ongoing work with energy sector entities in furtherance of that mission, the Department anticipates that the majority of CEII the Department will receive will be voluntary submissions, scoped in collaboration with the submitting entity, and for which DOE may often make a CEII designation based on the scoping prior to submission. DOE's role with respect to CEII is not expected to be related to its regulatory functions, and DOE expects that nearly all potential CEII sent to DOE will be voluntary submissions tied to specific programs. The Department anticipates receiving a smaller volume of CEII material than FERC does given the regulatory requirements for mandatory FERC filings by the electricity industry, giving DOE the flexibility to engage in more proactive designations. Even if the submission relates to a DOE regulatory function, DOE will still evaluate it based on the procedures set forth in this rule on whether to designate the information as CEII. If organizations and individuals submit material to DOE, the Department recommends adding all appropriate FOIA exemption markings, as the material may be both Confidential Business Information (CBI) and CEII. Based on the recent opinion of the Supreme Court of the United States in Food Marketing Institute v. Argus Leader Media (No. 18-481), which effectively broadens the scope of data and information that are eligible for the fourth exemption from disclosure under FOIA, DOE notes that all entities submitting information for CEII designation under this rule should also specify whether the material is Confidential Business Information under the new legal standard.

DOE received a total of fourteen (14) written comments in response to the NOPR, all of which are available at https://www.regulations.gov. Generally, the comments addressed the following issues: Scope, purpose, and definitions; authority to designate information as CEII; coordination among DOE Office designators; criteria and procedures for determining what constitutes CEII; duration of designation of CEII; sharing of CEII; and sanctions for unauthorized disclosure of CEII. DOE responds to the comments received in the discussion of the final rule in Section II below.

II. Discussion of Final Rule

A. Background

After FERC published its CEII designation criteria and procedures, DOE began its rulemaking to establish administrative procedures regarding how the Department would designate, protect, and share CEII. The Department follows the designation criteria FERC has already formulated, but establishes its own procedures for such designation in this final rule. These procedures differ from those established by FERC in that DOE's procedures provide additional time to coordinate with parties that submit CEII to DOE. However, the agencies' overall procedures are similar in providing specific information when requesting that submitted information be designated as CEII, as well as procedures for appealing a CEII designation determination. The Department's rule is consistent with FERC's rule to the maximum extent possible, so that the fundamental objectives of the CEII statutory program will be met regardless of whether the information is submitted to the Department or to FERC.

The Canadian Electricity Association (CEA) expressed support for DOE's effort to harmonize its CEII procedures with FERC's CEII procedures. (CEA, No. 12, p. 4). However, CEA asked for clarification between DOE and FERC's CEII procedures. In particular, CEA sought understanding on processes to ensure consistency between CEII designation, as well as removal of CEII designation, if the same material is shared with both DOE and FERC. Id.

The Department recognizes the importance of coordination among Federal agencies with similar programs, as each agency has different procedures related to voluntary information sharing and protection of the information. As mentioned above, the Department has sought to harmonize its procedures with the FERC procedures as much as possible, and DOE will use FERC's designation criteria. The Department's designation, however, does not mean that the information will be automatically shared with FERC, the Department of Homeland Security (DHS), or any other Federal agency. The Department will follow the procedures outlined in this rule to review and designate information and data as CEII. In addition, the Department will continue to coordinate with the DHS regarding its Protected Critical Infrastructure Information program, including as provided for under 1004.13(e)(4). If DOE finds it necessary to provide CEII material to another Federal agency, DOE will provide dissemination instructions prohibiting further distribution. DOE will continue to coordinate with FERC, DHS, and other Federal agencies on all cross-cutting initiatives related to CEII to ensure maximum harmonization.

B. Filing Procedures and Guidance

Proposed § 1004.13(a) tells interested stakeholders where to find information about CEII filing procedures and guidance. No comments were received; therefore, DOE finalizes this section as proposed.

C. Purpose and Scope

As described in proposed § 1004.13(b), procedures for the designation, protection, and sharing of CEII developed under section 215A of the FPA would apply to anyone who provides CEII to DOE or who receives CEII from DOE, including DOE employees, DOE contractors, agents of DOE, and individuals or organizations who have been permitted access to CEII, as well as non-DOE entities submitting CEII to DOE or receiving CEII from DOE. These proposed procedures would also apply to other Federal agencies seeking CEII designation and protection of information that agencies may submit to DOE.

The joint comments of EarthJustice, Union of Concerned Scientists, and Public Citizen (EarthJustice et al.) disputed the validity of the Department's notice and comment process in this rulemaking. Their comments alleged that the Department violated the Administrative Procedure Act because it held a meeting in February 2018 (discussed in footnote 1 of this rule) at which “industry stakeholders” laid out concerns in advance of this rulemaking. EarthJustice et al. stated that “[t]he public cannot meaningfully comment on an agency's action if key facts or rationale in support of the decision are not made available for consideration and comment.” (Earth Justice et al., No. 3, p. 13).

The Department disagrees with EarthJustice et al.' s claims of inadequate notice and comment. As explained in the October 2018 NOPR, the Department held a meeting with interested stakeholders in compliance with all applicable laws and procedures.^[1] As a preliminary matter, DOE's ex parte guidelines, promulgated in October 2009 and available at https://www.energy.gov/​gc/​downloads/​guidance-ex-parte-communications, provide that the applicability of the guidelines begins upon release of a NOPR or other preliminary rulemaking document. As noted in the Department's October 2018 NOPR, however, DOE nonetheless made a summary of that meeting available to the public, as specified in the ex parte guidelines. The NOPR subsequently provided regulatory text and a preamble explaining the proposed rule. Commenters were given 60 days to respond to the proposed rule, which is to be binding on the Department in designating CEII. No commenters asked for additional time to comment on the rule. This final rule includes the Department's consideration of, and response to, the comments it received. Based on the above, DOE concludes that commenters had the opportunity to meaningfully comment on the Department's proposed rule.

D. Definitions

Section 1004.13(c) of the proposed rule defines terms applicable to the proposed procedures in this notice for the designation of CEII. Where the terms are defined by statute or by FERC's CEII regulations, the definitions track those corresponding definitions, either verbatim or with maximum consistency. Other terms are proposed for the first time in this context. The Department received no comments on the proposed definitions. Therefore, unless discussed below, the proposed definitions are adopted without change in this final rule.

The Department adds the definition of “Confidential Business Information” to § 1004.13(c) to mean “commercial or financial information that is both customarily and actually treated as private by its owner and that is provided to the government as part of a claimed CEII submission.” This addition is based on the June 24, 2019, opinion of the Supreme Court of the United States in Food Marketing Institute v. Argus Leader Media (No. 18-481). The decision effectively broadens the scope of data and information that are eligible for exemption from disclosure under 5 U.S.C. 552(b)(4). In the case, the Supreme Court rejected the lower courts' holding that “information can never be deemed confidential [the FOIA statutory term] unless disclosing it is likely to result in `substantial competitive harm' to the business that provided it.” Food Mktg. Inst. v. Argus Leader Media, No. 18-481, slip op. at 1 (U.S. June 24, 2019). The Court found that the “substantial competitive harm” test which stemmed from the D.C. Circuit's 1974 opinion in National Parks & Conservation Association v. Morton, 498 F.2d 765 (DC Cir. 1974), went beyond the language of the statute itself, and did not reflect the typical meaning of the words used when Congress enacted FOIA Exemption 4. See Argus Leader, slip op. at 7-10. The Court held that “[a]t least where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is `confidential' within the meaning of Exemption 4.” Id. at 12.

The Department clarifies that the CEII Coordinator may delegate the daily implementation of the CEII Coordinator function as described in this rule, in whole or in part, to an Assistant Secretary or Administrator in DOE. The NOPR stated that the final CEII designation authority would reside with the DOE Office exercising its delegated CEII designation authority. The appropriate Assistant Secretary or Administrator would exercise the authority delegated to a DOE Office. Therefore, the Department adopts a definition of CEII Coordinator in § 1004.13(c) to specify delegation to the appropriate Assistant Secretary in DOE.

E. Authority To Designate Information as CEII

Proposed § 1004.13(d) allows the Secretary, or DOE Offices with delegated authority, to receive and designate CEII. Practically speaking, the flexibility to delegate allows the Department to handle CEII in a manner ensuring access to the critical information it needs to execute its responsibilities as the lead Sector-Specific Agency for cybersecurity for the energy sector, under section 61003(c) of the FAST Act, and the Sector-Specific Agency for Energy (Critical Infrastructure), under Presidential Policy Directive 21.

EarthJustice et al. claimed that “[t]he Department has no legal authority to establish criteria and procedures for CEII designation.” The comments contended that “while both [FERC] and the Department have authority to designate CEII, the power to establish criteria and procedures for doing so is [FERC]'s alone.” (EarthJustice et al., No. 3, p. 2).

EarthJustice et al. are correct that both the Department and FERC may designate CEII. However, while the Department is obligated to apply the criteria FERC crafted, FERC acknowledged in its final procedural rule that DOE is not bound by the procedures FERC uses, noting that “[t]he FAST Act . . . does not compel DOE to make any changes to its regulations in this regard” and that “nothing within the Commission's regulations would limit DOE's ability to designate CEII in accordance with the FAST Act,” and specifically “declin[ing] to revise [its] regulations to identify specific designation criteria and CEII procedures for DOE.” FERC Order No. 833, 157 FERC ¶ 61,123 at P 39 (2016), reh'g denied, FERC Order No. 833-A, 163 FERC ¶ 61,125 at PP 31-33 (2018). See also Department of Energy Organization Act, as amended, section 644, 42 U.S.C. 7254 (“The Secretary is authorized to prescribe such procedural . . . rules and regulations as he may deem necessary or appropriate to administer and manage the functions now or hereafter vested in him.”). The Department has therefore designed its own CEII designation procedures, which are consistent with the FERC regulations to the maximum extent possible.

Other commenters requested more detail on how the Department will evaluate information submitted as CEII. For example, Midcontinent Independent System Operator, Inc. (MISO) noted that the proposed rules allowed the delegation of CEII designation authority. (MISO, No. 11, p. 3). Therefore, MISO recommended that “[t]he designation criteria must be specified to enable consistent designation of CEII by each DOE Office, and for CEII submitters to understand the kind of information the DOE will designate as CEII.” Id. Edison Electric Institute (EEI) recommended that, in clarifying the CEII designation criteria, “the Department consider information on other systems or assets that may negatively affect national security, economic security, and/or public health; information that may enable the misuse of an asset or system that may negatively affect national security, economic security, and/or public health; and information on systems or assets that has previously been made public.” (EEI, No. 9, p. 5).

DOE has determined that the existing CEII designation criteria address these concerns. FPA section 215A(a)(2) defines Critical Electric Infrastructure as “a system or asset of the bulk-power system, whether physical or virtual, the incapacity or destruction of which would negatively affect national security, economic security, public health or safety, or any combination of such matters.” FPA section 215A(a)(3) includes “information related to critical electric infrastructure” in its definition of CEII. Under the criteria that FERC established and that DOE follows, FERC and DOE may consider a range of elements in determining what qualifies as CEII. The regulation, as proposed, provides adequate guidance for a submitter and DOE staff to determine whether information is CEII, and for the CEII Coordinator or Coordinator's designee to make a determination.

EEI stated that it supported coordination among DOE Office designees to ensure that the FAST Act authorities are consistently implemented within DOE and recommends a robust internal process to ensure that CEII is appropriately and consistently designated, protected, and shared throughout the Department. (EEI, No. 9, p. 11).

DOE agrees that the internal process for coordination among DOE Office designees is important and will ensure robust internal controls to appropriately and consistently designate, protect, and share CEII throughout the Department. More information on the internal process is provided in Section F.

F. Coordination Among DOE Office Designators

Proposed § 1004.13(e) sets out the functions of the CEII Coordinator and the Coordinator's designee. The CEII Coordinator may make an initial determination as to whether the information fits within the definition of CEII, but final CEII designation authority resides with the CEII Coordinator or DOE Office exercising its delegated CEII designation authority. The proposed subsection also provides that DOE entities with authority to designate CEII would meet to calibrate their approaches to CEII designation, and would meet with representatives of other Federal agencies, as needed and at the discretion of the Coordinator or designee, to ensure consistent understanding of CEII designation processes.

The Department clarifies that the CEII Coordinator or Coordinator's designee is delegated the authority already granted to the Secretary, in accordance with FPA section 215A, to designate information sought by DOE as CEII. Therefore, the Department amends § 1004.13(e)(1) to include specific mention that the CEII Coordinator or Coordinator's designee can designate certain information sought by DOE as CEII, in accordance with FPA section 215A(a)(3), and using the designation criteria codified at 18 CFR 388.113(c).

The Department clarifies that § 1004.13(e)(2) was not meant to limit coordination of implementation of DOE's CEII authority with only DOE Offices, PMAs, and the Energy Information Administration (EIA). It was meant to include all CEII Coordinator designees. Therefore, the Department amends § 1004.13(e)(2) to remove specific mention of the four PMAs and EIA.

The Department clarifies that a submitter requesting information be designated as CEII must clearly label the cover page and pages or portions of the information for which CEII treatment is requested in bold, capital lettering, indicating that it contains CEII, as appropriate, and marked “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE.” The additional marking of spelling out CEII is meant to eliminate any confusion related to the use of the new FOIA exemption in DOE. Therefore, the Department amends § 1004.13(e)(2)(i) to include the updated marking of CEII as “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE”

The Department clarifies that, based on the addition of the definition of “confidential business information,” when any person or entity requests CEII designation of submitted material, the submitter must also clearly label the cover page and pages or portions of information that it considers Confidential Business Information in bold, capital lettering, indicating that it contains Confidential Business Information, as appropriate, and marked “CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” In addition, if CEII and CBI are both included in the submission, the information should be marked “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION and CONFIDENTIAL BUSINESS INFORMATION—DO NOT RELEASE.” The Department therefore revises § 1004.13(e)(2) to add a new paragraph (ii) to include this additional requirement.

EEI supports the procedures that require the CEII Coordinator or the Coordinator's designee to notify CEII submitters of a non-federal entity request for CEII and to convene a conference call with the affected DOE Office(s) and the CEII submitter(s) to discuss any concerns with sharing the CEII. (EEI, No. 9, pp.11-12). However, EEI “recommends that the Department provide additional guidance to CEII submitters on what to expect from the CEII Coordinator or his/her designees when convening a conference call to discuss a non-federal entity request for CEII release.” Id. at 12. In particular, EEI requests clarity on whether a “conference call will be scheduled within five days of the request or within five days of when the submitter is notified of the request, and if the submitter will receive the § 1004.13(k) request before the conference call is convened.” Id. In addition, EEI supports the Department's proposed coordination with other Federal agencies but recommends that, “in addition to coordination with FERC, coordination with [DHS] under its Protected Critical Infrastructure Information (`PCII') and other information protection authorities and the Nuclear Regulatory Commission (`NRC') are critical” because each agency has different procedures related to CEII, and discussions identifying best practices related to voluntary information sharing and protection of the information “will be key to protecting the nation's critical electric infrastructure.” (EEI, No. 9, pp.12-13).

DOE clarifies and amends proposed § 1004.13(e)(1)(vii) to state that a conference call will be scheduled within five days of when the CEII submitter is notified of the request, and the submitter will receive a copy of the request before the conference call is convened.

The Department agrees with EEI's recommendation that close coordination between all relevant Federal agencies is critical to ensuring protection of the nation's critical electric infrastructure. Therefore, the Department has amended § 1004.13(e)(4) to specifically include DHS and the Nuclear Regulatory Commission.

G. CEII FOIA Exemption

The language from § 1004.13(f)(6)(ii) of the proposed rule (renumbered as § 1004.13(g)(7)(ii)) is moved to new § 1004.13(f) and a reference is made to new § 1004.13(f) in the renumbered § 1004.13(g)(7)(ii). This only moves to a new subsection the content of FPA section 215A(d)(1)(B), stating that all information designated CEII is exempt from disclosure under the FOIA exemption codified at 5 U.S.C. 552(b)(3) and other laws requiring the disclosure of certain information or records, whether at the Federal, State, political subdivision, or tribal level of government.

EEI noted that the proposed regulations do not contain a paragraph (g) and the Department should review and edit the number of all paragraphs and references as appropriate before finalizing the rule. (EEI, No. 9, p. 18).

DOE appreciates EEI raising the clerical error. The Department has added paragraph (f) to fix the clerical error and codify the requirements of FPA section 215A(d)(1)(B) in this new section.

H. Procedures for Designating CEII

Proposed § 1004.13(g) sets forth the procedures the Department would follow to designate CEII. The subsection covers requesting designation for information submitted to or generated by DOE, how DOE would treat submitted information and apply FERC's CEII designation criteria, how DOE would treat information once it has decided whether to designate the information as CEII, and how DOE would protect designated CEII. In particular, proposed § 1004.13(g)(3)(ii) stated that “[i]nformation for which CEII treatment is requested will be maintained by the CEII Coordinator or Coordinator's designee in DOE's files as non-public unless and until DOE completes its determination that the information is not entitled to CEII treatment.” To ensure that submitters of CEII are kept informed of the decision to be made, the Department has added the requirement to § 1004.13(g)(6)(i) that the designation decision be communicated “promptly.”

CEA shared its concern about the consequences of a submitter's inability to produce a public version of a document containing CEII. To alleviate that concern, CEA asked the Department to “clarify accommodations or outcomes if a submitter is unable to produce a public version of CEII.” (CEA, No. 12, p. 4).

In response to CEA's comment, the Department clarifies that if a submitter cannot produce a public version of a document with CEII, then the Department will provide a public version in response to a valid FOIA request with the CEII or other FOIA-exempt material redacted. The Department prefers, however, that a submitter provide public and non-public versions of documents containing CEII. Before the FAST Act amendments to the FPA, filers at FERC would routinely submit two versions of documents in this way. DOE encourages, but does not require, the same approach. The Department also suggests that CEII material be consolidated, to the extent possible, within a document rather than scattered throughout a document.

The comments of the American Public Power Association (APPA), the Large Public Power Council (LPPC), and the (National Rural Electric Cooperative Association (NRECA) (collectively, Joint Trade Associations) recommend that “the Department specify . . . that material maintained `in DOE's files as non-public' during the pendency of a request for CEII designation will be treated and handled in all respects as if it were CEII, as appears to be the Department's intent. [I]n particular, that treatment of electronic information as non-public will include `stor[age] in a secure electronic environment' with appropriate labeling, as the NOPR proposes for CEII.” (Joint Trade Associations, No. 15, pp. 9-10).

DOE believes that such a clarification is not necessary. The proposed regulation already states that “[w]hen a requester seeks information for which CEII status has been requested but not designated . . . DOE will render a decision on designation before responding to the requester or releasing such information. Subsequently, the release of information will be treated in accordance with the procedures established for CEII-designated material, or the return of information not designated as CEII.” Therefore, it is sufficiently clear that the Department will treat non-designated, CEII-marked information as if it were already designated CEII, until a designation has been conferred on the information. However, to prevent confusion, the Department amends § 1004.13(g)(7)(iii) to state that “secure place” refers to locked room or file cabinet.

EEI recommends that that the Department address how to mark information that cannot be physically labeled such as machine-to-machine information that may be shared with the Department because several DOE Power Marketing Administrations regularly receive machine-to-machine, electronic information from electric companies. (EEI, No. 9, p. 10).

In response to EEI's recommendation, DOE amends § 1004.13(g)(7) to require the marking of electronic information with the words “CEII-CRITICAL ELECTRIC INFRASTRUCTURE INFORMATION—DO NOT RELEASE” in the electronic file name or transmitted under a Non-Disclosure Agreement (NDA) or other agreements or arrangements, such as those identified in § 1004.13(j)(3), to an electronic system where such information is stored in a secure electronic environment that identifies the stored information as CEII. The Department agrees that the PMAs receive a significant amount of CEII, including real-time, streaming information. The Department understands that it may not be practical or possible to physically mark each electronic file or each bit of real-time, streaming data submitted to the PMAs. The Department will consider the information marked as long as it is shared with the PMAs under appropriate protections, transmitted through secure protocols, and stored in secure electronic environments that identify information as CEII. For instance, an entity sharing real-time operating information under the North American Electric Reliability Corporation's Operating Reliability Data Confidential Agreement with PMAs does not need to mark the data, provided that the entity supplying the data communicates to the PMAs that such real-time data is being provided under the agreement and the entity providing the data requests CEII designation. The PMAs will store such data in secure electronic environments identifying information as CEII. The Department notes that the DOE CEII Coordinator or Coordinator's designee still needs to review and evaluate such information and make a CEII determination. The marking of information as CEII does not guarantee that such information will be designated as CEII.

EEI encourages the Department to clarify the marking requirements for submitting pre-designated and machine-to-machine information as CEII. In particular, EEI supports the pre-designation of information “about [Defense Critical Electric Infrastructure (DCEI)] on incidents and emergencies reported through the Department's Form OE-417, and Federal spectrum information managed by the National Telecommunications and Information Administration (“NTIA”) . . . however, it is unclear whether the proposed procedures require submitters of this pre-designated information to follow the submission process outlined in § 1004.13(f)(1)(i) through (iv).” (EEI, No. 9, p. 9).

The Joint Trade Associations urge DOE to “pre-designate” all information as CEII for which a CEII designation is requested. (Joint Trade Associations, No. 15, p. 6). Joint Trade Associations argues that “Defense Critical Infrastructure Information, Form OE-417 submissions, and Federal spectrum information is likely to reflect CEII, and it is appropriate to immediately extend a blanket of protection over these submissions.” Id. This approach would not preclude the case where “individualized designation determination would still be made on all information for which CEII treatment is requested, which would protect against over-designation of material that does not qualify as CEII.” Id. at 8. Further, the Joint Trade Associations argue “if the Department does not adopt pre-designation for all materials . . . DOE should specify that a public power utility that receives a state public records request for information that has been submitted to DOE with request for CEII designation will have the opportunity to consult with the DOE CEII Coordinator and receive an expedited determination as to whether the submitted information is CEII under DOE's regulations.” Id. at 11.

EarthJustice et al. also raised concerns with the Department's suggested blanket CEII designation of information related to DCEI. The comment doubted that all information related to DCEI would meet the CEII criteria. See id. The comment characterized the automatic DCEI designation as a “sweeping restriction on public access to information that would not lead to disclosure of CEII,” in violation of the FAST Act, “and the Department's failure to provide reasonable justification for this element of the proposal also violates the [Administrative Procedure Act].” Id. at 9.

S&P Global Market Intelligence and E&E News oppose what they describe as the Department's intent to automatically designate the content of submitted Form OE-417 (or successor), including Schedule 2 (the narrative description), as CEII. (S&P Global Market Intelligence, No. 6, p. 1; E&E News, No. 8, at p.1). S&P Global Market Intelligence raised the following three points opposing the Department's proposal. First, the Department did not explain why it must distinguish between OE-417 Schedule 1 (information that is “not confidential”) and Schedule 2 (information that “DOE proposes `will be protected' upon CEII designation request”). (S&P Global Market Intelligence, No. 6, p. 1). Second, an automatic exemption would be at odds with FERC's requirement of adequate justification for a CEII designation. Finally, the Department in 2014 proposed to revoke public access to Form OE-417 Schedule 2 under the Confidential Information Protection and Statistical Efficiency Act of 2002, but never did, based on feedback. Id. at 2.

E&E News also opposed the Department's proposal. First, automatically exempting any portion of the Form OE-417 from applicable FOIA laws without proper justification would be in conflict with FERC, which requires adequate justification. (E&E News, No. 8, at p.1). Second, E&E News argues that “[i]n years of processing OE-417 information and releasing accompanying data, in whole or in part, under FOIA, DOE has not demonstrated that the public release of properly-redacted Schedule 1 or 2 information ever threatened to impair the security of critical infrastructure . . . Section 2 is where the clarifying details are often provided in the form, without which the public could get a distorted picture of the exact scope of the concern, issue or threat.” Id. at 2. Finally, E&E News argues that in 2014 DOE proposed to revoke public access to Schedule 2 under the Confidential Information Protection and Statistical Efficiency Act of 2002. But based on feedback received, DOE did not proceed with the proposal. Id.

Electric Reliability Council of Texas, Inc. (ERCOT) pointed out that the language in the proposed rule is in conflict with respect to schedule 2 of Form OE-417. In § 1004.13(g)(3) “DOE intends to `automatically' classify information submitted on schedule 2 of Form OE-417 as CEII upon submission of a request for CEII treatment of that information . . . However, the proposed definition of CEII [in § 1004.13(c)(3)] indicates that information submitted on Form OE-417 will be confidential only if it meets the definition of CEII.” (ERCOT, No. 14, p. 2). ERCOT recommends “DOE revise the rule to treat all information submitted on schedule 2 of Form OE-417 as CEII without requiring a further showing of CEII status or even requiring a request for CEII treatment. Otherwise, ERCOT would suggest that the DOE remove the mention of OE-417 from the definition of CEII to avoid confusion.” Id. at 2-3.

In response to the comments above, the Department clarifies that the intent of the Department is not to designate categories of information as CEII through this rulemaking. The Department will therefore remove all references to “pre-designation” in the Final Rule. All information submitted will be reviewed and evaluated and then, if appropriate, designated as CEII by the CEII Coordinator or his/her designee. The Department will modify the definition of CEII to remove the categories Defense Critical Electric Infrastructure; information on electric incidents and emergencies reported to DOE through the Electric Emergency Incident and Disturbance Report (Form OE-417); and/or Federal spectrum information managed by the National Telecommunications and Information Administration (NTIA). DOE notes that whether the information meets one or more of these categories will still be considered in the Department's determination of whether information is CEII. DOE will also render a decision as to whether information is CEII before sharing the information with other Federal or non-federal entities or releasing that information in response to a FOIA request. As a result, there is no practical change in the protection of information for which a CEII designation is requested between the NOPR and this final rule. The Department intends that this practice will facilitate the energy sector's sharing of CEII with DOE and, in requesting information to support its policy initiatives and priorities, it may request CEII-designated information. If information requested by the Department is determined to meet the CEII designation criteria, the Department will designate such information as CEII upon receipt by the Department.

EarthJustice et al. commented on the Department's “pre-designation” of material as CEII, as well as its “interim” treatment of CEII. The comment stated that the proposed rule would allow such information “to be withheld indefinitely without opportunity for judicial review.” (EarthJustice et al., No. 3, p. 3). Further, the comment stressed that the Department “fails to explain its need to provide indefinite, interim treatment of information as CEII based solely on the assertion of the information provider.” Id. at 10.

As discussed above, the Department will not be pre-designating categories of information as CEII through this rulemaking, and CEII designation will hinge on a rigorous review and application of the criteria defining such information. Notwithstanding that approach, information submitted with a CEII designation request will not be shared with the public except in response to a valid FOIA request, and only then if the information is determined not to be CEII, not to fall under any other FOIA exemption, and applicable administrative and judicial remedies have been exhausted pursuant to paragraph 1004.13(i) of the regulations. To clarify, if the information is sought via FOIA, the Department will review and consider whether the information is eligible for official CEII designation. In any event, a submitter will still need to follow all of the submission process outlined in § 1004.13(g)(1)(i) through (iv), and the information will not be designated as CEII until the CEII Coordinator or his/her designee makes a determination.

EarthJustice et al., discussing a related concern, cautioned that pre-designation and interim treatment would hamstring judicial review of CEII determinations. The comments stressed that the amendments to the FPA demonstrate “clear legislative intent to afford protections against arbitrary CEII designations and ensure public access where appropriate.” Id. at 4. More specifically, EarthJustice et al. were concerned that “[b]ecause neither pre-designation nor interim CEII status appears to trigger an opportunity for a person to request reconsideration of that treatment, which would be a prerequisite to judicial review, DOE's proposed rules effectively and inappropriately nullify this section of law.” Id.

As discussed above, DOE will not be pre-designating categories of information as CEII in this rulemaking. If a FOIA request is received for material claimed to be CEII but not yet designated as such, the request will result in a decision by DOE whether the information is CEII. If the submitter pursues DOE's decision through the reconsideration stage described at § 1004.13(i), that decision would then be subject to judicial review.

Finally, EarthJustice et al. pointed out that the Department's promise to return or destroy material not designated CEII would violate the Federal Records Act. Specifically, they said that “[t]he proposal suggests that records could be requested under FOIA, triggering a determination that a CEII designation is unwarranted, and then the records could be returned or destroyed prior to the resolution of the FOIA request[, which] would be patently unlawful.” (EarthJustice et al., No. 3, p. 6). The comment warned that information “could be labeled CEII, however unjustifiably, for the purpose of ensuring that such information is returned or destroyed when a CEII designation is denied, regardless of the information's content or how the Department utilized it.” Id. at 8.

The Department agrees that destruction of submitted material examined for CEII designation may be contrary to the Federal Records Act. The Department therefore revises § 1004.13(g)(6)(iii) to emphasize that it will in all instances comply with the Federal Records Act.

I. Duration of Designation

Section 1004.13(h) outlines procedures governing the duration of CEII designation, to include re-applications for CEII designation, expiration of designation, removal of designation, and treatment and return of information no longer designated as CEII.

EEI, joined by Southern California Edison (SoCal Edison), expressed concern that the proposed rule would not ease the regulatory burden on submitters of information claimed as CEII. Their comments warned, for instance, that “[d]uplicative tracking [of CEII expiration dates] could quickly become onerous and overwhelming for submitters who may also have to track information they have shared with other Federal entities.” (EEI, No. 9, pp. 15-16). They suggested “that the Department notify the CEII submitter and automatically initiate the re-designation process before the CEII designation period expires.” Id. at 16. They also recommended a “default action” of returning or destroying non-CEII and “allowing at least ten days for submitters to comment in writing prior to the removal of CEII designations.” Id.

The Joint Trade Associations described similar concerns. Specifically, their comments expressed unease “that the need for CEII submitters to track designation durations and dates of expiration for potentially numerous CEII submissions over multiple years could be a record-keeping challenge and a potential trap for the unwary that could put CEII designations at risk of inadvertent expiration.” (Joint Trade Associations, No. 15, pp. 11-12). They recommended “revis[ing] the proposed regulations to specify that, like FERC, DOE will continue to treat CEII as non-public even after a designation has lapsed due to the passage of time,” and that “submitters of CEII for which a designation has lapsed would receive notice of any requests for such information (by either a Federal or non-federal entity) and an opportunity to assert that DOE should re-designate the information as CEII.” Id. at 12.

The Department agrees with the comments that the Department could automatically initiate the re-designation process before the CEII designation period expires. Therefore, the Department clarifies there are two methods for initiation of the re-designation process. The Department may automatically initiate the re-designation process or the CEII submitter may request re-designation. Thus, the Department revises § 1004.13(h)(1) to add a subparagraph (iii) to make clear that the Department can also automatically initiate the re-designation process at any time during the duration of the designation.

Furthermore, the Department clarifies that information whose CEII designation has lapsed will not be immediately disclosed to the public. The information would only be disclosed following a review and determination as to whether CEII or other FOIA exemptions are applicable. Should the Department receive a FOIA request for the information, and determine that the information would be responsive to the FOIA request, the submitter or the Department will have an opportunity to contend that the information should be re-designated CEII prior to release. Regardless of the Department's re-designation decision, the aggrieved party could seek reconsideration, after which judicial review would be available if desired.

Finally, the Department cannot return or destroy non-CEII in violation of the Federal Records Act or other applicable laws. The Department therefore declines to institute the default action as the commenters recommended. Instead, the Department will return or destroy non-CEII consistent with applicable law and will make that evaluation on a case-by-case basis.

J. Review or Requests for Reconsideration of Designation

Proposed § 1004.13(i) describes how a submitter may request reconsideration of a decision not to designate CEII, not to release CEII in response to a request for release, or not to maintain an existing CEII designation, and discusses eligibility for judicial review. The subsection also notes that, with several exceptions, a reconsideration request triggers a stay of the underlying decision. The Department would like to clarify that all submitters of information proposed for CEII designation may request reconsideration of a DOE decision not to designate that information as CEII. A request for reconsideration can be made through a secure electronic submission or by mail according to the instructions at 10 CFR 205.12. The Department therefore revises § 1004.13(i) to allow for secure electronic submission or by mail according to the instructions at 10 CFR 205.12.

EarthJustice et al. stated that the Department does not provide due process to challengers of its decisions. The comment accuses the Department's proposed rule of being “little more than an attempt to hide the Department's decision-making process from public scrutiny and obfuscate judicial challenges to the Department's authority.” (EarthJustice et al., No. 3, p. 14). Further, the comment points out that, in contrast to FERC, “[t]he proposed rules notably do not provide any means for parties to Department proceedings to obtain timely access to information that is designated as CEII or preliminarily treated as CEII, and which therefore cannot be accessed by the public.” Id. at 13. The comment stresses that “[d]enying access to information that forms the basis of Department decision-making to parties affected by those decisions is inconsistent with due process.” Id.

In response, the Department emphasizes that the CEII designation procedure is an exercise in balancing a requester's need for information against the Nation's interest in national security. When information does not meet the CEII standard, the Department may disclose it if the Department receives a request under FOIA and the information is not otherwise protected from disclosure. When the Department finds that information qualifies as CEII, the Department will withhold it if the Department receives a FOIA request. Those aggrieved by such decisions have a number of avenues to seek relief, as specified in the rule and in DOE's FOIA regulations.

K. Sharing of CEII

As indicated in proposed § 1004.13(j), DOE may share CEII as necessary to carry out its specific jurisdictional duties pursuant to section 215A of the FPA and as the lead Sector-Specific Agency for cybersecurity for the energy sector under section 61003(c)(2)(A) of the FAST Act, and the Sector-Specific Agency for Energy (Critical Infrastructure) under Presidential Policy Directive 21, “Critical Infrastructure Security and Resilience” (Feb. 12, 2013). Those submitting CEII would have DOE's assurance that the information will be protected from unauthorized disclosure. The Department would follow standardized procedures when sharing CEII with Federal and non-federal entities to ensure the protection of CEII. Non-federal entities would be required to enter into a NDA with the Department, meeting the standards outlined in the proposed rule, prior to receiving CEII from DOE. When a non-federal entity requests such information, the DOE CEII coordinator would notify the submitter of the CEII and the appropriate DOE Office(s), to facilitate coordination and allow the submitter to raise concerns related to a requesting entity. The DOE CEII coordinator would, in consultation with the appropriate DOE Office(s), make a final determination on whether to release any CEII-designated material in response to such a request.

As mentioned above, DOE recognizes the importance of coordination among Federal entities with similar programs, therefore DOE revises § 1004.13(j)(1) to allow for CEII to be shared with other Federal entities without such entities being subject to the procedures set forth in § 1004.13(k). Instead, DOE will evaluate requests by Federal entities for CEII on a case-by-case, fact-specific basis, and may request information from the Federal entity explaining the specific jurisdictional responsibility, and the entity program charged with implementing that responsibility, to be fulfilled by obtaining the CEII. This approach allows DOE to continue its goal of appropriate sharing of CEII within the Federal Government. It also ensures that Federal entities will have access to CEII to carry out jurisdictional responsibilities.

ERCOT urges DOE to reconsider its approach to share CEII with non-federal Entities and instead “[f]or CEII that DOE obtains from external sources, those who can demonstrate a legitimate need for that information should be able to obtain the information directly from the source of that CEII . . .” (ERCOT, No. 14, p. 1). PJM Interconnection LLC (PJM) notes that it “has its own procedures under which requestors may submit requests and obtain CEII directly from PJM . . . PJM is concerned that as written, the proposed DOE rule potentially allows for requesters to circumvent the more rigorous CEII processes of the RTOs by simply going directly to the DOE for the requested information.” (PJM, No. 13, p. 5). PJM recommends DOE revise its proposed regulations “to require a requestor to first seek the information from the submitter of the CEII . . . Ultimately, if a requester is denied access to CEII from the submitter of the information, the requester could still seek the CEII from the Department” (Id. at pp. 5-6). The Joint Trade Associations recommend that “DOE reconsider its proposal to allow sharing of CEII that was not generated by DOE over the objection of the submitting entity in cases where information was voluntarily provided to DOE by the submitter.” (Joint Trade Associations, No. 15, p. 15).

DOE declines to revise its procedures as requested in the comments above. Once the CEII is in the Department's possession, it is the Department's obligation to determine whether to share the information. However, the Department clarifies that it will balance the need for and intended use of the information in the interest of national security against any concerns the CEII submitter has regarding the release of the information. The Department therefore revises § 1004.13(j)(2) to emphasize that a request shall not be entertained unless the requesting non-federal entity can demonstrate that the release of information is in the national security interest. In addition, based on other comments set forth below in Section L, DOE is adopting the criteria set forth in the FERC regulations in § 1004.13(k) for the detailed statement that is required by a requestor of CEII. These criteria provide more specificity with regard to the proposed § 1104.13(k)(2) as to what DOE will expect in the explanation of need provided with a request for CEII.

EEI encourages the Department to clarify and align its procedures for sharing with Federal and non-federal entities. In particular, EEI recommends “that in § 1004.13(j)(1) the Department explicitly require Federal Entities with which the Department shares CEII to protect the CEII from access or disclosure by individuals or organizations that have not been authorized by the Department and limit their use of the CEII.” (EEI, No. 9, p. 19). EEI argues that only requiring minimum protections for CEII shared with non-federal entities creates a disclosure risk for submitters if DOE shares the information with Federal entities. Id. EEI does acknowledge that the Department's procedures allow the Department to impose restrictions on the use and security of the information but without explicitly requiring minimum protections there is a risk that the information could be disclosed inadvertently, knowingly, or willfully to unauthorized individuals or organizations by other Federal entities. Id. EEI encourages the Department to also consider clarifying that the CEII it shares with Federal entities be maintained in accordance with the Department's CEII procedures. Id.

The Department clarifies that a Federal agency in receipt of CEII from the Department must protect that information in the same manner as the Department. That agency will be required to execute an appropriate Agency Acknowledgment and Agreement. The Department has revised § 1004.13(j)(1) to require an authorized agency employee to sign an acknowledgement and agreement that states the agency will protect the CEII in the same manner as the Department and will refer any requests for the information to the Department. Notice of each such request must also be given to the CEII Coordinator, who shall track this information.

PJM points out that “[i]t is unclear from the proposed rule whether the Department intends for the contemplated CEII NDA to apply to each individual request . . . or whether the Department intends for the requester to enter into the CEII NDA once, with such CEII NDA applying to all requests made by the requester for a certain period of time.” (PJM, No. 13, p. 6). PJM recommends “DOE's CEII NDAs to be specific to the requested information, be specific to the named individuals, and subset on their own terms, absent specific requests for renewal after twelve (12) months. Incorporating these parameters into the Department's procedures would avoid the perpetuation of stale NDAs not tied to specific data or signed by individuals no longer employed by the particular entity under which the request was made to the DOE.” Id at 6-7.

The Department revises § 1004.13(j)(2) to clarify that a requester that has entered into a CEII NDA with the Department is not required to file another NDA with subsequent requests during the calendar year because the original NDA must state that the agreement applies to all subsequent releases of CEII during that calendar year. However, the Department does not believe it is necessary to have an NDA be specific to the individual CEII information requested because all CEII will be maintained and protected in the same manner regardless of source or type of information.

The Joint Trade Associations and the Transmission Access Policy Study Group (TAPS) recommend revising the CEII NDA to include specific reference to the public disclosure law exemption. Both parties contend that including the text of the exemption in the NDA would ensure awareness of the limitation among stakeholders. (Joint Trade Associations, No. 15, p. 10; TAPS, No. 7, p. 3). Further, the Joint Trade Associations pointed out that FERC agreed with this recommendation and referenced the provision in section 215A(d)(1) in its CEII NDA. Id.

DOE agrees that the CEII NDA should reference the provision in section 215A(d)(1) that CEII is exempt from disclosure under Federal, State, political subdivision, or tribal law requiring public disclosure. Accordingly § 1004.13(j)(2) has been revised to include this additional requirement.

EEI encourages “the Department to share the minimum-level NDA with stakeholders for notice and comment to enable input from potential submitters and requesters on what can and should be agreed upon in the minimum-level NDAs.” (EEI, No. 9, p. 21). EEI goes on to state that although it does not oppose the development of protocols for sharing CEII with Canadian and Mexican authorities it recommends that the Department allow for notice and comment by stakeholders. Id. at 21-22.

Section 1004.13(j)(2) already includes minimum requirements for an NDA and is not intended to be exhaustive or preclude other requirements. Under certain circumstances, DOE may add additional provisions to the NDA and submitters may request that additional provisions be added to the NDA.

DOE appreciates EEI's concerns about protocols for sharing CEII with Canadian and Mexican authorities. DOE believes stakeholder notice and comment for the development of the protocols is not necessary. DOE clarifies here that a series of bilateral agreements govern and inform its work with Canadian and Mexican Authorities. As the U.S. power grid is integrated with jurisdictions in both Canada and Mexico, DOE fully intends to work closely with Canadian and Mexican authorities. Our three nations have a shared interest in the optimal functionality of our integrated power grid, and DOE will therefore develop sharing protocols that will ensure consistent treatment of information and data.

Section 1004.13(j)(3) was based on section 215A(d)(2)(D) of the FPA. Since the promulgation of § 215A, the Presidential Decision Directive 63, “Critical Infrastructure Protection” (May 22, 1998) referenced in section 215A(d)(2)(D) was superseded by Homeland Security Presidential Directive/HSPD-7, “Critical Infrastructure, Identification, Prioritization, and Protection” (Dec. 17, 2003), which has since been revoked by Presidential Policy Directive 21, “Critical Infrastructure Security and Resilience” (Feb. 12, 2013) (PPD-21). Therefore, DOE includes reference to information sharing and analysis organization (ISAO) defined at 6 U.S.C. 671(5), which defines ISAO as “any formal or informal entity or collaboration created or employed by public or private sector organizations for purposes of gathering and analyzing . . . communicating or disclosing . . . and voluntarily disseminating critical infrastructure information, including cybersecurity risks and incidents.” ISAO includes information sharing and analysis centers. See, e.g., 6 U.S.C. 659(d)(1)(B)(ii).

L. Procedures for Requesting CEII

Proposed § 1004.13(k) delineates procedures for requesting CEII designation and sharing CEII-designated materials. A request must include contact information, an explanation of the need for and intended use of the CEII, and a signed Non-Disclosure Acknowledgment or Agreement, as applicable.

DOE received several comments requesting additional details concerning the criteria and procedures that DOE will apply in responding to requests for release of CEII. For example, EEI recommends that DOE “consider clarifying that it will review the legitimacy of received requests and their associated requestors in making its sharing determination.” (EEI, No. 9, p. 15). MISO stated that “DOE should specify criteria for the review of requestors and requests, and consistently abide by those criteria throughout the DOE Offices when making decisions about sharing CEII.” (MISO, No. 11, p. 4). PJM noted that “the Department should deny a non-federal entity request that merely provides a broad need statement, such as general explanations of the business or profession of the requester or generalized statements that the requester intends to use the CEII in the normal course of the requestor's business or profession.” (PJM, No. 13, p. 3). PJM recommended “the requestor should be required to detail with specificity its need to know the requested information and why a request to DOE for release of CEII is the sole means for it to accomplish the purpose outlined in its request.” Id. at 4. The Joint Trade Associations recommended that “DOE should specify that any entity requesting CEII will be required to make a particularized showing of how its receipt of CEII will accomplish the stated need for the information.” (Joint Trade Associations, No. 15, p. 16). The Sustainable FERC Project and Natural Resources Defense Council recommend that “DOE adopt FERC's language so that there is consistency across agencies.” (The Sustainable FERC Project and Natural Resources Defense Council, No. 10, p. 3).

In response to these comments, DOE is adopting the criteria set forth in the FERC regulations for the detailed statement that is required by a requestor of CEII. In § 1004.13(k), DOE shall consider requests for CEII on a case-by-case basis. In addition, the requestor must provide a detailed statement which includes: (1) The extent to which a particular function is dependent upon access to the information; (2) why the function cannot be achieved or performed without access to the information; (3) an explanation of whether other information is available to the requester that could facilitate the same objective; (4) how long the information will be needed; (5) whether or not the information is needed to participate in a specific proceeding (with that proceeding identified); and (6) an explanation of whether the information is needed expeditiously. As noted in section K, these criteria provide more specificity with regard to the proposed § 1104.13(k)(2) as to what DOE will expect in the explanation of need provided with a request for CEII.

M. Unauthorized Disclosure

In the NOPR, DOE proposed § 1004.13(l), which sets out penalties and sanctions for unauthorized disclosure of CEII, emphasizing that statutory whistleblower protections still apply.

PJM encourages the Department to consider “specifying disciplinary action for non-Department employees or contractors who knowingly or willfully disclose CEII in an unauthorized manner” such as prohibition of making future requests by the requester.” (PJM, No. 13, p. 7). Additionally, PJM recommended the Department “should consider providing remedies to submitters for incidents of knowing or willful disclosure of CEII in an unauthorized manner.” Id.

The Department notes that the FAST Act does not require the Department to develop sanctions for external recipients of CEII. However, in order to ensure non-federal entities understand the serious nature of a knowing or willful disclosure of CEII, DOE will amend its proposed regulations at § 1004.13(l)(2) to state that any action by a Federal or non-federal Entity who knowingly or willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact; makes any materially false, fictitious, or fraudulent statement or representation; or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry to obtain CEII may constitute a violation of other applicable laws and is potentially punishable by fine and imprisonment. DOE will actively pursue all available remedies, including through referrals to appropriate law enforcement entities.

The Department declines to adopt PJM's recommendation that it provide remedies to submitters for incidents of knowing or willful disclosure of CEII in an unauthorized manner. The Department is revising the regulations to specify that knowingly or willfully falsifying information to obtain CEII may constitute a violation of applicable laws and is potentially punishable by fine or imprisonment.

EEI (joined by SoCal Edison) and the Joint Trade Associations expressed concern that inadvertent disclosure of CEII could eliminate that material's status as CEII and lift its FOIA exemption. EEI stated that “it is unclear if an inadvertent disclosure will trigger the Department to remove the CEII designation,” and asked the Department to clarify “the notification procedures for unauthorized CEII disclosures and CEII designation changes.” (EEI, No. 9, p. 13). The Joint Trade Associations asked the Department to “clarify that inadvertent disclosure of CEII by a submitting entity generally would not be a basis for reconsidering/removing a CEII designation.” (Joint Trade Associations, No. 15, p. 4).

The Department clarifies that inadvertent disclosure does not affect the disclosed material's CEII status. Such status is to be determined strictly according to the criteria FERC developed and promulgated in December 2016, as mandated by the FAST Act amendments to the FPA that created the CEII designation authority. Once a CEII designation is applied, the designation continues until it expires or is affirmatively removed.

Nonetheless, it is important to distinguish between inadvertent and deliberate disclosure. As stated in proposed § 1004.13(l)(1), the Department may remove a CEII designation “[i]f the submitter of information [designated CEII] discloses” that information. In response to the comment, the Department revises § 1004.13(l)(1) to emphasize that a CEII designation may be removed following deliberate disclosure, meaning disclosure that is not inadvertent and is sanctioned by the person with ultimate authority to determine whether and how the information is to be shared with the public.

III. Regulatory Review

A. Executive Order 12866 and 13563

This regulatory action has been determined to be a “significant regulatory action” under Executive Order 12866, “Regulatory Planning and Review.” 58 FR 51735 (Oct. 4, 1993). Accordingly, this action was subject to review under that Executive Order by the Office of Information and Regulatory Affairs of the Office of Management and Budget. DOE has also reviewed this regulation pursuant to Executive Order 13563, issued on January 18, 2011. 76 FR 3281 (Jan. 21, 2011). Executive Order 13563 is supplemental to and explicitly reaffirms the principles, structures, and definitions governing regulatory review established in Executive Order 12866. To the extent permitted by law, agencies are required by Executive Order 13563 to: (1) Propose or adopt a regulation only upon a reasoned determination that its benefits justify its costs (recognizing that some benefits and costs are difficult to quantify); (2) tailor regulations to impose the least burden on society, consistent with obtaining regulatory objectives, taking into account, among other things, and to the extent practicable, the costs of cumulative regulations; (3) select, in choosing among alternative regulatory approaches, those approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity); (4) to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt; and (5) identify and assess available alternatives to direct regulation, including providing economic incentives to encourage the desired behavior, such as user fees or marketable permits, or providing information upon which choices can be made by the public.

B. Executive Orders 13771

On January 30, 2017, the President issued Executive Order 13771, “Reducing Regulation and Controlling Regulatory Costs.” 82 FR 9339 (Feb. 3, 2017). That Order stated the policy of the executive branch is to be prudent and financially responsible in the expenditure of funds, from both public and private sources. The Order stated it is essential to manage the costs associated with the governmental imposition of private expenditures required to comply with Federal regulations.

The development and implementation of the procedures, as laid out in section 215A(d) of the FPA, are designed to protect the security and reliability of the nation's bulk-power system, distribution facilities, and other forms of energy infrastructure. The procedures relate solely to marking information that would facilitate voluntary sharing of CEII among DOE and other appropriate Federal, state, or local entities to address emergencies, accidents, or intentional destructive acts affecting the production, transmission, and delivery of energy resources. There is no new reporting requirement and no new program created as a result of the proposed procedures. This information will be stored on currently existing DOE systems.

This final rule is not subject to the requirements of E.O. 13771 (82 FR 9339, February 3, 2017) because this final rule is related to agency organization, management or personnel. Specifically, the rule provides for marking of information submitted to DOE as CEII so that DOE can protect CEII as necessary and appropriate.

C. National Environmental Policy Act

DOE has concluded that promulgation of this rule is covered under the Categorical Exclusion found in DOE's National Environmental Policy Act regulations at paragraph A6 of appendix A to subpart D, 10 CFR part 1021, which applies to rulemakings that are strictly procedural, such as rulemaking (under 48 CFR part 9) establishing procedures for technical and pricing proposals and establishing contract clauses and contracting practices for the purchase of goods and services, and rulemaking (under 10 CFR part 600) establishing application and review procedures for, and administration, audit, and closeout of, grants and cooperative agreements. Accordingly, neither an environmental assessment nor an environmental impact statement is required.

D. Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires preparation of an initial regulatory flexibility analysis for any rule that by law must be proposed for public comment, unless the agency certifies that the rule, if promulgated, will not have a significant economic impact on a substantial number of small entities. As required by Executive Order 13272, “Proper Consideration of Small Entities in Agency Rulemaking,” 67 FR 53461 (Aug. 16, 2002), DOE published procedures and policies on February 19, 2003, to ensure that the potential impacts of its rules on small entities are properly considered during the rulemaking process. 68 FR 7990 (Feb. 19, 2003). DOE's procedures and policies are available on the Office of General Counsel's website: https://energy.gov/​gc/​office-general-counsel.

DOE has reviewed this final rule under the provisions of the Regulatory Flexibility Act and the procedures and policies published on February 19, 2003. This final rule sets forth agency procedures for the designation, sharing, and protection of CEII, and applies to DOE employees, DOE contractors, agents of DOE, and individuals or organizations submitting a request for CEII designation or who have requested or been permitted access to CEII. The proposed procedures for marking incoming requests and/or submissions, which are expected to facilitate voluntary sharing of CEII among DOE and other appropriate Federal, state, or local entities to address emergencies, accidents, or intentional destructive acts to the production, transmission, and delivery of energy resources, are not expected to result in a significant impact to stakeholders. FERC's regulations already require entities requesting CEII designation to mark the subject information. DOE's procedures would provide consistency and would also help avoid unauthorized disclosure or release. DOE therefore expects that these procedures would not affect DOE's decision to designate submitted information as CEII, nor any decision to withhold or release information to requesters of energy infrastructure information under FOIA. On the basis of the foregoing, DOE certifies that this regulation will not have a significant economic impact on a substantial number of small entities. Accordingly, DOE has not prepared a regulatory flexibility analysis for this rulemaking. DOE's certification and supporting statement of factual basis was provided to the Chief Counsel for Advocacy of the Small Business Administration pursuant to 5 U.S.C. 605(b) and the Department did not receive any comments on the certification or the economic impacts of the rule.

E. Paperwork Reduction Act

Pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA) and the procedures implementing that Act at 5 CFR part 1320 require the Office of Management and Budget to review and approve certain information collection requirements imposed by agency rule. This Final Rule does not impose any additional information collection requirements. Therefore, the information collection regulations do not apply to this Final Rule.

F. Unfunded Mandates Reform Act of 1995

The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) generally requires Federal agencies to examine closely the impacts of regulatory actions on State, local, and tribal governments. Section 101(5) of title I of that law defines a Federal intergovernmental mandate to include any regulation that would impose upon State, local, or tribal governments an enforceable duty, except a condition of Federal assistance or a duty arising from participating in a voluntary Federal program. Title II of that law requires each Federal agency to assess the effects of Federal regulatory actions on State, local, and tribal governments, in the aggregate, or to the private sector, other than to the extent such actions merely incorporate requirements specifically set forth in a statute. Section 202 of that title requires a Federal agency to perform a detailed assessment of the anticipated costs and benefits of any rule that includes a Federal mandate that may result in costs to State, local, or tribal governments, or to the private sector, of $100 million or more in any one year (adjusted annually for inflation). 2 U.S.C. 1532(a) and (b). Section 204 of that title requires each agency that proposes a rule containing a significant Federal intergovernmental mandate to develop an effective process for obtaining meaningful and timely input from elected officers of State, local, and tribal governments. 2 U.S.C. 1534.

This rule will not result in the expenditure by State, local, and tribal governments in the aggregate, or by the private sector, of $100 million or more in any one year. Accordingly, no assessment or analysis is required under the Unfunded Mandates Reform Act of 1995.

G. Treasury and General Government Appropriations Act, 1999

Section 654 of the Treasury and General Government Appropriations Act, 1999 (Pub. L. 105-277) requires Federal agencies to issue a Family Policymaking Assessment for any rule that may affect family well-being. This rule will not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has concluded that it is not necessary to prepare a Family Policymaking Assessment.

H. Executive Order 13132

Executive Order 13132, “Federalism,” 64 FR 43255 (Aug. 4, 1999), imposes certain requirements on agencies formulating and implementing policies or regulations that preempt State law or that have Federalism implications. Agencies are required to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and carefully assess the necessity for such actions. DOE has examined the rule and has determined that it will not preempt State law and will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. No further action is required by Executive Order 13132.

I. Executive Order 12988

With respect to the review of existing regulations and the promulgation of new regulations, section 3(a) of Executive Order 12988, “Civil Justice Reform,” 61 FR 4729 (Feb. 7, 1996), imposes on Executive agencies the general duty to adhere to the following requirements: (1) Eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; and (3) provide a clear legal standard for affected conduct rather than a general standard and promote simplification and burden reduction. Section 3(b)(2) of Executive Order 12988 specifically requires that Executive agencies make every reasonable effort to ensure that the regulation: (1) Clearly specifies the preemptive effect, if any, to be given to the regulation; (2) clearly specifies any effect on existing Federal law or regulation; (3) provides a clear legal standard for affected conduct while promoting simplification and burden reduction; (4) specifies the retroactive effect, if any, to be given to the regulation; (5) defines key terms; and (6) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of Executive Order 12988 requires Executive agencies to review regulations in light of applicable standards in section 3(a) and section 3(b) to determine whether they are met or it is unreasonable to meet one or more of the standards. DOE has completed the required review and determined that, to the extent permitted by law, the rule meets the relevant standards of Executive Order 12988.

J. Treasury and General Government Appropriations Act, 2001

The Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516 note) provides for agencies to review most disseminations of information to the public under guidelines established by each agency pursuant to general guidelines issued by OMB.

OMB's guidelines were published at 67 FR 8452 (Feb. 22, 2002), and DOE's guidelines were published at 67 FR 62446 (Oct. 7, 2002). DOE has reviewed this rule under the OMB and DOE guidelines and has concluded that it is consistent with applicable policies in those guidelines.

K. Executive Order 13211

Executive Order 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 22, 2001), requires Federal agencies to prepare and submit to the OMB a Statement of Energy Effects for any proposed significant energy action. A “significant energy action” is defined as any action by an agency that promulgated or is expected to lead to promulgation of a final rule, and that (1) is a significant regulatory action under Executive Order 12866, or any successor order and is likely to have a significant adverse effect on the supply, distribution, or use of energy; or (2) is designated by the Administrator of the OIRA as a significant energy action. For any proposed significant energy action, the agency must give a detailed statement of any adverse effects on energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution, and use. This regulatory action will not have a significant adverse effect on the supply, distribution, or use of energy because it is concerned primarily with the procedures for designating, protecting, and sharing information. As the FAST Act highlighted, protection of CEII will have a positive effect on the energy supply, and is therefore not a significant energy action. Accordingly, DOE has not prepared a Statement of Energy Effects.

L. Congressional Notification

As required by 5 U.S.C. 801, DOE will submit to Congress a report regarding the issuance of this final rule prior to the effective date set forth at the outset of this rulemaking. The report will state that it has been determined that the rule is not a “major rule” as defined by 5 U.S.C. 801(2).

IV. Approval of the Office of the Secretary

The Secretary of Energy has approved publication of this final rulemaking.

List of Subjects in 10 CFR Part 1004

• Freedom of Information

For the reasons set out in the preamble, the DOE amends part 1004 of title 10, Code of Federal Regulations as set forth below:

PART 1004—FREEDOM OF INFORMATION ACT (FOIA)

1. The authority citation for part 1004 is revised to read as follows:

Authority: 5 U.S.C. 552; 16 U.S.C. 824o-1.

2. Add § 1004.13 to read as follows:

Footnotes